[Snyk] Fix for 13 vulnerabilities

[PatrickJnr]

Snyk has created this PR to fix 13 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• requirements.txt

⚠️ Warning

torpy 1.1.6 requires cryptography, which is not installed.
pypiwin32 223 requires pywin32, which is not installed.
inquirerpy 0.3.4 requires prompt-toolkit, which is not installed.
beautifulsoup4 4.12.3 requires soupsieve, which is not installed.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Uncontrolled Recursion
🦉 Allocation of Resources Without Limits or Throttling

[PatrickJnr]

This upgrade contains multiple major version changes with significant breaking changes, including a major version downgrade of urllib3.

High Risk Upgrades

• urllib3 @2.0.7 → @1.26.19 (HIGH): This is a major version downgrade. Code using urllib3 v2.x features will break. Breaking changes in v2.0 that are being reverted include: dropped support for Python < 3.7, a default minimum TLS version of 1.2, and the removal of legacy APIs. [17, 23, 25] Any application code relying on v2.x features or security defaults must be reviewed and adapted to the older 1.x series API. [17, 25]

• protobuf @3.20.3 → @4.25.8 (HIGH): This major upgrade introduces significant breaking changes. The Python package switched to a new, faster upb backend starting with version 4.21.0 (following 3.20.1). [15] This change requires that any .proto files are re-compiled with a newer protoc (version >= 3.19.0) and may require code changes, as some APIs like UnknownFields() have been replaced. [15] This upgrade is known to cause dependency conflicts with other libraries. [28]

• setuptools @40.5.0 → @65.5.1 (HIGH): This is a large jump for a critical build tool. setuptools has introduced many breaking changes in this range, moving away from setup.py commands and deprecating many distutils features. [29] Upgrading across this many versions will likely expose the build process to numerous previously-unseen deprecations that have since become errors, potentially breaking the application's build and deployment pipeline. [18, 30]

Medium Risk Upgrades

• cryptography @45.0.7 → @46.0.5 (MEDIUM): Version 46.0.0 drops support for Python 3.7. [3, 4] This is an environment-breaking change if you are using that Python version.

• gevent @22.10.2 → @23.9.0 (MEDIUM): The target version 23.9.0 requires Python 3.9 or newer. [12] This will break environments running on older Python versions like 3.7 or 3

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.