Skip to content

Update project dependencies#432

Draft
paulapreuss wants to merge 9 commits intomainfrom
fix/security
Draft

Update project dependencies#432
paulapreuss wants to merge 9 commits intomainfrom
fix/security

Conversation

@paulapreuss
Copy link

@paulapreuss paulapreuss commented Jan 15, 2026

OpenPlan is currently based on python 3.9, which has already reached it's EoL, and Django 4.2, which has its long term support (LTS) phase also ending at the end of the year. Additionally, most project dependencies have not been updated in a long time, posing possible security issues, among other things.

This PR aims to upgrade the project to python 3.12 and Django 5.2 (as a compromise between a jump to all latest versions and moving to versions that have at least two years of long term support ahead). Other project dependencies will also be checked for upgrades.

Within this PR, oemof packages are also upgraded to oemof-solph==0.5.7 and oemof-thermal==0.0.8. Will have to do some testing. Likely these versions were pinned to be in sync with MVS, but since we are moving away from MVS we will need to update anyway. The upgrade was necessary, since the package dependencies were not compatible with python 3.12.

Closes #399

TODO:

  • Check and potentially update security settings
  • Update README
  • Update local deploy settings / instructions

@paulapreuss paulapreuss force-pushed the fix/security branch 2 times, most recently from 1a0275b to f412f35 Compare January 15, 2026 15:05
Copy link

@Bachibouzouk Bachibouzouk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just though yesterday that we were due to update django. Shouldn't we unpin the dependencies ? I would keep a file with pinned dependencies but use the one with unpinned such that we always get the latest updates when we deploy (we could setup a scheduled job to build using the unpinned requirements and be notifyed when it fails). If it fails and it is a friday or one day before a workshop and one has no time, we can fallback on the pinned dependencies and leave it as TODO to fix the dependencies later.

whitenoise==6.9.0
django-q2==1.9.0
django-sass-processor==1.4.2
exchangelib==5.6.0

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't need exchangelib anymore :)

jsonschema==4.26.0
libsass==0.23.0
numpy==1.26.4
oemof-solph==0.5.5 # numpy version uses distutils which was removed in python 3.12

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't need oemof-solph if I am not mistaken, we will need oemof-datapackage as I updated in #422 and this will install solph

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Update dependencies

2 participants