From fc837f4fee1fe541bcac3a95b0131c9bf0882a04 Mon Sep 17 00:00:00 2001
From: JeffreyChen <zenxcvwait@gmail.com>
Date: Thu, 23 Jul 2026 14:36:58 +0800
Subject: [PATCH] Add lower bounds to the remaining runtime dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

requests, python-dotenv, webdriver-manager and defusedxml were declared
unbounded, so an installer could resolve any version — including ones
predating known advisories — whenever another constraint in the environment
held them back.

Floors chosen from evidence rather than convenience:

- requests>=2.33.0 is the first release carrying the extract_zipped_paths
  fix (GHSA-gc5v-m9x4-r6x2).
- webdriver-manager>=4.0.0 is the line this package is developed against.
  3.9.1 does expose DriverCacheManager and the cache_manager kwarg the
  wrapper uses, so this is a policy floor, not an API requirement.
- python-dotenv>=1.0.0 and defusedxml>=0.7.1 are the stable current lines.

These are minimums only; no upper bounds, so the package stays
co-installable. faker and sqlalchemy are deliberately left alone — both are
optional extras imported lazily behind guards and are absent from the
package metadata, so a floor there would add friction without benefit.
---
 dev.toml             |  9 +++++----
 dev_requirements.txt |  2 +-
 pyproject.toml       | 15 +++++++++++----
 requirements.txt     |  2 +-
 4 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/dev.toml b/dev.toml
index 8539fc41..5fb6eb1d 100644
--- a/dev.toml
+++ b/dev.toml
@@ -13,12 +13,13 @@ authors = [
 description = "WEB Automation Framework"
 requires-python = ">=3.10"
 license-files = ["LICENSE"]
+# Kept in step with pyproject.toml; see the rationale for each floor there.
 dependencies = [
     "selenium>=4.0.0",
-    "requests",
-    "python-dotenv",
-    "webdriver-manager",
-    "defusedxml",
+    "requests>=2.33.0",
+    "python-dotenv>=1.0.0",
+    "webdriver-manager>=4.0.0",
+    "defusedxml>=0.7.1",
 ]
 classifiers = [
     "Programming Language :: Python :: 3.10",
diff --git a/dev_requirements.txt b/dev_requirements.txt
index 1d8545ee..185c419d 100644
--- a/dev_requirements.txt
+++ b/dev_requirements.txt
@@ -4,7 +4,7 @@ sphinx
 je_web_runner_dev
 sphinx-rtd-theme
 Pyside6
-defusedxml
+defusedxml>=0.7.1
 Pillow>=12.3.0
 faker
 sqlalchemy
diff --git a/pyproject.toml b/pyproject.toml
index 1b6b74ed..69b7ea91 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -18,12 +18,19 @@ keywords = [
     "selenium", "automation", "testing", "web-automation",
     "webdriver", "browser", "e2e", "qa",
 ]
+# Every runtime dependency carries a lower bound so an installer cannot
+# silently resolve a version predating a known advisory or an API this
+# package relies on. Floors are minimums, not pins — upper bounds are left
+# open so the package stays co-installable.
 dependencies = [
     "selenium>=4.0.0",
-    'requests',
-    'python-dotenv',
-    "webdriver-manager",
-    "defusedxml",
+    # 2.33.0 is the first release carrying the extract_zipped_paths fix
+    # (GHSA-gc5v-m9x4-r6x2).
+    "requests>=2.33.0",
+    "python-dotenv>=1.0.0",
+    # 4.x is the line this package is developed and tested against.
+    "webdriver-manager>=4.0.0",
+    "defusedxml>=0.7.1",
     # Floor set to the first release without the known Pillow advisories;
     # wheels cover cp310-cp315, so it excludes no supported interpreter.
     "Pillow>=12.3.0",
diff --git a/requirements.txt b/requirements.txt
index 9349904b..9d2a22ad 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,5 @@
 je_web_runner
-defusedxml
+defusedxml>=0.7.1
 Pillow>=12.3.0
 faker
 sqlalchemy