Merge main and fix conflicts

Signed-off-by: tdruez <tdruez@nexb.com>

Author: tdruez

.github/workflows/create-github-release.yml

@@ -16,3 +16,4 @@ jobs:
         with:
           generate_release_notes: true
           draft: false
+          files: dist/*

.github/workflows/run-unit-tests.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "3.13"
 
       - name: Install python-ldap OS dependencies
         run: |

.readthedocs.yaml

@@ -8,7 +8,7 @@ version: 2
 build:
   os: ubuntu-22.04
   tools:
-    python: "3.12"
+    python: "3.13"
 
 # Optionally declare the Python requirements required to build your docs
 python:

CHANGELOG.rst

@@ -1,6 +1,16 @@
 Release notes
 =============
 
+### Version 5.3.1-dev (unreleased)
+
+- Upgrade Python version to 3.13 and Django to 5.2.x
+  https://github.com/aboutcode-org/dejacode/pull/315
+  https://github.com/aboutcode-org/dejacode/pull/312
+
+- Add new `is_locked` "Locked inventory" field to the ProductStatus model.
+  When a Product is locked through his status, its inventory cannot be modified.
+  https://github.com/aboutcode-org/dejacode/issues/189
+
 ### Version 5.3.0
 
 - Rename ProductDependency is_resolved to is_pinned.

Dockerfile

@@ -6,7 +6,7 @@
 # See https://aboutcode.org for more information about AboutCode FOSS projects.
 #
 
-FROM python:3.12-slim
+FROM python:3.13-slim
 
 LABEL org.opencontainers.image.source="https://github.com/aboutcode-org/dejacode"
 LABEL org.opencontainers.image.description="DejaCode"

Makefile

@@ -6,7 +6,7 @@
 # See https://aboutcode.org for more information about AboutCode FOSS projects.
 #
 
-PYTHON_EXE=python3.12
+PYTHON_EXE=python3.13
 VENV_LOCATION=.venv
 ACTIVATE?=. ${VENV_LOCATION}/bin/activate;
 MANAGE=${VENV_LOCATION}/bin/python manage.py
@@ -136,7 +136,7 @@ postgresdb_clean:
 	@${SUDO_POSTGRES} dropuser '${DB_USERNAME}' || true
 
 run:
-	${MANAGE} runserver 8000 --insecure
+	DJANGO_RUNSERVER_HIDE_WARNING=true ${MANAGE} runserver 8000 --insecure
 
 worker:
 	${MANAGE} rqworker

component_catalog/api.py

@@ -11,16 +11,13 @@
 from django.db import transaction
 from django.forms.widgets import HiddenInput
 
-import coreapi
-import coreschema
 import django_filters
 from packageurl.contrib import url2purl
 from packageurl.contrib.django.filters import PackageURLFilter
 from rest_framework import serializers
 from rest_framework.decorators import action
 from rest_framework.fields import ListField
 from rest_framework.response import Response
-from rest_framework.schemas import AutoSchema
 
 from component_catalog.admin import ComponentAdmin
 from component_catalog.admin import PackageAdmin
@@ -967,24 +964,7 @@ def download_scan_data(self, request, uuid):
             content_type="application/zip",
         )
 
-    download_url_description = (
-        "A single, or list of, Download URL(s).<br><br>"
-        '<b>cURL style</b>: <code>-d "download_url=url1&download_url=url2"</code><br><br>'
-        '<b>Python</b>: <code>data = {"download_url": ["url1", "url2"]}</code>'
-    )
-
-    add_action_schema = AutoSchema(
-        manual_fields=[
-            coreapi.Field(
-                "download_url",
-                required=True,
-                location="body",
-                schema=coreschema.String(description=download_url_description),
-            ),
-        ]
-    )
-
-    @action(detail=False, methods=["post"], name="Package Add", schema=add_action_schema)
+    @action(detail=False, methods=["post"], name="Package Add")
     def add(self, request):
         """
         Alternative way to add a package providing only its `download_url`.

component_catalog/forms.py

@@ -624,8 +624,11 @@ def __init__(self, user, *args, **kwargs):
         super().__init__(user, *args, **kwargs)
 
         product_field = self.fields["product"]
-        perms = ["view_product", "change_product"]
-        product_field.queryset = Product.objects.get_queryset(user, perms=perms)
+        product_field.queryset = Product.objects.get_queryset(
+            user=user,
+            perms=["view_product", "change_product"],
+            exclude_locked=True,
+        )
 
         if relation_instance:
             help_text = f'"{relation_instance}" will be assigned to the selected product.'
@@ -709,7 +712,9 @@ def __init__(self, request, model, relation_model, *args, **kwargs):
         self.relation_model = relation_model
         self.dataspace = request.user.dataspace
         self.fields["product"].queryset = Product.objects.get_queryset(
-            request.user, perms=["view_product", "change_product"]
+            user=request.user,
+            perms=["view_product", "change_product"],
+            exclude_locked=True,
         )
 
     def get_selected_objects(self):

component_catalog/tests/test_admin.py

@@ -230,7 +230,10 @@ def test_component_admin_form_clean(self):
         del data["name"]
         response = self.client.post(url, data)
         self.assertContains(response, '<p class="errornote">Please correct the error below.</p>')
-        self.assertContains(response, '<ul class="errorlist"><li>This field is required.</li>')
+        self.assertContains(
+            response,
+            '<ul class="errorlist" id="id_name_error"><li>This field is required.</li></ul>',
+        )
 
     @override_settings(REFERENCE_DATASPACE="Dataspace")
     def test_component_admin_form_clean_validate_against_reference_data(self):

dejacode/__init__.py

@@ -14,7 +14,7 @@
 
 import git
 
-VERSION = "5.3.0"
+VERSION = "5.3.1-dev"
 
 PROJECT_DIR = Path(__file__).resolve().parent
 ROOT_DIR = PROJECT_DIR.parent