Resolver vulnerabilidades reportadas por GH

[cmdelatorre]

https://github.com/PyAr/pyarweb/network/alert/requirements.txt/django/open

[diegoduncan21]

me da 404 esa url.

[cmdelatorre]

[FedericoJurio]

No soy un experto en django pero teniendo en cuenta que cada salto de versión puede impactar por incompatibilidades respecto a la versión anterior y en librerías third-party, quizas tiene sentido encarar upgrades graduales en vez de hacer el salto de 1.8 a 1.11

• https://docs.djangoproject.com/en/1.9/releases/1.9/#backwards-incompatible-changes-in-1-9
• https://docs.djangoproject.com/en/1.10/releases/1.10/#backwards-incompatible-changes-in-1-10
• https://docs.djangoproject.com/en/1.11/releases/1.11/#backwards-incompatible-changes-in-1-11

[JigyasuRajput]

Hi, @cmdelatorre
I checked the mentioned vulnerabilities (CVE-2019-6975 and CVE-2019-3498) and confirmed that they are already patched in the current Django==3.2.19 version specified in requirements.txt.

These issues were fixed in much older versions of Django, so the current setup is secure.
If there’s any follow-up work or improvements needed, I’d be happy to contribute!

[facundobatista]

Awesome, thanks!