diff mbox series

[layerindex-web] requirements.txt: fix GitPython and Django vulnerabilities

Message ID 20261017173608.79592-1-tim.orling@konsulko.com
State New
Headers show
Series [layerindex-web] requirements.txt: fix GitPython and Django vulnerabilities | expand

Commit Message

Tim Orling Oct. 17, 2026, 5:36 p.m. UTC 
GitPython 3.1.59 -> 3.1.62 resolves Dependabot alerts #60-63
(GHSA-239g-whfq-7xj9, GHSA-g5vv-9gxw-82hx, GHSA-whh4-5q6c-9v3x,
GHSA-59cr-6r3x-644w).

Raise the Django floor to 5.2.18 to avoid five issues affecting
>=5.2,<5.2.18 reported by safety. These were masked in 'safety scan'
by its default ignore-unpinned-requirements policy, since Django is
specified as a range.

Tested: full test suite passes (view tests on macOS/MariaDB,
tests/test_update.py in the Docker image on Ubuntu Jammy).

AI-Generated: Claude Opus 5.5
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
---
 requirements.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/requirements.txt b/requirements.txt
index e0be38a..4bfcd7f 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -10,7 +10,7 @@  click-plugins==1.1.1.2
 click-repl==0.3.0
 confusable-homoglyphs==3.3.1
 diff-match-patch==20241021
-Django>=5.2.17,<5.3
+Django>=5.2.18,<5.3
 django-appconf==1.2.0
 django-axes==8.3.1
 django-cors-headers==4.9.0
@@ -22,7 +22,7 @@  django-reversion-compare==0.17.0
 django-simple-captcha==0.7.0
 djangorestframework==3.18.0
 gitdb==4.0.12
-GitPython==3.1.59
+GitPython==3.1.62
 kombu==5.6.2
 mysqlclient==2.2.8
 packaging_legacy==23.0.post0