Mirrors/Dispatcharr
1
0
Fork 1
mirror of https://github.com/Dispatcharr/Dispatcharr.git synced 2026-07-21 01:05:30 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Security: Update dependencies for Django and django-celery-beat to address security vulnerabilities

Browse source
This commit is contained in:
SergeantPanda 2026-03-14 12:57:07 -05:00
parent 2b8ebc7882
commit 7b60a958a5
2 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
CHANGELOG.md
View file

@ -44,6 +44,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
### Changed
- Dependency updates:
- `Django` 5.2.11 → 6.0.3 (security patch + major version upgrade; see Security section)
- `django-celery-beat` ≥2.8.1 → ≥2.9.0 (adds explicit Django 6.0 support)
- When selecting an EPG source for a channel, the EPG source dropdown now only lists enabled (active) EPGs, sorted alphabetically.
- Channels page default splitter ratio changed from 50/50 to 60/40 (channels/streams) so all channel action buttons are visible without scrolling on 1080p displays.
- Frontend component refactoring and cleanup — Thanks [@nick4810](https://github.com/nick4810)
@ -60,6 +63,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Updated frontend npm dependencies to resolve 1 high-severity vulnerability:
- Updated `flatted` to 3.4.1, resolving **high** unbounded recursion DoS in the `parse()` revive phase ([GHSA-25h7-pfq9-p65f](https://github.com/advisories/GHSA-25h7-pfq9-p65f))
- Updated `Django` to 6.0.3 and `django-celery-beat` to 2.9.0, resolving new security vulnerabilities:
- [CVE-2026-25673](https://www.cve.org/CVERecord?id=CVE-2026-25673): Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows (March 3, 2026)
- [CVE-2026-25674](https://www.cve.org/CVERecord?id=CVE-2026-25674): Potential incorrect permissions on newly created file system objects (March 3, 2026)
### Fixed

4
pyproject.toml
View file

@ -6,7 +6,7 @@ license = "CC-BY-NC-SA-4.0"
requires-python = ">=3.13"
dynamic = ["version"]
dependencies = [
"Django==5.2.11",
"Django==6.0.3",
"psycopg2-binary==2.9.11",
"celery[redis]==5.6.2",
"djangorestframework==3.16.1",
@ -32,7 +32,7 @@ dependencies = [
"channels",
"channels-redis==4.3.0",
"django-filter",
"django-celery-beat>=2.8.1",
"django-celery-beat>=2.9.0",
"lxml==6.0.2",
"packaging",
]