mirror of
https://github.com/hequan2017/seal.git
synced 2026-10-29 03:18:23 +08:00
fix: 修复 246 个 Dependabot 依赖漏洞
- requirements.txt 由 2019 年 pip freeze 快照重写为直接依赖清单（Python>=3.10） - Django 2.2.4 -> 5.2.16，DRF 3.9.2 -> 3.17.2，channels 2.2 -> 4.3，celery 4.1 -> 5.5 - 移除代码未使用的 apache-airflow/tornado/GitPython/numpy/thrift/lxml/SQLAlchemy/Mako/Werkzeug/gevent/autobahn/ipython 等历史依赖（含 system/tests.py 中的 airflow 示例） - 已停维的 django-rest-swagger/DRF coreapi 文档替换为 drf-spectacular - celery.platforms/C_FORCE_ROOT/CELERYBEAT_SCHEDULE 按 celery 5 规范迁移 - asgi.py 迁移至 channels 4 入口写法；graphene-django 升级至 3.x（schema 增加 fields） - static/js/jquery-3.1.1.min.js（XSS 漏洞）替换为 jquery-3.7.1 并更新模板引用
This commit is contained in:
hequan2017
198
requirements.txt
198
requirements.txt
@@ -1,154 +1,44 @@
|
||||
aioredis==1.2.0
|
||||
alembic==0.9.10
|
||||
amqp==2.4.2
|
||||
aniso8601==3.0.2
|
||||
anyjson==0.3.3
|
||||
apache-airflow==1.10.3
|
||||
argh==0.26.2
|
||||
asgi-redis==1.4.3
|
||||
asgiref==3.1.2
|
||||
asn1crypto==0.24.0
|
||||
async-timeout==3.0.1
|
||||
attrs==19.1.0
|
||||
autobahn==19.6.2
|
||||
Automat==0.7.0
|
||||
Babel==2.7.0
|
||||
backcall==0.1.0
|
||||
bcrypt==3.1.6
|
||||
billiard==3.5.0.5
|
||||
cachetools==3.1.1
|
||||
celery==4.1.1
|
||||
certifi==2018.11.29
|
||||
cffi==1.12.3
|
||||
channels==2.2.0
|
||||
channels-redis==2.4.0
|
||||
chardet==3.0.4
|
||||
Click==7.0
|
||||
colorama==0.4.1
|
||||
configparser==3.5.3
|
||||
constantly==15.1.0
|
||||
coreapi==2.3.3
|
||||
coreschema==0.0.4
|
||||
croniter==0.3.30
|
||||
cryptography==2.7
|
||||
daphne==2.3.0
|
||||
decorator==4.3.0
|
||||
defusedxml==0.6.0
|
||||
dill==0.2.9
|
||||
Django==2.2.4
|
||||
django-bootstrap3==11.0.0
|
||||
django-bootstrap4==0.0.7
|
||||
django-celery-beat==1.4.0
|
||||
django-celery-results==1.0.4
|
||||
django-cors-headers==2.5.2
|
||||
django-crispy-forms==1.7.2
|
||||
django-filter==2.1.0
|
||||
django-pure-pagination==0.3.0
|
||||
django-simpleui==2.1.2.603
|
||||
django-timezone-field==3.0
|
||||
djangorestframework==3.9.2
|
||||
docutils==0.14
|
||||
dramatiq==1.5.0
|
||||
flower==0.9.3
|
||||
funcsigs==1.0.0
|
||||
future==0.16.0
|
||||
gevent==1.4.0
|
||||
gitdb2==2.0.5
|
||||
GitPython==2.1.11
|
||||
google-auth==1.6.3
|
||||
graphene==2.1.3
|
||||
graphene-django==2.2.0
|
||||
graphql-core==2.1
|
||||
graphql-relay==0.4.5
|
||||
greenlet==0.4.15
|
||||
gunicorn==19.9.0
|
||||
hiredis==1.0.0
|
||||
hyperlink==19.0.0
|
||||
idna==2.8
|
||||
incremental==17.5.0
|
||||
ipython==6.4.0
|
||||
ipython-genutils==0.2.0
|
||||
iso8601==0.1.12
|
||||
itsdangerous==1.1.0
|
||||
itypes==1.1.0
|
||||
jedi==0.12.0
|
||||
Jinja2==2.10
|
||||
json-merge-patch==0.2
|
||||
jsonfield==2.0.2
|
||||
kombu==4.4.0
|
||||
kubernetes==9.0.0
|
||||
lockfile==0.12.2
|
||||
lxml==4.3.4
|
||||
Mako==1.0.12
|
||||
Markdown==2.6.11
|
||||
MarkupSafe==1.1.1
|
||||
msgpack==0.6.1
|
||||
msgpack-python==0.5.6
|
||||
mysqlclient==1.3.14
|
||||
numpy==1.16.4
|
||||
oauthlib==3.0.1
|
||||
openapi-codec==1.3.2
|
||||
ordereddict==1.1
|
||||
pandas==0.24.2
|
||||
paramiko==2.4.2
|
||||
parso==0.2.1
|
||||
pathtools==0.1.2
|
||||
pendulum==1.4.4
|
||||
pexpect==4.6.0
|
||||
pickleshare==0.7.4
|
||||
prettytable==0.7.2
|
||||
prometheus-client==0.2.0
|
||||
promise==2.2.1
|
||||
prompt-toolkit==1.0.15
|
||||
psutil==5.6.3
|
||||
ptyprocess==0.5.2
|
||||
pyasn1==0.4.5
|
||||
pyasn1-modules==0.2.5
|
||||
pycparser==2.19
|
||||
Pygments==2.2.0
|
||||
PyHamcrest==1.9.0
|
||||
PyMySQL==0.9.3
|
||||
PyNaCl==1.3.0
|
||||
python-crontab==2.3.6
|
||||
python-daemon==2.1.2
|
||||
python-dateutil==2.8.0
|
||||
python-editor==1.0.4
|
||||
python3-openid==3.1.0
|
||||
pytz==2018.4
|
||||
pytzdata==2019.1
|
||||
PyYAML==5.1
|
||||
redis==3.2.1
|
||||
requests==2.21.0
|
||||
requests-oauthlib==1.2.0
|
||||
rsa==4.0
|
||||
Rx==1.6.1
|
||||
setproctitle==1.1.10
|
||||
simplegeneric==0.8.1
|
||||
simplejson==3.16.0
|
||||
singledispatch==3.4.0.3
|
||||
six==1.11.0
|
||||
smmap2==2.0.5
|
||||
SQLAlchemy==1.2.19
|
||||
sqlparse==0.3.0
|
||||
tabulate==0.8.3
|
||||
tenacity==4.12.0
|
||||
text-unidecode==1.2
|
||||
thrift==0.11.0
|
||||
tornado==5.1.1
|
||||
traitlets==4.3.2
|
||||
Twisted==19.2.1
|
||||
txaio==18.8.1
|
||||
tzlocal==1.5.1
|
||||
unicodecsv==0.14.1
|
||||
uritemplate==3.0.0
|
||||
urllib3==1.24.1
|
||||
vine==1.3.0
|
||||
watchdog==0.8.3
|
||||
watchdog-gevent==0.1.0
|
||||
wcwidth==0.1.7
|
||||
websocket-client==0.56.0
|
||||
Werkzeug==0.14.1
|
||||
WTForms==2.2.1
|
||||
zope.deprecation==4.4.0
|
||||
zope.interface==4.6.0
|
||||
django-rest-swagger
|
||||
# seal 海豹 CMDB —— 依赖清单（2026-09 安全修复版）
|
||||
# 说明：原文件为 2019 年的 pip freeze 全量快照，本版改为"直接依赖"清单，
|
||||
# 传递依赖由 pip 自动解析；运行要求 Python >= 3.10。
|
||||
# 安全升级：Django 5.2 / DRF 3.17 / channels 4 / celery 5；
|
||||
# 移除未使用的 apache-airflow、tornado、GitPython、numpy、thrift、
|
||||
# lxml、SQLAlchemy、Mako、Werkzeug、gevent、autobahn、ipython 等历史依赖。
|
||||
|
||||
# Web 框架
|
||||
Django==5.2.16
|
||||
djangorestframework==3.17.2
|
||||
django-filter==25.2
|
||||
drf-spectacular==0.28.0
|
||||
django-bootstrap3==25.1
|
||||
django-pure-pagination==0.3.0
|
||||
django-simpleui==2024.4.1
|
||||
django-cors-headers==4.9.0
|
||||
|
||||
# GraphQL
|
||||
graphene-django==3.2.3
|
||||
|
||||
# Channels / WebSocket
|
||||
channels==4.3.1
|
||||
channels-redis==4.3.0
|
||||
daphne==4.2.2
|
||||
Twisted==26.4.0
|
||||
|
||||
# Celery 任务队列
|
||||
celery==5.5.3
|
||||
django-celery-beat==2.8.1
|
||||
django-celery-results==2.6.0
|
||||
python-crontab==3.3.0
|
||||
|
||||
# 异步任务
|
||||
dramatiq==1.18.0
|
||||
|
||||
# 数据库
|
||||
mysqlclient==2.2.7
|
||||
PyMySQL==1.1.2
|
||||
|
||||
# 工具 / 客户端
|
||||
requests==2.33.0
|
||||
kubernetes==33.1.0
|
||||
prettytable==3.16.0
|
||||
gunicorn==23.0.0
|
||||
|
||||
Reference in New Issue
Block a user