django 3 end-of-life

[felschr]

django 3 support is scheduled to end on 2024-04-01: https://endoflife.date/django

Etebase server should be updated to django 4 (or 5 once released) to prevent issues e.g. with downstream packages.

Downstream NixOS issue: NixOS/nixpkgs#262907

[tasn]

Thanks! I can't believe it's already been this long that Django 3 is EOL. :)

[felschr]

EOL has been pushed back slightly to 2024-04-30.
Still, it's just a little more than a month away.

[s1ls]

I don't think I'll be using etesync in future as it can't be trusted if it continues using an insecure database backend.
Or is there anything done here?

Edit: Saw your lack of free time, apologies for my harsh words, I'll consider contributing

[shimunn]

Etesync is end to end encrypted, precisely for this reason, not having to trust the server. Additionally for an software to be eol does not imply insecure straight away.

[s1ls]

True, but as Django has not to few CVEs I wouldn't count on it's security (if its an unmaintained version)

[tasn]

The annoying this is that we don't really use Django almost at all, it's just for the ORM.

I could have sworn there was a ticket somewhere else by someone working on converting the queries to SQLAlchemy.

[tasn]

Done, sorry for the delay!

I was hoping we would be on SQLAlchemy by now, but I guess upgrading it to version 4 until that happens is better.