Merge pull request #2407 from ASFHyP3/develop

Release v7.8.1
ASFHyP3 · Sep 3, 2024 · 35eb668 · 35eb668
2 parents 9b75b01 + 38d8727
commit 35eb668
Show file tree

Hide file tree

Showing 6 changed files with 12 additions and 8 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [7.8.1]
+
+### Fixed
+- Upgraded to flask-cors v5.0.0 from v4.0.1. Resolves [CVE-2024-6221](https://github.com/ASFHyP3/hyp3/security/dependabot/17).
 
 ## [7.8.0]
 

diff --git a/requirements-all.txt b/requirements-all.txt
@@ -5,7 +5,7 @@
 -r requirements-apps-start-execution-worker.txt
 -r requirements-apps-disable-private-dns.txt
 -r requirements-apps-update-db.txt
-boto3==1.35.6
+boto3==1.35.10
 jinja2==3.1.4
 moto[dynamodb]==5.0.12
 pytest==8.3.2
@@ -15,6 +15,6 @@ flake8==7.1.1
 flake8-import-order==0.18.2
 flake8-blind-except==0.2.1
 flake8-builtins==2.5.0
-setuptools==73.0.1
+setuptools==74.1.0
 openapi-spec-validator==0.7.1
-cfn-lint==1.10.3
+cfn-lint==1.11.1
diff --git a/requirements-apps-api.txt b/requirements-apps-api.txt
@@ -1,7 +1,7 @@
 flask==2.2.5
-Flask-Cors==4.0.1
+Flask-Cors==5.0.0
 jsonschema==4.23.0
-openapi-core==0.19.3
+openapi-core==0.19.4
 prance==23.6.21.0
 PyJWT==2.9.0
 requests==2.32.3

diff --git a/requirements-apps-disable-private-dns.txt b/requirements-apps-disable-private-dns.txt
@@ -1 +1 @@
-boto3==1.35.6
+boto3==1.35.10
diff --git a/requirements-apps-start-execution-manager.txt b/requirements-apps-start-execution-manager.txt
@@ -1,3 +1,3 @@
-boto3==1.35.6
+boto3==1.35.10
 ./lib/dynamo/
 ./lib/lambda_logging/
diff --git a/requirements-apps-start-execution-worker.txt b/requirements-apps-start-execution-worker.txt
@@ -1,2 +1,2 @@
-boto3==1.35.6
+boto3==1.35.10
 ./lib/lambda_logging/