pin pyyaml to 5.3.1

NTIA · Aug 8, 2023 · 25f6223 · 25f6223
1 parent 4db900d
commit 25f6223
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/src/requirements-dev.txt b/src/requirements-dev.txt
@@ -318,7 +318,7 @@ pytz==2022.7.1
     #   django
     #   djangorestframework
     #   drf-yasg
-pyyaml==5.4.1
+pyyaml==5.3.1
     # via
     #   -r requirements.txt
     #   docker-compose

diff --git a/src/requirements.in b/src/requirements.in
@@ -22,3 +22,8 @@ scos_tekrsa @ git+https://github.com/NTIA/[email protected]
 certifi>=2023.07.22   # CVE-2023-37920
 cryptography>=41.0.3  # GHSA-jm77-qphf-c4w8
 sqlparse>=0.4.4       # CVE-2023-30608
+
+# PyYAML 5.4 is broken: https://github.com/yaml/pyyaml/issues/724
+# And docker-compose requires <6.0
+# This should be removed once the docker-compose dependency is dropped
+pyyaml==5.3.1
diff --git a/src/requirements.txt b/src/requirements.txt
@@ -153,8 +153,9 @@ pytz==2022.7.1
     #   django
     #   djangorestframework
     #   drf-yasg
-pyyaml==5.4.1
+pyyaml==5.3.1
     # via
+    #   -r requirements.in
     #   docker-compose
     #   ray
 ray==2.5.1