starred/ArchiveBox

Fork 0

mirror of https://github.com/ArchiveBox/ArchiveBox.git synced 2026-04-26 01:26:00 +03:00

[GH-ISSUE #988] Refactor: Remove dependency on old Django admin internal templates (+ bump Django from 3.1 to >=3.2) #2124

New issue

Closed

opened 2026-03-01 17:56:40 +03:00 by kerem · 6 comments

kerem commented

2026-03-01 17:56:40 +03:00

Owner

Originally created by @Jonasmadsen on GitHub (Jun 12, 2022).
Original GitHub issue: https://github.com/ArchiveBox/ArchiveBox/issues/988

Currently archivebox uses django: "django>=3.1.3,<3.2" as defined in setup.py
However according to the django website:
https://www.djangoproject.com/download/
3.1.14 has been unsupported for quite a while.
This has some security implications and should be updated to django 3.2 (LTS) or newer.

I tried just updating the dependency to "django>=3.2,<3.3" but the test fails.
Unfortunately, there are breaking changes so it is not a simple version bump.

If anyone has a good idea of the scope of changes needed that would be great.
Love the project!

Originally created by @Jonasmadsen on GitHub (Jun 12, 2022). Original GitHub issue: https://github.com/ArchiveBox/ArchiveBox/issues/988 Currently archivebox uses django: "django>=3.1.3,<3.2" as defined in setup.py However according to the django website: https://www.djangoproject.com/download/ 3.1.14 has been unsupported for quite a while. This has some security implications and should be updated to django 3.2 (LTS) or newer. I tried just updating the dependency to "django>=3.2,<3.3" but the test fails. Unfortunately, there are breaking changes so it is not a simple version bump. If anyone has a good idea of the scope of changes needed that would be great. Love the project!

kerem

2026-03-01 17:56:40 +03:00

closed this issue
added the
size: hard

status: done

expected: next release

why: security

status: backlog

touches: API/CLI/Spec

touches: dependencies/packaging

touches: js
labels

kerem commented

2026-03-01 17:56:41 +03:00

Author

Owner

@pirate commented on GitHub (Jun 13, 2022):

The changes are unfortunately complicated because I use some internal Django template components to build the UI (specifically the table-view action buttons), and those components were completely rewritten after 3.1.

@pirate commented on GitHub (Jun 13, 2022): The changes are unfortunately complicated because I use some internal Django template components to build the UI (specifically the table-view action buttons), and those components were completely rewritten after 3.1.

kerem commented

2026-03-01 17:56:42 +03:00

Author

Owner

@caj-larsson commented on GitHub (Jul 17, 2022):

@pirate I know you are working on something of rewrite of much of the internals, do you have any plans on the template side of things? I decided to see how hard this would be and it seems to be no exaggeration that is quite a bit of work because of the usage of admin template/widgets.

Is it time to rebuild the foundation of the UI, if so got any thoughts on the direction?
If not, have you done any research on what needs to be done or suggestions to make this easier?

@caj-larsson commented on GitHub (Jul 17, 2022): @pirate I know you are working on something of rewrite of much of the internals, do you have any plans on the template side of things? I decided to see how hard this would be and it seems to be no exaggeration that is quite a bit of work because of the usage of admin template/widgets. Is it time to rebuild the foundation of the UI, if so got any thoughts on the direction? If not, have you done any research on what needs to be done or suggestions to make this easier?

kerem commented

2026-03-01 17:56:42 +03:00

Author

Owner

@pirate commented on GitHub (Nov 28, 2022):

My inclination is to bridge the gap temporarily by including the old template files from the previous Django version's source code manually. I can create some template overrides that point to the old Django version for just the files needed, and default to all the newer files for everything else.

Then we can go through and rewrite those components/ remove the dependency on unstable Django internals entirely.

I knew this would be a pain eventually when I depended on those unstable templates but tbh they saved me a ton of dev time early on so I don't entirely regret incurring that tech debt.

In regards to the security fixes, last time I checked (2022/05) the two Django 3.1 CVEs were not hit by archivebox code paths, which is why I didn't push an urgent fix, however there may be newer CVEs since then that I haven't checked yet.

@pirate commented on GitHub (Nov 28, 2022): My inclination is to bridge the gap temporarily by including the old template files from the previous Django version's source code manually. I can create some template overrides that point to the old Django version for just the files needed, and default to all the newer files for everything else. Then we can go through and rewrite those components/ remove the dependency on unstable Django internals entirely. I knew this would be a pain eventually when I depended on those unstable templates but tbh they saved me a ton of dev time early on so I don't entirely regret incurring that tech debt. In regards to the security fixes, last time I checked (2022/05) the two Django 3.1 CVEs were not hit by archivebox code paths, which is why I didn't push an urgent fix, however there may be newer CVEs since then that I haven't checked yet.

kerem commented

2026-03-01 17:56:42 +03:00

Author

Owner

@joepie91 commented on GitHub (Sep 23, 2023):

last time I checked (2022/05) the two Django 3.1 CVEs were not hit by archivebox code paths

For what it's worth, nixpkgs specifies a rather longer list of relevant CVEs:

CVE-2021-45115
CVE-2021-45116
CVE-2021-45452
CVE-2022-23833
CVE-2022-22818
CVE-2022-28347
CVE-2022-28346

Not all of these explicitly mark Django 3.1 as being affected; as I understand it, the reason they are added is because they appeared when 3.1 was already out of support, so it is likely that they also exist in 3.1 but nobody has ever explicitly confirmed that.

@joepie91 commented on GitHub (Sep 23, 2023): > last time I checked (2022/05) the two Django 3.1 CVEs were not hit by archivebox code paths For what it's worth, [nixpkgs specifies](https://github.com/NixOS/nixpkgs/commit/067314d87fef67f713a06b64042da4e7442c851f) a rather longer list of relevant CVEs: - CVE-2021-45115 - CVE-2021-45116 - CVE-2021-45452 - CVE-2022-23833 - CVE-2022-22818 - CVE-2022-28347 - CVE-2022-28346 Not all of these explicitly mark Django 3.1 as being affected; as I understand it, the reason they are added is because they appeared when 3.1 was already out of support, so it is *likely* that they also exist in 3.1 but nobody has ever explicitly confirmed that.

kerem commented

2026-03-01 17:56:42 +03:00

Author

Owner

@pirate commented on GitHub (Oct 19, 2023):

For now I have manually verified all of these CVEs, luckily ArchiveBox is not affected by any as we don't use the vulnerable code paths. Upgrading Django is still high on my priority list, but I'm not worried about security concerns unless other CVEs are announced that we are vulnerable to (and I have subscribed to notifications for this with Dependabot).

I also recommend everyone check out our new dedicated Security section on Github: https://github.com/ArchiveBox/ArchiveBox/security

You can subscribe to advisories and keep an eye our for new CVE announcements there too.

I understand this is causing trouble for our friends who help repackage archivebox for nix, arch, and other platforms that only offer newer Django releases. Sorry! Fixing this dependency is the next major internal work on my todo list.

@pirate commented on GitHub (Oct 19, 2023): For now I have manually verified all of these CVEs, luckily ArchiveBox is not affected by any as we don't use the vulnerable code paths. Upgrading Django is still high on my priority list, but I'm not worried about security concerns unless other CVEs are announced that we are vulnerable to (and I have subscribed to notifications for this with Dependabot). I also recommend everyone check out our new dedicated Security section on Github: https://github.com/ArchiveBox/ArchiveBox/security You can subscribe to advisories and keep an eye our for new CVE announcements there too. I understand this is causing trouble for our friends who help repackage archivebox for nix, arch, and other platforms that only offer newer Django releases. Sorry! Fixing this dependency is the next major internal work on my todo list.

kerem commented

2026-03-01 17:56:42 +03:00

Author

Owner

@pirate commented on GitHub (Mar 26, 2024):

Huge thanks @jimwins for doing this! https://github.com/ArchiveBox/ArchiveBox/pull/1388

@pirate commented on GitHub (Mar 26, 2024): Huge thanks @jimwins for doing this! https://github.com/ArchiveBox/ArchiveBox/pull/1388

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/ArchiveBox#2124

No description provided.

Rows
Columns