security: remove dead pip-freeze snapshot carrying 11 Dependabot CVE alerts

[craigpnnl]

Summary

Removes gridappsd-field-bus-lib/info/requirements.txt, a stale pip-freeze export that no CI workflow, Dockerfile, pixi config, or source file references (confirmed via full-repo grep). The file is never installed by any build, test, or deploy step; it was only ever touched by automated version-bump commits. Deleting it closes all 11 open Dependabot alerts.

This mirrors PR #214, which already removed this same file from the develop branch with the same rationale and confirmed tests still pass (pixi run test: 51 passed, test-field-bus: 10 passed).

Alerts resolved

urllib3==1.26.20 (was 5 alerts, 4 HIGH + 1 MEDIUM):

• GHSA-qccp-gfcp-xxvc (HIGH): sensitive headers forwarded across origins in proxied redirects
• GHSA-38jv-5279-wg99 (HIGH): decompression-bomb safeguards bypassed on redirects
• GHSA-2xpw-w6gg-jr37 (HIGH): streaming API improperly handles highly compressed data
• GHSA-gm62-xv2j-4w53 (HIGH): unbounded number of links in decompression chain
• GHSA-pq67-6m6q-mj2v (MEDIUM): retries not disabled on PoolManager instantiation

requests==2.28.2 (was 4 MEDIUM alerts):

• GHSA-gc5v-m9x4-r6x2: insecure temp file reuse in extract_zipped_paths()
• GHSA-9hjg-9r4m-mvj7: .netrc credentials leaked via malicious URLs
• GHSA-9wx4-h78v-vm56: Session does not re-verify after verify=False
• GHSA-j8r2-6x86-q33q: Proxy-Authorization header leak

idna==3.10 (was 1 MEDIUM alert):

• GHSA-65pc-fj4g-8rjx: CVE-2024-3651 bypass via specially crafted inputs to idna.encode()

Pygments==2.19.2 (was 1 LOW alert):

• GHSA-5239-wwwm-4pmq: ReDoS via inefficient regex for GUID matching

Total: 11 alerts resolved (4 HIGH, 6 MEDIUM, 1 LOW).

Why delete rather than bump

The file is a dead pip-freeze export with no consumer. The real field-bus dependency declaration is in gridappsd-field-bus-lib/pyproject.toml. A clean venv install from pyproject.toml already resolves urllib3 2.7.0, requests 2.34.2, idna 3.18, and Pygments 2.20.0: all safe versions. Bumping pins in a file that is never installed would leave the file in place as a future alert source.

Verification

• Full-repo grep confirms zero references to this file path.
• Clean venv install from gridappsd-field-bus-lib/pyproject.toml succeeded; import gridappsd_field_bus passes.
• Resolved versions from pyproject.toml: urllib3 2.7.0, requests 2.34.2, idna 3.18, Pygments 2.20.0 (all at or above safe floors).
• git diff --name-only origin/main...HEAD shows exactly one file changed.