CVS commit: pkgsrc/www/py-django

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Aug  6 20:14:11 UTC 2024

Modified Files:
        pkgsrc/www/py-django: Makefile distinfo

Log Message:
py-django: updated to 5.0.8

Django 5.0.8 fixes three security issues with severity “moderate”, one security issue with severity “high”, and several bugs in 5.0.7.

CVE-2024-41989: Memory exhaustion in django.utils.numberformat.floatformat()

If floatformat received a string representation of a number in scientific notation with a large exponent, it could lead to significant memory consumption.

To avoid this, decimals with more than 200 digits are now returned as is.

CVE-2024-41990: Potential denial-of-service vulnerability in django.utils.html.urlize()

urlize and urlizetrunc were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

CVE-2024-41991: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget

urlize, urlizetrunc, and AdminURLFieldWidget were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()

QuerySet.values() and values_list() methods on models with a JSONField were subject to SQL injection in column aliases, via a crafted JSON object key as a passed *arg.

Bugfixes

Added missing validation for UniqueConstraint(nulls_distinct=False) when using *expressions
Fixed a regression in Django 5.0 where ModelAdmin.action_checkbox could break the admin changelist HTML page when rendering a model instance with a __html__ method
Fixed a crash when creating a model with a Field.db_default and a Meta.constraints constraint composed of __endswith, __startswith, or __contains lookups
Fixed a regression in Django 5.0.7 that caused a crash in LocaleMiddleware when processing a language code over 500 characters
Fixed a bug in Django 5.0 that caused a system check crash when ModelAdmin.date_hierarchy was a GeneratedField with an output_field of DateField or DateTimeField
Fixed a bug in Django 5.0 which caused constraint validation to either crash or incorrectly raise validation errors for constraints referring to fields using Field.db_default
Fixed a crash in Django 5.0 when saving a model containing a FileField with a db_default set


To generate a diff of this commit:
cvs rdiff -u -r1.130 -r1.131 pkgsrc/www/py-django/Makefile
cvs rdiff -u -r1.106 -r1.107 pkgsrc/www/py-django/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django/Makefile
diff -u pkgsrc/www/py-django/Makefile:1.130 pkgsrc/www/py-django/Makefile:1.131
--- pkgsrc/www/py-django/Makefile:1.130 Thu Jul 11 18:51:35 2024
+++ pkgsrc/www/py-django/Makefile       Tue Aug  6 20:14:10 2024
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.130 2024/07/11 18:51:35 adam Exp $
+# $NetBSD: Makefile,v 1.131 2024/08/06 20:14:10 adam Exp $
 
-DISTNAME=      Django-5.0.7
+DISTNAME=      Django-5.0.8
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/

Index: pkgsrc/www/py-django/distinfo
diff -u pkgsrc/www/py-django/distinfo:1.106 pkgsrc/www/py-django/distinfo:1.107
--- pkgsrc/www/py-django/distinfo:1.106 Thu Jul 11 18:51:35 2024
+++ pkgsrc/www/py-django/distinfo       Tue Aug  6 20:14:10 2024
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.106 2024/07/11 18:51:35 adam Exp $
+$NetBSD: distinfo,v 1.107 2024/08/06 20:14:10 adam Exp $
 
-BLAKE2s (Django-5.0.7.tar.gz) = c0838fb6b9a8d8c96d52d86786c784cc2198aaac3bbf4d04297a16628273e36f
-SHA512 (Django-5.0.7.tar.gz) = 29aa4cd7bfdc5c00479c9d60d988653bab76dcfd8cd553ab446f6c274f99677ccaef0571b0afdf1579215918f500d87a0b098a98452c7526e89b1ab64f00b037
-Size (Django-5.0.7.tar.gz) = 10642686 bytes
+BLAKE2s (Django-5.0.8.tar.gz) = 9db67be171c6c3f7bf2ecfec9fdd411041a8bf340edfc8ba94f04b331b09ad0b
+SHA512 (Django-5.0.8.tar.gz) = b835d01f76f0e0082f299c2b15483aa3a8aef79f873b09dac546d3b4ecfa8a6fb84d9377e06e18a858bd24bcdd2db89c4cf05811b3af133b7da6609f6c2d917c
+Size (Django-5.0.8.tar.gz) = 10630791 bytes