Merge pull request #2624 from onaio/security-updates-20240627

Security updates 27/06/2024
onaio · Jul 2, 2024 · 067bb5d · 067bb5d
2 parents 270417b + e30bb03
commit 067bb5d
Show file tree

Hide file tree

Showing 7 changed files with 110 additions and 94 deletions.
diff --git a/docker/onadata-uwsgi/Dockerfile.ubuntu b/docker/onadata-uwsgi/Dockerfile.ubuntu
@@ -53,7 +53,7 @@ RUN python -m pip install --no-cache-dir -r requirements/docs.pip && \
     make -C docs html
 
 
-FROM ubuntu:jammy-20240405 AS runtime
+FROM ubuntu:jammy-20240530 as runtime
 
 ENV DEBIAN_FRONTEND=noninteractive
 

diff --git a/requirements/azure.pip b/requirements/azure.pip
@@ -6,23 +6,23 @@
 #
 asgiref==3.8.1
     # via django
-azure-core==1.30.1
+azure-core==1.30.2
     # via
     #   azure-storage-blob
     #   django-storages
-azure-storage-blob==12.19.1
+azure-storage-blob==12.20.0
     # via django-storages
-certifi==2024.2.2
+certifi==2024.6.2
     # via requests
 cffi==1.16.0
     # via cryptography
 charset-normalizer==3.3.2
     # via requests
-cryptography==42.0.6
+cryptography==42.0.8
     # via
     #   -r requirements/azure.in
     #   azure-storage-blob
-django==4.2.11
+django==4.2.13
     # via
     #   -r requirements/azure.in
     #   django-storages
@@ -34,17 +34,18 @@ isodate==0.6.1
     # via azure-storage-blob
 pycparser==2.22
     # via cffi
-requests==2.31.0
+requests==2.32.3
     # via azure-core
 six==1.16.0
     # via
     #   azure-core
     #   isodate
 sqlparse==0.5.0
     # via django
-typing-extensions==4.11.0
+typing-extensions==4.12.2
     # via
+    #   asgiref
     #   azure-core
     #   azure-storage-blob
-urllib3==2.2.1
+urllib3==2.2.2
     # via requests
diff --git a/requirements/base.pip b/requirements/base.pip
@@ -16,6 +16,8 @@ asgiref==3.8.1
     # via
     #   django
     #   django-cors-headers
+async-timeout==4.0.3
+    # via redis
 attrs==23.2.0
     # via
     #   jsonlines
@@ -25,9 +27,9 @@ backoff==1.10.0
     # via analytics-python
 billiard==4.2.0
     # via celery
-boto3==1.34.98
+boto3==1.34.134
     # via dataflows-tabulator
-botocore==1.34.98
+botocore==1.34.134
     # via
     #   boto3
     #   s3transfer
@@ -37,7 +39,7 @@ cachetools==5.3.3
     # via google-auth
 celery==5.4.0
     # via onadata
-certifi==2024.2.2
+certifi==2024.6.2
     # via
     #   requests
     #   sentry-sdk
@@ -64,7 +66,7 @@ click-plugins==1.1.1
     # via celery
 click-repl==0.3.0
     # via celery
-cryptography==42.0.6
+cryptography==42.0.8
     # via
     #   jwcrypto
     #   onadata
@@ -84,7 +86,7 @@ deprecated==1.2.14
     # via onadata
 dict2xml==1.7.5
     # via onadata
-django==4.2.11
+django==4.2.13
     # via
     #   django-activity-stream
     #   django-cors-headers
@@ -105,11 +107,11 @@ django==4.2.11
     #   onadata
 django-activity-stream==2.0.0
     # via onadata
-django-cors-headers==4.3.1
+django-cors-headers==4.4.0
     # via onadata
 django-csp==3.8
     # via onadata
-django-debug-toolbar==4.3.0
+django-debug-toolbar==4.4.2
     # via onadata
 django-digest @ git+https://github.com/onaio/django-digest.git@6bf61ec08502fd3545d4f2c0838b6cb15e7ffa92
     # via -r requirements/base.in
@@ -123,7 +125,7 @@ django-multidb-router @ git+https://github.com/onaio/django-multidb-router.git@f
     # via -r requirements/base.in
 django-nose==1.4.7
     # via onadata
-django-oauth-toolkit==2.3.0
+django-oauth-toolkit==2.4.0
     # via onadata
 django-ordered-model==3.7.4
     # via onadata
@@ -141,7 +143,7 @@ django-taggit==5.0.1
     # via onadata
 django-templated-email==3.0.1
     # via onadata
-djangorestframework==3.15.1
+djangorestframework==3.15.2
     # via
     #   djangorestframework-csv
     #   djangorestframework-gis
@@ -155,15 +157,15 @@ djangorestframework-gis==1.0
     # via onadata
 djangorestframework-guardian==0.3.0
     # via onadata
-djangorestframework-jsonapi==7.0.0
+djangorestframework-jsonapi==7.0.1
     # via onadata
 djangorestframework-jsonp==1.0.2
     # via onadata
 djangorestframework-xml==2.0.0
     # via onadata
 dnspython==2.6.1
     # via pymongo
-dpath==2.1.6
+dpath==2.2.0
     # via onadata
 elaphe3==0.2.0
     # via onadata
@@ -175,7 +177,7 @@ future==1.0.0
     # via python-json2xlsclient
 geojson==3.1.0
     # via onadata
-google-auth==2.29.0
+google-auth==2.30.0
     # via
     #   google-auth-oauthlib
     #   onadata
@@ -189,7 +191,7 @@ httplib2==0.22.0
     # via onadata
 idna==3.7
     # via requests
-ijson==3.2.3
+ijson==3.3.0
     # via dataflows-tabulator
 inflection==0.5.1
     # via djangorestframework-jsonapi
@@ -201,9 +203,9 @@ jmespath==1.0.1
     #   botocore
 jsonlines==4.0.0
     # via dataflows-tabulator
-jsonpickle==3.0.4
+jsonpickle==3.2.2
     # via onadata
-jsonpointer==2.4
+jsonpointer==3.0.0
     # via datapackage
 jsonschema==4.22.0
     # via
@@ -217,7 +219,7 @@ kombu==5.3.7
     # via celery
 linear-tsv==1.1.0
     # via dataflows-tabulator
-lxml==5.2.1
+lxml==5.2.2
     # via onadata
 markdown==3.6
     # via onadata
@@ -227,7 +229,7 @@ monotonic==1.6
     # via analytics-python
 nose==1.3.7
     # via django-nose
-numpy==1.26.4
+numpy==2.0.0
     # via onadata
 oauthlib==3.2.2
     # via
@@ -246,7 +248,7 @@ pillow==10.3.0
     # via
     #   elaphe3
     #   onadata
-prompt-toolkit==3.0.43
+prompt-toolkit==3.0.47
     # via click-repl
 psycopg2-binary==2.9.9
     # via onadata
@@ -266,7 +268,7 @@ pyjwt==2.8.0
     #   onadata
 pylibmc==1.6.3
     # via onadata
-pymongo==4.7.1
+pymongo==4.8.0
     # via onadata
 pyparsing==3.1.2
     # via httplib2
@@ -286,6 +288,7 @@ python-memcached==1.62
     # via onadata
 pytz==2024.1
     # via
+    #   django-oauth-toolkit
     #   django-query-builder
     #   fleming
 pyxform==2.0.3
@@ -294,15 +297,15 @@ pyxform==2.0.3
     #   pyfloip
 recaptcha-client==1.0.6
     # via onadata
-redis==5.0.4
+redis==5.0.7
     # via
     #   django-redis
     #   onadata
 referencing==0.35.1
     # via
     #   jsonschema
     #   jsonschema-specifications
-requests==2.31.0
+requests==2.32.3
     # via
     #   analytics-python
     #   dataflows-tabulator
@@ -317,13 +320,13 @@ requests-oauthlib==2.0.0
     # via google-auth-oauthlib
 rfc3986==2.0.0
     # via tableschema
-rpds-py==0.18.0
+rpds-py==0.18.1
     # via
     #   jsonschema
     #   referencing
 rsa==4.9
     # via google-auth
-s3transfer==0.10.1
+s3transfer==0.10.2
     # via boto3
 sentry-sdk==1.45.0
     # via onadata
@@ -339,34 +342,35 @@ six==1.16.0
     #   linear-tsv
     #   python-dateutil
     #   tableschema
-sqlalchemy==2.0.30
+sqlalchemy==2.0.31
     # via dataflows-tabulator
 sqlparse==0.5.0
     # via
     #   django
     #   django-debug-toolbar
 tableschema==1.20.11
     # via datapackage
-typing-extensions==4.11.0
+typing-extensions==4.12.2
     # via
+    #   asgiref
     #   jwcrypto
     #   sqlalchemy
 tzdata==2024.1
     # via celery
-ujson==5.9.0
+ujson==5.10.0
     # via onadata
 unicodecsv==0.14.1
     # via
     #   dataflows-tabulator
     #   datapackage
     #   onadata
     #   tableschema
-urllib3==2.2.1
+urllib3==2.2.2
     # via
     #   botocore
     #   requests
     #   sentry-sdk
-uwsgi==2.0.25.1
+uwsgi==2.0.26
     # via onadata
 vine==5.1.0
     # via