Skip to content

Conversation

@codecov-releaser
Copy link
Contributor

@codecov-releaser codecov-releaser commented Dec 1, 2025

Release PR for 25.12.1
I've updated the version name and committed: 0dcf980.


Note

Bumps version to 25.12.1 and adds a migration to update the core Constants version value.

  • Versioning:
    • Update VERSION to 25.12.1.
  • Database/Migrations:
    • Add core migration libs/shared/shared/django_apps/core/migrations/0077_increment_version.py to set Constants record with key version to 25.12.1.

Written by Cursor Bugbot for commit ad2f2b8. This will update automatically on new commits. Configure here.

@calvin-codecov calvin-codecov requested a review from a team as a code owner December 1, 2025 23:25

def update_version(apps, schema):
Constants = apps.get_model("core", "Constants")
version = Constants.objects.get(key="version")

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical severity and reachable issue identified in your code:
Line 8 has a vulnerable usage of django, introducing a critical severity vulnerability.

ℹ️ Why this is reachable

A reachable issue is a real security risk because your project actually executes the vulnerable code. This issue is reachable because your code uses a certain version of django.
Affected versions of django are vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The ORM methods QuerySet.filter(), QuerySet.exclude(), QuerySet.get() and the Q() class can be tricked into SQL injection when you pass a specially crafted dictionary via **kwargs that includes a malicious _connector entry. This bypasses the normal query parameterization and lets an attacker inject arbitrary SQL into the WHERE clause.

References: GHSA, CVE

To resolve this comment:
Upgrade this dependency to at least version 4.2.26 at libs/shared/uv.lock.

💬 Ignore this finding

To ignore this, reply with:

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

You can view more details on this finding in the Semgrep AppSec Platform here.

@sentry
Copy link

sentry bot commented Dec 1, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.87%. Comparing base (b081221) to head (ad2f2b8).
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #590   +/-   ##
=======================================
  Coverage   93.86%   93.87%           
=======================================
  Files        1284     1285    +1     
  Lines       46492    46501    +9     
  Branches     1522     1522           
=======================================
+ Hits        43642    43651    +9     
  Misses       2540     2540           
  Partials      310      310           
Flag Coverage Δ
apiunit 96.55% <ø> (ø)
sharedintegration 38.73% <0.00%> (-0.03%) ⬇️
sharedunit 88.77% <100.00%> (+<0.01%) ⬆️
workerintegration 58.64% <ø> (ø)
workerunit 91.22% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@codecov-notifications
Copy link

codecov-notifications bot commented Dec 1, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

@codecov-eu
Copy link

codecov-eu bot commented Dec 1, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

@codspeed-hq
Copy link

codspeed-hq bot commented Dec 1, 2025

CodSpeed Performance Report

Merging #590 will not alter performance

Comparing release/25.12.1 (ad2f2b8) with main (39fb6a9)1

Summary

✅ 9 untouched

Footnotes

  1. No successful run was found on main (b081221) during the generation of this report, so 39fb6a9 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants