CVS commit: pkgsrc/www/py-django4

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Oct  2 07:51:04 UTC 2025

Modified Files:
        pkgsrc/www/py-django4: Makefile distinfo

Log Message:
py-django4: updated to 4.2.25

Django 4.2.25 fixes one security issue with severity “high” and one security issue with severity “low” in 4.2.24.

CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB

QuerySet.annotate(), alias(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed 
to these methods (follow up to CVE 2022-28346).

CVE-2025-59682: Potential partial directory-traversal via archive.extract()

The django.utils.archive.extract() function, used by startapp --template and startproject --template, allowed partial directory-traversal via an archive with file paths sharing a common prefix with 
the target directory (follow up to CVE 2021-3281).


To generate a diff of this commit:
cvs rdiff -u -r1.19 -r1.20 pkgsrc/www/py-django4/Makefile
cvs rdiff -u -r1.15 -r1.16 pkgsrc/www/py-django4/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django4/Makefile
diff -u pkgsrc/www/py-django4/Makefile:1.19 pkgsrc/www/py-django4/Makefile:1.20
--- pkgsrc/www/py-django4/Makefile:1.19 Wed Sep  3 14:29:00 2025
+++ pkgsrc/www/py-django4/Makefile      Thu Oct  2 07:51:04 2025
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.19 2025/09/03 14:29:00 adam Exp $
+# $NetBSD: Makefile,v 1.20 2025/10/02 07:51:04 adam Exp $
 
-DISTNAME=      django-4.2.24
+DISTNAME=      django-4.2.25
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/

Index: pkgsrc/www/py-django4/distinfo
diff -u pkgsrc/www/py-django4/distinfo:1.15 pkgsrc/www/py-django4/distinfo:1.16
--- pkgsrc/www/py-django4/distinfo:1.15 Wed Sep  3 14:29:00 2025
+++ pkgsrc/www/py-django4/distinfo      Thu Oct  2 07:51:04 2025
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.15 2025/09/03 14:29:00 adam Exp $
+$NetBSD: distinfo,v 1.16 2025/10/02 07:51:04 adam Exp $
 
-BLAKE2s (django-4.2.24.tar.gz) = 04a178705e34b53003f5ed27cb0b82db6366e9b3563eb15110d148a6f42d5f7e
-SHA512 (django-4.2.24.tar.gz) = b43b3c73301d60d19681d98b63f6f58a09af6bafb6166419d561f0c0236d2aa1a7c715d86e029ad942997e36868661e606a4a305bada0367383b27d660b8dc26
-Size (django-4.2.24.tar.gz) = 10452798 bytes
+BLAKE2s (django-4.2.25.tar.gz) = ec98a56f4a6273a5c8dc39c95c96e9c37b0d9197857600ffac84f1c911c3751d
+SHA512 (django-4.2.25.tar.gz) = 9f7999ed89e235ed0640d40eaa6bcd3761cc6231e09a218f3f0785cbadc14ee02bdf53fd4df1bb51f2757e658e0b53135a655e956024e508975748f884e07c74
+Size (django-4.2.25.tar.gz) = 10456257 bytes