⬆️🔒️ Upgrade security issue regarding h11 dependencies (#8052)

sanderegg · web-flow · commit 0fc43f757690 · 2025-07-07T10:13:00.000+02:00
diff --git a/packages/aws-library/requirements/_test.txt b/packages/aws-library/requirements/_test.txt
@@ -84,9 +84,9 @@ flexparser==0.4
     # via pint
 graphql-core==3.2.6
     # via moto
-h11==0.14.0
+h11==0.16.0
     # via httpcore
-httpcore==1.0.7
+httpcore==1.0.9
     # via httpx
 httpx==0.28.1
     # via
diff --git a/packages/service-integration/requirements/_base.in b/packages/service-integration/requirements/_base.in
@@ -13,5 +13,5 @@ jinja2_time
 jsonschema # pytest-plugin
 pytest # pytest-plugin
 pyyaml
-typer[all]
+typer
 yarl
diff --git a/packages/service-library/requirements/_fastapi.txt b/packages/service-library/requirements/_fastapi.txt
@@ -32,15 +32,15 @@ fastapi-cli==0.0.7
     # via fastapi
 fastapi-lifespan-manager==0.1.4
     # via -r requirements/_fastapi.in
-h11==0.14.0
+h11==0.16.0
     # via
     #   httpcore
     #   uvicorn
 h2==4.2.0
     # via httpx
 hpack==4.1.0
     # via h2
-httpcore==1.0.7
+httpcore==1.0.9
     # via httpx
 httptools==0.6.4
     # via uvicorn
diff --git a/packages/service-library/requirements/_test.txt b/packages/service-library/requirements/_test.txt
@@ -65,11 +65,11 @@ greenlet==3.1.1
     # via
     #   -c requirements/_aiohttp.txt
     #   sqlalchemy
-h11==0.14.0
+h11==0.16.0
     # via
     #   -c requirements/_fastapi.txt
     #   httpcore
-httpcore==1.0.7
+httpcore==1.0.9
     # via
     #   -c requirements/_fastapi.txt
     #   httpx
diff --git a/scripts/metrics/requirements.txt b/scripts/metrics/requirements.txt
@@ -1,5 +1,5 @@
 black
 httpx[http2]
-pydantic[email,dotenv]
+pydantic[email]
 pylint
-typer[all]
+typer
diff --git a/scripts/release/pyproject.toml b/scripts/release/pyproject.toml
@@ -8,7 +8,7 @@ version = "1.2.3"
 authors = [{name="Matus Drobuliak", email="drobuliak@itis.swiss" }]
 description = "Helper script for monitoring releases"
 readme = "README.md"
-dependencies = ["arrow", "python-dotenv","pydantic", "pydantic-settings", "typer[all]>=0.9", "rich", "requests"]
+dependencies = ["arrow", "python-dotenv","pydantic", "pydantic-settings", "typer>=0.9", "rich", "requests"]
 requires-python = ">=3.10"
 
 [project.scripts]
diff --git a/services/agent/requirements/_base.txt b/services/agent/requirements/_base.txt
@@ -112,15 +112,15 @@ googleapis-common-protos==1.69.1
     #   opentelemetry-exporter-otlp-proto-http
 grpcio==1.70.0
     # via opentelemetry-exporter-otlp-proto-grpc
-h11==0.14.0
+h11==0.16.0
     # via
     #   httpcore
     #   uvicorn
 h2==4.2.0
     # via httpx
 hpack==4.1.0
     # via h2
-httpcore==1.0.7
+httpcore==1.0.9
     # via httpx
 httptools==0.6.4
     # via uvicorn
diff --git a/services/agent/requirements/_test.txt b/services/agent/requirements/_test.txt
@@ -102,11 +102,11 @@ frozenlist==1.5.0
     #   aiosignal
 graphql-core==3.2.6
     # via moto
-h11==0.14.0
+h11==0.16.0
     # via
     #   -c requirements/_base.txt
     #   httpcore
-httpcore==1.0.7
+httpcore==1.0.9
     # via
     #   -c requirements/_base.txt
     #   httpx
diff --git a/services/api-server/requirements/_base.in b/services/api-server/requirements/_base.in
@@ -22,7 +22,7 @@ fastapi-pagination
 orjson
 packaging
 parse
-pydantic[dotenv]
+pydantic
 pyyaml
 tenacity
 typer
diff --git a/services/api-server/requirements/_base.txt b/services/api-server/requirements/_base.txt
@@ -207,15 +207,15 @@ greenlet==3.1.1
     # via sqlalchemy
 grpcio==1.68.1
     # via opentelemetry-exporter-otlp-proto-grpc
-h11==0.14.0
+h11==0.16.0
     # via
     #   httpcore
     #   uvicorn
 h2==4.2.0
     # via httpx
 hpack==4.1.0
     # via h2
-httpcore==1.0.7
+httpcore==1.0.9
     # via httpx
 httptools==0.6.4
     # via uvicorn
diff --git a/services/api-server/requirements/_test.txt b/services/api-server/requirements/_test.txt
@@ -123,12 +123,12 @@ greenlet==3.1.1
     # via
     #   -c requirements/_base.txt
     #   sqlalchemy
-h11==0.14.0
+h11==0.16.0
     # via
     #   -c requirements/_base.txt
     #   httpcore
     #   uvicorn
-httpcore==1.0.7
+httpcore==1.0.9
     # via
     #   -c requirements/_base.txt
     #   httpx
diff --git a/services/catalog/requirements/_base.in b/services/catalog/requirements/_base.in
@@ -19,6 +19,6 @@
 aiocache[redis,msgpack]
 asyncpg # database
 packaging
-pydantic[dotenv] # data models
+pydantic
 pyyaml
 tenacity
diff --git a/services/catalog/requirements/_base.txt b/services/catalog/requirements/_base.txt
@@ -124,15 +124,15 @@ greenlet==3.1.1
     # via sqlalchemy
 grpcio==1.71.0
     # via opentelemetry-exporter-otlp-proto-grpc
-h11==0.14.0
+h11==0.16.0
     # via
     #   httpcore
     #   uvicorn
 h2==4.2.0
     # via httpx
 hpack==4.1.0
     # via h2
-httpcore==1.0.7
+httpcore==1.0.9
     # via httpx
 httptools==0.6.4
     # via uvicorn
diff --git a/services/catalog/requirements/_test.txt b/services/catalog/requirements/_test.txt
@@ -58,11 +58,11 @@ greenlet==3.1.1
     # via
     #   -c requirements/_base.txt
     #   sqlalchemy
-h11==0.14.0
+h11==0.16.0
     # via
     #   -c requirements/_base.txt
     #   httpcore
-httpcore==1.0.7
+httpcore==1.0.9
     # via
     #   -c requirements/_base.txt
     #   httpx
diff --git a/services/datcore-adapter/requirements/_base.txt b/services/datcore-adapter/requirements/_base.txt
@@ -120,15 +120,15 @@ googleapis-common-protos==1.65.0
     #   opentelemetry-exporter-otlp-proto-http
 grpcio==1.66.0
     # via opentelemetry-exporter-otlp-proto-grpc
-h11==0.14.0
+h11==0.16.0
     # via
     #   httpcore
     #   uvicorn
 h2==4.1.0
     # via httpx
 hpack==4.0.0
     # via h2
-httpcore==1.0.5
+httpcore==1.0.9
     # via httpx
 httptools==0.6.4
     # via uvicorn
diff --git a/services/datcore-adapter/requirements/_test.txt b/services/datcore-adapter/requirements/_test.txt
@@ -29,11 +29,11 @@ execnet==2.1.1
     # via pytest-xdist
 faker==36.1.1
     # via -r requirements/_test.in
-h11==0.14.0
+h11==0.16.0
     # via
     #   -c requirements/_base.txt
     #   httpcore
-httpcore==1.0.5
+httpcore==1.0.9
     # via
     #   -c requirements/_base.txt
     #   httpx
diff --git a/services/director-v2/requirements/_base.in b/services/director-v2/requirements/_base.in
@@ -25,7 +25,7 @@ aiodocker
 networkx
 ordered-set
 orjson
-pydantic[dotenv]
+pydantic
 python-socketio
 redis
 rich
diff --git a/services/director/requirements/_base.txt b/services/director/requirements/_base.txt
@@ -111,15 +111,15 @@ googleapis-common-protos==1.66.0
     #   opentelemetry-exporter-otlp-proto-http
 grpcio==1.67.1
     # via opentelemetry-exporter-otlp-proto-grpc
-h11==0.14.0
+h11==0.16.0
     # via
     #   httpcore
     #   uvicorn
 h2==4.1.0
     # via httpx
 hpack==4.0.0
     # via h2
-httpcore==1.0.6
+httpcore==1.0.9
     # via httpx
 httptools==0.6.4
     # via uvicorn
diff --git a/services/director/requirements/_test.txt b/services/director/requirements/_test.txt
@@ -46,11 +46,11 @@ frozenlist==1.5.0
     #   -c requirements/_base.txt
     #   aiohttp
     #   aiosignal
-h11==0.14.0
+h11==0.16.0
     # via
     #   -c requirements/_base.txt
     #   httpcore
-httpcore==1.0.6
+httpcore==1.0.9
     # via
     #   -c requirements/_base.txt
     #   httpx
diff --git a/services/dynamic-scheduler/requirements/_base.in b/services/dynamic-scheduler/requirements/_base.in
@@ -18,5 +18,5 @@
 nicegui
 packaging
 python-socketio
-typer[all]
+typer
 u-msgpack-python
diff --git a/services/dynamic-scheduler/requirements/_base.txt b/services/dynamic-scheduler/requirements/_base.txt
@@ -130,7 +130,7 @@ greenlet==3.1.1
     # via sqlalchemy
 grpcio==1.70.0
     # via opentelemetry-exporter-otlp-proto-grpc
-h11==0.14.0
+h11==0.16.0
     # via
     #   httpcore
     #   uvicorn
@@ -139,7 +139,7 @@ h2==4.2.0
     # via httpx
 hpack==4.1.0
     # via h2
-httpcore==1.0.7
+httpcore==1.0.9
     # via httpx
 httptools==0.6.4
     # via uvicorn
diff --git a/services/dynamic-scheduler/requirements/_test.txt b/services/dynamic-scheduler/requirements/_test.txt
@@ -28,7 +28,7 @@ greenlet==3.1.1
     #   -c requirements/_base.txt
     #   playwright
     #   sqlalchemy
-h11==0.14.0
+h11==0.16.0
     # via
     #   -c requirements/_base.txt
     #   httpcore
@@ -42,7 +42,7 @@ hpack==4.1.0
     # via
     #   -c requirements/_base.txt
     #   h2
-httpcore==1.0.7
+httpcore==1.0.9
     # via
     #   -c requirements/_base.txt
     #   httpx
diff --git a/services/dynamic-sidecar/requirements/_base.txt b/services/dynamic-sidecar/requirements/_base.txt
@@ -179,7 +179,7 @@ greenlet==3.1.1
     # via sqlalchemy
 grpcio==1.70.0
     # via opentelemetry-exporter-otlp-proto-grpc
-h11==0.14.0
+h11==0.16.0
     # via
     #   httpcore
     #   uvicorn
@@ -188,7 +188,7 @@ h2==4.2.0
     # via httpx
 hpack==4.1.0
     # via h2
-httpcore==1.0.7
+httpcore==1.0.9
     # via httpx
 httptools==0.6.4
     # via uvicorn
diff --git a/services/invitations/requirements/_base.in b/services/invitations/requirements/_base.in
@@ -16,4 +16,4 @@
 
 cryptography
 packaging
-typer[all]
+typer
diff --git a/services/invitations/requirements/_base.txt b/services/invitations/requirements/_base.txt
@@ -127,15 +127,15 @@ googleapis-common-protos==1.69.1
     #   opentelemetry-exporter-otlp-proto-http
 grpcio==1.71.0
     # via opentelemetry-exporter-otlp-proto-grpc
-h11==0.14.0
+h11==0.16.0
     # via
     #   httpcore
     #   uvicorn
 h2==4.2.0
     # via httpx
 hpack==4.1.0
     # via h2
-httpcore==1.0.7
+httpcore==1.0.9
     # via httpx
 httptools==0.6.4
     # via uvicorn
diff --git a/services/invitations/requirements/_test.txt b/services/invitations/requirements/_test.txt
@@ -18,11 +18,11 @@ coverage==7.6.12
     #   pytest-cov
 faker==37.0.0
     # via -r requirements/_test.in
-h11==0.14.0
+h11==0.16.0
     # via
     #   -c requirements/_base.txt
     #   httpcore
-httpcore==1.0.7
+httpcore==1.0.9
     # via
     #   -c requirements/_base.txt
     #   httpx
diff --git a/services/notifications/requirements/_base.txt b/services/notifications/requirements/_base.txt
@@ -120,15 +120,15 @@ greenlet==3.1.1
     # via sqlalchemy
 grpcio==1.71.0
     # via opentelemetry-exporter-otlp-proto-grpc
-h11==0.14.0
+h11==0.16.0
     # via
     #   httpcore
     #   uvicorn
 h2==4.2.0
     # via httpx
 hpack==4.1.0
     # via h2
-httpcore==1.0.7
+httpcore==1.0.9
     # via httpx
 httptools==0.6.4
     # via uvicorn
diff --git a/services/notifications/requirements/_test.txt b/services/notifications/requirements/_test.txt
@@ -23,11 +23,11 @@ docker==7.1.0
     # via -r requirements/_test.in
 faker==37.1.0
     # via -r requirements/_test.in
-h11==0.14.0
+h11==0.16.0
     # via
     #   -c requirements/_base.txt
     #   httpcore
-httpcore==1.0.7
+httpcore==1.0.9
     # via
     #   -c requirements/_base.txt
     #   httpx
diff --git a/services/payments/requirements/_base.in b/services/payments/requirements/_base.in
@@ -22,4 +22,4 @@ packaging
 python-jose
 python-multipart
 python-socketio # notifier
-typer[all]
+typer
diff --git a/services/payments/requirements/_base.txt b/services/payments/requirements/_base.txt
diff --git a/services/payments/requirements/_test.txt b/services/payments/requirements/_test.txt
diff --git a/services/resource-usage-tracker/requirements/_base.in b/services/resource-usage-tracker/requirements/_base.in
diff --git a/services/resource-usage-tracker/requirements/_base.txt b/services/resource-usage-tracker/requirements/_base.txt
diff --git a/services/resource-usage-tracker/requirements/_test.txt b/services/resource-usage-tracker/requirements/_test.txt
diff --git a/services/storage/requirements/_base.in b/services/storage/requirements/_base.in
diff --git a/services/storage/requirements/_base.txt b/services/storage/requirements/_base.txt
diff --git a/services/storage/requirements/_test.txt b/services/storage/requirements/_test.txt
diff --git a/services/web/server/requirements/_base.txt b/services/web/server/requirements/_base.txt
diff --git a/services/web/server/requirements/_test.txt b/services/web/server/requirements/_test.txt
diff --git a/tests/e2e-playwright/requirements/_test.txt b/tests/e2e-playwright/requirements/_test.txt
diff --git a/tests/e2e-playwright/requirements/_test_wo_playwright.txt b/tests/e2e-playwright/requirements/_test_wo_playwright.txt
diff --git a/tests/public-api/requirements/_base.txt b/tests/public-api/requirements/_base.txt
diff --git a/tests/public-api/requirements/_test.txt b/tests/public-api/requirements/_test.txt
