From 96b5ea2e1c3172cf3b5625a5249856d6794f44d4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 6 Jul 2022 08:35:50 +0100 Subject: [PATCH 1/3] Bump django from 3.2.13 to 3.2.14 (#67) Bumps [django](https://github.com/django/django) from 3.2.13 to 3.2.14. - [Release notes](https://github.com/django/django/releases) - [Commits](https://github.com/django/django/compare/3.2.13...3.2.14) --- updated-dependencies: - dependency-name: django dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- poetry.lock | 8 ++++---- pyproject.toml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/poetry.lock b/poetry.lock index 5b4aa87..e69605a 100644 --- a/poetry.lock +++ b/poetry.lock @@ -114,7 +114,7 @@ python-versions = "*" [[package]] name = "django" -version = "3.2.13" +version = "3.2.14" description = "A high-level Python Web framework that encourages rapid development and clean, pragmatic design." category = "main" optional = false @@ -596,7 +596,7 @@ dev = ["pytest (>=4.6.2)", "black (>=19.3b0)"] [metadata] lock-version = "1.1" python-versions = "^3.8" -content-hash = "9b50232d4bb98c159b663c0b22cc505e8eaa903eaa555a8255bb931cc9550288" +content-hash = "ec34a47da48fe7188986f94a9eac21803effdcffc2bb339c0fbbd7b50b8c01bb" [metadata.files] asgiref = [ @@ -747,8 +747,8 @@ dj-database-url = [ {file = "dj_database_url-0.5.0-py2.py3-none-any.whl", hash = "sha256:851785365761ebe4994a921b433062309eb882fedd318e1b0fcecc607ed02da9"}, ] django = [ - {file = "Django-3.2.13-py3-none-any.whl", hash = "sha256:b896ca61edc079eb6bbaa15cf6071eb69d6aac08cce5211583cfb41515644fdf"}, - {file = "Django-3.2.13.tar.gz", hash = "sha256:6d93497a0a9bf6ba0e0b1a29cccdc40efbfc76297255b1309b3a884a688ec4b6"}, + {file = "Django-3.2.14-py3-none-any.whl", hash = "sha256:a8681e098fa60f7c33a4b628d6fcd3fe983a0939ff1301ecacac21d0b38bad56"}, + {file = "Django-3.2.14.tar.gz", hash = "sha256:677182ba8b5b285a4e072f3ac17ceee6aff1b5ce77fd173cc5b6a2d3dc022fcf"}, ] django-appconf = [ {file = "django-appconf-1.0.5.tar.gz", hash = "sha256:be3db0be6c81fa84742000b89a81c016d70ae66a7ccb620cdef592b1f1a6aaa4"}, diff --git a/pyproject.toml b/pyproject.toml index beead3b..2a5cb9d 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -10,7 +10,7 @@ license = "Creative Commons Attribution-ShareAlike 4.0 International License" [tool.poetry.dependencies] python = "^3.8" -Django = "^3.2.13" +Django = "^3.2.14" gunicorn = "^20.0.4" django-recaptcha2 = "^1.4.1" dj-database-url = "^0.5.0" From e09e0116abf8323eb2866bf2f188cf59f8b8c09e Mon Sep 17 00:00:00 2001 From: Ajurna Date: Wed, 6 Jul 2022 08:36:09 +0100 Subject: [PATCH 2/3] fix: requirements.txt to reduce vulnerabilities (#66) The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-2940618 Co-authored-by: snyk-bot --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index db54c71..e4f02e7 100644 --- a/requirements.txt +++ b/requirements.txt @@ -94,7 +94,7 @@ django-silk==4.3.0; python_version >= "3.7" \ django-sri==0.3.0; python_version >= "3.6" \ --hash=sha256:961e316c0663d2b277a60f677bae3bed451a26f045129eddf09827f98fe00b86 \ --hash=sha256:9fa50b4b41b4cc3e8072d1bc4a60a81e38fd95698aed115d2f56f3d7e83a6877 -django==3.2.13; python_version >= "3.6" \ +django==3.2.14; python_version >= "3.6" \ --hash=sha256:b896ca61edc079eb6bbaa15cf6071eb69d6aac08cce5211583cfb41515644fdf \ --hash=sha256:6d93497a0a9bf6ba0e0b1a29cccdc40efbfc76297255b1309b3a884a688ec4b6 gprof2dot==2021.2.21; python_version >= "3.7" \ From da4383be9f4611b8e8a66b30f81286f23bc6c585 Mon Sep 17 00:00:00 2001 From: Ajurna Date: Wed, 6 Jul 2022 08:36:29 +0100 Subject: [PATCH 3/3] fix: upgrade datatables.net-bs4 from 1.12.0 to 1.12.1 (#65) Snyk has created this PR to upgrade datatables.net-bs4 from 1.12.0 to 1.12.1. See this package in npm: https://www.npmjs.com/package/datatables.net-bs4 See this project in Snyk: https://app.snyk.io/org/ajurna/project/127292ba-f6a3-4db6-aa37-06b046e6c7a2?utm_source=github&utm_medium=referral&page=upgrade-pr Co-authored-by: snyk-bot --- package-lock.json | 16 ++++++++-------- package.json | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/package-lock.json b/package-lock.json index 93ab42b..ad274b5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,5 +1,5 @@ { - "name": "npm-proj-1654233148844-0.41497152300056084OKJ9EN", + "name": "npm-proj-1654843414984-0.467543510728424722Y64H", "lockfileVersion": 2, "requires": true, "packages": { @@ -7,7 +7,7 @@ "dependencies": { "@fortawesome/fontawesome-free": "^5.15.3", "bootstrap": "^4.6.0", - "datatables.net-bs4": "^1.12.0", + "datatables.net-bs4": "^1.12.1", "hammerjs": "^2.0.8", "isotope-layout": "^3.0.6", "jquery": "^3.6.0", @@ -48,9 +48,9 @@ } }, "node_modules/datatables.net-bs4": { - "version": "1.12.0", - "resolved": "https://registry.npmjs.org/datatables.net-bs4/-/datatables.net-bs4-1.12.0.tgz", - "integrity": "sha512-ttssh9EtzP2eHeli0Ws/BgT9rUC6BKJO2KbdehTREVC+BmaNtQnBG1lA2YG/BGgT3zkxZzhJZxEchyy30/Si8w==", + "version": "1.12.1", + "resolved": "https://registry.npmjs.org/datatables.net-bs4/-/datatables.net-bs4-1.12.1.tgz", + "integrity": "sha512-LBeC8zUNVYyQT7ytC2lYqyXDn+k2kYpqvijC83oOjlcnEtb/8Tduzgquox5FrNKUJPcUrj9r+h5B0TDBbob/Gg==", "dependencies": { "datatables.net": ">=1.11.3", "jquery": ">=1.7" @@ -198,9 +198,9 @@ } }, "datatables.net-bs4": { - "version": "1.12.0", - "resolved": "https://registry.npmjs.org/datatables.net-bs4/-/datatables.net-bs4-1.12.0.tgz", - "integrity": "sha512-ttssh9EtzP2eHeli0Ws/BgT9rUC6BKJO2KbdehTREVC+BmaNtQnBG1lA2YG/BGgT3zkxZzhJZxEchyy30/Si8w==", + "version": "1.12.1", + "resolved": "https://registry.npmjs.org/datatables.net-bs4/-/datatables.net-bs4-1.12.1.tgz", + "integrity": "sha512-LBeC8zUNVYyQT7ytC2lYqyXDn+k2kYpqvijC83oOjlcnEtb/8Tduzgquox5FrNKUJPcUrj9r+h5B0TDBbob/Gg==", "requires": { "datatables.net": ">=1.11.3", "jquery": ">=1.7" diff --git a/package.json b/package.json index de5e6e2..962b428 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "dependencies": { "@fortawesome/fontawesome-free": "^5.15.3", "bootstrap": "^4.6.0", - "datatables.net-bs4": "^1.12.0", + "datatables.net-bs4": "^1.12.1", "hammerjs": "^2.0.8", "isotope-layout": "^3.0.6", "jquery": "^3.6.0",