-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update dependency Django to v4.1.10 [SECURITY] - autoclosed #18
Conversation
⚠ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: Pipfile.lock
|
f719d3e
to
13fae11
Compare
13fae11
to
c8c2a0b
Compare
c8c2a0b
to
ff4e677
Compare
ff4e677
to
b20e7a7
Compare
b20e7a7
to
75eb936
Compare
75eb936
to
5936e5d
Compare
5936e5d
to
46cc2a4
Compare
46cc2a4
to
f5c2bd6
Compare
f5c2bd6
to
a7579aa
Compare
a7579aa
to
7503739
Compare
7503739
to
9e464af
Compare
9e464af
to
a0e74f3
Compare
a0e74f3
to
5c8072e
Compare
5c8072e
to
a17855f
Compare
a17855f
to
2c3b6c3
Compare
8de7d34
to
e63c8a8
Compare
e63c8a8
to
b7d8962
Compare
b7d8962
to
0c48386
Compare
0c48386
to
3228a86
Compare
3228a86
to
85afa19
Compare
85afa19
to
c6ea7d9
Compare
c6ea7d9
to
9215bc0
Compare
9215bc0
to
de9a35d
Compare
de9a35d
to
996940b
Compare
a373912
to
051ec43
Compare
051ec43
to
7f3ec29
Compare
|
7f3ec29
to
99e1de6
Compare
This PR contains the following updates:
==4.0.5
->==4.1.10
GitHub Vulnerability Alerts
CVE-2022-36359
An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.
CVE-2023-36053
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3,
EmailValidator
andURLValidator
are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.CVE-2023-24580
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
CVE-2023-31047
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
Release Notes
django/django (Django)
v4.1.10
Compare Source
v4.1.9
Compare Source
v4.1.8
Compare Source
v4.1.7
Compare Source
v4.1.6
Compare Source
v4.1.5
Compare Source
v4.1.4
Compare Source
v4.1.3
Compare Source
v4.1.2
Compare Source
v4.1.1
Compare Source
v4.1
Compare Source
v4.0.10
Compare Source
v4.0.9
Compare Source
v4.0.8
Compare Source
v4.0.7
Compare Source
v4.0.6
Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.