chore(pre-commit): autoupdate hooks

[pre-commit-ci]

updates:

• github.com/pycqa/bandit: 1.7.4 → 1.7.5

[thekaveman]

This is interesting!

https://bandit.readthedocs.io/en/1.7.5/plugins/b113_request_without_timeout.html

This plugin test checks for requests calls without a timeout specified.
...
New in version 1.7.5.

Hence the pre-commit failure here.

[machikoyasuda]

From dev meeting: Let’s add timeouts to our requests so Bandit passes these tests

[angela-tran]

I was looking into what value we should use for the timeout. According to request docs, we can set values for the "connect" timeout and the "read" timeout.

I think we might want to have these driven by configurable settings rather than hard-coding them. So basically we would introduce new environment variables for these two values, update docs, and use them everywhere that we make an HTTP request via requests.

[thekaveman]

Let's keep this as simple as possible. I don't think we have any reason or data to suggest we need to worry about timeouts anywhere in the app. Fine to create an env var, but let's have a sane default and not expect that we'll need to override it really ever, unless this becomes a real issue.

[angela-tran]

The bandit failure should be addressed by the commits I pushed. However, this is blocked due to the same error that is blocking #1325

[angela-tran]

This is now unblocked and ready for review

[thekaveman]

I was looking around the web at different ways to set this timeout, hoping for a simpler configuration that would avoid having to repeat the setting each time. Nothing compelling came up. A Session object doesn't feel correct since we're requesting from many different services.

This works! 👍