[Snyk] Fix for 26 vulnerabilities

[robertatakenaka]

Snyk has created this PR to fix 26 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

• requirements/production.txt

⚠️ Warning

django-extensions 3.2.1 requires Django, which is not installed.
django-debug-toolbar 3.8.1 requires django, which is not installed.
django-debug-toolbar 3.8.1 requires sqlparse, which is not installed.
django-anymail 11.1 requires django, which is not installed.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.
• Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Improper Output Neutralization for Logs
🦉 SQL Injection
🦉 More lessons are available in Snyk Learn

[Copilot]

Pull request overview

Updates production Python dependencies to address Snyk-reported vulnerabilities.

Changes:

• Bumps gunicorn to 23.0.0 and sentry-sdk to 2.8.0.
• Adds new direct vulnerability-driven constraints for django, sqlparse, and zipp in requirements/production.txt.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Minor formatting: other lines in this file use two spaces before inline comments (e.g., gevent==... # ...), but sentry-sdk==2.8.0 # ... uses a single space. Consider normalizing spacing for consistency.

[Copilot]

production.txt already includes -r base.txt, and base.txt pins django==4.1.6 (requirements/base.txt:15). Adding django>=4.2.27 here creates an unsatisfiable constraint (==4.1.6 vs >=4.2.27) and will cause pip install -r requirements/production.txt to fail. Align the Django constraint by updating the pin in base.txt to the intended secure version (or remove the duplicate constraint here if base.txt is the source of truth).

Suggested change

django>=4.2.27 # not directly required, pinned by Snyk to avoid a vulnerability

[Copilot]

These new Snyk pins use >= in a file that otherwise pins production deps with ==, which makes production installs non-deterministic and could pull in future major versions (e.g., Django 5.x) without review. Prefer an exact pin (or at least an upper bound like <5) consistent with the rest of this file, ideally managed in the same place as other pins (e.g., base.txt).

Suggested change

	django>=4.2.27 # not directly required, pinned by Snyk to avoid a vulnerability
	sqlparse>=0.5.4 # not directly required, pinned by Snyk to avoid a vulnerability
	zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability
	django==4.2.27 # not directly required, pinned by Snyk to avoid a vulnerability
	sqlparse==0.5.4 # not directly required, pinned by Snyk to avoid a vulnerability
	zipp==3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability

[Copilot]

The header says to avoid production dependencies that aren't in development (-r base.txt is intended to keep envs aligned). Adding direct vulnerability pins only in production.txt means local/dev installs from requirements/local.txt won't match production. Consider moving these vulnerability-driven constraints into base.txt so all environments exercise the same dependency set.

Suggested change

	elastic-apm==6.15.1
	django>=4.2.27 # not directly required, pinned by Snyk to avoid a vulnerability
	sqlparse>=0.5.4 # not directly required, pinned by Snyk to avoid a vulnerability
	zipp>=3.19.1 # not directly required, pinned by Snyk to avoid a vulnerability
	elastic-apm==6.15.1