vignesh/bottleneckcrm
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: update dependencies and configurations

Browse source 
- Updated `pnpm-workspace.yaml` to force patch for `cookie` package to address GHSA-pxg6-pf52-xh8x vulnerability.
- Modified `vitest.config.js` to set `maxWorkers` to '50%' for improved test performance.
- Bumped version in `pubspec.yaml` from 1.2.1+12 to 1.9.0+13 for mobile application.
This commit is contained in:
Ashwin 2026-09-05 22:49:29 +05:30
parent ebd6e45f15
commit 6e9fd8c98c
10 changed files with 1308 additions and 1268 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
DESIGN_SYSTEM.md
View file

@ -1,4 +1,4 @@
# CRM Design System — Style Guide # CRM Design System: Style Guide
> Version 1.2 | Last Updated: December 2024 > Version 1.2 | Last Updated: December 2024
@ -27,11 +27,11 @@ A comprehensive design system reference for building consistent, accessible, and
## Design Principles ## Design Principles
1. **Clarity First** — Every element should serve a purpose. Remove visual clutter. 1. **Clarity First**: Every element should serve a purpose. Remove visual clutter.
2. **Data-Driven** — Prioritize readability of data in tables, lists, and cards. 2. **Data-Driven**: Prioritize readability of data in tables, lists, and cards.
3. **Consistent Rhythm** — Use the 8px grid system for all spacing decisions. 3. **Consistent Rhythm**: Use the 8px grid system for all spacing decisions.
4. **Accessible** — WCAG 2.0 AA compliant color contrast and interactions. 4. **Accessible**: WCAG 2.0 AA compliant color contrast and interactions.
5. **Theme-Ready** — Semantic tokens enable light/dark mode switching. 5. **Theme-Ready**: Semantic tokens enable light/dark mode switching.
--- ---

2
backend/README.md
View file

@ -26,7 +26,7 @@ Minimum versions, as declared in `pyproject.toml`. That file is the source of
truth; the list here is a summary and `uv.lock` pins what actually gets truth; the list here is a summary and `uv.lock` pins what actually gets
installed. installed.
- **Django 6.0.7+** - Web framework - **Django 6.1.1+** - Web framework
- **Django REST Framework 3.17+** - API toolkit - **Django REST Framework 3.17+** - API toolkit
- **PostgreSQL** - Database, via **psycopg 3.2.10+** with the `pool` extra - **PostgreSQL** - Database, via **psycopg 3.2.10+** with the `pool` extra
- **Celery 5.6+** - Async task queue - **Celery 5.6+** - Async task queue

40
backend/pyproject.toml
View file

@ -4,7 +4,7 @@ build-backend = "hatchling.build"
[project] [project]
name = "django-crm" name = "django-crm"
version = "1.9.1" version = "1.9.2"
# The one-line summary PyPI shows under the project title and in search results, # The one-line summary PyPI shows under the project title and in search results,
# so it carries the terms people actually search for ("open source CRM", # so it carries the terms people actually search for ("open source CRM",
# "self-hosted CRM", "Django CRM") and names the modules rather than the # "self-hosted CRM", "Django CRM") and names the modules rather than the
@ -46,7 +46,7 @@ classifiers = [
"Development Status :: 5 - Production/Stable", "Development Status :: 5 - Production/Stable",
"Environment :: Web Environment", "Environment :: Web Environment",
"Framework :: Django", "Framework :: Django",
"Framework :: Django :: 6.0", "Framework :: Django :: 6.1",
"Intended Audience :: Developers", "Intended Audience :: Developers",
"License :: OSI Approved :: MIT License", "License :: OSI Approved :: MIT License",
"Operating System :: OS Independent", "Operating System :: OS Independent",
@ -59,40 +59,42 @@ classifiers = [
] ]
dependencies = [ dependencies = [
"django>=6.0.7", "django>=6.1.1",
"celery>=5.6.3", "celery>=5.6.3",
"python-dotenv>=1.2.2", "python-dotenv>=1.2.3",
"django-cors-headers>=4.9.0", "django-cors-headers>=4.9.0",
"djangorestframework>=3.17.1", "djangorestframework>=3.18.0",
"djangorestframework-simplejwt>=5.5.1", "djangorestframework-simplejwt>=5.5.1",
"drf-spectacular>=0.30.0", "drf-spectacular>=0.30.0",
"django-ses>=4.7.2", "django-ses>=4.8.0",
# psycopg 3, not psycopg2. The `pool` extra is required: Django refuses # psycopg 3, not psycopg2. The `pool` extra is required: Django refuses
# pool options under psycopg2 (ImproperlyConfigured, "Database pooling # pool options under psycopg2 (ImproperlyConfigured, "Database pooling
# requires psycopg >= 3"), and DATABASES["default"]["OPTIONS"]["pool"] in # requires psycopg >= 3"), and DATABASES["default"]["OPTIONS"]["pool"] in
# crm/settings.py depends on it. No application code imports the driver # crm/settings.py depends on it. No application code imports the driver
# directly, so the swap is confined to this line. # directly, so the swap is confined to this line.
"psycopg[binary,pool]>=3.2.10", "psycopg[binary,pool]>=3.3.5",
"whitenoise>=6.12.0", "whitenoise>=6.12.0",
"sentry-sdk>=2.66.1", "sentry-sdk>=2.68.1",
"django-storages>=1.14.6", "django-storages>=1.14.6",
"django-crum>=0.7.9", "django-crum>=0.7.9",
"disposable-email-domains>=0.0.231", "disposable-email-domains>=0.0.250",
"redis>=8.0.1", "redis>=8.1.0",
"pytz>=2026.3.post1", "pytz>=2026.3.post1",
"requests>=2.34.2", "requests>=2.34.2",
"faker>=40.36.0", "faker>=40.38.0",
"python-dateutil>=2.9.0.post0", "python-dateutil>=2.9.0.post0",
"google-auth>=2.56.2", "google-auth>=2.57.1",
# X.509 handling for inbound SNS webhook signature verification # X.509 handling for inbound SNS webhook signature verification
# (cases/inbound/sns.py). Needs >=42 for the not_valid_*_utc accessors. # (cases/inbound/sns.py). The API floor is 42, where the not_valid_*_utc
"cryptography>=49.0.0", # accessors landed; this pin sits higher only because floors here track the
# versions in uv.lock.
"cryptography>=50.0.1",
# PDF generation (also needs system libs: cairo, pango, gdk-pixbuf, libffi, shared-mime-info) # PDF generation (also needs system libs: cairo, pango, gdk-pixbuf, libffi, shared-mime-info)
"weasyprint>=69.0", "weasyprint>=69.0",
"cairocffi>=1.7.1", "cairocffi>=1.7.1",
# Production WSGI server # Production WSGI server
"gunicorn>=26.0.0", "gunicorn>=26.2.0",
"uvicorn[standard]>=0.51.0", "uvicorn[standard]>=0.52.4",
] ]
[project.urls] [project.urls]
@ -110,12 +112,12 @@ Changelog = "https://github.com/Django-CRM/Django-CRM/releases"
[dependency-groups] [dependency-groups]
dev = [ dev = [
"pytest>=9.1.1", "pytest>=9.1.1",
"pytest-django>=4.12.0", "pytest-django>=4.14.0",
"pytest-cov>=7.1.0", "pytest-cov>=7.1.0",
"ruff>=0.16.1", "ruff>=0.16.6",
] ]
docs = [ docs = [
"mkdocs-material>=9.5.0", "mkdocs-material>=9.7.7",
] ]
[tool.hatch.build.targets.wheel] [tool.hatch.build.targets.wheel]

1188
backend/uv.lock
View file

File diff suppressed because it is too large Load diff

2
docs/self-hosting/requirements.md
View file

@ -10,7 +10,7 @@ them.
| Component | Version | Source | | Component | Version | Source |
|---|---|---| |---|---|---|
| Python | 3.12 or later | `backend/pyproject.toml` sets `requires-python = ">=3.12"`; `backend/.python-version` pins `3.12` exactly. | | Python | 3.12 or later | `backend/pyproject.toml` sets `requires-python = ">=3.12"`; `backend/.python-version` pins `3.12` exactly. |
| Django | 6.0.7 or later | `backend/pyproject.toml` dependency `django>=6.0.7`. | | Django | 6.1.1 or later | `backend/pyproject.toml` dependency `django>=6.1.1`. |
| PostgreSQL | 16 | `docker-compose.yml`'s `db` service uses image `postgres:16-alpine`. This is also the only version this project's own CI ever runs against. See the note below. | | PostgreSQL | 16 | `docker-compose.yml`'s `db` service uses image `postgres:16-alpine`. This is also the only version this project's own CI ever runs against. See the note below. |
| Redis | 7 | `docker-compose.yml`'s `redis` service uses image `redis:7-alpine`. | | Redis | 7 | `docker-compose.yml`'s `redis` service uses image `redis:7-alpine`. |
| Node.js | 24 | `.github/workflows/tests.yml`'s `frontend-checks` job sets up `node-version: '24'`. | | Node.js | 24 | `.github/workflows/tests.yml`'s `frontend-checks` job sets up `node-version: '24'`. |

38
frontend/package.json
View file

@ -16,41 +16,41 @@
"test:watch": "vitest" "test:watch": "vitest"
}, },
"devDependencies": { "devDependencies": {
"@eslint/compat": "^2.1.0", "@eslint/compat": "^2.1.1",
"@eslint/js": "^10.0.1", "@eslint/js": "^10.0.1",
"@internationalized/date": "^3.12.3", "@internationalized/date": "^3.12.4",
"@lucide/svelte": "^1.28.0", "@lucide/svelte": "^1.41.0",
"@sveltejs/adapter-node": "^5.5.7", "@sveltejs/adapter-node": "^5.5.7",
"@sveltejs/kit": "^2.70.2", "@sveltejs/kit": "^2.70.3",
"@sveltejs/vite-plugin-svelte": "^7.2.0", "@sveltejs/vite-plugin-svelte": "^7.3.0",
"@tailwindcss/typography": "^0.5.20", "@tailwindcss/typography": "^0.5.20",
"@tailwindcss/vite": "^4.3.3", "@tailwindcss/vite": "^4.3.3",
"@types/node": "^25.9.5", "@types/node": "^25.9.5",
"bits-ui": "^2.18.1", "bits-ui": "^2.19.0",
"eslint": "^10.8.0", "eslint": "^10.10.0",
"eslint-config-prettier": "^10.1.8", "eslint-config-prettier": "^10.1.8",
"eslint-plugin-svelte": "^3.22.0", "eslint-plugin-svelte": "^3.23.0",
"globals": "^17.9.0", "globals": "^17.12.0",
"mode-watcher": "^1.1.0", "mode-watcher": "^1.1.0",
"prettier": "^3.9.6", "prettier": "^3.9.6",
"prettier-plugin-svelte": "^4.1.1", "prettier-plugin-svelte": "^4.1.1",
"prettier-plugin-tailwindcss": "^0.8.1", "prettier-plugin-tailwindcss": "^0.8.1",
"svelte": "^5.56.8", "svelte": "^5.57.0",
"svelte-check": "^4.7.4", "svelte-check": "^4.7.6",
"svelte-sonner": "^1.1.1", "svelte-sonner": "^1.2.1",
"tailwindcss": "^4.3.3", "tailwindcss": "^4.3.3",
"typescript": "^6.0.3", "typescript": "^6.0.3",
"vite": "^8.2.0", "vite": "^8.2.2",
"vitest": "^4.1.10" "vitest": "^5.0.0"
}, },
"dependencies": { "dependencies": {
"@sentry/sveltekit": "^10.69.0", "@sentry/sveltekit": "^10.73.0",
"axios": "^1.19.0", "axios": "^1.20.0",
"clsx": "^2.1.1", "clsx": "^2.1.1",
"libphonenumber-js": "^1.13.10", "libphonenumber-js": "^1.13.12",
"svelte-dnd-action": "^0.9.77", "svelte-dnd-action": "^0.9.79",
"tailwind-merge": "^3.6.0", "tailwind-merge": "^3.6.0",
"tailwind-variants": "^3.3.0", "tailwind-variants": "^3.3.1",
"tw-animate-css": "^1.4.0" "tw-animate-css": "^1.4.0"
} }
} }

1283
frontend/pnpm-lock.yaml
View file

File diff suppressed because it is too large Load diff

6
frontend/pnpm-workspace.yaml
View file

@ -7,3 +7,9 @@ overrides:
# Only reachable through dev tooling (eslint, @sentry/vite-plugin), but the # Only reachable through dev tooling (eslint, @sentry/vite-plugin), but the
# transitive parents still ask for a vulnerable range, so force the patch. # transitive parents still ask for a vulnerable range, so force the patch.
'brace-expansion@>=4.0.0 <5.0.9': '^5.0.9' 'brace-expansion@>=4.0.0 <5.0.9': '^5.0.9'
# GHSA-pxg6-pf52-xh8x (low): cookie name/path/domain accept out-of-bounds
# characters. Reachable at runtime, not just in dev tooling: @sveltejs/kit
# parses and serialises the jwt_access / jwt_refresh / org cookies through
# this package. Kit still asks for ^0.6.0, so force the patched line. Kit
# only calls parse() and serialize(), both unchanged in 0.7.
'cookie@<0.7.0': '^0.7.2'

3
frontend/vitest.config.js
View file

@ -42,7 +42,8 @@ export default defineConfig({
// Server modules only. They are plain functions over `apiRequest`, so they // Server modules only. They are plain functions over `apiRequest`, so they
// need no DOM, and a node environment keeps the run fast. // need no DOM, and a node environment keeps the run fast.
environment: 'node', environment: 'node',
include: ['src/**/*.test.js'] include: ['src/**/*.test.js'],
maxWorkers: '50%'
}, },
resolve: { resolve: {
alias: { alias: {

2
mobile/pubspec.yaml
View file

@ -4,7 +4,7 @@ description: "CRM for everyone."
# pub.dev using `flutter pub publish`. This is preferred for private packages. # pub.dev using `flutter pub publish`. This is preferred for private packages.
publish_to: "none" # Remove this line if you wish to publish to pub.dev publish_to: "none" # Remove this line if you wish to publish to pub.dev
version: 1.2.1+12 version: 1.9.0+13
environment: environment:
sdk: ^3.8.1 sdk: ^3.8.1