Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
DynamicForms performs all the visualisation & data entry of your DRF Serializers & ViewSets and adds some candy of its own
Releases 0.50.x and 0.70.x are interim releases with which we prepare the stage for 1.x release.
0.50.x moves all "existing" code to dynamicforms_legacy
module. If you weren't following vue
development branches, you will need to change all imports in python to this "new" module.
This is done to keep legacy code still running as existing code is transitioned to vue-based approach. Unless there is significant interest, we will remove this module with 1.x release.
0.70.x re-introduces dynamicforms
module, but this time refactored to only provide .componentdef OPTIONS +
payload data responses needed by the vue front-end library. This will hopefully be refactored to be more OpenAPI
compatible. The new primary branch is now main
.
HTML renderers will no longer be supported and have been removed from the "new" dynamicforms module. It was too slow and required too many hacks to remain viable. So we moved to Vue. The components in 0.70 will be vue3, vuetify3, vite and typescript-compatible. We're in final stages of adapting to the new stack. Some inputs and some table functionality isn't working yet.
We're keeping the Bootstrap stubs too, but not actively developing to support seamless selection of the two frameworks. If there is interest to support CSS frameworks other than Vuetify, pull requests welcome. Hopefully the stubs should point the way on how to do it.
Migration path is thus:
Upgrade to dynamicforms >= 0.50.3
replace all dynamicforms imports with dynamicforms_legacy
because of the rename, there is a bit of work required in settings.py so that Django can find the templates and filters:
``` python
from dynamicforms_legacy import __file__ as DYNAMICFORMS_BASEDIR_FILE
DYNAMICFORMS_BASEDIR = os.path.dirname(DYNAMICFORMS_BASEDIR_FILE)
...
INSTALLED_APPS = [
...
'dynamicforms_legacy'
TEMPLATES = [
...
'DIRS': [
os.path.join(DYNAMICFORMS_BASEDIR, 'templates'),
...
'OPTIONS': {
...
'libraries': {
'dynamicforms': 'dynamicforms_legacy.templatetags.dynamicforms',
}
STATICFILES_DIRS = [
...
os.path.join(DYNAMICFORMS_BASEDIR, 'static'),
]
```
replace any javascript dynamicforms progress calls with progress-legacy
all other javascript code remains the same (including the dynamicforms object with support functions)
check that everything still works
Upgrade dynamicforms to >= 0.70.1
Start migration to Vue front-end and the new backend
DynamicForms wants to eliminate HTML form boilerplate for generic tables & forms. Specifying a single DRF Serializer / ViewSet and possibly desired form layout instantly provides both HTML renders and JSON renders (and anything else DRF supports) keeping you free to implement your project.
There are two parts to DanymicForms:
It performs all the visualisation & data entry of your DRF Serializers & ViewSets and adds some candy of its own: It is a django library that gives you the power of dynamically-shown form fields, autofilled default values, dynamic record loading and similar candy with little effort. To put it differently: once defined, a particular ViewSet / Serializer can be rendered in multiple ways allowing you to perform viewing and authoring operations on the data in question.
It is based on django-rest-framework
Documentation on readthedocs
FAQs
DynamicForms performs all the visualisation & data entry of your DRF Serializers & ViewSets and adds some candy of its own
We found that dynamicforms demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.