CVS commit: pkgsrc/www/py-django4

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Nov 11 10:44:06 UTC 2025

Modified Files:
        pkgsrc/www/py-django4: Makefile distinfo

Log Message:
py-django4: updated to 4.2.26

Django 4.2.26 fixes one security issue with severity “high” and one security issue with severity “moderate” in 4.2.25.

CVE-2025-64458: Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

Python’s NFKC normalization is slow on Windows. As a consequence, HttpResponseRedirect, HttpResponsePermanentRedirect, and the shortcut redirect() were subject to a potential denial-of-service attack 
via certain inputs with a very large number of Unicode characters (follow up to CVE 2025-27556).

CVE-2025-64459: Potential SQL injection via _connector keyword argument

QuerySet.filter(), exclude(), get(), and Q were subject to SQL injection using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.


To generate a diff of this commit:
cvs rdiff -u -r1.20 -r1.21 pkgsrc/www/py-django4/Makefile
cvs rdiff -u -r1.16 -r1.17 pkgsrc/www/py-django4/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django4/Makefile
diff -u pkgsrc/www/py-django4/Makefile:1.20 pkgsrc/www/py-django4/Makefile:1.21
--- pkgsrc/www/py-django4/Makefile:1.20 Thu Oct  2 07:51:04 2025
+++ pkgsrc/www/py-django4/Makefile      Tue Nov 11 10:44:05 2025
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.20 2025/10/02 07:51:04 adam Exp $
+# $NetBSD: Makefile,v 1.21 2025/11/11 10:44:05 adam Exp $
 
-DISTNAME=      django-4.2.25
+DISTNAME=      django-4.2.26
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/

Index: pkgsrc/www/py-django4/distinfo
diff -u pkgsrc/www/py-django4/distinfo:1.16 pkgsrc/www/py-django4/distinfo:1.17
--- pkgsrc/www/py-django4/distinfo:1.16 Thu Oct  2 07:51:04 2025
+++ pkgsrc/www/py-django4/distinfo      Tue Nov 11 10:44:06 2025
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.16 2025/10/02 07:51:04 adam Exp $
+$NetBSD: distinfo,v 1.17 2025/11/11 10:44:06 adam Exp $
 
-BLAKE2s (django-4.2.25.tar.gz) = ec98a56f4a6273a5c8dc39c95c96e9c37b0d9197857600ffac84f1c911c3751d
-SHA512 (django-4.2.25.tar.gz) = 9f7999ed89e235ed0640d40eaa6bcd3761cc6231e09a218f3f0785cbadc14ee02bdf53fd4df1bb51f2757e658e0b53135a655e956024e508975748f884e07c74
-Size (django-4.2.25.tar.gz) = 10456257 bytes
+BLAKE2s (django-4.2.26.tar.gz) = 3109422fe5a61ff3023cc79f540b3af7df2e4decdf16c40a6efda73e9f3e95d1
+SHA512 (django-4.2.26.tar.gz) = 49fc2d3796719b201567bcd1d68d4a018a62ffbd5aef3c609cbeb4e415f6508e383908949dba45fc3c2c9ca6d53f88c80598cf72ea29bf7b9fbd7d237dcc5077
+Size (django-4.2.26.tar.gz) = 10433052 bytes