Skip to content

Commit

Permalink
Loosen certifi version requirements (#45)
Browse files Browse the repository at this point in the history
Summary:
The certifi package has a "vulnerability" [0], asking us to update. Dependabot should take care of that, except it didn't:
```
  > updater | 2024/07/05 <job_852060501> Checking if certifi 2023.11.17 needs updating
  >   proxy | 2024/07/05  GET https://pypi.org:443/simple/certifi/
  >   proxy | 2024/07/05  200 https://pypi.org:443/simple/certifi/
  > updater | 2024/07/05 <job_852060501> Filtered out 2 yanked versions
  > updater | 2024/07/05 <job_852060501> Latest version is 2024.7.4
  > updater | 2024/07/05 <job_852060501> Requirements to unlock update_not_possible
  > updater | 2024/07/05 <job_852060501> Requirements update strategy lockfile_only
  > updater | 2024/07/05 <job_852060501> No update possible for certifi 2023.11.17
```

I suspect that reason is that it interprets the version as a SemVer specification and 2023 -> 2024 would be a major bump and it won't do that given our strategy.
It appears none of our Python code is actually depending on this package, so let's just remove it.

[0] https://github.com/facebookincubator/kernel-patches-daemon/security/dependabot/23

Pull Request resolved: #45

Reviewed By: danielocfb

Differential Revision: D59470231

fbshipit-source-id: d8209067d849e00ff9d858d05ddfc7cfe1530206
  • Loading branch information
d-e-s-o authored and facebook-github-bot committed Jul 8, 2024
1 parent 8a98b5d commit d20dba4
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
4 changes: 2 additions & 2 deletions poetry.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions pyproject.toml
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,11 @@ pygithub = "^1.59.0"
pyre-extensions = "^0.0.30"
opentelemetry-sdk = "^1.18.0"
python-dateutil = "^2.8.2"
# Explicitely include cryptography package
# Explicitly include cryptography package
# It's required for PyJWT which is dependency of PyGithub
# https://pyjwt.readthedocs.io/en/stable/installation.html#cryptographic-dependencies-optional
cryptography = "^42.0.0"
certifi = "^2023.7.22"
certifi = "*"

[tool.poetry.group.dev.dependencies]
freezegun = "^1.2.2"
Expand Down

0 comments on commit d20dba4

Please sign in to comment.