From 7b60a958a5e1054054e21692b99d503be751c0b3 Mon Sep 17 00:00:00 2001 From: SergeantPanda Date: Sat, 14 Mar 2026 12:57:07 -0500 Subject: [PATCH] Security: Update dependencies for Django and django-celery-beat to address security vulnerabilities --- CHANGELOG.md | 6 ++++++ pyproject.toml | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 03cef51f..6571bfcf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -44,6 +44,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Changed +- Dependency updates: + - `Django` 5.2.11 → 6.0.3 (security patch + major version upgrade; see Security section) + - `django-celery-beat` ≥2.8.1 → ≥2.9.0 (adds explicit Django 6.0 support) - When selecting an EPG source for a channel, the EPG source dropdown now only lists enabled (active) EPGs, sorted alphabetically. - Channels page default splitter ratio changed from 50/50 to 60/40 (channels/streams) so all channel action buttons are visible without scrolling on 1080p displays. - Frontend component refactoring and cleanup — Thanks [@nick4810](https://github.com/nick4810) @@ -60,6 +63,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Updated frontend npm dependencies to resolve 1 high-severity vulnerability: - Updated `flatted` to 3.4.1, resolving **high** unbounded recursion DoS in the `parse()` revive phase ([GHSA-25h7-pfq9-p65f](https://github.com/advisories/GHSA-25h7-pfq9-p65f)) +- Updated `Django` to 6.0.3 and `django-celery-beat` to 2.9.0, resolving new security vulnerabilities: + - [CVE-2026-25673](https://www.cve.org/CVERecord?id=CVE-2026-25673): Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows (March 3, 2026) + - [CVE-2026-25674](https://www.cve.org/CVERecord?id=CVE-2026-25674): Potential incorrect permissions on newly created file system objects (March 3, 2026) ### Fixed diff --git a/pyproject.toml b/pyproject.toml index 8b87a9ea..a5990fed 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -6,7 +6,7 @@ license = "CC-BY-NC-SA-4.0" requires-python = ">=3.13" dynamic = ["version"] dependencies = [ - "Django==5.2.11", + "Django==6.0.3", "psycopg2-binary==2.9.11", "celery[redis]==5.6.2", "djangorestframework==3.16.1", @@ -32,7 +32,7 @@ dependencies = [ "channels", "channels-redis==4.3.0", "django-filter", - "django-celery-beat>=2.8.1", + "django-celery-beat>=2.9.0", "lxml==6.0.2", "packaging", ]