tree f183cae9057186d70afe1e2b20ffb93963382948
parent 7e53dc8aa75272e8efad7d95c99d4e1727070ee5
author David Pursehouse <dpursehouse@collab.net> 1555465460 +0900
committer David Pursehouse <dpursehouse@collab.net> 1555465702 +0900

[CVE-2019-7164] Upgrade SqlAlchemy to ~= 1.3.0

SqlAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL
Injection via the order_by parameter.  See [1] for details.

This was reported by Github's automated vulnerability alert [2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2019-7164
[2] https://github.com/GerritCodeReview/k8s-gerrit/network/alert/Pipfile.lock/SQLAlchemy/open

Change-Id: Id6f217fc4e7c4edc8a417d5d688c96f1f65b7fe3