PythonIreland · nlaurance · Mar 25, 2024 · Mar 25, 2024 · Mar 25, 2024 · Mar 25, 2024
diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax = docker/dockerfile:1.4
-FROM python:3.10 AS compile-stage
+FROM python:3.13.0a4-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
 RUN --mount=type=cache,target=/var/cache/apt \
  apt update && \
  apt install -y --no-install-recommends \
@@ -19,3 +19,4 @@ RUN --mount=type=cache,target=/root/.cache \
 
 FROM compile-stage AS tests-stage
 
+USER nobody
diff --git a/Taskfile.yaml b/Taskfile.yaml
@@ -68,7 +68,7 @@ tasks:
  - docker compose run --rm web python pythonie/manage.py migrate
 
  django:collect-static:
- desc: Make migrations
+ desc: Make static resources
  cmds:
  - docker compose run --rm web python pythonie/manage.py collectstatic
 

diff --git a/pythonie/core/templates/base.html b/pythonie/core/templates/base.html
@@ -17,7 +17,8 @@
  <meta name="description" content=""/>
  <meta name="viewport" content="width=device-width, initial-scale=1"/>
 
- <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"></script>
+ <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"
+ integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"></script>
  <script type="text/javascript">try{Typekit.load({async: false});}catch(e){}</script>
 
 
@@ -56,7 +57,10 @@
 {% endcompress %}
 
 {% block basejs %}
- <script src="https://code.jquery.com/jquery.js"></script>
+ <script src="https://code.jquery.com/jquery-1.12.4.js"
+ integrity="sha256-Qw82+bXyGq6MydymqBxNPYTaUXXq7c8v3CwiYwLLNXU="
+ crossorigin="anonymous"></script>
+
  <script src="{% static 'js/jquery.smartmenus.js' %}"></script>
  <script src="{% static 'js/jquery.smartmenus.bootstrap.js' %}"></script>
  <script src="{% static 'js/bootstrap.min.js' %}"></script>

diff --git a/pythonie/meetups/test_meetups.py b/pythonie/meetups/test_meetups.py
@@ -10,9 +10,9 @@
 description = (
  "<p>We will be having a meetup in June. More details to follow."
  "</p> <p>If you are interested in speaking, please submit your "
- 'details to\xa0<a href="http://bit.ly/pyie-cfp-2015">'
- '<a href="http://bit.ly/pyie-cfp-2015" class="linkified">'
- "http://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
+ 'details to\xa0<a href="https://bit.ly/pyie-cfp-2015">'
+ '<a href="https://bit.ly/pyie-cfp-2015" class="linkified">'
+ "https://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
  "contact contact@python.ie.</p>"
 )
 
@@ -60,7 +60,7 @@ def _first_result(self):
  "description": description,
  "name": "Python Ireland meetup",
  "event_url": (
- "http://www.meetup.com/pythonireland/" "events/221078098/"
+ "https://www.meetup.com/pythonireland/" "events/221078098/"
  ),
  "headcount": 0,
  "time": 1433957400000,
@@ -123,7 +123,7 @@ def test_update_first_run(self, mock_get_content):
  self.assertEqual(meetup.visibility, "public")
  self.assertEqual(
  meetup.event_url,
- ("http://www.meetup.com/" "pythonireland/events/221078098/"),
+ ("https://www.meetup.com/" "pythonireland/events/221078098/"),
  )
 
  @patch("meetups.utils.get_content")

diff --git a/pythonie/pythonie/settings/dev.py b/pythonie/pythonie/settings/dev.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # just for dev #nosec B105
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/pythonie/settings/tests.py b/pythonie/pythonie/settings/tests.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" #nosec B105 # Just for dev
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/speakers/management/commands/import-sessionize.py b/pythonie/speakers/management/commands/import-sessionize.py
@@ -4,7 +4,6 @@
 import numpy as np
 import pandas as pd
 from django.core.management.base import BaseCommand, CommandParser
-from django.utils.text import slugify
 from wagtail.core.models import Page
 
 from speakers.models import Speaker, Room, Session

diff --git a/pythonie/speakers/management/commands/update-sessionize-json-stream.py b/pythonie/speakers/management/commands/update-sessionize-json-stream.py
@@ -51,7 +51,7 @@ class SessionizeModel(pydantic.BaseModel):
 
 class Command(BaseCommand):
  def handle(self, *args, **kwargs):
- response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All")
+ response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All", timeout=500)
  sessionize: SessionizeModel = SessionizeModel.parse_obj(response.json())
 
  rooms = {}

diff --git a/pythonie/speakers/templates/speakers/session.html b/pythonie/speakers/templates/speakers/session.html
@@ -27,7 +27,7 @@ <h2>{{ self.name }}</h2>
  <a href="{% pageurl speaker %}">{{ speaker.name }}</a>
  </td>
  <td>
- {{ speaker.biography|safe }}
+ {{ speaker.biography }}
  </td>
  </tr>
  {% endfor %}

diff --git a/requirements/dev.in b/requirements/dev.in
@@ -1,10 +1,12 @@
 # dev.in
 -c main.txt
+bandit
 black
 coverage
+django-debug-toolbar
 fakeredis
 flake8
 isort
 model-mommy
-pipdeptree
-django-debug-toolbar
+pip-tools
+pipdeptree
diff --git a/requirements/dev.txt b/requirements/dev.txt
@@ -1,62 +1,116 @@
-asgiref==3.6.0
+#
+# This file is autogenerated by pip-compile with Python 3.9
+# by the following command:
+#
+# pip-compile dev.in
+#
+asgiref==3.8.1
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
-async-timeout==4.0.2
+async-timeout==4.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # redis
-black==23.3.0
- # via -r requirements/dev.in
-click==8.1.3
- # via black
-coverage==7.2.2
- # via -r requirements/dev.in
-django==3.2.18
+bandit==1.7.8
+ # via -r dev.in
+black==24.3.0
+ # via -r dev.in
+build==1.1.1
+ # via pip-tools
+click==8.1.7
+ # via
+ # black
+ # pip-tools
+coverage==7.4.4
+ # via -r dev.in
+django==3.2.25
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django-debug-toolbar
  # model-mommy
-django-debug-toolbar==3.8.1
- # via -r requirements/dev.in
-fakeredis==2.10.2
- # via -r requirements/dev.in
-flake8==6.0.0
- # via -r requirements/dev.in
-isort==5.12.0
- # via -r requirements/dev.in
+django-debug-toolbar==4.3.0
+ # via -r dev.in
+fakeredis==2.21.3
+ # via -r dev.in
+flake8==7.0.0
+ # via -r dev.in
+importlib-metadata==7.1.0
+ # via build
+isort==5.13.2
+ # via -r dev.in
+markdown-it-py==3.0.0
+ # via rich
 mccabe==0.7.0
  # via flake8
+mdurl==0.1.2
+ # via markdown-it-py
 model-mommy==2.0.0
- # via -r requirements/dev.in
+ # via -r dev.in
 mypy-extensions==1.0.0
  # via black
-packaging==23.0
- # via black
-pathspec==0.11.1
+packaging==24.0
+ # via
+ # -c main.txt
+ # black
+ # build
+pathspec==0.12.1
  # via black
-pipdeptree==2.7.0
- # via -r requirements/dev.in
-platformdirs==3.2.0
+pbr==6.0.0
+ # via stevedore
+pip-tools==7.4.1
+ # via -r dev.in
+pipdeptree==2.16.1
+ # via -r dev.in
+platformdirs==4.2.0
  # via black
-pycodestyle==2.10.0
+pycodestyle==2.11.1
  # via flake8
-pyflakes==3.0.1
+pyflakes==3.2.0
  # via flake8
-pytz==2023.3
+pygments==2.17.2
+ # via rich
+pyproject-hooks==1.0.0
  # via
- # -c requirements/main.txt
+ # build
+ # pip-tools
+pytz==2024.1
+ # via
+ # -c main.txt
  # django
-redis==4.5.4
+pyyaml==6.0.1
+ # via bandit
+redis==5.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # fakeredis
+rich==13.7.1
+ # via bandit
 sortedcontainers==2.4.0
  # via fakeredis
-sqlparse==0.4.3
+sqlparse==0.4.4
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
  # django-debug-toolbar
+stevedore==5.2.0
+ # via bandit
 tomli==2.0.1
- # via black
+ # via
+ # black
+ # build
+ # pip-tools
+ # pyproject-hooks
+typing-extensions==4.10.0
+ # via
+ # -c main.txt
+ # asgiref
+ # black
+wheel==0.43.0
+ # via pip-tools
+zipp==3.18.1
+ # via importlib-metadata
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip
+# setuptools
diff --git a/requirements/main.in b/requirements/main.in
@@ -13,15 +13,16 @@ django-libsass
 django-modelcluster
 django-storages
 django-taggit
-gunicorn
+gunicorn>=22.0.0
 pandas
 pydantic
 python-dateutil
 pytz
 redis
 requests
 wagtail
-wagtail-blog
+# important to pin that version until that dependency is removed
+wagtail-blog==2.3.5
 wagtailfontawesome
 wagtailnews
 whitenoise
diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax = docker/dockerfile:1.4
-FROM python:3.10 AS compile-stage
+FROM python:3.13.0a4-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
 RUN --mount=type=cache,target=/var/cache/apt \
  apt update && \
  apt install -y --no-install-recommends \
@@ -19,3 +19,4 @@ RUN --mount=type=cache,target=/root/.cache \
 
 FROM compile-stage AS tests-stage
 
+USER nobody
diff --git a/Taskfile.yaml b/Taskfile.yaml
@@ -68,7 +68,7 @@ tasks:
  - docker compose run --rm web python pythonie/manage.py migrate
 
  django:collect-static:
- desc: Make migrations
+ desc: Make static resources
  cmds:
  - docker compose run --rm web python pythonie/manage.py collectstatic
 

diff --git a/pythonie/core/templates/base.html b/pythonie/core/templates/base.html
@@ -17,7 +17,8 @@
  <meta name="description" content=""/>
  <meta name="viewport" content="width=device-width, initial-scale=1"/>
 
- <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"></script>
+ <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"
+ integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"></script>
  <script type="text/javascript">try{Typekit.load({async: false});}catch(e){}</script>
 
 
@@ -56,7 +57,10 @@
 {% endcompress %}
 
 {% block basejs %}
- <script src="https://code.jquery.com/jquery.js"></script>
+ <script src="https://code.jquery.com/jquery-1.12.4.js"
+ integrity="sha256-Qw82+bXyGq6MydymqBxNPYTaUXXq7c8v3CwiYwLLNXU="
+ crossorigin="anonymous"></script>
+
  <script src="{% static 'js/jquery.smartmenus.js' %}"></script>
  <script src="{% static 'js/jquery.smartmenus.bootstrap.js' %}"></script>
  <script src="{% static 'js/bootstrap.min.js' %}"></script>

diff --git a/pythonie/meetups/test_meetups.py b/pythonie/meetups/test_meetups.py
@@ -10,9 +10,9 @@
 description = (
  "<p>We will be having a meetup in June. More details to follow."
  "</p> <p>If you are interested in speaking, please submit your "
- 'details to\xa0<a href="http://bit.ly/pyie-cfp-2015">'
- '<a href="http://bit.ly/pyie-cfp-2015" class="linkified">'
- "http://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
+ 'details to\xa0<a href="https://bit.ly/pyie-cfp-2015">'
+ '<a href="https://bit.ly/pyie-cfp-2015" class="linkified">'
+ "https://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
  "contact contact@python.ie.</p>"
 )
 
@@ -60,7 +60,7 @@ def _first_result(self):
  "description": description,
  "name": "Python Ireland meetup",
  "event_url": (
- "http://www.meetup.com/pythonireland/" "events/221078098/"
+ "https://www.meetup.com/pythonireland/" "events/221078098/"
  ),
  "headcount": 0,
  "time": 1433957400000,
@@ -123,7 +123,7 @@ def test_update_first_run(self, mock_get_content):
  self.assertEqual(meetup.visibility, "public")
  self.assertEqual(
  meetup.event_url,
- ("http://www.meetup.com/" "pythonireland/events/221078098/"),
+ ("https://www.meetup.com/" "pythonireland/events/221078098/"),
  )
 
  @patch("meetups.utils.get_content")

diff --git a/pythonie/pythonie/settings/dev.py b/pythonie/pythonie/settings/dev.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # just for dev #nosec B105
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/pythonie/settings/tests.py b/pythonie/pythonie/settings/tests.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" #nosec B105 # Just for dev
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/speakers/management/commands/import-sessionize.py b/pythonie/speakers/management/commands/import-sessionize.py
@@ -4,7 +4,6 @@
 import numpy as np
 import pandas as pd
 from django.core.management.base import BaseCommand, CommandParser
-from django.utils.text import slugify
 from wagtail.core.models import Page
 
 from speakers.models import Speaker, Room, Session

diff --git a/pythonie/speakers/management/commands/update-sessionize-json-stream.py b/pythonie/speakers/management/commands/update-sessionize-json-stream.py
@@ -51,7 +51,7 @@ class SessionizeModel(pydantic.BaseModel):
 
 class Command(BaseCommand):
  def handle(self, *args, **kwargs):
- response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All")
+ response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All", timeout=500)
  sessionize: SessionizeModel = SessionizeModel.parse_obj(response.json())
 
  rooms = {}

diff --git a/pythonie/speakers/templates/speakers/session.html b/pythonie/speakers/templates/speakers/session.html
@@ -27,7 +27,7 @@ <h2>{{ self.name }}</h2>
  <a href="{% pageurl speaker %}">{{ speaker.name }}</a>
  </td>
  <td>
- {{ speaker.biography|safe }}
+ {{ speaker.biography }}
  </td>
  </tr>
  {% endfor %}

diff --git a/requirements/dev.in b/requirements/dev.in
@@ -1,10 +1,12 @@
 # dev.in
 -c main.txt
+bandit
 black
 coverage
+django-debug-toolbar
 fakeredis
 flake8
 isort
 model-mommy
-pipdeptree
-django-debug-toolbar
+pip-tools
+pipdeptree
diff --git a/requirements/dev.txt b/requirements/dev.txt
@@ -1,62 +1,116 @@
-asgiref==3.6.0
+#
+# This file is autogenerated by pip-compile with Python 3.9
+# by the following command:
+#
+# pip-compile dev.in
+#
+asgiref==3.8.1
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
-async-timeout==4.0.2
+async-timeout==4.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # redis
-black==23.3.0
- # via -r requirements/dev.in
-click==8.1.3
- # via black
-coverage==7.2.2
- # via -r requirements/dev.in
-django==3.2.18
+bandit==1.7.8
+ # via -r dev.in
+black==24.3.0
+ # via -r dev.in
+build==1.1.1
+ # via pip-tools
+click==8.1.7
+ # via
+ # black
+ # pip-tools
+coverage==7.4.4
+ # via -r dev.in
+django==3.2.25
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django-debug-toolbar
  # model-mommy
-django-debug-toolbar==3.8.1
- # via -r requirements/dev.in
-fakeredis==2.10.2
- # via -r requirements/dev.in
-flake8==6.0.0
- # via -r requirements/dev.in
-isort==5.12.0
- # via -r requirements/dev.in
+django-debug-toolbar==4.3.0
+ # via -r dev.in
+fakeredis==2.21.3
+ # via -r dev.in
+flake8==7.0.0
+ # via -r dev.in
+importlib-metadata==7.1.0
+ # via build
+isort==5.13.2
+ # via -r dev.in
+markdown-it-py==3.0.0
+ # via rich
 mccabe==0.7.0
  # via flake8
+mdurl==0.1.2
+ # via markdown-it-py
 model-mommy==2.0.0
- # via -r requirements/dev.in
+ # via -r dev.in
 mypy-extensions==1.0.0
  # via black
-packaging==23.0
- # via black
-pathspec==0.11.1
+packaging==24.0
+ # via
+ # -c main.txt
+ # black
+ # build
+pathspec==0.12.1
  # via black
-pipdeptree==2.7.0
- # via -r requirements/dev.in
-platformdirs==3.2.0
+pbr==6.0.0
+ # via stevedore
+pip-tools==7.4.1
+ # via -r dev.in
+pipdeptree==2.16.1
+ # via -r dev.in
+platformdirs==4.2.0
  # via black
-pycodestyle==2.10.0
+pycodestyle==2.11.1
  # via flake8
-pyflakes==3.0.1
+pyflakes==3.2.0
  # via flake8
-pytz==2023.3
+pygments==2.17.2
+ # via rich
+pyproject-hooks==1.0.0
  # via
- # -c requirements/main.txt
+ # build
+ # pip-tools
+pytz==2024.1
+ # via
+ # -c main.txt
  # django
-redis==4.5.4
+pyyaml==6.0.1
+ # via bandit
+redis==5.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # fakeredis
+rich==13.7.1
+ # via bandit
 sortedcontainers==2.4.0
  # via fakeredis
-sqlparse==0.4.3
+sqlparse==0.4.4
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
  # django-debug-toolbar
+stevedore==5.2.0
+ # via bandit
 tomli==2.0.1
- # via black
+ # via
+ # black
+ # build
+ # pip-tools
+ # pyproject-hooks
+typing-extensions==4.10.0
+ # via
+ # -c main.txt
+ # asgiref
+ # black
+wheel==0.43.0
+ # via pip-tools
+zipp==3.18.1
+ # via importlib-metadata
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip
+# setuptools
diff --git a/requirements/main.in b/requirements/main.in
@@ -13,15 +13,16 @@ django-libsass
 django-modelcluster
 django-storages
 django-taggit
-gunicorn
+gunicorn>=22.0.0
 pandas
 pydantic
 python-dateutil
 pytz
 redis
 requests
 wagtail
-wagtail-blog
+# important to pin that version until that dependency is removed
+wagtail-blog==2.3.5
 wagtailfontawesome
 wagtailnews
 whitenoise
diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax = docker/dockerfile:1.4
-FROM python:3.10 AS compile-stage
+FROM python:3.13.0a4-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
 RUN --mount=type=cache,target=/var/cache/apt \
  apt update && \
  apt install -y --no-install-recommends \
@@ -19,3 +19,4 @@ RUN --mount=type=cache,target=/root/.cache \
 
 FROM compile-stage AS tests-stage
 
+USER nobody
diff --git a/Taskfile.yaml b/Taskfile.yaml
@@ -68,7 +68,7 @@ tasks:
  - docker compose run --rm web python pythonie/manage.py migrate
 
  django:collect-static:
- desc: Make migrations
+ desc: Make static resources
  cmds:
  - docker compose run --rm web python pythonie/manage.py collectstatic
 

diff --git a/pythonie/core/templates/base.html b/pythonie/core/templates/base.html
@@ -17,7 +17,8 @@
  <meta name="description" content=""/>
  <meta name="viewport" content="width=device-width, initial-scale=1"/>
 
- <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"></script>
+ <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"
+ integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"></script>
  <script type="text/javascript">try{Typekit.load({async: false});}catch(e){}</script>
 
 
@@ -56,7 +57,10 @@
 {% endcompress %}
 
 {% block basejs %}
- <script src="https://code.jquery.com/jquery.js"></script>
+ <script src="https://code.jquery.com/jquery-1.12.4.js"
+ integrity="sha256-Qw82+bXyGq6MydymqBxNPYTaUXXq7c8v3CwiYwLLNXU="
+ crossorigin="anonymous"></script>
+
  <script src="{% static 'js/jquery.smartmenus.js' %}"></script>
  <script src="{% static 'js/jquery.smartmenus.bootstrap.js' %}"></script>
  <script src="{% static 'js/bootstrap.min.js' %}"></script>

diff --git a/pythonie/meetups/test_meetups.py b/pythonie/meetups/test_meetups.py
@@ -10,9 +10,9 @@
 description = (
  "<p>We will be having a meetup in June. More details to follow."
  "</p> <p>If you are interested in speaking, please submit your "
- 'details to\xa0<a href="http://bit.ly/pyie-cfp-2015">'
- '<a href="http://bit.ly/pyie-cfp-2015" class="linkified">'
- "http://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
+ 'details to\xa0<a href="https://bit.ly/pyie-cfp-2015">'
+ '<a href="https://bit.ly/pyie-cfp-2015" class="linkified">'
+ "https://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
  "contact contact@python.ie.</p>"
 )
 
@@ -60,7 +60,7 @@ def _first_result(self):
  "description": description,
  "name": "Python Ireland meetup",
  "event_url": (
- "http://www.meetup.com/pythonireland/" "events/221078098/"
+ "https://www.meetup.com/pythonireland/" "events/221078098/"
  ),
  "headcount": 0,
  "time": 1433957400000,
@@ -123,7 +123,7 @@ def test_update_first_run(self, mock_get_content):
  self.assertEqual(meetup.visibility, "public")
  self.assertEqual(
  meetup.event_url,
- ("http://www.meetup.com/" "pythonireland/events/221078098/"),
+ ("https://www.meetup.com/" "pythonireland/events/221078098/"),
  )
 
  @patch("meetups.utils.get_content")

diff --git a/pythonie/pythonie/settings/dev.py b/pythonie/pythonie/settings/dev.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # just for dev #nosec B105
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/pythonie/settings/tests.py b/pythonie/pythonie/settings/tests.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" #nosec B105 # Just for dev
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/speakers/management/commands/import-sessionize.py b/pythonie/speakers/management/commands/import-sessionize.py
@@ -4,7 +4,6 @@
 import numpy as np
 import pandas as pd
 from django.core.management.base import BaseCommand, CommandParser
-from django.utils.text import slugify
 from wagtail.core.models import Page
 
 from speakers.models import Speaker, Room, Session

diff --git a/pythonie/speakers/management/commands/update-sessionize-json-stream.py b/pythonie/speakers/management/commands/update-sessionize-json-stream.py
@@ -51,7 +51,7 @@ class SessionizeModel(pydantic.BaseModel):
 
 class Command(BaseCommand):
  def handle(self, *args, **kwargs):
- response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All")
+ response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All", timeout=500)
  sessionize: SessionizeModel = SessionizeModel.parse_obj(response.json())
 
  rooms = {}

diff --git a/pythonie/speakers/templates/speakers/session.html b/pythonie/speakers/templates/speakers/session.html
@@ -27,7 +27,7 @@ <h2>{{ self.name }}</h2>
  <a href="{% pageurl speaker %}">{{ speaker.name }}</a>
  </td>
  <td>
- {{ speaker.biography|safe }}
+ {{ speaker.biography }}
  </td>
  </tr>
  {% endfor %}

diff --git a/requirements/dev.in b/requirements/dev.in
@@ -1,10 +1,12 @@
 # dev.in
 -c main.txt
+bandit
 black
 coverage
+django-debug-toolbar
 fakeredis
 flake8
 isort
 model-mommy
-pipdeptree
-django-debug-toolbar
+pip-tools
+pipdeptree
diff --git a/requirements/dev.txt b/requirements/dev.txt
@@ -1,62 +1,116 @@
-asgiref==3.6.0
+#
+# This file is autogenerated by pip-compile with Python 3.9
+# by the following command:
+#
+# pip-compile dev.in
+#
+asgiref==3.8.1
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
-async-timeout==4.0.2
+async-timeout==4.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # redis
-black==23.3.0
- # via -r requirements/dev.in
-click==8.1.3
- # via black
-coverage==7.2.2
- # via -r requirements/dev.in
-django==3.2.18
+bandit==1.7.8
+ # via -r dev.in
+black==24.3.0
+ # via -r dev.in
+build==1.1.1
+ # via pip-tools
+click==8.1.7
+ # via
+ # black
+ # pip-tools
+coverage==7.4.4
+ # via -r dev.in
+django==3.2.25
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django-debug-toolbar
  # model-mommy
-django-debug-toolbar==3.8.1
- # via -r requirements/dev.in
-fakeredis==2.10.2
- # via -r requirements/dev.in
-flake8==6.0.0
- # via -r requirements/dev.in
-isort==5.12.0
- # via -r requirements/dev.in
+django-debug-toolbar==4.3.0
+ # via -r dev.in
+fakeredis==2.21.3
+ # via -r dev.in
+flake8==7.0.0
+ # via -r dev.in
+importlib-metadata==7.1.0
+ # via build
+isort==5.13.2
+ # via -r dev.in
+markdown-it-py==3.0.0
+ # via rich
 mccabe==0.7.0
  # via flake8
+mdurl==0.1.2
+ # via markdown-it-py
 model-mommy==2.0.0
- # via -r requirements/dev.in
+ # via -r dev.in
 mypy-extensions==1.0.0
  # via black
-packaging==23.0
- # via black
-pathspec==0.11.1
+packaging==24.0
+ # via
+ # -c main.txt
+ # black
+ # build
+pathspec==0.12.1
  # via black
-pipdeptree==2.7.0
- # via -r requirements/dev.in
-platformdirs==3.2.0
+pbr==6.0.0
+ # via stevedore
+pip-tools==7.4.1
+ # via -r dev.in
+pipdeptree==2.16.1
+ # via -r dev.in
+platformdirs==4.2.0
  # via black
-pycodestyle==2.10.0
+pycodestyle==2.11.1
  # via flake8
-pyflakes==3.0.1
+pyflakes==3.2.0
  # via flake8
-pytz==2023.3
+pygments==2.17.2
+ # via rich
+pyproject-hooks==1.0.0
  # via
- # -c requirements/main.txt
+ # build
+ # pip-tools
+pytz==2024.1
+ # via
+ # -c main.txt
  # django
-redis==4.5.4
+pyyaml==6.0.1
+ # via bandit
+redis==5.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # fakeredis
+rich==13.7.1
+ # via bandit
 sortedcontainers==2.4.0
  # via fakeredis
-sqlparse==0.4.3
+sqlparse==0.4.4
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
  # django-debug-toolbar
+stevedore==5.2.0
+ # via bandit
 tomli==2.0.1
- # via black
+ # via
+ # black
+ # build
+ # pip-tools
+ # pyproject-hooks
+typing-extensions==4.10.0
+ # via
+ # -c main.txt
+ # asgiref
+ # black
+wheel==0.43.0
+ # via pip-tools
+zipp==3.18.1
+ # via importlib-metadata
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip
+# setuptools
diff --git a/requirements/main.in b/requirements/main.in
@@ -13,15 +13,16 @@ django-libsass
 django-modelcluster
 django-storages
 django-taggit
-gunicorn
+gunicorn>=22.0.0
 pandas
 pydantic
 python-dateutil
 pytz
 redis
 requests
 wagtail
-wagtail-blog
+# important to pin that version until that dependency is removed
+wagtail-blog==2.3.5
 wagtailfontawesome
 wagtailnews
 whitenoise
diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax = docker/dockerfile:1.4
-FROM python:3.10 AS compile-stage
+FROM python:3.13.0a4-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
 RUN --mount=type=cache,target=/var/cache/apt \
  apt update && \
  apt install -y --no-install-recommends \
@@ -19,3 +19,4 @@ RUN --mount=type=cache,target=/root/.cache \
 
 FROM compile-stage AS tests-stage
 
+USER nobody
diff --git a/Taskfile.yaml b/Taskfile.yaml
@@ -68,7 +68,7 @@ tasks:
  - docker compose run --rm web python pythonie/manage.py migrate
 
  django:collect-static:
- desc: Make migrations
+ desc: Make static resources
  cmds:
  - docker compose run --rm web python pythonie/manage.py collectstatic
 

diff --git a/pythonie/core/templates/base.html b/pythonie/core/templates/base.html
@@ -17,7 +17,8 @@
  <meta name="description" content=""/>
  <meta name="viewport" content="width=device-width, initial-scale=1"/>
 
- <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"></script>
+ <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"
+ integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"></script>
  <script type="text/javascript">try{Typekit.load({async: false});}catch(e){}</script>
 
 
@@ -56,7 +57,10 @@
 {% endcompress %}
 
 {% block basejs %}
- <script src="https://code.jquery.com/jquery.js"></script>
+ <script src="https://code.jquery.com/jquery-1.12.4.js"
+ integrity="sha256-Qw82+bXyGq6MydymqBxNPYTaUXXq7c8v3CwiYwLLNXU="
+ crossorigin="anonymous"></script>
+
  <script src="{% static 'js/jquery.smartmenus.js' %}"></script>
  <script src="{% static 'js/jquery.smartmenus.bootstrap.js' %}"></script>
  <script src="{% static 'js/bootstrap.min.js' %}"></script>

diff --git a/pythonie/meetups/test_meetups.py b/pythonie/meetups/test_meetups.py
@@ -10,9 +10,9 @@
 description = (
  "<p>We will be having a meetup in June. More details to follow."
  "</p> <p>If you are interested in speaking, please submit your "
- 'details to\xa0<a href="http://bit.ly/pyie-cfp-2015">'
- '<a href="http://bit.ly/pyie-cfp-2015" class="linkified">'
- "http://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
+ 'details to\xa0<a href="https://bit.ly/pyie-cfp-2015">'
+ '<a href="https://bit.ly/pyie-cfp-2015" class="linkified">'
+ "https://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
  "contact contact@python.ie.</p>"
 )
 
@@ -60,7 +60,7 @@ def _first_result(self):
  "description": description,
  "name": "Python Ireland meetup",
  "event_url": (
- "http://www.meetup.com/pythonireland/" "events/221078098/"
+ "https://www.meetup.com/pythonireland/" "events/221078098/"
  ),
  "headcount": 0,
  "time": 1433957400000,
@@ -123,7 +123,7 @@ def test_update_first_run(self, mock_get_content):
  self.assertEqual(meetup.visibility, "public")
  self.assertEqual(
  meetup.event_url,
- ("http://www.meetup.com/" "pythonireland/events/221078098/"),
+ ("https://www.meetup.com/" "pythonireland/events/221078098/"),
  )
 
  @patch("meetups.utils.get_content")

diff --git a/pythonie/pythonie/settings/dev.py b/pythonie/pythonie/settings/dev.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # just for dev #nosec B105
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/pythonie/settings/tests.py b/pythonie/pythonie/settings/tests.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" #nosec B105 # Just for dev
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/speakers/management/commands/import-sessionize.py b/pythonie/speakers/management/commands/import-sessionize.py
@@ -4,7 +4,6 @@
 import numpy as np
 import pandas as pd
 from django.core.management.base import BaseCommand, CommandParser
-from django.utils.text import slugify
 from wagtail.core.models import Page
 
 from speakers.models import Speaker, Room, Session

diff --git a/pythonie/speakers/management/commands/update-sessionize-json-stream.py b/pythonie/speakers/management/commands/update-sessionize-json-stream.py
@@ -51,7 +51,7 @@ class SessionizeModel(pydantic.BaseModel):
 
 class Command(BaseCommand):
  def handle(self, *args, **kwargs):
- response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All")
+ response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All", timeout=500)
  sessionize: SessionizeModel = SessionizeModel.parse_obj(response.json())
 
  rooms = {}

diff --git a/pythonie/speakers/templates/speakers/session.html b/pythonie/speakers/templates/speakers/session.html
@@ -27,7 +27,7 @@ <h2>{{ self.name }}</h2>
  <a href="{% pageurl speaker %}">{{ speaker.name }}</a>
  </td>
  <td>
- {{ speaker.biography|safe }}
+ {{ speaker.biography }}
  </td>
  </tr>
  {% endfor %}

diff --git a/requirements/dev.in b/requirements/dev.in
@@ -1,10 +1,12 @@
 # dev.in
 -c main.txt
+bandit
 black
 coverage
+django-debug-toolbar
 fakeredis
 flake8
 isort
 model-mommy
-pipdeptree
-django-debug-toolbar
+pip-tools
+pipdeptree
diff --git a/requirements/dev.txt b/requirements/dev.txt
@@ -1,62 +1,116 @@
-asgiref==3.6.0
+#
+# This file is autogenerated by pip-compile with Python 3.9
+# by the following command:
+#
+# pip-compile dev.in
+#
+asgiref==3.8.1
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
-async-timeout==4.0.2
+async-timeout==4.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # redis
-black==23.3.0
- # via -r requirements/dev.in
-click==8.1.3
- # via black
-coverage==7.2.2
- # via -r requirements/dev.in
-django==3.2.18
+bandit==1.7.8
+ # via -r dev.in
+black==24.3.0
+ # via -r dev.in
+build==1.1.1
+ # via pip-tools
+click==8.1.7
+ # via
+ # black
+ # pip-tools
+coverage==7.4.4
+ # via -r dev.in
+django==3.2.25
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django-debug-toolbar
  # model-mommy
-django-debug-toolbar==3.8.1
- # via -r requirements/dev.in
-fakeredis==2.10.2
- # via -r requirements/dev.in
-flake8==6.0.0
- # via -r requirements/dev.in
-isort==5.12.0
- # via -r requirements/dev.in
+django-debug-toolbar==4.3.0
+ # via -r dev.in
+fakeredis==2.21.3
+ # via -r dev.in
+flake8==7.0.0
+ # via -r dev.in
+importlib-metadata==7.1.0
+ # via build
+isort==5.13.2
+ # via -r dev.in
+markdown-it-py==3.0.0
+ # via rich
 mccabe==0.7.0
  # via flake8
+mdurl==0.1.2
+ # via markdown-it-py
 model-mommy==2.0.0
- # via -r requirements/dev.in
+ # via -r dev.in
 mypy-extensions==1.0.0
  # via black
-packaging==23.0
- # via black
-pathspec==0.11.1
+packaging==24.0
+ # via
+ # -c main.txt
+ # black
+ # build
+pathspec==0.12.1
  # via black
-pipdeptree==2.7.0
- # via -r requirements/dev.in
-platformdirs==3.2.0
+pbr==6.0.0
+ # via stevedore
+pip-tools==7.4.1
+ # via -r dev.in
+pipdeptree==2.16.1
+ # via -r dev.in
+platformdirs==4.2.0
  # via black
-pycodestyle==2.10.0
+pycodestyle==2.11.1
  # via flake8
-pyflakes==3.0.1
+pyflakes==3.2.0
  # via flake8
-pytz==2023.3
+pygments==2.17.2
+ # via rich
+pyproject-hooks==1.0.0
  # via
- # -c requirements/main.txt
+ # build
+ # pip-tools
+pytz==2024.1
+ # via
+ # -c main.txt
  # django
-redis==4.5.4
+pyyaml==6.0.1
+ # via bandit
+redis==5.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # fakeredis
+rich==13.7.1
+ # via bandit
 sortedcontainers==2.4.0
  # via fakeredis
-sqlparse==0.4.3
+sqlparse==0.4.4
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
  # django-debug-toolbar
+stevedore==5.2.0
+ # via bandit
 tomli==2.0.1
- # via black
+ # via
+ # black
+ # build
+ # pip-tools
+ # pyproject-hooks
+typing-extensions==4.10.0
+ # via
+ # -c main.txt
+ # asgiref
+ # black
+wheel==0.43.0
+ # via pip-tools
+zipp==3.18.1
+ # via importlib-metadata
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip
+# setuptools
diff --git a/requirements/main.in b/requirements/main.in
@@ -13,15 +13,16 @@ django-libsass
 django-modelcluster
 django-storages
 django-taggit
-gunicorn
+gunicorn>=22.0.0
 pandas
 pydantic
 python-dateutil
 pytz
 redis
 requests
 wagtail
-wagtail-blog
+# important to pin that version until that dependency is removed
+wagtail-blog==2.3.5
 wagtailfontawesome
 wagtailnews
 whitenoise
diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax = docker/dockerfile:1.4
-FROM python:3.10 AS compile-stage
+FROM python:3.13.0a4-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
 RUN --mount=type=cache,target=/var/cache/apt \
  apt update && \
  apt install -y --no-install-recommends \
@@ -19,3 +19,4 @@ RUN --mount=type=cache,target=/root/.cache \
 
 FROM compile-stage AS tests-stage
 
+USER nobody
diff --git a/Taskfile.yaml b/Taskfile.yaml
@@ -68,7 +68,7 @@ tasks:
  - docker compose run --rm web python pythonie/manage.py migrate
 
  django:collect-static:
- desc: Make migrations
+ desc: Make static resources
  cmds:
  - docker compose run --rm web python pythonie/manage.py collectstatic
 

diff --git a/pythonie/core/templates/base.html b/pythonie/core/templates/base.html
@@ -17,7 +17,8 @@
  <meta name="description" content=""/>
  <meta name="viewport" content="width=device-width, initial-scale=1"/>
 
- <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"></script>
+ <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"
+ integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"></script>
  <script type="text/javascript">try{Typekit.load({async: false});}catch(e){}</script>
 
 
@@ -56,7 +57,10 @@
 {% endcompress %}
 
 {% block basejs %}
- <script src="https://code.jquery.com/jquery.js"></script>
+ <script src="https://code.jquery.com/jquery-1.12.4.js"
+ integrity="sha256-Qw82+bXyGq6MydymqBxNPYTaUXXq7c8v3CwiYwLLNXU="
+ crossorigin="anonymous"></script>
+
  <script src="{% static 'js/jquery.smartmenus.js' %}"></script>
  <script src="{% static 'js/jquery.smartmenus.bootstrap.js' %}"></script>
  <script src="{% static 'js/bootstrap.min.js' %}"></script>

diff --git a/pythonie/meetups/test_meetups.py b/pythonie/meetups/test_meetups.py
@@ -10,9 +10,9 @@
 description = (
  "<p>We will be having a meetup in June. More details to follow."
  "</p> <p>If you are interested in speaking, please submit your "
- 'details to\xa0<a href="http://bit.ly/pyie-cfp-2015">'
- '<a href="http://bit.ly/pyie-cfp-2015" class="linkified">'
- "http://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
+ 'details to\xa0<a href="https://bit.ly/pyie-cfp-2015">'
+ '<a href="https://bit.ly/pyie-cfp-2015" class="linkified">'
+ "https://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
  "contact contact@python.ie.</p>"
 )
 
@@ -60,7 +60,7 @@ def _first_result(self):
  "description": description,
  "name": "Python Ireland meetup",
  "event_url": (
- "http://www.meetup.com/pythonireland/" "events/221078098/"
+ "https://www.meetup.com/pythonireland/" "events/221078098/"
  ),
  "headcount": 0,
  "time": 1433957400000,
@@ -123,7 +123,7 @@ def test_update_first_run(self, mock_get_content):
  self.assertEqual(meetup.visibility, "public")
  self.assertEqual(
  meetup.event_url,
- ("http://www.meetup.com/" "pythonireland/events/221078098/"),
+ ("https://www.meetup.com/" "pythonireland/events/221078098/"),
  )
 
  @patch("meetups.utils.get_content")

diff --git a/pythonie/pythonie/settings/dev.py b/pythonie/pythonie/settings/dev.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # just for dev #nosec B105
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/pythonie/settings/tests.py b/pythonie/pythonie/settings/tests.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" #nosec B105 # Just for dev
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/speakers/management/commands/import-sessionize.py b/pythonie/speakers/management/commands/import-sessionize.py
@@ -4,7 +4,6 @@
 import numpy as np
 import pandas as pd
 from django.core.management.base import BaseCommand, CommandParser
-from django.utils.text import slugify
 from wagtail.core.models import Page
 
 from speakers.models import Speaker, Room, Session

diff --git a/pythonie/speakers/management/commands/update-sessionize-json-stream.py b/pythonie/speakers/management/commands/update-sessionize-json-stream.py
@@ -51,7 +51,7 @@ class SessionizeModel(pydantic.BaseModel):
 
 class Command(BaseCommand):
  def handle(self, *args, **kwargs):
- response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All")
+ response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All", timeout=500)
  sessionize: SessionizeModel = SessionizeModel.parse_obj(response.json())
 
  rooms = {}

diff --git a/pythonie/speakers/templates/speakers/session.html b/pythonie/speakers/templates/speakers/session.html
@@ -27,7 +27,7 @@ <h2>{{ self.name }}</h2>
  <a href="{% pageurl speaker %}">{{ speaker.name }}</a>
  </td>
  <td>
- {{ speaker.biography|safe }}
+ {{ speaker.biography }}
  </td>
  </tr>
  {% endfor %}

diff --git a/requirements/dev.in b/requirements/dev.in
@@ -1,10 +1,12 @@
 # dev.in
 -c main.txt
+bandit
 black
 coverage
+django-debug-toolbar
 fakeredis
 flake8
 isort
 model-mommy
-pipdeptree
-django-debug-toolbar
+pip-tools
+pipdeptree
diff --git a/requirements/dev.txt b/requirements/dev.txt
@@ -1,62 +1,116 @@
-asgiref==3.6.0
+#
+# This file is autogenerated by pip-compile with Python 3.9
+# by the following command:
+#
+# pip-compile dev.in
+#
+asgiref==3.8.1
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
-async-timeout==4.0.2
+async-timeout==4.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # redis
-black==23.3.0
- # via -r requirements/dev.in
-click==8.1.3
- # via black
-coverage==7.2.2
- # via -r requirements/dev.in
-django==3.2.18
+bandit==1.7.8
+ # via -r dev.in
+black==24.3.0
+ # via -r dev.in
+build==1.1.1
+ # via pip-tools
+click==8.1.7
+ # via
+ # black
+ # pip-tools
+coverage==7.4.4
+ # via -r dev.in
+django==3.2.25
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django-debug-toolbar
  # model-mommy
-django-debug-toolbar==3.8.1
- # via -r requirements/dev.in
-fakeredis==2.10.2
- # via -r requirements/dev.in
-flake8==6.0.0
- # via -r requirements/dev.in
-isort==5.12.0
- # via -r requirements/dev.in
+django-debug-toolbar==4.3.0
+ # via -r dev.in
+fakeredis==2.21.3
+ # via -r dev.in
+flake8==7.0.0
+ # via -r dev.in
+importlib-metadata==7.1.0
+ # via build
+isort==5.13.2
+ # via -r dev.in
+markdown-it-py==3.0.0
+ # via rich
 mccabe==0.7.0
  # via flake8
+mdurl==0.1.2
+ # via markdown-it-py
 model-mommy==2.0.0
- # via -r requirements/dev.in
+ # via -r dev.in
 mypy-extensions==1.0.0
  # via black
-packaging==23.0
- # via black
-pathspec==0.11.1
+packaging==24.0
+ # via
+ # -c main.txt
+ # black
+ # build
+pathspec==0.12.1
  # via black
-pipdeptree==2.7.0
- # via -r requirements/dev.in
-platformdirs==3.2.0
+pbr==6.0.0
+ # via stevedore
+pip-tools==7.4.1
+ # via -r dev.in
+pipdeptree==2.16.1
+ # via -r dev.in
+platformdirs==4.2.0
  # via black
-pycodestyle==2.10.0
+pycodestyle==2.11.1
  # via flake8
-pyflakes==3.0.1
+pyflakes==3.2.0
  # via flake8
-pytz==2023.3
+pygments==2.17.2
+ # via rich
+pyproject-hooks==1.0.0
  # via
- # -c requirements/main.txt
+ # build
+ # pip-tools
+pytz==2024.1
+ # via
+ # -c main.txt
  # django
-redis==4.5.4
+pyyaml==6.0.1
+ # via bandit
+redis==5.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # fakeredis
+rich==13.7.1
+ # via bandit
 sortedcontainers==2.4.0
  # via fakeredis
-sqlparse==0.4.3
+sqlparse==0.4.4
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
  # django-debug-toolbar
+stevedore==5.2.0
+ # via bandit
 tomli==2.0.1
- # via black
+ # via
+ # black
+ # build
+ # pip-tools
+ # pyproject-hooks
+typing-extensions==4.10.0
+ # via
+ # -c main.txt
+ # asgiref
+ # black
+wheel==0.43.0
+ # via pip-tools
+zipp==3.18.1
+ # via importlib-metadata
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip
+# setuptools
diff --git a/requirements/main.in b/requirements/main.in
@@ -13,15 +13,16 @@ django-libsass
 django-modelcluster
 django-storages
 django-taggit
-gunicorn
+gunicorn>=22.0.0
 pandas
 pydantic
 python-dateutil
 pytz
 redis
 requests
 wagtail
-wagtail-blog
+# important to pin that version until that dependency is removed
+wagtail-blog==2.3.5
 wagtailfontawesome
 wagtailnews
 whitenoise
diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax = docker/dockerfile:1.4
-FROM python:3.10 AS compile-stage
+FROM python:3.13.0a4-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
 RUN --mount=type=cache,target=/var/cache/apt \
  apt update && \
  apt install -y --no-install-recommends \
@@ -19,3 +19,4 @@ RUN --mount=type=cache,target=/root/.cache \
 
 FROM compile-stage AS tests-stage
 
+USER nobody
diff --git a/Taskfile.yaml b/Taskfile.yaml
@@ -68,7 +68,7 @@ tasks:
  - docker compose run --rm web python pythonie/manage.py migrate
 
  django:collect-static:
- desc: Make migrations
+ desc: Make static resources
  cmds:
  - docker compose run --rm web python pythonie/manage.py collectstatic
 

diff --git a/pythonie/core/templates/base.html b/pythonie/core/templates/base.html
@@ -17,7 +17,8 @@
  <meta name="description" content=""/>
  <meta name="viewport" content="width=device-width, initial-scale=1"/>
 
- <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"></script>
+ <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"
+ integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"></script>
  <script type="text/javascript">try{Typekit.load({async: false});}catch(e){}</script>
 
 
@@ -56,7 +57,10 @@
 {% endcompress %}
 
 {% block basejs %}
- <script src="https://code.jquery.com/jquery.js"></script>
+ <script src="https://code.jquery.com/jquery-1.12.4.js"
+ integrity="sha256-Qw82+bXyGq6MydymqBxNPYTaUXXq7c8v3CwiYwLLNXU="
+ crossorigin="anonymous"></script>
+
  <script src="{% static 'js/jquery.smartmenus.js' %}"></script>
  <script src="{% static 'js/jquery.smartmenus.bootstrap.js' %}"></script>
  <script src="{% static 'js/bootstrap.min.js' %}"></script>

diff --git a/pythonie/meetups/test_meetups.py b/pythonie/meetups/test_meetups.py
@@ -10,9 +10,9 @@
 description = (
  "<p>We will be having a meetup in June. More details to follow."
  "</p> <p>If you are interested in speaking, please submit your "
- 'details to\xa0<a href="http://bit.ly/pyie-cfp-2015">'
- '<a href="http://bit.ly/pyie-cfp-2015" class="linkified">'
- "http://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
+ 'details to\xa0<a href="https://bit.ly/pyie-cfp-2015">'
+ '<a href="https://bit.ly/pyie-cfp-2015" class="linkified">'
+ "https://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
  "contact contact@python.ie.</p>"
 )
 
@@ -60,7 +60,7 @@ def _first_result(self):
  "description": description,
  "name": "Python Ireland meetup",
  "event_url": (
- "http://www.meetup.com/pythonireland/" "events/221078098/"
+ "https://www.meetup.com/pythonireland/" "events/221078098/"
  ),
  "headcount": 0,
  "time": 1433957400000,
@@ -123,7 +123,7 @@ def test_update_first_run(self, mock_get_content):
  self.assertEqual(meetup.visibility, "public")
  self.assertEqual(
  meetup.event_url,
- ("http://www.meetup.com/" "pythonireland/events/221078098/"),
+ ("https://www.meetup.com/" "pythonireland/events/221078098/"),
  )
 
  @patch("meetups.utils.get_content")

diff --git a/pythonie/pythonie/settings/dev.py b/pythonie/pythonie/settings/dev.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # just for dev #nosec B105
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/pythonie/settings/tests.py b/pythonie/pythonie/settings/tests.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" #nosec B105 # Just for dev
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/speakers/management/commands/import-sessionize.py b/pythonie/speakers/management/commands/import-sessionize.py
@@ -4,7 +4,6 @@
 import numpy as np
 import pandas as pd
 from django.core.management.base import BaseCommand, CommandParser
-from django.utils.text import slugify
 from wagtail.core.models import Page
 
 from speakers.models import Speaker, Room, Session

diff --git a/pythonie/speakers/management/commands/update-sessionize-json-stream.py b/pythonie/speakers/management/commands/update-sessionize-json-stream.py
@@ -51,7 +51,7 @@ class SessionizeModel(pydantic.BaseModel):
 
 class Command(BaseCommand):
  def handle(self, *args, **kwargs):
- response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All")
+ response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All", timeout=500)
  sessionize: SessionizeModel = SessionizeModel.parse_obj(response.json())
 
  rooms = {}

diff --git a/pythonie/speakers/templates/speakers/session.html b/pythonie/speakers/templates/speakers/session.html
@@ -27,7 +27,7 @@ <h2>{{ self.name }}</h2>
  <a href="{% pageurl speaker %}">{{ speaker.name }}</a>
  </td>
  <td>
- {{ speaker.biography|safe }}
+ {{ speaker.biography }}
  </td>
  </tr>
  {% endfor %}

diff --git a/requirements/dev.in b/requirements/dev.in
@@ -1,10 +1,12 @@
 # dev.in
 -c main.txt
+bandit
 black
 coverage
+django-debug-toolbar
 fakeredis
 flake8
 isort
 model-mommy
-pipdeptree
-django-debug-toolbar
+pip-tools
+pipdeptree
diff --git a/requirements/dev.txt b/requirements/dev.txt
@@ -1,62 +1,116 @@
-asgiref==3.6.0
+#
+# This file is autogenerated by pip-compile with Python 3.9
+# by the following command:
+#
+# pip-compile dev.in
+#
+asgiref==3.8.1
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
-async-timeout==4.0.2
+async-timeout==4.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # redis
-black==23.3.0
- # via -r requirements/dev.in
-click==8.1.3
- # via black
-coverage==7.2.2
- # via -r requirements/dev.in
-django==3.2.18
+bandit==1.7.8
+ # via -r dev.in
+black==24.3.0
+ # via -r dev.in
+build==1.1.1
+ # via pip-tools
+click==8.1.7
+ # via
+ # black
+ # pip-tools
+coverage==7.4.4
+ # via -r dev.in
+django==3.2.25
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django-debug-toolbar
  # model-mommy
-django-debug-toolbar==3.8.1
- # via -r requirements/dev.in
-fakeredis==2.10.2
- # via -r requirements/dev.in
-flake8==6.0.0
- # via -r requirements/dev.in
-isort==5.12.0
- # via -r requirements/dev.in
+django-debug-toolbar==4.3.0
+ # via -r dev.in
+fakeredis==2.21.3
+ # via -r dev.in
+flake8==7.0.0
+ # via -r dev.in
+importlib-metadata==7.1.0
+ # via build
+isort==5.13.2
+ # via -r dev.in
+markdown-it-py==3.0.0
+ # via rich
 mccabe==0.7.0
  # via flake8
+mdurl==0.1.2
+ # via markdown-it-py
 model-mommy==2.0.0
- # via -r requirements/dev.in
+ # via -r dev.in
 mypy-extensions==1.0.0
  # via black
-packaging==23.0
- # via black
-pathspec==0.11.1
+packaging==24.0
+ # via
+ # -c main.txt
+ # black
+ # build
+pathspec==0.12.1
  # via black
-pipdeptree==2.7.0
- # via -r requirements/dev.in
-platformdirs==3.2.0
+pbr==6.0.0
+ # via stevedore
+pip-tools==7.4.1
+ # via -r dev.in
+pipdeptree==2.16.1
+ # via -r dev.in
+platformdirs==4.2.0
  # via black
-pycodestyle==2.10.0
+pycodestyle==2.11.1
  # via flake8
-pyflakes==3.0.1
+pyflakes==3.2.0
  # via flake8
-pytz==2023.3
+pygments==2.17.2
+ # via rich
+pyproject-hooks==1.0.0
  # via
- # -c requirements/main.txt
+ # build
+ # pip-tools
+pytz==2024.1
+ # via
+ # -c main.txt
  # django
-redis==4.5.4
+pyyaml==6.0.1
+ # via bandit
+redis==5.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # fakeredis
+rich==13.7.1
+ # via bandit
 sortedcontainers==2.4.0
  # via fakeredis
-sqlparse==0.4.3
+sqlparse==0.4.4
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
  # django-debug-toolbar
+stevedore==5.2.0
+ # via bandit
 tomli==2.0.1
- # via black
+ # via
+ # black
+ # build
+ # pip-tools
+ # pyproject-hooks
+typing-extensions==4.10.0
+ # via
+ # -c main.txt
+ # asgiref
+ # black
+wheel==0.43.0
+ # via pip-tools
+zipp==3.18.1
+ # via importlib-metadata
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip
+# setuptools
diff --git a/requirements/main.in b/requirements/main.in
@@ -13,15 +13,16 @@ django-libsass
 django-modelcluster
 django-storages
 django-taggit
-gunicorn
+gunicorn>=22.0.0
 pandas
 pydantic
 python-dateutil
 pytz
 redis
 requests
 wagtail
-wagtail-blog
+# important to pin that version until that dependency is removed
+wagtail-blog==2.3.5
 wagtailfontawesome
 wagtailnews
 whitenoise
diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax = docker/dockerfile:1.4
-FROM python:3.10 AS compile-stage
+FROM python:3.13.0a4-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
 RUN --mount=type=cache,target=/var/cache/apt \
  apt update && \
  apt install -y --no-install-recommends \
@@ -19,3 +19,4 @@ RUN --mount=type=cache,target=/root/.cache \
 
 FROM compile-stage AS tests-stage
 
+USER nobody
diff --git a/Taskfile.yaml b/Taskfile.yaml
@@ -68,7 +68,7 @@ tasks:
  - docker compose run --rm web python pythonie/manage.py migrate
 
  django:collect-static:
- desc: Make migrations
+ desc: Make static resources
  cmds:
  - docker compose run --rm web python pythonie/manage.py collectstatic
 

diff --git a/pythonie/core/templates/base.html b/pythonie/core/templates/base.html
@@ -17,7 +17,8 @@
  <meta name="description" content=""/>
  <meta name="viewport" content="width=device-width, initial-scale=1"/>
 
- <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"></script>
+ <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"
+ integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"></script>
  <script type="text/javascript">try{Typekit.load({async: false});}catch(e){}</script>
 
 
@@ -56,7 +57,10 @@
 {% endcompress %}
 
 {% block basejs %}
- <script src="https://code.jquery.com/jquery.js"></script>
+ <script src="https://code.jquery.com/jquery-1.12.4.js"
+ integrity="sha256-Qw82+bXyGq6MydymqBxNPYTaUXXq7c8v3CwiYwLLNXU="
+ crossorigin="anonymous"></script>
+
  <script src="{% static 'js/jquery.smartmenus.js' %}"></script>
  <script src="{% static 'js/jquery.smartmenus.bootstrap.js' %}"></script>
  <script src="{% static 'js/bootstrap.min.js' %}"></script>

diff --git a/pythonie/meetups/test_meetups.py b/pythonie/meetups/test_meetups.py
@@ -10,9 +10,9 @@
 description = (
  "<p>We will be having a meetup in June. More details to follow."
  "</p> <p>If you are interested in speaking, please submit your "
- 'details to\xa0<a href="http://bit.ly/pyie-cfp-2015">'
- '<a href="http://bit.ly/pyie-cfp-2015" class="linkified">'
- "http://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
+ 'details to\xa0<a href="https://bit.ly/pyie-cfp-2015">'
+ '<a href="https://bit.ly/pyie-cfp-2015" class="linkified">'
+ "https://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
  "contact contact@python.ie.</p>"
 )
 
@@ -60,7 +60,7 @@ def _first_result(self):
  "description": description,
  "name": "Python Ireland meetup",
  "event_url": (
- "http://www.meetup.com/pythonireland/" "events/221078098/"
+ "https://www.meetup.com/pythonireland/" "events/221078098/"
  ),
  "headcount": 0,
  "time": 1433957400000,
@@ -123,7 +123,7 @@ def test_update_first_run(self, mock_get_content):
  self.assertEqual(meetup.visibility, "public")
  self.assertEqual(
  meetup.event_url,
- ("http://www.meetup.com/" "pythonireland/events/221078098/"),
+ ("https://www.meetup.com/" "pythonireland/events/221078098/"),
  )
 
  @patch("meetups.utils.get_content")

diff --git a/pythonie/pythonie/settings/dev.py b/pythonie/pythonie/settings/dev.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # just for dev #nosec B105
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/pythonie/settings/tests.py b/pythonie/pythonie/settings/tests.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" #nosec B105 # Just for dev
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/speakers/management/commands/import-sessionize.py b/pythonie/speakers/management/commands/import-sessionize.py
@@ -4,7 +4,6 @@
 import numpy as np
 import pandas as pd
 from django.core.management.base import BaseCommand, CommandParser
-from django.utils.text import slugify
 from wagtail.core.models import Page
 
 from speakers.models import Speaker, Room, Session

diff --git a/pythonie/speakers/management/commands/update-sessionize-json-stream.py b/pythonie/speakers/management/commands/update-sessionize-json-stream.py
@@ -51,7 +51,7 @@ class SessionizeModel(pydantic.BaseModel):
 
 class Command(BaseCommand):
  def handle(self, *args, **kwargs):
- response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All")
+ response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All", timeout=500)
  sessionize: SessionizeModel = SessionizeModel.parse_obj(response.json())
 
  rooms = {}

diff --git a/pythonie/speakers/templates/speakers/session.html b/pythonie/speakers/templates/speakers/session.html
@@ -27,7 +27,7 @@ <h2>{{ self.name }}</h2>
  <a href="{% pageurl speaker %}">{{ speaker.name }}</a>
  </td>
  <td>
- {{ speaker.biography|safe }}
+ {{ speaker.biography }}
  </td>
  </tr>
  {% endfor %}

diff --git a/requirements/dev.in b/requirements/dev.in
@@ -1,10 +1,12 @@
 # dev.in
 -c main.txt
+bandit
 black
 coverage
+django-debug-toolbar
 fakeredis
 flake8
 isort
 model-mommy
-pipdeptree
-django-debug-toolbar
+pip-tools
+pipdeptree
diff --git a/requirements/dev.txt b/requirements/dev.txt
@@ -1,62 +1,116 @@
-asgiref==3.6.0
+#
+# This file is autogenerated by pip-compile with Python 3.9
+# by the following command:
+#
+# pip-compile dev.in
+#
+asgiref==3.8.1
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
-async-timeout==4.0.2
+async-timeout==4.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # redis
-black==23.3.0
- # via -r requirements/dev.in
-click==8.1.3
- # via black
-coverage==7.2.2
- # via -r requirements/dev.in
-django==3.2.18
+bandit==1.7.8
+ # via -r dev.in
+black==24.3.0
+ # via -r dev.in
+build==1.1.1
+ # via pip-tools
+click==8.1.7
+ # via
+ # black
+ # pip-tools
+coverage==7.4.4
+ # via -r dev.in
+django==3.2.25
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django-debug-toolbar
  # model-mommy
-django-debug-toolbar==3.8.1
- # via -r requirements/dev.in
-fakeredis==2.10.2
- # via -r requirements/dev.in
-flake8==6.0.0
- # via -r requirements/dev.in
-isort==5.12.0
- # via -r requirements/dev.in
+django-debug-toolbar==4.3.0
+ # via -r dev.in
+fakeredis==2.21.3
+ # via -r dev.in
+flake8==7.0.0
+ # via -r dev.in
+importlib-metadata==7.1.0
+ # via build
+isort==5.13.2
+ # via -r dev.in
+markdown-it-py==3.0.0
+ # via rich
 mccabe==0.7.0
  # via flake8
+mdurl==0.1.2
+ # via markdown-it-py
 model-mommy==2.0.0
- # via -r requirements/dev.in
+ # via -r dev.in
 mypy-extensions==1.0.0
  # via black
-packaging==23.0
- # via black
-pathspec==0.11.1
+packaging==24.0
+ # via
+ # -c main.txt
+ # black
+ # build
+pathspec==0.12.1
  # via black
-pipdeptree==2.7.0
- # via -r requirements/dev.in
-platformdirs==3.2.0
+pbr==6.0.0
+ # via stevedore
+pip-tools==7.4.1
+ # via -r dev.in
+pipdeptree==2.16.1
+ # via -r dev.in
+platformdirs==4.2.0
  # via black
-pycodestyle==2.10.0
+pycodestyle==2.11.1
  # via flake8
-pyflakes==3.0.1
+pyflakes==3.2.0
  # via flake8
-pytz==2023.3
+pygments==2.17.2
+ # via rich
+pyproject-hooks==1.0.0
  # via
- # -c requirements/main.txt
+ # build
+ # pip-tools
+pytz==2024.1
+ # via
+ # -c main.txt
  # django
-redis==4.5.4
+pyyaml==6.0.1
+ # via bandit
+redis==5.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # fakeredis
+rich==13.7.1
+ # via bandit
 sortedcontainers==2.4.0
  # via fakeredis
-sqlparse==0.4.3
+sqlparse==0.4.4
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
  # django-debug-toolbar
+stevedore==5.2.0
+ # via bandit
 tomli==2.0.1
- # via black
+ # via
+ # black
+ # build
+ # pip-tools
+ # pyproject-hooks
+typing-extensions==4.10.0
+ # via
+ # -c main.txt
+ # asgiref
+ # black
+wheel==0.43.0
+ # via pip-tools
+zipp==3.18.1
+ # via importlib-metadata
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip
+# setuptools
diff --git a/requirements/main.in b/requirements/main.in
@@ -13,15 +13,16 @@ django-libsass
 django-modelcluster
 django-storages
 django-taggit
-gunicorn
+gunicorn>=22.0.0
 pandas
 pydantic
 python-dateutil
 pytz
 redis
 requests
 wagtail
-wagtail-blog
+# important to pin that version until that dependency is removed
+wagtail-blog==2.3.5
 wagtailfontawesome
 wagtailnews
 whitenoise
diff --git a/Dockerfile b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax = docker/dockerfile:1.4
-FROM python:3.10 AS compile-stage
+FROM python:3.13.0a4-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
-FROM python:3.13.0a4-slim AS compile-stage
+FROM python:3.12-slim AS compile-stage
 RUN --mount=type=cache,target=/var/cache/apt \
  apt update && \
  apt install -y --no-install-recommends \
@@ -19,3 +19,4 @@ RUN --mount=type=cache,target=/root/.cache \
 
 FROM compile-stage AS tests-stage
 
+USER nobody
diff --git a/Taskfile.yaml b/Taskfile.yaml
@@ -68,7 +68,7 @@ tasks:
  - docker compose run --rm web python pythonie/manage.py migrate
 
  django:collect-static:
- desc: Make migrations
+ desc: Make static resources
  cmds:
  - docker compose run --rm web python pythonie/manage.py collectstatic
 

diff --git a/pythonie/core/templates/base.html b/pythonie/core/templates/base.html
@@ -17,7 +17,8 @@
  <meta name="description" content=""/>
  <meta name="viewport" content="width=device-width, initial-scale=1"/>
 
- <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"></script>
+ <script type="text/javascript" src="//use.typekit.net/qgj1xay.js"
+ integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"></script>
  <script type="text/javascript">try{Typekit.load({async: false});}catch(e){}</script>
 
 
@@ -56,7 +57,10 @@
 {% endcompress %}
 
 {% block basejs %}
- <script src="https://code.jquery.com/jquery.js"></script>
+ <script src="https://code.jquery.com/jquery-1.12.4.js"
+ integrity="sha256-Qw82+bXyGq6MydymqBxNPYTaUXXq7c8v3CwiYwLLNXU="
+ crossorigin="anonymous"></script>
+
  <script src="{% static 'js/jquery.smartmenus.js' %}"></script>
  <script src="{% static 'js/jquery.smartmenus.bootstrap.js' %}"></script>
  <script src="{% static 'js/bootstrap.min.js' %}"></script>

diff --git a/pythonie/meetups/test_meetups.py b/pythonie/meetups/test_meetups.py
@@ -10,9 +10,9 @@
 description = (
  "<p>We will be having a meetup in June. More details to follow."
  "</p> <p>If you are interested in speaking, please submit your "
- 'details to\xa0<a href="http://bit.ly/pyie-cfp-2015">'
- '<a href="http://bit.ly/pyie-cfp-2015" class="linkified">'
- "http://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
+ 'details to\xa0<a href="https://bit.ly/pyie-cfp-2015">'
+ '<a href="https://bit.ly/pyie-cfp-2015" class="linkified">'
+ "https://bit.ly/pyie-cfp-2015</a></a>.</p> <p>Enquiries? Please "
  "contact contact@python.ie.</p>"
 )
 
@@ -60,7 +60,7 @@ def _first_result(self):
  "description": description,
  "name": "Python Ireland meetup",
  "event_url": (
- "http://www.meetup.com/pythonireland/" "events/221078098/"
+ "https://www.meetup.com/pythonireland/" "events/221078098/"
  ),
  "headcount": 0,
  "time": 1433957400000,
@@ -123,7 +123,7 @@ def test_update_first_run(self, mock_get_content):
  self.assertEqual(meetup.visibility, "public")
  self.assertEqual(
  meetup.event_url,
- ("http://www.meetup.com/" "pythonireland/events/221078098/"),
+ ("https://www.meetup.com/" "pythonireland/events/221078098/"),
  )
 
  @patch("meetups.utils.get_content")

diff --git a/pythonie/pythonie/settings/dev.py b/pythonie/pythonie/settings/dev.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # just for dev #nosec B105
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/pythonie/settings/tests.py b/pythonie/pythonie/settings/tests.py
@@ -4,7 +4,7 @@
 
 DEBUG = True
 
-SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" # Just for dev
+SECRET_KEY = "1185a082-7e72-449e-bf43-12d2da59222b" #nosec B105 # Just for dev
 MEETUP_KEY = "" # Put your own key here.
 # See https://secure.meetup.com/meetup_api/key/
 

diff --git a/pythonie/speakers/management/commands/import-sessionize.py b/pythonie/speakers/management/commands/import-sessionize.py
@@ -4,7 +4,6 @@
 import numpy as np
 import pandas as pd
 from django.core.management.base import BaseCommand, CommandParser
-from django.utils.text import slugify
 from wagtail.core.models import Page
 
 from speakers.models import Speaker, Room, Session

diff --git a/pythonie/speakers/management/commands/update-sessionize-json-stream.py b/pythonie/speakers/management/commands/update-sessionize-json-stream.py
@@ -51,7 +51,7 @@ class SessionizeModel(pydantic.BaseModel):
 
 class Command(BaseCommand):
  def handle(self, *args, **kwargs):
- response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All")
+ response = requests.get("https://sessionize.com/api/v2/z66z4kb6/view/All", timeout=500)
  sessionize: SessionizeModel = SessionizeModel.parse_obj(response.json())
 
  rooms = {}

diff --git a/pythonie/speakers/templates/speakers/session.html b/pythonie/speakers/templates/speakers/session.html
@@ -27,7 +27,7 @@ <h2>{{ self.name }}</h2>
  <a href="{% pageurl speaker %}">{{ speaker.name }}</a>
  </td>
  <td>
- {{ speaker.biography|safe }}
+ {{ speaker.biography }}
  </td>
  </tr>
  {% endfor %}

diff --git a/requirements/dev.in b/requirements/dev.in
@@ -1,10 +1,12 @@
 # dev.in
 -c main.txt
+bandit
 black
 coverage
+django-debug-toolbar
 fakeredis
 flake8
 isort
 model-mommy
-pipdeptree
-django-debug-toolbar
+pip-tools
+pipdeptree
diff --git a/requirements/dev.txt b/requirements/dev.txt
@@ -1,62 +1,116 @@
-asgiref==3.6.0
+#
+# This file is autogenerated by pip-compile with Python 3.9
+# by the following command:
+#
+# pip-compile dev.in
+#
+asgiref==3.8.1
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
-async-timeout==4.0.2
+async-timeout==4.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # redis
-black==23.3.0
- # via -r requirements/dev.in
-click==8.1.3
- # via black
-coverage==7.2.2
- # via -r requirements/dev.in
-django==3.2.18
+bandit==1.7.8
+ # via -r dev.in
+black==24.3.0
+ # via -r dev.in
+build==1.1.1
+ # via pip-tools
+click==8.1.7
+ # via
+ # black
+ # pip-tools
+coverage==7.4.4
+ # via -r dev.in
+django==3.2.25
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django-debug-toolbar
  # model-mommy
-django-debug-toolbar==3.8.1
- # via -r requirements/dev.in
-fakeredis==2.10.2
- # via -r requirements/dev.in
-flake8==6.0.0
- # via -r requirements/dev.in
-isort==5.12.0
- # via -r requirements/dev.in
+django-debug-toolbar==4.3.0
+ # via -r dev.in
+fakeredis==2.21.3
+ # via -r dev.in
+flake8==7.0.0
+ # via -r dev.in
+importlib-metadata==7.1.0
+ # via build
+isort==5.13.2
+ # via -r dev.in
+markdown-it-py==3.0.0
+ # via rich
 mccabe==0.7.0
  # via flake8
+mdurl==0.1.2
+ # via markdown-it-py
 model-mommy==2.0.0
- # via -r requirements/dev.in
+ # via -r dev.in
 mypy-extensions==1.0.0
  # via black
-packaging==23.0
- # via black
-pathspec==0.11.1
+packaging==24.0
+ # via
+ # -c main.txt
+ # black
+ # build
+pathspec==0.12.1
  # via black
-pipdeptree==2.7.0
- # via -r requirements/dev.in
-platformdirs==3.2.0
+pbr==6.0.0
+ # via stevedore
+pip-tools==7.4.1
+ # via -r dev.in
+pipdeptree==2.16.1
+ # via -r dev.in
+platformdirs==4.2.0
  # via black
-pycodestyle==2.10.0
+pycodestyle==2.11.1
  # via flake8
-pyflakes==3.0.1
+pyflakes==3.2.0
  # via flake8
-pytz==2023.3
+pygments==2.17.2
+ # via rich
+pyproject-hooks==1.0.0
  # via
- # -c requirements/main.txt
+ # build
+ # pip-tools
+pytz==2024.1
+ # via
+ # -c main.txt
  # django
-redis==4.5.4
+pyyaml==6.0.1
+ # via bandit
+redis==5.0.3
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # fakeredis
+rich==13.7.1
+ # via bandit
 sortedcontainers==2.4.0
  # via fakeredis
-sqlparse==0.4.3
+sqlparse==0.4.4
  # via
- # -c requirements/main.txt
+ # -c main.txt
  # django
  # django-debug-toolbar
+stevedore==5.2.0
+ # via bandit
 tomli==2.0.1
- # via black
+ # via
+ # black
+ # build
+ # pip-tools
+ # pyproject-hooks
+typing-extensions==4.10.0
+ # via
+ # -c main.txt
+ # asgiref
+ # black
+wheel==0.43.0
+ # via pip-tools
+zipp==3.18.1
+ # via importlib-metadata
+
+# The following packages are considered to be unsafe in a requirements file:
+# pip
+# setuptools
diff --git a/requirements/main.in b/requirements/main.in
@@ -13,15 +13,16 @@ django-libsass
 django-modelcluster
 django-storages
 django-taggit
-gunicorn
+gunicorn>=22.0.0
 pandas
 pydantic
 python-dateutil
 pytz
 redis
 requests
 wagtail
-wagtail-blog
+# important to pin that version until that dependency is removed
+wagtail-blog==2.3.5
 wagtailfontawesome
 wagtailnews
 whitenoise