Commit 7459904
committed
security: remove dead pip-freeze snapshot carrying 11 Dependabot CVE alerts
Removes gridappsd-field-bus-lib/info/requirements.txt, a stale pip-freeze
export that no CI workflow, Dockerfile, pixi config, or source file
references (confirmed via full-repo grep). The file pinned vulnerable
versions that generated 11 open Dependabot alerts:
- urllib3==1.26.20: 5 alerts (4 HIGH, 1 MEDIUM)
GHSA-qccp-gfcp-xxvc, GHSA-38jv-5279-wg99, GHSA-2xpw-w6gg-jr37,
GHSA-gm62-xv2j-4w53, GHSA-pq67-6m6q-mj2v
- requests==2.28.2: 4 MEDIUM alerts
GHSA-gc5v-m9x4-r6x2, GHSA-9hjg-9r4m-mvj7, GHSA-9wx4-h78v-vm56,
GHSA-j8r2-6x86-q33q
- idna==3.10: 1 MEDIUM alert (GHSA-65pc-fj4g-8rjx)
- pygments==2.19.2: 1 LOW alert (GHSA-5239-wwwm-4pmq)
The file was never installed by any build, test, or deploy step; it was
only ever touched by automated version-bump commits. The real dependency
declaration for gridappsd-field-bus-lib lives in
gridappsd-field-bus-lib/pyproject.toml. This mirrors PR #214 which
already removed the same file from the develop branch.1 parent 514e917 commit 7459904
1 file changed
Lines changed: 0 additions & 44 deletions
This file was deleted.
0 commit comments