Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(security): upgrade django to >=5.1.4. #885

Merged
merged 1 commit into from
Jan 13, 2025
Merged

chore(security): upgrade django to >=5.1.4. #885

merged 1 commit into from
Jan 13, 2025

Conversation

n1k0
Copy link
Member

@n1k0 n1k0 commented Jan 8, 2025

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities.

https://github.com/MTES-MCT/ecobalyse/security/dependabot/53

@n1k0 n1k0 requested a review from vjousse January 8, 2025 16:33
vjousse
vjousse approved these changes Jan 13, 2025
View reviewed changes
Copy link
Collaborator

@vjousse vjousse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks 👍

@n1k0 n1k0 merged commit 5ddae0f into master Jan 13, 2025
6 checks passed
@n1k0 n1k0 deleted the fix/upgrade-django branch January 13, 2025 12:46
@github-actions github-actions bot mentioned this pull request Jan 13, 2025
Merged
vjousse pushed a commit that referenced this pull request Jan 13, 2025
@github-actions
chore(release): release v3.0.0 (#845)
c0c02a3 
## [3.0.0](https://github.com/MTES-MCT/ecobalyse/compare/v2.7.1..v3.0.0)
(2025-01-13)



### 🚀 Features

- Generalize density, electricity, heat and waste process fields
([#855](#855))
- *(data)* Ensure consistent nullable alias field in all processes
files. ([#862](#862))
- Add betagouv logo.
([#848](#848))
- *(data)* Unified, cross-domain processes file format.
([#866](#866))
- *(data)* Validate processes files against a JSON schema.
([#869](#869))
- *(data,textile)* Add trim process and components data.
([#824](#824))
- *(textile)* Implement trims.
([#873](#873))
- *(data,ui)* Add trims to more textile examples, render them in
explorer ([#876](#876))
- Allow expanding trim details.
([#877](#877))
- Allow staff to access detailed impacts from explorer.
([#878](#878))

### 🪲 Bug Fixes

- *(food)* [**breaking**] Food processes identifiers are now UUIDs
([#844](#844))
- *(data)* [**breaking**] Update textile process ids to use UUID format
([#858](#858))
- Data pipeline with new UUIDs
([#857](#857))
- Fix api error with old versions
([#851](#851))
- Broken homepage after upgrading highcharts
([#863](#863))
- *(dev)* Fix npm ci error with `transcrypt`
([#870](#870))
- Correct data on trims
([#879](#879))
- Warn on session data decoding error.
([#884](#884))
- *(textile)* Apply durability to trims impacts.
([#886](#886))
- Update PEF score label.
([#887](#887))

### 🚜 Refactor

- Move textile step_usage field to categories.
([#850](#850))
- *(data)* Move textile process "correctif" to comment
([#852](#852))
- Add encrypted detailed impacts files to the source code
([#840](#840))
- Abstract components.
([#872](#872))
- Order json keys
([#871](#871))

### 📚 Documentation

- Fix openapi food examples
([#867](#867))

### ⚙️ Miscellaneous Tasks

- Increase API test timeout
([#853](#853))
- *(data)* Remove system_description process field.
([#859](#859))
- Upgrade dependencies, December 2024.
([#860](#860))
- Remove obsolete/unused info textile process field.
([#861](#861))
- *(data)* Merge PastoEco in a single file to speedup imports and fixed
linking to AGB
([#833](#833))
- Fix score_history workflow for transcrypt
([#864](#864))
- Standardize number formatting across codebase
([#804](#804))
- Standardize tkm unit
([#868](#868))
- Remove obsolete pre-commit command.
([#874](#874))
- Update trim api parameter ordering.
([#875](#875))
- Remove data directory, now in `ecobalyse-data` repo
([#888](#888))
- Update crypto-related docs.
([#890](#890))
- *(security)* Upgrade django to >=5.1.4.
([#885](#885))
- Readd score_history
([#891](#891))

<!-- generated by git-cliff -->

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actions github-actions bot mentioned this pull request Jan 13, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vjousse vjousse vjousse approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@n1k0 @vjousse