From 88bd0a906151736290a03dbed4a164514c9fe004 Mon Sep 17 00:00:00 2001 From: Conor Schaefer Date: Thu, 27 Aug 2026 17:11:18 -0700 Subject: [PATCH 1/7] fix: support selinux in compose mounts When SELinux is set to enforcing, we need the "z" flag on volume mounts to ensure that the mounted files are labeled correctly. Follow-up to https://github.com/freedomofpress/securedrop.org/pull/1566 --- docker-compose.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yaml b/docker-compose.yaml index b60981ff..7a261c6c 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -14,7 +14,7 @@ services: ports: - '127.0.0.1:5432:5432' volumes: - - ./:/django:ro + - ./:/django:ro,z environment: POSTGRES_PASSWORD: *db-password POSTGRES_USER: *db-username From 497888fcd5a4832a4dd07147bd670c88ea67cd1a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 30 Aug 2026 11:42:46 +0000 Subject: [PATCH 2/7] build(deps): bump https://github.com/adamchainz/django-upgrade Bumps [https://github.com/adamchainz/django-upgrade](https://github.com/adamchainz/django-upgrade) from 1.31.1 to 1.32.0. - [Changelog](https://github.com/adamchainz/django-upgrade/blob/main/docs/changelog.rst) - [Commits](https://github.com/adamchainz/django-upgrade/compare/1.31.1...1.32.0) --- updated-dependencies: - dependency-name: https://github.com/adamchainz/django-upgrade dependency-version: 1.32.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .pre-commit-config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index dd745b4b..58a04c19 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,6 +1,6 @@ repos: - repo: https://github.com/adamchainz/django-upgrade - rev: 1.31.1 + rev: 1.32.0 hooks: - id: django-upgrade args: [--target-version, '5.2'] From 0a5c0f34ae21f2bc3fd3e96935b05ea431619789 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 30 Aug 2026 11:42:50 +0000 Subject: [PATCH 3/7] build(deps): bump https://github.com/astral-sh/ruff-pre-commit Bumps [https://github.com/astral-sh/ruff-pre-commit](https://github.com/astral-sh/ruff-pre-commit) from v0.16.3 to 0.16.4. - [Release notes](https://github.com/astral-sh/ruff-pre-commit/releases) - [Commits](https://github.com/astral-sh/ruff-pre-commit/compare/v0.16.3...v0.16.4) --- updated-dependencies: - dependency-name: https://github.com/astral-sh/ruff-pre-commit dependency-version: 0.16.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- .pre-commit-config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index dd745b4b..17847f7f 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -25,7 +25,7 @@ repos: - id: check-yaml - repo: https://github.com/astral-sh/ruff-pre-commit - rev: v0.16.3 + rev: v0.16.4 hooks: - id: ruff-check args: [--fix] From 048987d072ad5ed320453fb89174d14a2d60456a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 30 Aug 2026 11:42:55 +0000 Subject: [PATCH 4/7] build(deps): bump taiki-e/install-action from 2.86.1 to 2.86.6 Bumps [taiki-e/install-action](https://github.com/taiki-e/install-action) from 2.86.1 to 2.86.6. - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/taiki-e/install-action/compare/288e746965032cfcc232e09af2daf5f23c14d780...6cd13508893c0e7eab5f273c2575d3859bd7229a) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.86.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/check.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml index 7844c755..870f2a18 100644 --- a/.github/workflows/check.yaml +++ b/.github/workflows/check.yaml @@ -72,7 +72,7 @@ jobs: persist-credentials: false - name: Install just - uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1 + uses: taiki-e/install-action@6cd13508893c0e7eab5f273c2575d3859bd7229a # v2.86.6 with: tool: just @@ -143,7 +143,7 @@ jobs: docker image tag "$IMAGE_NODE_URL" localhost/securedroporg-node - name: Install just - uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1 + uses: taiki-e/install-action@6cd13508893c0e7eab5f273c2575d3859bd7229a # v2.86.6 with: tool: just From 15bfd93596425ea51f783a5046efe9930e31fa5e Mon Sep 17 00:00:00 2001 From: Paul Schreiber Date: Thu, 27 Aug 2026 21:09:21 -0400 Subject: [PATCH 5/7] build: update postgres from 14 to 17 --- docker-compose.yaml | 2 +- prod-docker-compose.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.yaml b/docker-compose.yaml index 7a261c6c..bde45716 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -9,7 +9,7 @@ x-variables: services: postgresql: - image: docker.io/library/postgres:14 + image: docker.io/library/postgres:17 init: true ports: - '127.0.0.1:5432:5432' diff --git a/prod-docker-compose.yaml b/prod-docker-compose.yaml index 07fdace9..a829d8a3 100644 --- a/prod-docker-compose.yaml +++ b/prod-docker-compose.yaml @@ -3,7 +3,7 @@ networks: app: services: postgresql: - image: docker.io/library/postgres:14 + image: docker.io/library/postgres:17 init: true ports: - '5432' From 414f5ff86a78023457333477411a23b7e02bce89 Mon Sep 17 00:00:00 2001 From: Paul Schreiber Date: Mon, 31 Aug 2026 22:36:12 -0400 Subject: [PATCH 6/7] build: ignore hadolint DL3066 errors; same as FPF/PFT --- .hadolint.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.hadolint.yaml b/.hadolint.yaml index 25dbf056..71e9b335 100644 --- a/.hadolint.yaml +++ b/.hadolint.yaml @@ -5,3 +5,7 @@ ignored: # builds silently whenever Debian trixie rotates a version, for no real # reproducibility gain. - DL3008 + # We ensure that containers are run in prod with `runAsUser: 1000`, + # and also port dev UIDs into the container build, so we're sufficiently + # defensive about UIDs within the container. + - DL3066 From 98f035594cb94abdd5fda0ae3e16fa25d6479b13 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 2 Sep 2026 00:01:46 +0000 Subject: [PATCH 7/7] build(deps): bump djangorestframework from 3.17.1 to 3.17.2 Bumps [djangorestframework](https://github.com/encode/django-rest-framework) from 3.17.1 to 3.17.2. - [Release notes](https://github.com/encode/django-rest-framework/releases) - [Commits](https://github.com/encode/django-rest-framework/compare/3.17.1...3.17.2) --- updated-dependencies: - dependency-name: djangorestframework dependency-version: 3.17.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- dev-requirements.txt | 6 +++--- requirements.txt | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/dev-requirements.txt b/dev-requirements.txt index 93fbfa49..26ddccb7 100644 --- a/dev-requirements.txt +++ b/dev-requirements.txt @@ -474,9 +474,9 @@ django-webpack-loader==3.2.4 \ --hash=sha256:0a253113ea6b150403cd2de802e732872c1d5e3185f0ad4a7fac673c00ae5af2 \ --hash=sha256:a9d345746ae4d0700b9a86a7f0683ab8282c56a3a32736070f27ad658a9bfcb2 # via -r requirements.txt -djangorestframework==3.17.1 \ - --hash=sha256:a6def5f447fe78ff853bff1d47a3c59bf38f5434b031780b351b0c73a62db1a5 \ - --hash=sha256:c3c74dd3e83a5a3efc37b3c18d92bd6f86a6791c7b7d4dff62bb068500e76457 +djangorestframework==3.17.2 \ + --hash=sha256:89ed713b6dc83e1539f214b7d10808ae19bb8511004beba886225da6d5c9dafa \ + --hash=sha256:cb0546a7415d5b46c04e0f4fe0a54b2109f4fdd5e83ca773c8c6183a6493d042 # via # -r requirements.txt # wagtail diff --git a/requirements.txt b/requirements.txt index 4d1e0e96..e54521ab 100644 --- a/requirements.txt +++ b/requirements.txt @@ -337,9 +337,9 @@ django-webpack-loader==3.2.4 \ --hash=sha256:0a253113ea6b150403cd2de802e732872c1d5e3185f0ad4a7fac673c00ae5af2 \ --hash=sha256:a9d345746ae4d0700b9a86a7f0683ab8282c56a3a32736070f27ad658a9bfcb2 # via -r requirements.in -djangorestframework==3.17.1 \ - --hash=sha256:a6def5f447fe78ff853bff1d47a3c59bf38f5434b031780b351b0c73a62db1a5 \ - --hash=sha256:c3c74dd3e83a5a3efc37b3c18d92bd6f86a6791c7b7d4dff62bb068500e76457 +djangorestframework==3.17.2 \ + --hash=sha256:89ed713b6dc83e1539f214b7d10808ae19bb8511004beba886225da6d5c9dafa \ + --hash=sha256:cb0546a7415d5b46c04e0f4fe0a54b2109f4fdd5e83ca773c8c6183a6493d042 # via # -r requirements.in # wagtail