Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Nov 5, 2025

This PR contains the following updates:

Package Change Age Confidence
django (changelog) 4.2.25 -> 4.2.26 age confidence

GitHub Vulnerability Alerts

CVE-2025-64458

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

CVE-2025-64459

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q(), are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.


Release Notes

django/django (django)

v4.2.26

Compare Source


Configuration

📅 Schedule: Branch creation - "" in timezone US/Eastern, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link

github-actions bot commented Nov 5, 2025

OpenAPI Changes

Show/hide ## Changes for v0.yaml:
## Changes for v0.yaml:


## Changes for v1.yaml:


## Changes for v2.yaml:


Unexpected changes? Ensure your branch is up-to-date with main (consider rebasing).

@renovate renovate bot force-pushed the renovate/pypi-django-vulnerability branch 9 times, most recently from f7414c2 to ef58682 Compare November 12, 2025 16:51
@renovate renovate bot changed the title fix(deps): update dependency django to v4.2.26 [security] Update dependency django to v4.2.26 [SECURITY] Nov 12, 2025
@renovate renovate bot force-pushed the renovate/pypi-django-vulnerability branch 2 times, most recently from 6d0967b to 003a312 Compare November 12, 2025 21:07
@renovate renovate bot changed the title Update dependency django to v4.2.26 [SECURITY] fix(deps): update dependency django to v4.2.26 [security] Nov 14, 2025
@renovate renovate bot force-pushed the renovate/pypi-django-vulnerability branch 9 times, most recently from 6a7a91f to 757f0b6 Compare November 18, 2025 20:09
@renovate renovate bot force-pushed the renovate/pypi-django-vulnerability branch from 757f0b6 to 8d4b8b6 Compare November 19, 2025 14:01
@renovate renovate bot merged commit ea13434 into main Nov 19, 2025
9 checks passed
@renovate renovate bot deleted the renovate/pypi-django-vulnerability branch November 19, 2025 15:33
@odlbot odlbot mentioned this pull request Nov 19, 2025
14 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant