Merge pull request #65968 from s0undt3ch/hotfix/merge-forward-into-3005.x

[3005.x] Merge 3005.5 into 3005.x

.github/workflows/docs.yml

@@ -2,27 +2,36 @@ name: Docs
 
 on: [push, pull_request]
 
+permissions:
+  contents: read  # for dorny/paths-filter to fetch a list of changed files
+  pull-requests: read  # for dorny/paths-filter to read pull requests
+
 jobs:
   Salt:
     name: Build Salt Documentation
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "medium", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
-      image: python:3.8.6-slim-buster
+      image: ghcr.io/saltstack/salt-ci-containers/python:3.8
 
     steps:
 
     - name: Install System Deps
       run: |
-        echo "deb http://deb.debian.org/debian buster-backports main" >> /etc/apt/sources.list
         apt-get update
-        apt-get install -y enchant git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev xz-utils
+        apt-get upgrade debian-keyring -y
-        apt-get install -y git/buster-backports
+        echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list
+        apt-get update
+        apt-get install -y enchant-2 git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev xz-utils
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         fetch-depth: 0
 
+    - name: Add Git Safe Directory
+      run: |
+        git config --global --add safe.directory $(pwd)
+
     - name: Install Nox
       env:
         PIP_EXTRA_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
@@ -60,21 +69,26 @@ jobs:
 
   Manpages:
     name: Build Salt man Pages
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "medium", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
-      image: python:3.8.6-slim-buster
+      image: ghcr.io/saltstack/salt-ci-containers/python:3.8
 
     steps:
 
     - name: Install System Deps
       run: |
-        echo "deb http://deb.debian.org/debian buster-backports main" >> /etc/apt/sources.list
         apt-get update
-        apt-get install -y enchant git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
+        apt-get upgrade debian-keyring -y
-        apt-get install -y git/buster-backports
+        echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list
+        apt-get update
+        apt-get install -y enchant-2 git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
+
+    - name: Add Git Safe Directory
+      run: |
+        git config --global --add safe.directory $(pwd)
 
     - id: changed-files
       name: Get Changed Files

.github/workflows/lint.yml

@@ -2,24 +2,33 @@ name: Lint
 
 on: [push, pull_request]
 
+permissions:
+  contents: read  # for dorny/paths-filter to fetch a list of changed files
+  pull-requests: read  # for dorny/paths-filter to read pull requests
+
 jobs:
   Salt:
     name: Lint Salt's Source Code
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "medium", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
-      image: python:3.8.6-slim-buster
+      image: ghcr.io/saltstack/salt-ci-containers/python:3.8
 
     steps:
 
     - name: Install System Deps
       run: |
-        echo "deb http://deb.debian.org/debian buster-backports main" >> /etc/apt/sources.list
         apt-get update
-        apt-get install -y enchant git gcc make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
+        apt-get upgrade debian-keyring -y
-        apt-get install -y git/buster-backports
+        echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list
+        apt-get update
+        apt-get install -y enchant-2 git gcc make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
+
+    - name: Add Git Safe Directory
+      run: |
+        git config --global --add safe.directory $(pwd)
 
     - name: Install Nox
       env:
@@ -67,26 +76,32 @@ jobs:
 
   Tests:
     name: Lint Salt's Test Suite
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "medium", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
-      image: python:3.8.6-slim-buster
+      image: ghcr.io/saltstack/salt-ci-containers/python:3.8
 
     steps:
 
     - name: Install System Deps
       run: |
-        echo "deb http://deb.debian.org/debian buster-backports main" >> /etc/apt/sources.list
         apt-get update
-        apt-get install -y enchant git gcc make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
+        apt-get upgrade debian-keyring -y
-        apt-get install -y git/buster-backports
+        echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list
+        apt-get update
+        apt-get install -y enchant-2 git gcc make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
+
+    - name: Add Git Safe Directory
+      run: |
+        git config --global --add safe.directory $(pwd)
 
     - name: Install Nox
       env:
         PIP_EXTRA_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
       run: |
+        git config --global --add safe.directory $(pwd)
         python -m pip install --upgrade pip
         pip install nox
 

.github/workflows/pr-checks.yml

@@ -4,15 +4,19 @@ on:
   pull_request_target:
     types: [opened, synchronize]
 
+permissions:
+  contents: read  # for dorny/paths-filter to fetch a list of changed files
+  pull-requests: read  # for dorny/paths-filter to read pull requests
+
 jobs:
 
   Check-Changed-Files-Docstrings:
     name: Check Docstrings For Changed Files On PR
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@v4
         with:
           python-version: '3.9'
 
@@ -20,6 +24,7 @@ jobs:
         env:
           PIP_EXTRA_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
         run: |
+          git config --global --add safe.directory $(pwd)
           python -m pip install --upgrade pip
           pip install pre-commit pygithub
 

.github/workflows/pre-commit.yml

@@ -2,33 +2,43 @@ name: Pre-Commit
 
 on: [push, pull_request]
 
+permissions:
+  contents: read  # for dorny/paths-filter to fetch a list of changed files
+  pull-requests: read  # for dorny/paths-filter to read pull requests
+
 jobs:
   Pre-Commit:
     name: Run Pre-Commit Against Salt
 
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
-      image: python:3.8.6-slim-buster
+      image: ghcr.io/saltstack/salt-ci-containers/python:3.8
 
     steps:
 
     - name: Install System Deps
       run: |
-        echo "deb http://deb.debian.org/debian buster-backports main" >> /etc/apt/sources.list
         apt-get update
-        apt-get install -y enchant git gcc make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
+        apt-get upgrade debian-keyring -y
-        apt-get install -y git/buster-backports
+        echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list
+        apt-get update
+        apt-get install -y enchant-2 git gcc make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
+
+    - name: Add Git Safe Directory
+      run: |
+        git config --global --add safe.directory $(pwd)
 
     - name: Install Pre-Commit
       env:
         PIP_EXTRA_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
       run: |
+        git config --global --add safe.directory $(pwd)
         python -m pip install --upgrade pip
         pip install pre-commit
-        pre-commit install --install-hooks
+        pre-commit install --install-hooks || cat /root/.cache/pre-commit/pre-commit.log
 
     - id: changed-files
       name: Get Changed Files

.github/workflows/release-tag.yml

@@ -19,7 +19,7 @@ on:
 jobs:
   GenerateTagRelease:
     name: Generate Tag and Github Release
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
     steps:
     - uses: dev-drprasad/delete-tag-and-release@v0.2.0
       if: github.event.inputs.reTag == 'true'
@@ -29,7 +29,7 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         repository: ${{ github.event.inputs.saltRepo }}
         ref: ${{ github.event.inputs.saltBranch }}
@@ -42,11 +42,11 @@ jobs:
         custom_tag: ${{ github.event.inputs.saltVersion }}
 
     - name: Set up Python 3.8
-      uses: actions/setup-python@v1
+      uses: actions/setup-python@v4
       with:
         python-version: 3.8
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Install pypa/build
       run: |
         python -m pip install build --user

.github/workflows/release.yml

@@ -15,10 +15,14 @@ on:
         default: "master"
         required: false
 
+permissions:
+  contents: read  # for dorny/paths-filter to fetch a list of changed files
+  pull-requests: read  # for dorny/paths-filter to read pull requests
+
 jobs:
   SaltChangelog:
     name: Build Salt Changelog
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
       image: python:3.8.6-slim-buster
@@ -32,7 +36,7 @@ jobs:
         apt-get install -y enchant git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev xz-utils
         apt-get install -y git/buster-backports
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.branch }}
         fetch-depth: 0
@@ -81,7 +85,7 @@ jobs:
 
   Manpages:
     name: Build Salt man Pages
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
       image: python:3.8.6-slim-buster
@@ -96,7 +100,7 @@ jobs:
         apt-get install -y enchant git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
         apt-get install -y git/buster-backports
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.branch }}
 
@@ -144,7 +148,7 @@ jobs:
   PullRequest:
     needs: [SaltChangelog, Manpages]
     name: Create Pull Request
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
       image: python:3.8.6-slim-buster
@@ -157,7 +161,7 @@ jobs:
         apt-get install -y enchant git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev xz-utils
         apt-get install -y git/buster-backports
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.branch }}
         fetch-depth: 0

.github/workflows/triage.yml

@@ -7,13 +7,13 @@ on:
 jobs:
   label-and-assign:
     name: Triage New Issue
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
     steps:
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v4
         with:
           python-version: 3.8
 

.github/workflows/twine-check.yml

@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-20.04
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Setup Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v4
       with:
         python-version: '3.8'
 

.pre-commit-config.yaml

@@ -21,6 +21,9 @@ repos:
           - --include=requirements/zeromq.txt
           - --include=requirements/zeromq.txt
           - requirements/static/pkg/linux.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-linux-3.6-zmq-requirements
@@ -34,6 +37,9 @@ repos:
           - --include=requirements/base.txt
           - --include=requirements/zeromq.txt
           - requirements/static/pkg/linux.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-linux-3.7-zmq-requirements
@@ -47,6 +53,9 @@ repos:
           - --include=requirements/base.txt
           - --include=requirements/zeromq.txt
           - requirements/static/pkg/linux.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-linux-3.8-zmq-requirements
@@ -60,6 +69,9 @@ repos:
           - --include=requirements/base.txt
           - --include=requirements/zeromq.txt
           - requirements/static/pkg/linux.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-linux-3.9-zmq-requirements
@@ -73,6 +85,9 @@ repos:
           - --include=requirements/base.txt
           - --include=requirements/zeromq.txt
           - requirements/static/pkg/linux.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-linux-3.10-zmq-requirements
@@ -86,6 +101,9 @@ repos:
           - --include=requirements/base.txt
           - --include=requirements/zeromq.txt
           - requirements/static/pkg/linux.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-freebsd-3.7-zmq-requirements
@@ -99,6 +117,9 @@ repos:
           - --include=requirements/base.txt
           - --include=requirements/zeromq.txt
           - requirements/static/pkg/freebsd.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-freebsd-3.8-zmq-requirements
@@ -112,6 +133,9 @@ repos:
           - --include=requirements/base.txt
           - --include=requirements/zeromq.txt
           - requirements/static/pkg/freebsd.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-freebsd-3.9-zmq-requirements
@@ -125,6 +149,9 @@ repos:
           - --include=requirements/base.txt
           - --include=requirements/zeromq.txt
           - requirements/static/pkg/freebsd.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-freebsd-3.10-zmq-requirements
@@ -138,6 +165,9 @@ repos:
           - --include=requirements/base.txt
           - --include=requirements/zeromq.txt
           - requirements/static/pkg/freebsd.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-darwin-3.9-zmq-requirements
@@ -150,6 +180,9 @@ repos:
           - --platform=darwin
           - --include=requirements/darwin.txt
           - requirements/static/pkg/darwin.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-darwin-3.10-zmq-requirements
@@ -162,6 +195,9 @@ repos:
           - --platform=darwin
           - --include=requirements/darwin.txt
           - requirements/static/pkg/darwin.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-windows-3.7-zmq-requirements
@@ -174,6 +210,9 @@ repos:
           - --platform=windows
           - --include=requirements/windows.txt
           - requirements/static/pkg/windows.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-windows-3.8-zmq-requirements
@@ -186,6 +225,9 @@ repos:
           - --platform=windows
           - --include=requirements/windows.txt
           - requirements/static/pkg/windows.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       - id: pip-tools-compile
         alias: compile-pkg-windows-3.9-zmq-requirements
@@ -198,6 +240,9 @@ repos:
           - --platform=windows
           - --include=requirements/windows.txt
           - requirements/static/pkg/windows.in
+        additional_dependencies:
+          - setuptools<58.0
+          - pip>=20.2.4,<21.2
 
       # There's no pywin32 package for Py3.10 yet
 #      - id: pip-tools-compile
@@ -1216,7 +1261,7 @@ repos:
           - docs.check
         additional_dependencies:
           - blessings==1.7
-          - pyyaml==6.0
+          - pyyaml==6.0.1
           - distro==1.7.0
           - jinja2==3.0.3
           - msgpack==1.0.3
@@ -1233,7 +1278,7 @@ repos:
           - filemap.check
         additional_dependencies:
           - blessings==1.7
-          - pyyaml==6.0
+          - pyyaml==6.0.1
           - distro==1.7.0
           - jinja2==3.0.3
           - msgpack==1.0.3
@@ -1254,7 +1299,7 @@ repos:
           - loader.check-virtual
         additional_dependencies:
           - blessings==1.7
-          - pyyaml==6.0
+          - pyyaml==6.0.1
           - distro==1.7.0
           - jinja2==3.0.3
           - msgpack==1.0.3
@@ -1275,7 +1320,7 @@ repos:
           - docstrings.check
         additional_dependencies:
           - blessings==1.7
-          - pyyaml==6.0
+          - pyyaml==6.0.1
           - distro==1.7.0
           - jinja2==3.0.3
           - msgpack==1.0.3
@@ -1298,7 +1343,7 @@ repos:
           - --error-on-known-failures
         additional_dependencies:
           - blessings==1.7
-          - pyyaml==6.0
+          - pyyaml==6.0.1
           - distro==1.7.0
           - jinja2==3.0.3
           - msgpack==1.0.3

CHANGELOG.md

@@ -7,6 +7,80 @@ Versions are `MAJOR.PATCH`.
 
 # Changelog
 
+Salt 3005.5 (2024-01-19)
+========================
+
+Security
+--------
+
+- Fix CVE-2024-22231 Prevent directory traversal when creating syndic cache directory on the master.
+- Fix CVE-2024-22232 Prevent directory traversal attacks in the master's serve_file method.
+
+These vulnerablities were discovered and reported by:
+Yudi Zhao(Huawei Nebula Security Lab),Chenwei Jiang(Huawei Nebula Security Lab) (#565)
+
+
+Salt v3005.4 (2023-10-16)
+=========================
+
+Security
+--------
+
+- Fix CVE-2023-34049 by ensuring we do not use a predictable name for the script and correctly check returncode of scp command.
+  This only impacts salt-ssh users using the pre-flight option. (cve-2023-34049)
+- Bump to `cryptography==41.0.4` due to https://github.com/advisories/GHSA-v8gr-m533-ghj9 (#65267)
+- Bump to `urllib3==1.26.17` or `urllib3==2.0.6` due to https://github.com/advisories/GHSA-v845-jxx5-vc9f (#65334)
+- Bump to `gitpython==3.1.37` due to https://github.com/advisories/GHSA-cwvm-v4w8-q58c (#65383)
+
+
+## Salt v3005.3 (2023-09-14)
+
+### Fixed
+
+- Fix __env__ and improve cache cleaning see more info at pull #65017. (#65002)
+
+
+### Security
+
+- Update to `gitpython>=3.1.35` due to https://github.com/advisories/GHSA-wfm5-v35h-vwf4 and https://github.com/advisories/GHSA-cwvm-v4w8-q58c (#65167)
+
+
+Salt v3005.2 (2023-07-31)
+=========================
+
+Changed
+-------
+
+- Additional required package upgrades
+
+  * It's now `pyzmq>=20.0.0` on all platforms, and `<=22.0.3` just for windows.
+  * Upgrade to `pyopenssl==23.0.0` due to the cryptography upgrade. (#63757)
+
+
+Security
+--------
+
+- fix CVE-2023-20897 by catching exception instead of letting exception disrupt connection (cve-2023-20897)
+- Fixed gitfs cachedir_basename to avoid hash collisions. Added MP Lock to gitfs. These changes should stop race conditions. (cve-2023-20898)
+- Upgrade to `requests==2.31.0`
+
+  Due to:
+    * https://github.com/advisories/GHSA-j8r2-6x86-q33q (#64336)
+- Upgrade to `cryptography==41.0.3`(and therefor `pyopenssl==23.2.0` due to https://github.com/advisories/GHSA-jm77-qphf-c4w8)
+
+  Also resolves the following cryptography advisories:
+
+  Due to:
+    * https://github.com/advisories/GHSA-5cpq-8wj7-hf2v
+    * https://github.com/advisories/GHSA-x4qr-2fvf-3mr5
+    * https://github.com/advisories/GHSA-w7pp-m8wf-vj6r
+
+  There is no security upgrade available for Py3.5 (#64595)
+- Bump to `certifi==2023.07.22` due to https://github.com/advisories/GHSA-xqr8-7jwr-rhp7
+
+  Python 3.5 cannot get the updated requirements since certifi no longer supports this python version (#64720)
+
+
 Salt v3005.1-2 (2022-11-04)
 ===========================
 

cicd/amis.yml

@@ -1,5 +1,5 @@
 alma-8-x86_64: ami-0594d7cf435c3d2f7
-amazon-2-x86_64: ami-01226819a514516fe
+amazon-2-x86_64: ami-01cef47eb0f1d5363
 arch-lts-x86_64: ami-018a6b479dcb87969
 centos-7-x86_64: ami-05764f27cdf8f99e0
 centosstream-8-x86_64: ami-02fc0a57f9b1fa4ed
@@ -7,9 +7,6 @@ centosstream-9-x86_64: ami-09c9a8cff0874c232
 debian-10-amd64: ami-0eb32b3297dc438d0
 debian-11-amd64: ami-08bf6df84b4488e8a
 debian-11-arm64: ami-085ff5dc42735c52e
-debian-9-amd64: ami-033ed8f0f55cad1e0
-fedora-35-x86_64: ami-05dbe9d0b98ca2f9c
-freebsd-131-amd64: ami-0ef1a75f9b997e572
 opensuse-15-x86_64: ami-0b57dabce687992c3
 photon-3-x86_64: ami-080bc696fab4f5840
 ubuntu-1804-amd64: ami-0decb138fa5e24979

cicd/jenkins/pr-debian-9-amd64-py3-pytest

@@ -1,17 +0,0 @@
-@Library('salt@master-1.11') _
-
-runTestSuite(
-    concurrent_builds: 1,
-    distro_name: 'debian',
-    distro_version: '9',
-    distro_arch: 'amd64',
-    env: env,
-    jenkins_slave_label: 'kitchen-slave',
-    nox_env_name: 'pytest-zeromq',
-    nox_passthrough_opts: '--ssh-tests',
-    python_version: 'py3',
-    testrun_timeout: 6,
-    use_spot_instances: true,
-)
-
-// vim: ft=groovy

cicd/jenkins/pr-fedora-35-x86_64-py3-pytest

@@ -1,17 +0,0 @@
-@Library('salt@master-1.11') _
-
-runTestSuite(
-    concurrent_builds: 1,
-    distro_name: 'fedora',
-    distro_version: '35',
-    distro_arch: 'x86-64',
-    env: env,
-    jenkins_slave_label: 'kitchen-slave',
-    nox_env_name: 'pytest-zeromq',
-    nox_passthrough_opts: '--ssh-tests',
-    python_version: 'py3',
-    testrun_timeout: 6,
-    use_spot_instances: true,
-)
-
-// vim: ft=groovy

cicd/jenkins/pr-freebsd-131-amd64-py3-pytest

@@ -1,17 +0,0 @@
-@Library('salt@master-1.11') _
-
-runTestSuite(
-    concurrent_builds: 1,
-    distro_name: 'freebsd',
-    distro_version: '131',
-    distro_arch: 'amd64',
-    env: env,
-    jenkins_slave_label: 'kitchen-slave',
-    nox_env_name: 'pytest-zeromq',
-    nox_passthrough_opts: '--ssh-tests',
-    python_version: 'py3',
-    testrun_timeout: 6,
-    use_spot_instances: true,
-)
-
-// vim: ft=groovy

doc/_themes/saltstack2/layout.html

@@ -152,7 +152,7 @@
                             <span class="icon-bar"></span>
                             <span class="icon-bar"></span>
                         </button>
-                        <a href="http://saltstack.com/" target="_blank"><img src="{{ pathto('_static/images/SaltStack_white.svg', 1) }}" class="nolightbox" height="40px" width="170px"></a>
+                        <a href="https://saltproject.io/" target="_blank"><img src="https://gitlab.com/saltstack/open/salt-branding-guide/-/raw/master/logos/SaltProject_altlogo_teal.png" class="nolightbox" height="44.5px" width="125px"></a>
                     </div>
                     <!-- Collect the nav links, forms, and other content for toggling -->
                     <div class="collapse navbar-collapse" id="navbarCollapse">
@@ -263,17 +263,17 @@
                                 <p>You are viewing preview docs for the next major release, {{ next_release }}. Switch to docs for the latest stable release, <a data-container="body" data-toggle="tooltip" data-placement="bottom" title="Docs for the latest stable release" href="/en/latest/">{{ latest_release }}</a>.</p>
                                 {% endif %}
                                 <br>
-                                <p><a href="http://saltstack.com">saltstack.com</a></p>
+                                <p><a href="https://saltproject.io/">saltproject.io</a></p>
 
                                 <div class="footer">
-                                    <p>© {{ copyright }} SaltStack. All Rights Reserved, SaltStack Inc. | <a href="http://saltstack.com/privacy-policy" target="_blank">Privacy Policy</a></p>
+                                    <p>© {{ copyright }} VMware, Inc. | <a href="https://www.vmware.com/help/privacy.html" target="_blank">Privacy Policy</a></p>
                                 </div>
                             </div>
                             <div class="col-sm-6">
                                  <!--
                                  <a href="https://saltstack.com/saltstack-enterprise/" target="_blank"><img class="nolightbox footer-banner center" src="{{ pathto('_static/images/enterprise_ad.jpg', 1) }}"/></a>
                                  -->
-                                 <a href="https://saltconf.com/ad" target="_blank"><img class="nolightbox footer-banner center" src="https://gitlab.com/saltstack/open/salt-branding-guide/-/raw/master/misc/banners/try_salt_now.png"/></a>
+                                 <a href="https://docs.saltproject.io/salt/user-guide/en/latest/index.html" target="_blank"><img class="nolightbox footer-banner center" src="https://gitlab.com/saltstack/open/salt-branding-guide/-/raw/master/misc/banners/try_salt_now.png"/></a>
                             </div>
                             {% endif %}
                         </div>
@@ -295,7 +295,7 @@
                 {% else %}
                 <a href="http://saltstack.com/support" target="_blank"><img class="nolightbox sidebar-banner center" src="{{ pathto('_static/images/banner-support.png', 1) }}"/></a>
                 {% endif %} #}-->
-                <a href="https://saltconf.com/menu-ad" target="_blank"><img class="nolightbox sidebar-banner center" src="https://gitlab.com/saltstack/open/salt-branding-guide/-/raw/master/misc/banners/saltconf.png"/></a>
+                <a href="https://saltproject.io" target="_blank"><img class="nolightbox sidebar-banner center" src="https://gitlab.com/saltstack/open/salt-branding-guide/-/raw/master/logos/SaltProject_altlogo_teal.png"/></a>
 
 
                 {% if build_type=="next" %}

doc/man/salt-api.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-API" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SALT-API" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt-api \- salt-api Command
 .

doc/man/salt-call.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-CALL" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SALT-CALL" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt-call \- salt-call Documentation
 .

doc/man/salt-cloud.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-CLOUD" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SALT-CLOUD" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt-cloud \- Salt Cloud Command
 .

doc/man/salt-cp.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-CP" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SALT-CP" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt-cp \- salt-cp Documentation
 .

doc/man/salt-key.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-KEY" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SALT-KEY" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt-key \- salt-key Documentation
 .

doc/man/salt-master.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-MASTER" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SALT-MASTER" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt-master \- salt-master Documentation
 .

doc/man/salt-minion.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-MINION" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SALT-MINION" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt-minion \- salt-minion Documentation
 .

doc/man/salt-proxy.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-PROXY" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SALT-PROXY" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt-proxy \- salt-proxy Documentation
 .

doc/man/salt-run.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-RUN" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SALT-RUN" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt-run \- salt-run Documentation
 .

doc/man/salt-ssh.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-SSH" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SALT-SSH" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt-ssh \- salt-ssh Documentation
 .

doc/man/salt-syndic.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-SYNDIC" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SALT-SYNDIC" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt-syndic \- salt-syndic Documentation
 .

doc/man/salt.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SALT" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt \- salt
 .

doc/man/salt.7

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT" "7" "Sep 26, 2022" "3005" "Salt"
+.TH "SALT" "7" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 salt \- Salt Documentation
 .
@@ -151127,7 +151127,7 @@ salt \(aq*\(aq cmd.powershell_all "dir mydirectory" force_list=True
 .UNINDENT
 .INDENT 0.0
 .TP
-.B salt.modules.cmdmod.retcode(cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/sh\(aq, python_shell=None, env=None, clean_env=False, template=None, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, password=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
+.B salt.modules.cmdmod.retcode(cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/bash\(aq, python_shell=None, env=None, clean_env=False, template=None, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, password=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
 Execute a shell command and return the command\(aqs return code.
 .INDENT 7.0
 .TP
@@ -151386,7 +151386,7 @@ salt \(aq*\(aq cmd.retcode "grep f" stdin=\(aqone\entwo\enthree\enfour\enfive\en
 .UNINDENT
 .INDENT 0.0
 .TP
-.B salt.modules.cmdmod.run(cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/sh\(aq, python_shell=None, env=None, clean_env=False, template=None, rstrip=True, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, bg=False, password=None, encoded_cmd=False, raise_err=False, prepend_path=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
+.B salt.modules.cmdmod.run(cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/bash\(aq, python_shell=None, env=None, clean_env=False, template=None, rstrip=True, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, bg=False, password=None, encoded_cmd=False, raise_err=False, prepend_path=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
 Execute the passed command and return the output as a string
 .INDENT 7.0
 .TP
@@ -151767,7 +151767,7 @@ salt \(aq*\(aq cmd.run cmd=\(aqsed \-e s/=/:/g\(aq
 .UNINDENT
 .INDENT 0.0
 .TP
-.B salt.modules.cmdmod.run_all(cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/sh\(aq, python_shell=None, env=None, clean_env=False, template=None, rstrip=True, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, redirect_stderr=False, password=None, encoded_cmd=False, prepend_path=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
+.B salt.modules.cmdmod.run_all(cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/bash\(aq, python_shell=None, env=None, clean_env=False, template=None, rstrip=True, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, redirect_stderr=False, password=None, encoded_cmd=False, prepend_path=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
 Execute the passed command and return a dict of return data
 .INDENT 7.0
 .TP
@@ -152110,7 +152110,7 @@ salt \(aq*\(aq cmd.run_all "grep f" stdin=\(aqone\entwo\enthree\enfour\enfive\en
 .UNINDENT
 .INDENT 0.0
 .TP
-.B salt.modules.cmdmod.run_bg(cmd, cwd=None, runas=None, group=None, shell=\(aq/bin/sh\(aq, python_shell=None, env=None, clean_env=False, template=None, umask=None, timeout=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, password=None, prepend_path=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
+.B salt.modules.cmdmod.run_bg(cmd, cwd=None, runas=None, group=None, shell=\(aq/bin/bash\(aq, python_shell=None, env=None, clean_env=False, template=None, umask=None, timeout=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, password=None, prepend_path=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
 New in version 2016.3.0.
 
 .sp
@@ -152411,7 +152411,7 @@ salt \(aq*\(aq cmd.run_bg cmd=\(aqls \-lR / | sed \-e s/=/:/g > /tmp/dontwait\(a
 .UNINDENT
 .INDENT 0.0
 .TP
-.B salt.modules.cmdmod.run_chroot(root, cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/sh\(aq, python_shell=True, binds=None, env=None, clean_env=False, template=None, rstrip=True, umask=None, output_encoding=None, output_loglevel=\(aqquiet\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, bg=False, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
+.B salt.modules.cmdmod.run_chroot(root, cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/bash\(aq, python_shell=True, binds=None, env=None, clean_env=False, template=None, rstrip=True, umask=None, output_encoding=None, output_loglevel=\(aqquiet\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, bg=False, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
 New in version 2014.7.0.
 
 .sp
@@ -152632,7 +152632,7 @@ salt \(aq*\(aq cmd.run_chroot /var/lib/lxc/container_name/rootfs \(aqsh /tmp/boo
 .UNINDENT
 .INDENT 0.0
 .TP
-.B salt.modules.cmdmod.run_stderr(cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/sh\(aq, python_shell=None, env=None, clean_env=False, template=None, rstrip=True, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, password=None, prepend_path=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
+.B salt.modules.cmdmod.run_stderr(cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/bash\(aq, python_shell=None, env=None, clean_env=False, template=None, rstrip=True, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, password=None, prepend_path=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
 Execute a command and only return the standard error
 .INDENT 7.0
 .TP
@@ -152909,7 +152909,7 @@ salt \(aq*\(aq cmd.run_stderr "grep f" stdin=\(aqone\entwo\enthree\enfour\enfive
 .UNINDENT
 .INDENT 0.0
 .TP
-.B salt.modules.cmdmod.run_stdout(cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/sh\(aq, python_shell=None, env=None, clean_env=False, template=None, rstrip=True, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, password=None, prepend_path=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
+.B salt.modules.cmdmod.run_stdout(cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/bash\(aq, python_shell=None, env=None, clean_env=False, template=None, rstrip=True, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, password=None, prepend_path=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
 Execute a command, and only return the standard out
 .INDENT 7.0
 .TP
@@ -153186,7 +153186,7 @@ salt \(aq*\(aq cmd.run_stdout "grep f" stdin=\(aqone\entwo\enthree\enfour\enfive
 .UNINDENT
 .INDENT 0.0
 .TP
-.B salt.modules.cmdmod.script(source, args=None, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/sh\(aq, python_shell=None, env=None, template=None, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, saltenv=None, use_vt=False, bg=False, password=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
+.B salt.modules.cmdmod.script(source, args=None, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/bash\(aq, python_shell=None, env=None, template=None, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, saltenv=None, use_vt=False, bg=False, password=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
 Download a script from a remote location and execute the script locally.
 The script can be located on the salt master file server or on an HTTP/FTP
 server.
@@ -153462,7 +153462,7 @@ salt \(aq*\(aq cmd.script salt://scripts/runme.sh stdin=\(aqone\entwo\enthree\en
 .UNINDENT
 .INDENT 0.0
 .TP
-.B salt.modules.cmdmod.script_retcode(source, args=None, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/sh\(aq, python_shell=None, env=None, template=\(aqjinja\(aq, umask=None, timeout=None, reset_system_locale=True, saltenv=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, use_vt=False, password=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
+.B salt.modules.cmdmod.script_retcode(source, args=None, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/bash\(aq, python_shell=None, env=None, template=\(aqjinja\(aq, umask=None, timeout=None, reset_system_locale=True, saltenv=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, use_vt=False, password=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
 Download a script from a remote location and execute the script locally.
 The script can be located on the salt master file server or on an HTTP/FTP
 server.
@@ -153687,7 +153687,7 @@ salt \(aq*\(aq cmd.script_retcode salt://scripts/runme.sh stdin=\(aqone\entwo\en
 .UNINDENT
 .INDENT 0.0
 .TP
-.B salt.modules.cmdmod.shell(cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/sh\(aq, env=None, clean_env=False, template=None, rstrip=True, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, bg=False, password=None, prepend_path=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
+.B salt.modules.cmdmod.shell(cmd, cwd=None, stdin=None, runas=None, group=None, shell=\(aq/bin/bash\(aq, env=None, clean_env=False, template=None, rstrip=True, umask=None, output_encoding=None, output_loglevel=\(aqdebug\(aq, log_callback=None, hide_output=False, timeout=None, reset_system_locale=True, ignore_retcode=False, saltenv=None, use_vt=False, bg=False, password=None, prepend_path=None, success_retcodes=None, success_stdout=None, success_stderr=None, **kwargs)
 Execute the passed command and return the output as a string.
 .sp
 New in version 2015.5.0.
@@ -192875,7 +192875,7 @@ Passes through all the parameters described in the
 \fI\%utils.http.query function\fP:
 .INDENT 7.0
 .TP
-.B salt.utils.http.query(url, method=\(aqGET\(aq, params=None, data=None, data_file=None, header_dict=None, header_list=None, header_file=None, username=None, password=None, auth=None, decode=False, decode_type=\(aqauto\(aq, status=False, headers=False, text=False, cookies=None, cookie_jar=None, cookie_format=\(aqlwp\(aq, persist_session=False, session_cookie_jar=None, data_render=False, data_renderer=None, header_render=False, header_renderer=None, template_dict=None, test=False, test_url=None, node=\(aqminion\(aq, port=80, opts=None, backend=None, ca_bundle=None, verify_ssl=None, cert=None, text_out=None, headers_out=None, decode_out=None, stream=False, streaming_callback=None, header_callback=None, handle=False, agent=\(aqSalt/3005+0na.a0d3c44\(aq, hide_fields=None, raise_error=True, formdata=False, formdata_fieldname=None, formdata_filename=None, decode_body=True, **kwargs)
+.B salt.utils.http.query(url, method=\(aqGET\(aq, params=None, data=None, data_file=None, header_dict=None, header_list=None, header_file=None, username=None, password=None, auth=None, decode=False, decode_type=\(aqauto\(aq, status=False, headers=False, text=False, cookies=None, cookie_jar=None, cookie_format=\(aqlwp\(aq, persist_session=False, session_cookie_jar=None, data_render=False, data_renderer=None, header_render=False, header_renderer=None, template_dict=None, test=False, test_url=None, node=\(aqminion\(aq, port=80, opts=None, backend=None, ca_bundle=None, verify_ssl=None, cert=None, text_out=None, headers_out=None, decode_out=None, stream=False, streaming_callback=None, header_callback=None, handle=False, agent=\(aqSalt/3005.4+8.ge88ed17326\(aq, hide_fields=None, raise_error=True, formdata=False, formdata_fieldname=None, formdata_filename=None, decode_body=True, **kwargs)
 Query a resource, and decode the return data
 .UNINDENT
 .INDENT 7.0
@@ -335748,8 +335748,8 @@ Alternate constructor that accept multiple recipients and rooms
 .B filter(record)
 Determine if the specified record is to be logged.
 .sp
-Is the specified record to be logged? Returns 0 for no, nonzero for
+Returns True if the record should be logged, or False otherwise.
-yes. If deemed appropriate, the record may be modified in\-place.
+If deemed appropriate, the record may be modified in\-place.
 .UNINDENT
 .UNINDENT
 .INDENT 0.0
@@ -448748,7 +448748,7 @@ installed2
 .UNINDENT
 .INDENT 0.0
 .TP
-.B salt.states.zcbuildout.installed(name, config=\(aqbuildout.cfg\(aq, quiet=False, parts=None, user=None, env=(), buildout_ver=None, test_release=False, distribute=None, new_st=None, offline=False, newest=False, python=\(aq/__w/salt/salt/.nox/docs\-man\-compress\-false\-update\-true\-clean\-true/bin/python\(aq, debug=False, verbose=False, unless=None, onlyif=None, use_vt=False, loglevel=\(aqdebug\(aq, **kwargs)
+.B salt.states.zcbuildout.installed(name, config=\(aqbuildout.cfg\(aq, quiet=False, parts=None, user=None, env=(), buildout_ver=None, test_release=False, distribute=None, new_st=None, offline=False, newest=False, python=\(aq/mnt/c/Users/alyssar/Documents/Git\-Projects/salt\-priv/.nox/docs\-man\-compress\-false\-update\-true\-clean\-true/bin/python\(aq, debug=False, verbose=False, unless=None, onlyif=None, use_vt=False, loglevel=\(aqdebug\(aq, **kwargs)
 Install buildout in a specific directory
 .sp
 It is a thin wrapper to modules.buildout.buildout
@@ -468050,6 +468050,140 @@ Add sample and shuffle functions from random (#62225)
 .IP \(bu 2
 Add "<tiamat> python" subcommand to allow execution or arbitrary scripts via bundled Python runtime (#62381)
 .UNINDENT
+.SS Salt 3005.1 Release Notes
+.sp
+Version 3005.1 is a bug fix release for 3005\&.
+.SS Fixed
+.INDENT 0.0
+.IP \(bu 2
+Fix arch parsing issue in apt source files (#62247)
+.IP \(bu 2
+Fixed parsing CDROM apt sources (#62474)
+.IP \(bu 2
+Use str() method instead of repo_line for when python3\-apt is installed or not in aptpkg.py. (#62546)
+.IP \(bu 2
+Remove the connection_timeout from netmiko_connection_args before netmiko_connection_args is added to __context__["netmiko_device"]["args"] which is passed along to the Netmiko library. (#62547)
+.IP \(bu 2
+fixes #62553 by checking for disabled master_type before starting master connection and skipping it if set. (#62553)
+.IP \(bu 2
+Fix runas with cmd module when using the onedir bundled packages (#62565)
+.IP \(bu 2
+Fix the Pyinstaller hooks to preserve the environment if None is passed. (#62567, #62628)
+.IP \(bu 2
+pkgrepo.managed sets wrong permissions on keys installed to /etc/apt/keyring (#62569)
+.IP \(bu 2
+pkgrepo.managed creates zero byte gpg files when dearmoring contents to the same filename (#62570)
+.IP \(bu 2
+Ensure default values for IPC Buffers are correct type (#62591)
+.IP \(bu 2
+Fix a hang on salt\-ssh when using sudo. (#62603)
+.IP \(bu 2
+Renderers now have access to the correct set of salt functions. (#62610, #62620)
+.IP \(bu 2
+Fix including Jinja template from absolute path (#62611)
+.IP \(bu 2
+include jmespath in package requirements (#62613)
+.IP \(bu 2
+Fix pkgrepo.managed signed\-by in test=true mode (#62662)
+.IP \(bu 2
+Ensure the status of the service is captured when the beacon function is called, even when the event is not being emitted. (#62675)
+.IP \(bu 2
+The sub proxies controlled by Deltaproxy need to have their own req_channel otherwise there are timeout exceptions when the __master_req_channel_payload is fired and reacted on. (#62708)
+.UNINDENT
+.SS Salt 3005.2 Release Notes
+.sp
+Version 3005.2 is a CVE security fix release for 3005\&.
+.SS Changed
+.INDENT 0.0
+.IP \(bu 2
+Additional required package upgrades
+.INDENT 2.0
+.IP \(bu 2
+It\(aqs now \fIpyzmq>=20.0.0\fP on all platforms, and \fI<=22.0.3\fP just for windows.
+.IP \(bu 2
+Upgrade to \fIpyopenssl==23.0.0\fP due to the cryptography upgrade. (#63757)
+.UNINDENT
+.UNINDENT
+.SS Security
+.INDENT 0.0
+.IP \(bu 2
+fix CVE\-2023\-20897 by catching exception instead of letting exception disrupt connection (cve\-2023\-20897)
+.IP \(bu 2
+Fixed gitfs cachedir_basename to avoid hash collisions. Added MP Lock to gitfs. These changes should stop race conditions. (cve\-2023\-20898)
+.IP \(bu 2
+Upgrade to \fIrequests==2.31.0\fP
+.INDENT 2.0
+.TP
+.B Due to:
+.INDENT 7.0
+.IP \(bu 2
+\fI\%https://github.com/advisories/GHSA\-j8r2\-6x86\-q33q\fP (#64336)
+.UNINDENT
+.UNINDENT
+.IP \(bu 2
+Upgrade to \fIcryptography==41.0.3\(ga(and therefor \(gapyopenssl==23.2.0\fP due to \fI\%https://github.com/advisories/GHSA\-jm77\-qphf\-c4w8\fP)
+.sp
+Also resolves the following cryptography advisories:
+.INDENT 2.0
+.TP
+.B Due to:
+.INDENT 7.0
+.IP \(bu 2
+\fI\%https://github.com/advisories/GHSA\-5cpq\-8wj7\-hf2v\fP
+.IP \(bu 2
+\fI\%https://github.com/advisories/GHSA\-x4qr\-2fvf\-3mr5\fP
+.IP \(bu 2
+\fI\%https://github.com/advisories/GHSA\-w7pp\-m8wf\-vj6r\fP
+.UNINDENT
+.UNINDENT
+.sp
+There is no security upgrade available for Py3.5 (#64595)
+.IP \(bu 2
+Bump to \fIcertifi==2023.07.22\fP due to \fI\%https://github.com/advisories/GHSA\-xqr8\-7jwr\-rhp7\fP
+.sp
+Python 3.5 cannot get the updated requirements since certifi no longer supports this python version (#64720)
+.UNINDENT
+.SS Salt 3005.3 Release Notes
+.sp
+Version 3005.3 is a Bug fix release for 3005\&.
+.SS Changed
+.INDENT 0.0
+.IP \(bu 2
+Fix __env__ and improve cache cleaning see more info at pull #65017. (#65002)
+.UNINDENT
+.SS Security
+.INDENT 0.0
+.IP \(bu 2
+Update to \fIgitpython>=3.1.35\fP due to \fI\%https://github.com/advisories/GHSA\-wfm5\-v35h\-vwf4\fP and \fI\%https://github.com/advisories/GHSA\-cwvm\-v4w8\-q58c\fP (#65167)
+.UNINDENT
+.SS Salt 3005.4 Release Notes
+.sp
+Version 3005.4 is a CVE security fix release for 3005\&.
+.SS Security
+.INDENT 0.0
+.IP \(bu 2
+Fix CVE\-2023\-34049 by ensuring we do not use a predictable name for the script and correctly check returncode of scp command.
+This only impacts salt\-ssh users using the pre\-flight option. (cve\-2023\-34049)
+.IP \(bu 2
+Bump to \fIcryptography==41.0.4\fP due to \fI\%https://github.com/advisories/GHSA\-v8gr\-m533\-ghj9\fP (#65267)
+.IP \(bu 2
+Bump to \fIurllib3==1.26.17\fP or \fIurllib3==2.0.6\fP due to \fI\%https://github.com/advisories/GHSA\-v845\-jxx5\-vc9f\fP (#65334)
+.IP \(bu 2
+Bump to \fIgitpython==3.1.37\fP due to \fI\%https://github.com/advisories/GHSA\-cwvm\-v4w8\-q58c\fP (#65383)
+.UNINDENT
+.SS Salt 3005.5 Release Notes
+.sp
+Version 3005.5 is a CVE security fix release for 3005\&.
+.SS Security
+.INDENT 0.0
+.IP \(bu 2
+Fix CVE\-2024\-22231 by preventing directory traversal when creating syndic cache directory on the master.
+.IP \(bu 2
+Fix CVE\-2024\-22232 Prevent directory traversal attacks in the master\(aqs serve_file method.
+.UNINDENT
+.sp
+These vulnerablities were discovered and reported by:
+Yudi Zhao(Huawei Nebula Security Lab),Chenwei Jiang(Huawei Nebula Security Lab) (#565)
 .SS Salt 3004 Release Notes \- Codename Silicon
 .SS New Features
 .SS Transactional System Support (MicroOS)

doc/man/spm.1

@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SPM" "1" "Sep 26, 2022" "3005.1" "Salt"
+.TH "SPM" "1" "Jan 24, 2024" "3005" "Salt"
 .SH NAME
 spm \- Salt Package Manager Command
 .

doc/topics/releases/3005.2.rst

@@ -0,0 +1,41 @@
+.. _release-3005-2:
+
+=========================
+Salt 3005.2 Release Notes
+=========================
+
+Version 3005.2 is a CVE security fix release for :ref:`3005 <release-3005>`.
+
+
+Changed
+-------
+
+- Additional required package upgrades
+
+  * It's now `pyzmq>=20.0.0` on all platforms, and `<=22.0.3` just for windows.
+  * Upgrade to `pyopenssl==23.0.0` due to the cryptography upgrade. (#63757)
+
+
+Security
+--------
+
+- fix CVE-2023-20897 by catching exception instead of letting exception disrupt connection (cve-2023-20897)
+- Fixed gitfs cachedir_basename to avoid hash collisions. Added MP Lock to gitfs. These changes should stop race conditions. (cve-2023-20898)
+- Upgrade to `requests==2.31.0`
+
+  Due to:
+    * https://github.com/advisories/GHSA-j8r2-6x86-q33q (#64336)
+- Upgrade to `cryptography==41.0.3`(and therefor `pyopenssl==23.2.0` due to https://github.com/advisories/GHSA-jm77-qphf-c4w8)
+
+  Also resolves the following cryptography advisories:
+
+  Due to:
+    * https://github.com/advisories/GHSA-5cpq-8wj7-hf2v
+    * https://github.com/advisories/GHSA-x4qr-2fvf-3mr5
+    * https://github.com/advisories/GHSA-w7pp-m8wf-vj6r
+
+  There is no security upgrade available for Py3.5 (#64595)
+- Bump to `certifi==2023.07.22` due to https://github.com/advisories/GHSA-xqr8-7jwr-rhp7
+
+  Python 3.5 cannot get the updated requirements since certifi no longer supports this python version (#64720)
+

doc/topics/releases/3005.3.rst

@@ -0,0 +1,19 @@
+.. _release-3005-3:
+
+=========================
+Salt 3005.3 Release Notes
+=========================
+
+Version 3005.3 is a Bug fix release for :ref:`3005 <release-3005>`.
+
+
+Changed
+-------
+
+- Fix __env__ and improve cache cleaning see more info at pull #65017. (#65002)
+
+
+Security
+--------
+
+- Update to `gitpython>=3.1.35` due to https://github.com/advisories/GHSA-wfm5-v35h-vwf4 and https://github.com/advisories/GHSA-cwvm-v4w8-q58c (#65167)

doc/topics/releases/3005.4.rst

@@ -0,0 +1,17 @@
+.. _release-3005-4:
+
+=========================
+Salt 3005.4 Release Notes
+=========================
+
+Version 3005.4 is a CVE security fix release for :ref:`3005 <release-3005>`.
+
+
+Security
+--------
+
+- Fix CVE-2023-34049 by ensuring we do not use a predictable name for the script and correctly check returncode of scp command.
+  This only impacts salt-ssh users using the pre-flight option. (cve-2023-34049)
+- Bump to `cryptography==41.0.4` due to https://github.com/advisories/GHSA-v8gr-m533-ghj9 (#65267)
+- Bump to `urllib3==1.26.17` or `urllib3==2.0.6` due to https://github.com/advisories/GHSA-v845-jxx5-vc9f (#65334)
+- Bump to `gitpython==3.1.37` due to https://github.com/advisories/GHSA-cwvm-v4w8-q58c (#65383)

doc/topics/releases/3005.5.rst

@@ -0,0 +1,16 @@
+.. _release-3005-5:
+
+=========================
+Salt 3005.5 Release Notes
+=========================
+
+Version 3005.5 is a CVE security fix release for :ref:`3005 <release-3005>`.
+
+Security
+--------
+
+- Fix CVE-2024-22231 by preventing directory traversal when creating syndic cache directory on the master.
+- Fix CVE-2024-22232 Prevent directory traversal attacks in the master's serve_file method.
+
+These vulnerablities were discovered and reported by:
+Yudi Zhao(Huawei Nebula Security Lab),Chenwei Jiang(Huawei Nebula Security Lab) (#565)

noxfile.py

@@ -10,6 +10,8 @@ Nox configuration script
 import datetime
 import os
 import pathlib
+import platform
+import subprocess
 import sys
 import tempfile
 
@@ -272,6 +274,20 @@ def _install_requirements(
     requirements_file = _get_pip_requirements_file(
         session, transport, requirements_type=requirements_type
     )
+    if _get_session_python_version_info(session) >= (3, 10):
+        # Workaround pyyaml issue https://github.com/yaml/pyyaml/issues/601
+        with open(requirements_file, encoding="utf-8") as rfh:
+            contents = rfh.read().lower()
+            for line in contents.splitlines():
+                if line.startswith("pyyaml"):
+                    session.install(
+                        "--progress-bar=off",
+                        "--no-build-isolation",
+                        "Cython<3.0",
+                        line.strip(),
+                        silent=PIP_INSTALL_SILENT,
+                    )
+                    break
     install_command = ["--progress-bar=off", "-r", requirements_file]
     session.install(*install_command, silent=PIP_INSTALL_SILENT)
 
@@ -721,6 +737,17 @@ def _pytest(session, coverage, cmd_args):
     # Create required artifacts directories
     _create_ci_directories()
 
+    if "amzn2" in platform.release():
+        # workaround on 3005 for https://github.com/saltstack/salt/issues/62851
+        subprocess.run(
+            [
+                "pip3",
+                "install",
+                "importlib_metadata<5.0.0",
+            ],
+            check=True,
+        )
+
     env = {"CI_RUN": "1" if CI_RUN else "0"}
 
     args = [
@@ -934,7 +961,14 @@ def docs(session, compress, update, clean):
     """
     Build Salt's Documentation
     """
-    session.notify("docs-html-{}(compress={})".format(session.python, compress))
+    session.notify(
+        find_session_runner(
+            session,
+            "docs-html-{}".format(session.python),
+            compress=compress,
+            clean=clean,
+        )
+    )
     session.notify(
         find_session_runner(
             session,

pkg/osx/build_env.sh

@@ -59,7 +59,7 @@ export MACOSX_DEPLOYMENT_TARGET
 
 # Versions we're going to install
 PY_VERSION=3.9
-PY_DOT_VERSION=3.9.16
+PY_DOT_VERSION=3.9.18
 ZMQ_VERSION=4.3.4
 LIBSODIUM_VERSION=1.0.18
 

pkg/osx/notarize.sh

@@ -6,18 +6,19 @@
 # Date: December 2020
 #
 # Description: This notarizes the macOS Installer Package (.pkg). It uses the
-#              `altool` xcode utility which is only available in the full
+#              `notarytool` xcode utility which became available in Xcode 13.
-#              Xcode package. It is not available in Command Line Tools.
+#              Xcode 13 requires macOS Big Sur 11.3 or higher. However, the
+#              notarytool binary can be extracted and run on macOS Catalina
+#              10.15.7 and higher. It is not available in Command Line Tools.
 #
-#              This script will upload a copy of the package to apple and wait
+#              This script will upload a copy of the package to Apple and wait
 #              for the notarization to return. This can take several minutes.
 #
-#              This script should be run with sudo. If not, it will attempt to
+#              This script requires the presence of some environment variables.
-#              elevate and run with sudo. In order for the environment variables
+#              If running this script with sudo, be sure to pass the `-E`
-#              to be available in sudo you need to pass the `-E` option. For
+#              option.
-#              example:
 #
-#              sudo -E ./notarize.sh
+#              sudo -E ./notarize.sh salt-3006.2-signed.pkg
 #
 # Requirements:
 #     - Full Xcode Installation
@@ -32,36 +33,27 @@
 #             The package that will be notarized (must be signed)
 #
 #     Example:
-#         The following will notarize the 'salt-v2015.8.3-signed.pkg' file
+#         The following will notarize the 'salt-3006.2-signed.pkg' file:
 #
-#         sudo ./notarize.sh salt-v2015.8.3-signed.pkg
+#         ./notarize.sh salt-3006.2-signed.pkg
 #
 # Environment Setup:
 #
 #     Define Environment Variables:
-#         Create two environment variables for the apple account and the
+#         Create three environment variables for the apple account, apple team
-#         app-specific password associated with that account. To generate the
+#         ID, and the app-specific password associated with that account. To
-#         app-specific password see: https://support.apple.com/en-us/HT204397
+#         generate the app-specific password see:
+#         https://support.apple.com/en-us/HT204397
 #
 #         export APPLE_ACCT="username@domain.com"
+#         export APPLE_TEAM_ID="AB283DVDS5"
 #         export APP_SPEC_PWD="abcd-efgh-ijkl-mnop"
 #
 ################################################################################
-echo "vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv"
-echo "Notarize Salt Package"
 
-# Make sure the script is launched with sudo
+#-------------------------------------------------------------------------------
-# We're doing this with notarize because the package we're notarizing was
-# built with sudo... so, we need sudo here in order to staple the notarization
-# to the package
-if [[ $(id -u) -ne 0 ]]; then
-    echo ">>>>>> Re-launching as sudo <<<<<<"
-    exec sudo -E /bin/bash -c "$(printf '%q ' "${BASH_SOURCE[0]}" "$@")"
-fi
-
-################################################################################
 # Check input parameters
-################################################################################
+#-------------------------------------------------------------------------------
 if [ "$1" == "" ]; then
     echo "Must supply a package to notarize"
     exit 1
@@ -69,84 +61,99 @@ else
     PACKAGE=$1
 fi
 
-################################################################################
+#-------------------------------------------------------------------------------
-# Environment Variables
+# Functions
-################################################################################
+#-------------------------------------------------------------------------------
-echo "**** Setting Variables"
+# _msg
-BUNDLE_ID="com.saltstack.salt"
+#
-NOTARIZE_APP_LOG=$(mktemp -t notarize-app)
+#   Prints the message with a dash... no new line
-NOTARIZE_INFO_LOG=$(mktemp -t notarize-info)
+_msg() {
+    printf -- "- %s: " "$1"
+}
 
-################################################################################
+# _success
+#
+#   Prints a green Success
+_success() {
+    printf "\e[32m%s\e[0m\n" "Success"
+}
+
+# _failure
+#
+#   Prints a red Failure and exits
+_failure() {
+    printf "\e[31m%s\e[0m\n" "Failure"
+    echo "output >>>>>>"
+    cat "$NOTARIZE_LOG" 1>&2
+    echo "<<<<<< output"
+    exit 1
+}
+
+#-------------------------------------------------------------------------------
+# Environment Variables
+#-------------------------------------------------------------------------------
+_msg "Setting Variables"
+NOTARIZE_LOG=$(mktemp -t notarize-app.log)
+NOTARY_TOOL=$(xcrun --find notarytool)
+_success
+
+#-------------------------------------------------------------------------------
+# Check for notarytool
+#-------------------------------------------------------------------------------
+if [ ! -f "$NOTARY_TOOL" ]; then
+    echo "This script requires the NotaryTool binary"
+    exit 1
+fi
+
+#-------------------------------------------------------------------------------
 # Delete temporary files on exit
-################################################################################
+#-------------------------------------------------------------------------------
 function finish {
-    rm "$NOTARIZE_APP_LOG" "$NOTARIZE_INFO_LOG"
+    rm "$NOTARIZE_LOG"
 }
 trap finish EXIT
 
-################################################################################
+#-------------------------------------------------------------------------------
+# Script Start
+#-------------------------------------------------------------------------------
+printf "=%.0s" {1..80}; printf "\n"
+echo "Notarize Salt Package"
+echo "- This can take up to 30 minutes"
+printf -- "-%.0s" {1..80}; printf "\n"
+
+#-------------------------------------------------------------------------------
 # Submit app for notarization
-################################################################################
+#-------------------------------------------------------------------------------
-echo "**** Submitting Package for Notarization"
+_msg "Submitting Package for Notarization"
-if ! xcrun altool --notarize-app \
+if $NOTARY_TOOL submit \
-                  --primary-bundle-id "$BUNDLE_ID" \
+        --apple-id "$APPLE_ACCT" \
-                  --username "$APPLE_ACCT" \
+        --team-id "$APPLE_TEAM_ID" \
-                  --password "$APP_SPEC_PWD" \
+        --password "$APP_SPEC_PWD" \
-                  -f "$PACKAGE" > "$NOTARIZE_APP_LOG" 2>&1; then
+        --wait \
-    cat "$NOTARIZE_APP_LOG" 1>&2
+        "$PACKAGE" > "$NOTARIZE_LOG" 2>&1; then
-    exit 1
+    _success
+else
+    _failure
 fi
 
-# Get RequestUUID from the APP LOG
+# Make sure the status is "Accepted", then staple
-# Uncomment for debugging
+_msg "Verifying accepted status"
-# cat "$NOTARIZE_APP_LOG"
+if grep -q "status: Accepted" "$NOTARIZE_LOG"; then
-
+    _success
-if ! grep -q "No errors uploading" "$NOTARIZE_APP_LOG"; then
+else
-    echo ">>>>>> Failed Uploading Package <<<<<<"
+    _failure
-    exit 1
-fi
-RequestUUID=$(awk -F ' = ' '/RequestUUID/ {print $2}' "$NOTARIZE_APP_LOG")
-
-echo "**** Checking Notarization Status (every 30 seconds)"
-echo -n "**** "
-# Check status every 30 seconds
-while sleep 30; do
-    echo -n "."
-
-    # check notarization status
-    if ! xcrun altool --notarization-info "$RequestUUID" \
-                      --username "$APPLE_ACCT" \
-                      --password "$APP_SPEC_PWD" > "$NOTARIZE_INFO_LOG" 2>&1; then
-        cat "$NOTARIZE_INFO_LOG" 1>&2
-        exit 1
-    fi
-
-    # Look for Status in the INFO LOG
-    # Uncomment for debugging
-    # cat "$NOTARIZE_INFO_LOG"
-
-    # Continue checking until Status is no longer "in progress"
-    if ! grep -q "Status: in progress" "$NOTARIZE_INFO_LOG"; then
-        echo ""
-        break
-    fi
-
-done
-
-# Make sure the result is "success", then staple
-if ! grep -q "Status: success" "$NOTARIZE_INFO_LOG"; then
-    echo "**** There was a problem notarizing the package"
-    echo "**** View the log for details:"
-    awk -F ': ' '/LogFileURL/ {print $2}' "$NOTARIZE_INFO_LOG"
-    exit 1
 fi
 
-echo "**** Stapling Notarization to the Package"
+_msg "Stapling Notarization to the Package"
-if ! xcrun stapler staple "$PACKAGE" > "$NOTARIZE_INFO_LOG"; then
+if xcrun stapler staple "$PACKAGE" > "$NOTARIZE_LOG"; then
-    cat "$NOTARIZE_INFO_LOG" 1>&2
+    _success
-    exit 1
+else
+    _failure
 fi
 
-echo "Notarize Salt Package Completed Successfully"
+#-------------------------------------------------------------------------------
-echo "^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"
+# Script Completed
+#-------------------------------------------------------------------------------
+printf -- "-%.0s" {1..80}; printf "\n"
+echo "Notarize Salt Package Completed"
+printf "=%.0s" {1..80}; printf "\n"

pkg/osx/package.sh

@@ -94,7 +94,7 @@ echo "**** Setting Variables"
 SRCDIR=`git rev-parse --show-toplevel`
 PKGRESOURCES=$SRCDIR/pkg/osx
 PY_VERSION=3.9
-PY_DOT_VERSION=3.9.16
+PY_DOT_VERSION=3.9.18
 
 ################################################################################
 # Make sure this is the Salt Repository

pkg/osx/pkg-scripts/postinstall

@@ -19,7 +19,7 @@
 ###############################################################################
 # Define Variables
 ###############################################################################
-PY_DOT_VERSION=3.9.16
+PY_DOT_VERSION=3.9.18
 INSTALL_DIR="/opt/salt"
 BIN_DIR="$INSTALL_DIR/bin"
 CONFIG_DIR="/etc/salt"

pkg/osx/sign_binaries.sh

@@ -68,7 +68,7 @@ quit_on_error() {
 echo "**** Setting Variables"
 INSTALL_DIR=/opt/salt
 PY_VERSION=3.9
-PY_DOT_VERSION=3.9.16
+PY_DOT_VERSION=3.9.18
 CMD_OUTPUT=$(mktemp -t cmd.log)
 SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 

requirements/darwin.txt

@@ -5,15 +5,18 @@
 apache-libcloud>=2.4.0
 backports.ssl_match_hostname>=3.7.0.1; python_version < '3.7'
 cherrypy>=17.4.1
-cryptography>=2.6.1
+cryptography>=41.0.3 ; python_version >= "3.7"
+cryptography<=40.0.2 ; python_version == "3.6"
+cryptography<=3.2.1 ; python_version <= "3.5"
 gitpython>=2.1.15 ; python_version <= "3.6"
-gitpython>=3.1.30 ; python_version >= "3.7"
+gitpython>=3.1.37 ; python_version >= "3.7"
 idna>=2.8
 linode-python>=1.1.1
 mako>=1.0.7
 pyasn1>=0.4.8
 pycparser>=2.21
-pyopenssl>=19.0.0
+pyopenssl>=23.2.0 ; python_version >= "3.6"
+pyopenssl<=20.0.0 ; python_version <= "3.5"
 python-dateutil>=2.8.0
 python-gnupg>=0.4.4
 setproctitle>=1.1.10

requirements/static/ci/common.in

@@ -7,7 +7,7 @@ boto3>=1.16.0,<1.17.0; python_version < '3.6'
 boto3>=1.17.67; python_version >= '3.6'
 boto>=2.46.0
 cassandra-driver>=2.0
-certifi>=2022.12.7; python_version >= "3.6"
+certifi>=2023.07.22; python_version >= "3.6"
 certifi<=2021.10.8; python_version <= "3.5"
 cffi>=1.12.2
 cherrypy>=17.4.1
@@ -17,7 +17,7 @@ dnspython
 docker
 etcd3-py==0.1.6 ; python_version >= '3.6'
 gitpython>=2.1.15 ; python_version <= "3.6"
-gitpython>=3.1.30 ; python_version >= "3.7"
+gitpython>=3.1.37 ; python_version >= "3.7"
 jmespath
 jsonschema
 junos-eznc==2.4.0; sys_platform != 'win32' and python_version <= '3.9'

requirements/static/ci/py3.10/cloud.txt

@@ -348,7 +348,7 @@ cachetools==4.2.2
     # via google-auth
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -363,10 +363,10 @@ cffi==1.14.6
     #   bcrypt
     #   cryptography
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post1
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -383,8 +383,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   azure-cosmosdb-table
     #   azure-keyvault
@@ -426,7 +427,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==2.1.0
     # via kubernetes
@@ -435,7 +436,7 @@ idna==2.8
     #   etcd3-py
     #   requests
     #   yarl
-immutables==0.16
+immutables==0.19
     # via contextvars
 importlib_metadata==4.6.3 ; python_version >= "3.10"
     # via -r requirements/static/pkg/linux.in
@@ -665,7 +666,7 @@ pyjwt==2.4.0
     # via adal
 pynacl==1.4.0
     # via paramiko
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -739,14 +740,14 @@ pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
 pywinrm==0.3.0
     # via -r requirements/static/ci/cloud.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
     #   junos-eznc
     #   kubernetes
     #   yamlordereddictloader
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
@@ -754,7 +755,7 @@ requests-ntlm==1.1.0
     # via pywinrm
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -799,7 +800,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -813,7 +813,6 @@ six==1.16.0
     #   paramiko
     #   profitbricks
     #   pynacl
-    #   pyopenssl
     #   pypsexec
     #   python-dateutil
     #   pyvmomi
@@ -846,7 +845,7 @@ typing-extensions==4.2.0
     # via
     #   pytest-shell-utilities
     #   pytest-system-statistics
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.10/darwin.txt

@@ -350,7 +350,7 @@ cachetools==3.1.0
     # via google-auth
 cassandra-driver==3.23.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -366,10 +366,10 @@ cffi==1.14.6
     #   cryptography
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -386,7 +386,7 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==0.3.29 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
     #   -r requirements/darwin.txt
     #   adal
@@ -428,7 +428,7 @@ geomet==0.1.2
     # via cassandra-driver
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via
     #   -r requirements/darwin.txt
     #   -r requirements/static/ci/common.in
@@ -667,7 +667,7 @@ pyjwt==2.4.0
     # via adal
 pynacl==1.3.0
     # via paramiko
-pyopenssl==19.0.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/darwin.txt
     #   etcd3-py
@@ -737,7 +737,7 @@ pytz==2022.1
     #   tempora
 pyvmomi==6.7.1.2018.12
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
@@ -745,13 +745,13 @@ pyyaml==5.4.1
     #   kubernetes
     #   yamllint
     #   yamlordereddictloader
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -792,7 +792,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -807,7 +806,6 @@ six==1.16.0
     #   packaging
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-dateutil
     #   pyvmomi
     #   responses
@@ -835,7 +833,7 @@ typing-extensions==4.2.0
     # via
     #   pytest-shell-utilities
     #   pytest-system-statistics
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.10/docs.txt

@@ -353,7 +353,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -370,10 +370,10 @@ cffi==1.14.4
     #   cryptography
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post1
     # via -r requirements/static/ci/common.in
 cheroot==8.6.0
@@ -390,8 +390,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -428,7 +429,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==2.0.1
     # via kubernetes
@@ -669,7 +670,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.4.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -710,7 +711,7 @@ pytz==2022.1
     #   twilio
 pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -719,7 +720,7 @@ pyyaml==5.4.1
     #   kubernetes
     #   yamllint
     #   yamlordereddictloader
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
 redis-py-cluster==2.1.3
     # via -r requirements/static/ci/linux.in
@@ -727,7 +728,7 @@ redis==3.5.3
     # via redis-py-cluster
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -775,7 +776,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -789,7 +789,6 @@ six==1.16.0
     #   ncclient
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -834,7 +833,7 @@ twilio==7.9.2
     # via -r requirements/static/ci/linux.in
 tzlocal==3.0
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.10/freebsd.txt

@@ -346,7 +346,7 @@ cachetools==3.1.0
     # via google-auth
 cassandra-driver==3.24.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -362,10 +362,10 @@ cffi==1.14.6
     #   cryptography
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -382,8 +382,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==0.3.29 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/freebsd.in
     #   adal
     #   azure-cosmosdb-table
     #   azure-keyvault
@@ -424,7 +425,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==1.6.3
     # via kubernetes
@@ -662,7 +663,7 @@ pyjwt==2.4.0
     # via adal
 pynacl==1.3.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/freebsd.in
     #   etcd3-py
@@ -732,7 +733,7 @@ pytz==2022.1
     #   tempora
 pyvmomi==6.7.1.2018.12
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
@@ -740,13 +741,13 @@ pyyaml==5.4.1
     #   kubernetes
     #   yamllint
     #   yamlordereddictloader
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -786,7 +787,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -803,7 +803,6 @@ six==1.16.0
     #   packaging
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-dateutil
     #   pyvmomi
     #   responses
@@ -831,7 +830,7 @@ typing-extensions==4.2.0
     # via
     #   pytest-shell-utilities
     #   pytest-system-statistics
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.10/invoke.txt

@@ -8,7 +8,7 @@ blessings==1.7
     # via -r requirements/static/ci/invoke.in
 invoke==1.4.1
     # via -r requirements/static/ci/invoke.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/static/ci/invoke.in
 six==1.16.0
     # via blessings

requirements/static/ci/py3.10/lint.txt

@@ -351,7 +351,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -388,8 +388,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.4.7
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -424,7 +425,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==2.0.1
     # via kubernetes
@@ -435,7 +436,7 @@ idna==3.2
     #   etcd3-py
     #   requests
     #   yarl
-immutables==0.16
+immutables==0.19
     # via contextvars
 importlib_metadata==4.6.3 ; python_version >= "3.10"
     # via -r requirements/static/pkg/linux.in
@@ -669,7 +670,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.4.0
     # via paramiko
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -709,7 +710,7 @@ pytz==2022.1
     #   twilio
 pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -718,7 +719,7 @@ pyyaml==5.4.1
     #   kubernetes
     #   yamllint
     #   yamlordereddictloader
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
 redis-py-cluster==2.1.3
     # via -r requirements/static/ci/linux.in
@@ -726,7 +727,7 @@ redis==3.5.3
     # via redis-py-cluster
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.26.0
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -788,7 +789,6 @@ six==1.16.0
     #   ncclient
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -819,7 +819,7 @@ twilio==7.9.2
     # via -r requirements/static/ci/linux.in
 tzlocal==3.0
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.10/linux.txt

@@ -359,7 +359,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.23.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -376,10 +376,10 @@ cffi==1.14.6
     #   cryptography
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -396,8 +396,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==0.3.29 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -438,7 +439,7 @@ geomet==0.1.2
     # via cassandra-driver
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==1.6.3
     # via kubernetes
@@ -684,7 +685,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.3.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -762,7 +763,7 @@ pytz==2022.1
     #   tzlocal
 pyvmomi==6.7.1.2018.12
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -771,7 +772,7 @@ pyyaml==5.4.1
     #   kubernetes
     #   yamllint
     #   yamlordereddictloader
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
@@ -781,7 +782,7 @@ redis==3.5.3
     # via redis-py-cluster
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -828,7 +829,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -844,7 +844,6 @@ six==1.16.0
     #   packaging
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -879,7 +878,7 @@ typing-extensions==4.2.0
     #   pytest-system-statistics
 tzlocal==2.1
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.10/windows.txt

@@ -37,7 +37,7 @@ cachetools==3.1.0
     # via google-auth
 cassandra-driver==3.23.0
     # via -r requirements/static/ci/common.in
-certifi==2022.5.18.1
+certifi==2023.07.22
     # via
     #   -r requirements/static/ci/common.in
     #   -r requirements/static/pkg/py3.10/windows.txt
@@ -72,8 +72,8 @@ clustershell==1.8.3
 colorama==0.4.1
     # via pytest
 contextvars==2.4
-    # via -r requirements/static/pkg/py3.10/windows.txt
+    # via -r requirements/base.txt
-cryptography==3.4.7
+cryptography==41.0.4
     # via
     #   -r requirements/static/pkg/py3.10/windows.txt
     #   moto
@@ -263,7 +263,7 @@ pygit2==1.5.0 ; python_version >= "3.7"
     # via -r requirements/static/ci/windows.in
 pymysql==1.0.2
     # via -r requirements/static/pkg/py3.10/windows.txt
-pyopenssl==20.0.1
+pyopenssl==23.0.0
     # via -r requirements/static/pkg/py3.10/windows.txt
 pyparsing==2.4.5
     # via packaging
@@ -314,7 +314,7 @@ pywin32==303
     #   wmi
 pywinrm==0.4.1
     # via -r requirements/static/ci/windows.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/static/pkg/py3.10/windows.txt
     #   cfn-lint

requirements/static/ci/py3.5/linux.txt

@@ -394,8 +394,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==0.3.29 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.0
+cryptography==3.2.1 ; python_version <= "3.5"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -717,7 +718,7 @@ pymysql==0.9.3 ; python_version <= "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.3.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==20.0.0 ; python_version <= "3.5"
     # via -r requirements/static/pkg/linux.in
 pyparsing==2.4.5
     # via
@@ -803,7 +804,7 @@ pyyaml==5.3.1
     #   moto
     #   yamllint
     #   yamlordereddictloader
-pyzmq==18.0.1 ; python_version < "3.9"
+pyzmq==19.0.2 ; python_version < "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories

requirements/static/ci/py3.6/cloud.txt

@@ -352,7 +352,7 @@ cachetools==4.2.2
     # via google-auth
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -387,8 +387,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==40.0.2 ; python_version == "3.6"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   azure-cosmosdb-table
     #   azure-keyvault
@@ -446,7 +447,7 @@ idna==2.8
     #   idna-ssl
     #   requests
     #   yarl
-immutables==0.16
+immutables==0.19
     # via contextvars
 importlib-metadata==4.8.1 ; python_version >= "3.6" and python_version < "3.10"
     # via
@@ -687,7 +688,7 @@ pyjwt==2.4.0
     # via adal
 pynacl==1.4.0
     # via paramiko
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -761,14 +762,14 @@ pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
 pywinrm==0.3.0
     # via -r requirements/static/ci/cloud.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
     #   junos-eznc
     #   kubernetes
     #   yamlordereddictloader
-pyzmq==21.0.2 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
@@ -821,7 +822,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -835,7 +835,6 @@ six==1.16.0
     #   paramiko
     #   profitbricks
     #   pynacl
-    #   pyopenssl
     #   pypsexec
     #   python-dateutil
     #   pyvmomi
@@ -877,7 +876,7 @@ typing-extensions==3.10.0.0
     #   pytest-shell-utilities
     #   pytest-system-statistics
     #   yarl
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.6/docs.txt

@@ -359,7 +359,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -396,8 +396,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.4.7
+cryptography==40.0.2 ; python_version == "3.6"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -691,7 +692,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.4.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -732,7 +733,7 @@ pytz==2022.1
     #   twilio
 pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -741,7 +742,7 @@ pyyaml==5.4.1
     #   kubernetes
     #   yamllint
     #   yamlordereddictloader
-pyzmq==18.0.1 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
 redis-py-cluster==2.1.3
     # via -r requirements/static/ci/linux.in
@@ -810,7 +811,6 @@ six==1.16.0
     #   ncclient
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -865,7 +865,7 @@ typing-extensions==3.10.0.0
     #   yarl
 tzlocal==3.0
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.6/invoke.txt

@@ -8,7 +8,7 @@ blessings==1.7
     # via -r requirements/static/ci/invoke.in
 invoke==1.4.1
     # via -r requirements/static/ci/invoke.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/static/ci/invoke.in
 six==1.16.0
     # via blessings

requirements/static/ci/py3.6/lint.txt

@@ -357,7 +357,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -394,8 +394,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.4.7
+cryptography==40.0.2 ; python_version == "3.6"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -448,7 +449,7 @@ idna==3.2
     #   idna-ssl
     #   requests
     #   yarl
-immutables==0.16
+immutables==0.19
     # via contextvars
 importlib-metadata==4.6.4 ; python_version >= "3.6" and python_version < "3.10"
     # via
@@ -693,7 +694,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.4.0
     # via paramiko
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -733,7 +734,7 @@ pytz==2022.1
     #   twilio
 pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -742,7 +743,7 @@ pyyaml==5.4.1
     #   kubernetes
     #   yamllint
     #   yamlordereddictloader
-pyzmq==21.0.2 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
 redis-py-cluster==2.1.3
     # via -r requirements/static/ci/linux.in
@@ -812,7 +813,6 @@ six==1.16.0
     #   ncclient
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -856,7 +856,7 @@ typing-extensions==3.10.0.0
     #   yarl
 tzlocal==3.0
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.6/linux.txt

@@ -363,7 +363,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.23.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -400,8 +400,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==0.3.29 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==40.0.2 ; python_version == "3.6"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -706,7 +707,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.3.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -784,7 +785,7 @@ pytz==2022.1
     #   tzlocal
 pyvmomi==6.7.1.2018.12
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -793,7 +794,7 @@ pyyaml==5.4.1
     #   kubernetes
     #   yamllint
     #   yamlordereddictloader
-pyzmq==18.0.1 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
@@ -850,7 +851,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -866,7 +866,6 @@ six==1.16.0
     #   packaging
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -911,7 +910,7 @@ typing-extensions==3.10.0.0
     #   yarl
 tzlocal==2.1
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.7/cloud.txt

@@ -350,7 +350,7 @@ cachetools==4.2.2
     # via google-auth
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -366,10 +366,10 @@ cffi==1.14.6
     #   cryptography
     #   napalm
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post1
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -390,8 +390,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   azure-cosmosdb-table
     #   azure-keyvault
@@ -438,7 +439,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==2.1.0
     # via kubernetes
@@ -447,7 +448,7 @@ idna==2.8
     #   etcd3-py
     #   requests
     #   yarl
-immutables==0.16
+immutables==0.19
     # via contextvars
 importlib-metadata==4.8.1 ; python_version >= "3.6" and python_version < "3.10"
     # via
@@ -706,7 +707,7 @@ pyjwt==2.4.0
     # via adal
 pynacl==1.4.0
     # via paramiko
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -782,7 +783,7 @@ pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
 pywinrm==0.3.0
     # via -r requirements/static/ci/cloud.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
@@ -790,7 +791,7 @@ pyyaml==5.4.1
     #   kubernetes
     #   napalm
     #   yamlordereddictloader
-pyzmq==21.0.2 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
@@ -798,7 +799,7 @@ requests-ntlm==1.1.0
     # via pywinrm
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -847,7 +848,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -861,7 +861,6 @@ six==1.16.0
     #   paramiko
     #   profitbricks
     #   pynacl
-    #   pyopenssl
     #   pypsexec
     #   python-dateutil
     #   pyvmomi
@@ -907,7 +906,7 @@ typing-extensions==3.10.0.0
     #   pytest-shell-utilities
     #   pytest-system-statistics
     #   yarl
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.7/docs.txt

@@ -357,7 +357,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -375,10 +375,10 @@ cffi==1.14.6
     #   napalm
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post1
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -399,8 +399,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.4.7
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -442,7 +443,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==2.0.1
     # via kubernetes
@@ -709,7 +710,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.4.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -752,7 +753,7 @@ pytz==2022.1
     #   twilio
 pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -762,7 +763,7 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==18.0.1 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
 redis-py-cluster==2.1.3
     # via -r requirements/static/ci/linux.in
@@ -770,7 +771,7 @@ redis==3.5.3
     # via redis-py-cluster
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -835,7 +836,6 @@ six==1.16.0
     #   ncclient
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -894,7 +894,7 @@ typing-extensions==3.10.0.0
     #   yarl
 tzlocal==3.0
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.7/freebsd.txt

@@ -348,7 +348,7 @@ cachetools==3.1.0
     # via google-auth
 cassandra-driver==3.24.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -365,10 +365,10 @@ cffi==1.14.6
     #   napalm
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -389,8 +389,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==0.3.29 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/freebsd.in
     #   adal
     #   azure-cosmosdb-table
     #   azure-keyvault
@@ -436,7 +437,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==1.6.3
     # via kubernetes
@@ -699,7 +700,7 @@ pyjwt==2.4.0
     # via adal
 pynacl==1.3.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/freebsd.in
     #   etcd3-py
@@ -771,7 +772,7 @@ pytz==2022.1
     #   tempora
 pyvmomi==6.7.1.2018.12
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
@@ -780,13 +781,13 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==18.0.1 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -830,7 +831,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -847,7 +847,6 @@ six==1.16.0
     #   packaging
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-dateutil
     #   pyvmomi
     #   responses
@@ -888,7 +887,7 @@ typing-extensions==3.10.0.0
     #   pytest-shell-utilities
     #   pytest-system-statistics
     #   yarl
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.7/invoke.txt

@@ -8,7 +8,7 @@ blessings==1.7
     # via -r requirements/static/ci/invoke.in
 invoke==1.4.1
     # via -r requirements/static/ci/invoke.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/static/ci/invoke.in
 six==1.16.0
     # via blessings

requirements/static/ci/py3.7/lint.txt

@@ -355,7 +355,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -397,8 +397,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.4.7
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -438,7 +439,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==2.0.1
     # via kubernetes
@@ -449,7 +450,7 @@ idna==3.2
     #   etcd3-py
     #   requests
     #   yarl
-immutables==0.16
+immutables==0.19
     # via contextvars
 importlib-metadata==4.6.4 ; python_version >= "3.6" and python_version < "3.10"
     # via
@@ -711,7 +712,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.4.0
     # via paramiko
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -753,7 +754,7 @@ pytz==2022.1
     #   twilio
 pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -763,7 +764,7 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==21.0.2 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
 redis-py-cluster==2.1.3
     # via -r requirements/static/ci/linux.in
@@ -771,7 +772,7 @@ redis==3.5.3
     # via redis-py-cluster
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.26.0
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -837,7 +838,6 @@ six==1.16.0
     #   ncclient
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -885,7 +885,7 @@ typing-extensions==3.10.0.0
     #   yarl
 tzlocal==3.0
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.7/linux.txt

@@ -361,7 +361,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.23.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -379,10 +379,10 @@ cffi==1.14.6
     #   napalm
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -403,8 +403,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==0.3.29 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -450,7 +451,7 @@ geomet==0.1.2
     # via cassandra-driver
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==1.6.3
     # via kubernetes
@@ -719,7 +720,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.3.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -799,7 +800,7 @@ pytz==2022.1
     #   tzlocal
 pyvmomi==6.7.1.2018.12
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -809,7 +810,7 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==18.0.1 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
@@ -819,7 +820,7 @@ redis==3.5.3
     # via redis-py-cluster
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -870,7 +871,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -886,7 +886,6 @@ six==1.16.0
     #   packaging
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -934,7 +933,7 @@ typing-extensions==3.10.0.0
     #   yarl
 tzlocal==2.1
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.7/windows.txt

@@ -42,7 +42,7 @@ cachetools==3.1.0
     # via google-auth
 cassandra-driver==3.23.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   -r requirements/windows.txt
@@ -54,10 +54,10 @@ cffi==1.14.6
     #   -r requirements/windows.txt
     #   cryptography
     #   pygit2
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -74,7 +74,7 @@ colorama==0.4.1
     # via pytest
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.4.7
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
     #   -r requirements/windows.txt
     #   etcd3-py
@@ -113,7 +113,7 @@ geomet==0.1.2
     # via cassandra-driver
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via
     #   -r requirements/static/ci/common.in
     #   -r requirements/windows.txt
@@ -248,7 +248,7 @@ pymssql==2.2.1
     # via -r requirements/windows.txt
 pymysql==1.0.2
     # via -r requirements/windows.txt
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/windows.txt
     #   etcd3-py
@@ -319,19 +319,19 @@ pywin32==303
     #   wmi
 pywinrm==0.4.1
     # via -r requirements/static/ci/windows.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
     #   kubernetes
     #   yamllint
-pyzmq==22.0.3 ; python_version < "3.9" and sys_platform == "win32"
+pyzmq==22.0.3 ; sys_platform == "win32"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
 requests-ntlm==1.1.0
     # via pywinrm
-requests==2.25.1
+requests==2.31.0 ; python_version >= "3.7"
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -372,7 +372,6 @@ six==1.16.0
     #   kubernetes
     #   mock
     #   packaging
-    #   pyopenssl
     #   python-dateutil
     #   pyvmomi
     #   pywinrm
@@ -402,7 +401,7 @@ typing-extensions==3.10.0.0
     #   pytest-shell-utilities
     #   pytest-system-statistics
     #   yarl
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   -r requirements/windows.txt
     #   botocore

requirements/static/ci/py3.8/cloud.txt

@@ -348,7 +348,7 @@ cachetools==4.2.2
     # via google-auth
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -364,10 +364,10 @@ cffi==1.14.6
     #   cryptography
     #   napalm
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post1
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -388,8 +388,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   azure-cosmosdb-table
     #   azure-keyvault
@@ -436,7 +437,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==2.1.0
     # via kubernetes
@@ -445,7 +446,7 @@ idna==2.8
     #   etcd3-py
     #   requests
     #   yarl
-immutables==0.16
+immutables==0.19
     # via contextvars
 importlib-metadata==4.8.1 ; python_version >= "3.6" and python_version < "3.10"
     # via -r requirements/static/pkg/linux.in
@@ -696,7 +697,7 @@ pyjwt==2.4.0
     # via adal
 pynacl==1.4.0
     # via paramiko
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -772,7 +773,7 @@ pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
 pywinrm==0.3.0
     # via -r requirements/static/ci/cloud.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
@@ -780,7 +781,7 @@ pyyaml==5.4.1
     #   kubernetes
     #   napalm
     #   yamlordereddictloader
-pyzmq==21.0.2 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
@@ -788,7 +789,7 @@ requests-ntlm==1.1.0
     # via pywinrm
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -837,7 +838,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -851,7 +851,6 @@ six==1.16.0
     #   paramiko
     #   profitbricks
     #   pynacl
-    #   pyopenssl
     #   pypsexec
     #   python-dateutil
     #   pyvmomi
@@ -891,7 +890,7 @@ typing-extensions==3.10.0.2
     # via
     #   pytest-shell-utilities
     #   pytest-system-statistics
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.8/docs.txt

@@ -355,7 +355,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -373,10 +373,10 @@ cffi==1.14.6
     #   napalm
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post1
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -397,8 +397,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -440,7 +441,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==2.0.1
     # via kubernetes
@@ -701,7 +702,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.4.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -744,7 +745,7 @@ pytz==2022.1
     #   twilio
 pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -754,7 +755,7 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==19.0.0 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
 redis-py-cluster==2.1.3
     # via -r requirements/static/ci/linux.in
@@ -762,7 +763,7 @@ redis==3.5.3
     # via redis-py-cluster
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -814,7 +815,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -828,7 +828,6 @@ six==1.16.0
     #   ncclient
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -880,7 +879,7 @@ twilio==7.9.2
     # via -r requirements/static/ci/linux.in
 tzlocal==3.0
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.8/freebsd.txt

@@ -346,7 +346,7 @@ cachetools==3.1.0
     # via google-auth
 cassandra-driver==3.24.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -363,10 +363,10 @@ cffi==1.14.6
     #   napalm
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -387,8 +387,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==0.3.29 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/freebsd.in
     #   adal
     #   azure-cosmosdb-table
     #   azure-keyvault
@@ -434,7 +435,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==1.6.3
     # via kubernetes
@@ -690,7 +691,7 @@ pyjwt==2.4.0
     # via adal
 pynacl==1.3.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/freebsd.in
     #   etcd3-py
@@ -762,7 +763,7 @@ pytz==2022.1
     #   tempora
 pyvmomi==6.7.1.2018.12
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
@@ -771,13 +772,13 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==19.0.0 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -821,7 +822,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -838,7 +838,6 @@ six==1.16.0
     #   packaging
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-dateutil
     #   pyvmomi
     #   responses
@@ -874,7 +873,7 @@ typing-extensions==4.2.0
     # via
     #   pytest-shell-utilities
     #   pytest-system-statistics
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.8/invoke.txt

@@ -8,7 +8,7 @@ blessings==1.7
     # via -r requirements/static/ci/invoke.in
 invoke==1.4.1
     # via -r requirements/static/ci/invoke.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/static/ci/invoke.in
 six==1.16.0
     # via blessings

requirements/static/ci/py3.8/lint.txt

@@ -353,7 +353,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -395,8 +395,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.4.7
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -436,7 +437,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==2.0.1
     # via kubernetes
@@ -447,7 +448,7 @@ idna==3.2
     #   etcd3-py
     #   requests
     #   yarl
-immutables==0.16
+immutables==0.19
     # via contextvars
 importlib-metadata==4.6.4 ; python_version >= "3.6" and python_version < "3.10"
     # via -r requirements/static/pkg/linux.in
@@ -703,7 +704,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.4.0
     # via paramiko
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -745,7 +746,7 @@ pytz==2022.1
     #   twilio
 pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -755,7 +756,7 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==21.0.2 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
 redis-py-cluster==2.1.3
     # via -r requirements/static/ci/linux.in
@@ -763,7 +764,7 @@ redis==3.5.3
     # via redis-py-cluster
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.26.0
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -829,7 +830,6 @@ six==1.16.0
     #   ncclient
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -867,7 +867,7 @@ twilio==7.9.2
     # via -r requirements/static/ci/linux.in
 tzlocal==3.0
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.8/linux.txt

@@ -359,7 +359,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.23.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -377,10 +377,10 @@ cffi==1.14.6
     #   napalm
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -401,8 +401,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==0.3.29 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -448,7 +449,7 @@ geomet==0.1.2
     # via cassandra-driver
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==1.6.3
     # via kubernetes
@@ -710,7 +711,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.3.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -790,7 +791,7 @@ pytz==2022.1
     #   tzlocal
 pyvmomi==6.7.1.2018.12
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -800,7 +801,7 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==19.0.0 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
@@ -810,7 +811,7 @@ redis==3.5.3
     # via redis-py-cluster
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -861,7 +862,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -877,7 +877,6 @@ six==1.16.0
     #   packaging
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -920,7 +919,7 @@ typing-extensions==4.2.0
     #   pytest-system-statistics
 tzlocal==2.1
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.8/windows.txt

@@ -40,7 +40,7 @@ cachetools==3.1.0
     # via google-auth
 cassandra-driver==3.23.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   -r requirements/windows.txt
@@ -52,10 +52,10 @@ cffi==1.14.6
     #   -r requirements/windows.txt
     #   cryptography
     #   pygit2
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -72,7 +72,7 @@ colorama==0.4.1
     # via pytest
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.4.7
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
     #   -r requirements/windows.txt
     #   etcd3-py
@@ -111,7 +111,7 @@ geomet==0.1.2
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via
     #   -r requirements/static/ci/common.in
     #   -r requirements/windows.txt
@@ -239,7 +239,7 @@ pymssql==2.2.1
     # via -r requirements/windows.txt
 pymysql==1.0.2
     # via -r requirements/windows.txt
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/windows.txt
     #   etcd3-py
@@ -310,19 +310,19 @@ pywin32==303
     #   wmi
 pywinrm==0.4.1
     # via -r requirements/static/ci/windows.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
     #   kubernetes
     #   yamllint
-pyzmq==22.0.3 ; python_version < "3.9" and sys_platform == "win32"
+pyzmq==22.0.3 ; sys_platform == "win32"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
 requests-ntlm==1.1.0
     # via pywinrm
-requests==2.25.1
+requests==2.31.0 ; python_version >= "3.7"
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -363,7 +363,6 @@ six==1.15.0
     #   kubernetes
     #   mock
     #   packaging
-    #   pyopenssl
     #   python-dateutil
     #   pyvmomi
     #   pywinrm
@@ -388,7 +387,7 @@ typing-extensions==4.2.0
     # via
     #   pytest-shell-utilities
     #   pytest-system-statistics
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   -r requirements/windows.txt
     #   botocore

requirements/static/ci/py3.9/cloud.txt

@@ -348,7 +348,7 @@ cachetools==4.2.2
     # via google-auth
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -364,10 +364,10 @@ cffi==1.14.6
     #   cryptography
     #   napalm
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post1
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -388,8 +388,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   azure-cosmosdb-table
     #   azure-keyvault
@@ -436,7 +437,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==2.1.0
     # via kubernetes
@@ -445,7 +446,7 @@ idna==2.8
     #   etcd3-py
     #   requests
     #   yarl
-immutables==0.16
+immutables==0.19
     # via contextvars
 importlib-metadata==4.8.1 ; python_version >= "3.6" and python_version < "3.10"
     # via -r requirements/static/pkg/linux.in
@@ -699,7 +700,7 @@ pyjwt==2.4.0
     # via adal
 pynacl==1.4.0
     # via paramiko
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -775,7 +776,7 @@ pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
 pywinrm==0.3.0
     # via -r requirements/static/ci/cloud.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
@@ -783,7 +784,7 @@ pyyaml==5.4.1
     #   kubernetes
     #   napalm
     #   yamlordereddictloader
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
@@ -791,7 +792,7 @@ requests-ntlm==1.1.0
     # via pywinrm
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -840,7 +841,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -854,7 +854,6 @@ six==1.16.0
     #   paramiko
     #   profitbricks
     #   pynacl
-    #   pyopenssl
     #   pypsexec
     #   python-dateutil
     #   pyvmomi
@@ -894,7 +893,7 @@ typing-extensions==3.10.0.2
     # via
     #   pytest-shell-utilities
     #   pytest-system-statistics
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.9/darwin.txt

@@ -350,7 +350,7 @@ cachetools==3.1.0
     # via google-auth
 cassandra-driver==3.23.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -367,10 +367,10 @@ cffi==1.14.6
     #   napalm
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -391,7 +391,7 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==0.3.29 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
     #   -r requirements/darwin.txt
     #   adal
@@ -438,7 +438,7 @@ geomet==0.1.2
     # via cassandra-driver
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via
     #   -r requirements/darwin.txt
     #   -r requirements/static/ci/common.in
@@ -698,7 +698,7 @@ pyjwt==2.4.0
     # via adal
 pynacl==1.3.0
     # via paramiko
-pyopenssl==19.0.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/darwin.txt
     #   etcd3-py
@@ -770,7 +770,7 @@ pytz==2022.1
     #   tempora
 pyvmomi==6.7.1.2018.12
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
@@ -779,13 +779,13 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -830,7 +830,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -845,7 +844,6 @@ six==1.16.0
     #   packaging
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-dateutil
     #   pyvmomi
     #   responses
@@ -881,7 +879,7 @@ typing-extensions==4.2.0
     # via
     #   pytest-shell-utilities
     #   pytest-system-statistics
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.9/docs.txt

@@ -353,7 +353,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -371,10 +371,10 @@ cffi==1.14.6
     #   napalm
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post1
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -395,8 +395,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -438,7 +439,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==2.0.1
     # via kubernetes
@@ -702,7 +703,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.4.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -745,7 +746,7 @@ pytz==2022.1
     #   twilio
 pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -755,7 +756,7 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
 redis-py-cluster==2.1.3
     # via -r requirements/static/ci/linux.in
@@ -763,7 +764,7 @@ redis==3.5.3
     # via redis-py-cluster
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -815,7 +816,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -829,7 +829,6 @@ six==1.16.0
     #   ncclient
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -881,7 +880,7 @@ twilio==7.9.2
     # via -r requirements/static/ci/linux.in
 tzlocal==3.0
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.9/freebsd.txt

@@ -346,7 +346,7 @@ cachetools==3.1.0
     # via google-auth
 cassandra-driver==3.24.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -363,10 +363,10 @@ cffi==1.14.6
     #   napalm
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -387,8 +387,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==0.3.29 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/freebsd.in
     #   adal
     #   azure-cosmosdb-table
     #   azure-keyvault
@@ -434,7 +435,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==1.6.3
     # via kubernetes
@@ -693,7 +694,7 @@ pyjwt==2.4.0
     # via adal
 pynacl==1.3.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/freebsd.in
     #   etcd3-py
@@ -765,7 +766,7 @@ pytz==2022.1
     #   tempora
 pyvmomi==6.7.1.2018.12
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
@@ -774,13 +775,13 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -824,7 +825,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -841,7 +841,6 @@ six==1.16.0
     #   packaging
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-dateutil
     #   pyvmomi
     #   responses
@@ -877,7 +876,7 @@ typing-extensions==4.2.0
     # via
     #   pytest-shell-utilities
     #   pytest-system-statistics
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.9/invoke.txt

@@ -8,7 +8,7 @@ blessings==1.7
     # via -r requirements/static/ci/invoke.in
 invoke==1.4.1
     # via -r requirements/static/ci/invoke.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/static/ci/invoke.in
 six==1.16.0
     # via blessings

requirements/static/ci/py3.9/lint.txt

@@ -351,7 +351,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.25.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -393,8 +393,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==1.0.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.4.7
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -434,7 +435,7 @@ geomet==0.2.1.post1
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==2.0.1
     # via kubernetes
@@ -445,7 +446,7 @@ idna==3.2
     #   etcd3-py
     #   requests
     #   yarl
-immutables==0.16
+immutables==0.19
     # via contextvars
 importlib-metadata==4.6.4 ; python_version >= "3.6" and python_version < "3.10"
     # via -r requirements/static/pkg/linux.in
@@ -704,7 +705,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.4.0
     # via paramiko
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -746,7 +747,7 @@ pytz==2022.1
     #   twilio
 pyvmomi==7.0.2
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -756,7 +757,7 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
 redis-py-cluster==2.1.3
     # via -r requirements/static/ci/linux.in
@@ -764,7 +765,7 @@ redis==3.5.3
     # via redis-py-cluster
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.26.0
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -830,7 +831,6 @@ six==1.16.0
     #   ncclient
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -868,7 +868,7 @@ twilio==7.9.2
     # via -r requirements/static/ci/linux.in
 tzlocal==3.0
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.9/linux.txt

@@ -361,7 +361,7 @@ cachetools==4.2.2
     #   python-telegram-bot
 cassandra-driver==3.23.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   kubernetes
@@ -379,10 +379,10 @@ cffi==1.14.6
     #   napalm
     #   pygit2
     #   pynacl
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -403,8 +403,9 @@ contextvars==2.4
     # via -r requirements/base.txt
 croniter==0.3.29 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
+    #   -r requirements/static/pkg/linux.in
     #   adal
     #   ansible-core
     #   azure-cosmosdb-table
@@ -450,7 +451,7 @@ geomet==0.1.2
     # via cassandra-driver
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/static/ci/common.in
 google-auth==1.6.3
     # via kubernetes
@@ -715,7 +716,7 @@ pymysql==1.0.2 ; python_version > "3.5"
     # via -r requirements/static/ci/linux.in
 pynacl==1.3.0
     # via paramiko
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/static/pkg/linux.in
     #   etcd3-py
@@ -795,7 +796,7 @@ pytz==2022.1
     #   tzlocal
 pyvmomi==6.7.1.2018.12
     # via -r requirements/static/ci/common.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   ansible-core
@@ -805,7 +806,7 @@ pyyaml==5.4.1
     #   napalm
     #   yamllint
     #   yamlordereddictloader
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
@@ -815,7 +816,7 @@ redis==3.5.3
     # via redis-py-cluster
 requests-oauthlib==1.3.0
     # via msrest
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -866,7 +867,6 @@ six==1.16.0
     #   bcrypt
     #   cassandra-driver
     #   cheroot
-    #   cryptography
     #   etcd3-py
     #   genshi
     #   geomet
@@ -882,7 +882,6 @@ six==1.16.0
     #   packaging
     #   paramiko
     #   pynacl
-    #   pyopenssl
     #   python-consul
     #   python-dateutil
     #   pyvmomi
@@ -925,7 +924,7 @@ typing-extensions==4.2.0
     #   pytest-system-statistics
 tzlocal==2.1
     # via apscheduler
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   botocore
     #   kubernetes

requirements/static/ci/py3.9/windows.txt

@@ -40,7 +40,7 @@ cachetools==3.1.0
     # via google-auth
 cassandra-driver==3.23.0
     # via -r requirements/static/ci/common.in
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/static/ci/common.in
     #   -r requirements/windows.txt
@@ -52,10 +52,10 @@ cffi==1.14.6
     #   -r requirements/windows.txt
     #   cryptography
     #   pygit2
-chardet==3.0.4
-    # via requests
 charset-normalizer==2.0.12
-    # via aiohttp
+    # via
+    #   aiohttp
+    #   requests
 cheetah3==3.2.6.post2
     # via -r requirements/static/ci/common.in
 cheroot==8.5.2
@@ -72,7 +72,7 @@ colorama==0.4.1
     # via pytest
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.4.7
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
     #   -r requirements/windows.txt
     #   etcd3-py
@@ -111,7 +111,7 @@ geomet==0.1.2
     # via cassandra-driver
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via
     #   -r requirements/static/ci/common.in
     #   -r requirements/windows.txt
@@ -240,7 +240,7 @@ pymssql==2.2.1
     # via -r requirements/windows.txt
 pymysql==1.0.2
     # via -r requirements/windows.txt
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via
     #   -r requirements/windows.txt
     #   etcd3-py
@@ -311,19 +311,19 @@ pywin32==303
     #   wmi
 pywinrm==0.4.1
     # via -r requirements/static/ci/windows.in
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via
     #   -r requirements/base.txt
     #   clustershell
     #   kubernetes
     #   yamllint
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==22.0.3 ; sys_platform == "win32"
     # via
     #   -r requirements/zeromq.txt
     #   pytest-salt-factories
 requests-ntlm==1.1.0
     # via pywinrm
-requests==2.25.1
+requests==2.31.0 ; python_version >= "3.7"
     # via
     #   -r requirements/base.txt
     #   -r requirements/static/ci/common.in
@@ -364,7 +364,6 @@ six==1.15.0
     #   kubernetes
     #   mock
     #   packaging
-    #   pyopenssl
     #   python-dateutil
     #   pyvmomi
     #   pywinrm
@@ -389,7 +388,7 @@ typing-extensions==4.2.0
     # via
     #   pytest-shell-utilities
     #   pytest-system-statistics
-urllib3==1.26.6
+urllib3==1.26.17
     # via
     #   -r requirements/windows.txt
     #   botocore

requirements/static/pkg/freebsd.in

@@ -1,9 +1,13 @@
 # This file only exists to trigger the right static compiled requirements destination
 # Any non hard dependencies of Salt for FreeBSD can go here
 cherrypy
+cryptography>=41.0.3 ; python_version >= "3.7"
+cryptography<=40.0.2 ; python_version == "3.6"
+cryptography<=3.2.1 ; python_version <= "3.5"
 backports.ssl_match_hostname>=3.7.0.1; python_version < '3.7'
 pycparser>=2.21; python_version >= '3.9'
-pyopenssl>=19.0.0
+pyopenssl>=23.2.0 ; python_version >= "3.6"
+pyopenssl<=20.0.0 ; python_version <= "3.5"
 python-dateutil>=2.8.0
 python-gnupg>=0.4.4
 setproctitle>=1.1.10

requirements/static/pkg/linux.in

@@ -1,9 +1,13 @@
 # This file only exists to trigger the right static compiled requirements destination.
 # Any non hard dependencies of Salt for linux can go here
 cherrypy
+cryptography>=41.0.3 ; python_version >= "3.7"
+cryptography<=40.0.2 ; python_version == "3.6"
+cryptography<=3.2.1 ; python_version <= "3.5"
 backports.ssl_match_hostname>=3.7.0.1; python_version < '3.7'
 pycparser>=2.21; python_version >= '3.9'
-pyopenssl>=19.0.0
+pyopenssl>=23.2.0 ; python_version >= "3.6"
+pyopenssl<=20.0.0 ; python_version <= "3.5"
 python-dateutil>=2.8.0
 python-gnupg>=0.4.4
 rpm-vercmp

requirements/static/pkg/py3.10/darwin.txt

@@ -6,11 +6,11 @@
 #
 apache-libcloud==2.5.0
     # via -r requirements/darwin.txt
-certifi==2022.12.7
+certifi==2023.07.22
     # via requests
 cffi==1.14.6
     # via cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -18,7 +18,7 @@ cherrypy==18.6.1
     # via -r requirements/darwin.txt
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
     #   -r requirements/darwin.txt
     #   pyopenssl
@@ -26,7 +26,7 @@ distro==1.5.0
     # via -r requirements/base.txt
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/darwin.txt
 idna==2.8
     # via
@@ -78,7 +78,7 @@ pycparser==2.21
     #   cffi
 pycryptodomex==3.9.8
     # via -r requirements/crypto.txt
-pyopenssl==19.0.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/darwin.txt
 python-dateutil==2.8.0
     # via -r requirements/darwin.txt
@@ -86,11 +86,11 @@ python-gnupg==0.4.8
     # via -r requirements/darwin.txt
 pytz==2022.1
     # via tempora
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   apache-libcloud
@@ -100,8 +100,6 @@ setproctitle==1.1.10
 six==1.16.0
     # via
     #   cheroot
-    #   cryptography
-    #   pyopenssl
     #   python-dateutil
 smmap==3.0.2
     # via gitdb
@@ -109,7 +107,7 @@ tempora==4.1.1
     # via portend
 timelib==0.2.5
     # via -r requirements/darwin.txt
-urllib3==1.26.6
+urllib3==2.0.6
     # via requests
 vultr==1.0.1
     # via -r requirements/darwin.txt

requirements/static/pkg/py3.10/freebsd.txt

@@ -4,11 +4,11 @@
 #
 #    pip-compile --output-file=requirements/static/pkg/py3.10/freebsd.txt requirements/base.txt requirements/static/pkg/freebsd.in requirements/zeromq.txt
 #
-certifi==2022.12.7
+certifi==2023.07.22
     # via requests
 cffi==1.14.6
     # via cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -16,8 +16,10 @@ cherrypy==18.6.1
     # via -r requirements/static/pkg/freebsd.in
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
-    # via pyopenssl
+    # via
+    #   -r requirements/static/pkg/freebsd.in
+    #   pyopenssl
 distro==1.5.0
     # via
     #   -r requirements/base.txt
@@ -63,7 +65,7 @@ pycparser==2.21 ; python_version >= "3.9"
     #   cffi
 pycryptodomex==3.9.8
     # via -r requirements/crypto.txt
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/static/pkg/freebsd.in
 python-dateutil==2.8.1
     # via -r requirements/static/pkg/freebsd.in
@@ -71,26 +73,24 @@ python-gnupg==0.4.8
     # via -r requirements/static/pkg/freebsd.in
 pytz==2022.1
     # via tempora
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0
     # via -r requirements/base.txt
 setproctitle==1.1.10
     # via -r requirements/static/pkg/freebsd.in
 six==1.16.0
     # via
     #   cheroot
-    #   cryptography
     #   more-itertools
-    #   pyopenssl
     #   python-dateutil
 tempora==4.1.1
     # via portend
 timelib==0.2.5
     # via -r requirements/static/pkg/freebsd.in
-urllib3==1.26.6
+urllib3==2.0.6
     # via requests
 zc.lockfile==1.4
     # via cherrypy

requirements/static/pkg/py3.10/linux.txt

@@ -4,11 +4,11 @@
 #
 #    pip-compile --output-file=requirements/static/pkg/py3.10/linux.txt requirements/base.txt requirements/static/pkg/linux.in requirements/zeromq.txt
 #
-certifi==2022.12.7
+certifi==2023.07.22
     # via requests
 cffi==1.14.6
     # via cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -16,8 +16,10 @@ cherrypy==18.6.1
     # via -r requirements/static/pkg/linux.in
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
-    # via pyopenssl
+    # via
+    #   -r requirements/static/pkg/linux.in
+    #   pyopenssl
 distro==1.5.0
     # via -r requirements/base.txt
 idna==2.8
@@ -63,7 +65,7 @@ pycparser==2.21 ; python_version >= "3.9"
     #   cffi
 pycryptodomex==3.9.8
     # via -r requirements/crypto.txt
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/static/pkg/linux.in
 python-dateutil==2.8.1
     # via -r requirements/static/pkg/linux.in
@@ -71,11 +73,11 @@ python-gnupg==0.4.8
     # via -r requirements/static/pkg/linux.in
 pytz==2022.1
     # via tempora
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0
     # via -r requirements/base.txt
 rpm-vercmp==0.1.2
     # via -r requirements/static/pkg/linux.in
@@ -84,15 +86,13 @@ setproctitle==1.2.2 ; python_version >= "3.10"
 six==1.16.0
     # via
     #   cheroot
-    #   cryptography
     #   more-itertools
-    #   pyopenssl
     #   python-dateutil
 tempora==4.1.1
     # via portend
 timelib==0.2.5
     # via -r requirements/static/pkg/linux.in
-urllib3==1.26.6
+urllib3==2.0.6
     # via requests
 zc.lockfile==1.4
     # via cherrypy

requirements/static/pkg/py3.10/windows.txt

@@ -4,7 +4,7 @@
 #
 #    pip-compile --output-file=requirements/static/pkg/py3.10/windows.txt requirements/static/pkg/windows.in requirements/windows.txt
 #
-certifi==2022.5.18.1
+certifi==2023.07.22
     # via
     #   -r requirements/windows.txt
     #   requests
@@ -20,7 +20,7 @@ cherrypy==18.6.1
     # via -r requirements/windows.txt
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.4.7
+cryptography==41.0.4
     # via
     #   -r requirements/windows.txt
     #   pyopenssl
@@ -85,7 +85,7 @@ pycurl==7.43.0.5
     # via -r requirements/windows.txt
 pymysql==1.0.2
     # via -r requirements/windows.txt
-pyopenssl==20.0.1
+pyopenssl==23.0.0
     # via -r requirements/windows.txt
 python-dateutil==2.8.1
     # via -r requirements/windows.txt
@@ -100,7 +100,7 @@ pywin32==303
     #   -r requirements/windows.txt
     #   cherrypy
     #   wmi
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
 pyzmq==23.2.0
     # via -r requirements/zeromq.txt

requirements/static/pkg/py3.5/linux.txt

@@ -18,8 +18,10 @@ cherrypy==18.6.1
     # via -r requirements/static/pkg/linux.in
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.0
+cryptography==3.2.1 ; python_version <= "3.5"
-    # via pyopenssl
+    # via
+    #   -r requirements/static/pkg/linux.in
+    #   pyopenssl
 distro==1.5.0
     # via -r requirements/base.txt
 idna==2.8
@@ -62,7 +64,7 @@ pycparser==2.17
     # via cffi
 pycryptodomex==3.9.8
     # via -r requirements/crypto.txt
-pyopenssl==19.1.0
+pyopenssl==20.0.0 ; python_version <= "3.5"
     # via -r requirements/static/pkg/linux.in
 python-dateutil==2.8.1
     # via -r requirements/static/pkg/linux.in
@@ -72,7 +74,7 @@ pytz==2022.1
     # via tempora
 pyyaml==5.3.1
     # via -r requirements/base.txt
-pyzmq==18.0.1 ; python_version < "3.9"
+pyzmq==19.0.2 ; python_version < "3.6"
     # via -r requirements/zeromq.txt
 requests==2.25.1
     # via -r requirements/base.txt

requirements/static/pkg/py3.6/linux.txt

@@ -6,7 +6,7 @@
 #
 backports.ssl-match-hostname==3.7.0.1 ; python_version < "3.7"
     # via -r requirements/static/pkg/linux.in
-certifi==2022.12.7
+certifi==2023.07.22
     # via requests
 cffi==1.14.6
     # via cryptography
@@ -18,8 +18,10 @@ cherrypy==18.6.1
     # via -r requirements/static/pkg/linux.in
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.3.2
+cryptography==40.0.2 ; python_version == "3.6"
-    # via pyopenssl
+    # via
+    #   -r requirements/static/pkg/linux.in
+    #   pyopenssl
 distro==1.5.0
     # via -r requirements/base.txt
 idna==2.8
@@ -65,7 +67,7 @@ pycparser==2.17
     # via cffi
 pycryptodomex==3.9.8
     # via -r requirements/crypto.txt
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/static/pkg/linux.in
 python-dateutil==2.8.1
     # via -r requirements/static/pkg/linux.in
@@ -73,9 +75,9 @@ python-gnupg==0.4.8
     # via -r requirements/static/pkg/linux.in
 pytz==2022.1
     # via tempora
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==18.0.1 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
 requests==2.25.1
     # via -r requirements/base.txt
@@ -86,9 +88,7 @@ setproctitle==1.1.10 ; python_version < "3.10"
 six==1.16.0
     # via
     #   cheroot
-    #   cryptography
     #   more-itertools
-    #   pyopenssl
     #   python-dateutil
 tempora==4.1.1
     # via portend
@@ -96,7 +96,7 @@ timelib==0.2.5
     # via -r requirements/static/pkg/linux.in
 typing-extensions==3.10.0.0
     # via importlib-metadata
-urllib3==1.26.6
+urllib3==1.26.17
     # via requests
 zc.lockfile==1.4
     # via cherrypy

requirements/static/pkg/py3.7/freebsd.txt

@@ -4,11 +4,11 @@
 #
 #    pip-compile --output-file=requirements/static/pkg/py3.7/freebsd.txt requirements/base.txt requirements/static/pkg/freebsd.in requirements/zeromq.txt
 #
-certifi==2022.12.7
+certifi==2023.07.22
     # via requests
 cffi==1.14.6
     # via cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -16,8 +16,10 @@ cherrypy==18.6.1
     # via -r requirements/static/pkg/freebsd.in
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
-    # via pyopenssl
+    # via
+    #   -r requirements/static/pkg/freebsd.in
+    #   pyopenssl
 distro==1.5.0
     # via
     #   -r requirements/base.txt
@@ -63,7 +65,7 @@ pycparser==2.17
     # via cffi
 pycryptodomex==3.9.8
     # via -r requirements/crypto.txt
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/static/pkg/freebsd.in
 python-dateutil==2.8.1
     # via -r requirements/static/pkg/freebsd.in
@@ -71,20 +73,18 @@ python-gnupg==0.4.8
     # via -r requirements/static/pkg/freebsd.in
 pytz==2022.1
     # via tempora
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==18.0.1 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0
     # via -r requirements/base.txt
 setproctitle==1.1.10
     # via -r requirements/static/pkg/freebsd.in
 six==1.16.0
     # via
     #   cheroot
-    #   cryptography
     #   more-itertools
-    #   pyopenssl
     #   python-dateutil
 tempora==4.1.1
     # via portend
@@ -92,7 +92,7 @@ timelib==0.2.5
     # via -r requirements/static/pkg/freebsd.in
 typing-extensions==3.10.0.0
     # via importlib-metadata
-urllib3==1.26.6
+urllib3==2.0.6
     # via requests
 zc.lockfile==1.4
     # via cherrypy

requirements/static/pkg/py3.7/linux.txt

@@ -4,11 +4,11 @@
 #
 #    pip-compile --output-file=requirements/static/pkg/py3.7/linux.txt requirements/base.txt requirements/static/pkg/linux.in requirements/zeromq.txt
 #
-certifi==2022.12.7
+certifi==2023.07.22
     # via requests
 cffi==1.14.6
     # via cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -16,8 +16,10 @@ cherrypy==18.6.1
     # via -r requirements/static/pkg/linux.in
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
-    # via pyopenssl
+    # via
+    #   -r requirements/static/pkg/linux.in
+    #   pyopenssl
 distro==1.5.0
     # via -r requirements/base.txt
 idna==2.8
@@ -61,7 +63,7 @@ pycparser==2.17
     # via cffi
 pycryptodomex==3.9.8
     # via -r requirements/crypto.txt
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/static/pkg/linux.in
 python-dateutil==2.8.1
     # via -r requirements/static/pkg/linux.in
@@ -69,11 +71,11 @@ python-gnupg==0.4.8
     # via -r requirements/static/pkg/linux.in
 pytz==2022.1
     # via tempora
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==18.0.1 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0
     # via -r requirements/base.txt
 rpm-vercmp==0.1.2
     # via -r requirements/static/pkg/linux.in
@@ -82,9 +84,7 @@ setproctitle==1.1.10 ; python_version < "3.10"
 six==1.16.0
     # via
     #   cheroot
-    #   cryptography
     #   more-itertools
-    #   pyopenssl
     #   python-dateutil
 tempora==4.1.1
     # via portend
@@ -92,7 +92,7 @@ timelib==0.2.5
     # via -r requirements/static/pkg/linux.in
 typing-extensions==3.10.0.0
     # via importlib-metadata
-urllib3==1.26.6
+urllib3==2.0.6
     # via requests
 zc.lockfile==1.4
     # via cherrypy

requirements/static/pkg/py3.7/windows.txt

@@ -4,7 +4,7 @@
 #
 #    pip-compile --output-file=requirements/static/pkg/py3.7/windows.txt requirements/static/pkg/windows.in requirements/windows.txt
 #
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/windows.txt
     #   requests
@@ -12,7 +12,7 @@ cffi==1.14.6
     # via
     #   -r requirements/windows.txt
     #   cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -20,7 +20,7 @@ cherrypy==18.6.1
     # via -r requirements/windows.txt
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.4.7
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
     #   -r requirements/windows.txt
     #   pyopenssl
@@ -28,7 +28,7 @@ distro==1.5.0
     # via -r requirements/base.txt
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/windows.txt
 idna==2.8
     # via requests
@@ -91,7 +91,7 @@ pymssql==2.2.1
     # via -r requirements/windows.txt
 pymysql==1.0.2
     # via -r requirements/windows.txt
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/windows.txt
 python-dateutil==2.8.1
     # via -r requirements/windows.txt
@@ -106,11 +106,11 @@ pywin32==303
     #   -r requirements/windows.txt
     #   cherrypy
     #   wmi
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==22.0.3 ; python_version < "3.9" and sys_platform == "win32"
+pyzmq==22.0.3 ; sys_platform == "win32"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0 ; python_version >= "3.7"
     # via
     #   -r requirements/base.txt
     #   -r requirements/windows.txt
@@ -119,7 +119,6 @@ setproctitle==1.1.10
 six==1.16.0
     # via
     #   cheroot
-    #   pyopenssl
     #   python-dateutil
 smmap==3.0.4
     # via gitdb
@@ -131,7 +130,7 @@ typing-extensions==3.10.0.0
     # via
     #   gitpython
     #   importlib-metadata
-urllib3==1.26.6
+urllib3==2.0.6
     # via
     #   -r requirements/windows.txt
     #   requests

requirements/static/pkg/py3.8/freebsd.txt

@@ -4,11 +4,11 @@
 #
 #    pip-compile --output-file=requirements/static/pkg/py3.8/freebsd.txt requirements/base.txt requirements/static/pkg/freebsd.in requirements/zeromq.txt
 #
-certifi==2022.12.7
+certifi==2023.07.22
     # via requests
 cffi==1.14.6
     # via cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -16,8 +16,10 @@ cherrypy==18.6.1
     # via -r requirements/static/pkg/freebsd.in
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
-    # via pyopenssl
+    # via
+    #   -r requirements/static/pkg/freebsd.in
+    #   pyopenssl
 distro==1.5.0
     # via
     #   -r requirements/base.txt
@@ -63,7 +65,7 @@ pycparser==2.17
     # via cffi
 pycryptodomex==3.9.8
     # via -r requirements/crypto.txt
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/static/pkg/freebsd.in
 python-dateutil==2.8.1
     # via -r requirements/static/pkg/freebsd.in
@@ -71,26 +73,24 @@ python-gnupg==0.4.8
     # via -r requirements/static/pkg/freebsd.in
 pytz==2022.1
     # via tempora
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==19.0.0 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0
     # via -r requirements/base.txt
 setproctitle==1.1.10
     # via -r requirements/static/pkg/freebsd.in
 six==1.16.0
     # via
     #   cheroot
-    #   cryptography
     #   more-itertools
-    #   pyopenssl
     #   python-dateutil
 tempora==4.1.1
     # via portend
 timelib==0.2.5
     # via -r requirements/static/pkg/freebsd.in
-urllib3==1.26.6
+urllib3==2.0.6
     # via requests
 zc.lockfile==1.4
     # via cherrypy

requirements/static/pkg/py3.8/linux.txt

@@ -4,11 +4,11 @@
 #
 #    pip-compile --output-file=requirements/static/pkg/py3.8/linux.txt requirements/base.txt requirements/static/pkg/linux.in requirements/zeromq.txt
 #
-certifi==2022.12.7
+certifi==2023.07.22
     # via requests
 cffi==1.14.6
     # via cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -16,8 +16,10 @@ cherrypy==18.6.1
     # via -r requirements/static/pkg/linux.in
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
-    # via pyopenssl
+    # via
+    #   -r requirements/static/pkg/linux.in
+    #   pyopenssl
 distro==1.5.0
     # via -r requirements/base.txt
 idna==2.8
@@ -61,7 +63,7 @@ pycparser==2.17
     # via cffi
 pycryptodomex==3.9.8
     # via -r requirements/crypto.txt
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/static/pkg/linux.in
 python-dateutil==2.8.1
     # via -r requirements/static/pkg/linux.in
@@ -69,11 +71,11 @@ python-gnupg==0.4.8
     # via -r requirements/static/pkg/linux.in
 pytz==2022.1
     # via tempora
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==19.0.0 ; python_version < "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0
     # via -r requirements/base.txt
 rpm-vercmp==0.1.2
     # via -r requirements/static/pkg/linux.in
@@ -82,15 +84,13 @@ setproctitle==1.1.10 ; python_version < "3.10"
 six==1.16.0
     # via
     #   cheroot
-    #   cryptography
     #   more-itertools
-    #   pyopenssl
     #   python-dateutil
 tempora==4.1.1
     # via portend
 timelib==0.2.5
     # via -r requirements/static/pkg/linux.in
-urllib3==1.26.6
+urllib3==2.0.6
     # via requests
 zc.lockfile==1.4
     # via cherrypy

requirements/static/pkg/py3.8/windows.txt

@@ -4,7 +4,7 @@
 #
 #    pip-compile --output-file=requirements/static/pkg/py3.8/windows.txt requirements/static/pkg/windows.in requirements/windows.txt
 #
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/windows.txt
     #   requests
@@ -12,7 +12,7 @@ cffi==1.14.6
     # via
     #   -r requirements/windows.txt
     #   cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -20,7 +20,7 @@ cherrypy==18.6.1
     # via -r requirements/windows.txt
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.4.7
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
     #   -r requirements/windows.txt
     #   pyopenssl
@@ -28,7 +28,7 @@ distro==1.5.0
     # via -r requirements/base.txt
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/windows.txt
 idna==2.8
     # via requests
@@ -91,7 +91,7 @@ pymssql==2.2.1
     # via -r requirements/windows.txt
 pymysql==1.0.2
     # via -r requirements/windows.txt
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/windows.txt
 python-dateutil==2.8.1
     # via -r requirements/windows.txt
@@ -106,11 +106,11 @@ pywin32==303
     #   -r requirements/windows.txt
     #   cherrypy
     #   wmi
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==22.0.3 ; python_version < "3.9" and sys_platform == "win32"
+pyzmq==22.0.3 ; sys_platform == "win32"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0 ; python_version >= "3.7"
     # via
     #   -r requirements/base.txt
     #   -r requirements/windows.txt
@@ -119,7 +119,6 @@ setproctitle==1.1.10
 six==1.15.0
     # via
     #   cheroot
-    #   pyopenssl
     #   python-dateutil
 smmap==4.0.0
     # via gitdb
@@ -127,7 +126,7 @@ tempora==4.1.1
     # via portend
 timelib==0.2.5
     # via -r requirements/windows.txt
-urllib3==1.26.6
+urllib3==2.0.6
     # via
     #   -r requirements/windows.txt
     #   requests

requirements/static/pkg/py3.9/darwin.txt

@@ -6,11 +6,11 @@
 #
 apache-libcloud==2.5.0
     # via -r requirements/darwin.txt
-certifi==2022.12.7
+certifi==2023.07.22
     # via requests
 cffi==1.14.6
     # via cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -18,7 +18,7 @@ cherrypy==18.6.1
     # via -r requirements/darwin.txt
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
     #   -r requirements/darwin.txt
     #   pyopenssl
@@ -26,7 +26,7 @@ distro==1.5.0
     # via -r requirements/base.txt
 gitdb==4.0.5
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/darwin.txt
 idna==2.8
     # via
@@ -80,7 +80,7 @@ pycparser==2.21
     #   cffi
 pycryptodomex==3.9.8
     # via -r requirements/crypto.txt
-pyopenssl==19.0.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/darwin.txt
 python-dateutil==2.8.0
     # via -r requirements/darwin.txt
@@ -88,11 +88,11 @@ python-gnupg==0.4.8
     # via -r requirements/darwin.txt
 pytz==2022.1
     # via tempora
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0
     # via
     #   -r requirements/base.txt
     #   apache-libcloud
@@ -102,8 +102,6 @@ setproctitle==1.1.10
 six==1.16.0
     # via
     #   cheroot
-    #   cryptography
-    #   pyopenssl
     #   python-dateutil
 smmap==3.0.2
     # via gitdb
@@ -111,7 +109,7 @@ tempora==4.1.1
     # via portend
 timelib==0.2.5
     # via -r requirements/darwin.txt
-urllib3==1.26.6
+urllib3==2.0.6
     # via requests
 vultr==1.0.1
     # via -r requirements/darwin.txt

requirements/static/pkg/py3.9/freebsd.txt

@@ -4,11 +4,11 @@
 #
 #    pip-compile --output-file=requirements/static/pkg/py3.9/freebsd.txt requirements/base.txt requirements/static/pkg/freebsd.in requirements/zeromq.txt
 #
-certifi==2022.12.7
+certifi==2023.07.22
     # via requests
 cffi==1.14.6
     # via cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -16,8 +16,10 @@ cherrypy==18.6.1
     # via -r requirements/static/pkg/freebsd.in
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
-    # via pyopenssl
+    # via
+    #   -r requirements/static/pkg/freebsd.in
+    #   pyopenssl
 distro==1.5.0
     # via
     #   -r requirements/base.txt
@@ -65,7 +67,7 @@ pycparser==2.21 ; python_version >= "3.9"
     #   cffi
 pycryptodomex==3.9.8
     # via -r requirements/crypto.txt
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/static/pkg/freebsd.in
 python-dateutil==2.8.1
     # via -r requirements/static/pkg/freebsd.in
@@ -73,26 +75,24 @@ python-gnupg==0.4.8
     # via -r requirements/static/pkg/freebsd.in
 pytz==2022.1
     # via tempora
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0
     # via -r requirements/base.txt
 setproctitle==1.1.10
     # via -r requirements/static/pkg/freebsd.in
 six==1.16.0
     # via
     #   cheroot
-    #   cryptography
     #   more-itertools
-    #   pyopenssl
     #   python-dateutil
 tempora==4.1.1
     # via portend
 timelib==0.2.5
     # via -r requirements/static/pkg/freebsd.in
-urllib3==1.26.6
+urllib3==2.0.6
     # via requests
 zc.lockfile==1.4
     # via cherrypy

requirements/static/pkg/py3.9/linux.txt

@@ -4,11 +4,11 @@
 #
 #    pip-compile --output-file=requirements/static/pkg/py3.9/linux.txt requirements/base.txt requirements/static/pkg/linux.in requirements/zeromq.txt
 #
-certifi==2022.12.7
+certifi==2023.07.22
     # via requests
 cffi==1.14.6
     # via cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -16,8 +16,10 @@ cherrypy==18.6.1
     # via -r requirements/static/pkg/linux.in
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.3.2
+cryptography==41.0.4 ; python_version >= "3.7"
-    # via pyopenssl
+    # via
+    #   -r requirements/static/pkg/linux.in
+    #   pyopenssl
 distro==1.5.0
     # via -r requirements/base.txt
 idna==2.8
@@ -63,7 +65,7 @@ pycparser==2.21 ; python_version >= "3.9"
     #   cffi
 pycryptodomex==3.9.8
     # via -r requirements/crypto.txt
-pyopenssl==19.1.0
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/static/pkg/linux.in
 python-dateutil==2.8.1
     # via -r requirements/static/pkg/linux.in
@@ -71,11 +73,11 @@ python-gnupg==0.4.8
     # via -r requirements/static/pkg/linux.in
 pytz==2022.1
     # via tempora
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==23.2.0 ; python_version >= "3.6"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0
     # via -r requirements/base.txt
 rpm-vercmp==0.1.2
     # via -r requirements/static/pkg/linux.in
@@ -84,15 +86,13 @@ setproctitle==1.1.10 ; python_version < "3.10"
 six==1.16.0
     # via
     #   cheroot
-    #   cryptography
     #   more-itertools
-    #   pyopenssl
     #   python-dateutil
 tempora==4.1.1
     # via portend
 timelib==0.2.5
     # via -r requirements/static/pkg/linux.in
-urllib3==1.26.6
+urllib3==2.0.6
     # via requests
 zc.lockfile==1.4
     # via cherrypy

requirements/static/pkg/py3.9/windows.txt

@@ -4,7 +4,7 @@
 #
 #    pip-compile --output-file=requirements/static/pkg/py3.9/windows.txt requirements/static/pkg/windows.in requirements/windows.txt
 #
-certifi==2022.12.7 ; python_version >= "3.6"
+certifi==2023.07.22 ; python_version >= "3.6"
     # via
     #   -r requirements/windows.txt
     #   requests
@@ -12,7 +12,7 @@ cffi==1.14.6
     # via
     #   -r requirements/windows.txt
     #   cryptography
-chardet==3.0.4
+charset-normalizer==3.2.0
     # via requests
 cheroot==8.5.2
     # via cherrypy
@@ -20,7 +20,7 @@ cherrypy==18.6.1
     # via -r requirements/windows.txt
 contextvars==2.4
     # via -r requirements/base.txt
-cryptography==3.4.7
+cryptography==41.0.4 ; python_version >= "3.7"
     # via
     #   -r requirements/windows.txt
     #   pyopenssl
@@ -28,7 +28,7 @@ distro==1.5.0
     # via -r requirements/base.txt
 gitdb==4.0.7
     # via gitpython
-gitpython==3.1.30 ; python_version >= "3.7"
+gitpython==3.1.37 ; python_version >= "3.7"
     # via -r requirements/windows.txt
 idna==2.8
     # via requests
@@ -91,7 +91,7 @@ pymssql==2.2.1
     # via -r requirements/windows.txt
 pymysql==1.0.2
     # via -r requirements/windows.txt
-pyopenssl==20.0.1
+pyopenssl==23.2.0 ; python_version >= "3.6"
     # via -r requirements/windows.txt
 python-dateutil==2.8.1
     # via -r requirements/windows.txt
@@ -106,11 +106,11 @@ pywin32==303
     #   -r requirements/windows.txt
     #   cherrypy
     #   wmi
-pyyaml==5.4.1
+pyyaml==6.0.1
     # via -r requirements/base.txt
-pyzmq==23.2.0 ; python_version >= "3.9"
+pyzmq==22.0.3 ; sys_platform == "win32"
     # via -r requirements/zeromq.txt
-requests==2.25.1
+requests==2.31.0 ; python_version >= "3.7"
     # via
     #   -r requirements/base.txt
     #   -r requirements/windows.txt
@@ -119,7 +119,6 @@ setproctitle==1.1.10
 six==1.15.0
     # via
     #   cheroot
-    #   pyopenssl
     #   python-dateutil
 smmap==4.0.0
     # via gitdb
@@ -127,7 +126,7 @@ tempora==4.1.1
     # via portend
 timelib==0.2.5
     # via -r requirements/windows.txt
-urllib3==1.26.6
+urllib3==2.0.6
     # via
     #   -r requirements/windows.txt
     #   requests

requirements/windows.txt

@@ -11,9 +11,11 @@ certifi>=2022.12.7 ; python_version >= "3.6"
 certifi<=2021.10.8  ; python_version <= "3.5"
 cffi>=1.14.5
 cherrypy>=18.6.1
-cryptography>=3.4.7
+cryptography>=41.0.3 ; python_version >= "3.7"
+cryptography<=40.0.2 ; python_version == "3.6"
+cryptography<=3.2.1 ; python_version <= "3.5"
 gitpython>=2.1.15 ; python_version <= "3.6"
-gitpython>=3.1.30 ; python_version >= "3.7"
+gitpython>=3.1.37 ; python_version >= "3.7"
 ioloop>=0.1a0
 libnacl>=1.8.0
 lxml>=4.6.3
@@ -23,10 +25,13 @@ pycparser>=2.21
 pycurl>=7.43.0.5  # PyCurl does not provide a whl file for newer versions
 pymssql>=2.2.1
 pymysql>=1.0.2
-pyopenssl>=20.0.1
+pyopenssl>=23.2.0 ; python_version >= "3.6"
+pyopenssl<=20.0.0 ; python_version <= "3.5"
 python-dateutil>=2.8.1
 python-gnupg>=0.4.7
-requests>=2.25.1
+requests>=2.31.0 ; python_version >= "3.7"
+requests<=2.27.1 ; python_version == "3.6"
+requests<=2.25.1 ; python_version == "3.5"
 setproctitle
 timelib>=0.2.5
 urllib3>=1.26.5

requirements/zeromq.txt

@@ -1,10 +1,8 @@
 -r base.txt
 -r crypto.txt
 
-pyzmq<=20.0.0 ; python_version < "3.6"
+pyzmq<=20.0.0; python_version < "3.6"
-pyzmq>=17.0.0 ; python_version < "3.9"
+pyzmq>=20.0.0; python_version >= "3.6"
-pyzmq>19.0.2 ; python_version >= "3.9"
-
 # We can't use 23+ on Windows until they fix this:
 # https://github.com/zeromq/pyzmq/issues/1472
-pyzmq>=20.0.0, <=22.0.3 ; python_version < "3.9" and sys_platform == 'win32'
+pyzmq>=20.0.0,<=22.0.3 ; sys_platform == "win32"

salt/client/ssh/__init__.py

@@ -11,9 +11,11 @@ import hashlib
 import logging
 import multiprocessing
 import os
+import pathlib
 import queue
 import re
 import shlex
+import shutil
 import subprocess
 import sys
 import tarfile
@@ -467,7 +469,14 @@ class SSH(MultiprocessingStateMixin):
             if target.get("passwd", False) or self.opts["ssh_passwd"]:
                 self._key_deploy_run(host, target, False)
             return ret
-        if ret[host].get("stderr", "").count("Permission denied"):
+        stderr = ret[host].get("stderr", "")
+        # -failed to upload file- is detecting scp errors
+        # Errors to ignore when Permission denied is in the stderr. For example
+        # scp can get a permission denied on the target host, but they where
+        # able to accurate authenticate against the box
+        ignore_err = ["failed to upload file"]
+        check_err = [x for x in ignore_err if stderr.count(x)]
+        if "Permission denied" in stderr and not check_err:
             target = self.targets[host]
             # permission denied, attempt to auto deploy ssh key
             print(
@@ -500,7 +509,7 @@ class SSH(MultiprocessingStateMixin):
             mods=self.mods,
             fsclient=self.fsclient,
             thin=self.thin,
-            **target
+            **target,
         )
         if salt.utils.path.which("ssh-copy-id"):
             # we have ssh-copy-id, use it!
@@ -516,7 +525,7 @@ class SSH(MultiprocessingStateMixin):
                 mods=self.mods,
                 fsclient=self.fsclient,
                 thin=self.thin,
-                **target
+                **target,
             )
             stdout, stderr, retcode = single.cmd_block()
             try:
@@ -543,7 +552,7 @@ class SSH(MultiprocessingStateMixin):
             fsclient=self.fsclient,
             thin=self.thin,
             mine=mine,
-            **target
+            **target,
         )
         ret = {"id": single.id}
         stdout, stderr, retcode = single.run()
@@ -883,7 +892,7 @@ class Single:
         remote_port_forwards=None,
         winrm=False,
         ssh_options=None,
-        **kwargs
+        **kwargs,
     ):
         # Get mine setting and mine_functions if defined in kwargs (from roster)
         self.mine = mine
@@ -1007,11 +1016,30 @@ class Single:
         """
         Run our pre_flight script before running any ssh commands
         """
-        script = os.path.join(tempfile.gettempdir(), self.ssh_pre_file)
+        with tempfile.NamedTemporaryFile() as temp:
+            # ensure we use copyfile to not copy the file attributes
+            # we want to ensure we use the perms set by the secure
+            # NamedTemporaryFile
+            try:
+                shutil.copyfile(self.ssh_pre_flight, temp.name)
+            except OSError as err:
+                return (
+                    "",
+                    "Could not copy pre flight script to temporary path",
+                    1,
+                )
+            target_script = f".{pathlib.Path(temp.name).name}"
+            log.trace("Copying the pre flight script to target")
+            stdout, stderr, retcode = self.shell.send(temp.name, target_script)
+            if retcode != 0:
+                # We could not copy the script to the target
+                log.error("Could not copy the pre flight script to target")
+                return stdout, stderr, retcode
 
-        self.shell.send(self.ssh_pre_flight, script)
+            log.trace("Executing the pre flight script on target")
-
+            return self.execute_script(
-        return self.execute_script(script, script_args=self.ssh_pre_flight_args)
+                target_script, script_args=self.ssh_pre_flight_args
+            )
 
     def check_thin_dir(self):
         """
@@ -1131,7 +1159,7 @@ class Single:
                 self.id,
                 fsclient=self.fsclient,
                 minion_opts=self.minion_opts,
-                **self.target
+                **self.target,
             )
 
             opts_pkg = pre_wrapper["test.opts_pkg"]()  # pylint: disable=E1102
@@ -1210,7 +1238,7 @@ class Single:
             self.id,
             fsclient=self.fsclient,
             minion_opts=self.minion_opts,
-            **self.target
+            **self.target,
         )
         wrapper.fsclient.opts["cachedir"] = opts["cachedir"]
         self.wfuncs = salt.loader.ssh_wrapper(opts, wrapper, self.context)
@@ -1381,18 +1409,20 @@ ARGS = {arguments}\n'''.format(
             return self.shell.exec_cmd(cmd_str)
 
         # Write the shim to a temporary file in the default temp directory
-        with tempfile.NamedTemporaryFile(
+        with tempfile.NamedTemporaryFile(mode="w+b", delete=False) as shim_tmp_file:
-            mode="w+b", prefix="shim_", delete=False
-        ) as shim_tmp_file:
             shim_tmp_file.write(salt.utils.stringutils.to_bytes(cmd_str))
 
         # Copy shim to target system, under $HOME/.<randomized name>
-        target_shim_file = ".{}.{}".format(
+        target_shim_file = f".{pathlib.Path(shim_tmp_file.name).name}"
-            binascii.hexlify(os.urandom(6)).decode("ascii"), extension
+
-        )
         if self.winrm:
             target_shim_file = saltwinshell.get_target_shim_file(self, target_shim_file)
-        self.shell.send(shim_tmp_file.name, target_shim_file, makedirs=True)
+        stdout, stderr, retcode = self.shell.send(
+            shim_tmp_file.name, target_shim_file, makedirs=True
+        )
+        if retcode != 0:
+            log.error("Could not copy the shim script to target")
+            return stdout, stderr, retcode
 
         # Remove our shim file
         try:

salt/fileserver/__init__.py

@@ -569,10 +569,6 @@ class Fileserver:
         back = self.backends(back)
         kwargs = {}
         fnd = {"path": "", "rel": ""}
-        if os.path.isabs(path):
-            return fnd
-        if "../" in path:
-            return fnd
         if salt.utils.url.is_escaped(path):
             # don't attempt to find URL query arguments in the path
             path = salt.utils.url.unescape(path)
@@ -588,6 +584,9 @@ class Fileserver:
                     args = comp.split("=", 1)
                     kwargs[args[0]] = args[1]
 
+        if os.path.isabs(path) or "../" in path:
+            return fnd
+
         if "env" in kwargs:
             # "env" is not supported; Use "saltenv".
             kwargs.pop("env")

salt/fileserver/roots.py

@@ -27,6 +27,7 @@ import salt.utils.hashutils
 import salt.utils.path
 import salt.utils.platform
 import salt.utils.stringutils
+import salt.utils.verify
 import salt.utils.versions
 
 log = logging.getLogger(__name__)
@@ -98,6 +99,11 @@ def find_file(path, saltenv="base", **kwargs):
         if saltenv == "__env__":
             root = root.replace("__env__", actual_saltenv)
         full = os.path.join(root, path)
+
+        # Refuse to serve file that is not under the root.
+        if not salt.utils.verify.clean_path(root, full, subdir=True):
+            continue
+
         if os.path.isfile(full) and not salt.fileserver.is_file_ignored(__opts__, full):
             fnd["path"] = full
             fnd["rel"] = path
@@ -128,6 +134,26 @@ def serve_file(load, fnd):
     ret["dest"] = fnd["rel"]
     gzip = load.get("gzip", None)
     fpath = os.path.normpath(fnd["path"])
+
+    actual_saltenv = saltenv = load["saltenv"]
+    if saltenv not in __opts__["file_roots"]:
+        if "__env__" in __opts__["file_roots"]:
+            log.debug(
+                "salt environment '%s' maps to __env__ file_roots directory", saltenv
+            )
+            saltenv = "__env__"
+        else:
+            return fnd
+    file_in_root = False
+    for root in __opts__["file_roots"][saltenv]:
+        if saltenv == "__env__":
+            root = root.replace("__env__", actual_saltenv)
+        # Refuse to serve file that is not under the root.
+        if salt.utils.verify.clean_path(root, fpath, subdir=True):
+            file_in_root = True
+    if not file_in_root:
+        return ret
+
     with salt.utils.files.fopen(fpath, "rb") as fp_:
         fp_.seek(load["loc"])
         data = fp_.read(__opts__["file_buffer_size"])