Conversation
The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-15183335 - https://snyk.io/vuln/SNYK-PYTHON-WAGTAIL-15189141
There was a problem hiding this comment.
Pull request overview
This PR attempts to address security vulnerabilities by upgrading Django from 4.1.6 to 4.2.28 and Wagtail from 4.2.2 to 6.3.6. However, the upgrades introduce multiple critical compatibility issues that will prevent the application from functioning.
Changes:
- Upgrade Django from 4.1.6 to 4.2.28 (minor version jump crossing the 4.0 constraint boundary)
- Upgrade Wagtail from 4.2.2 to 6.3.6 (major version jump spanning two major releases)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Django | ||
| # ------------------------------------------------------------------------------ | ||
| django==4.1.6 # pyup: < 4.0 # https://www.djangoproject.com/ | ||
| django==4.2.28 # pyup: < 4.0 # https://www.djangoproject.com/ |
There was a problem hiding this comment.
The Django version upgrade to 4.2.28 violates the explicit version constraint "pyup: < 4.0" specified in the comment. This constraint indicates that the codebase is not intended to be upgraded to Django 4.x. The jump from Django 4.1.6 to 4.2.28 requires updating this constraint to match the intended version policy, or downgrading to the latest 3.2.x LTS version if the constraint is intentional. Note that Django 4.0 introduced several breaking changes including new template tag autoescape behavior, updated URL pattern matching, and changes to the admin interface.
| # Wagtail | ||
| # ------------------------------------------------------------------------------ | ||
| wagtail==4.2.2 # https://github.com/wagtail/wagtail | ||
| wagtail==6.3.6 # https://github.com/wagtail/wagtail |
There was a problem hiding this comment.
The Wagtail upgrade from 4.2.2 to 6.3.6 is a major version jump spanning two major releases (5.x and 6.x). This introduces significant breaking changes that will cause runtime errors. Key issues include:
- Wagtail 5.0+ requires Pillow>=9.1.0, but line 3 has Pillow==9.0.1 (as noted in the PR warnings)
- wagtailautocomplete.edit_handlers.AutocompletePanel was deprecated in Wagtail 3.0 and removed in later versions - it should be imported from wagtail.admin.panels instead (used in 11+ files across the codebase)
- wagtail.contrib.modeladmin was deprecated in Wagtail 5.0 and requires migration to the Snippet ViewSets API (used extensively throughout the codebase)
- Multiple template tag and API changes between versions
This upgrade requires code migration across the entire codebase before it can work properly. Consider upgrading incrementally (4.2→5.0→6.0→6.3) with proper testing at each step.
| # Wagtail | ||
| # ------------------------------------------------------------------------------ | ||
| wagtail==4.2.2 # https://github.com/wagtail/wagtail | ||
| wagtail==6.3.6 # https://github.com/wagtail/wagtail |
There was a problem hiding this comment.
The Pillow version 9.0.1 on line 3 is incompatible with the upgraded Wagtail 6.3.6. As noted in the PR warnings, Wagtail 5.0.5+ requires Pillow>=9.1.0. This dependency needs to be updated to at least Pillow==9.1.0, though a more recent version like 10.x or 11.x would be preferable for security and compatibility. Without this update, the application will fail to start with a dependency conflict error.
| # Wagtail | ||
| # ------------------------------------------------------------------------------ | ||
| wagtail==4.2.2 # https://github.com/wagtail/wagtail | ||
| wagtail==6.3.6 # https://github.com/wagtail/wagtail |
There was a problem hiding this comment.
The wagtailmenus version 3.1.3 is likely incompatible with Wagtail 6.3.6. Wagtailmenus 3.1.3 was released for Wagtail 3.x and 4.x. For Wagtail 6.x, wagtailmenus 4.0+ is required. Without updating this dependency, the menu functionality will fail with import errors or runtime exceptions. This is a secondary dependency that should be addressed alongside the main Wagtail upgrade.
| # Wagtail | ||
| # ------------------------------------------------------------------------------ | ||
| wagtail==4.2.2 # https://github.com/wagtail/wagtail | ||
| wagtail==6.3.6 # https://github.com/wagtail/wagtail |
There was a problem hiding this comment.
The wagtail-autocomplete version 0.9.0 is incompatible with Wagtail 6.3.6. Wagtail-autocomplete 0.9.0 supports up to Wagtail 4.x. For Wagtail 6.x, wagtail-autocomplete 0.11+ is required. Additionally, the codebase imports from the deprecated wagtailautocomplete.edit_handlers module (used in 11+ files including article/models.py, education_directory/models.py, etc.), which needs to be updated to use wagtail.admin.panels instead. This will cause import errors throughout the application.
| django==4.2.28 # pyup: < 4.0 # https://www.djangoproject.com/ | ||
| django-environ==0.8.1 # https://github.com/joke2k/django-environ | ||
| django-model-utils==4.3.1 # https://github.com/jazzband/django-model-utils | ||
| django-allauth==0.54.0 # https://github.com/pennersr/django-allauth |
There was a problem hiding this comment.
The django-allauth version 0.54.0 may have compatibility issues with Django 4.2.28. Django-allauth 0.54.0 was released for Django 3.2 and 4.1. For Django 4.2, django-allauth 0.57.0+ is recommended to ensure full compatibility with newer Django features and avoid potential deprecation warnings or errors.
| django-allauth==0.54.0 # https://github.com/pennersr/django-allauth | |
| django-allauth==0.57.0 # https://github.com/pennersr/django-allauth |
| # Django | ||
| # ------------------------------------------------------------------------------ | ||
| django==4.1.6 # pyup: < 4.0 # https://www.djangoproject.com/ | ||
| django==4.2.28 # pyup: < 4.0 # https://www.djangoproject.com/ |
There was a problem hiding this comment.
The django-haystack version 3.2.1 may have compatibility issues with Django 4.2.28. Django-haystack 3.2.1 was designed for Django 3.2 and 4.1. While it may work with Django 4.2, there could be deprecation warnings or unexpected behavior. Consider testing thoroughly or upgrading to the latest django-haystack version that explicitly supports Django 4.2.
The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-DJANGO-15183335 - https://snyk.io/vuln/SNYK-PYTHON-WAGTAIL-15189141
Snyk has created this PR to fix 2 vulnerabilities in the pip dependencies of this project.
Snyk changed the following file(s):
requirements/base.txtImportant
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 SQL Injection
🦉 Missing Authorization