| Message ID | 20261105115526.634289-5-leon.anavi@konsulko.com |
|---|---|
| State | New |
| Headers | show |
| Series | [meta-python,01/19] python3-apispec: Upgrade 6.10.0 -> 6.10.1 | expand |
diff --git a/meta-python/recipes-devtools/python/python3-django_6.1.2.bb b/meta-python/recipes-devtools/python/python3-django_6.1.2.bb deleted file mode 100644 index ff1ba01d68..0000000000 --- a/meta-python/recipes-devtools/python/python3-django_6.1.2.bb +++ /dev/null @@ -1,4 +0,0 @@ -require python3-django.inc -inherit python_setuptools_build_meta - -SRC_URI[sha256sum] = "a1e92451ccb8b514e91bbb3b6d186d20b4030558f116b5d9de6535455ff210b7" diff --git a/meta-python/recipes-devtools/python/python3-django_6.1.3.bb b/meta-python/recipes-devtools/python/python3-django_6.1.3.bb new file mode 100644 index 0000000000..64f6d412ea --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-django_6.1.3.bb @@ -0,0 +1,4 @@ +require python3-django.inc +inherit python_setuptools_build_meta + +SRC_URI[sha256sum] = "b5d2d9e35295065d13b1927b3f19a59bd119f737aa6299def14ccca1ae3c8c0d"
Upgrade to release 6.1.3: Security fixes: - CVE-2026-108147: Potential memory exhaustion in MultiPartParser via base64-encoded file upload - CVE-2026-111211: Potential log injection via unescaped geometry form values - CVE-2026-111362: Server-side request forgery via crs member of GeoJSON geometrie - CVE-2026-113593: Potential exposure of private data via empty and missing Vary headers - CVE-2026-113733: Password hash disclosure to “view only” admin users with custom user models - CVE-2026-114582: Server-side request forgery via SpatialReference string input Bug fixes: - Fixed a bug in Django 6.1 where accessing a deferred field with the FETCH_PEERS fetch mode overwrote values that peer instances had already modified locally or loaded via refresh_from_db() with an explicit fields argument. The fix also addresses a KeyError when a peer's row had been deleted - Fixed a regression in Django 6.1 where the YAML serializer crashed if passed the sort_keys option - Fixed a regression in Django 6.1 where a Value expression with a None value and an output field other than JSONField crashed on SQLite when used in a top-level JSONField in lookup. Using such an expression in an IN lookup is likely unintended, since SQL NULL cannot match any value. - Fixed a regression in Django 6.1 where legend_tag() with a custom attrs could add the required_css_class more than once. - Added compatibility for oracledb 26.0.0+ - Fixed a crash in makemessages on Windows when processing files with non-ASCII names on Python 3.15+, or with UTF-8 mode enabled on older Python versions. Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> --- meta-python/recipes-devtools/python/python3-django_6.1.2.bb | 4 ---- meta-python/recipes-devtools/python/python3-django_6.1.3.bb | 4 ++++ 2 files changed, 4 insertions(+), 4 deletions(-) delete mode 100644 meta-python/recipes-devtools/python/python3-django_6.1.2.bb create mode 100644 meta-python/recipes-devtools/python/python3-django_6.1.3.bb