The requirements.txt file is out of date, and is only used during tox and not as part of the final product. The spec files for the rpm discard the requirements.txt as part of building the rpms https://opendev.org/starlingx/distcloud/src/branch/master/distributedcloud/c... The product (ISO) builds and packages with python2-requests-2.21 and python2-sqlalchemy-1.1.11 so there are no vulnerabilities. We should get into the habit of updating those files, since it means that the version of those python modules that we are running tox against, is not the same as we are shipping with. You are welcome to raise a Launchpad (cosmetic, or minor) about cleaning those up. Al From: Qian, Bin [mailto:Bin.Qian@windriver.com] Sent: Wednesday, February 05, 2020 4:10 PM To: starlingx-discuss@lists.starlingx.io Subject: [Starlingx-discuss] [distcloud-client][security] security vulnerability detected by GitHub Hello, As part of the activity to upload Startlingx repos to GitHub mirror, the distcloud-client is now uploaded to GitHub [1]. Please be aware that there are total 3 vulnerabilities detected by GitHub during the upload. 1. Known moderate severity security vulnerability detected in SQLAlchemy < 1.3.0 defined in requirements.txt<https://github.com/starlingx/distcloud-client/blob/master/requirements.txt>. 2. Known moderate severity security vulnerability detected in requests <= 2.19.1 defined in requirements.txt<https://github.com/starlingx/distcloud-client/blob/master/distributedcloud-client/requirements.txt>. 3. Known moderate severity security vulnerability detected in SQLAlchemy < 1.3.0 defined in requirements.txt<https://github.com/starlingx/distcloud-client/blob/master/requirements.txt>. Do we have planned actions to take care of the vulnerabilities? Best regards, Bin [1] https://github.com/starlingx/distcloud-client