[pkgsrc/trunk]: pkgsrc/www/py-django3 py-django3: updated to 3.0.7

[adam <adam%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/5ce71a54c612
branches:  trunk
changeset: 433532:5ce71a54c612
user:      adam <adam%pkgsrc.org@localhost>
date:      Wed Jun 03 15:29:36 2020 +0000

description:
py-django3: updated to 3.0.7

Django 3.0.7 fixes two security issues and several bugs in 3.0.6.

CVE-2020-13254: Potential data leakage via malformed memcached keys

In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. In order to avoid this vulnerability, key 
validation is added to the memcached cache backends.

CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget

Query parameters for the admin ForeignKeyRawIdWidget were not properly URL encoded, posing an XSS attack vector. ForeignKeyRawIdWidget now ensures query parameters are correctly URL encoded.

Bugfixes

Fixed a regression in Django 3.0 by restoring the ability to use field lookups in Meta.ordering.
Fixed a regression in Django 3.0 where QuerySet.values() and values_list() crashed if a queryset contained an aggregation and a subquery annotation.
Fixed a regression in Django 3.0 where aggregates used wrong annotations when a queryset has multiple subqueries annotations.
Fixed a regression in Django 3.0 where QuerySet.values() and values_list() crashed if a queryset contained an aggregation and an Exists() annotation on Oracle.
Fixed a regression in Django 3.0 where all resolved Subquery() expressions were considered equal.
Fixed a regression in Django 3.0.5 that affected translation loading for apps providing translations for territorial language variants as well as a generic language, where the project has different 
plural equations for the language.
Tracking a jQuery security release, upgraded the version of jQuery used by the admin from 3.4.1 to 3.5.1.

diffstat:

 www/py-django3/Makefile |   4 ++--
 www/py-django3/distinfo |  10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diffs (27 lines):

diff -r 12261a1753ac -r 5ce71a54c612 www/py-django3/Makefile
--- a/www/py-django3/Makefile   Wed Jun 03 15:28:38 2020 +0000
+++ b/www/py-django3/Makefile   Wed Jun 03 15:29:36 2020 +0000
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.4 2020/05/12 06:55:19 adam Exp $
+# $NetBSD: Makefile,v 1.5 2020/06/03 15:29:36 adam Exp $
 
-DISTNAME=      Django-3.0.6
+DISTNAME=      Django-3.0.7
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/
diff -r 12261a1753ac -r 5ce71a54c612 www/py-django3/distinfo
--- a/www/py-django3/distinfo   Wed Jun 03 15:28:38 2020 +0000
+++ b/www/py-django3/distinfo   Wed Jun 03 15:29:36 2020 +0000
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.4 2020/05/12 06:55:19 adam Exp $
+$NetBSD: distinfo,v 1.5 2020/06/03 15:29:36 adam Exp $
 
-SHA1 (Django-3.0.6.tar.gz) = c2d4bb41760eae528ae2f67cb087f64456910673
-RMD160 (Django-3.0.6.tar.gz) = 3b90cc648f3fad4f9afc2e20fe5adf34c07c94b6
-SHA512 (Django-3.0.6.tar.gz) = 4c92c51386919c389037d6c6d1de3cb6ec443bd1f216f20797fb20fb24ea8d021701a03805ba693deadfa82b1aee38ae0d7fc03cae94cd744b1d1fa47ddc46ad
-Size (Django-3.0.6.tar.gz) = 9070990 bytes
+SHA1 (Django-3.0.7.tar.gz) = 71938dec22f3f6adae6f3edac6a288fee69def24
+RMD160 (Django-3.0.7.tar.gz) = ce33cbdf81ab9bd30563773216892c9a3cf4e438
+SHA512 (Django-3.0.7.tar.gz) = 566a78c3686baaea2ea8f2db2c1762a78ec5e5ae44f0be43f49c83899c2a0a9d1b2297a05ce8f4bc6bc580c494dde66bb2be47a8269cce3e1b007fedd857e5d3
+Size (Django-3.0.7.tar.gz) = 8947502 bytes