merge patches from 2.10.2

.github/workflows/check-test-names.yml

@@ -11,20 +11,31 @@ jobs:
     runs-on: ubuntu-latest
     name: Check test naming convention
     steps:
+    # This job runs on pull_request_target, so it has a write token and access
+    # to secrets even when the pull request comes from a fork. Nothing from the
+    # pull request may be checked out or executed here: no build, no install,
+    # no running its tests or scripts. Leaving this checkout bare keeps us on
+    # the default branch, and that is the only reason it is safe to run
+    # check_test_names.py below. Adding a ref: pointing at the pull request
+    # head would hand its author our credentials.
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
         persist-credentials: false
 
+    # Fetch only. The head is read as data by git diff, never checked out.
     - name: Fetch PR head
       run: git fetch origin "+refs/pull/${PR_NUMBER}/head:refs/remotes/pull/head"
       env:
         PR_NUMBER: ${{ github.event.pull_request.number }}
 
     - name: Check new test names
       id: check
+      env:
+        BASE_REF: ${{ github.event.pull_request.base.ref }}
       run: |
-        merge_base=$(git merge-base HEAD refs/remotes/pull/head)
+        # Name the base branch explicitly; HEAD is not it
+        merge_base=$(git merge-base "origin/$BASE_REF" refs/remotes/pull/head)
         output=$(git diff "$merge_base" refs/remotes/pull/head --unified=0 | python3 checks/check_test_names.py --stdin --format markdown 2>&1) && has_violations=false || has_violations=true
         echo "$output"
         {

.github/workflows/publish-test-results.yml

@@ -34,7 +34,7 @@ jobs:
            done
 
       - name: "Publish test results"
-        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
+        uses: EnricoMi/publish-unit-test-result-action@7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d # v2.25.0
         with:
           commit: ${{ github.event.workflow_run.head_sha }}
           check_name: "Test results"

.github/workflows/python.yml

@@ -112,7 +112,7 @@ jobs:
 
     - name: Upload test reports (${{ matrix.python-version }})
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: test-reports-${{ matrix.python-version }}
         path: |

.github/workflows/trigger-argus-docker.yml

@@ -10,7 +10,7 @@ jobs:
     steps:
       - name: Generate an installation access token
         id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}

CHANGELOG.md

@@ -8,6 +8,63 @@ This project uses [*towncrier*](https://towncrier.readthedocs.io/) and the chang
 
 <!-- towncrier release notes start -->
 
+## [2.10.2] - 2026-10-22
+
+Mini-release. The most important bit is fixing a dependency problem
+that affects the task queue. The most visible bit is "Level" in the
+filter box should no longer magically flip to the middle position for
+no reason.
+
+Do upgrade if:
+
+- using Argus to send notifications
+- using the planned maintenance subsystem
+
+### Added
+
+- Added options to set base url for source created with management
+  command `create_source`
+  ([#2081](https://github.com/Uninett/Argus/issues/2081))
+
+### Changed
+
+- Altered helper function `get_version()` so that it either returns
+  a valid version string for Argus, or "unknown", and nothing else.
+  ([#2061](https://github.com/Uninett/Argus/issues/2061))
+- We now explicitly depend on "django-tasks" since how "django-tasks-db"
+  depends on "django-tasks" has changed. We cannot do it the new way, by
+  depending on "django-tasks-db[compat]", since that conflicts with
+  Django 6.1, which we still want to be able to test on.
+
+### Fixed
+
+- Fixed a problem with `maxlevel` in the filter box caused by the
+  default of an HTML range-input defaulting to the middle value if no
+  value is given. It now defaults to the maximum level, "5", as it
+  should. This should cut down on maxlevel suddenly flipping to "3" for
+  apparently no reason.
+  ([#2072](https://github.com/Uninett/Argus/issues/2072))
+- Fixed a dependency issue with the most recent "django-tasks-db", by
+  always depending directly on "django-tasks".
+
+
+## [2.10.1] - 2026-10-21
+
+Security release! Install this version *after* having made sure that the OS
+Argus will run on and the package manager you will use to install Argus with
+have already been updated to a safe version. See also (brief) NOTES.
+
+https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576/4
+
+Do the same for systems running glue services, and ticket systems and
+notification systems under your own control.
+
+### Changed
+
+- Upgraded the sub-dependency "certifi" which bundles TLS root certificates.
+- Upgraded to newest patch-release of Django.
+
+
 ## [2.10.0] - 2026-08-28
 
 This release is the first to suport Django 6.1, and no longer supports Django

NOTES.md

@@ -3,6 +3,19 @@
 This file documents changes to Argus that are relevant for operations,
 customizers and end-users.
 
+## [2.10.1] - 2026-10-21
+
+Security release!
+
+This release is flagged here in NOTES even if it is a patch release to ensure
+that any new installations of Argus use a sufficiently new version of the
+sub-dependency.
+
+If you install Argus and its dependencies *without* using the requirements.txt
+file (for instance with `pip install argus-server`) you can manually update
+"certifi" directly. If you *did* use the requirements.txt to install locked
+versions of the dependencies you should install this upgrade.
+
 ## [2.10.0] - 2026-08-28
 
 This release is the first to suport Django 6.1, and no longer supports Django

constraints.txt

@@ -8,3 +8,5 @@ packaging>=25.0  # fix for setuptools "License-Files" shenanigans
 idna>=3.16
 pyjwt>=2.13.0
 sqlparse>=0.6.0
+certifi>=2026.10.19
+pip>=26.2.2

docs/development/management-commands.rst

@@ -259,6 +259,12 @@ To add a custom source system type, instead of the default `argus`, add the
 
         $ python manage.py create_source -t "Custom type"
 
+To add a base_url add the `-u` flag to the command as such:
+
+    .. code:: console
+
+        $ python manage.py create_source -u "https://example.com"
+
 
 .. _check-token-expiry:
 

requirements-django52.txt

@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.12
+# This file is autogenerated by pip-compile with Python 3.14
 # by the following command:
 #
 #    pip-compile --no-strip-extras --output-file=requirements-django52.txt constraints.txt pyproject.toml requirements/django52.txt
@@ -18,8 +18,9 @@ attrs==25.4.0
     #   -r constraints.txt
     #   jsonschema
     #   referencing
-certifi==2026.2.25
+certifi==2026.10.19
     # via
+    #   -r constraints.txt
     #   httpcore
     #   httpx
     #   requests
@@ -37,7 +38,7 @@ defusedxml==0.7.1
     #   social-auth-core
 dj-database-url==3.1.2
     # via argus-server (pyproject.toml)
-django==5.2.16
+django==5.2.18
     # via
     #   -r requirements/django52.txt
     #   argus-server (pyproject.toml)
@@ -172,14 +173,11 @@ sqlparse==0.6.0
     #   django
 typing-extensions==4.15.0
     # via
-    #   anyio
     #   django-stubs-ext
     #   django-tasks
     #   django-tasks-db
-    #   psycopg
     #   pydantic
     #   pydantic-core
-    #   referencing
     #   typing-inspection
 typing-inspection==0.4.2
     # via pydantic
@@ -193,3 +191,6 @@ wheel==0.46.3
     # via argus-server (pyproject.toml)
 whitenoise==6.12.0
     # via argus-server (pyproject.toml)
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip

requirements-django61.txt

@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.12
+# This file is autogenerated by pip-compile with Python 3.14
 # by the following command:
 #
 #    pip-compile --no-strip-extras --output-file=requirements-django61.txt constraints.txt pyproject.toml requirements/django61.txt
@@ -19,8 +19,9 @@ attrs==26.1.0
     #   -r constraints.txt
     #   jsonschema
     #   referencing
-certifi==2026.7.22
+certifi==2026.10.19
     # via
+    #   -r constraints.txt
     #   httpcore
     #   httpx
     #   requests
@@ -39,7 +40,7 @@ defusedxml==0.7.1
     #   social-auth-core
 dj-database-url==3.1.2
     # via argus-server (pyproject.toml)
-django==6.1
+django==6.1.2
     # via
     #   -r requirements/django61.txt
     #   argus-server (pyproject.toml)
@@ -174,14 +175,11 @@ sqlparse==0.6.0
     #   django
 typing-extensions==4.16.0
     # via
-    #   anyio
     #   django-stubs-ext
     #   django-tasks
     #   django-tasks-db
-    #   psycopg
     #   pydantic
     #   pydantic-core
-    #   referencing
     #   typing-inspection
 typing-inspection==0.4.2
     # via pydantic
@@ -195,3 +193,6 @@ wheel==0.47.0
     # via argus-server (pyproject.toml)
 whitenoise==6.12.0
     # via argus-server (pyproject.toml)
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip

requirements.txt

@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.12
+# This file is autogenerated by pip-compile with Python 3.14
 # by the following command:
 #
 #    pip-compile --no-strip-extras --output-file=requirements-django52.txt constraints.txt pyproject.toml requirements/django52.txt
@@ -18,8 +18,9 @@ attrs==25.4.0
     #   -r constraints.txt
     #   jsonschema
     #   referencing
-certifi==2026.2.25
+certifi==2026.10.19
     # via
+    #   -r constraints.txt
     #   httpcore
     #   httpx
     #   requests
@@ -172,14 +173,11 @@ sqlparse==0.6.0
     #   django
 typing-extensions==4.15.0
     # via
-    #   anyio
     #   django-stubs-ext
     #   django-tasks
     #   django-tasks-db
-    #   psycopg
     #   pydantic
     #   pydantic-core
-    #   referencing
     #   typing-inspection
 typing-inspection==0.4.2
     # via pydantic
@@ -193,3 +191,6 @@ wheel==0.46.3
     # via argus-server (pyproject.toml)
 whitenoise==6.12.0
     # via argus-server (pyproject.toml)
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip

src/argus/incident/management/commands/create_source.py

@@ -14,13 +14,15 @@ def add_arguments(self, parser):
         parser.add_argument(
             "-t", "--source-type", type=str, help="Create/use the source type <source-type> instead of argus"
         )
+        parser.add_argument("-u", "--base-url", type=str, help="Add this base-url to the created source")
 
     def handle(self, *args, **options):
         source = options["source"]
         source_type = options.get("source_type") or "argus"
+        base_url = options.get("base_url") or ""
         if SourceSystem.objects.filter(name=source, type__name=source_type).exists():
             return
         with transaction.atomic():
             user = SourceUserFactory(username=source)
             sst = SourceSystemTypeFactory(name=source_type.lower())
-            SourceSystemFactory(user=user, name=source, type=sst)
+            SourceSystemFactory(user=user, name=source, type=sst, base_url=base_url)

tests/incident/management_commands/test_create_source.py

@@ -35,6 +35,21 @@ def test_create_source_will_create_source_with_set_type(self):
 
         self.assertTrue(SourceSystem.objects.exclude(id__in=previous_source_pks).filter(type_id=source_type).exists())
 
+    def test_create_source_will_create_source_with_set_base_url(self):
+        previous_source_pks = [source.id for source in SourceSystem.objects.all()]
+        source_name = "source name"
+        base_url = "https://example.com"
+        call_command("create_source", source_name, base_url=base_url)
+
+        self.assertTrue(SourceSystem.objects.exclude(id__in=previous_source_pks).filter(base_url=base_url).exists())
+
+    def test_create_source_will_create_source_with_base_url_empty_string_if_not_set(self):
+        previous_source_pks = [source.id for source in SourceSystem.objects.all()]
+        source_name = "source name"
+        call_command("create_source", source_name)
+
+        self.assertTrue(SourceSystem.objects.exclude(id__in=previous_source_pks).filter(base_url="").exists())
+
     def test_create_source_will_use_already_existing_source_system_type(self):
         previous_source_pks = [source.id for source in SourceSystem.objects.all()]
         source_name = "source name"

tox.ini

@@ -8,7 +8,7 @@ envlist =
     coverage-html
 skipsdist = True
 skip_missing_interpreters = True
-basepython = python3.12
+basepython = python3.14
 
 [gh-actions]
 python =
@@ -50,6 +50,7 @@ commands =
 
 [testenv:upgrade-deps]
 allowlist_externals = cp
+basepython = python3.14
 deps =
     pip-tools
 setenv =