From 46acd94a290cc2627fbce7de944fcec441089ac6 Mon Sep 17 00:00:00 2001
From: Mathieu Benoit <mathben@technolibre.ca>
Date: Fri, 25 Sep 2026 04:14:51 -0400
Subject: [PATCH] [UPD] requirement: pin requests 2.32.4 over the 2.31.0 of
 Odoo 18
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Odoo 18 pins requests 2.31.0, affected by CVE-2024-35195 and
CVE-2024-47081, both fixed in 2.32.4. Left to the generated resolution,
the version followed whatever an addon repository declared, down to an
example requirements file under a doc/ directory. The ERPLibre pin now
wins the conflict and states its reason.
Checked: poetry lock resolves, requests is the only package that moves.

--- FR ---

[UPD] requirement : requests 2.32.4 plutôt que le 2.31.0 d'Odoo 18

Odoo 18 épingle requests 2.31.0, touchée par CVE-2024-35195 et
CVE-2024-47081, toutes deux corrigées en 2.32.4. Livrée à la résolution
générée, la version suivait ce qu'un dépôt d'addons déclarait, jusqu'à un
requirements d'exemple sous un répertoire doc/. L'épingle d'ERPLibre
l'emporte désormais et dit sa raison.
Vérifié : poetry lock résout, requests est le seul paquet qui bouge.

Assisted-by: Claude Opus 5.5
---
 requirement/poetry.odoo18.0_python3.12.10.lock      | 12 ++++++------
 requirement/pyproject.odoo18.0_python3.12.10.toml   |  2 +-
 requirement/requirements.odoo18.0_python3.12.10.txt |  3 +++
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/requirement/poetry.odoo18.0_python3.12.10.lock b/requirement/poetry.odoo18.0_python3.12.10.lock
index 4a69254..48181d2 100644
--- a/requirement/poetry.odoo18.0_python3.12.10.lock
+++ b/requirement/poetry.odoo18.0_python3.12.10.lock
@@ -7593,19 +7593,19 @@ renderpm = ["rl-renderPM (>=4.0.3,<4.1)"]
 
 [[package]]
 name = "requests"
-version = "2.31.0"
+version = "2.32.4"
 description = "Python HTTP for Humans."
 optional = false
-python-versions = ">=3.7"
+python-versions = ">=3.8"
 groups = ["main"]
 files = [
-    {file = "requests-2.31.0-py3-none-any.whl", hash = "sha256:58cd2187c01e70e6e26505bca751777aa9f2ee0b7f4300988b709f44e013003f"},
-    {file = "requests-2.31.0.tar.gz", hash = "sha256:942c5a758f98d790eaed1a29cb6eefc7ffb0d1cf7af05c3d2791656dbd6ad1e1"},
+    {file = "requests-2.32.4-py3-none-any.whl", hash = "sha256:27babd3cda2a6d50b30443204ee89830707d396671944c998b5975b031ac2b2c"},
+    {file = "requests-2.32.4.tar.gz", hash = "sha256:27d0316682c8a29834d3264820024b62a36942083d52caf2f14c0591336d3422"},
 ]
 
 [package.dependencies]
 certifi = ">=2017.4.17"
-charset-normalizer = ">=2,<4"
+charset_normalizer = ">=2,<4"
 idna = ">=2.5,<4"
 urllib3 = ">=1.21.1,<3"
 
@@ -9565,4 +9565,4 @@ bindings = ["ghostscript"]
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.12.10,<3.13"
-content-hash = "12a1d5b0492e1090c4a85b9a7d0cad722328cd94200827e066a2518aa3de5a7c"
+content-hash = "e7342912cea361d2e2ad2c9d9510f446208096ebcf99b8514e3ad9b1471ffc3e"
diff --git a/requirement/pyproject.odoo18.0_python3.12.10.toml b/requirement/pyproject.odoo18.0_python3.12.10.toml
index 86d861a..82b6b9a 100644
--- a/requirement/pyproject.odoo18.0_python3.12.10.toml
+++ b/requirement/pyproject.odoo18.0_python3.12.10.toml
@@ -173,7 +173,7 @@ radon = "^6.0.1"
 redis = "^8.1.0"
 regex = "^2026.9.10"
 reportlab = "4.1.0"
-requests = "2.31.0"
+requests = "2.32.4"
 requests-oauthlib = "^2.0.0"
 requests-toolbelt = "^1.0.0"
 responses = "^0.26.3"
diff --git a/requirement/requirements.odoo18.0_python3.12.10.txt b/requirement/requirements.odoo18.0_python3.12.10.txt
index b0f7128..c80c28b 100644
--- a/requirement/requirements.odoo18.0_python3.12.10.txt
+++ b/requirement/requirements.odoo18.0_python3.12.10.txt
@@ -18,6 +18,9 @@ googletrans-py==4.0.0
 #chardet==3.0.4
 openai==2.54.0
 idna==3.20
+# Odoo 18 épingle requests 2.31.0, touchée par CVE-2024-35195 et
+# CVE-2024-47081, corrigées en 2.32.4. L'épingle d'ERPLibre l'emporte.
+requests==2.32.4
 
 # Module infobip_whatsapp_integration
 # Ignore it, need another version of requests