Bump lxml to 4.6.5 and pin to 4.7.1

This is a fix for a security issue CVE-2021-43818

Signed-off-by: Philippe Ombredanne <pombredanne@nexb.com>

Author: pombredanne

requirements.txt

@@ -33,7 +33,7 @@ javaproperties==0.8.0
 Jinja2==3.0.1
 jsonstreams==0.6.0
 license-expression==21.6.14
-lxml==4.6.3
+lxml==4.7.1
 MarkupSafe==2.0.1
 more-itertools==8.8.0
 normality==2.2.2

setup-mini.cfg

@@ -77,7 +77,7 @@ install_requires =
     jinja2 >= 2.7.0
     jsonstreams >= 0.5.0
     license_expression >= 21.6.14
-    lxml >= 4.6.3
+    lxml >= 4.6.5
     MarkupSafe >= 1.0
     packageurl_python >= 0.9.0
     packaging > 20

setup.cfg

@@ -77,7 +77,7 @@ install_requires =
     jinja2 >= 2.7.0
     jsonstreams >= 0.5.0
     license_expression >= 21.6.14
-    lxml >= 4.6.3
+    lxml >= 4.6.5
     MarkupSafe >= 1.0
     packageurl_python >= 0.9.0
     packaging > 20