mathben/erplibre
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity

[UPD] requirement: pin requests 2.32.4 over the 2.31.0 of Odoo 18

Browse source 
Odoo 18 pins requests 2.31.0, affected by CVE-2024-35195 and
CVE-2024-47081, both fixed in 2.32.4. Left to the generated resolution,
the version followed whatever an addon repository declared, down to an
example requirements file under a doc/ directory. The ERPLibre pin now
wins the conflict and states its reason.
Checked: poetry lock resolves, requests is the only package that moves.

--- FR ---

[UPD] requirement : requests 2.32.4 plutôt que le 2.31.0 d'Odoo 18

Odoo 18 épingle requests 2.31.0, touchée par CVE-2024-35195 et
CVE-2024-47081, toutes deux corrigées en 2.32.4. Livrée à la résolution
générée, la version suivait ce qu'un dépôt d'addons déclarait, jusqu'à un
requirements d'exemple sous un répertoire doc/. L'épingle d'ERPLibre
l'emporte désormais et dit sa raison.
Vérifié : poetry lock résout, requests est le seul paquet qui bouge.

Assisted-by: Claude Opus 5.5
This commit is contained in:
Mathieu Benoit 2026-09-25 04:14:51 -04:00
parent 3316f70223
commit 46acd94a29
3 changed files with 10 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
requirement/poetry.odoo18.0_python3.12.10.lock
View file

@ -7593,19 +7593,19 @@ renderpm = ["rl-renderPM (>=4.0.3,<4.1)"]
[[package]]
name = "requests"
version = "2.31.0"
version = "2.32.4"
description = "Python HTTP for Humans."
optional = false
python-versions = ">=3.7"
python-versions = ">=3.8"
groups = ["main"]
files = [
{file = "requests-2.31.0-py3-none-any.whl", hash = "sha256:58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f"},
{file = "requests-2.31.0.tar.gz", hash = "sha256:942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1"},
{file = "requests-2.32.4-py3-none-any.whl", hash = "sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c"},
{file = "requests-2.32.4.tar.gz", hash = "sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422"},
]
[package.dependencies]
certifi = ">=2017.4.17"
charset-normalizer = ">=2,<4"
charset_normalizer = ">=2,<4"
idna = ">=2.5,<4"
urllib3 = ">=1.21.1,<3"
@ -9565,4 +9565,4 @@ bindings = ["ghostscript"]
[metadata]
lock-version = "2.1"
python-versions = ">=3.12.10,<3.13"
content-hash = "12a1d5b0492e1090c4a85b9a7d0cad722328cd94200827e066a2518aa3de5a7c"
content-hash = "e7342912cea361d2e2ad2c9d9510f446208096ebcf99b8514e3ad9b1471ffc3e"

2
requirement/pyproject.odoo18.0_python3.12.10.toml
View file

@ -173,7 +173,7 @@ radon = "^6.0.1"
redis = "^8.1.0"
regex = "^2026.9.10"
reportlab = "4.1.0"
requests = "2.31.0"
requests = "2.32.4"
requests-oauthlib = "^2.0.0"
requests-toolbelt = "^1.0.0"
responses = "^0.26.3"

3
requirement/requirements.odoo18.0_python3.12.10.txt
View file

@ -18,6 +18,9 @@ googletrans-py==4.0.0
#chardet==3.0.4
openai==2.54.0
idna==3.20
# Odoo 18 épingle requests 2.31.0, touchée par CVE-2024-35195 et
# CVE-2024-47081, corrigées en 2.32.4. L'épingle d'ERPLibre l'emporte.
requests==2.32.4
# Module infobip_whatsapp_integration
# Ignore it, need another version of requests