From 4dc0d28e1b07980630a86d3a6f2591c9c148a604 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 20 Aug 2026 23:33:09 +0000 Subject: [PATCH] fix: requirements.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-DJANGORESTFRAMEWORK-18853986 - https://snyk.io/vuln/SNYK-PYTHON-SQLPARSE-18905009 - https://snyk.io/vuln/SNYK-PYTHON-SQLPARSE-18905413 - https://snyk.io/vuln/SNYK-PYTHON-SQLPARSE-18905471 - https://snyk.io/vuln/SNYK-PYTHON-SQLPARSE-18905644 --- requirements.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 9023aa5436..a405a3ec57 100644 --- a/requirements.txt +++ b/requirements.txt @@ -31,7 +31,7 @@ django-stubs>=4.2.7,<5 # The django-stubs version used determines the the myp django-tastypie>=0.15.1 # Version must be kept in sync with Django django-vite>=3.1.0 django-widget-tweaks>=1.4.12 -djangorestframework>=3.16.0 +djangorestframework>=3.17.2 docutils>=0.22.0 # Used only by dbtemplates for RestructuredText types-docutils>=0.21.0 # should match docutils (0.22.0 not out yet) drf-spectacular>=0.27 @@ -93,3 +93,4 @@ xml2rfc>=3.30.0 xym>=0.6,<0.10.0 zxcvbn>=4.5.0 types-zxcvbn~=4.5.0.20260518 # match zxcvbn version +sqlparse>=0.6.0 # not directly required, pinned by Snyk to avoid a vulnerability