core/homeassistant/package_constraints.txt

PyJWT==1.7.1
PyNaCl==1.3.0
aiohttp==3.6.2
aiohttp_cors==0.7.0
astral==1.10.1
async_timeout==3.0.1
attrs==19.3.0
bcrypt==3.1.7
certifi>=2020.4.5.1
ciso8601==2.1.3
cryptography==2.9.2
defusedxml==0.6.0
distro==1.5.0
emoji==0.5.4
hass-nabucasa==0.35.0
home-assistant-frontend==20200820.0
importlib-metadata==1.6.0;python_version<'3.8'
jinja2>=2.11.1
netdisco==2.8.2
paho-mqtt==1.5.0
pillow==7.2.0
pip>=8.0.3
python-slugify==4.0.1
pytz>=2020.1
pyyaml==5.3.1
requests==2.24.0
ruamel.yaml==0.15.100
sqlalchemy==1.3.18
voluptuous-serialize==2.4.0
voluptuous==0.11.7
yarl==1.4.2
zeroconf==0.28.1

pycryptodome>=3.6.6

# Constrain urllib3 to ensure we deal with CVE-2019-11236 & CVE-2019-11324
urllib3>=1.24.3

# Constrain httplib2 to protect against CVE-2020-11078
httplib2>=0.18.0

# Not needed for our supported Python versions
enum34==1000000000.0.0

# This is a old unmaintained library and is replaced with pycryptodome
pycrypto==1000000000.0.0
Add default config to constaint file (#24423) 2019-06-10 21:38:14 +00:00			`PyJWT==1.7.1`
			`PyNaCl==1.3.0`
Upgrade aiohttp to 3.6.2 (#38082) 2020-07-22 21:56:28 +00:00			`aiohttp==3.6.2`
Add default config to constaint file (#24423) 2019-06-10 21:38:14 +00:00			`aiohttp_cors==0.7.0`
Upgrade astral to 1.10.1 (#21474) 2019-02-27 13:07:51 +00:00			`astral==1.10.1`
Upgrade async_timeout to 3.0.1 (#17655) 2018-10-21 12:13:30 +00:00			`async_timeout==3.0.1`
Upgrade attrs to 19.3.0 (#28421) 2019-11-01 12:10:53 +00:00			`attrs==19.3.0`
Upgrade bcrypt to 3.1.7 (#24850) 2019-07-01 00:23:47 +00:00			`bcrypt==3.1.7`
Upgrade certifi to >=2020.4.5.1 (#34080) 2020-04-12 10:52:04 +00:00			`certifi>=2020.4.5.1`
Use ciso8601 library to parse datetime faster (#32128) 2020-02-24 16:33:10 +00:00			`ciso8601==2.1.3`
Upgrade cryptography to 2.9.2 (#35084) 2020-05-04 08:38:26 +00:00			`cryptography==2.9.2`
Add bandit, use to catch known vulnerable XML parsing (#28341) * Add bandit to pre-commit and CI, use to catch known vulnerable XML parsing * Use defusedxml instead of direct xml.etree to parse XML * Move config to tests/bandit.yaml 2019-11-18 08:10:15 +00:00			`defusedxml==0.6.0`
Upgrade distro to 1.5.0 (#34009) 2020-04-11 10:55:02 +00:00			`distro==1.5.0`
Handle Mobile App registrations for device names containing of only emoji (#36957) 2020-06-21 16:12:15 +00:00			`emoji==0.5.4`
Bump hass-nabucasa to avoid the performance penalty loading ecdsa (#38056) 2020-08-03 10:55:30 +00:00			`hass-nabucasa==0.35.0`
Update frontend to 20200820.0 (#39085) 2020-08-20 15:48:24 +00:00			`home-assistant-frontend==20200820.0`
Use the built-in importlib.metadata library in Python 3.8+ (#36225) importlib_metadata is a backport of this library for Python 3.7 and older. 2020-06-17 13:21:14 +00:00			`importlib-metadata==1.6.0;python_version<'3.8'`
Upgrade jinja2 to >=2.11.1 (#33244) 2020-03-26 15:12:12 +00:00			`jinja2>=2.11.1`
Bump netdisco to 2.8.2 to accomodate new zeroconf exception (#38949) 2020-08-17 07:46:30 +00:00			`netdisco==2.8.2`
Add MQTT to constraints file (#38049) 2020-07-22 02:19:32 +00:00			`paho-mqtt==1.5.0`
Add image integration (#38969) 2020-08-19 09:33:04 +00:00			`pillow==7.2.0`
Upgrade aiohttp to 3.2.1 (#14517) * Upgrade aiohttp to 3.2.1 * Upgrade async_timeout to 3.0.0 * Update the order of the requirements 2018-05-19 08:04:00 +00:00			`pip>=8.0.3`
Bump python-slugify to 4.0.1 (#38140) * Bump python-slugify to 4.0.1 * Dummy commit to re-trigger tests 2020-07-24 14:55:54 +00:00			`python-slugify==4.0.1`
Upgrade pytz to 2020.1 (#35174) 2020-05-04 13:16:37 +00:00			`pytz>=2020.1`
Upgrade pyyaml to 5.3.1 (#33246) 2020-03-26 15:14:07 +00:00			`pyyaml==5.3.1`
Upgrade requests to 2.24.0 (#36886) 2020-06-17 23:26:29 +00:00			`requests==2.24.0`
Upgrade ruamel_yaml to 0.15.100 (#26095) 2019-08-21 16:13:40 +00:00			`ruamel.yaml==0.15.100`
Upgrade sqlalchemy to 1.3.18 (#37123) 2020-06-26 13:15:54 +00:00			`sqlalchemy==1.3.18`
Bump voluptuous-serialize 2.4.0 (#37241) * Bump voluptuous-serialize 2.4.0 * Add constant to demo * gen reqs 2020-07-07 03:04:35 +00:00			`voluptuous-serialize==2.4.0`
Upgrade voluptuous to 0.11.7 (#26007) 2019-08-16 19:31:28 +00:00			`voluptuous==0.11.7`
Pin yarl dependency to 1.4.2 as core dependency (#38428) 2020-07-31 20:06:02 +00:00			`yarl==1.4.2`
Update zeroconf to fix ServiceBrowser leak on cancelation (#38933) 2020-08-17 20:52:54 +00:00			`zeroconf==0.28.1`
Block dependencies that depend on enum34 (#8698) * Block dependencies that depend on enum34 * Remove uninstalling enum34 * Update validation script * Add constraints to tox.ini * Upgrade yeelight to version that uses enum-compat * Disable sensor.skybeacon * Lint 2017-08-05 06:06:10 +00:00
Avoid insecure pycryptodome (#16238) 2018-08-28 10:49:50 +00:00			`pycryptodome>=3.6.6`

Add minimal version contrain to urllib3 (#32031) 2020-02-20 18:19:09 +00:00			`# Constrain urllib3 to ensure we deal with CVE-2019-11236 & CVE-2019-11324`
			`urllib3>=1.24.3`

Mark min version of httplib2 (#36330) 2020-06-01 07:44:18 +00:00			`# Constrain httplib2 to protect against CVE-2020-11078`
			`httplib2>=0.18.0`

Drop Python 3.6 support (#29978) 2019-12-16 06:29:19 +00:00			`# Not needed for our supported Python versions`
Block dependencies that depend on enum34 (#8698) * Block dependencies that depend on enum34 * Remove uninstalling enum34 * Update validation script * Add constraints to tox.ini * Upgrade yeelight to version that uses enum-compat * Disable sensor.skybeacon * Lint 2017-08-05 06:06:10 +00:00			`enum34==1000000000.0.0`
Don't allow to use a old unsecure library (#12715) * Don't allow to use a old unsecury library * Update gen_requirements_all.py * Cryptodome fix for python-broadlink * Coinbase cryptodome fix 2018-02-27 09:58:45 +00:00
			`# This is a old unmaintained library and is replaced with pycryptodome`
			`pycrypto==1000000000.0.0`