StackStorm · dependabot · Jul 17, 2021 · Aug 11, 2021 · Sep 15, 2022 · Sep 15, 2022
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -572,7 +572,7 @@ jobs:
       #  Once you are done debugging in your SSH session, simply: touch /continue
       #  and this will continue the build.
       #
-      # - name: Setup tmate session for debugging failed jobs (allows SSH into the container)
-      #   uses: mxschmitt/action-tmate@v3
-      #   if: "${{ failure() }}"
+      #- name: Setup tmate session for debugging failed jobs (allows SSH into the container)
+      #  uses: mxschmitt/action-tmate@v3
+      #  if: "${{ failure() }}"
       #
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -92,6 +92,8 @@ Added
 Changed
 ~~~~~~~
 
+* Security update for eventlet to 0.31.0.  https://github.com/eventlet/eventlet/security/advisories/GHSA-9p9m-jm8w-94p2
+
 * BREAKING CHANGE for anyone that uses ``output_schema``, which is disabled by default.
   If you have ``[system].validate_output_schema = True`` in st2.conf AND you have added
   ``output_schema`` to any of your packs, then you must update your action metadata.

diff --git a/fixed-requirements.txt b/fixed-requirements.txt
@@ -8,16 +8,14 @@ cffi<1.15.0
 # NOTE: 2.0 version breaks pymongo work with hosts
 dnspython>=1.16.0,<2.0.0
 cryptography==3.4.7
-# Note: 0.20.0 removed select.poll() on which some of our code and libraries we
-# depend on rely
-eventlet==0.30.2
+eventlet==0.33.3
 flex==6.14.1
 gitpython==3.1.15
 # Needed by gitpython, old versions used to bundle it
 gitdb==4.0.2
 # Note: greenlet is used by eventlet
 greenlet==1.0.0
-gunicorn==20.1.0
+#gunicorn==20.1.0
 jsonpath-rw==1.4.0
 jsonschema==2.6.0
 kombu==5.0.2

diff --git a/requirements-pants.txt b/requirements-pants.txt
@@ -18,7 +18,9 @@ gitdb
 gitpython
 # st2common/tests/integration/test_util_green.py requires greenlet (as does eventlet)
 greenlet
-gunicorn
+# use a commit hash from master branch until gunicorn 0.21 is released:
+# https://github.com/benoitc/gunicorn/issues/2638
+gunicorn @ git+https://github.com/benoitc/gunicorn.git@792edf6d9aabcbfb84e76be1d722ac49c32dc027
 jinja2
 jsonpath-rw
 jsonschema

diff --git a/requirements.txt b/requirements.txt
@@ -17,12 +17,12 @@ ciso8601
 cryptography==3.4.7
 decorator==4.4.2
 dnspython>=1.16.0,<2.0.0
-eventlet==0.30.2
+eventlet==0.33.3
 flex==6.14.1
 gitdb==4.0.2
 gitpython==3.1.15
 greenlet==1.0.0
-gunicorn==20.1.0
+gunicorn@ git+https://github.com/benoitc/gunicorn.git@792edf6d9aabcbfb84e76be1d722ac49c32dc027
 importlib-metadata==3.10.1
 jinja2==2.11.3
 jsonpath-rw==1.4.0

diff --git a/st2actions/requirements.txt b/st2actions/requirements.txt
@@ -8,7 +8,7 @@
 MarkupSafe<2.1.0,>=0.23
 apscheduler==3.7.0
 chardet<3.1.0
-eventlet==0.30.2
+eventlet==0.33.3
 gitpython==3.1.15
 jinja2==2.11.3
 kombu==5.0.2

diff --git a/st2api/in-requirements.txt b/st2api/in-requirements.txt
@@ -9,5 +9,5 @@ oslo.utils
 pyparsing
 pymongo
 six
-gunicorn
+gunicorn@ git+https://github.com/benoitc/gunicorn.git@792edf6d9aabcbfb84e76be1d722ac49c32dc027
 simplejson
diff --git a/st2api/requirements.txt b/st2api/requirements.txt
@@ -5,8 +5,8 @@
 # If you want to update depdencies for a single component, modify the
 # in-requirements.txt for that component and then run 'make requirements' to
 # update the component requirements.txt
-eventlet==0.30.2
-gunicorn==20.1.0
+eventlet==0.33.3
+gunicorn@ git+https://github.com/benoitc/gunicorn.git@792edf6d9aabcbfb84e76be1d722ac49c32dc027
 jsonschema==2.6.0
 kombu==5.0.2
 mongoengine==0.23.0

diff --git a/st2auth/in-requirements.txt b/st2auth/in-requirements.txt
@@ -9,4 +9,4 @@ stevedore
 # For backward compatibility reasons, flat file backend is installed by default
 st2-auth-backend-flat-file@ git+https://github.com/StackStorm/st2-auth-backend-flat-file.git@master
 st2-auth-ldap@ git+https://github.com/StackStorm/st2-auth-ldap.git@master
-gunicorn
+gunicorn@ git+https://github.com/benoitc/gunicorn.git@792edf6d9aabcbfb84e76be1d722ac49c32dc027
diff --git a/st2auth/requirements.txt b/st2auth/requirements.txt
@@ -6,8 +6,8 @@
 # in-requirements.txt for that component and then run 'make requirements' to
 # update the component requirements.txt
 bcrypt==3.2.0
-eventlet==0.30.2
-gunicorn==20.1.0
+eventlet==0.33.3
+gunicorn@ git+https://github.com/benoitc/gunicorn.git@792edf6d9aabcbfb84e76be1d722ac49c32dc027
 oslo.config>=1.12.1,<1.13
 passlib==1.7.4
 pymongo==3.11.3

diff --git a/st2common/requirements.txt b/st2common/requirements.txt
@@ -14,7 +14,7 @@ ciso8601
 cryptography==3.4.7
 decorator==4.4.2
 dnspython>=1.16.0,<2.0.0
-eventlet==0.30.2
+eventlet==0.33.3
 flex==6.14.1
 gitdb==4.0.2
 gitpython==3.1.15

diff --git a/st2reactor/requirements.txt b/st2reactor/requirements.txt
@@ -6,7 +6,7 @@
 # in-requirements.txt for that component and then run 'make requirements' to
 # update the component requirements.txt
 apscheduler==3.7.0
-eventlet==0.30.2
+eventlet==0.33.3
 jsonpath-rw==1.4.0
 jsonschema==2.6.0
 kombu==5.0.2

diff --git a/st2stream/in-requirements.txt b/st2stream/in-requirements.txt
@@ -9,4 +9,4 @@ oslo.utils
 pyparsing
 pymongo
 six
-gunicorn
+gunicorn@ git+https://github.com/benoitc/gunicorn.git@792edf6d9aabcbfb84e76be1d722ac49c32dc027
diff --git a/st2stream/requirements.txt b/st2stream/requirements.txt
@@ -5,8 +5,8 @@
 # If you want to update depdencies for a single component, modify the
 # in-requirements.txt for that component and then run 'make requirements' to
 # update the component requirements.txt
-eventlet==0.30.2
-gunicorn==20.1.0
+eventlet==0.33.1
+gunicorn@ git+https://github.com/benoitc/gunicorn.git@792edf6d9aabcbfb84e76be1d722ac49c32dc027
 jsonschema==2.6.0
 kombu==5.0.2
 mongoengine==0.23.0