Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion requirements/local.txt
Original file line number Diff line number Diff line change
Expand Up @@ -40,4 +40,6 @@ tornado>=6.3.3 # not directly required, pinned by Snyk to avoid a vulnerability

django-test-migrations==1.3.0
Copy link

Copilot AI Dec 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This line is a duplicate of line 15. The dependency django-test-migrations==1.3.0 is already declared earlier in the file and should not be repeated.

Suggested change
django-test-migrations==1.3.0

Copilot uses AI. Check for mistakes.

django-silk==5.3.2
django-silk==5.3.2
django>=4.2.27 # not directly required, pinned by Snyk to avoid a vulnerability
Copy link

Copilot AI Dec 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This Django version constraint conflicts with the existing pinned version in requirements/base.txt (line 19: django==5.2.7). Since local.txt includes base.txt via -r base.txt, adding django>=4.2.27 here will create a conflict during installation. Django is already pinned at 5.2.7 in base.txt, which is higher than the 4.2.27 minimum specified here.

If the intent is to fix vulnerabilities in Django, the fix should be applied to requirements/base.txt instead, as that's where Django is directly managed for this project. The current approach will either be ignored (if base.txt takes precedence) or cause installation issues.

Suggested change
django>=4.2.27 # not directly required, pinned by Snyk to avoid a vulnerability

Copilot uses AI. Check for mistakes.
sqlparse>=0.5.4 # not directly required, pinned by Snyk to avoid a vulnerability
Comment on lines +44 to +45
Copy link

Copilot AI Dec 7, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While sqlparse is a transitive dependency of Django and django-debug-toolbar, pinning it with >= instead of == could lead to unexpected version updates that may introduce breaking changes or incompatibilities.

Following the pattern used elsewhere in this file (e.g., tornado>=6.3.3 on line 39) and in requirements/base.txt (e.g., certifi>=2025.10.5), the >= operator is acceptable for security pins. However, note that sqlparse is included with Django, so if Django is already at 5.2.7 in base.txt, it likely already includes a safe version of sqlparse. Verify this is necessary to avoid redundant pinning.

Suggested change
django>=4.2.27 # not directly required, pinned by Snyk to avoid a vulnerability
sqlparse>=0.5.4 # not directly required, pinned by Snyk to avoid a vulnerability
django>=4.2.27 # not directly required, pinned by Snyk to avoid a vulnerability

Copilot uses AI. Check for mistakes.
Loading