New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency Django to v3.1.13 [SECURITY] - abandoned #274

Open

renovate wants to merge 1 commit into master from renovate/pypi-Django-vulnerability

Contributor

renovate bot commented Apr 26, 2021 •

edited

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
Django (source, changelog)	`==3.0.8` -> `==3.1.13`

GitHub Vulnerability Alerts

CVE-2021-28658

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.

CVE-2021-31542

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.

CVE-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.

Release Notes

django/django

`v3.1.13`

`v3.1.12`

`v3.1.11`

`v3.1.10`

`v3.1.9`

`v3.1.8`

`v3.1.7`

`v3.1.6`

`v3.1.5`

`v3.1.4`

`v3.1.3`

`v3.1.2`

`v3.1.1`

`v3.1`

`v3.0.14`

`v3.0.13`

`v3.0.12`

`v3.0.11`

`v3.0.10`

`v3.0.9`

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

renovate bot requested a review from Clivern as a code owner

April 26, 2021 12:49

renovate bot force-pushed the renovate/pypi-Django-vulnerability branch from a21a0d4 to 7f27bd9 Compare

June 6, 2021 22:10

renovate bot changed the title ~~Update dependency Django to v3.0.14 [SECURITY]~~ Update dependency Django to v3.1.9 [SECURITY]

sonarcloud bot commented Jun 6, 2021

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information


          Update dependency Django to v3.1.13 [SECURITY]

69b68b2

renovate bot force-pushed the renovate/pypi-Django-vulnerability branch from 7f27bd9 to 69b68b2 Compare

October 18, 2021 17:25

renovate bot changed the title ~~Update dependency Django to v3.1.9 [SECURITY]~~ Update dependency Django to v3.1.13 [SECURITY]

sonarcloud bot commented Oct 18, 2021

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

Contributor Author

renovate bot commented Mar 24, 2023

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.

renovate bot changed the title ~~Update dependency Django to v3.1.13 [SECURITY]~~ Update dependency Django to v3.1.13 [SECURITY] - abandoned

Contributor Author

renovate bot commented Feb 24, 2024

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment