Repository: pywbem/pywbem (language: python)

Issue:
Safety issues up to 2024-11-30
No review needed.


Discussion / hints:

Fix patch:
diff --git a/.safety-policy-all.yml b/.safety-policy-all.yml
index 7737c01c8..02f31b01c 100644
--- a/.safety-policy-all.yml
+++ b/.safety-policy-all.yml
@@ -185,6 +185,8 @@ security:
             reason: Fixed tornado version 6.4.0 requires Python>=3.8 and is used there
         72132:
             reason: Fixed zipp version 3.19.1 requires Python>=3.8 and is used there
+        73456:
+            reason: Fixed virtualenv version 20.26.6 is only used on Python>=3.12 to avoid other changes
 
     # Continue with exit code 0 when vulnerabilities are found.
     continue-on-vulnerability-error: False
diff --git a/dev-requirements.txt b/dev-requirements.txt
index 9befaf992..e619968ef 100644
--- a/dev-requirements.txt
+++ b/dev-requirements.txt
@@ -93,7 +93,7 @@ wrapt>=1.14; python_version >= '3.11'
 # platformdirs is used by pylint starting with its 2.10
 platformdirs>=2.2.0; python_version == '3.6'
 platformdirs>=2.5.0; python_version >= '3.7' and python_version <= '3.11'
-platformdirs>=3.2.0; python_version >= '3.12'
+platformdirs>=3.9.1; python_version >= '3.12'
 # isort 5.0.0 removed support for py27,py35
 # isort 4.2.8 fixes a pylint issue with false positive on import order of ssl on Windows
 # isort 4.3.8 fixes an issue with py310 and works on py310 (Note that isort 5.10.0 has official support for py310)
@@ -260,7 +260,7 @@ notebook>=4.3.1,<6.1.0; python_version == '2.7'
 notebook>=6.4.10; python_version == '3.6'
 notebook>=6.5.4; python_version == '3.7'
 # safety issue sets new minimum 7.1.0 2025-3-17
-notebook>=7.1.0; python_version >= '3.8'
+notebook>=7.2.2; python_version >= '3.8'
 
 # notebook-shim 0.1.0 removed support for Python 3.6
 # latest 3.10: notebook_shim 0.2.3
@@ -268,13 +268,13 @@ notebook-shim>=0.2.3; python_version >= '3.7'
 
 # jupyterlab-server 2.25.0 removed support for Python 3.7
 # latest 3.10: jupyterlab_server 2.25.2
-jupyterlab-server>=2.22.1,<3; python_version >= '3.8'
+jupyterlab-server>=2.27.1,<3; python_version >= '3.8'
 
 # jupyterlab 4.0.0 removed support for Python 3.7
 # latest 3.10: jupyterlab 4.0.10
 # safety vulnerability #64588, #64587 jupyterlab < 4.0.11
 # notebook 7.1.0 depends on jupyterlab<4.2 and >=4.1.1
-jupyterlab>=4.1.1,<5; python_version >= '3.8'
+jupyterlab>=4.2.6,<5; python_version >= '3.8'
 
 pyrsistent>=0.14.0,<0.16.0; python_version == '2.7'
 pyrsistent>=0.14.0; python_version == '3.6'
@@ -375,7 +375,8 @@ anyio>=3.7.1; python_version == '3.7'
 anyio>=4.4.0; python_version >= '3.8'
 distlib>=0.3.4; python_version <= '3.11'
 distlib>=0.3.7; python_version >= '3.12'
-filelock>=3.0.0
+filelock>=3.2.0; python_version <= "3.11"
+filelock>=3.12.2; python_version >= "3.12"
 # gitdb2 4.0.2 requires gitdb>=4.0.1 for installation, see https://github.com/gitpython-developers/gitdb/issues/86
 gitdb2>=2.0.6,<4.0; python_version == '2.7'
 gitdb2>=2.0.6,<4.0; python_version == '3.6'
diff --git a/docs/changes.rst b/docs/changes.rst
index d2008eaf0..6e41fd9df 100644
--- a/docs/changes.rst
+++ b/docs/changes.rst
@@ -25,7 +25,7 @@ Released: not yet
 
 **Bug fixes:**
 
-* Fixed safety issues up to 2024-08-18.
+* Fixed safety issues up to 2024-11-30.
 
 * Fixed new issues reported by Pylint 3.2 and 3.3.
 
diff --git a/minimum-constraints-install.txt b/minimum-constraints-install.txt
index 190463aac..a2c991863 100644
--- a/minimum-constraints-install.txt
+++ b/minimum-constraints-install.txt
@@ -45,7 +45,7 @@ mock==2.0.0; python_version == '2.7'
 ordereddict==1.1
 ply==3.10
 PyYAML==5.3.1; python_version == '2.7'
-PyYAML==5.3.1; python_version >= '3.6'
+PyYAML==6.0.1; python_version >= '3.6'
 six==1.14.0; python_version <= '3.9'
 six==1.16.0; python_version >= '3.10'
 requests==2.25.0; python_version == '2.7'
diff --git a/minimum-constraints.txt b/minimum-constraints.txt
index 0ab88de1a..7f39554e0 100644
--- a/minimum-constraints.txt
+++ b/minimum-constraints.txt
@@ -35,7 +35,7 @@ pytest-easy-server==0.8.0
 cryptography==3.3; python_version == '2.7'
 cryptography==3.4.7; python_version == '3.6'
 # minimum version 42.0.2, safety issue 2024-3-17
-cryptography==42.0.8; python_version >= '3.7'
+cryptography==43.0.1; python_version >= '3.7'
 keyring==18.0.0
 
 jsonschema==2.6.0; python_version <= '3.6'
@@ -77,7 +77,7 @@ coveralls==3.3.0; python_version >= '3.6'
 
 # Virtualenv
 virtualenv==20.15.0; python_version <= '3.11'  # requires six<2,>=1.12.0
-virtualenv==20.23.0; python_version >= '3.12'
+virtualenv==20.26.6; python_version >= '3.12'
 
 
 # Direct dependencies for development (without test) and indirect dependencies
@@ -148,7 +148,7 @@ wrapt==1.12; python_version >= '3.6' and python_version <= '3.10'
 wrapt==1.14; python_version >= '3.11'
 platformdirs==2.2.0; python_version == '3.6'
 platformdirs==2.5.0; python_version >= '3.7' and python_version <= '3.11'
-platformdirs==3.2.0; python_version >= '3.12'
+platformdirs==3.9.1; python_version >= '3.12'
 isort==4.3.8
 tomlkit==0.10.1; python_version >= '3.7'
 dill==0.3.4; python_version >= '3.6' and python_version <= '3.10'
@@ -249,15 +249,15 @@ notebook==4.3.1; python_version == '2.7'
 notebook==6.4.10; python_version == '3.6'
 notebook==6.5.4; python_version == '3.7'
 # safety issue sets new minimum 7.1.0 17  2024-3-17
-notebook==7.1.0; python_version >= '3.8'
+notebook==7.2.2; python_version >= '3.8'
 
 notebook-shim==0.2.3; python_version >= '3.7'
 
-jupyterlab-server==2.22.1; python_version >= '3.8'
+jupyterlab-server==2.27.1; python_version >= '3.8'
 
 # safety vulnerability #64588, #64587 with jupyterlab < 4.0.11
 # notebook 7.1.0 depends on jupyterlab<4.2 and >=4.1.1
-jupyterlab==4.1.1; python_version >= '3.8'
+jupyterlab==4.2.6; python_version >= '3.8'
 
 pyrsistent==0.14.0; python_version == '2.7'
 pyrsistent==0.14.0; python_version == '3.6'
@@ -323,7 +323,7 @@ distlib==0.3.4; python_version <= '3.11'
 distlib==0.3.7; python_version >= '3.12'
 # previous version filelock==3.0.0
 filelock==3.2.0; python_version <= "3.11"
-filelock==3.11.0; python_version >= "3.12"
+filelock==3.12.2; python_version >= "3.12"
 # gitdb2 is a mirror Pypi name for certain gitdb versions.
 gitdb2==2.0.6; python_version == '2.7'
 gitdb2==2.0.6; python_version == '3.6'
diff --git a/requirements.txt b/requirements.txt
index 9e1331434..c44ca665d 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -13,7 +13,7 @@ ply>=3.10
 # PyYAML 5.2 addressed issue 38639 reported by safety
 # PyYAML 6.0 removed support for Python 2.7, but 6.0b1 installs in installtest
 PyYAML>=5.3.1,<6.0; python_version == '2.7'
-PyYAML>=5.3.1; python_version >= '3.6'
+PyYAML>=6.0.1; python_version >= '3.6'
 # virtualenv 20.0.0 (required on py3.8+) requires six>=0.12.0
 # tox 3.17 (used in dev-requirements.txt) requires six>=1.14.0
 # six 1.16.0 removes the ImportWarning raised by Python 3.10


Test patch:
diff --git a/test-requirements.txt b/test-requirements.txt
index 5b9da0151..bf069b79a 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -40,7 +40,7 @@ easy-server>=0.8.0
 pytest-easy-server>=0.8.0
 cryptography>=3.3; python_version == '2.7'
 cryptography>=3.4.7; python_version == '3.6'
-cryptography>=42.0.8; python_version >= '3.7'
+cryptography>=43.0.1; python_version >= '3.7'
 keyring>=18.0.0
 
 jsonschema>=2.6.0,!=4.0.0; python_version <= '3.6'
@@ -99,4 +99,4 @@ lxml>=4.9.3; python_version == '3.12'
 
 virtualenv>=16.1.0,!=20.0.19,!=20.0.32; python_version <= '3.7'
 virtualenv>=20.15.0; python_version >= '3.8' and python_version <= '3.11'  # requires six<2,>=1.12.0
-virtualenv>=20.23.0; python_version >= '3.12'
+virtualenv>=20.26.6; python_version >= '3.12'