Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use the nix path for mysql/mariadb 'basedir'. Fixes #2524 #2525

Open
wants to merge 18 commits into
base: main
Choose a base branch
from

Conversation

jefft
Copy link

@jefft jefft commented Feb 17, 2025

Summary

As described on #2524, mysqld are using the local /usr for basedir (e.g. reading /usr/lib/mysql/plugins if present), when it should be using the nix equivalent.

How was it tested?

Warning: this is untested. I don't know how to recompile flake.nix, so I cheated and edited the mysqld wrapper with sudo vim $(which mysqld). This patch may be wrong, e.g. I'm not sure if $out will be expanded in those single-quotes.

But if the patch does what I hope, this is the effect it should have:

cd /tmp
devbox create mysqltest --template mysql
devbox run mysqld --verbose --help | grep ^basedir

With this patch, the command above should print something like:

basedir                                                      /nix/store/15pzxq00jcraacaxancf3zm6h444azpm-mysql-wrapped/

previously it would print:

basedir                                                      /usr/

Also, one can fully launch mysqld, connect with mysql and show the basedir with:

mysql> SHOW VARIABLES LIKE '%dir';
+-----------------------------+---------------------------------------------------------------------------------+
| Variable_name               | Value                                                                           |
+-----------------------------+---------------------------------------------------------------------------------+
| basedir                     | /nix/store/15pzxq00jcraacaxancf3zm6h444azpm-mysql-wrapped/                      |
| character_sets_dir          | /nix/store/15pzxq00jcraacaxancf3zm6h444azpm-mysql-wrapped/share/mysql/charsets/ |
| datadir                     | /tmp/mysqltest/.devbox/virtenv/mysql80/data/                                    |
| innodb_data_home_dir        |                                                                                 |
| innodb_doublewrite_dir      |                                                                                 |
| innodb_log_group_home_dir   | ./                                                                              |
| innodb_temp_tablespaces_dir | ./#innodb_temp/                                                                 |
| innodb_tmpdir               |                                                                                 |
| lc_messages_dir             | /nix/store/15pzxq00jcraacaxancf3zm6h444azpm-mysql-wrapped/share/mysql/          |
| plugin_dir                  | /nix/store/15pzxq00jcraacaxancf3zm6h444azpm-mysql-wrapped/lib/mysql/plugin/     |
| replica_load_tmpdir         | /tmp                                                                            |
| slave_load_tmpdir           | /tmp                                                                            |
| tmpdir                      | /tmp                                                                            |
+-----------------------------+---------------------------------------------------------------------------------+
13 rows in set (0.00 sec)

The basedir and related paths are now correctly pointing to /nix/store paths, and everything still works!

@Lagoja Lagoja self-requested a review March 7, 2025 22:25
artemklevtsov and others added 17 commits March 9, 2025 11:18
## Summary

This MR modifies the Dockerfile to reduce the final image size by
optimizing the Nix store after installing packages. Added `nix-store
--gc` and `nix-store --optimise` commands to clean up and optimize the
Nix store after package installation.

## How was it tested?

Built the Docker image locally and verified the image size reduction.
Confirmed that the application runs as expected after the changes.
Upgrade to Go 1.24 and use `go get -tool` to manage golangci-lint and
gofumpt instead of runx. They're installed to `dist/tools` (which is
also prepended to PATH) when a devbox shell starts.

Added `git` and `fd` to `devbox.json` since we have scripts that rely on
them.

Other misc. changes fix the warnings from the latest version of
golangci-lint.
## Summary
Migrate devbox to go.jetify.com

## How was it tested?
go test
## Summary
Upgrade dependencies for devbox. In particular, handled the package name
change for alessio, and now that archiver is deprecated in favor of
archives, switched to it. In fact, archiver is causing a failure in
axiom (via devbox).

## How was it tested?
devbox run build
## Summary

This action is flaky, this is one of the reasons it fails. 

## How was it tested?
## Summary

Allows running a script on all devbox projects nested in a directory.
Useful for monorepos. Example:

`devbox run --all-projects lint`

Doing 

`devbox run --all-projects` without a script name shows all available
scripts among all nested projects.

@savil I kinda regret changing `run` to remove the need for `--`. It
means that this flag only works for defined scripts, not for arbitrary
commands :(

## How was it tested?

`devbox run --all-projects fmt`
## Summary

## How was it tested?

---------

Co-authored-by: John Lago <[email protected]>
…y-com#2546)

## Summary
Tweaks several of our files to more clearly explain under what terms we
accept contributions.
Reformat markdown files to fit under an 80 character width.

## How was it tested?
N/A

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Documentation**
- Introduced a new section detailing the licensing terms for community
contributions under the Apache 2 License.
- Updated contribution guidelines by replacing outdated certification
details with the new licensing information.
- Improved overall readability and formatting across community
guidelines, the code of conduct, and other support documents for a
clearer, more streamlined experience.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
…y-com#2547)

Bumps [rack](https://github.com/rack/rack) from 2.2.10 to 2.2.12.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rack/rack/blob/main/CHANGELOG.md">rack's
changelog</a>.</em></p>
<blockquote>
<h2>[2.2.12] - 2025-03-04</h2>
<h3>Security</h3>
<ul>
<li><a
href="https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v">CVE-2025-27111</a>
Possible Log Injection in <code>Rack::Sendfile</code>.</li>
</ul>
<h2>[2.2.11] - 2025-02-12</h2>
<h3>Security</h3>
<ul>
<li><a
href="https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg">CVE-2025-25184</a>
Possible Log Injection in <code>Rack::CommonLogger</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rack/rack/commit/78296637d7b35dcd357a64e8c76bd7f664c1cdbf"><code>7829663</code></a>
Bump patch verison.</li>
<li><a
href="https://github.com/rack/rack/commit/fadf97e6448fb2fccc48b75ebcef7db55028b303"><code>fadf97e</code></a>
Fix development workflow.</li>
<li><a
href="https://github.com/rack/rack/commit/b13bc6bfc7506aca3478dc5ac1c2ec6fc53f82a3"><code>b13bc6b</code></a>
Use <code>#inspect</code> to prevent log injection.</li>
<li><a
href="https://github.com/rack/rack/commit/f393916baf057bd613290b505150b7ae5da1b9c4"><code>f393916</code></a>
Fix version number in release notes.</li>
<li><a
href="https://github.com/rack/rack/commit/aa5a0f532aac7a57e4bc7e857eca1c38229f7b30"><code>aa5a0f5</code></a>
Bump patch version.</li>
<li><a
href="https://github.com/rack/rack/commit/f8b41c1dba33ec96b886e57505c149c36d56662b"><code>f8b41c1</code></a>
Escape non-printable characters when logging.</li>
<li>See full diff in <a
href="https://github.com/rack/rack/compare/v2.2.10...v2.2.12">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=rack&package-manager=bundler&previous-version=2.2.10&new-version=2.2.12)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/jetify-com/devbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ks/drupal (jetify-com#2514)

Bumps
[drupal/core-recommended](https://github.com/drupal/core-recommended)
from 10.2.3 to 10.2.11.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/drupal/core-recommended/commit/44e8501698d2c28b5d68a2195f8b0d94855b3e80"><code>44e8501</code></a>
Drupal 10.2.11</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/92d4eda171aba18bd1d6b2a3837f16d3f3e3e95b"><code>92d4eda</code></a>
Drupal 10.2.10</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/4629116a19425c5c16a9ad01e03f9bc86c360400"><code>4629116</code></a>
Drupal 10.2.9</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/599de3076ea07593759285aff78c260ce96cf52d"><code>599de30</code></a>
Back to dev.</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/9880260a404d28578cb23dcc104fc5d37dc9dc6f"><code>9880260</code></a>
Drupal 10.2.8</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/ab7078ff2c996f1d6173aaabfefe7c5603e9b79f"><code>ab7078f</code></a>
Issue <a
href="https://redirect.github.com/drupal/core-recommended/issues/3473195">#3473195</a>
by longwave, catch, jurgenhaas, naveenvalecha, quietone: twig/...</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/da18902fed42b46e7edf3b624ee6e9a79fa99e5b"><code>da18902</code></a>
Back to dev.</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/afaac96cde3b05179d11152ed646f9f6772e7a0e"><code>afaac96</code></a>
Drupal 10.2.7</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/6099fa60358b0534ff52f95ac3370b0650b4fa82"><code>6099fa6</code></a>
Back to dev.</li>
<li><a
href="https://github.com/drupal/core-recommended/commit/6fbff9a26e06c047ec4a2313fc423a7a1c51c850"><code>6fbff9a</code></a>
Drupal 10.2.6</li>
<li>Additional commits viewable in <a
href="https://github.com/drupal/core-recommended/compare/10.2.3...10.2.11">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=drupal/core-recommended&package-manager=composer&previous-version=10.2.3&new-version=10.2.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/jetify-com/devbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps
[github.com/go-jose/go-jose/v3](https://github.com/go-jose/go-jose) from
3.0.3 to 3.0.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-jose/go-jose/releases">github.com/go-jose/go-jose/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.0.4</h2>
<h2>What's Changed</h2>
<p>Backport fix for GHSA-c6gw-w398-hv78 CVE-2025-27144
<a
href="https://redirect.github.com/go-jose/go-jose/pull/174">go-jose/go-jose#174</a></p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-jose/go-jose/compare/v3.0.3...v3.0.4">https://github.com/go-jose/go-jose/compare/v3.0.3...v3.0.4</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-jose/go-jose/commit/5253038e3b5f64a2200b5b6c72107bf9823f4358"><code>5253038</code></a>
Backport fix 167 to v3 (<a
href="https://redirect.github.com/go-jose/go-jose/issues/174">#174</a>)</li>
<li><a
href="https://github.com/go-jose/go-jose/commit/047dc99758ca176080217a26d0f8a95a3350e7fb"><code>047dc99</code></a>
CI: Update github actions and go version (<a
href="https://redirect.github.com/go-jose/go-jose/issues/173">#173</a>)</li>
<li><a
href="https://github.com/go-jose/go-jose/commit/0f017e9bc3fd4ee0ca9171c131d6eb3d196ab05b"><code>0f017e9</code></a>
Revert <a
href="https://redirect.github.com/go-jose/go-jose/issues/26">#26</a>
(ignore unsupported JWKs in Sets) (<a
href="https://redirect.github.com/go-jose/go-jose/issues/131">#131</a>)</li>
<li><a
href="https://github.com/go-jose/go-jose/commit/3e2bbef724ae666f9e6691659bd46bc0c3e0c7aa"><code>3e2bbef</code></a>
Unmarshal jwk keys with unsupported key type or algorithm into empty …
(<a
href="https://redirect.github.com/go-jose/go-jose/issues/26">#26</a>)</li>
<li>See full diff in <a
href="https://github.com/go-jose/go-jose/compare/v3.0.3...v3.0.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-jose/go-jose/v3&package-manager=go_modules&previous-version=3.0.3&new-version=3.0.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/jetify-com/devbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…com#2513)

Bumps [django](https://github.com/django/django) from 4.2.17 to 4.2.18.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/django/django/commit/a7b0e50eadba8f0420013605c70eb790280b0fd2"><code>a7b0e50</code></a>
[4.2.x] Bumped version for 4.2.18 release.</li>
<li><a
href="https://github.com/django/django/commit/ad866a1ca3e7d60da888d25d27e46a8adb2ed36e"><code>ad866a1</code></a>
[4.2.x] Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6
validation.</li>
<li><a
href="https://github.com/django/django/commit/b0d309c9eb802cbc652595e2d413bb451e37f124"><code>b0d309c</code></a>
[4.2.x] Added stub release notes and release date for 4.2.18.</li>
<li><a
href="https://github.com/django/django/commit/39cf3c63f3228a04f101f3e62c75a6aae7c6ef0f"><code>39cf3c6</code></a>
[4.2.x] Cleaned up CVE-2024-53907 and CVE-2024-53908 security archive
descrip...</li>
<li><a
href="https://github.com/django/django/commit/0ff19d12e7d240d871975432ce429616012aa35e"><code>0ff19d1</code></a>
[4.2.x] Added CVE-2024-53907 and CVE-2024-53908 to security
archive.</li>
<li><a
href="https://github.com/django/django/commit/6c4fc7d6202b70ca20d21a62808e38b36bc50854"><code>6c4fc7d</code></a>
[4.2.x] Post-release version bump.</li>
<li>See full diff in <a
href="https://github.com/django/django/compare/4.2.17...4.2.18">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=django&package-manager=pip&previous-version=4.2.17&new-version=4.2.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/jetify-com/devbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
## Summary

## How was it tested?

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Chores**
- Updated the value used to verify the integrity of external
dependencies. This update ensures that underlying resources are based on
the most recent information, contributing to improved system security
and consistency. The changes do not affect any user-facing functionality
and are part of routine maintenance to guarantee updated assets.
Overall, this improvement bolsters system reliability.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary

## How was it tested?

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Chores**
- Updated several third-party dependency versions to enhance overall
stability, performance, and security.
	- Updated the vendor hash to reflect changes in dependencies.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary

## How was it tested?

## Community Contribution License

All community contributions in this pull request are licensed to the
project
maintainers under the terms of the
[Apache 2 License](https://www.apache.org/licenses/LICENSE-2.0).

By creating this pull request, I represent that I have the right to
license the
contributions to the project maintainers under the Apache 2 License as
stated in
the
[Community Contribution
License](https://github.com/jetify-com/opensource/blob/main/CONTRIBUTING.md#community-contribution-license).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **Chores**
- Upgraded several underlying libraries to their latest versions,
enhancing overall stability, performance, and compatibility.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
…com#2553)

Bumps [django](https://github.com/django/django) from 4.2.18 to 4.2.20.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/django/django/commit/35c58a7924aa07e87e925f6eea978c278f143f36"><code>35c58a7</code></a>
[4.2.x] Bumped version for 4.2.20 release.</li>
<li><a
href="https://github.com/django/django/commit/e88f7376fe68dbf4ebaf11fad1513ce700b45860"><code>e88f737</code></a>
[4.2.x] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap
template ...</li>
<li><a
href="https://github.com/django/django/commit/348e46a3e0cd80718d237a3b6d96a1c84bff317d"><code>348e46a</code></a>
[4.2.x] Added stub release notes and release date for 4.2.20.</li>
<li><a
href="https://github.com/django/django/commit/73e210755a90728fd7ff6f9a441c23521288a697"><code>73e2107</code></a>
[4.2.x] Post-release version bump.</li>
<li><a
href="https://github.com/django/django/commit/db89d2fee7906eaadfeea59506156e9578d32412"><code>db89d2f</code></a>
[4.2.x] Bumped version for 4.2.19 release.</li>
<li><a
href="https://github.com/django/django/commit/83231cca9c26fbfe4835fb7c3e53a61ca1c4e7e3"><code>83231cc</code></a>
[4.2.x] Added release date for 4.2.19.</li>
<li><a
href="https://github.com/django/django/commit/7bd1ddf1d81e9120c28322ee2a0b9c11941a6af2"><code>7bd1ddf</code></a>
[4.2.x] Refs <a
href="https://redirect.github.com/django/django/issues/34060">#34060</a>
-- Adjusted CVE-2024-53908 regression test for psycopg2.</li>
<li><a
href="https://github.com/django/django/commit/57b0229421ad64fea6ba50a8628e6aedce017152"><code>57b0229</code></a>
[4.2.x] Refs <a
href="https://redirect.github.com/django/django/issues/36098">#36098</a>
-- Fixed validate_ipv4_address() crash for non-string val...</li>
<li><a
href="https://github.com/django/django/commit/043dfadbcebc752d5ab2e9ff08c7e48044d20dc2"><code>043dfad</code></a>
[4.2.x] Fixed <a
href="https://redirect.github.com/django/django/issues/36098">#36098</a>
-- Fixed validate_ipv6_address()/validate_ipv46_address(...</li>
<li><a
href="https://github.com/django/django/commit/8769b44fdabc960dc23d1222430470809fd751b1"><code>8769b44</code></a>
[4.2.x] Added CVE-2024-56374 to security archive.</li>
<li>Additional commits viewable in <a
href="https://github.com/django/django/compare/4.2.18...4.2.20">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=django&package-manager=pip&previous-version=4.2.18&new-version=4.2.20)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/jetify-com/devbox/network/alerts).

</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

6 participants