You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Restore a more relaxed dependency on Django (e.g. Django>=2.1,<2.2) that would allow the patch version to change, simplifying the inclusion of Django security releases.
Justification
In 0a71c63 the dependency on Django was changed from a relaxed major-minor that accepted any patch version Django>=2.0,<2.1 to a frozen version Django==2.1.3, that was later bumped to 2.1.4 in baeb793.
On Jan. 4th Django had another security release 2.1.5, that is not included in an installation of Netbox due to the frozen requirement.
I'm wondering what lead to the choice of using a frozen version, in particular for Django that is well known to be stable and to properly follow semantic versioning.
The text was updated successfully, but these errors were encountered:
We decided to adopt strict dependency pinning after dealing with numerous compatibility issues (see #2239 for an example). However, I agree that Django is a mature and stable enough project that we should have no problem matching on minor version only.
Proposed Changes
Restore a more relaxed dependency on Django (e.g.
Django>=2.1,<2.2
) that would allow the patch version to change, simplifying the inclusion of Django security releases.Justification
In 0a71c63 the dependency on Django was changed from a relaxed major-minor that accepted any patch version
Django>=2.0,<2.1
to a frozen versionDjango==2.1.3
, that was later bumped to2.1.4
in baeb793.On Jan. 4th Django had another security release
2.1.5
, that is not included in an installation of Netbox due to the frozen requirement.I'm wondering what lead to the choice of using a frozen version, in particular for Django that is well known to be stable and to properly follow semantic versioning.
The text was updated successfully, but these errors were encountered: