[FIX] Bump Django 4.2.1 -> 4.2.30 (LTS) to clear SQLi/DoS Dependabot alerts#2040
[FIX] Bump Django 4.2.1 -> 4.2.30 (LTS) to clear SQLi/DoS Dependabot alerts#2040
Conversation
…alerts Django was hard-pinned at 4.2.1 in backend/pyproject.toml and the root hook-check-django-migrations group. Bumps to the latest 4.2.x LTS patch, which clears the critical SQL-injection alert (_connector kwarg) plus the high-severity ASGI header spoofing, DATA_UPLOAD bypass, column-alias SQLi, path traversal and several DoS advisories. - pyproject.toml / backend/pyproject.toml: django==4.2.1 -> ==4.2.30 - uv.lock, backend/uv.lock: re-locked (django-only diff, no transitive churn) Verified: both locks pass 'uv lock --check'; pinned Django ecosystem (django-tenants 3.5.0, DRF 3.14.0, django-celery-beat 2.5.0) still resolves. Runtime/test verification deferred to CI (local backend sync is blocked by an unrelated django-celery-beat 2.5.0 wheel packaging quirk).
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (2)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughDjango version is updated from 4.2.1 to 4.2.30 across two configuration files: the backend project dependencies and the development hook-check-django-migrations dependency group. Both changes coordinate a single upstream version bump. ChangesDjango dependency updates
🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
| Filename | Overview |
|---|---|
| backend/pyproject.toml | Django pin updated from 4.2.1 to 4.2.30; all surrounding pins unchanged. |
| pyproject.toml | Django pin in hook-check-django-migrations group updated from 4.2.1 to 4.2.30; no other changes. |
| backend/uv.lock | Lock file re-generated with correct Django 4.2.30 sdist/wheel hashes; no transitive dependency churn. |
| uv.lock | Root lock file re-generated with correct Django 4.2.30 sdist/wheel hashes; no transitive dependency churn. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[backend/pyproject.toml\ndjango==4.2.1 → 4.2.30] --> C[uv lock --upgrade-package django]
B[pyproject.toml\nhook-check-django-migrations\ndjango==4.2.1 → 4.2.30] --> D[uv lock --upgrade-package django]
C --> E[backend/uv.lock\nNew sdist + wheel hashes]
D --> F[uv.lock\nNew sdist + wheel hashes]
E --> G{uv lock --check ✓}
F --> G
G --> H[Dependabot alerts cleared\nSQLi / DoS CVEs in 4.2.1–4.2.29]
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
A[backend/pyproject.toml\ndjango==4.2.1 → 4.2.30] --> C[uv lock --upgrade-package django]
B[pyproject.toml\nhook-check-django-migrations\ndjango==4.2.1 → 4.2.30] --> D[uv lock --upgrade-package django]
C --> E[backend/uv.lock\nNew sdist + wheel hashes]
D --> F[uv.lock\nNew sdist + wheel hashes]
E --> G{uv lock --check ✓}
F --> G
G --> H[Dependabot alerts cleared\nSQLi / DoS CVEs in 4.2.1–4.2.29]
Reviews (2): Last reviewed commit: "Merge branch 'main' into fix/dependabot-..." | Re-trigger Greptile
jaseemjaskp
left a comment
There was a problem hiding this comment.
PR Review Toolkit — automated pass.
This PR is a dependency-only change (Django 4.2.1 → 4.2.30 across two pyproject.toml pins + two re-locked uv.lock files). It carries no application code, types, comments, or test changes, so the code-focused toolkit agents (Type Design, Silent Failure Hunter, Comment Analyzer, Code Simplifier, PR Test Analyzer) have no surface to review. I instead ran dependency-bump-specific checks:
✅ Pin consistency — both Django pins in the monorepo (backend/pyproject.toml:21, root pyproject.toml:47) and both lock files (uv.lock, backend/uv.lock) are updated to 4.2.30. No stray django==4.2.1 remains anywhere in the repo.
✅ Lock integrity / no transitive churn — each lock diff is exactly 4 lines (the django package block + its requires-dist specifier); asgiref/sqlparse/tzdata are untouched, confirming the "django-only diff" claim.
✅ LTS-line patch upgrade — stays within 4.2.x, so Django's intra-series backward-compat policy applies; security remediation rationale is sound.
One forward-looking compatibility note left inline. (The Django-4.2-EOL concern is already covered by the existing @greptile-apps P1 comment — not re-raised here.)
|
Unstract test resultsPer-group results
Critical paths
|
What
Bumps Django 4.2.1 → 4.2.30 (latest 4.2.x LTS patch). Django was hard-pinned at
4.2.1, so this needs apyproject.tomlchange (not just a lock bump) in two places:backend/pyproject.toml:django==4.2.1→django==4.2.30pyproject.toml(hook-check-django-migrationsgroup):django==4.2.1→django==4.2.30backend/uv.lock,uv.lock: re-lockedWhy
Django 4.2.1 carries a long list of open Dependabot alerts. Moving to the latest 4.2 LTS patch clears them in one step:
_connectorkwarg inQuerySet/QDATA_UPLOAD_MAX_MEMORY_SIZEbypass, column-alias SQL injection,HasKeyOracle SQLi, path traversal, plus several DoS advisories (Truncator, intcomma, EmailValidator/URLValidator ReDoS, etc.)How
==4.2.30, thenuv lock --upgrade-package djangoforbackend/and the root workspace.Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)
Low risk, but this one touches the whole backend so it deserves a full CI/test run before merge.
django-tenants3.5.0,djangorestframework3.14.0,django-celery-beat2.5.0,asgiref3.11.1,sqlparse0.5.5.uv lock --check.Database Migrations
None introduced by this change. (Django's own migrations are unchanged within 4.2.x.)
Env Config
None.
Relevant Docs
Django 4.2 release notes / security releases
Related Issues or PRs
Part of the Dependabot remediation series — follows #2038 (frontend) and #2039 (Python transitive). Authlib + PyMySQL pinned bumps will be a separate PR.
Dependencies Versions
Django 4.2.1 → 4.2.30
Notes on Testing
uv lock --checkonbackend/and root ✓Screenshots
N/A — dependency bump.
Checklist
I have read and understood the Contribution Guidelines.