Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump djangorestframework from 3.14.0 to 3.15.1 #9979

Closed

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Apr 22, 2024

Bumps djangorestframework from 3.14.0 to 3.15.1.

Commits
  • 3285916 Version 3.15.1 (#9339)
  • eb361d2 SearchFilter.get_search_terms returns list. (#9338)
  • 400b4c5 Revert "Fix NamespaceVersioning ignoring DEFAULT_VERSION on non-None namespac...
  • 4ef3aaf Revert #9030 (#9333)
  • 4f10c4e Revert "Fix Respect can_read_model permission in DjangoModelPermissions (#8...
  • a4d5807 Revert "feat: Add some changes to ValidationError to support django style vad...
  • da78a14 Revert "Re-prefetch related objects after updating (#8043)" (#9327)
  • 0e4ed81 Revert "feat: Add some changes to ValidationError to support django style vad...
  • 56a5b35 Add drf-sendables to third-party-packages.md (#9261)
  • d7c8dcf Revert PR that adds autocomplete_fields to TokenAdmin, as this break some use...
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Apr 22, 2024
Copy link

dryrunsecurity bot commented Apr 22, 2024

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security Status Findings
Server-Side Request Forgery Analyzer 0 findings
IDOR Analyzer 0 findings
SQL Injection Analyzer 0 findings
Configured Codepaths Analyzer 0 findings
Sensitive Files Analyzer 1 finding
Authn/Authz Analyzer 0 findings
Secrets Analyzer 0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The provided code change in the requirements.txt file appears to be an update to the djangorestframework dependency from version 3.14.0 to version 3.15.1. From an application security perspective, this change is generally positive, as it indicates the project is keeping its dependencies up-to-date. Updating dependencies is an important security practice, as it helps address known vulnerabilities and security issues in the underlying libraries.

The djangorestframework library is a critical component of the DefectDojo application, as it provides the core functionality for the Django REST API. Keeping this library up-to-date is important to ensure the application's API is secure and compliant with the latest security standards. Additionally, the requirements.txt file itself is an important part of the application's security posture, as it ensures the development and deployment environments are using the same, known-good set of dependencies, preventing issues related to dependency drift.

Files Changed:

  • requirements.txt: The code change in this file updates the djangorestframework dependency from version 3.14.0 to version 3.15.1. This is a routine update to keep the application's dependencies up-to-date, which is a good security practice. However, it's always important to review the changelog or release notes for the new version of djangorestframework to ensure there are no breaking changes or new security considerations that need to be addressed.

Powered by DryRun Security

@dependabot dependabot bot force-pushed the dependabot/pip/dev/djangorestframework-3.15.1 branch 2 times, most recently from bcb286d to 2797def Compare April 23, 2024 01:16
@mtesauro mtesauro force-pushed the dependabot/pip/dev/djangorestframework-3.15.1 branch from 2797def to 0f27db3 Compare April 25, 2024 14:39
Copy link
Contributor

This pull request has conflicts, please resolve those before we can evaluate the pull request.

@github-actions github-actions bot added conflicts-detected docker New Migration Adding a new migration file. Take care when merging. settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR apiv2 docs unittests integration_tests ui parser helm localization labels Apr 25, 2024
@mtesauro mtesauro force-pushed the dependabot/pip/dev/djangorestframework-3.15.1 branch from b58e0bd to 0f27db3 Compare April 25, 2024 15:30
@mtesauro
Copy link
Contributor

@dependabot rebase

Copy link
Contributor Author

dependabot bot commented on behalf of github Apr 25, 2024

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@mtesauro
Copy link
Contributor

@dependabot recreate

@dependabot dependabot bot force-pushed the dependabot/pip/dev/djangorestframework-3.15.1 branch from 8c65273 to 8dbd012 Compare April 25, 2024 19:58
Copy link
Contributor

Conflicts have been resolved. A maintainer will review the pull request shortly.

@github-actions github-actions bot removed docker New Migration Adding a new migration file. Take care when merging. settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR apiv2 labels Apr 25, 2024
Copy link
Contributor

This pull request has conflicts, please resolve those before we can evaluate the pull request.

@mtesauro
Copy link
Contributor

@dependabot rebase

Dependabot couldn't find the original pull request head commit, 2797def.
@dependabot dependabot bot force-pushed the dependabot/pip/dev/djangorestframework-3.15.1 branch from 8dbd012 to 5f31ae2 Compare June 15, 2024 02:34
Copy link
Contributor

Conflicts have been resolved. A maintainer will review the pull request shortly.

Copy link
Contributor Author

dependabot bot commented on behalf of github Jun 19, 2024

Superseded by #10431.

@dependabot dependabot bot closed this Jun 19, 2024
@dependabot dependabot bot deleted the dependabot/pip/dev/djangorestframework-3.15.1 branch June 19, 2024 12:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant