search

openedx / wg-build-test-release

Open edX Build / Test / Release Working Group
25 stars 15 forks source link

django-debug-toolbar security update #52

Closed nedbat closed 3 years ago

nedbat commented 3 years ago

https://www.djangoproject.com/weblog/2021/apr/14/debug-toolbar-security-releases/

These requirements files from installed repos pin django-debug-toolbar. We have to decide which should be updated:

enterprise-catalog/requirements/dev.txt
credentials/requirements/test.txt
credentials/requirements/dev.txt
credentials/requirements/base.txt
credentials/requirements/production.txt
credentials/requirements/all.txt
course-discovery/requirements/local.txt
license-manager/requirements/dev.txt
edx-platform/requirements/edx/development.txt
edx-analytics-dashboard/requirements/local.txt
ecommerce/requirements/dev.txt
blockstore/requirements/local.txt
nedbat commented 3 years ago

In the lilac branch, I updated all the pins that were at 3.2 to 3.2.1. This is the diff:

---- ./edx-analytics-configuration ----
---- ./edx-documentation ----
---- ./configuration ----
---- ./enterprise-catalog ----
diff --git a/requirements/dev.txt b/requirements/dev.txt
index 6271e60..d97c874 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -135,7 +135,7 @@ django-crum==0.7.9
     #   edx-django-utils
     #   edx-rbac
     #   edx-toggles
-django-debug-toolbar==3.2
+django-debug-toolbar==3.2.1
     # via -r requirements/dev.in
 django-dynamic-fixture==3.1.1
     # via -r requirements/test.txt
---- ./blockstore ----
---- ./edx-analytics-data-api ----
---- ./ecommerce ----
diff --git a/requirements/dev.txt b/requirements/dev.txt
index 02c3bc50..24c16d38 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -42,7 +42,7 @@ django-config-models==2.1.0  # via -r requirements/test.txt
 django-cors-headers==3.6.0  # via -r requirements/test.txt
 django-crispy-forms==1.8.1  # via -r requirements/test.txt
 django-crum==0.7.9        # via -r requirements/test.txt, edx-django-utils, edx-rbac
-django-debug-toolbar==3.2  # via -r requirements/dev.in
+django-debug-toolbar==3.2.1  # via -r requirements/dev.in
 django-extensions==3.1.0  # via -r requirements/test.txt
 django-extra-views==0.11.0  # via -r requirements/test.txt, django-oscar
 django-filter==2.4.0      # via -r requirements/test.txt
---- ./frontend-app-publisher ----
---- ./edx-app-android ----
---- ./frontend-app-ecommerce ----
---- ./edx-analytics-dashboard ----
diff --git a/requirements/local.txt b/requirements/local.txt
index f4d31e28..9560ae66 100644
--- a/requirements/local.txt
+++ b/requirements/local.txt
@@ -27,7 +27,7 @@ django-braces==1.14.0     # via -r requirements/test.txt
 django-countries==7.0     # via -r requirements/test.txt
 django-crispy-forms==1.11.1  # via -r requirements/test.txt
 django-crum==0.7.9        # via -r requirements/test.txt, edx-django-utils, edx-toggles
-django-debug-toolbar==3.2  # via -r requirements/local.in
+django-debug-toolbar==3.2.1  # via -r requirements/local.in
 django-dynamic-fixture==3.1.1  # via -r requirements/test.txt
 django-lang-pref-middleware==1.0.0  # via -r requirements/test.txt
 django-model-utils==4.1.1  # via -r requirements/test.txt
---- ./frontend-app-support-tools ----
---- ./devstack ----
---- ./edx-app-ios ----
---- ./edx-demo-course ----
---- ./xqueue ----
---- ./frontend-app-payment ----
---- ./ecommerce-worker ----
---- ./tubular ----
---- ./edx-e2e-tests ----
---- ./frontend-app-learning ----
---- ./edx-certificates ----
---- ./edx-platform ----
diff --git a/requirements/edx/development.txt b/requirements/edx/development.txt
index e5127f9b18..4b11bc5009 100644
--- a/requirements/edx/development.txt
+++ b/requirements/edx/development.txt
@@ -68,7 +68,7 @@ django-cookies-samesite==0.9.0  # via -r requirements/edx/testing.txt
 django-cors-headers==2.5.3  # via -c requirements/edx/../constraints.txt, -r requirements/edx/testing.txt
 django-countries==5.5     # via -c requirements/edx/../constraints.txt, -r requirements/edx/testing.txt, edx-enterprise
 django-crum==0.7.9        # via -r requirements/edx/testing.txt, edx-django-utils, edx-enterprise, edx-proctoring, edx-rbac, edx-toggles, super-csv
-django-debug-toolbar==3.2  # via -r requirements/edx/development.in
+django-debug-toolbar==3.2.1  # via -r requirements/edx/development.in
 django-fernet-fields==0.6  # via -r requirements/edx/testing.txt, edx-enterprise, edx-event-routing-backends, edxval
 django-filter==2.4.0      # via -r requirements/edx/testing.txt, edx-enterprise, lti-consumer-xblock
 django-ipware==3.0.2      # via -r requirements/edx/testing.txt, edx-enterprise, edx-proctoring
---- ./edx-analytics-pipeline ----
---- ./repo-tools ----
---- ./edx-notes-api ----
---- ./frontend-app-profile ----
---- ./license-manager ----
diff --git a/requirements/dev.txt b/requirements/dev.txt
index de1ad9d..0251772 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -102,7 +102,7 @@ django-crum==0.7.9
     #   -r requirements/validation.txt
     #   edx-django-utils
     #   edx-rbac
-django-debug-toolbar==3.2
+django-debug-toolbar==3.2.1
     # via -r requirements/dev.in
 django-dynamic-fixture==3.1.1
     # via -r requirements/validation.txt
---- ./frontend-template-application ----
---- ./cs_comments_service ----
---- ./testeng-ci ----
---- ./course-discovery ----
diff --git a/requirements/local.txt b/requirements/local.txt
index c01a5b35..858c7bc2 100644
--- a/requirements/local.txt
+++ b/requirements/local.txt
@@ -106,7 +106,7 @@ django-cors-headers==2.5.3
     #   -r requirements/base.in
 django-crum==0.7.9
     # via edx-django-utils
-django-debug-toolbar==3.2
+django-debug-toolbar==3.2.1
     # via -r requirements/local.in
 django-dynamic-filenames==1.1.4
     # via -r requirements/base.in
---- ./frontend-app-gradebook ----
---- ./edx-developer-docs ----
---- ./credentials ----
diff --git a/requirements/all.txt b/requirements/all.txt
index d010dad8..5c74b58a 100644
--- a/requirements/all.txt
+++ b/requirements/all.txt
@@ -124,7 +124,7 @@ django-crum==0.7.9
     #   -r requirements/dev.txt
     #   -r requirements/production.txt
     #   edx-django-utils
-django-debug-toolbar==3.2
+django-debug-toolbar==3.2.1
     # via
     #   -r requirements/dev.txt
     #   -r requirements/production.txt
diff --git a/requirements/base.txt b/requirements/base.txt
index 6167084a..ff460a2f 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -35,7 +35,7 @@ django-appconf==1.0.4
     # via django-statici18n
 django-crum==0.7.9
     # via edx-django-utils
-django-debug-toolbar==3.2
+django-debug-toolbar==3.2.1
     # via -r requirements/base.in
 django-extensions==3.1.2
     # via -r requirements/base.in
diff --git a/requirements/dev.txt b/requirements/dev.txt
index ef25f526..14778913 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -97,7 +97,7 @@ django-crum==0.7.9
     # via
     #   -r requirements/test.txt
     #   edx-django-utils
-django-debug-toolbar==3.2
+django-debug-toolbar==3.2.1
     # via -r requirements/test.txt
 django-extensions==3.1.2
     # via -r requirements/test.txt
diff --git a/requirements/production.txt b/requirements/production.txt
index 198bee38..c1f88d9a 100644
--- a/requirements/production.txt
+++ b/requirements/production.txt
@@ -57,7 +57,7 @@ django-crum==0.7.9
     # via
     #   -r requirements/base.txt
     #   edx-django-utils
-django-debug-toolbar==3.2
+django-debug-toolbar==3.2.1
     # via -r requirements/base.txt
 django-extensions==3.1.2
     # via -r requirements/base.txt
diff --git a/requirements/test.txt b/requirements/test.txt
index 219cbd93..c6a1dfa0 100644
--- a/requirements/test.txt
+++ b/requirements/test.txt
@@ -82,7 +82,7 @@ django-crum==0.7.9
     # via
     #   -r requirements/base.txt
     #   edx-django-utils
-django-debug-toolbar==3.2
+django-debug-toolbar==3.2.1
     # via -r requirements/base.txt
 django-extensions==3.1.2
     # via -r requirements/base.txt
---- ./frontend-app-account ----