[fix] The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

requirements.txt

@@ -1,7 +1,7 @@
 APScheduler==3.2.0
 werkzeug==0.11.15
 Flask==0.12
-requests==2.12.4
+requests==2.20.0
 lxml==3.7.2
 
 pymongo