CVS commit: pkgsrc/www/py-django4

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Dec  2 20:39:23 UTC 2025

Modified Files:
        pkgsrc/www/py-django4: Makefile PLIST distinfo

Log Message:
py-django: updated to 4.2.27

Django 4.2.27 fixes one security issue with severity “high”, one security issue with severity “moderate”, and one bug in 4.2.26.

CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL

FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on 
PostgreSQL.

CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer

XML Serialization was subject to a potential denial-of-service attack due to quadratic time complexity when deserializing crafted documents containing many nested invalid elements. The internal 
helper django.core.serializers.xml_serializer.getInnerText() previously accumulated inner text inefficiently during recursion. It now collects text per element, avoiding excessive resource usage.

Bugfixes

Fixed a regression in Django 4.2.26 where DisallowedRedirect was raised by HttpResponseRedirect and HttpResponsePermanentRedirect for URLs longer than 2048 characters. The limit is now 16384 
characters.


To generate a diff of this commit:
cvs rdiff -u -r1.21 -r1.22 pkgsrc/www/py-django4/Makefile
cvs rdiff -u -r1.2 -r1.3 pkgsrc/www/py-django4/PLIST
cvs rdiff -u -r1.17 -r1.18 pkgsrc/www/py-django4/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django4/Makefile
diff -u pkgsrc/www/py-django4/Makefile:1.21 pkgsrc/www/py-django4/Makefile:1.22
--- pkgsrc/www/py-django4/Makefile:1.21 Tue Nov 11 10:44:05 2025
+++ pkgsrc/www/py-django4/Makefile      Tue Dec  2 20:39:23 2025
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.21 2025/11/11 10:44:05 adam Exp $
+# $NetBSD: Makefile,v 1.22 2025/12/02 20:39:23 adam Exp $
 
-DISTNAME=      django-4.2.26
+DISTNAME=      django-4.2.27
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/

Index: pkgsrc/www/py-django4/PLIST
diff -u pkgsrc/www/py-django4/PLIST:1.2 pkgsrc/www/py-django4/PLIST:1.3
--- pkgsrc/www/py-django4/PLIST:1.2     Mon Apr 14 14:16:21 2025
+++ pkgsrc/www/py-django4/PLIST Tue Dec  2 20:39:23 2025
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.2 2025/04/14 14:16:21 adam Exp $
+@comment $NetBSD: PLIST,v 1.3 2025/12/02 20:39:23 adam Exp $
 bin/django-admin-${PYVERSSUFFIX}
 ${PYSITELIB}/${WHEEL_INFODIR}/METADATA
 ${PYSITELIB}/${WHEEL_INFODIR}/RECORD
@@ -4606,6 +4606,9 @@ ${PYSITELIB}/django/db/backends/postgres
 ${PYSITELIB}/django/db/backends/postgresql/client.py
 ${PYSITELIB}/django/db/backends/postgresql/client.pyc
 ${PYSITELIB}/django/db/backends/postgresql/client.pyo
+${PYSITELIB}/django/db/backends/postgresql/compiler.py
+${PYSITELIB}/django/db/backends/postgresql/compiler.pyc
+${PYSITELIB}/django/db/backends/postgresql/compiler.pyo
 ${PYSITELIB}/django/db/backends/postgresql/creation.py
 ${PYSITELIB}/django/db/backends/postgresql/creation.pyc
 ${PYSITELIB}/django/db/backends/postgresql/creation.pyo

Index: pkgsrc/www/py-django4/distinfo
diff -u pkgsrc/www/py-django4/distinfo:1.17 pkgsrc/www/py-django4/distinfo:1.18
--- pkgsrc/www/py-django4/distinfo:1.17 Tue Nov 11 10:44:06 2025
+++ pkgsrc/www/py-django4/distinfo      Tue Dec  2 20:39:23 2025
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.17 2025/11/11 10:44:06 adam Exp $
+$NetBSD: distinfo,v 1.18 2025/12/02 20:39:23 adam Exp $
 
-BLAKE2s (django-4.2.26.tar.gz) = 3109422fe5a61ff3023cc79f540b3af7df2e4decdf16c40a6efda73e9f3e95d1
-SHA512 (django-4.2.26.tar.gz) = 49fc2d3796719b201567bcd1d68d4a018a62ffbd5aef3c609cbeb4e415f6508e383908949dba45fc3c2c9ca6d53f88c80598cf72ea29bf7b9fbd7d237dcc5077
-Size (django-4.2.26.tar.gz) = 10433052 bytes
+BLAKE2s (django-4.2.27.tar.gz) = c7d846d083b39047d66bb965131f43c0f6e6536a61da4d6fc432c7a2a223502b
+SHA512 (django-4.2.27.tar.gz) = 8bb5e63ef13066aa8ee051ba2b7914f3c848f9c7406f2f53dd1fbaedf1ad752d342ea670485d81969d2b60a42dea2c6064065431e1415e408a7da026785e8ff1
+Size (django-4.2.27.tar.gz) = 10432781 bytes