pyproject: add, pin requests (#605)

* pyproject: add, pin requests Signed-off-by: William Woodruff <william@trailofbits.com> * pyproject: NOTE Signed-off-by: William Woodruff <william@trailofbits.com> * CHANGELOG: record changes Signed-off-by: William Woodruff <william@trailofbits.com> * pyproject: relax Signed-off-by: William Woodruff <william@trailofbits.com> * pyproject: fix dep comment Signed-off-by: William Woodruff <william@trailofbits.com> --------- Signed-off-by: William Woodruff <william@trailofbits.com>
pypa · May 3, 2023 · 5955d52 · 5955d52
1 parent 2b03cba
commit 5955d52
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -37,6 +37,9 @@ All versions prior to 0.0.9 are untracked.
 * Fixed a crash caused by invalid UTF-8 sequences in subprocess outputs
   ([#572](https://github.com/pypa/pip-audit/pull/572))
 
+* Fixed a crash caused by incompatible dependency changes
+  ([#605](https://github.com/pypa/pip-audit/pull/605))
+
 ## [2.5.2]
 
 ### Fixed

diff --git a/pyproject.toml b/pyproject.toml
@@ -35,6 +35,10 @@ dependencies = [
     "packaging>=23.0.0",                     # https://github.com/pypa/pip-audit/issues/464
     "pip-api>=0.0.28",
     "pip-requirements-parser>=32.0.0",
+    # NOTE(ww): urllib3 2.0 and higher are incompatible with CacheControl;
+    # we prevent its use by using a version of requests that uses urllib3 < 2.0.
+    # See: https://github.com/psf/requests/issues/6437
+    "requests<2.30",
     "rich>=12.4",
     "toml>=0.10",
 ]