Upgrade "cryptography" to safe version

.. add a requirements-file "forced-upgrades.txt" to easily be able to upgrade a dependency's dependency without polluting "base.txt". "cryptopgraphy" is a dependency of "python-social-auth".
Uninett · Mar 15, 2021 · e8a50fb · e8a50fb
1 parent e765941
commit e8a50fb
Show file tree

Hide file tree

Showing 5 changed files with 13 additions and 12 deletions.
diff --git a/requirements-django30.txt b/requirements-django30.txt
@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile
 # To update, run:
 #
-#    pip-compile --output-file=requirements-django30.txt requirements/base.txt requirements/django30.txt
+#    pip-compile --output-file=requirements-django30.txt requirements/base.txt requirements/django30.txt requirements/forced-upgrade.txt
 #
 --index-url https://pypi.python.org/simple/
 
@@ -42,8 +42,9 @@ chardet==3.0.4
     # via requests
 constantly==15.1.0
     # via twisted
-cryptography==3.2.1
+cryptography==3.4.6
     # via
+    #   -r requirements/forced-upgrade.txt
     #   autobahn
     #   pyopenssl
     #   service-identity
@@ -153,7 +154,6 @@ service-identity==18.1.0
 six==1.15.0
     # via
     #   automat
-    #   cryptography
     #   jsonschema
     #   pyopenssl
     #   python-dateutil

diff --git a/requirements-django31.txt b/requirements-django31.txt
@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile
 # To update, run:
 #
-#    pip-compile --output-file=requirements-django31.txt requirements/base.txt requirements/django31.txt
+#    pip-compile --output-file=requirements-django31.txt requirements/base.txt requirements/django31.txt requirements/forced-upgrade.txt
 #
 --index-url https://pypi.python.org/simple/
 
@@ -42,8 +42,9 @@ chardet==3.0.4
     # via requests
 constantly==15.1.0
     # via twisted
-cryptography==3.2.1
+cryptography==3.4.6
     # via
+    #   -r requirements/forced-upgrade.txt
     #   autobahn
     #   pyopenssl
     #   service-identity
@@ -153,7 +154,6 @@ service-identity==18.1.0
 six==1.15.0
     # via
     #   automat
-    #   cryptography
     #   jsonschema
     #   pyopenssl
     #   python-dateutil

diff --git a/requirements.txt b/requirements.txt
@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile
 # To update, run:
 #
-#    pip-compile --output-file=requirements.txt requirements/prod.txt
+#    pip-compile --output-file=requirements.txt requirements/forced-upgrade.txt requirements/prod.txt
 #
 --index-url https://pypi.python.org/simple/
 
@@ -42,8 +42,9 @@ chardet==3.0.4
     # via requests
 constantly==15.1.0
     # via twisted
-cryptography==3.2.1
+cryptography==3.4.6
     # via
+    #   -r requirements/forced-upgrade.txt
     #   autobahn
     #   pyopenssl
     #   service-identity
@@ -153,7 +154,6 @@ service-identity==18.1.0
 six==1.15.0
     # via
     #   automat
-    #   cryptography
     #   jsonschema
     #   pyopenssl
     #   python-dateutil

diff --git a/requirements/forced-upgrade.txt b/requirements/forced-upgrade.txt
@@ -0,0 +1 @@
+cryptography>=3.3.2
diff --git a/tox.ini b/tox.ini
@@ -34,9 +34,9 @@ deps =
     pip-tools
 
 commands =
-    pip-compile --output-file requirements.txt requirements/prod.txt
-    pip-compile --output-file requirements-django30.txt requirements/django30.txt requirements/base.txt
-    pip-compile --output-file requirements-django31.txt requirements/django31.txt requirements/base.txt
+    pip-compile --output-file requirements.txt requirements/prod.txt requirements/forced-upgrade.txt
+    pip-compile --output-file requirements-django30.txt requirements/django30.txt requirements/base.txt requirements/forced-upgrade.txt
+    pip-compile --output-file requirements-django31.txt requirements/django31.txt requirements/base.txt requirements/forced-upgrade.txt
 
 [testenv:coverage-xml]
 basepython = python3.8