Subject: Upgrade some pgweb python dependencies

From: Paul A Jungwirth <[email-masked]>
Date: Wed, 11 Feb 2026 14:39:50 -0800

I submitted a patch to pgarchive recently, which led me to setting up
pgweb, based on the instructions in docs/dev_install.rst.[0]

Using debian 13 and python 3.9, I ran into several errors running `pip
install -r requirements.txt`. The versions pinned there look quite
old. The latest allowed version of pycryptodomex even seems to use
python2 syntax, so I don't understand how it works for anyone else.
Here are some patches with the upgrades I needed to get things
installed and running. (The pycryptodomex failure didn't appear until
I ran `./manage.py migrate`.) The psycopg2 upgrade is very modest, but
the other two are more aggressive. Probably more of the dependencies
are due for upgrading as well, but they do work.

[0] https://www.postgresql.org/message-id/CA%2BrenyWA77wVu2Zis3%3DtdBWAj-Xbz7cKuZbMbo6%3Do5cMR7wZVQ%40mail.gmail.com

Yours,

-- 
Paul              ~{:-)
[email-masked]
From 37cf2dbbd6b41c9935b488a997f86219a8604bbd Mon Sep 17 00:00:00 2001
From: "Paul A. Jungwirth" <[email-masked]>
Date: Wed, 11 Feb 2026 14:14:24 -0800
Subject: [PATCH v1 3/3] Allow pycryptodomex up to 3.23.0

Our `requirements.txt` file pins pycryptodomex to very old versions:

    pycryptodomex>=3.4.7,<3.5

3.4.12 was released in 2018. Running `./manage.py migrate` fails with a
syntax error, because it's using the old Python 2 comma syntax for an
`except` clause. I don't recall Python 3 ever supporting that syntax, so
I'm not sure how this `requirements.txt` file ever worked before.
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 6faba9be..e17a7877 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,6 @@
 Django>=4.2,<4.3
 psycopg2==2.8.6
-pycryptodomex>=3.4.7,<3.5
+pycryptodomex>=3.4.7,<=3.23.0
 Markdown==3.0.1
 requests-oauthlib==1.0.0
 cvss==2.2
-- 
2.47.3

From 9519cebe69f7482e4a87fcfa9f05406bb660fe39 Mon Sep 17 00:00:00 2001
From: "Paul A. Jungwirth" <[email-masked]>
Date: Wed, 11 Feb 2026 13:59:26 -0800
Subject: [PATCH v1 2/3] Upgrade PyYAML to 6.0.3

Previously we were using 3.13, released in 2018. This no longer builds
on Debian 13 (using python3.9).
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 64461086..6faba9be 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -9,6 +9,6 @@ pycodestyle==2.4.0
 pynliner==0.8.0
 Babel==2.6.0
 bleach==3.1.4
-PyYAML==3.13
+PyYAML==6.0.3
 zstandard==0.23.0
 rpmfile==2.1.0
-- 
2.47.3

From 93308911f0d437a54ffe15f11bf2c3b02af02705 Mon Sep 17 00:00:00 2001
From: "Paul A. Jungwirth" <[email-masked]>
Date: Wed, 11 Feb 2026 13:52:08 -0800
Subject: [PATCH v1 1/3] Upgrade psycopg2 to 2.8.6

This fixes an error installing it on Debian 13 (and elsewhere) described
[in this Github issue](https://github.com/psycopg/psycopg2/issues/1397).
They fixed it in [this
pull request](https://github.com/psycopg/psycopg2/pull/1399).
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 840037ee..64461086 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,5 @@
 Django>=4.2,<4.3
-psycopg2==2.8.5
+psycopg2==2.8.6
 pycryptodomex>=3.4.7,<3.5
 Markdown==3.0.1
 requests-oauthlib==1.0.0
-- 
2.47.3

---

From: Magnus Hagander <[email-masked]>
Date: Thu, 12 Feb 2026 13:02:46 +0100

> python2 syntax, so I don't understand how it works for anyone else.

These requirements files are, ahem, badly maintained. I assume nobody
really uses them :/

FWIW, since you're on debian, the easiest is to just use the debian
packaged versions of basically everything. Our production is on debian
bookworm and testing is on debian trixie, so either of those should work.
The only thing you need to install from pip at this point is Django itself
and cvss (if you want the security pages).

Doesn't mean the requirements.txt shouldn't be better maintained, so we
should look at that, but as a quick-fix for your current situation and to
make sure you're running something that matches what's actually used in
production.

//Magnus