mirror of
https://github.com/ansible/awx.git
synced 2026-10-29 22:03:20 -02:30
Rodrigo Toshiaki Horie
5333d0d1f9
* Bump PyJWT to address CVE-2026-102268 Pin PyJWT>=2.14.0 in requirements.in to address CVE-2026-102268 (authentication bypass via improper public key validation). Regenerated requirements.txt via make docker_update_requirements. Assisted-By: Claude Code Signed-off-by: Rodrigo Horie <rodrigo.horie@hotmail.com> * Use a 32+ byte HMAC key in workload identity tests PyJWT >= 2.11 emits InsecureKeyLengthWarning for HS256 keys shorter than 32 bytes, which pytest's filterwarnings=error turns into an exception that populate_workload_identity_tokens swallows, so the Gateway request is never made. Assisted-By: Claude Code Signed-off-by: Rodrigo Horie <rodrigo.horie@hotmail.com> --------- Signed-off-by: Rodrigo Horie <rodrigo.horie@hotmail.com>
80 lines
2.2 KiB
Plaintext
80 lines
2.2 KiB
Plaintext
aiohttp>=3.14.3
|
|
ansi2html # Used to format the stdout from jobs into html for display
|
|
jq # used for indirect host counting feature
|
|
asn1
|
|
azure-identity
|
|
azure-keyvault
|
|
boto3
|
|
botocore
|
|
cachetools # Used by awx/conf/settings.py for TTLCache
|
|
channels
|
|
channels-redis
|
|
cryptography
|
|
Cython
|
|
daphne>=4.2.2
|
|
distro
|
|
django>=5.2.17,<5.3 # Django 5.2 LTS, allow patch updates, CVE-2026-15307
|
|
django-cors-headers
|
|
django-crum
|
|
django-extensions
|
|
django-guid
|
|
django-polymorphic
|
|
django-solo
|
|
djangorestframework==3.15.2 # upgrading to 3.16+ throws NOT_REQUIRED_DEFAULT error on required fields in serializer that have no default
|
|
djangorestframework-yaml
|
|
drf-spectacular>=0.27.0
|
|
dynaconf
|
|
filelock
|
|
GitPython>=3.1.60 # CVE-2026-87817
|
|
grpcio
|
|
irc
|
|
jinja2>=3.1.6 # CVE-2025-27516
|
|
JSON-log-formatter
|
|
jsonschema
|
|
Markdown # used for formatting API help
|
|
maturin # pydantic-core build dep
|
|
msgpack
|
|
msrestazure
|
|
OPA-python-client==2.0.2 # upgrading requires urllib3 2.5.0+ which is blocked by other deps
|
|
kubernetes>=36.0.2 # fixes NO_PROXY silently being reset to None
|
|
openshift
|
|
opentelemetry-api~=1.37 # new y streams can be drastically different, in a good way
|
|
opentelemetry-sdk~=1.37
|
|
opentelemetry-instrumentation-logging
|
|
opentelemetry-exporter-otlp
|
|
pexpect
|
|
prometheus-client
|
|
psycopg
|
|
psutil
|
|
pyasn1>=0.6.2 # CVE-2026-2349
|
|
pygerduty
|
|
PyGithub
|
|
PyJWT>=2.14.0 # CVE-2026-102268
|
|
pyopenssl
|
|
pyparsing>3.0 # Upgraded to v3 and changed import patterns
|
|
python-daemon
|
|
python-dsv-sdk>=1.0.4
|
|
python-tss-sdk>=1.2.1
|
|
pyyaml>=6.0.2 # require packing fix for cython 3 or higher
|
|
pyzstd # otel collector log file compression library
|
|
receptorctl
|
|
sqlparse>=0.6.0 # CVE-2026-59893
|
|
redis[hiredis]>=7.0 # requires 7.0+ for retry functionality on connection errors
|
|
requests
|
|
slack-sdk
|
|
twilio
|
|
twisted[tls]>=24.7.0 # CVE-2024-41810
|
|
urllib3>=2.6.3 # CVE-2024-37891
|
|
uWSGI>=2.0.28
|
|
uwsgitop
|
|
wheel>=0.46.2 # CVE-2026-24049
|
|
pip==25.3 # see UPGRADE BLOCKERs
|
|
setuptools==80.9.0 # see UPGRADE BLOCKERs
|
|
setuptools-scm[toml]
|
|
setuptools-rust>=0.11.4 # cryptography build dep
|
|
pkgconfig>=1.5.1 # xmlsec build dep - needed for offline build
|
|
django-flags>=5.0.13
|
|
dispatcherd[pg-notify] # tasking system, previously part of AWX code base
|
|
protobuf>=4.25.8 # CVE-2025-4565
|
|
idna>=3.10 # CVE-2024-3651
|