Merge pull request #621 from crim-ca/gunicorn

crim-ca · Apr 29, 2024 · 30d1889 · 30d1889
2 parents 60442fa + f3e738d
commit 30d1889
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 3 deletions.
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -12,7 +12,7 @@ Changes
 
 Changes:
 --------
-- No change.
+- Pin ``gunicorn>=22`` to address CVE-2024-1135.
 
 Fixes:
 ------

diff --git a/requirements.txt b/requirements.txt
@@ -40,9 +40,8 @@ esgf-compute-api @ git+https://github.com/ESGF/[email protected]
 # (https://github.com/KipCrossing/geotiff/pull/59)
 geotiff>=0.2.8
 # gunicorn >20 breaks some config.ini loading parameters (paste)
-# it is also only available for Python >=3.5
 # use pserve to continue supporting config.ini with paste settings
-gunicorn>=20.0.4
+gunicorn>=22
 # reduced dependencies contrains to let packages update to latest (https://github.com/vinitkumar/json2xml/issues/157)
 # even more reduced dependency constraints (https://github.com/vinitkumar/json2xml/pull/195)
 json2xml>=4.1.0