Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Relax Django dependency accepted versions #2808

Closed
volans- opened this issue Jan 24, 2019 · 1 comment
Closed

Relax Django dependency accepted versions #2808

volans- opened this issue Jan 24, 2019 · 1 comment
Labels
status: accepted This issue has been accepted for implementation

Comments

@volans-
Copy link

volans- commented Jan 24, 2019

Proposed Changes

Restore a more relaxed dependency on Django (e.g. Django>=2.1,<2.2) that would allow the patch version to change, simplifying the inclusion of Django security releases.

Justification

In 0a71c63 the dependency on Django was changed from a relaxed major-minor that accepted any patch version Django>=2.0,<2.1 to a frozen version Django==2.1.3, that was later bumped to 2.1.4 in baeb793.

On Jan. 4th Django had another security release 2.1.5, that is not included in an installation of Netbox due to the frozen requirement.

I'm wondering what lead to the choice of using a frozen version, in particular for Django that is well known to be stable and to properly follow semantic versioning.

@jeremystretch
Copy link
Member

We decided to adopt strict dependency pinning after dealing with numerous compatibility issues (see #2239 for an example). However, I agree that Django is a mature and stable enough project that we should have no problem matching on minor version only.

@jeremystretch jeremystretch added the status: accepted This issue has been accepted for implementation label Jan 29, 2019
cimnine added a commit to netbox-community/netbox-docker that referenced this issue Feb 8, 2019
cimnine added a commit to netbox-community/netbox-docker that referenced this issue Feb 22, 2019
@lock lock bot locked as resolved and limited conversation to collaborators Jan 16, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
status: accepted This issue has been accepted for implementation
Projects
None yet
Development

No branches or pull requests

2 participants