Skip to content

0.5.3 - Bug fixes, security hardening, test infra improvements, and code cleanup

Choose a tag to compare

View all tags
@wilfredinni wilfredinni released this 30 May 14:52
· 9 commits to main since this release
0.5.3
7cd1b2c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixed

  • Test auth header mismatch — test_login_view.py used "Token" prefix but Knox AUTH_HEADER_PREFIX is "Bearer". Test was returning 401 instead of 200.
  • Test logging crash — test_settings.py cleared console handler filters, but JSON formatter expected fields injected by RequestIDFilter. Mock filter now provides dummy values for all fields.
  • Unhandled CORS env var — env.list("CORS_ALLOWED_ORIGINS") had no default, crashing startup when DEBUG=False and env var missing.
  • Sentry startup crash — sentry_sdk.init() required SENTRY_DSN in non-DEBUG mode. Now gated on env var existence with graceful fallback.
  • Sentry 100% sampling — Both traces_sample_rate and profiles_sample_rate reduced to 0.1 in production to avoid quota exhaustion.
  • Password validation bypass — UserProfileSerializer.validate() passed blank model instance to validate_password() instead of self.instance, letting UserAttributeSimilarityValidator miss email/name comparisons.
  • Email field writable — email field allowed modification via PUT/PATCH without verification. Made read-only in UserProfileSerializer.
  • Missing HSTS headers — Added SECURE_HSTS_SECONDS, SECURE_SSL_REDIRECT, and SECURE_PROXY_SSL_HEADER when DEBUG=False.
  • Wrong middleware ordering in tests — Mock RequestIDMiddleware inserted after CommonMiddleware instead of position 0, causing behavior mismatch with production.
  • Seed command error swallowing — except Exception caught everything with misleading "already exists" message. Narrowed to IntegrityError. Removed @transaction.atomic from outer handler; per-user savepoints prevent total rollback on individual failures.
  • Shared Redis throttle state — Test throttles persisted across runs via shared Redis cache. Switched tests to LocMemCache to isolate throttle state.
  • Test throttles incomplete — Only user_login throttle was relaxed in tests; user and anon rates now also set to 1000/minute.

Removed

  • ADMIN_MEDIA_PREFIX (dead config, removed in Django 2.0)
  • USER_AGENTS_CACHE (orphan setting, django-user-agents not installed)
  • from __future__ import absolute_import, unicode_literals from conf/__init__.py and conf/celery.py (Python 2 compat, dead code)
  • django.template.defaultfilters from template builtins (all default filters already available)
  • Dead get_serializer_context() override in LoginView (DRF already injects request)
  • Redundant KeyError from BaseTaskWithRetry.autoretry_for (subclass of Exception)
  • scripts/celery.py (dead code, never referenced)
  • Stale .pyc files in scripts/__pycache__/ (orphaned from deleted django.py)

Changed

  • CustomUserManager.create_user() now uses user.save(using=self._db) for multi-DB safety
  • RequestIDMiddleware uses request.user.pk instead of request.user.id as canonical identifier
  • ruff target-version and mypy python_version updated from py313 to py314 (matches runtime)
  • pytest.ini now includes addopts = --reuse-db --nomigrations for faster test setup

Full Changelog: 0.5.2...0.5.3

Assets 2
Loading