-
Notifications
You must be signed in to change notification settings - Fork 10
[Snyk] Fix for 3 vulnerabilities #1238
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||
|---|---|---|---|---|---|---|---|---|
|
|
@@ -40,4 +40,6 @@ tornado>=6.3.3 # not directly required, pinned by Snyk to avoid a vulnerability | |||||||
|
|
||||||||
| django-test-migrations==1.3.0 | ||||||||
|
|
||||||||
| django-silk==5.3.2 | ||||||||
| django-silk==5.3.2 | ||||||||
| django>=4.2.27 # not directly required, pinned by Snyk to avoid a vulnerability | ||||||||
|
||||||||
| django>=4.2.27 # not directly required, pinned by Snyk to avoid a vulnerability |
Copilot
AI
Dec 7, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
While sqlparse is a transitive dependency of Django and django-debug-toolbar, pinning it with >= instead of == could lead to unexpected version updates that may introduce breaking changes or incompatibilities.
Following the pattern used elsewhere in this file (e.g., tornado>=6.3.3 on line 39) and in requirements/base.txt (e.g., certifi>=2025.10.5), the >= operator is acceptable for security pins. However, note that sqlparse is included with Django, so if Django is already at 5.2.7 in base.txt, it likely already includes a safe version of sqlparse. Verify this is necessary to avoid redundant pinning.
| django>=4.2.27 # not directly required, pinned by Snyk to avoid a vulnerability | |
| sqlparse>=0.5.4 # not directly required, pinned by Snyk to avoid a vulnerability | |
| django>=4.2.27 # not directly required, pinned by Snyk to avoid a vulnerability |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This line is a duplicate of line 15. The dependency
django-test-migrations==1.3.0is already declared earlier in the file and should not be repeated.