Cloud-CV / Cloud-CV/EvalAI

Insecure requirement: Django version insecure

Open
#2,564 15 comments 0 reactions 0 assignees View on GitHub
GSoC-2020 medium-difficulty priority-high
Dominant language
Python
Stars
2k
Forks
984
Avg merge
2h 54m
Merged PRs (30d)
14

Description

### Current:
The Django version currently in use for EvalAI (1.11.23) is now being marked as insecure by `requires.io`. While 1.11.23 was a security release and is much safer than its previous versions, it can still be a major trouble in the future as Django will end support for all 1.x versions in April 2020.
![django-insecure](https://user-images.githubusercontent.com/37668193/71638325-ac852900-2c82-11ea-9f08-99a03c8265d4.PNG)

### Proceeding:
The Django version should be updated to 2.2 so that we won't have to make major changes urgently in the API when a new vulnerability is discovered in Django.
However, this can be a big change, many dependencies will have to be updated to support the new version. Along with API updates for Django, the API for these dependencies will also have to be updated.
I think the best way to proceed would be to:
1. Research and enumerate the required changes
2. Formulate a plan (e.g. which dependencies will have to be updated first and which should be kept for later)
3. Add modular changes in steps according to the plan (reference: #2505)

**Edit:**
* Latest 1.11 release is Django 1.11.28 It could be considered a short term solution. But extended support will end for 1.11 in April 2020.
* Instead of upgrading to 3.0, it should be upgraded to 2.2 LTS (extended support till April 2022). Edited the above message accordingly.
* Reference:
https://djangoproject.com/download/
![image](https://user-images.githubusercontent.com/37668193/73919799-411a2100-48ea-11ea-90e5-435a40639a2d.png)

**Please test and make sure to verify the validity and compatibility of suggestions with EvalAI current master branch.**

Contributor guide

Open the contributing guide

Research direction

Start by checking the current master branch's dependency configuration and Django compatibility. Enumerate the dependencies and API changes required for Django 2.2, then review the plan against the existing API and dependency versions. Done means the upgrade is implemented in modular steps and the current master branch remains compatible and tested.

Written by the indexing model from the issue text.

Assessment

Tech stack
django, python
Domain
backend, security
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.