Security fixes

.circleci/config.yml

@@ -5,16 +5,18 @@ orbs:
 jobs:
   install_and_update_dependencies:
     docker:
-      - image: circleci/python:3.8.6-node
+      - image: cimg/python:3.8-node
     working_directory: ~/repo
     steps:
       - checkout
+      - run: python --version
+      - run: node --version
       - restore_cache:
           keys:
             - v2-dependencies-{{ checksum "Pipfile.lock" }}-{{ checksum "thumbs/Pipfile.lock" }}
             - v2-dependencies-default
-      - run: &install-pipenv sudo pip install -U urllib3 cryptography==3.3.2 pipenv pip --quiet --no-input
-      - run: sudo pip uninstall -y poetry
+      - run: &install-pipenv pip install -U urllib3 cryptography==3.3.2 pipenv pip --quiet --no-input
+      - run: pip uninstall -y poetry
       - run: pipenv install --dev
       - run: pipenv check # before save_cache so an insecure cache is never saved
       - run: make lambda-layers/DependenciesLayer/requirements.txt
@@ -32,7 +34,7 @@ jobs:
 
   run-tests:
     docker:
-      - image: circleci/python:3.8.6
+      - image: cimg/python:3.8-node
     working_directory: ~/repo
     steps:
       - checkout
@@ -84,7 +86,7 @@ jobs:
 
   sam_deploy:
     docker:
-      - image: circleci/python:3.8.6
+      - image: cimg/python:3.8.6
     working_directory: ~/repo/
     parameters:
       dc-environment:

Makefile

@@ -20,7 +20,7 @@ lambda-layers/DependenciesLayer:
 	mkdir -p $@
 
 lambda-layers/DependenciesLayer/requirements.txt: Pipfile Pipfile.lock lambda-layers/DependenciesLayer lambda-layers/DependenciesLayer ## Update the requirements.txt file used to build this Lambda function's DependenciesLayer
-	pipenv lock -r | sed "s/^-e //" >lambda-layers/DependenciesLayer/requirements.txt
+	pipenv requirements | sed "s/^-e //" >lambda-layers/DependenciesLayer/requirements.txt
 
 thumbs/requirements.txt: thumbs/Pipfile thumbs/Pipfile.lock ## Update the requirements.txt file used to build this Lambda function's DependenciesLayer
 	cd thumbs && pipenv lock -r | sed "s/^-e //" >requirements.txt

Pipfile

@@ -7,43 +7,38 @@ url = "https://pypi.org/simple"
 verify_ssl = true
 
 [dev-packages]
-aws-sam-cli = "==1.40.1"
+aws-sam-cli = "==1.70.0"
 
 [packages]
 boto3 = "*"
 aws-wsgi = {ref = "a5b800373c326e75f705d400c48f7df301409724", git = "https://github.com/DemocracyClub/awsgi.git"}
 contextlib2 = "==0.5.5"
 configparser = "==3.5.0"
 cssselect = "==0.9.1"
-django-braces = "==1.14.0"
-django-extensions = "==3.1.5"
-django-localflavor = "==1.1"
+django-braces = "==1.15.0"
+django-extensions = "==3.2.1"
+django-localflavor = "==3.1"
 django-markdown-deux = "==1.0.5"
-django-storages = "==1.7"
+django-storages = "==1.13.2"
 django-uk-political-parties = {git = "https://github.com/DemocracyClub/django-uk-political-parties.git"}
-djangorestframework = ">=3.9.1"
+djangorestframework = "==3.14.0"
 durationpy = "==0.4"
-enum34 = "==1.1.6"
 fixtures = "==3.0.0"
 flake8 = "==3.8.3"
-funcsigs = "==1.0.2"
 futures = "==3.1.1"
 dj-pagination = "==2.4.0"
 linecache2 = "==1.0.0"
 lxml = "==4.8.0"
 markdown2 = "==2.4.0"
-mccabe = "==0.6.1"
 mock = "==2.0.0"
 oauthlib = "==2.0.2"
-pbr = "==3.0.0"
 piexif = "==1.0.12"
-placebo = "==0.8.1"
 pyparsing = "==2.2.0"
 python-dateutil = "==2.6.0"
 python-memcached = "==1.57"
 python-mimeparse = "==0.1.4"
 python-openid = "==2.2.5"
-python-slugify = "==1.2.4"
+python-slugify = "==7.0.0"
 python-subunit = "==1.0.0"
 requests-oauthlib = "==0.8.0"
 sentry-sdk = "*"
@@ -55,20 +50,16 @@ tqdm = "==4.11.2"
 traceback2 = "==1.4.0"
 unittest2 = "==1.1.0"
 wsgi-request-logger = "==0.4.6"
-Django = "==2.2.27"
+Django = ">=4.1"
 Pillow = "==9.0.1"
 python-Levenshtein = "==0.12.0"
-PyYAML = ">=4.2b1"
 Unidecode = "==0.4.20"
 aloe-django = "==0.2.0"
 factory-boy = "*"
 responses = "*"
 django-ses = "==2.6.0"
-future = "==0.16.0"
 django-pipeline = "==1.6.14"
-docutils = "==0.14"
 django-static-jquery = "==2.1.4"
-setuptools = "==62.1.0"
 faker = "*"
 werkzeug = "==2.0.3"
 black = "==19.10b0"
@@ -81,8 +72,7 @@ libsass = "*"
 django-formtools = "==2.2"
 django-debug-toolbar = "*"
 django-filter = "*"
-click = "==8.0.4"
-flask = "==2.0.2"
+aws-sam-cli = "==1.70.0"
 
 [scripts]
 collectstatic = "python manage.py collectstatic -c --noinput"