Skip to content

chore(deps): bump remaining packages with known advisories - #945

Open
valvesss wants to merge 2 commits into
attendee-labs:mainfrom
cold-code-labs:chore/deps-security-medium
Open

chore(deps): bump remaining packages with known advisories#945
valvesss wants to merge 2 commits into
attendee-labs:mainfrom
cold-code-labs:chore/deps-security-medium

Conversation

@valvesss

@valvesss valvesss commented Aug 7, 2026

Copy link
Copy Markdown

Summary

Package From To
django-allauth 65.1.0 65.19.0
requests 2.32.3 2.34.2
sqlparse 0.5.1 0.5.5
sentry-sdk ≥2.0.0 ==2.66.1
click 8.1.7 8.4.2
idna 3.10 3.18
setuptools 78.1.1 83.0.0
python-dotenv 1.0.1 1.2.2

Django left for PR #937.

Test plan

Local (Mimir): Postgres 15.3 + Redis 7.

  • Fresh venv pip install -r requirements.txt — OK (django-allauth==65.19.0, etc.; Django still 5.1.14)
  • Follow-up commit: invite flow adapted — send_email_confirmation removed in allauth ≥65.13; now EmailAddress + send_verification_email_to_address
  • bots.tests.test_invite_user_integration7/7 OK after that fix
  • manage.py check OK (3 allauth settings deprecation warnings only — pre-existing style, not failures)

Still for CI/maintainer: full Docker matrix; spot-check allauth login UI if enabled.


Contribution from Cold Code Labs · authored via Brokk · co-authors in commit trailers.

Raise django-allauth, requests, sqlparse, sentry-sdk, click, idna,
setuptools, and python-dotenv to current advisory-safe versions.
All stay within existing major lines (sentry pinned to latest 2.x).

Co-authored-by: Vitor Alves <vitoralvesinfo@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
@valvesss
valvesss requested a review from a team as a code owner August 7, 2026 15:28
send_email_confirmation was removed from allauth.account.utils;
use EmailAddress + send_verification_email_to_address so the
deps bump remains importable and invitation mail still sends.

Co-authored-by: Vitor Alves <vitoralvesinfo@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
@valvesss

valvesss commented Aug 7, 2026

Copy link
Copy Markdown
Author

Test follow-up (Mimir): bumping django-allauth to 65.19.0 alone broke imports — allauth.account.utils.send_email_confirmation was removed in ≥65.13.

Pushed a second commit that switches the invite path to EmailAddress + send_verification_email_to_address. bots.tests.test_invite_user_integration is 7/7 OK against Postgres 15.3 + Redis 7 locally.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants