[pkgsrc/trunk]: pkgsrc/www/py-django3 py-django3: updated to 3.2.13

[adam <adam%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/831f117e9866
branches:  trunk
changeset: 377389:831f117e9866
user:      adam <adam%pkgsrc.org@localhost>
date:      Wed Apr 20 12:29:47 2022 +0000

description:
py-django3: updated to 3.2.13

Django 3.2.13 fixes two security issues with severity “high” in 3.2.12 and a regression in 3.2.4.

CVE-2022-28346: Potential SQL injection in QuerySet.annotate(), aggregate(), and extra()

QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these 
methods.

CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options) on PostgreSQL

QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument.

Bugfixes

Fixed a regression in Django 3.2.4 that caused the auto-reloader to no longer detect changes when the DIRS option of the TEMPLATES setting contained an empty string

diffstat:

 www/py-django3/Makefile |  4 ++--
 www/py-django3/distinfo |  8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diffs (25 lines):

diff -r 8d7762a2e46e -r 831f117e9866 www/py-django3/Makefile
--- a/www/py-django3/Makefile   Wed Apr 20 12:28:57 2022 +0000
+++ b/www/py-django3/Makefile   Wed Apr 20 12:29:47 2022 +0000
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.27 2022/02/02 10:23:41 adam Exp $
+# $NetBSD: Makefile,v 1.28 2022/04/20 12:29:47 adam Exp $
 
-DISTNAME=      Django-3.2.12
+DISTNAME=      Django-3.2.13
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/
diff -r 8d7762a2e46e -r 831f117e9866 www/py-django3/distinfo
--- a/www/py-django3/distinfo   Wed Apr 20 12:28:57 2022 +0000
+++ b/www/py-django3/distinfo   Wed Apr 20 12:29:47 2022 +0000
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.26 2022/02/02 10:23:41 adam Exp $
+$NetBSD: distinfo,v 1.27 2022/04/20 12:29:47 adam Exp $
 
-BLAKE2s (Django-3.2.12.tar.gz) = 749e76e0ad521c9ad09cbb2054722c4c987d063b4de8db58f1b82fe9b5a08934
-SHA512 (Django-3.2.12.tar.gz) = fc8ad3af019b268d514cc5240cac9c6b2fbf3a169c7933e8ab2da92e9cfed72df7a2784a8d92eaec8105bc9c245763acd307178bdf662e5d51407e72ae9d8683
-Size (Django-3.2.12.tar.gz) = 9812448 bytes
+BLAKE2s (Django-3.2.13.tar.gz) = 2546c0988f02e41038b6f14f0ee23300cde9c70faaccd87df25df136becb144b
+SHA512 (Django-3.2.13.tar.gz) = 08f056b18bc04b95d6705cf70c2ecc5be0c1324e0b38582991b907ed5977c4e3d35417ccf4ec06c2436a718e3aae007b015f0d40dd94ce5cfb129a54cceb6578
+Size (Django-3.2.13.tar.gz) = 9813985 bytes