-
Notifications
You must be signed in to change notification settings - Fork 10
Release 25.12.1 #590
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Release 25.12.1 #590
Conversation
|
|
||
| def update_version(apps, schema): | ||
| Constants = apps.get_model("core", "Constants") | ||
| version = Constants.objects.get(key="version") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Critical severity and reachable issue identified in your code:
Line 8 has a vulnerable usage of django, introducing a critical severity vulnerability.
ℹ️ Why this is reachable
A reachable issue is a real security risk because your project actually executes the vulnerable code. This issue is reachable because your code uses a certain version of django.
Affected versions of django are vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The ORM methods QuerySet.filter(), QuerySet.exclude(), QuerySet.get() and the Q() class can be tricked into SQL injection when you pass a specially crafted dictionary via **kwargs that includes a malicious _connector entry. This bypasses the normal query parameterization and lets an attacker inject arbitrary SQL into the WHERE clause.
To resolve this comment:
Upgrade this dependency to at least version 4.2.26 at libs/shared/uv.lock.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #590 +/- ##
=======================================
Coverage 93.86% 93.87%
=======================================
Files 1284 1285 +1
Lines 46492 46501 +9
Branches 1522 1522
=======================================
+ Hits 43642 43651 +9
Misses 2540 2540
Partials 310 310
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
CodSpeed Performance ReportMerging #590 will not alter performanceComparing Summary
Footnotes |
Release PR for 25.12.1
I've updated the version name and committed: 0dcf980.
Note
Bumps version to 25.12.1 and adds a migration to update the core
Constantsversion value.VERSIONto25.12.1.coremigrationlibs/shared/shared/django_apps/core/migrations/0077_increment_version.pyto setConstantsrecord with keyversionto25.12.1.Written by Cursor Bugbot for commit ad2f2b8. This will update automatically on new commits. Configure here.