Merge pull request #80 from uktrade/security/update-django-2210-cve-2…

…020-7471

CVE-2020-5236 & CVE-2020-7471 fixes

CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## Hotfix
+- No ticket - CVE-2020-5236 & CVE-2020-7471: Potential SQL injection via StringAgg(delimiter)
+
 ## Pre-release
 
 ## [2019.11.25](https://github.com/uktrade/invest-pir-api/releases/tag/2019.11.25)

requirements.in

@@ -1,7 +1,7 @@
 boto3
 botocore==1.8.24
 dj-database-url==0.4.2
-django==1.11.23
+django==1.11.28
 django-amazon-ses==2.0.0
 django-clear-cache==0.3
 django-crispy-forms==1.7.1
@@ -11,7 +11,7 @@ django-storages==1.6.5
 django-modeltranslation==0.12.2
 dj-database-url==0.4.2
 gunicorn==19.7.1
-waitress==1.4.2
+waitress==1.4.3
 psycopg2==2.7.3.2
 pytz==2017.2
 raven==6.5.0

requirements.txt

@@ -42,7 +42,7 @@ django-redis==4.8.0
 django-storages==1.6.5
 django-taggit==0.22.2
 django-treebeard==4.2.0
-django==1.11.23
+django==1.11.28
 django_recaptcha==1.2.0
 djangorestframework==3.9.1
 docopt==0.6.2             # via notifications-python-client
@@ -80,7 +80,7 @@ sorl-thumbnail==12.4.1
 tinycss2==0.6.1           # via cairosvg, cssselect2
 urllib3==1.24.3
 vine==1.1.4               # via amqp
-waitress==1.4.2
+waitress==1.4.3
 webencodings==0.5.1       # via html5lib, tinycss2
 whitenoise==3.3.1
 zenpy==1.1.10

requirements_test.txt

@@ -48,7 +48,7 @@ django-redis==4.8.0
 django-storages==1.6.5
 django-taggit==0.22.2
 django-treebeard==4.2.0
-django==1.11.23
+django==1.11.28
 django_recaptcha==1.2.0
 djangorestframework==3.9.1
 docker-pycreds==0.3.0     # via docker
@@ -107,7 +107,7 @@ termcolor==1.1.0          # via pytest-sugar
 tinycss2==0.6.1           # via cairosvg, cssselect2
 urllib3==1.24.3
 vine==1.1.4               # via amqp
-waitress==1.4.2
+waitress==1.4.3
 webencodings==0.5.1       # via html5lib, tinycss2
 websocket-client==0.48.0  # via docker
 werkzeug==0.14.1          # via moto