Using prometheus_client 0.20.0.post1

Details: Version 0.20.0 from Pypi, plus the following changes: * Removed CBC ciphers to address CVE-2013-0169 (LUCKY13) (PR 1051) * Reject invalid HTTP methods and resources (PR 1019) Signed-off-by: Andreas Maier <[email protected]>
zhmcclient · Jul 29, 2024 · 6248e50 · 6248e50
1 parent a21b2cf
commit 6248e50
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/minimum-constraints-install.txt b/minimum-constraints-install.txt
@@ -18,7 +18,8 @@ wheel==0.38.1
 # Direct dependencies for install (must be consistent with requirements.txt)
 
 zhmcclient==1.14.0
-prometheus-client==0.19.0
+# TODO: Use official prometheus-client version (0.21.0 ?) once released.
+# prometheus-client==0.21.0
 urllib3==1.26.19
 jsonschema==3.2.0
 six==1.16.0

diff --git a/requirements.txt b/requirements.txt
@@ -10,7 +10,13 @@
 zhmcclient>=1.14.0
 
 # prometheus-client 0.19.0 added support for HTTPS/mTLS
-prometheus-client>=0.19.0
+# prometheus-client 0.20.0 improved HTTPS/mTLS support
+# prometheus-client 0.20.0.post1 (on forked repo) adds the following PRs:
+# - Removed CBC ciphers to address CVE-2013-0169 (LUCKY13) (PR https://github.com/prometheus/client_python/pull/1051)
+# - Reject invalid HTTP methods and resources (PR https://github.com/prometheus/client_python/pull/1019)
+# TODO: Use official prometheus-client version (0.21.0 ?) with these PRs once released.
+prometheus-client @ git+https://github.com/andy-maier/client_python.git@release_0.20.0.post1
+# prometheus-client>=0.21.0
 
 urllib3>=1.26.19
 jsonschema>=3.2.0