From ac59a82095217f974be8e9e7f0a9ebb58bd4d4f7 Mon Sep 17 00:00:00 2001 From: Leon Anavi Date: Thu, 5 Nov 2026 13:55:12 +0200 Subject: [PATCH] python3-django: Upgrade 6.1.2 -> 6.1.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upgrade to release 6.1.3: Security fixes: - CVE-2026-108147: Potential memory exhaustion in MultiPartParser via base64-encoded file upload - CVE-2026-111211: Potential log injection via unescaped geometry form values - CVE-2026-111362: Server-side request forgery via crs member of GeoJSON geometrie - CVE-2026-113593: Potential exposure of private data via empty and missing Vary headers - CVE-2026-113733: Password hash disclosure to “view only” admin users with custom user models - CVE-2026-114582: Server-side request forgery via SpatialReference string input Bug fixes: - Fixed a bug in Django 6.1 where accessing a deferred field with the FETCH_PEERS fetch mode overwrote values that peer instances had already modified locally or loaded via refresh_from_db() with an explicit fields argument. The fix also addresses a KeyError when a peer's row had been deleted - Fixed a regression in Django 6.1 where the YAML serializer crashed if passed the sort_keys option - Fixed a regression in Django 6.1 where a Value expression with a None value and an output field other than JSONField crashed on SQLite when used in a top-level JSONField in lookup. Using such an expression in an IN lookup is likely unintended, since SQL NULL cannot match any value. - Fixed a regression in Django 6.1 where legend_tag() with a custom attrs could add the required_css_class more than once. - Added compatibility for oracledb 26.0.0+ - Fixed a crash in makemessages on Windows when processing files with non-ASCII names on Python 3.15+, or with UTF-8 mode enabled on older Python versions. Signed-off-by: Leon Anavi Signed-off-by: Khem Raj --- meta-python/recipes-devtools/python/python3-django_6.1.2.bb | 4 ---- meta-python/recipes-devtools/python/python3-django_6.1.3.bb | 4 ++++ 2 files changed, 4 insertions(+), 4 deletions(-) delete mode 100644 meta-python/recipes-devtools/python/python3-django_6.1.2.bb create mode 100644 meta-python/recipes-devtools/python/python3-django_6.1.3.bb diff --git a/meta-python/recipes-devtools/python/python3-django_6.1.2.bb b/meta-python/recipes-devtools/python/python3-django_6.1.2.bb deleted file mode 100644 index ff1ba01d68..0000000000 --- a/meta-python/recipes-devtools/python/python3-django_6.1.2.bb +++ /dev/null @@ -1,4 +0,0 @@ -require python3-django.inc -inherit python_setuptools_build_meta - -SRC_URI[sha256sum] = "a1e92451ccb8b514e91bbb3b6d186d20b4030558f116b5d9de6535455ff210b7" diff --git a/meta-python/recipes-devtools/python/python3-django_6.1.3.bb b/meta-python/recipes-devtools/python/python3-django_6.1.3.bb new file mode 100644 index 0000000000..64f6d412ea --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-django_6.1.3.bb @@ -0,0 +1,4 @@ +require python3-django.inc +inherit python_setuptools_build_meta + +SRC_URI[sha256sum] = "b5d2d9e35295065d13b1927b3f19a59bd119f737aa6299def14ccca1ae3c8c0d"