From 9030b910f5337e0ab54411355ea4224696e031d5 Mon Sep 17 00:00:00 2001 From: catborise Date: Sun, 11 Oct 2026 22:21:50 +0300 Subject: [PATCH] build(deps): idna, requests and urllib3 above their advisories django-bootstrap-icons (template tags; it downloads an icon missing from static/icon_cache) and websockify depend on requests, unpinned. On a host that already has python3-requests, the installer's venv kept the distro's idna, requests and urllib3 (Rocky 10: idna 3.7, urllib3 1.26.19; Ubuntu 24.04: idna 3.6, requests 2.31.0, urllib3 2.0.7), all with advisories, and the panel loads them with its templates. Checked in fresh Rocky 10 and Ubuntu 24.04 containers with python3-requests installed first: all three come from the venv. --- conf/requirements.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/conf/requirements.txt b/conf/requirements.txt index 30575d86..325e8d4f 100644 --- a/conf/requirements.txt +++ b/conf/requirements.txt @@ -7,6 +7,11 @@ django-auth-ldap==5.3.0 # the installer's venv can otherwise keep older distro copies (openSUSE 15.6) python-ldap>=3.4.5 pyasn1>=0.6.4 +# for django-bootstrap-icons and websockify; a host's python3-requests would +# otherwise bring idna, requests and urllib3 with advisories +idna>=3.15 +requests>=2.33.0 +urllib3>=2.8.0 django-axes==8.3.1 djangorestframework==3.18.3 drf-nested-routers==0.95.3