[Snyk] Fix for 6 vulnerabilities

[DaleMcGrew]

Snyk has created this PR to fix 6 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• requirements.txt

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 SQL Injection
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Arbitrary Code Injection

[DaleMcGrew]

This upgrade contains major version increases for both django and sqlparse, introducing significant breaking changes and environmental requirements. The upgrade from Django 3.2 to 4.2 is a high-risk change due to multiple API removals, setting changes, and required updates to Python and database versions.

django@3.2.25 → django@4.2.28

This is a major upgrade across two Long-Term Support (LTS) versions with numerous breaking changes. Careful migration is required.

Key Breaking Changes:

• Python Version: Support for Python 3.6 and 3.7 was dropped in Django 4.0. The new minimum is Python 3.8.
• Database Version: Support for several older database versions has been dropped:
  • PostgreSQL 9.6 (in v4.0) and 10 (in v4.1).
  • MySQL 5.7 and MariaDB 10.3 (in v4.2).
• Timezone Handling: Django 4.0 transitions from pytz to Python's standard library zoneinfo for timezone implementation. Support for pytz is deprecated and will be removed in Django 5.0. This may require code audits, especially for projects working with non-UTC timezones.
• Removed Features: Functions and APIs deprecated in Django 3.x have been removed, including force_text(), ugettext(), and urlquote().
• Settings Changes:
  • DEFAULT_FILE_STORAGE and STATICFILES_STORAGE are deprecated in favor of the STORAGES setting in v4.2.
  • CSRF_TRUSTED_ORIGINS must now be configured for most applications using a proxy.

Recommendation: This upgrade requires a thorough review of the official Django upgrade guides for versions 4.0, 4.1, and 4.2. Pay close attention to environment compatibility (Python/DB), timezone handling code, and deprecated settings.

sqlparse@0.4.4 → sqlparse@0.6.0

This upgrade is rated medium risk due to the significant jump in Python version requirements.

• Python Version: Version 0.5.0 dropped support for Python 3.5-3.7. Version 0.6.0 goes further, dropping support for Python 3.8 and 3.9, making Python 3.10 or newer a requirement.
• Other Changes: The updates primarily consist of security fixes for Denial of Service (DoS) vulnerabilities and bug fixes. No major API breakages are noted for typical usage.

Source: Django 4.0 Release Notes, Django 4.1 Release Notes, Django 4.2 Release Notes, sqlparse Changelog

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.