Stable/4.1.x #loophole #serious

.git-blame-ignore-revs

@@ -2,3 +2,5 @@ ca88caa1031c0de545d82de8d90dcae0e03651fb
 c5cd8783825b5f6384417dac5f3889b4210b7d08
 9c19aff7c7561e3a82978a272ecdaad40dda5c00
 7119f40c9881666b6f9b5cf7df09ee1d21cc8344
+d3f5782a335823401aa51cae02dd5e789029143a
+a637d0bd22665edfe7af40b4da3297462ec3c9cf

.github/workflows/linters.yml

@@ -27,7 +27,8 @@ jobs:
           python-version: '3.10'
       - run: python -m pip install flake8
       - name: flake8
-        uses: liskin/gh-problem-matcher-wrap@v1
+        # Pinned to v2.0.0.
+        uses: liskin/gh-problem-matcher-wrap@d8afa2cfb66dd3f982b1950429e652bc14d0d7d2
         with:
           linters: flake8
           run: flake8
@@ -43,7 +44,8 @@ jobs:
           python-version: '3.10'
       - run: python -m pip install isort
       - name: isort
-        uses: liskin/gh-problem-matcher-wrap@v1
+        # Pinned to v2.0.0.
+        uses: liskin/gh-problem-matcher-wrap@d8afa2cfb66dd3f982b1950429e652bc14d0d7d2
         with:
           linters: isort
           run: isort --check --diff django tests scripts

.github/workflows/tests.yml

@@ -46,7 +46,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v3
         with:
-          node-version: '12'
+          node-version: '14'
           cache: 'npm'
           cache-dependency-path: '**/package.json'
       - run: npm install

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/psf/black
-    rev: 22.3.0
+    rev: 23.1.0
     hooks:
     - id: black
       exclude: \.py-tpl$
@@ -9,10 +9,10 @@ repos:
     hooks:
       - id: isort
   - repo: https://github.com/PyCQA/flake8
-    rev: 4.0.1
+    rev: 5.0.0
     hooks:
       - id: flake8
   - repo: https://github.com/pre-commit/mirrors-eslint
-    rev: v8.3.0
+    rev: v8.15.0
     hooks:
       - id: eslint

AUTHORS

@@ -22,6 +22,7 @@ answer newbie questions, and generally made Django that much better:
     Ade Lee <alee@redhat.com>
     Adiyat Mubarak <adiyatmubarak@gmail.com>
     Adnan Umer <u.adnan@outlook.com>
+    Arslan Noor <arslannoorpansota@gmail.com>
     Adrian Holovaty <adrian@holovaty.com>
     Adrian Torres <atorresj@redhat.com>
     Adrien Lemaire <lemaire.adrien@gmail.com>
@@ -319,11 +320,13 @@ answer newbie questions, and generally made Django that much better:
     Filip Noetzel <http://filip.noetzel.co.uk/>
     Filip Wasilewski <filip.wasilewski@gmail.com>
     Finn Gruwier Larsen <finn@gruwier.dk>
+    Fiza Ashraf <fizaashraf37@gmail.com>
     Flávio Juvenal da Silva Junior <flavio@vinta.com.br>
     flavio.curella@gmail.com
     Florian Apolloner <florian@apolloner.eu>
     Florian Demmer <fdemmer@gmail.com>
     Florian Moussous <florian.moussous@gmail.com>
+    fnaimi66 <https://github.com/fnaimi66>
     Fran Hrženjak <fran.hrzenjak@gmail.com>
     Francisco Albarran Cristobal <pahko.xd@gmail.com>
     Francisco Couzo <franciscouzo@gmail.com>
@@ -422,6 +425,7 @@ answer newbie questions, and generally made Django that much better:
     james_027@yahoo.com
     James Aylett
     James Bennett <james@b-list.org>
+    James Gillard <jamesgillard@live.co.uk>
     James Murty
     James Tauber <jtauber@jtauber.com>
     James Timmins <jameshtimmins@gmail.com>
@@ -489,7 +493,9 @@ answer newbie questions, and generally made Django that much better:
     John Shaffer <jshaffer2112@gmail.com>
     Jökull Sólberg Auðunsson <jokullsolberg@gmail.com>
     Jon Dufresne <jon.dufresne@gmail.com>
+    Jon Janzen <jon@jonjanzen.com>
     Jonas Haag <jonas@lophus.org>
+    Jonas Lundberg <jonas.lundberg@gmail.com>
     Jonathan Davis <jonathandavis47780@gmail.com>
     Jonatas C. D. <jonatas.cd@gmail.com>
     Jonathan Buchanan <jonathan.buchanan@gmail.com>

django/__init__.py

@@ -1,6 +1,6 @@
 from django.utils.version import get_version
 
-VERSION = (4, 1, 0, "alpha", 0)
+VERSION = (4, 1, 8, "alpha", 0)
 
 __version__ = get_version(VERSION)
 

django/conf/global_settings.py

@@ -313,6 +313,10 @@ def gettext_noop(s):
 # SuspiciousOperation (TooManyFieldsSent) is raised.
 DATA_UPLOAD_MAX_NUMBER_FIELDS = 1000
 
+# Maximum number of files encoded in a multipart upload that will be read
+# before a SuspiciousOperation (TooManyFilesSent) is raised.
+DATA_UPLOAD_MAX_NUMBER_FILES = 100
+
 # Directory in which upload streamed files will be temporarily saved. A value of
 # `None` will make Django use the operating system's default temporary directory
 # (i.e. "/tmp" on *nix systems).