diff mbox series

[meta-python,03/36] python3-django: Upgrade 5.2.18 -> 6.1.2

Message ID 20261021110103.1943456-3-leon.anavi@konsulko.com
State Under Review
Headers show
Series [meta-python,01/36] python3-cachetools: Upgrade 7.2.3 -> 7.2.4 | expand

Commit Message

Leon Anavi Oct. 21, 2026, 11 a.m. UTC 
Upgrade to release 6.1.2 which fixes:

- CVE-2026-77050: Potential denial-of-service vulnerability in
  get_supported_language_variant()
- CVE-2026-84429: Potential denial-of-service vulnerability in
  HTTP header parsing
- CVE-2026-87890: Potential request forgery via spatial lookup
  byte values
- CVE-2026-87975: Privilege abuse in model formsets with editable
  primary keys

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
---
 ...sgfmt_error_including_non_ascii-test.patch | 71 -------------------
 .../python/python3-django_5.2.18.bb           |  5 --
 .../python/python3-django_6.1.2.bb            |  4 ++
 3 files changed, 4 insertions(+), 76 deletions(-)
 delete mode 100644 meta-python/recipes-devtools/python/python3-django/0001-fix-test_msgfmt_error_including_non_ascii-test.patch
 delete mode 100644 meta-python/recipes-devtools/python/python3-django_5.2.18.bb
 create mode 100644 meta-python/recipes-devtools/python/python3-django_6.1.2.bb
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-django/0001-fix-test_msgfmt_error_including_non_ascii-test.patch b/meta-python/recipes-devtools/python/python3-django/0001-fix-test_msgfmt_error_including_non_ascii-test.patch
deleted file mode 100644
index 6f887b3015..0000000000
--- a/meta-python/recipes-devtools/python/python3-django/0001-fix-test_msgfmt_error_including_non_ascii-test.patch
+++ /dev/null
@@ -1,71 +0,0 @@ 
-From 1960ecd879ce351226b36e7ac0aa25616241b6f6 Mon Sep 17 00:00:00 2001
-From: Jericho Serrano <118679068+jericho1050@users.noreply.github.com>
-Date: Fri, 6 Jun 2025 04:58:29 +0800
-Subject: [PATCH] Fixed #36421 -- Made test_msgfmt_error_including_non_ascii
- compatible with msgfmt 0.25.
-
-Upstream-Status: Backport [https://github.com/django/django/commit/1960ecd879ce351226b36e7ac0aa25616241b6f6]
-Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
----
- tests/i18n/test_compilation.py | 25 +++++++++++++++++++++++--
- 1 file changed, 23 insertions(+), 2 deletions(-)
-
-diff --git a/tests/i18n/test_compilation.py b/tests/i18n/test_compilation.py
-index 4b0bb9f6bb16..3a57dbf0765f 100644
---- a/tests/i18n/test_compilation.py
-+++ b/tests/i18n/test_compilation.py
-@@ -1,5 +1,6 @@
- import gettext as gettext_module
- import os
-+import re
- import stat
- import unittest
- from io import StringIO
-@@ -8,10 +9,12 @@
- from unittest import mock
- 
- from django.core.management import CommandError, call_command, execute_from_command_line
--from django.core.management.utils import find_command
-+from django.core.management.utils import find_command, popen_wrapper
- from django.test import SimpleTestCase, override_settings
- from django.test.utils import captured_stderr, captured_stdout
- from django.utils import translation
-+from django.utils.encoding import DEFAULT_LOCALE_ENCODING
-+from django.utils.functional import cached_property
- from django.utils.translation import gettext
- 
- from .utils import RunInTmpDirMixin, copytree
-@@ -254,6 +257,17 @@ def test_no_dirs_accidentally_skipped(self):
- 
- 
- class CompilationErrorHandling(MessageCompilationTests):
-+    @cached_property
-+    def msgfmt_version(self):
-+        # Note that msgfmt is installed via GNU gettext tools, hence the msgfmt
-+        # version should align to gettext.
-+        out, err, status = popen_wrapper(
-+            ["msgfmt", "--version"],
-+            stdout_encoding=DEFAULT_LOCALE_ENCODING,
-+        )
-+        m = re.search(r"(\d+)\.(\d+)\.?(\d+)?", out)
-+        return tuple(int(d) for d in m.groups() if d is not None)
-+
-     def test_error_reported_by_msgfmt(self):
-         # po file contains wrong po formatting.
-         with self.assertRaises(CommandError):
-@@ -278,7 +292,14 @@ def test_msgfmt_error_including_non_ascii(self):
-                 call_command(
-                     "compilemessages", locale=["ko"], stdout=StringIO(), stderr=stderr
-                 )
--            self.assertIn("' cannot start a field name", stderr.getvalue())
-+            if self.msgfmt_version < (0, 25):
-+                error_msg = "' cannot start a field name"
-+            else:
-+                error_msg = (
-+                    "a field name starts with a character that is not alphanumerical "
-+                    "or underscore"
-+                )
-+            self.assertIn(error_msg, stderr.getvalue())
- 
- 
- class ProjectAndAppTests(MessageCompilationTests):
diff --git a/meta-python/recipes-devtools/python/python3-django_5.2.18.bb b/meta-python/recipes-devtools/python/python3-django_5.2.18.bb
deleted file mode 100644
index eb84122116..0000000000
--- a/meta-python/recipes-devtools/python/python3-django_5.2.18.bb
+++ /dev/null
@@ -1,5 +0,0 @@ 
-require python3-django.inc
-inherit python_setuptools_build_meta
-
-SRC_URI += "file://0001-fix-test_msgfmt_error_including_non_ascii-test.patch"
-SRC_URI[sha256sum] = "461c5dd06d2ea16bd5ca37d3f46e4def1d6b0fe7588c6f4e2119517bb0af8b2d"
diff --git a/meta-python/recipes-devtools/python/python3-django_6.1.2.bb b/meta-python/recipes-devtools/python/python3-django_6.1.2.bb
new file mode 100644
index 0000000000..ff1ba01d68
--- /dev/null
+++ b/meta-python/recipes-devtools/python/python3-django_6.1.2.bb
@@ -0,0 +1,4 @@ 
+require python3-django.inc
+inherit python_setuptools_build_meta
+
+SRC_URI[sha256sum] = "a1e92451ccb8b514e91bbb3b6d186d20b4030558f116b5d9de6535455ff210b7"