mirror of
https://github.com/makeplane/plane.git
synced 2026-08-29 10:08:51 +02:00
ca3b48ef87
* chore(api): upgrade Django 4.2 → 5.2 and bump Django ecosystem deps Upgrade Django 4.2.30 LTS → 5.2.15 LTS and bump all Django-coupled dependencies to versions that officially support 5.2 (DRF 3.17.1, channels 4.3.2, django-cors-headers 4.9.0, django-filter 25.2, django-storages 1.14.6, django-redis 7.0.0, celery 5.5.3, django-celery-beat 2.9.0, django-celery-results 2.6.0, drf-spectacular 0.29.0, scout-apm 3.5.3, psycopg 3.3.4, whitenoise 6.12.0, django-debug-toolbar 6.0.0, pytest-django 4.12.0). OpenTelemetry set, django-crum and pytz held (already 5.2-compatible). Code changes the upgrade required: - urls.py: gate the debug-toolbar URL include on apps.is_installed(), since django-debug-toolbar 6.0 ships a model that errors when the app isn't in INSTALLED_APPS (test settings run DEBUG=True but don't install it). - migration 0122: state-only AlterField for three M2M fields using through_fields (Django 5.1 deconstruction normalization); sqlmigrate is a no-op, zero DB impact. - test_authentication.py: module-level autouse cache.clear() fixture to fix 8 pre-existing throttle test-isolation failures (identical on the 4.2 baseline) so the suite is green. Verified on python:3.12-alpine + Postgres 15.7: check clean, makemigrations --check clean, full migrate applies, pytest 393 passed. Adds the migration plan/audit write-up under apps/api/docs/. * fix(api): scope auth test cache reset to throttle keys only The module-wide _reset_auth_throttle_cache fixture called cache.clear(), wiping the entire shared Redis cache between tests. Replace it with targeted deletion of throttle_authentication_* keys (DRF SimpleRateThrottle history for AuthenticationThrottle) via cache.delete_pattern, keeping the same before/after cleanup.
78 lines
1.4 KiB
Plaintext
78 lines
1.4 KiB
Plaintext
# base requirements
|
|
|
|
# django
|
|
Django==5.2.15
|
|
# rest framework
|
|
djangorestframework==3.17.1
|
|
# postgres
|
|
psycopg==3.3.4
|
|
psycopg-binary==3.3.4
|
|
psycopg-c==3.3.4
|
|
dj-database-url==3.0.1
|
|
# redis
|
|
redis==5.0.4
|
|
django-redis==7.0.0
|
|
# cors
|
|
django-cors-headers==4.9.0
|
|
# celery
|
|
celery==5.5.3
|
|
django_celery_beat==2.9.0
|
|
django-celery-results==2.6.0
|
|
# file serve
|
|
whitenoise==6.12.0
|
|
# fake data
|
|
faker==25.0.0
|
|
# filters
|
|
django-filter==25.2
|
|
# json model
|
|
jsonmodels==2.7.0
|
|
# storage
|
|
django-storages==1.14.6
|
|
# user management
|
|
django-crum==0.7.9
|
|
# web server
|
|
uvicorn==0.29.0
|
|
# sockets
|
|
channels==4.3.2
|
|
# ai
|
|
openai==1.63.2
|
|
# slack
|
|
slack-sdk==3.27.1
|
|
# apm
|
|
scout-apm==3.5.3
|
|
# xlsx generation
|
|
openpyxl==3.1.2
|
|
# logging
|
|
python-json-logger==4.0.0
|
|
# html parser
|
|
beautifulsoup4==4.12.3
|
|
# analytics
|
|
posthog==3.5.0
|
|
# crypto
|
|
cryptography==48.0.1
|
|
# html validator
|
|
lxml==6.1.0
|
|
# s3
|
|
boto3==1.34.96
|
|
# http client (pinned to address CVE-2026-44431 and CVE-2026-44432)
|
|
urllib3>=2.7.0
|
|
# requests — used directly for webhook delivery & link unfurling; pinned to
|
|
# >=2.32 for the get_connection_with_tls_context adapter hook (SSRF IP pinning)
|
|
requests==2.33.0
|
|
# password validator
|
|
zxcvbn==4.4.28
|
|
# timezone
|
|
pytz==2024.1
|
|
# jwt
|
|
PyJWT==2.13.0
|
|
# OpenTelemetry
|
|
opentelemetry-api==1.28.1
|
|
opentelemetry-sdk==1.28.1
|
|
opentelemetry-instrumentation-django==0.49b1
|
|
opentelemetry-exporter-otlp==1.28.1
|
|
opentelemetry-exporter-otlp-proto-grpc==1.28.1
|
|
# OpenAPI Specification
|
|
drf-spectacular==0.29.0
|
|
# html sanitizer
|
|
nh3==0.2.18
|