Summary by CodeRabbit

• Chores
  • Updated framework dependencies for improved stability.

Walkthrough

djangorestframework is downgraded from 3.15.2 to 3.14.0 in two places: the main dependencies list in backend/pyproject.toml and the test-rig dependency group in the root pyproject.toml.

Changes

djangorestframework version downgrade

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["PR #2087: Dependabot batch bump\n(DRF 3.14.0 → 3.15.2)"] --> B["DRF 3.15 auto-generates\nUniqueTogetherValidator\nfrom model UniqueConstraint"]
    B --> C["organization FK marked\nrequired=True by serializer\n(DefaultOrganizationMixin)"]
    C --> D["Clients never send 'organization'\n→ 400 validation_error on\nadapter/connector/workflow creates"]
    D --> E["146 staging failures on rc.342"]
    E --> F["This PR: Revert DRF → 3.14.0\n(backend/pyproject.toml + pyproject.toml\n+ both uv.lock files)"]
    F --> G["Staging unblocked\n(restores 3.14 semantics)"]
    H["Follow-up PR\n(separate)"] --> I["Override get_unique_together_validators()\nin AuditSerializer + IntegrityErrorMixin\nto drop org-scoped auto-validators"]
    I --> J["Safe re-upgrade to DRF 3.15.2"]

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["PR #2087: Dependabot batch bump\n(DRF 3.14.0 → 3.15.2)"] --> B["DRF 3.15 auto-generates\nUniqueTogetherValidator\nfrom model UniqueConstraint"]
    B --> C["organization FK marked\nrequired=True by serializer\n(DefaultOrganizationMixin)"]
    C --> D["Clients never send 'organization'\n→ 400 validation_error on\nadapter/connector/workflow creates"]
    D --> E["146 staging failures on rc.342"]
    E --> F["This PR: Revert DRF → 3.14.0\n(backend/pyproject.toml + pyproject.toml\n+ both uv.lock files)"]
    F --> G["Staging unblocked\n(restores 3.14 semantics)"]
    H["Follow-up PR\n(separate)"] --> I["Override get_unique_together_validators()\nin AuditSerializer + IntegrityErrorMixin\nto drop org-scoped auto-validators"]
    I --> J["Safe re-upgrade to DRF 3.15.2"]

_{Reviews (1): Last reviewed commit: "[FIX] Revert djangorestframework 3.15.2 ..." | Re-trigger Greptile}

Unstract test results

Per-group results

Critical paths

⚠️ Critical paths not yet covered

• auth-login — User can log in and obtain a session cookie. (entry: POST /api/v1/auth/login; declared coverage: no groups declared)
• adapter-register-llm — Register and validate an LLM adapter. (entry: POST /api/v1/adapter/; declared coverage: no groups declared)
• workflow-create-execute — Create a workflow, configure source+destination, execute, poll, fetch result. (entry: POST /api/v1/workflow/{id}/execute/; declared coverage: e2e-workflow)
• api-deployment-run — Deploy a workflow as an API, POST a document, receive structured JSON. (entry: POST /deployment/api/{org}/{name}/; declared coverage: e2e-api-deployment)
• prompt-studio-fetch-response — Prompt Studio: create project, add prompt, run single-pass, get response. (entry: POST /api/v1/prompt-studio/prompt-studio-tool/{id}/fetch_response/; declared coverage: e2e-prompt-studio)
• pipeline-etl-execute — Run an ETL pipeline from source connector to destination. (entry: POST /api/v1/pipeline/{id}/execute/; declared coverage: no groups declared)
• usage-token-tracking — Per-execution token usage is recorded and retrievable. (entry: GET /api/v1/usage/get_token_usage/; declared coverage: no groups declared)
• workflow-execution-fan-out — Multi-file workflow execution fans out to file-processing workers and rejoins. (entry: internal: backend → rabbitmq → workers/file_processing; declared coverage: no groups declared)
• callback-result-delivery — Async results are posted back via the callback worker. (entry: internal: workers/callback → backend /internal endpoints; declared coverage: no groups declared)

Superseded — reintroduces CVE-2024-21520 (DRF<3.15.2 XSS). Going with a roll-forward model-level fix on 3.15.2 instead.

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud