Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

In the mysql/mariadb templates, set MYSQL_UNIX_PORT to a hardcoded short path #2523

Open
wants to merge 20 commits into
base: main
Choose a base branch
from
Open

In the mysql/mariadb templates, set MYSQL_UNIX_PORT to a hardcoded short path #2523

wants to merge 20 commits into from

Conversation

jefft
Copy link

@jefft jefft commented Feb 17, 2025

..rather than plugin's project-relative path, to avoid triggering 'The socket file path is too long (> 107)' error on start. Also specify the (blank) password in 'test_db_setup'. Fixes #2521

How was it tested?

Per the description in #2521, after this change mysqld should come up in a >107 length path, e.g.:

cd ~/src/github.com/jetify-com/devbox/examples/databases/mysql
devbox services up -b
tail -1 .devbox/compose.log  # This shows the socket path, which should now be /tmp/devbox/mariadb/run/mysql.sock
devbox run mysql -u root -p   # Blank password - connects

Note: I have patched mysql and mariadb because they are essentially the same. However whereas mysql respects the MYSQL_UNIX_PORT env variable, mysql from the mariadb package does not (logged as #2522), so the last step of this code fails:

cd ~/src/github.com/jetify-com/devbox/examples/databases/mariadb
devbox services up -b
tail -1 .devbox/compose.log  # This shows the socket path, which should now be /tmp/devbox/mariadb/run/mysql.sock
devbox run mysql -u root -p   # ERROR 2002 (HY000): Can't connect to local server through socket '/run/mysqld/mysqld.sock' (2)

Aside from testing, this mariadb bug is irrelevant to this patch. I just thought I'd mention it.

jefft added 3 commits February 18, 2025 02:03
@jefft
In the mysql/mariadb templates, set MYSQL_UNIX_PORT to a hardcoded short
06ac64d 
path rather than plugin's project-relative path, to avoid triggering
'The socket file path is too long (> 107)' error on start. Also specify
the (blank) password in 'test_db_setup'. Fixes jetify-com#2521
@jefft
Update READMEs to reflect that MYSQL_UNIX_PORT does not need to be ad…
2576ef3 
…ded, but can be tweaked.
@jefft
Update README to specify --password with MySQL, consistent with
b4b1758 
devbox.json. Also for mariadb, specify --socket to work around jetify-com#2522.
@Lagoja Lagoja self-requested a review March 7, 2025 22:25
artemklevtsov and others added 17 commits March 9, 2025 11:19
@artemklevtsov @jefft
Optimize Docker Image Size by Cleaning Nix Store (jetify-com#2486)
92a3265 
## Summary

This MR modifies the Dockerfile to reduce the final image size by
optimizing the Nix store after installing packages. Added `nix-store
--gc` and `nix-store --optimise` commands to clean up and optimize the
Nix store after package installation.

## How was it tested?

Built the Docker image locally and verified the image size reduction.
Confirmed that the application runs as expected after the changes.
@gcurtis @jefft
all: upgrade to Go 1.24 (jetify-com#2533)
5fda898 
Upgrade to Go 1.24 and use `go get -tool` to manage golangci-lint and
gofumpt instead of runx. They're installed to `dist/tools` (which is
also prepended to PATH) when a devbox shell starts.

Added `git` and `fd` to `devbox.json` since we have scripts that rely on
them.

Other misc. changes fix the warnings from the latest version of
golangci-lint.
@loreto @jefft
Migrate devbox to go.jetify.com (jetify-com#2536)
946944c 
## Summary
Migrate devbox to go.jetify.com

## How was it tested?
go test
@loreto @jefft
Upgrade dependencies for devbox (jetify-com#2538)
2157990 
## Summary
Upgrade dependencies for devbox. In particular, handled the package name
change for alessio, and now that archiver is deprecated in favor of
archives, switched to it. In fact, archiver is causing a failure in
axiom (via devbox).

## How was it tested?
devbox run build
@mikeland73 @jefft
[cicd] fix release action (jetify-com#2540)
189ebfe 
## Summary

This action is flaky, this is one of the reasons it fails. 

## How was it tested?
@mikeland73 @jefft
[run] Add --all-projects flag (jetify-com#2543)
7d1f2ac 
## Summary

Allows running a script on all devbox projects nested in a directory.
Useful for monorepos. Example:

`devbox run --all-projects lint`

Doing 

`devbox run --all-projects` without a script name shows all available
scripts among all nested projects.

@savil I kinda regret changing `run` to remove the need for `--`. It
means that this flag only works for defined scripts, not for arbitrary
commands :(

## How was it tested?

`devbox run --all-projects fmt`
@mikeland73 @Lagoja @jefft
[easy][cicd] Fix testscripts (jetify-com#2545)
f4c593d 
## Summary

## How was it tested?

---------

Co-authored-by: John Lago <[email protected]>
@loreto @jefft
Clarify license and terms for contributions, reformat markdown (jetif…
c6a6859 
…y-com#2546)

## Summary
Tweaks several of our files to more clearly explain under what terms we
accept contributions.
Reformat markdown files to fit under an 80 character width.

## How was it tested?
N/A

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Documentation**
- Introduced a new section detailing the licensing terms for community
contributions under the Apache 2 License.
- Updated contribution guidelines by replacing outdated certification
details with the new licensing information.
- Improved overall readability and formatting across community
guidelines, the code of conduct, and other support documents for a
clearer, more streamlined experience.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@dependabot @jefft
Bump rack from 2.2.10 to 2.2.12 in /examples/stacks/rails/blog (jetif…
231ce31 
…y-com#2547)

Bumps [rack](https://github.com/rack/rack) from 2.2.10 to 2.2.12.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rack/rack/blob/main/CHANGELOG.md">rack's
changelog</a>.</em></p>
<blockquote>
<h2>[2.2.12] - 2025-03-04</h2>
<h3>Security</h3>
<ul>
<li><a
href="https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v">CVE-2025-27111</a>
Possible Log Injection in <code>Rack::Sendfile</code>.</li>
</ul>
<h2>[2.2.11] - 2025-02-12</h2>
<h3>Security</h3>
<ul>
<li><a
href="https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg">CVE-2025-25184</a>
Possible Log Injection in <code>Rack::CommonLogger</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rack/rack/commit/78296637d7b35dcd357a64e8c76bd7f664c1cdbf"><code>7829663</code></a>
Bump patch verison.</li>
<li><a
href="https://github.com/rack/rack/commit/fadf97e6448fb2fccc48b75ebcef7db55028b303"><code>fadf97e</code></a>
Fix development workflow.</li>
<li><a
href="https://github.com/rack/rack/commit/b13bc6bfc7506aca3478dc5ac1c2ec6fc53f82a3"><code>b13bc6b</code></a>
Use <code>#inspect</code> to prevent log injection.</li>
<li><a
href="https://github.com/rack/rack/commit/f393916baf057bd613290b505150b7ae5da1b9c4"><code>f393916</code></a>
Fix version number in release notes.</li>
<li><a
href="https://github.com/rack/rack/commit/aa5a0f532aac7a57e4bc7e857eca1c38229f7b30"><code>aa5a0f5</code></a>
Bump patch version.</li>
<li><a
href="https://github.com/rack/rack/commit/f8b41c1dba33ec96b886e57505c149c36d56662b"><code>f8b41c1</code></a>
Escape non-printable characters when logging.</li>
<li>See full diff in <a
href="https://github.com/rack/rack/compare/v2.2.10...v2.2.12">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=rack&package-manager=bundler&previous-version=2.2.10&new-version=2.2.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/jetify-com/devbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @jefft
Bump drupal/core-recommended from 10.2.3 to 10.2.11 in /examples/stac…
3271681 
…ks/drupal (jetify-com#2514)

Bumps
[drupal/core-recommended](https://github.com/drupal/core-recommended)
from 10.2.3 to 10.2.11.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/drupal/core-recommended/commit/44e8501698d2c28b5d68a2195f8b0d94855b3e80"><code>44e8501</code></a>
Drupal 10.2.11</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/92d4eda171aba18bd1d6b2a3837f16d3f3e3e95b"><code>92d4eda</code></a>
Drupal 10.2.10</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/4629116a19425c5c16a9ad01e03f9bc86c360400"><code>4629116</code></a>
Drupal 10.2.9</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/599de3076ea07593759285aff78c260ce96cf52d"><code>599de30</code></a>
Back to dev.</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/9880260a404d28578cb23dcc104fc5d37dc9dc6f"><code>9880260</code></a>
Drupal 10.2.8</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/ab7078ff2c996f1d6173aaabfefe7c5603e9b79f"><code>ab7078f</code></a>
Issue <a
href="https://redirect.github.com/drupal/core-recommended/issues/3473195">#3473195</a>
by longwave, catch, jurgenhaas, naveenvalecha, quietone: twig/...</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/da18902fed42b46e7edf3b624ee6e9a79fa99e5b"><code>da18902</code></a>
Back to dev.</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/afaac96cde3b05179d11152ed646f9f6772e7a0e"><code>afaac96</code></a>
Drupal 10.2.7</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/6099fa60358b0534ff52f95ac3370b0650b4fa82"><code>6099fa6</code></a>
Back to dev.</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/6fbff9a26e06c047ec4a2313fc423a7a1c51c850"><code>6fbff9a</code></a>
Drupal 10.2.6</li>
<li>Additional commits viewable in <a
href="https://github.com/drupal/core-recommended/compare/10.2.3...10.2.11">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=drupal/core-recommended&package-manager=composer&previous-version=10.2.3&new-version=10.2.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/jetify-com/devbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @jefft
Bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4 (jetify-com#2541)
34ad93e 
Bumps
[github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from
3.0.3 to 3.0.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-jose/go-jose/releases">github.com/go-jose/go-jose/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.0.4</h2>
<h2>What's Changed</h2>
<p>Backport fix for GHSA-c6gw-w398-hv78 CVE-2025-27144
<a
href="https://redirect.github.com/go-jose/go-jose/pull/174">go-jose/go-jose#174</a></p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-jose/go-jose/compare/v3.0.3...v3.0.4">https://github.com/go-jose/go-jose/compare/v3.0.3...v3.0.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-jose/go-jose/commit/5253038e3b5f64a2200b5b6c72107bf9823f4358"><code>5253038</code></a>
Backport fix 167 to v3 (<a
href="https://redirect.github.com/go-jose/go-jose/issues/174">#174</a>)</li>
<li><a
href="https://github.com/go-jose/go-jose/commit/047dc99758ca176080217a26d0f8a95a3350e7fb"><code>047dc99</code></a>
CI: Update github actions and go version (<a
href="https://redirect.github.com/go-jose/go-jose/issues/173">#173</a>)</li>
<li><a
href="https://github.com/go-jose/go-jose/commit/0f017e9bc3fd4ee0ca9171c131d6eb3d196ab05b"><code>0f017e9</code></a>
Revert <a
href="https://redirect.github.com/go-jose/go-jose/issues/26">#26</a>
(ignore unsupported JWKs in Sets) (<a
href="https://redirect.github.com/go-jose/go-jose/issues/131">#131</a>)</li>
<li><a
href="https://github.com/go-jose/go-jose/commit/3e2bbef724ae666f9e6691659bd46bc0c3e0c7aa"><code>3e2bbef</code></a>
Unmarshal jwk keys with unsupported key type or algorithm into empty …
(<a
href="https://redirect.github.com/go-jose/go-jose/issues/26">#26</a>)</li>
<li>See full diff in <a
href="https://github.com/go-jose/go-jose/compare/v3.0.3...v3.0.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-jose/go-jose/v3&package-manager=go_modules&previous-version=3.0.3&new-version=3.0.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/jetify-com/devbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @jefft
Bump django from 4.2.17 to 4.2.18 in /examples/stacks/django (jetify-…
86085ed 
…com#2513)

Bumps [django](https://github.com/django/django) from 4.2.17 to 4.2.18.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/django/django/commit/a7b0e50eadba8f0420013605c70eb790280b0fd2"><code>a7b0e50</code></a>
[4.2.x] Bumped version for 4.2.18 release.</li>
<li><a
href="https://github.com/django/django/commit/ad866a1ca3e7d60da888d25d27e46a8adb2ed36e"><code>ad866a1</code></a>
[4.2.x] Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6
validation.</li>
<li><a
href="https://github.com/django/django/commit/b0d309c9eb802cbc652595e2d413bb451e37f124"><code>b0d309c</code></a>
[4.2.x] Added stub release notes and release date for 4.2.18.</li>
<li><a
href="https://github.com/django/django/commit/39cf3c63f3228a04f101f3e62c75a6aae7c6ef0f"><code>39cf3c6</code></a>
[4.2.x] Cleaned up CVE-2024-53907 and CVE-2024-53908 security archive
descrip...</li>
<li><a
href="https://github.com/django/django/commit/0ff19d12e7d240d871975432ce429616012aa35e"><code>0ff19d1</code></a>
[4.2.x] Added CVE-2024-53907 and CVE-2024-53908 to security
archive.</li>
<li><a
href="https://github.com/django/django/commit/6c4fc7d6202b70ca20d21a62808e38b36bc50854"><code>6c4fc7d</code></a>
[4.2.x] Post-release version bump.</li>
<li>See full diff in <a
href="https://github.com/django/django/compare/4.2.17...4.2.18">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=django&package-manager=pip&previous-version=4.2.17&new-version=4.2.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/jetify-com/devbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@mikeland73 @jefft
[flake] fix vendor hash (jetify-com#2548)
f3771ab 
## Summary

## How was it tested?

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Chores**
- Updated the value used to verify the integrity of external
dependencies. This update ensures that underlying resources are based on
the most recent information, contributing to improved system security
and consistency. The changes do not affect any user-facing functionality
and are part of routine maintenance to guarantee updated assets.
Overall, this improvement bolsters system reliability.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@mikeland73 @jefft
[deps] Fix a few more dependabot issues (jetify-com#2552)
f1e3875 
## Summary

## How was it tested?

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Chores**
- Updated several third-party dependency versions to enhance overall
stability, performance, and security.
	- Updated the vendor hash to reflect changes in dependencies.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@burritobill @jefft
Disable PreRunE check for Nix when passing no-install flag on update …
6025ca8 
…cmd (jetify-com#2554)
@mikeland73 @jefft
[deps] Bump docs deps (jetify-com#2551)
bc905b6 
## Summary

## How was it tested?

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Chores**
- Upgraded several underlying libraries to their latest versions,
enhancing overall stability, performance, and compatibility.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@dependabot @jefft
Bump django from 4.2.18 to 4.2.20 in /examples/stacks/django (jetify-…
7ad3de8 
…com#2553)

Bumps [django](https://github.com/django/django) from 4.2.18 to 4.2.20.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/django/django/commit/35c58a7924aa07e87e925f6eea978c278f143f36"><code>35c58a7</code></a>
[4.2.x] Bumped version for 4.2.20 release.</li>
<li><a
href="https://github.com/django/django/commit/e88f7376fe68dbf4ebaf11fad1513ce700b45860"><code>e88f737</code></a>
[4.2.x] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap
template ...</li>
<li><a
href="https://github.com/django/django/commit/348e46a3e0cd80718d237a3b6d96a1c84bff317d"><code>348e46a</code></a>
[4.2.x] Added stub release notes and release date for 4.2.20.</li>
<li><a
href="https://github.com/django/django/commit/73e210755a90728fd7ff6f9a441c23521288a697"><code>73e2107</code></a>
[4.2.x] Post-release version bump.</li>
<li><a
href="https://github.com/django/django/commit/db89d2fee7906eaadfeea59506156e9578d32412"><code>db89d2f</code></a>
[4.2.x] Bumped version for 4.2.19 release.</li>
<li><a
href="https://github.com/django/django/commit/83231cca9c26fbfe4835fb7c3e53a61ca1c4e7e3"><code>83231cc</code></a>
[4.2.x] Added release date for 4.2.19.</li>
<li><a
href="https://github.com/django/django/commit/7bd1ddf1d81e9120c28322ee2a0b9c11941a6af2"><code>7bd1ddf</code></a>
[4.2.x] Refs <a
href="https://redirect.github.com/django/django/issues/34060">#34060</a>
-- Adjusted CVE-2024-53908 regression test for psycopg2.</li>
<li><a
href="https://github.com/django/django/commit/57b0229421ad64fea6ba50a8628e6aedce017152"><code>57b0229</code></a>
[4.2.x] Refs <a
href="https://redirect.github.com/django/django/issues/36098">#36098</a>
-- Fixed validate_ipv4_address() crash for non-string val...</li>
<li><a
href="https://github.com/django/django/commit/043dfadbcebc752d5ab2e9ff08c7e48044d20dc2"><code>043dfad</code></a>
[4.2.x] Fixed <a
href="https://redirect.github.com/django/django/issues/36098">#36098</a>
-- Fixed validate_ipv6_address()/validate_ipv46_address(...</li>
<li><a
href="https://github.com/django/django/commit/8769b44fdabc960dc23d1222430470809fd751b1"><code>8769b44</code></a>
[4.2.x] Added CVE-2024-56374 to security archive.</li>
<li>Additional commits viewable in <a
href="https://github.com/django/django/compare/4.2.18...4.2.20">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=django&package-manager=pip&previous-version=4.2.18&new-version=4.2.20)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/jetify-com/devbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Lagoja Lagoja Awaiting requested review from Lagoja

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

mysql/mariadb template does not work out the box - incorrect socket path
6 participants
@jefft @artemklevtsov @gcurtis @loreto @mikeland73 @burritobill