chore(deps-dev): bump django from 4.2.4 to 4.2.5

[dependabot]

Bumps django from 4.2.4 to 4.2.5.

Commits

• b8b2f74 [4.2.x] Bumped version for 4.2.5 release.
• 9c51b4d [4.2.x] Fixed CVE-2023-41164 -- Fixed potential DoS in django.utils.encoding....
• acfb427 [4.2.x] Fixed #34803 -- Fixed queryset crash when filtering againts deeply ne...
• 55a0b9c [4.2.x] Added stub release notes and release date for 4.2.5, 4.1.11, and 3.2.21.
• 8e8c318 [4.2.x] Avoided counting exceptions in AsyncClient docs.
• dcb9d7a [4.2.x] Improved formset docs by using a set instead of a list in the custom ...
• f55b420 [4.2.x] Fixed #34781 -- Updated logging ref docs for django.server's request ...
• 46b2b08 [4.2.x] Fixed #34779 -- Avoided unnecessary selection of non-nullable m2m fie...
• d34db66 [4.2.x] Fixed #34773 -- Fixed syncing DEFAULT_FILE_STORAGE/STATICFILES_STORAG...
• a22aeef [4.2.x] Fixed #15799 -- Doc'd that Storage._open() should raise FileNotFoundE...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[thekaveman]

@dependabot rebase

[thekaveman]

@machikoyasuda can you please take this one, review the notes and make sure the update doesn't break anything locally?

[machikoyasuda]

4.2.5 release notes:

https://docs.djangoproject.com/en/4.2/releases/4.2.5/

• Django 4.2.5 fixes a security issue with severity “moderate” and several bugs in 4.2.4.
  CVE-2023-41164: Potential denial of service vulnerability in django.utils.encoding.uri_to_iri()¶

• django.utils.encoding.uri_to_iri() was subject to potential denial of service attack via certain inputs with a very large number of Unicode characters.

Bugfixes¶

Fixed a regression in Django 4.2 that caused an incorrect validation of CheckConstraints on __isnull lookups against JSONField ([#34754](https://code.djangoproject.com/ticket/34754)).
Fixed a bug in Django 4.2 where the deprecated DEFAULT_FILE_STORAGE and STATICFILES_STORAGE settings were not synced with STORAGES ([#34773](https://code.djangoproject.com/ticket/34773)).
Fixed a regression in Django 4.2.2 that caused an unnecessary selection of a non-nullable ManyToManyField without a natural key during serialization ([#34779](https://code.djangoproject.com/ticket/34779)).
Fixed a regression in Django 4.2 that caused a crash of a queryset when filtering against deeply nested OuterRef() annotations ([#34803](https://code.djangoproject.com/ticket/34803)).

---

Deprecation warnings in the app:

/home/calitp/.local/lib/python3.10/site-packages/django/conf/__init__.py:267: RemovedInDjango50Warning: The USE_L10N setting is deprecated. Starting with Django 5.0, localized formatting of data will always be enabled. For example Django will display numbers and dates using the format of the current locale. warnings.warn(USE_L10N_DEPRECATED_MSG, RemovedInDjango50Warning) - The Benefits app has USE_L10N set to True.

[machikoyasuda]

• Ran the app locally and ran thru app flows
• Looked for any deprecation warnings
• Read thru Changelog