WX-1192 Updated semver versions for flagged dependencies

[JVThomas]

Addresses WX-1192

PR updates the semver dependency in sass to 7.5.2 in order to patch out a CVE present in older versions.

There's also an additional backend update (unrelated to Sass) that was required due to a breaking sub-dependency update on PyYAML. A constraints file was added to constrain Cython's (the sub-dependency) version.

[THWiseman]

I think it would be good if we left some sort of comment, somewhere, explaining how we're messing with python and why (and maybe a link to that github issue). I can see something like this coming up again...

[THWiseman]

Will this constraint apply to every python package? I'm worried that it will end up causing more problems down the road as other packages begin to rely on new cython features. Is it possible to constrain just the problematic package?

[JVThomas]

Yeah it will, however we pin dependencies to their exact values. If a fixed dependency updates it's Cython sub-dependency from v2 to v3 and still uses the deprecated features of Cython v2 then it'll break as well.

Constraining the version won't change the functionality of the library, and new features on a library would be tied to a version update which JM won't see due to pinned versions.

[THWiseman]

That makes sense.

[THWiseman]

I believe it's good practice to include the constraints.txt inside a particular requirements.txt. I think it could make it a little easier down the road to figure out what is being constrained and why. This article seems helpful. Not a huge deal if there's some reason we can't do that.

[JVThomas]

I went with the above per tox documentation here, which outlines setting constraints as seen above.

Didn't know you could do the above (most Github posts have people adding the -c <file name> flag to pip install), but seeing how it conflicts with the documented usage in tox I've opted for this instead.

That said I do need to update any pip install references to include the constraints flag. I'll add a new commit that does it.

[THWiseman]

I'm in favor of doing what tox documentation does.

Good catch on the pip/docker stuff!

[THWiseman]

LGTM!

[jgainerdewar]

Happy to go with your preference here but can't miss this chance to stand up for the oxford comma.

[JVThomas]

Sorry, I'm going to ask for a re-review on my PR. While tox was able to handle the backend installation correctly, building the Docker image locally did not. Further investigation led me to this comment:

yaml/pyyaml#736 (comment)

Turns out that using the -c flag on pip install does not work properly if the package is installed through a wheel. In order to ensure that the constraints file is respected, the file itself must be assigned to thePIP_CONSTRAINT env variable alongside the individual install of PyYAML via pip install (PyYAML is also commented out of the requirements.txt file.

Once the above completes, the Dockerfile will install the rest of the packages via requirements.txt

Updated PR, requesting re-review