ha-core/homeassistant/package_constraints.txt

PyJWT==1.7.1
PyNaCl==1.3.0
aiohttp==3.6.2
aiohttp_cors==0.7.0
astral==1.10.1
async_timeout==3.0.1
attrs==19.3.0
bcrypt==3.1.7
certifi>=2020.4.5.1
ciso8601==2.1.3
cryptography==2.9.2
defusedxml==0.6.0
distro==1.5.0
emoji==0.5.4
hass-nabucasa==0.35.0
home-assistant-frontend==20200811.0
importlib-metadata==1.6.0;python_version<'3.8'
jinja2>=2.11.1
netdisco==2.8.1
paho-mqtt==1.5.0
pip>=8.0.3
python-slugify==4.0.1
pytz>=2020.1
pyyaml==5.3.1
requests==2.24.0
ruamel.yaml==0.15.100
sqlalchemy==1.3.18
voluptuous-serialize==2.4.0
voluptuous==0.11.7
yarl==1.4.2
zeroconf==0.28.0

pycryptodome>=3.6.6

# Constrain urllib3 to ensure we deal with CVE-2019-11236 & CVE-2019-11324
urllib3>=1.24.3

# Constrain httplib2 to protect against CVE-2020-11078
httplib2>=0.18.0

# Not needed for our supported Python versions
enum34==1000000000.0.0

# This is a old unmaintained library and is replaced with pycryptodome
pycrypto==1000000000.0.0
Add default config to constaint file (#24423) 2019-06-10 23:38:14 +02:00			`PyJWT==1.7.1`
			`PyNaCl==1.3.0`
Upgrade aiohttp to 3.6.2 (#38082) 2020-07-22 23:56:28 +02:00			`aiohttp==3.6.2`
Add default config to constaint file (#24423) 2019-06-10 23:38:14 +02:00			`aiohttp_cors==0.7.0`
Upgrade astral to 1.10.1 (#21474) 2019-02-27 14:07:51 +01:00			`astral==1.10.1`
Upgrade async_timeout to 3.0.1 (#17655) 2018-10-21 14:13:30 +02:00			`async_timeout==3.0.1`
Upgrade attrs to 19.3.0 (#28421) 2019-11-01 13:10:53 +01:00			`attrs==19.3.0`
Upgrade bcrypt to 3.1.7 (#24850) 2019-07-01 02:23:47 +02:00			`bcrypt==3.1.7`
Upgrade certifi to >=2020.4.5.1 (#34080) 2020-04-12 12:52:04 +02:00			`certifi>=2020.4.5.1`
Use ciso8601 library to parse datetime faster (#32128) 2020-02-24 17:33:10 +01:00			`ciso8601==2.1.3`
Upgrade cryptography to 2.9.2 (#35084) 2020-05-04 10:38:26 +02:00			`cryptography==2.9.2`
Add bandit, use to catch known vulnerable XML parsing (#28341) * Add bandit to pre-commit and CI, use to catch known vulnerable XML parsing * Use defusedxml instead of direct xml.etree to parse XML * Move config to tests/bandit.yaml 2019-11-18 09:10:15 +01:00			`defusedxml==0.6.0`
Upgrade distro to 1.5.0 (#34009) 2020-04-11 12:55:02 +02:00			`distro==1.5.0`
Handle Mobile App registrations for device names containing of only emoji (#36957) 2020-06-21 18:12:15 +02:00			`emoji==0.5.4`
Bump hass-nabucasa to avoid the performance penalty loading ecdsa (#38056) 2020-08-03 12:55:30 +02:00			`hass-nabucasa==0.35.0`
Bump frontend to 20200811.0 (#38760) 2020-08-11 15:45:07 +02:00			`home-assistant-frontend==20200811.0`
Use the built-in importlib.metadata library in Python 3.8+ (#36225) importlib_metadata is a backport of this library for Python 3.7 and older. 2020-06-17 15:21:14 +02:00			`importlib-metadata==1.6.0;python_version<'3.8'`
Upgrade jinja2 to >=2.11.1 (#33244) 2020-03-26 16:12:12 +01:00			`jinja2>=2.11.1`
Bump netdisco to 2.8.1 (#38173) * Bump netdisco to 2.8.1 * bump ssdp 2020-07-25 09:00:08 +02:00			`netdisco==2.8.1`
Add MQTT to constraints file (#38049) 2020-07-22 04:19:32 +02:00			`paho-mqtt==1.5.0`
Upgrade aiohttp to 3.2.1 (#14517) * Upgrade aiohttp to 3.2.1 * Upgrade async_timeout to 3.0.0 * Update the order of the requirements 2018-05-19 10:04:00 +02:00			`pip>=8.0.3`
Bump python-slugify to 4.0.1 (#38140) * Bump python-slugify to 4.0.1 * Dummy commit to re-trigger tests 2020-07-24 16:55:54 +02:00			`python-slugify==4.0.1`
Upgrade pytz to 2020.1 (#35174) 2020-05-04 15:16:37 +02:00			`pytz>=2020.1`
Upgrade pyyaml to 5.3.1 (#33246) 2020-03-26 16:14:07 +01:00			`pyyaml==5.3.1`
Upgrade requests to 2.24.0 (#36886) 2020-06-18 01:26:29 +02:00			`requests==2.24.0`
Upgrade ruamel_yaml to 0.15.100 (#26095) 2019-08-21 18:13:40 +02:00			`ruamel.yaml==0.15.100`
Upgrade sqlalchemy to 1.3.18 (#37123) 2020-06-26 15:15:54 +02:00			`sqlalchemy==1.3.18`
Bump voluptuous-serialize 2.4.0 (#37241) * Bump voluptuous-serialize 2.4.0 * Add constant to demo * gen reqs 2020-07-07 05:04:35 +02:00			`voluptuous-serialize==2.4.0`
Upgrade voluptuous to 0.11.7 (#26007) 2019-08-16 21:31:28 +02:00			`voluptuous==0.11.7`
Pin yarl dependency to 1.4.2 as core dependency (#38428) 2020-07-31 22:06:02 +02:00			`yarl==1.4.2`
Bump zeroconf to 0.28.0 (#37951) 2020-07-18 09:47:43 +02:00			`zeroconf==0.28.0`
Block dependencies that depend on enum34 (#8698) * Block dependencies that depend on enum34 * Remove uninstalling enum34 * Update validation script * Add constraints to tox.ini * Upgrade yeelight to version that uses enum-compat * Disable sensor.skybeacon * Lint 2017-08-05 08:06:10 +02:00
Avoid insecure pycryptodome (#16238) 2018-08-28 12:49:50 +02:00			`pycryptodome>=3.6.6`

Add minimal version contrain to urllib3 (#32031) 2020-02-20 19:19:09 +01:00			`# Constrain urllib3 to ensure we deal with CVE-2019-11236 & CVE-2019-11324`
			`urllib3>=1.24.3`

Mark min version of httplib2 (#36330) 2020-06-01 09:44:18 +02:00			`# Constrain httplib2 to protect against CVE-2020-11078`
			`httplib2>=0.18.0`

Drop Python 3.6 support (#29978) 2019-12-16 07:29:19 +01:00			`# Not needed for our supported Python versions`
Block dependencies that depend on enum34 (#8698) * Block dependencies that depend on enum34 * Remove uninstalling enum34 * Update validation script * Add constraints to tox.ini * Upgrade yeelight to version that uses enum-compat * Disable sensor.skybeacon * Lint 2017-08-05 08:06:10 +02:00			`enum34==1000000000.0.0`
Don't allow to use a old unsecure library (#12715) * Don't allow to use a old unsecury library * Update gen_requirements_all.py * Cryptodome fix for python-broadlink * Coinbase cryptodome fix 2018-02-27 10:58:45 +01:00
			`# This is a old unmaintained library and is replaced with pycryptodome`
			`pycrypto==1000000000.0.0`