[Snyk] Fix for 3 vulnerabilities

[sankalpdomore]

Snyk has created this PR to fix 3 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• requirements.txt

⚠️ Warning

Django 3.2.25 has requirement asgiref<4,>=3.3.2, but you have asgiref 3.3.1.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 SQL Injection
🦉 Allocation of Resources Without Limits or Throttling

---

Note

Bumps Django and sqlparse versions in requirements.txt.

• Dependencies:
  • Upgrade django from 3.1.8 to 4.2.27 in requirements.txt.
  • Upgrade sqlparse from 0.3.0 to 0.5.4 in requirements.txt.

^{Written by Cursor Bugbot for commit abc3822. This will update automatically on new commits. Configure here.}

[cursor]

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on January 1

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Bug: Django 4.2 requires higher asgiref version than pinned

The upgrade to django==4.2.27 creates a dependency conflict with asgiref==3.3.1 which remains pinned at line 13. Django 4.2.x requires asgiref>=3.6.0, but the current version is 3.3.1. This incompatibility will cause pip to fail during dependency resolution or result in runtime errors. The PR's own warning explicitly notes this conflict.

Additional Locations (1)

• requirements.txt#L12-L13

 

[cursor]

Bug: Source requirements.in not updated, fix will be reverted

The requirements.txt was updated but requirements.in still pins Django==3.1.8 (line 13) and asgiref==3.3.1 (line 5). Since requirements.txt is autogenerated by pip-compile requirements.in, running this command will silently revert the security fix back to the vulnerable versions. The source file needs to be updated for this fix to persist.