913636b6b1
There's a regression[0] in bandit 1.6.0 which causes bandit to stop respecting excluded directories, and our tests throw a bunch of violations. Blacklist this version, but allow newer versions as there is already a pull request[1] to fix it, and I expect it will be included in the next release. Also fix the requirements job which was broken by https://review.opendev.org/657890 adding a cap on Sphinx on Python 2. [0] https://github.com/PyCQA/bandit/issues/488 [1] https://github.com/PyCQA/bandit/pull/489 Co-Authored-By: Jake Yip <jake.yip@unimelb.edu.au> Task: 33401 Story: 2005740 Change-Id: I34dc36c5236debc42424073af2c2d2104e18179a
26 lines
912 B
Plaintext
26 lines
912 B
Plaintext
# The order of packages is significant, because pip processes them in the order
|
|
# of appearance. Changing the order has an impact on the overall integration
|
|
# process, which may cause wedges in the gate later.
|
|
|
|
# Despite above warning added by global sync process, please use
|
|
# ascii betical order.
|
|
|
|
bandit!=1.6.0,>=1.1.0 # Apache-2.0
|
|
bashate>=0.5.1 # Apache-2.0
|
|
coverage!=4.4,>=4.0 # Apache-2.0
|
|
doc8>=0.6.0 # Apache-2.0
|
|
fixtures>=3.0.0 # Apache-2.0/BSD
|
|
hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0
|
|
mock>=2.0.0 # BSD
|
|
oslotest>=3.2.0 # Apache-2.0
|
|
osprofiler>=1.4.0 # Apache-2.0
|
|
os-testr>=1.0.0 # Apache-2.0
|
|
python-subunit>=1.0.0 # Apache-2.0/BSD
|
|
pytz>=2013.6 # MIT
|
|
sphinx!=1.6.6,!=1.6.7,>=1.6.2;python_version>='3.4' # BSD
|
|
sphinx!=1.6.6,!=1.6.7,>=1.6.2,<2.0.0;python_version=='2.7' # BSD
|
|
testrepository>=0.0.18 # Apache-2.0/BSD
|
|
stestr>=2.0.0 # Apache-2.0
|
|
testscenarios>=0.4 # Apache-2.0/BSD
|
|
testtools>=2.2.0 # MIT
|