[Snyk] Security upgrade django from 3.2.25 to 4.2.28

[robertatakenaka]

Snyk has created this PR to fix 1 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• requirements/production.txt

⚠️ Warning

django-extensions 3.2.1 requires Django, which is not installed.
django-debug-toolbar 3.8.1 requires django, which is not installed.
django-anymail 11.1 requires django, which is not installed.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 SQL Injection

[Copilot]

Pull request overview

This PR attempts to address a security vulnerability by upgrading Django from 3.2.25 to 4.2.28. However, the implementation has critical issues that prevent it from working correctly.

Changes:

• Adds django>=4.2.28 to requirements/production.txt to fix a Snyk-identified security vulnerability
• Removes a blank line before the elastic-apm dependency

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Wagtail 4.2.2 is not compatible with Django 4.2. According to Wagtail's release notes, Wagtail 4.2.x series supports Django 3.2, 4.0, and 4.1, but not Django 4.2. To upgrade to Django 4.2.28, you need to upgrade Wagtail to at least version 5.0 or later. This incompatibility will likely cause runtime errors or prevent the application from starting.

This affects base.txt line 27: wagtail==4.2.2, which is outside the scope of this PR but is a blocking issue for the Django upgrade.

Suggested change

	django>=4.2.28 # not directly required, pinned by Snyk to avoid a vulnerability
	django<4.2 # constrained to remain compatible with wagtail==4.2.2 from base.txt

[Copilot]

The use of >= instead of == for version pinning creates unpredictable behavior. With >=4.2.28, pip could install any future Django version (e.g., 4.2.29, 4.3.x, 5.x), which may introduce breaking changes or incompatibilities.

For production dependencies, use exact version pinning with == to ensure reproducible builds. Change to django==4.2.28 instead.

Suggested change

	django>=4.2.28 # not directly required, pinned by Snyk to avoid a vulnerability
	django==4.2.28 # not directly required, pinned by Snyk to avoid a vulnerability

[Copilot]

Inconsistent line formatting: A blank line was removed before elastic-apm==6.15.1, breaking the visual separation pattern used throughout the requirements files. The blank line should be preserved to maintain consistency with the file's formatting conventions.

Suggested change

	# ------------------------------------------------------------------------------
	# ------------------------------------------------------------------------------

[Copilot]

The comment "# pyup: < 4.0" in base.txt line 15 indicates that the project is intentionally configured to prevent automatic upgrades to Django 4.x. Upgrading to Django 4.2.28 in production.txt contradicts this configuration and suggests that the upgrade strategy needs to be coordinated across all requirements files and the pyup configuration should be updated accordingly.

Suggested change

	elastic-apm==6.15.1
	django>=4.2.28 # not directly required, pinned by Snyk to avoid a vulnerability
	elastic-apm==6.15.1

[Copilot]

Critical dependency conflict: This PR adds django>=4.2.28 to production.txt, but base.txt (which is included via -r base.txt on line 3) explicitly pins django==4.1.6. This will cause pip to fail during installation with a conflict error.

The base.txt file needs to be updated to django==4.2.28 (or higher) to resolve this conflict. Additionally, using >= is problematic because it allows unpredictable upgrades - use == for pinned versions to ensure reproducible builds.

Suggested change

	elastic-apm==6.15.1
	django>=4.2.28 # not directly required, pinned by Snyk to avoid a vulnerability
	elastic-apm==6.15.1