Upgrade to release 6.1.3:
Security fixes:
- CVE-2026-108147: Potential memory exhaustion in MultiPartParser
via base64-encoded file upload
- CVE-2026-111211: Potential log injection via unescaped geometry
form values
- CVE-2026-111362: Server-side request forgery via crs member of
GeoJSON geometrie
- CVE-2026-113593: Potential exposure of private data via empty
and missing Vary headers
- CVE-2026-113733: Password hash disclosure to “view only” admin
users with custom user models
- CVE-2026-114582: Server-side request forgery via
SpatialReference string input
Bug fixes:
- Fixed a bug in Django 6.1 where accessing a deferred field with
the FETCH_PEERS fetch mode overwrote values that peer instances
had already modified locally or loaded via refresh_from_db() with
an explicit fields argument. The fix also addresses a KeyError
when a peer's row had been deleted
- Fixed a regression in Django 6.1 where the YAML serializer
crashed if passed the sort_keys option
- Fixed a regression in Django 6.1 where a Value expression with a
None value and an output field other than JSONField crashed on
SQLite when used in a top-level JSONField in lookup. Using such an
expression in an IN lookup is likely unintended, since SQL NULL
cannot match any value.
- Fixed a regression in Django 6.1 where legend_tag() with a
custom attrs could add the required_css_class more than once.
- Added compatibility for oracledb 26.0.0+
- Fixed a crash in makemessages on Windows when processing files
with non-ASCII names on Python 3.15+, or with UTF-8 mode enabled
on older Python versions.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
