-
-
Notifications
You must be signed in to change notification settings - Fork 6.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Drop support for Django < 4.2 and Python < 3.8
Discussion: #8814 (reply in thread)
- Loading branch information
1 parent
91bbac1
commit 1f2daaf
Showing
5 changed files
with
9 additions
and
35 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we should revert this part and release 3.15.3
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, You are right. To resolve CVE-2024-21520, I upgraded django-rest-framework to 3.15.2, but django-rest-framework requires django to be installed later than 3.2.25, which forced me to upgrade django. This is really fucked up.
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why is that fucked up?
It primarily seems to be caused by the fact that you're using a Django version that's no longer maintained. If you're willing to not upgrade DJango and accept any security issues the Django installation might have, then why do you insist on upgrading DRF but not Django?
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Because I can't evaluate the risk points brought by upgrading Django from 3.25 to 4.2, and testing will increase extra workload, which is extra workload for solving the CVE vulnerability of Django-rest-framework, which I don't want to do; I just want to solve the CVE vulnerability of Django-rest-framework and don't want to upgrade now. Even if I need to upgrade, I hope to put a plan aside, it is urgent to solve the CVE vulnerability in time.
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That just sounds like some technical debt has accumulated.
Dropping support for unmaintained Django versions is not just the above commit, but also other ones that remove extra code that had special treatment for those versions, reducing the size of the DRF codebase. I don't see why DRF folk should keep maintaining that only because updating Django is work.
You could argue that versions shouldn't be dropped silently in a minor release -- but it's not actually a silent change (the package manager will tell you about the requirements mismatch). (But for those who like to make this argument, consider the following: If we had released a new major DRF version (3.16) when dropping support for those old Django versions, then the CVE fix would have ended up in 3.16.1. So that would not have helped you: you still would not have the CVE fix and support for the old Django version at the same time. Any minor/major version discussion is thus besides the point in this case.)
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There are more factors to consider when upgrading. If the upgrade does not bring me extra significant benefits, I may not upgrade.
DRF follows the iteration of Django and Python versions, which is correct. I wonder if we can iterate the versions in the major version, including removing the versions that are no longer maintained in Django and Python, and fix CVE vulnerabilities in the minor version.
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Upgrading to a maintained Django version would have brought the benefit of a compatible ecosystem. You're now asking DRF to put the work in instead. I think the right strategy would be to acknowledge that upgrading actually has the benefit you want, but you're not willing to put in the work on your side. That's OK, but your choice and not our problem.
As I wrote earlier, if we had released 3.16 (instead of 3.15.2) on the occasion of dropping support for unmaintained Django versions, then the CVE fix would have gone into 3.16.1, not into 3.15.x. So you would be stuck with 3.15.1. Exactly as you are now.
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why can't we release a new version to fix the CVE vulnerabilities in 3.15.x? Similar to the update version, only the CVE vulnerabilities of the current version or other additional bugs are maintained, which is conducive to the simultaneous update and iteration of multiple versions.
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
To quote from your earlier message, doing that (including the necessary testing and subsequent maintenance of two branches) "will increase extra workload, which is extra workload [...], which I don't want to do".
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Tom Christie suggested this change, as the release was hastily done in a point release. not entirely your fault btw
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The reason why I have such a big opinion is that I have three services that have to upgrade the Django version due to the CVE vulnerability of drf. This is indeed a very tedious task for me. I believe that I am one of the many drf users, and the impact of this change is indeed very large.In short, we hope that drf will get better and better。
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You don't have to upgrade Django because of DRF vulnerability. Today is DRF but tomorrow will be another django package. Sure, the patch release dropping support is not ideal, but package managers handle it just fine. You're running an unsupported version of Django, if you don't want vulnerabilities in your app, you should upgrade to a supported one, period.
I'm not a maintainer, just a mere user. I just don't want volunteer to do unecessary work, so I'm with Peter here.
1f2daaf
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Got it, I understand you, but we are just standing at different angles. We will evaluate the impact of upgrading the Django version and work hard to resolve it.Thanks to all the maintainers and fans of drf。