[Snyk] Security upgrade django from 1.2 to 4.2.27#42
Conversation
The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-14157807 - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-14157810
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # GAE packages should match the "libraries" section of app.yaml | ||
| django==1.2 | ||
| django==4.2.27 |
There was a problem hiding this comment.
Upgrade to Django 4.2 incompatible with App Engine config
requirements.txt now pins django==4.2.27, but the app is configured to run on the legacy App Engine Python runtime (app.yaml api_version 1) and explicitly requests Django 1.2 via use_library('django', '1.2') in appengine_config.py:11-16. Django 4.2 requires Python 3.8+ and cannot be loaded through the App Engine bundled libraries, so installing the new requirement under the existing Python 2 stack will fail, and even if installed the runtime will still attempt to load 1.2, causing version skew and import errors. This change will break deployments/dev installs unless the runtime and codebase are migrated to Django 4.x first.
Useful? React with 👍 / 👎.
Snyk has created this PR to fix 2 vulnerabilities in the pip dependencies of this project.
Snyk changed the following file(s):
requirements.txtImportant
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 SQL Injection