jazzband / django-payments

Universal payment handling for Django.
https://django-payments.readthedocs.io
Other
1.07k stars 282 forks source link

Upgrade min dependency versions #428

Open deeprave opened 3 hours ago

deeprave commented 3 hours ago

The configured requires-python and the Django version dependency are currently outdated and needlessly prevent working with contemporary versions of dependencies

The Django dependency and the requires-python version should be updated to 4.1 and 3.10 respectively.

Installing contemporary Django and Python versions is impossible with the current dependency versions due to the minimum version requirements.

Other dependencies, such as urllib3, sqlparse, and requests, also need to be updated for a different reason: recent CVEs have been reported on all three.

$ uv add "Django>=5.1"
  × No solution found when resolving dependencies:
  ╰─▶ Because the requested Python version (>=3.7) does not satisfy Python>=3.10 and django>=5.1 depends on Python>=3.10, we can conclude that django>=5.1 cannot be used.
      And because only the following versions of django are available:
          django<=5.1
          django==5.1.1
          django==5.1.2
          django==5.1.3
      we can conclude that django>=5.1 cannot be used.
      And because your project depends on django>=5.1 and your project requires django-payments[stripe], we can conclude that your projects's requirements are unsatisfiable.

      hint: The `requires-python` value (>=3.7) includes Python versions that are not supported by your dependencies (e.g., django>=5.1 only supports >=3.10). Consider using a more restrictive `requires-python` value (like >=3.10).
  help: If you want to add the package regardless of the failed resolution, provide the `--frozen` flag to skip locking and syncing.
deeprave commented 3 hours ago

https://security.snyk.io/vuln?search=py3-requests https://security.snyk.io/vuln?search=py3-sqlparse https://security.snyk.io/vuln?search=py3-urllib3