# Django 2.2.19 security update
**URL:** https://discuss.openedx.org/t/django-2-2-19-security-update/4305
**Category:** Build-Test-Release
**Created:** [February 19, 2021, 1:08pm UTC](https://discuss.openedx.org/t/django-2-2-19-security-update/4305 "2021-02-19T13:08:03Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@nedbat](https://discuss.openedx.org/u/nedbat)
#### Post date: [February 19, 2021, 1:08pm UTC](https://discuss.openedx.org/t/django-2-2-19-security-update/4305/1 "2021-02-19T13:08:03Z")
When Django issues security releases, the release manager updates the pinned Django versions in the appropriate community release repos.
I just did that for Django 2.2.19, released today. The **`open-release/koa.master`** branch is updated.
* * *
I’m trying to record how release tasks get done, so:
I have a directory with the [33 branched koa repos](https://discuss.openedx.org/t/the-repos-that-will-be-marked-for-koa/3586) checked out, and I have the [gittree and gittreeif bash functions](https://discuss.openedx.org/t/how-i-work-with-many-git-repos-at-once/3412) available in my shell.
Then:
```bash
export BRANCH=open-release/koa.master
export NEWVER=2.2.19
gittree git fetch --all
gittreeif origin/$BRANCH "git checkout $BRANCH; git pull; git status -s -b"
gittreeif origin/$BRANCH git branch --set-upstream-to=origin/$BRANCH $BRANCH
# Eyeball the current Django state
gittreeif origin/$BRANCH -q pwd | while read d; do rg -i '^django==' -g '*.in' -g '*.txt' $d | sed 's/#.*//'; done
# Create a shell script to make the change
gittreeif origin/$BRANCH -q pwd | while read d; do rg -n -i '^django==2\.2\.' -g '*.in' -g '*.txt' $d | awk -F: "{print \"sed -E -i '' '\" \$2 \"s/==2\\\\.2\\\\.[0-9]+/==$NEWVER/' \" \$1 \" # \" \$3}" ; done > /tmp/doit.sh
# Run the shell script
source /tmp/doit.sh
# Eyeball what the shell script did
gittreeif origin/$BRANCH git status -s -b
GIT_PAGER=cat gittreeif origin/$BRANCH git diff
# Commit the changes
gittreeif origin/$BRANCH git commit -am "chore: upgrade Django to $NEWVER"
gittreeif origin/$BRANCH git push
# Check that everything is clean.
gittreeif origin/$BRANCH git status -s -b
```
---
### Author:  [@sambapete](https://discuss.openedx.org/u/sambapete)
#### Post date: [February 19, 2021, 3:27pm UTC](https://discuss.openedx.org/t/django-2-2-19-security-update/4305/2 "2021-02-19T15:27:09Z")
I will be honest I had not looked at your instructions or bash functions yet. And each time there was a new Django security update, I needed to do some things manually in our fork.
This morning I just looked at them and adapted them for our fork. Well, I needed to run “brew install ripgrep” because I didn’t have “rg” installed on my mac, but apart from that, very nice indeed!
Thanks Ned for sharing the instructions and your gittree and gittreeif bash functions. Incredibly useful.
---
### Author:  [@nedbat](https://discuss.openedx.org/u/nedbat)
#### Post date: [May 13, 2021, 9:43am UTC](https://discuss.openedx.org/t/django-2-2-19-security-update/4305/3 "2021-05-13T09:43:43Z")
Recently we also had a django-debug-toolbar upgrade, so I further generalized the patch application steps:
```auto
# Define the branch to work on
export BRANCH=open-release/lilac.master
# What package are we upgrading? From what maj.min to what new version?
export PKG=Django OLDMAJ=2 OLDMIN=2 NEWVER=2.2.23
gittree git fetch --all
gittreeif origin/$BRANCH "git switch $BRANCH; git pull; git status -s -b"
gittreeif origin/$BRANCH git branch --set-upstream-to=origin/$BRANCH $BRANCH
# Eyeball the current state
gittreeif origin/$BRANCH -q pwd | while read d; do rg -i "^${PKG}==" -g '*.in' -g '*.txt' $d | sed 's/#.*//'; done
# Create a shell script to make the change
gittreeif origin/$BRANCH -q pwd | while read d; do rg -n -i "^${PKG}==${OLDMAJ}\.${OLDMIN}" -g '*.in' -g '*.txt' $d | awk -F: "{print \"sed -E -i '' '\" \$2 \"s/==${OLDMAJ}\\\\.${OLDMIN}(\\\\.[0-9]+)?/==$NEWVER/' \" \$1 \" # \" \$3}" ; done > /tmp/doit.sh
# Run the shell script
source /tmp/doit.sh
# Eyeball what the shell script did
gittreeif origin/$BRANCH git status -s -b
GIT_PAGER=cat gittreeif origin/$BRANCH git diff
# Commit the changes
gittreeif origin/$BRANCH git commit -am "chore: upgrade ${PKG} to ${NEWVER}"
gittreeif origin/$BRANCH git push
# Check that everything is clean.
gittreeif origin/$BRANCH git status -s -b
```
---
### Author:  [@mtyaka](https://discuss.openedx.org/u/mtyaka)
#### Post date: [October 20, 2022, 6:53am UTC](https://discuss.openedx.org/t/django-2-2-19-security-update/4305/4 "2022-10-20T06:53:24Z")
I’ve been working on [applying the django patch to olive.master](https://github.com/openedx/build-test-release-wg/issues/201), but because I don’t have push rights to all repositories involved in the patch, I modified the above script to open PRs instead of pushing the change directly.
I used the [Github CLI tool](https://cli.github.com/) to create the pull requests.
I followed the steps above up until pushing to the upstream branches, and then performed these steps:
```auto
# Checkout a custom branch
gittreeif origin/$BRANCH git checkout -b mtyaka/patch-django
# Commit the changes
gittreeif origin/$BRANCH git commit -am "chore: upgrade ${PKG} to ${NEWVER}"
# Authenticate the Github CLI tool
gh auth login
# Create personal forks of all repos
gittreeif origin/$BRANCH gh repo fork --remote=true --remote-name=mtyaka
# Push to the fork
gittreeif origin/$BRANCH git push --set-upstream mtyaka
# Create pull requests
gittreeif origin/$BRANCH /bin/sh -c 'if [`git log $BRANCH..HEAD | wc -c` -gt 0]; then gh pr create --repo $(git remote get-url origin | sed s/git@github.com:// | sed s/.git//) --base $BRANCH --title "chore: upgrade ${PKG} to ${NEWVER}" --body "See: https://github.com/openedx/build-test-release-wg/issues/201"; fi'
```