## Summary Removes `gridappsd-field-bus-lib/info/requirements.txt`, a stale pip-freeze export that no CI workflow, Dockerfile, pixi config, or source file references (confirmed via full-repo grep). The file is never installed by any build, test, or deploy step; it was only ever touched by automated version-bump commits. Deleting it closes all 11 open Dependabot alerts. This mirrors PR #214, which already removed this same file from the `develop` branch with the same rationale and confirmed tests still pass (pixi run test: 51 passed, test-field-bus: 10 passed). ## Alerts resolved **urllib3==1.26.20 (was 5 alerts, 4 HIGH + 1 MEDIUM):** - GHSA-qccp-gfcp-xxvc (HIGH): sensitive headers forwarded across origins in proxied redirects - GHSA-38jv-5279-wg99 (HIGH): decompression-bomb safeguards bypassed on redirects - GHSA-2xpw-w6gg-jr37 (HIGH): streaming API improperly handles highly compressed data - GHSA-gm62-xv2j-4w53 (HIGH): unbounded number of links in decompression chain - GHSA-pq67-6m6q-mj2v (MEDIUM): retries not disabled on PoolManager instantiation **requests==2.28.2 (was 4 MEDIUM alerts):** - GHSA-gc5v-m9x4-r6x2: insecure temp file reuse in extract_zipped_paths() - GHSA-9hjg-9r4m-mvj7: .netrc credentials leaked via malicious URLs - GHSA-9wx4-h78v-vm56: Session does not re-verify after verify=False - GHSA-j8r2-6x86-q33q: Proxy-Authorization header leak **idna==3.10 (was 1 MEDIUM alert):** - GHSA-65pc-fj4g-8rjx: CVE-2024-3651 bypass via specially crafted inputs to idna.encode() **Pygments==2.19.2 (was 1 LOW alert):** - GHSA-5239-wwwm-4pmq: ReDoS via inefficient regex for GUID matching Total: 11 alerts resolved (4 HIGH, 6 MEDIUM, 1 LOW). ## Why delete rather than bump The file is a dead pip-freeze export with no consumer. The real field-bus dependency declaration is in `gridappsd-field-bus-lib/pyproject.toml`. A clean venv install from `pyproject.toml` already resolves urllib3 2.7.0, requests 2.34.2, idna 3.18, and Pygments 2.20.0: all safe versions. Bumping pins in a file that is never installed would leave the file in place as a future alert source. ## Verification - Full-repo grep confirms zero references to this file path. - Clean venv install from `gridappsd-field-bus-lib/pyproject.toml` succeeded; `import gridappsd_field_bus` passes. - Resolved versions from `pyproject.toml`: urllib3 2.7.0, requests 2.34.2, idna 3.18, Pygments 2.20.0 (all at or above safe floors). - `git diff --name-only origin/main...HEAD` shows exactly one file changed.