Merge pull request #652 from permitio/roe/per-10573-fix-current-vulne…

…rabilities-in-opal-as-reported-by-snyk

Upgrade packages to mitigate reported (though not necessarily actual) vulnerabilities

packages/opal-client/requires.txt

@@ -2,6 +2,5 @@ aiofiles>=0.8.0,<1
 aiohttp>=3.9.2,<4
 psutil>=5.9.1,<6
 tenacity>=8.0.1,<9
-websockets>=10.3,<11
 dpath>=2.1.5,<3
 jsonpatch>=1.33,<2

packages/opal-server/requires.txt

@@ -2,7 +2,6 @@ click>=8.1.3,<9
 permit-broadcaster[postgres,redis,kafka]==0.2.5
 gitpython>=3.1.32,<4
 pyjwt[crypto]>=2.1.0,<3
-websockets>=10.3,<11
 slowapi>=0.1.5,<1
 # slowapi is stuck on and old `redis`, so fix that and switch from aioredis to redis
 pygit2>=1.14.1,<1.15

packages/requires.txt

@@ -2,7 +2,8 @@ idna>=3.3,<4
 typer>=0.4.1,<1
 fastapi>=0.109.1,<1
 fastapi_websocket_pubsub==0.3.7
-fastapi_websocket_rpc==0.1.25
+fastapi_websocket_rpc==0.1.27
+websockets>=10.3,<14
 gunicorn>=22.0.0,<23
 pydantic[email]>=1.9.1,<2
 typing-extensions;python_version<'3.8'

requirements.txt

@@ -7,5 +7,5 @@ pytest-asyncio
 pytest-rerunfailures
 wheel>=0.38.0
 twine
-setuptools>=65.5.1 # not directly required, pinned by Snyk to avoid a vulnerability
+setuptools>=70.0.0 # not directly required, pinned by Snyk to avoid a vulnerability
 zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability