• X
• Mastodon
• Reddit
• LinkedIn

Re-bumps djangorestframework from 3.14.0 to 3.17.1 across backend/pyproject.toml, pyproject.toml, and both lock files. The bump also drops pytz as a transitive DRF dependency (removed upstream in 3.15) and targets the CVE-2024-21520 XSS fix plus the UniqueConstraint.violation_error_message feature.

• backend/pyproject.toml and backend/uv.lock correctly pin DRF 3.17.1 and resolve drf-yasg to 1.21.15 (>=1.21.8 floor).
• pyproject.toml bumps the DRF pin in the hook-check-django-migrations group but leaves drf-yasg==1.21.7 in place; the root uv.lock therefore locks that CI environment to drf-yasg 1.21.7 + DRF 3.17.1 — a combination where drf-yasg predates any DRF 3.15 support.
• Even drf-yasg 1.21.15 (latest, used by the backend) officially lists DRF 3.13–3.15 as supported, making DRF 3.17 officially outside its stated matrix; the PR itself flags schema generation as an unvalidated checklist item.

The PR is intentionally drafted pending build, test, and staging validation; the DRF bump itself is straightforward but the drf-yasg version skew in the root hook group needs resolution before this can go to production.

The root pyproject.toml migration-hook group now pairs drf-yasg==1.21.7 (a 2023 release targeting DRF 3.14) with djangorestframework==3.17.1. If the hook environment initialises Django with drf_yasg in INSTALLED_APPS, this mismatch can cause the migration check to fail or be silently skipped. The backend lock resolves to drf-yasg 1.21.15, which is better, but even that version only officially lists DRF 3.15 as its maximum, so schema-generation correctness under DRF 3.17 remains unverified until staging smoke tests pass.

The root pyproject.toml needs its drf-yasg pin in the hook-check-django-migrations group updated from ==1.21.7 to >=1.21.8 to match the backend and remove the version skew. The uv.lock would need to be re-generated after that change.

1. pyproject.toml, line 54 (link)

   drf-yasg==1.21.7 in root hook group is now coupled with DRF 3.17.1

   The hook-check-django-migrations dependency group pins drf-yasg==1.21.7 (released July 2023, only tested against DRF up to 3.14). After this bump, the root uv.lock resolves that group to drf-yasg 1.21.7 + djangorestframework 3.17.1. If the hook environment runs manage.py with drf_yasg in INSTALLED_APPS, its startup introspection of DRF internals could raise an AttributeError or ImportError, causing the migration check to fail or silently skip.

   The backend's own pyproject.toml already requires >=1.21.8 (resolves to 1.21.15) — bringing the root hook group in line with that floor would remove the discrepancy and match what the real backend runs.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: pyproject.toml
   Line: 54
   
   Comment:
   **`drf-yasg==1.21.7` in root hook group is now coupled with DRF 3.17.1**
   
   The `hook-check-django-migrations` dependency group pins `drf-yasg==1.21.7` (released July 2023, only tested against DRF up to 3.14). After this bump, the root `uv.lock` resolves that group to `drf-yasg 1.21.7 + djangorestframework 3.17.1`. If the hook environment runs `manage.py` with `drf_yasg` in `INSTALLED_APPS`, its startup introspection of DRF internals could raise an `AttributeError` or `ImportError`, causing the migration check to fail or silently skip.
   
   The backend's own `pyproject.toml` already requires `>=1.21.8` (resolves to 1.21.15) — bringing the root hook group in line with that floor would remove the discrepancy and match what the real backend runs.
   
   How can I resolve this? If you propose a fix, please make it concise.