Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Update Django version to resolve critical vulnerability #1248

Open
exalate-issue-sync bot opened this issue Dec 9, 2024 · 3 comments
Open

[Snyk] Update Django version to resolve critical vulnerability #1248

exalate-issue-sync bot opened this issue Dec 9, 2024 · 3 comments

Comments

@exalate-issue-sync
Copy link

exalate-issue-sync bot commented Dec 9, 2024

This week’s snyk review has shown two vulnerabilities in our API, one critical and one high (see screenshot below). The solution for both issues is to upgrade Django to at least v5.1.4, which is the latest version of Django at time of writing.

image-20241209-201613.png

QA Notes

API changes with zero user-facing effects. Should have passing unit tests as normal.

DEV Notes

The dev should update Django to 5.1.4 along with any other packages that require updating alongside any django version upgrade.

Design

null

See full ticket and images here: FECFILE-1885

Pull Request: #1260

Copy link
Author

Todd Lees commented: Passes cr moving to qa

Copy link
Author

Todd Lees commented: [https://app.circleci.com/pipelines/github/fecgov/fecfile-web-api/4786/workflows/309cb85a-ef78-48b0-8d84-b1c3103f6c22/jobs/13512|https://app.circleci.com/pipelines/github/fecgov/fecfile-web-api/4786/workflows/309cb85a-ef78-48b0-8d84-b1c3103f6c22/jobs/13512]

!image-20241220-142753.png|width=1048,height=581,alt="image-20241220-142753.png"!

Copy link
Author

Shelly Wise commented: QA review verified unit test pass per DEV.

!image-20241227-143350.png|width=1488,height=688,alt="image-20241227-143350.png"!

QA Review Completed. Moved to Stage Ready.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant