updated pip pkg: requests, Jinja2, tqdm, Werkzeug

[smuzaffar]

As nonted by dependabot, this update fixes following isses

• Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
• Requests Session object does not verify requests after making first request with verify=False
• Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
• tqdm CLI arguments injection attack

[smuzaffar]

please test

[cmsbuild]

A new Pull Request was created by @smuzaffar for branch IB/CMSSW_14_1_X/master.

@smuzaffar, @aandvalenzuela, @iarspider can you please review it and eventually sign? Thanks.
@antoniovilela, @rappoccio, @sextonkennedy you are the release manager for this.
cms-bot commands are listed here

[cmsbuild]

cms-bot internal usage

[cmsbuild]

+1

Summary: https://cmssdt.cern.ch/SDT/jenkins-artifacts/pull-request-integration/PR-6643eb/39439/summary.html
COMMIT: 98f692f
CMSSW: CMSSW_14_1_X_2024-05-20-2300/el8_amd64_gcc12
User test area: For local testing, you can use /cvmfs/cms-ci.cern.ch/week0/cms-sw/cmsdist/9196/39439/install.sh to create a dev area with all the needed externals and cmssw changes.

Comparison Summary

Summary:

• You potentially added 14 lines to the logs
• Reco comparison results: 17 differences found in the comparisons
• DQMHistoTests: Total files compared: 48
• DQMHistoTests: Total histograms compared: 3338862
• DQMHistoTests: Total failures: 878
• DQMHistoTests: Total nulls: 0
• DQMHistoTests: Total successes: 3337964
• DQMHistoTests: Total skipped: 20
• DQMHistoTests: Total Missing objects: 0
• DQMHistoSizes: Histogram memory added: 0.0 KiB( 47 files compared)
• Checked 202 log files, 165 edm output root files, 48 DQM output files
• TriggerResults: no differences found

[smuzaffar]

+externals

[cmsbuild]

This pull request is fully signed and it will be integrated in one of the next IB/CMSSW_14_1_X/master IBs (tests are also fine). This pull request will now be reviewed by the release team before it's merged. @rappoccio, @antoniovilela, @sextonkennedy (and backports should be raised in the release meeting by the corresponding L2)