Add lower bounds to the remaining runtime dependencies

dev.toml

@@ -13,12 +13,13 @@ authors = [
 description = "WEB Automation Framework"
 requires-python = ">=3.10"
 license-files = ["LICENSE"]
+# Kept in step with pyproject.toml; see the rationale for each floor there.
 dependencies = [
     "selenium>=4.0.0",
-    "requests",
-    "python-dotenv",
-    "webdriver-manager",
-    "defusedxml",
+    "requests>=2.33.0",
+    "python-dotenv>=1.0.0",
+    "webdriver-manager>=4.0.0",
+    "defusedxml>=0.7.1",
 ]
 classifiers = [
     "Programming Language :: Python :: 3.10",

dev_requirements.txt

@@ -4,7 +4,7 @@ sphinx
 je_web_runner_dev
 sphinx-rtd-theme
 Pyside6
-defusedxml
+defusedxml>=0.7.1
 Pillow>=12.3.0
 faker
 sqlalchemy

pyproject.toml

@@ -18,12 +18,19 @@ keywords = [
     "selenium", "automation", "testing", "web-automation",
     "webdriver", "browser", "e2e", "qa",
 ]
+# Every runtime dependency carries a lower bound so an installer cannot
+# silently resolve a version predating a known advisory or an API this
+# package relies on. Floors are minimums, not pins — upper bounds are left
+# open so the package stays co-installable.
 dependencies = [
     "selenium>=4.0.0",
-    'requests',
-    'python-dotenv',
-    "webdriver-manager",
-    "defusedxml",
+    # 2.33.0 is the first release carrying the extract_zipped_paths fix
+    # (GHSA-gc5v-m9x4-r6x2).
+    "requests>=2.33.0",
+    "python-dotenv>=1.0.0",
+    # 4.x is the line this package is developed and tested against.
+    "webdriver-manager>=4.0.0",
+    "defusedxml>=0.7.1",
     # Floor set to the first release without the known Pillow advisories;
     # wheels cover cp310-cp315, so it excludes no supported interpreter.
     "Pillow>=12.3.0",

requirements.txt

@@ -1,5 +1,5 @@
 je_web_runner
-defusedxml
+defusedxml>=0.7.1
 Pillow>=12.3.0
 faker
 sqlalchemy