Merge branch 'dev/github_bot'
[UPD] requirement: Odoo 18 aws 1.43.75, requests 2.32.4, no examples 6 commits. aiobotocore 3.9.1 accepts botocore only below 1.43.76, so the AWS trio moves together to 1.43.75. requests is pinned to 2.32.4 against the 2.31.0 of Odoo 18 and its two CVEs; its version had followed an example requirements file, which poetry_update.py now skips along with anything under doc and examples directories. factur-x gets the floor already locked, openpyxl and xlsxwriter move for Transform data. Checked: poetry lock resolves at each commit, the Transform data leak test passes, 511 tests. --- FR --- [UPD] requirement : Odoo 18 aws 1.43.75, requests 2.32.4, sans exemples 6 commits. aiobotocore 3.9.1 n'accepte botocore que sous 1.43.76 : le trio AWS passe ensemble à 1.43.75. requests est épinglé à 2.32.4 contre le 2.31.0 d'Odoo 18 et ses deux CVE ; sa version suivait un requirements d'exemple, que poetry_update.py écarte désormais avec tout ce qui est sous un répertoire doc ou examples. factur-x reçoit le plancher déjà verrouillé, openpyxl et xlsxwriter montent pour Transform data. Vérifié : poetry lock résout à chaque commit, le test de fuite de Transform data passe, 511 tests. Assisted-by: Claude Opus 5.5
This commit is contained in:
commit
120f92088d
8 changed files with 66 additions and 33 deletions
|
|
@ -174,8 +174,10 @@ au [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|||
- TODO menus: the language is set only from Configuration, the duplicate entry in Execute is gone, and Fork moves from the main menu to Configuration. The main menu now numbers Telemetry 4 and Configuration 5. The language chooser shows a flag per language
|
||||
- Odoo 18 dependencies refreshed. `openai` is pinned to 2.x, whose 3.x requires an `idna` that Odoo 18 forbids; `fsspec` is pinned beside `s3fs`, which demands it at its own exact version, so the two move together; `meteostat` returns to 1.x, every 2.x capping `pytz` below 2024. PyMuPDF stays excluded on s390x, now declared in the requirements so a regeneration keeps it. Major bumps of `ujson` 6, `plotly` 7, `python-slugify` 9 and `sqlalchemy` 2.1 are not yet tested
|
||||
- Dependabot ignores the major versions of `meteostat`
|
||||
- Odoo 18 moves to pandas 3.0.6, cryptography 50 with pyopenssl 26.4, Pillow 12.3 and botocore/boto3 1.43.49 with aiobotocore 3.9.0 — the only aiobotocore whose botocore range holds 1.43.49. The seven modules that import pandas run their pandas calls unchanged; `freq='d'` in a Cybro attendance dashboard now warns and will break with pandas 4
|
||||
- Odoo 18 moves to pandas 3.0.6, cryptography 50 with pyopenssl 26.4, Pillow 12.3 and botocore/boto3 1.43.75 with aiobotocore 3.9.1, the highest botocore its narrow range accepts. The seven modules that import pandas run their pandas calls unchanged; `freq='d'` in a Cybro attendance dashboard now warns and will break with pandas 4
|
||||
- Dependabot groups `aiobotocore`, `botocore` and `boto3` into one pull request, since each aiobotocore accepts only a narrow botocore range; security fixes still arrive on their own
|
||||
- `TODO › Transform data` reads Excel with openpyxl 3.1.5 and xlsxwriter 3.2.9; the leak test that guards openpyxl's exact pin passes on them
|
||||
- factur-x requires 6.8 outside s390x, the version already locked, so a regeneration can no longer fall back to an untested 4.x or 5.x
|
||||
|
||||
<!-- [fr] -->
|
||||
|
||||
|
|
@ -206,8 +208,10 @@ au [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|||
- Menus de TODO : la langue se règle seulement depuis Configuration, l'entrée en double dans Execute disparaît, et Fork quitte le menu principal pour Configuration. Le menu principal numérote désormais Télémétrie 4 et Configuration 5. Le choix de la langue montre un drapeau par langue
|
||||
- Dépendances d'Odoo 18 rafraîchies. `openai` est épinglé en 2.x, dont la 3.x exige un `idna` qu'Odoo 18 interdit ; `fsspec` est épinglé à côté de `s3fs`, qui l'exige à sa propre version exacte, si bien que les deux se montent ensemble ; `meteostat` revient en 1.x, toute 2.x plafonnant `pytz` sous 2024. PyMuPDF reste écarté sur s390x, désormais déclaré dans les requirements pour qu'une régénération le garde. Les montées majeures de `ujson` 6, `plotly` 7, `python-slugify` 9 et `sqlalchemy` 2.1 ne sont pas encore testées
|
||||
- Dependabot ignore les versions majeures de `meteostat`
|
||||
- Odoo 18 passe à pandas 3.0.6, cryptography 50 avec pyopenssl 26.4, Pillow 12.3 et botocore/boto3 1.43.49 avec aiobotocore 3.9.0 — le seul aiobotocore dont la plage de botocore contient 1.43.49. Les sept modules qui importent pandas exécutent leurs appels pandas sans changement ; `freq='d'` dans un tableau de bord de présence Cybro avertit désormais et cassera avec pandas 4
|
||||
- Odoo 18 passe à pandas 3.0.6, cryptography 50 avec pyopenssl 26.4, Pillow 12.3 et botocore/boto3 1.43.75 avec aiobotocore 3.9.1, le plus haut botocore que sa plage étroite accepte. Les sept modules qui importent pandas exécutent leurs appels pandas sans changement ; `freq='d'` dans un tableau de bord de présence Cybro avertit désormais et cassera avec pandas 4
|
||||
- Dependabot réunit `aiobotocore`, `botocore` et `boto3` dans une seule demande de fusion, chaque aiobotocore n'acceptant qu'une plage étroite de botocore ; les correctifs de sécurité arrivent toujours seuls
|
||||
- `TODO › Transform data` lit Excel avec openpyxl 3.1.5 et xlsxwriter 3.2.9 ; le test de fuite qui garde l'épingle exacte d'openpyxl passe sur eux
|
||||
- factur-x exige 6.8 hors s390x, la version déjà verrouillée : une régénération ne peut plus retomber sur une 4.x ou 5.x non testée
|
||||
|
||||
<!-- [en] -->
|
||||
## Fixed
|
||||
|
|
@ -280,6 +284,7 @@ au [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|||
- Dependabot no longer opens pull requests against the frozen requirements of Odoo 12 to 17: its security updates scan `requirement/` as its own directory, which the exclusions did not cover
|
||||
- `poetry_update.py` stops on a missing `pyproject.toml` with the command that creates it, `make switch_odoo_XX` for the active version, and offers to run it then restart when launched from a terminal
|
||||
- `poetry_update.py` runs Poetry in the Odoo venv even from a shell under `.venv.erplibre`, whose Python made it fail on « InvalidCurrentPythonVersionError »
|
||||
- `poetry_update.py` skips requirements and manifests under a `doc`, `docs`, `example` or `examples` directory: an example file declaring a loose `>=` no longer moves a dependency for the whole environment
|
||||
|
||||
<!-- [fr] -->
|
||||
|
||||
|
|
@ -348,6 +353,7 @@ au [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|||
- Dependabot n'ouvre plus de demandes de fusion sur les requirements figés d'Odoo 12 à 17 : ses mises à jour de sécurité lisent `requirement/` comme un répertoire à part, que les exclusions ne couvraient pas
|
||||
- `poetry_update.py` s'arrête sur un `pyproject.toml` absent en nommant la commande qui le crée, `make switch_odoo_XX` pour la version active, et propose de la lancer puis de se relancer quand il tourne dans un terminal
|
||||
- `poetry_update.py` fait tourner Poetry dans le venv Odoo même depuis un shell sous `.venv.erplibre`, dont le Python le faisait échouer sur « InvalidCurrentPythonVersionError »
|
||||
- `poetry_update.py` écarte les requirements et manifestes sous un répertoire `doc`, `docs`, `example` ou `examples` : un fichier d'exemple déclarant un `>=` lâche ne déplace plus une dépendance pour tout l'environnement
|
||||
|
||||
<!-- [en] -->
|
||||
## Removed
|
||||
|
|
@ -370,12 +376,14 @@ au [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|||
- An API key and a bearer token are redacted too before a command is displayed, logged or reprinted: `OPENAI_API_KEY=` went out in the clear, and a header token escaped by construction, carrying neither an option name nor a variable name
|
||||
- Following a redirect, the cache no longer forwards the client's credentials (Authorization, Cookie, Proxy-Authorization) to another host
|
||||
- Odoo 18 installs `idna` 3.20 instead of the 3.6 its own requirements pin, which is affected by CVE-2024-3651
|
||||
- Odoo 18 installs `requests` 2.32.4 instead of the 2.31.0 its own requirements pin, which is affected by CVE-2024-35195 and CVE-2024-47081
|
||||
|
||||
<!-- [fr] -->
|
||||
|
||||
- Une clé d'API et un jeton Bearer sont caviardés eux aussi avant qu'une commande soit affichée, journalisée ou réimprimée : `OPENAI_API_KEY=` partait en clair, et un jeton d'en-tête échappait par construction, ne portant ni nom d'option ni nom de variable
|
||||
- En suivant une redirection, le cache ne transmet plus les identifiants du client (Authorization, Cookie, Proxy-Authorization) à un autre hôte
|
||||
- Odoo 18 installe `idna` 3.20 au lieu de la 3.6 qu'épinglent ses propres requirements, touchée par CVE-2024-3651
|
||||
- Odoo 18 installe `requests` 2.32.4 au lieu du 2.31.0 qu'épinglent ses propres requirements, touché par CVE-2024-35195 et CVE-2024-47081
|
||||
|
||||
<!-- [common] -->
|
||||
|
||||
|
|
|
|||
|
|
@ -94,8 +94,10 @@ au [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|||
- Menus de TODO : la langue se règle seulement depuis Configuration, l'entrée en double dans Execute disparaît, et Fork quitte le menu principal pour Configuration. Le menu principal numérote désormais Télémétrie 4 et Configuration 5. Le choix de la langue montre un drapeau par langue
|
||||
- Dépendances d'Odoo 18 rafraîchies. `openai` est épinglé en 2.x, dont la 3.x exige un `idna` qu'Odoo 18 interdit ; `fsspec` est épinglé à côté de `s3fs`, qui l'exige à sa propre version exacte, si bien que les deux se montent ensemble ; `meteostat` revient en 1.x, toute 2.x plafonnant `pytz` sous 2024. PyMuPDF reste écarté sur s390x, désormais déclaré dans les requirements pour qu'une régénération le garde. Les montées majeures de `ujson` 6, `plotly` 7, `python-slugify` 9 et `sqlalchemy` 2.1 ne sont pas encore testées
|
||||
- Dependabot ignore les versions majeures de `meteostat`
|
||||
- Odoo 18 passe à pandas 3.0.6, cryptography 50 avec pyopenssl 26.4, Pillow 12.3 et botocore/boto3 1.43.49 avec aiobotocore 3.9.0 — le seul aiobotocore dont la plage de botocore contient 1.43.49. Les sept modules qui importent pandas exécutent leurs appels pandas sans changement ; `freq='d'` dans un tableau de bord de présence Cybro avertit désormais et cassera avec pandas 4
|
||||
- Odoo 18 passe à pandas 3.0.6, cryptography 50 avec pyopenssl 26.4, Pillow 12.3 et botocore/boto3 1.43.75 avec aiobotocore 3.9.1, le plus haut botocore que sa plage étroite accepte. Les sept modules qui importent pandas exécutent leurs appels pandas sans changement ; `freq='d'` dans un tableau de bord de présence Cybro avertit désormais et cassera avec pandas 4
|
||||
- Dependabot réunit `aiobotocore`, `botocore` et `boto3` dans une seule demande de fusion, chaque aiobotocore n'acceptant qu'une plage étroite de botocore ; les correctifs de sécurité arrivent toujours seuls
|
||||
- `TODO › Transform data` lit Excel avec openpyxl 3.1.5 et xlsxwriter 3.2.9 ; le test de fuite qui garde l'épingle exacte d'openpyxl passe sur eux
|
||||
- factur-x exige 6.8 hors s390x, la version déjà verrouillée : une régénération ne peut plus retomber sur une 4.x ou 5.x non testée
|
||||
|
||||
## Corrigé
|
||||
|
||||
|
|
@ -164,6 +166,7 @@ au [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|||
- Dependabot n'ouvre plus de demandes de fusion sur les requirements figés d'Odoo 12 à 17 : ses mises à jour de sécurité lisent `requirement/` comme un répertoire à part, que les exclusions ne couvraient pas
|
||||
- `poetry_update.py` s'arrête sur un `pyproject.toml` absent en nommant la commande qui le crée, `make switch_odoo_XX` pour la version active, et propose de la lancer puis de se relancer quand il tourne dans un terminal
|
||||
- `poetry_update.py` fait tourner Poetry dans le venv Odoo même depuis un shell sous `.venv.erplibre`, dont le Python le faisait échouer sur « InvalidCurrentPythonVersionError »
|
||||
- `poetry_update.py` écarte les requirements et manifestes sous un répertoire `doc`, `docs`, `example` ou `examples` : un fichier d'exemple déclarant un `>=` lâche ne déplace plus une dépendance pour tout l'environnement
|
||||
|
||||
## Retiré
|
||||
|
||||
|
|
@ -174,6 +177,7 @@ au [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|||
- Une clé d'API et un jeton Bearer sont caviardés eux aussi avant qu'une commande soit affichée, journalisée ou réimprimée : `OPENAI_API_KEY=` partait en clair, et un jeton d'en-tête échappait par construction, ne portant ni nom d'option ni nom de variable
|
||||
- En suivant une redirection, le cache ne transmet plus les identifiants du client (Authorization, Cookie, Proxy-Authorization) à un autre hôte
|
||||
- Odoo 18 installe `idna` 3.20 au lieu de la 3.6 qu'épinglent ses propres requirements, touchée par CVE-2024-3651
|
||||
- Odoo 18 installe `requests` 2.32.4 au lieu du 2.31.0 qu'épinglent ses propres requirements, touché par CVE-2024-35195 et CVE-2024-47081
|
||||
|
||||
|
||||
## [1.8.0] - 2026-09-04
|
||||
|
|
|
|||
|
|
@ -94,8 +94,10 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|||
- TODO menus: the language is set only from Configuration, the duplicate entry in Execute is gone, and Fork moves from the main menu to Configuration. The main menu now numbers Telemetry 4 and Configuration 5. The language chooser shows a flag per language
|
||||
- Odoo 18 dependencies refreshed. `openai` is pinned to 2.x, whose 3.x requires an `idna` that Odoo 18 forbids; `fsspec` is pinned beside `s3fs`, which demands it at its own exact version, so the two move together; `meteostat` returns to 1.x, every 2.x capping `pytz` below 2024. PyMuPDF stays excluded on s390x, now declared in the requirements so a regeneration keeps it. Major bumps of `ujson` 6, `plotly` 7, `python-slugify` 9 and `sqlalchemy` 2.1 are not yet tested
|
||||
- Dependabot ignores the major versions of `meteostat`
|
||||
- Odoo 18 moves to pandas 3.0.6, cryptography 50 with pyopenssl 26.4, Pillow 12.3 and botocore/boto3 1.43.49 with aiobotocore 3.9.0 — the only aiobotocore whose botocore range holds 1.43.49. The seven modules that import pandas run their pandas calls unchanged; `freq='d'` in a Cybro attendance dashboard now warns and will break with pandas 4
|
||||
- Odoo 18 moves to pandas 3.0.6, cryptography 50 with pyopenssl 26.4, Pillow 12.3 and botocore/boto3 1.43.75 with aiobotocore 3.9.1, the highest botocore its narrow range accepts. The seven modules that import pandas run their pandas calls unchanged; `freq='d'` in a Cybro attendance dashboard now warns and will break with pandas 4
|
||||
- Dependabot groups `aiobotocore`, `botocore` and `boto3` into one pull request, since each aiobotocore accepts only a narrow botocore range; security fixes still arrive on their own
|
||||
- `TODO › Transform data` reads Excel with openpyxl 3.1.5 and xlsxwriter 3.2.9; the leak test that guards openpyxl's exact pin passes on them
|
||||
- factur-x requires 6.8 outside s390x, the version already locked, so a regeneration can no longer fall back to an untested 4.x or 5.x
|
||||
|
||||
## Fixed
|
||||
|
||||
|
|
@ -164,6 +166,7 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|||
- Dependabot no longer opens pull requests against the frozen requirements of Odoo 12 to 17: its security updates scan `requirement/` as its own directory, which the exclusions did not cover
|
||||
- `poetry_update.py` stops on a missing `pyproject.toml` with the command that creates it, `make switch_odoo_XX` for the active version, and offers to run it then restart when launched from a terminal
|
||||
- `poetry_update.py` runs Poetry in the Odoo venv even from a shell under `.venv.erplibre`, whose Python made it fail on « InvalidCurrentPythonVersionError »
|
||||
- `poetry_update.py` skips requirements and manifests under a `doc`, `docs`, `example` or `examples` directory: an example file declaring a loose `>=` no longer moves a dependency for the whole environment
|
||||
|
||||
## Removed
|
||||
|
||||
|
|
@ -174,6 +177,7 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|||
- An API key and a bearer token are redacted too before a command is displayed, logged or reprinted: `OPENAI_API_KEY=` went out in the clear, and a header token escaped by construction, carrying neither an option name nor a variable name
|
||||
- Following a redirect, the cache no longer forwards the client's credentials (Authorization, Cookie, Proxy-Authorization) to another host
|
||||
- Odoo 18 installs `idna` 3.20 instead of the 3.6 its own requirements pin, which is affected by CVE-2024-3651
|
||||
- Odoo 18 installs `requests` 2.32.4 instead of the 2.31.0 its own requirements pin, which is affected by CVE-2024-35195 and CVE-2024-47081
|
||||
|
||||
|
||||
## [1.8.0] - 2026-09-04
|
||||
|
|
|
|||
|
|
@ -14,20 +14,20 @@ files = [
|
|||
|
||||
[[package]]
|
||||
name = "aiobotocore"
|
||||
version = "3.9.0"
|
||||
version = "3.9.1"
|
||||
description = "Async client for aws services using botocore and aiohttp"
|
||||
optional = false
|
||||
python-versions = ">=3.10"
|
||||
groups = ["main"]
|
||||
files = [
|
||||
{file = "aiobotocore-3.9.0-py3-none-any.whl", hash = "sha256:7354659eac9ba6034675b3ea178330b7de97c45989d6fda1bf01d3da167b6135"},
|
||||
{file = "aiobotocore-3.9.0.tar.gz", hash = "sha256:5d344e97c518b010bea167c7f7ba4f9e785f9d2b8ac7af4fd00846c62f2c0a10"},
|
||||
{file = "aiobotocore-3.9.1-py3-none-any.whl", hash = "sha256:23aa448b4daff3fdce0714c962a2050b63c0222b5f2b5c17d0c874eb76a50ac0"},
|
||||
{file = "aiobotocore-3.9.1.tar.gz", hash = "sha256:617d4a78da5adb6ae7d532835727ad388f73555f2ef129b9de1b1add73a43ee6"},
|
||||
]
|
||||
|
||||
[package.dependencies]
|
||||
aiohttp = ">=3.14.0,<4.0.0"
|
||||
aioitertools = ">=0.5.1,<1.0.0"
|
||||
botocore = ">=1.43.3,<1.43.57"
|
||||
botocore = ">=1.43.66,<1.43.76"
|
||||
jmespath = ">=0.7.1,<2.0.0"
|
||||
multidict = ">=6.0.0,<7.0.0"
|
||||
python-dateutil = ">=2.1,<3.0.0"
|
||||
|
|
@ -658,18 +658,18 @@ xyzservices = ">=2021.09.1"
|
|||
|
||||
[[package]]
|
||||
name = "boto3"
|
||||
version = "1.43.49"
|
||||
version = "1.43.75"
|
||||
description = "The AWS SDK for Python"
|
||||
optional = false
|
||||
python-versions = ">=3.10"
|
||||
groups = ["main"]
|
||||
files = [
|
||||
{file = "boto3-1.43.49-py3-none-any.whl", hash = "sha256:2b31ab1a0eb1cee01d0363b8ee5e68b45dff2c8f99e7b53aca11c9f7b591a794"},
|
||||
{file = "boto3-1.43.49.tar.gz", hash = "sha256:e58e0704805f720b94e40a56588eadd6da05d3693bde78b573116b11ae56710f"},
|
||||
{file = "boto3-1.43.75-py3-none-any.whl", hash = "sha256:08a79edb68e6a0d65d305eb90188639313650e155aed015e86eef59d8475dde0"},
|
||||
{file = "boto3-1.43.75.tar.gz", hash = "sha256:86da93d3d5b46a58b03fa51b598ffa4aeaff485a3000affacf78491c105e44f0"},
|
||||
]
|
||||
|
||||
[package.dependencies]
|
||||
botocore = ">=1.43.49,<1.44.0"
|
||||
botocore = ">=1.43.75,<1.44.0"
|
||||
jmespath = ">=0.7.1,<2.0.0"
|
||||
s3transfer = ">=0.19.0,<0.20.0"
|
||||
|
||||
|
|
@ -678,14 +678,14 @@ crt = ["botocore[crt] (>=1.21.0,<2.0a0)"]
|
|||
|
||||
[[package]]
|
||||
name = "botocore"
|
||||
version = "1.43.49"
|
||||
version = "1.43.75"
|
||||
description = "Low-level, data-driven core of boto 3."
|
||||
optional = false
|
||||
python-versions = ">=3.10"
|
||||
groups = ["main"]
|
||||
files = [
|
||||
{file = "botocore-1.43.49-py3-none-any.whl", hash = "sha256:16b6838ac2fbbab85fb265c1f2e37906527aca07f461b1d293d3f8ab82f992dc"},
|
||||
{file = "botocore-1.43.49.tar.gz", hash = "sha256:7de02863c95b8008b1400c92a1a00996f25ad38944c07f7b620949f8798d1fdf"},
|
||||
{file = "botocore-1.43.75-py3-none-any.whl", hash = "sha256:121abc8b0b529bc4e29a28d1e8b096b20f26708cabe3d5ae4b3446747712aece"},
|
||||
{file = "botocore-1.43.75.tar.gz", hash = "sha256:e8ed6b0f3cd398dfb9e08d7ca3a0b964152166a317a04e89c45ec91003327ffe"},
|
||||
]
|
||||
|
||||
[package.dependencies]
|
||||
|
|
@ -694,7 +694,7 @@ python-dateutil = ">=2.1,<3.0.0"
|
|||
urllib3 = ">=1.25.4,<2.2.0 || >2.2.0,<3"
|
||||
|
||||
[package.extras]
|
||||
crt = ["awscrt (==0.32.2)"]
|
||||
crt = ["awscrt (==0.36.0)"]
|
||||
|
||||
[[package]]
|
||||
name = "cachecontrol"
|
||||
|
|
@ -7593,19 +7593,19 @@ renderpm = ["rl-renderPM (>=4.0.3,<4.1)"]
|
|||
|
||||
[[package]]
|
||||
name = "requests"
|
||||
version = "2.31.0"
|
||||
version = "2.32.4"
|
||||
description = "Python HTTP for Humans."
|
||||
optional = false
|
||||
python-versions = ">=3.7"
|
||||
python-versions = ">=3.8"
|
||||
groups = ["main"]
|
||||
files = [
|
||||
{file = "requests-2.31.0-py3-none-any.whl", hash = "sha256:58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f"},
|
||||
{file = "requests-2.31.0.tar.gz", hash = "sha256:942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1"},
|
||||
{file = "requests-2.32.4-py3-none-any.whl", hash = "sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c"},
|
||||
{file = "requests-2.32.4.tar.gz", hash = "sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422"},
|
||||
]
|
||||
|
||||
[package.dependencies]
|
||||
certifi = ">=2017.4.17"
|
||||
charset-normalizer = ">=2,<4"
|
||||
charset_normalizer = ">=2,<4"
|
||||
idna = ">=2.5,<4"
|
||||
urllib3 = ">=1.21.1,<3"
|
||||
|
||||
|
|
@ -9565,4 +9565,4 @@ bindings = ["ghostscript"]
|
|||
[metadata]
|
||||
lock-version = "2.1"
|
||||
python-versions = ">=3.12.10,<3.13"
|
||||
content-hash = "0d5f25bb32481ba8b3c917b42bbab385dba2d5f1b0142c05d69665e1febb7a93"
|
||||
content-hash = "e7342912cea361d2e2ad2c9d9510f446208096ebcf99b8514e3ad9b1471ffc3e"
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ authors = [ "Mathieu Benoit <mathben@technolibre.ca>",]
|
|||
[tool.poetry.dependencies]
|
||||
python = ">=3.12.10,<3.13"
|
||||
a2wsgi = ">=1.10.6"
|
||||
aiobotocore = "3.9.0"
|
||||
aiobotocore = "3.9.1"
|
||||
altcha = ">=2.0.0"
|
||||
ansi2html = "^1.9.5"
|
||||
apispec = "^6.10.0"
|
||||
|
|
@ -32,8 +32,8 @@ bandit = "^1.9.4"
|
|||
base64io = "^1.0.3"
|
||||
beautifulsoup4 = "4.13.5"
|
||||
bokeh = "3.6.3"
|
||||
boto3 = "1.43.49"
|
||||
botocore = "1.43.49"
|
||||
boto3 = "1.43.75"
|
||||
botocore = "1.43.75"
|
||||
cachetools = "^7.2.0"
|
||||
cairosvg = "^2.9.1"
|
||||
caldav = "1.3.9"
|
||||
|
|
@ -173,7 +173,7 @@ radon = "^6.0.1"
|
|||
redis = "^8.1.0"
|
||||
regex = "^2026.9.10"
|
||||
reportlab = "4.1.0"
|
||||
requests = "2.31.0"
|
||||
requests = "2.32.4"
|
||||
requests-oauthlib = "^2.0.0"
|
||||
requests-toolbelt = "^1.0.0"
|
||||
responses = "^0.26.3"
|
||||
|
|
@ -208,7 +208,7 @@ xmltodict = "0.13.0"
|
|||
zeep = "4.2.1"
|
||||
zklib = "^0.1.1"
|
||||
[[tool.poetry.dependencies.factur-x]]
|
||||
version = ">=4.2"
|
||||
version = ">=6.8"
|
||||
markers = "platform_machine != \"s390x\""
|
||||
|
||||
[[tool.poetry.dependencies.factur-x]]
|
||||
|
|
|
|||
|
|
@ -18,6 +18,9 @@ googletrans-py==4.0.0
|
|||
#chardet==3.0.4
|
||||
openai==2.54.0
|
||||
idna==3.20
|
||||
# Odoo 18 épingle requests 2.31.0, touchée par CVE-2024-35195 et
|
||||
# CVE-2024-47081, corrigées en 2.32.4. L'épingle d'ERPLibre l'emporte.
|
||||
requests==2.32.4
|
||||
|
||||
# Module infobip_whatsapp_integration
|
||||
# Ignore it, need another version of requests
|
||||
|
|
@ -86,9 +89,9 @@ pillow==12.3.0
|
|||
# exigée par s3fs (>=2.19.0,<4.0.0).
|
||||
s3fs==2026.9.0
|
||||
fsspec==2026.9.0
|
||||
aiobotocore==3.9.0
|
||||
botocore==1.43.49
|
||||
boto3==1.43.49
|
||||
aiobotocore==3.9.1
|
||||
botocore==1.43.75
|
||||
boto3==1.43.75
|
||||
|
||||
# factur-x >= 4.0 dépend de saxonche, qui encapsule SaxonC. Saxonica ne publie
|
||||
# de roue que pour x86_64, aarch64, macOS et Windows — aucune pour s390x, et
|
||||
|
|
@ -96,7 +99,7 @@ boto3==1.43.49
|
|||
# en amont, GraalVM Native Image ne ciblant pas s390x.
|
||||
# La 3.x n'exige que lxml et pypdf. On y retombe là où saxonche n'existe pas,
|
||||
# au prix de la validation Schematron.
|
||||
factur-x>=4.2 ; platform_machine != 's390x'
|
||||
factur-x>=6.8 ; platform_machine != 's390x'
|
||||
factur-x<4 ; platform_machine == 's390x'
|
||||
|
||||
# PyMuPDF (OCA_edi) : MuPDF ne se construit pas sur s390x. On l'y écarte, au
|
||||
|
|
|
|||
|
|
@ -10,8 +10,8 @@
|
|||
# conditional_formatting._cf_rules, qui n'ont pas d'équivalent public en
|
||||
# 3.1.2. Le test de fuite de test_transform_external.py est ce qui
|
||||
# surveille cette borne à la montée de version.
|
||||
openpyxl==3.1.2
|
||||
xlsxwriter==3.1.9
|
||||
openpyxl==3.1.5
|
||||
xlsxwriter==3.2.9
|
||||
xlrd==2.0.1
|
||||
access-parser==0.0.6
|
||||
chardet==5.2.0
|
||||
|
|
|
|||
|
|
@ -113,12 +113,24 @@ def get_lst_manifest_py(config, ignore_dir_startswith: list = None):
|
|||
)
|
||||
|
||||
|
||||
# A file under one of these directories documents or illustrates, it does not
|
||||
# declare what an addon needs: an example requirements.txt with a loose
|
||||
# ">=" would otherwise override a pin for the whole environment.
|
||||
IGNORED_DIR_NAMES = {"doc", "docs", "example", "examples"}
|
||||
|
||||
|
||||
def get_file_from_glob(
|
||||
config,
|
||||
glob_txt,
|
||||
ignore_dir_startswith: list = None,
|
||||
force_add_item: list = None,
|
||||
):
|
||||
"""Files matching glob_txt under the Odoo tree of the active version.
|
||||
|
||||
A path is skipped when a directory of it is named in IGNORED_DIR_NAMES,
|
||||
compared by exact name, or when it starts with one of
|
||||
ignore_dir_startswith. force_add_item is appended without filtering.
|
||||
"""
|
||||
lst_v = []
|
||||
# TODO take all groups odoo##.# from manifest, will create a dependency
|
||||
# Hardcode logic from manifest
|
||||
|
|
@ -131,6 +143,8 @@ def get_file_from_glob(
|
|||
a_dirname = os.path.dirname(a)
|
||||
if a_dirname.startswith(".repo/") or a_dirname.startswith(".venv"):
|
||||
continue
|
||||
if IGNORED_DIR_NAMES.intersection(Path(a_dirname).parts):
|
||||
continue
|
||||
if ignore_dir_startswith:
|
||||
ignore_it = False
|
||||
for item_ignore_dir in ignore_dir_startswith:
|
||||
|
|
|
|||
Loading…
Reference in a new issue