Bump djangorestframework from 3.15.2 to 3.17.2 - #38104
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps [djangorestframework](https://github.com/encode/django-rest-framework) from 3.15.2 to 3.17.2. - [Release notes](https://github.com/encode/django-rest-framework/releases) - [Commits](encode/django-rest-framework@3.15.2...3.17.2) --- updated-dependencies: - dependency-name: djangorestframework dependency-version: 3.17.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
🔍 Dependency Analysis SummaryThis is a lock-file-only bump of
📋 Detailed Changelog Reviewdjangorestframework 3.15.2 → 3.17.2Changes (aggregated across 3.16.0, 3.16.1, 3.17.0, 3.17.1, 3.17.2): Platform support
Features
Bug fixes relevant to serializers
Bug fixes in areas HQ does not exercise
Breaking Changes
Migration Notes
|
| Upstream change | HQ exposure |
|---|---|
| Python 3.9 drop | None — requires-python = ">=3.13" |
| coreapi removal | None — not a dependency, no schema generation |
DATA_UPLOAD_MAX_MEMORY_SIZE on request.data |
None — no DRF views/parsers; settings.py:1055 sets it to None anyway |
AdminRenderer / HTMLFormRenderer / browsable API |
None — DRF not in INSTALLED_APPS, no renderers configured |
TokenAdmin, OrderingFilter |
None — not used |
COERCE_BIGINT_TO_STRING |
Defaults to False; BlobMeta.content_length, LedgerTransaction.delta/updated_balance keep integer output |
DurationField format |
No DurationField on any serialized model |
MultipleChoiceField ordering |
Not used; XFormStateField subclasses ChoiceField |
UniqueTogetherValidator fixes |
HQ serializers are read-only (.data on an instance); validators never run, so no behaviour change even though LedgerValue has a unique_together |
Affected Files — none require changes, but these are the DRF surface area:
Direct imports
corehq/form_processor/serializers.py— the bulk of it (form/case/ledger/attachmentModelSerializers)corehq/apps/sms/serializers.py—SMSSerializer,MobileBackendSerializercorehq/apps/receiverwrapper/tests/test_submissions.py—from rest_framework import status(constants only)
Consumers whose JSON output is produced by those serializers
corehq/form_processor/models/forms.py:722,models/cases.py:422,428,models/ledgers.py:85corehq/apps/sms/models.py:308,1810corehq/apps/hqwebapp/doc_lookup.py:96,102(raw-doc lookup views)
These serializers feed case/form document JSON that flows into APIs and Elasticsearch, so the thing that actually matters for this upgrade is output-shape stability, not API compatibility.
Test Impact: No test updates expected. corehq/form_processor/tests/test_serialization.py also asserts query counts around the lazy(...)-wrapped attachment/history serializers, so it will catch any change in when DRF evaluates nested fields.
Configuration Changes: None.
🛠️ Recommendations
Action Required
- Nothing blocking. Worth confirming CI is green rather than hand-verifying — I was not able to run the test suite in this environment (no
uv/virtualenv available), so the assessment above is from changelog review and static analysis only.
Testing Focus
corehq/form_processor/tests/test_serialization.py— output shape plus the lazy-evaluation query-count assertions.- Case/form JSON round-trips:
XFormInstanceRawDocSerializer,CommCareCaseRawDocSerializer,CommCareCaseAPISerializer, and the Elasticsearch/API paths that consumeto_json(). Any silent change in a field's representation would show up as a document-shape diff. LedgerValueSerializerandCommCareCaseAPISerializerboth mutateself.fieldsbefore callingsuper().__init__()(corehq/form_processor/serializers.py:227and thelitekwarg handling). This is pre-existing, and it's inverted relative toDeletableModelSerializer/XFormInstanceRawDocSerializer, which callsuper()first. It relies onModelSerializer.get_fields()not depending on instance state set in__init__— exactly the kind of internal that a DRF upgrade can shift. Make sure the ledger-serialization andlite=Truecase-API paths are exercised; consider normalising the ordering as a follow-up.- SMS document serialization (
SMS.to_json()/SQLMobileBackend).
Follow-up Tasks
- Nothing required by this PR. For planning: DRF 3.18.0 drops Django 4.2/5.0/5.1 (HQ is on Django 5.2.16, so still supported) and changes
many=Truelist-serializer errors to a dict format. That error-format change is only relevant if HQ starts using DRF for validation — currently it does not.
Merge Recommendation: APPROVE (pending green CI)
📚 Useful Links
- DRF release notes
- 3.15.2…3.17.2 compare view
- 3.16.0 release · 3.17.0 release · 3.17.2 release
- DRF settings reference (for
COERCE_BIGINT_TO_STRING,COERCE_DECIMAL_TO_STRING)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps djangorestframework from 3.15.2 to 3.17.2.
Release notes
Sourced from djangorestframework's releases.
... (truncated)
Commits
ad309f3Release 3.17.2 (#10014)2912dc9EnforceDATA_UPLOAD_MAX_MEMORY_SIZEforrequest.dataparsing (#10013)71f8194Fix disclosure of GET-protected data in case of validation error with `AdminR...22e231cPrepare bug fix release 3.17.1 (#9931)8e99b53Add condition to skip pushed tags from forks (#9924)c0407deFixHTMLFormRendererwith emptydatetimevalues (#9928)30d58a7Fix the book sizing in the documentation (#9926)6f03b79Tweak order of changes in release notes021ab56Bump version and update release notes for 3.17.0 (#9921)19ebad7Bump mkdocs-material[imaging] from 9.7.4 to 9.7.5 (#9923)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.