search

opensafely-core / opencodelists

OpenCodelists is an open platform for creating and sharing codelists of clinical terms and drugs.
https://www.opencodelists.org
Other
31 stars 11 forks source link

Address security alerts for Opencodelists by upgrading dependencies #1817

Open lucyb opened 10 months ago

lucyb commented 10 months ago

From Steve: There are several outstanding dependency upgrades that have not been merged, so there are currently 18 active security alerts in this project.

2107 Covers upgrading Django and should be done first. It may also require updating some Django dependencies.

1852 Covers upgrading Python, but I don't think addresses any security vulnerabilities.

Acceptance criteria:

Given the number of dependencies to update, it might be worth updating them in batches rather than in one go.

iaindillingham commented 7 months ago

https://github.com/opensafely-core/opencodelists/security/dependabot/82 is blocked until we upgrade django and django-debug-toolbar.

StevenMaude commented 5 months ago

If testing/upgrading to Django 5 is a little bit tricky, it might be easier to upgrade to the latest Django 4.2 (we're already on a 4.2 version).

It's a long term support release and still gets security updates, although Dependabot wants to upgrade us to Django 5.

lucyb commented 2 weeks ago

Upgrading whitenoise may be particularly useful and may not be picked up as required by Dependabot.