Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump django-debug-toolbar from 4.4.2 to 4.4.4 #10520

Merged
merged 1 commit into from
Jul 5, 2024
Merged

Bump django-debug-toolbar from 4.4.2 to 4.4.4 #10520

merged 1 commit into from
Jul 5, 2024

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 5, 2024

Bumps django-debug-toolbar from 4.4.2 to 4.4.4.

Release notes

Sourced from django-debug-toolbar's releases.

4.4.4

What's Changed

New Contributors

Full Changelog: django-commons/django-debug-toolbar@4.4.3...4.4.4

4.4.3

What's Changed

New Contributors

Full Changelog: django-commons/django-debug-toolbar@4.4.2...4.4.3

Changelog

Sourced from django-debug-toolbar's changelog.

4.4.4 (2024-07-05)

  • Added check for StreamingHttpResponse in alerts panel.
  • Instrument the Django Jinja2 template backend. This only instruments the immediate template that's rendered. It will not provide stats on any parent templates.

4.4.3 (2024-07-04)

  • Added alerts panel with warning when form is using file fields without proper encoding type.
  • Fixed overriding font-family for both light and dark themes.
  • Restored compatibility with iptools.IpRangeList.
  • Limit E001 check to likely error cases when the SHOW_TOOLBAR_CALLBACK has changed, but the toolbar's URL paths aren't installed.
  • Introduce helper function debug_toolbar_urls to simplify installation.
  • Moved "1rem" height/width for SVGs to CSS properties.
Commits
  • 57ada8e Version 4.4.4
  • 9834e7e Ignore check for jinja2's base.html template in integration test
  • 6614910 Fix jinja2 integration test.
  • 4fd886b Improve the jinja tests to better indicate the situation.
  • c8f6763 Instrument the Django Jinja2 template backend.
  • e59c8ca Clean-up change log.
  • afeee86 Check for for StreamingHttpResponse when generating stats in Alert (#1946)
  • c79f249 Version 4.4.3
  • eff9128 Remove rem units from svg (#1942)
  • d0f09b3 Fixed #1682 -- alert user when using file field without proper encoding (#1933)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump django-debug-toolbar from 4.4.2 to 4.4.4
fb6ac8b 
Bumps [django-debug-toolbar](https://github.com/jazzband/django-debug-toolbar) from 4.4.2 to 4.4.4.
- [Release notes](https://github.com/jazzband/django-debug-toolbar/releases)
- [Changelog](https://github.com/jazzband/django-debug-toolbar/blob/main/docs/changes.rst)
- [Commits](django-commons/django-debug-toolbar@4.4.2...4.4.4)

---
updated-dependencies:
- dependency-name: django-debug-toolbar
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jul 5, 2024
@dryrunsecurity DryRunSecurity
Copy link

dryrunsecurity bot commented Jul 5, 2024 •
edited
Loading

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security Status Findings
Server-Side Request Forgery Analyzer ✅ 0 findings
Configured Codepaths Analyzer ✅ 0 findings
IDOR Analyzer ✅ 0 findings
Sensitive Files Analyzer ❕ 1 finding
SQL Injection Analyzer ✅ 0 findings
Authn/Authz Analyzer ✅ 0 findings
Secrets Analyzer ✅ 0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The provided code change is an update to the requirements.txt file for the DefectDojo application, which is a web-based open-source vulnerability management tool. The key changes include a minor version update to the django-debug-toolbar library and the inclusion of several security-focused libraries and tools, such as django-ratelimit, argon2-cffi, blackduck, and vulners.

From an application security perspective, these changes are generally positive, as they indicate that the development team is taking steps to improve the security of the application. The use of the django-ratelimit library to protect against brute-force attacks, the argon2-cffi library for secure password hashing, and the blackduck and vulners libraries for managing and monitoring open-source dependencies and vulnerabilities are all good security practices. However, it's important to ensure that the django-debug-toolbar is removed or disabled in production environments, as it can expose sensitive information about the application and its internals.

Files Changed:

  • requirements.txt: The key changes in this file include:
    • The django-debug-toolbar version has been updated from 4.4.2 to 4.4.4, which is a minor version update likely to address bug fixes or security improvements.
    • The django-ratelimit library is being used, which is a good practice to protect the application from brute-force attacks and other types of abuse.
    • The argon2-cffi library is being used for password hashing, which is a secure and recommended hashing algorithm.
    • The blackduck library is being used, which is a tool for managing and monitoring open-source components and their associated vulnerabilities.
    • The vulners library is being used, which is a tool for checking for known vulnerabilities in the application's dependencies.

Powered by DryRun Security

@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented Jul 5, 2024

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

mtesauro
mtesauro approved these changes Jul 5, 2024
View reviewed changes
Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@mtesauro mtesauro merged commit fe620a9 into dev Jul 5, 2024
127 checks passed
@dependabot dependabot bot deleted the dependabot/pip/dev/django-debug-toolbar-4.4.4 branch July 5, 2024 16:15
mwager added a commit to mwager/django-DefectDojo that referenced this pull request Jul 15, 2024
@mwager
Merge branch 'dev' into kiuwan-sca
abf48f2 
* dev:
  Update dependency ruff from 0.5.0 to v0.5.1 (requirements-lint.txt) (DefectDojo#10521)
  Bump django-debug-toolbar from 4.4.2 to 4.4.4 (DefectDojo#10520)
  Bump boto3 from 1.34.138 to 1.34.139 (DefectDojo#10518)
  Bump psycopg[binary] from 3.1.19 to 3.2.1 (DefectDojo#10517)
  Bump packageurl-python from 0.15.1 to 0.15.2 (DefectDojo#10516)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mtesauro mtesauro mtesauro approved these changes

@cneill cneill cneill approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@cneill @mtesauro