django: CVE-2019-3498

[dotlambda]

Motivation for this change

https://www.djangoproject.com/weblog/2019/jan/04/security-releases/

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Assured whether relevant documentation is up to date
• Fits CONTRIBUTING.md.

---

cc @georgewhewell

[lsix]

Looks good to me. I have built locally the different versions, not tested them.

[dotlambda]

Tested every dependency except sage (to which this change shouldn't make any difference) using nix-review. The reported failures (python27Packages.buildbot python27Packages.buildbot-full python27Packages.buildbot-plugins.console-view python27Packages.buildbot-plugins.grid-view python27Packages.buildbot-plugins.waterfall-view python27Packages.buildbot-plugins.wsgi-dashboards python27Packages.buildbot-ui python27Packages.django-sites python27Packages.django_evolution python27Packages.django_silk python37Packages.buildbot python37Packages.buildbot-full python37Packages.buildbot-plugins.console-view python37Packages.buildbot-plugins.grid-view python37Packages.buildbot-plugins.waterfall-view python37Packages.buildbot-plugins.wsgi-dashboards python37Packages.buildbot-ui python37Packages.django-sites python37Packages.django_silk python37Packages.djmail) are also present in the master branch. I can also confirm that sage.quicktest builds fine.