mirror of
https://github.com/apache/superset.git
synced 2026-04-07 18:35:15 +00:00
51 lines
2.1 KiB
Plaintext
51 lines
2.1 KiB
Plaintext
#
|
|
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
#
|
|
# Security: CVE-2026-21441 - decompression bomb bypass on redirects
|
|
urllib3>=2.6.3,<3.0.0
|
|
# Security: GHSA-87hc-h4r5-73f7 - Windows path traversal fix
|
|
werkzeug>=3.1.5,<4.0.0
|
|
# Security: CVE-2025-68146 - TOCTOU symlink vulnerability
|
|
filelock>=3.20.3,<4.0.0
|
|
# Security: decompression bomb fix (required by aiohttp 3.13.3)
|
|
brotli>=1.2.0,<2.0.0
|
|
numexpr>=2.9.0
|
|
|
|
# 5.0.0 has a sensitive deprecation used in other libs
|
|
# -> https://github.com/aio-libs/async-timeout/blob/master/CHANGES.rst#500-2024-10-31
|
|
async_timeout>=4.0.0,<5.0.0
|
|
|
|
# Known issue with 6.7.0 breaking a unit test, probably easy to fix, but will require
|
|
# a bit of attention to bump.
|
|
apispec>=6.0.0,<6.7.0
|
|
|
|
# 1.4.1 appears to use much more memory, where the python test suite runs out of memory
|
|
# causing CI to fail. 1.4.0 is the last version that works.
|
|
# https://marshmallow-sqlalchemy.readthedocs.io/en/latest/changelog.html#id3
|
|
# Opened this issue https://github.com/marshmallow-code/marshmallow-sqlalchemy/issues/665
|
|
marshmallow-sqlalchemy>=1.3.0,<1.4.1
|
|
|
|
# needed for python 3.12 support
|
|
openapi-schema-validator>=0.6.3
|
|
|
|
# Pin setuptools <81 until all dependencies migrate from pkg_resources to importlib.metadata
|
|
# pkg_resources is deprecated and will be removed in setuptools 81+ (around 2025-11-30)
|
|
# Known affected packages: Preset's 'clients' package
|
|
# See docs/docs/contributing/pkg-resources-migration.md for details
|
|
setuptools<81
|