Pin to requests 2.20 or later. Fixes #491.

pypa · Sep 22, 2019 · 20c33ca · 20c33ca
1 parent 2f8c336
commit 20c33ca
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/docs/changelog.rst b/docs/changelog.rst
@@ -3,6 +3,8 @@
 =========
 Changelog
 =========
+* :bug:`491` Require requests 2.20 or later to avoid reported security
+  vulnerabilities in earlier releases.
 * :release:`1.15.0 <2019-09-17>`
 * :feature:`488` Improved output on ``check`` command:
   Prints a message when there are no distributions given to check.

diff --git a/setup.py b/setup.py
@@ -72,7 +72,7 @@
     install_requires=[
         "pkginfo >= 1.4.2",
         "readme_renderer >= 21.0",
-        "requests >= 2.5.0, != 2.15, != 2.16",
+        "requests >= 2.20",
         "requests-toolbelt >= 0.8.0, != 0.9.0",
         "setuptools >= 0.7.0",
         "tqdm >= 4.14",