Pin vulnerable dependencies

- certifi@^2023.7.22 and cryptography@^41.0.2 - Added a section to pyproject.toml to house pinned deps + the reason why they're pinned
cds-snc · Nov 20, 2023 · e436710 · e436710
1 parent 3bf74e5
commit e436710
Show file tree

Hide file tree

Showing 2 changed files with 43 additions and 25 deletions.
diff --git a/poetry.lock b/poetry.lock
diff --git a/pyproject.toml b/pyproject.toml
@@ -38,7 +38,6 @@ click-datetime = "0.2"
 gevent = "23.9.0"
 gunicorn = "20.1.0"
 iso8601 = "2.0.0"
-idna = "2.10" # pinned to align with test moto dependency requirements (for <=2.9)
 jsonschema = "3.2.0"
 marshmallow-sqlalchemy = "0.29.0"
 marshmallow = "3.20.1"
@@ -71,6 +70,11 @@ typing-extensions = "4.7.1"
 greenlet = "2.0.2"
 simple-salesforce = "^1.12.3"
 
+# Pinned dependencies
+certifi = "^2023.7.22" # pinned for security reasons: https://github.com/cds-snc/notification-api/security/dependabot/119
+cryptography = "^41.0.2" # pinned for security reasons: https://github.com/cds-snc/notification-api/security/dependabot/118
+idna = "2.10" # pinned to align with test moto dependency requirements (for <=2.9)
+
 [tool.poetry.group.test.dependencies]
 flake8 = "6.1.0"
 isort = "5.12.0"