Skip to content

[Snyk] Security upgrade django from 3.2.25 to 4.2.28 #1272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
robertatakenaka wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Security upgrade django from 3.2.25 to 4.2.28 #1272

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion requirements/production.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,4 +41,5 @@ elastic-apm==6.21.4.post8347027212 # https://pypi.org/project/elastic-apm/
# SECURITY UPDATES
# ==============================================================================

setuptools>=68.2.2 # not directly required, pinned by Snyk to avoid a vulnerability
setuptools>=68.2.2 # not directly required, pinned by Snyk to avoid a vulnerability
django>=4.2.28 # not directly required, pinned by Snyk to avoid a vulnerability
Comment on lines +44 to +45
Copy link

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change conflicts with the existing Django version pinned in requirements/base.txt. The base.txt file specifies django==5.2.7 (line 19), but this PR adds django>=4.2.28 to production.txt. Since production.txt includes base.txt via "-r base.txt", Django 5.2.7 is already installed, making this additional constraint unnecessary and potentially confusing.

The comment "not directly required" is also misleading because Django is directly required in base.txt. If the intent is to ensure Django is at least version 4.2.28 for security reasons, that requirement is already satisfied by the existing django==5.2.7 constraint. This line should be removed.

Suggested change
setuptools>=68.2.2 # not directly required, pinned by Snyk to avoid a vulnerability
django>=4.2.28 # not directly required, pinned by Snyk to avoid a vulnerability
setuptools>=68.2.2 # not directly required, pinned by Snyk to avoid a vulnerability

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description mentions upgrading from Django 3.2.25 to 4.2.28, but the codebase currently has django==5.2.7 specified in requirements/base.txt (line 19). This discrepancy suggests the PR description may be outdated or incorrect. Django 5.2.7 was released after my knowledge cutoff (January 2025), so I cannot verify its validity, but if it's a legitimate version, it already satisfies any security requirements for Django >= 4.2.28. Please verify that the current Django version (5.2.7) addresses the security vulnerability SNYK-PYTHON-DJANGO-15183335 mentioned in the PR description.

Copilot uses AI. Check for mistakes.
Loading