python-django (3:5.2.4-1ubuntu2.5) questing-security; urgency=medium

  * SECURITY UPDATE: Potential denial-of-service vulnerability in ASGI
    requests via file upload limit bypass
    - debian/patches/CVE-2026-5766.patch: enforce
      DATA_UPLOAD_MAX_MEMORY_SIZE in MemoryFileUploadHandler on ASGI in
      django/core/files/uploadhandler.py, tests/asgi/tests.py,
      tests/requests_tests/tests.py.
    - CVE-2026-5766
  * SECURITY UPDATE: Session fixation via public cached pages and
    SESSION_SAVE_EVERY_REQUEST
    - debian/patches/CVE-2026-35192.patch: ensure Vary header is sent when
      setting session cookie with SESSION_SAVE_EVERY_REQUEST=True in
      django/contrib/sessions/middleware.py, tests/sessions_tests/tests.py.
    - CVE-2026-35192
  * SECURITY UPDATE: Potential exposure of private data due to incorrect
    handling of Vary: * in UpdateCacheMiddleware
    - debian/patches/CVE-2026-6907.patch: prevent caching of requests when
      Vary header contains an asterisk in django/middleware/cache.py,
      tests/cache/tests.py.
    - CVE-2026-6907

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 28 Apr 2026 13:40:09 -0400

python-django (3:5.2.4-1ubuntu2.4) questing-security; urgency=medium

  * SECURITY UPDATE: Potential denial-of-service vulnerability in
    MultiPartParser via base64-encoded file upload
    - debian/patches/CVE-2026-33033.patch: mitigate potential DoS in
      MultiPartParser in django/http/multipartparser.py,
      tests/requests_tests/tests.py.
    - CVE-2026-33033
  * SECURITY UPDATE: Potential denial-of-service vulnerability in ASGI
    requests via memory upload limit bypass
    - debian/patches/CVE-2026-33034.patch: enforce
      DATA_UPLOAD_MAX_MEMORY_SIZE on body size in ASGI requests in
      django/http/request.py, tests/asgi/tests.py.
    - CVE-2026-33034
  * SECURITY UPDATE: ASGI header spoofing via underscore/hyphen conflation
    - debian/patches/CVE-2026-3902.patch: ignore headers with underscores
      in ASGIRequest in django/core/handlers/asgi.py,
      django/test/client.py, tests/asgi/tests.py.
    - CVE-2026-3902
  * SECURITY UPDATE: Privilege abuse in GenericInlineModelAdmin
    - debian/patches/CVE-2026-4277.patch: Check add permissions in
      GenericInlineModelAdmin in django/contrib/contenttypes/admin.py,
      tests/generic_inline_admin/tests.py.
    - CVE-2026-4277
  * SECURITY UPDATE: Privilege abuse in ModelAdmin.list_editable
    - debian/patches/CVE-2026-4292.patch: Disallow instance creation via
      ModelAdmin.list_editable in django/contrib/admin/options.py,
      tests/admin_views/admin.py, tests/admin_views/tests.py.
    - CVE-2026-4292

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 01 Apr 2026 09:49:17 -0400

python-django (3:5.2.4-1ubuntu2.3) questing-security; urgency=medium

  * SECURITY UPDATE: Username enumeration through timing difference in
    mod_wsgi authentication handler
    - debian/patches/CVE-2025-13473.patch: standardize timing of
      check_password() in mod_wsgi auth handler in
      django/contrib/auth/handlers/modwsgi.py,
      tests/auth_tests/test_handlers.py.
    - CVE-2025-13473
  * SECURITY UPDATE: Potential denial-of-service vulnerability via repeated
    headers when using ASGI
    - debian/patches/CVE-2025-14550.patch: optimize repeated header parsing
      in ASGI requests in django/core/handlers/asgi.py,
      tests/asgi/tests.py.
    - CVE-2025-14550
  * SECURITY UPDATE: Potential SQL injection via raster lookups on PostGIS
    - debian/patches/CVE-2026-1207.patch: prevent SQL injections in
      RasterField lookups via band index in
      django/contrib/gis/db/backends/postgis/operations.py,
      tests/gis_tests/rasterapp/test_rasterfield.py.
    - CVE-2026-1207
  * SECURITY UPDATE: Potential denial-of-service vulnerability in
    django.utils.text.Truncator HTML methods
    - debian/patches/CVE-2026-1285.patch: mitigate potential DoS in
      django.utils.text.Truncator for HTML input in django/utils/text.py,
      tests/utils_tests/test_text.py.
    - CVE-2026-1285
  * SECURITY UPDATE: Potential SQL injection in column aliases via control
    characters
    - debian/patches/CVE-2026-1287.patch: protect against SQL injection in
      column aliases via control characters in
      django/db/models/sql/query.py, tests/aggregation/tests.py,
      tests/annotations/tests.py, tests/queries/tests.py,
      tests/expressions/test_queryset_values.py.
    - CVE-2026-1287
  * SECURITY UPDATE: Potential SQL injection via QuerySet.order_by and
    FilteredRelation
    - debian/patches/CVE-2026-1312-1.patch: protect order_by() from SQL
      injection via aliases with periods in
      django/db/models/sql/compiler.py, tests/ordering/tests.py.
    - debian/patches/CVE-2026-1312-2.patch: raise ValueError when
      FilteredRelation aliases contain periods in
      django/db/models/sql/query.py, tests/filtered_relation/tests.py,
      tests/ordering/tests.py.
    - CVE-2026-1312

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 28 Jan 2026 07:48:21 -0500

python-django (3:5.2.4-1ubuntu2.2) questing-security; urgency=medium

  * SECURITY UPDATE: SQL injection in FilteredRelation column aliases on
    PostgreSQL
    - debian/patches/CVE-2025-13372.patch: protect FilteredRelation against
      SQL injection in column aliases in
      django/db/backends/postgresql/compiler.py,
      tests/annotations/tests.py.
    - CVE-2025-13372
  * SECURITY UPDATE: DoS vulnerability in XML serializer text extraction
    - debian/patches/CVE-2025-64460.patch: corrected quadratic inner text
      accumulation in XML serializer in
      django/core/serializers/xml_serializer.py,
      docs/topics/serialization.txt,
      tests/serializers/test_deserialization.py.
    - CVE-2025-64460

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 26 Nov 2025 11:25:51 -0500

python-django (3:5.2.4-1ubuntu2.1) questing-security; urgency=medium

  * SECURITY UPDATE: Potential SQL injection in QuerySet and Q objects
    - debian/patches/CVE-2025-62769-1.patch: Add connects and checks for them
      in django/db/models/query_utils.py.
    - debian/patches/CVE-2025-62769-2.patch: Add PROHIBITED_FILTER_KWARGS and
      check for them in django/db/models/query.py.
    - CVE-2025-62769

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Thu, 30 Oct 2025 10:37:09 -0230

python-django (3:5.2.4-1ubuntu2) questing; urgency=medium

  * SECURITY UPDATE: Potential SQL injection
    - debian/patches/CVE-2025-59681.patch: protect against SQL injection in
      django/db/models/sql/query.py, tests/aggregation/tests.py,
      tests/annotations/tests.py,
      tests/expressions/test_queryset_values.py, tests/queries/tests.py.
    - CVE-2025-59681
  * SECURITY UPDATE: Potential partial directory-traversal
    - debian/patches/CVE-2025-59682.patch: validate path in
      django/utils/archive.py, tests/utils_tests/test_archive.py.
    - CVE-2025-59682

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 01 Oct 2025 12:49:58 -0400

python-django (3:5.2.4-1ubuntu1) questing; urgency=medium

  * SECURITY UPDATE: SQL injection
    - debian/patches/CVE-2025-57833.patch: protected
      FilteredRelation against SQL injection in column
      aliases in django/db/models/sql/query.py,
      tests/annotations/tests.py.
    - debian/patches/fixing_test_stip_tags.patch: Adjusted
      utils_tests.test_html.TestUtilsHtml.test_strip_tags following Python's
      HTMLParser new behavior in tests/utils_test/test_html.py.
    - debian/patches/fixing_test_parsing_errors.patch: Fixed
      test_utils.tests.HTMLEqualTests.test_parsing_errors
      following Python's HTMLParser fixed parsing in
      tests/test_utils/tests.py.
    - CVE-2025-57833

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 15 Sep 2025 09:13:25 -0300

python-django (3:5.2.4-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://www.djangoproject.com/weblog/2025/jul/02/bugfix-releases/>

 -- Chris Lamb <lamby@debian.org>  Mon, 07 Jul 2025 10:29:43 -0700

python-django (3:5.2.3-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/>

 -- Chris Lamb <lamby@debian.org>  Tue, 10 Jun 2025 08:53:25 -0700

python-django (3:5.2.2-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2025-48432: Potential log injection via unescaped request path.

      Django's internal HTTP response logging used request.path directly,
      allowing control characters (e.g. newlines or ANSI escape sequences) to
      be written unescaped into logs. This could enable log injection or
      forgery, letting attackers manipulate log appearance or structure,
      especially in logs processed by external systems or viewed in terminals.

      Although this does not directly impact Django's security model, it poses
      risks when logs are consumed or interpreted by other tools.  To fix this,
      the internal django.utils.log.log_response() function now escapes all
      positional formatting arguments using a safe encoding.

      (Closes: #1107282)

    <https://www.djangoproject.com/weblog/2025/jun/04/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 04 Jun 2025 08:09:36 -0700

python-django (3:5.2.1-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2025-32873: Denial-of-service possibility in strip_tags()

      django.utils.html.strip_tags() would be slow to evaluate certain inputs
      containing large sequences of incomplete HTML tags. This function is used
      to implement the striptags template filter, which was therefore also
      vulnerable. strip_tags() now raises a SuspiciousOperation exception if it
      encounters an unusually large number of unclosed opening tags.

      (Closes: #1104872)

    <https://www.djangoproject.com/weblog/2025/may/07/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 07 May 2025 09:27:26 -0700

python-django (3:5.2-1) experimental; urgency=medium

  * New upstream stable release.
    <https://www.djangoproject.com/weblog/2025/apr/02/django-52-released/>
  * Bump Standards-Version to 4.7.2.

 -- Chris Lamb <lamby@debian.org>  Fri, 04 Apr 2025 09:58:15 -0700

python-django (3:5.2~rc1-1) experimental; urgency=medium

  * New upstream release candidate.
    <https://www.djangoproject.com/weblog/2025/mar/19/django-52-rc1/>

 -- Chris Lamb <lamby@debian.org>  Wed, 19 Mar 2025 12:04:42 +0000

python-django (3:5.2~beta1-1) experimental; urgency=medium

  * New upstream beta release.
    <https://www.djangoproject.com/weblog/2025/feb/19/django-52-beta-1-released/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Wed, 19 Feb 2025 11:41:40 +0000

python-django (3:5.2~alpha1-1) experimental; urgency=medium

  * New upstream alpha release.
    <https://www.djangoproject.com/weblog/2025/jan/16/django-52-alpha-1-released/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Thu, 16 Jan 2025 14:26:59 +0000

python-django (3:5.1.5-1) experimental; urgency=high

  * New upstream security release. (Closes: #1093049)

    - CVE-2024-56374: Potential denial-of-service vulnerability in IPv6
      validation.

      A lack of upper bound limit enforcement in strings passed when performing
      IPv6 validation could have led to a potential denial-of-service (DoS)
      attack. The undocumented and private functions clean_ipv6_address and
      is_valid_ipv6_address were vulnerable, as was the GenericIPAddressField
      form field, which has now been updated to define a max_length of 39
      characters. The GenericIPAddressField model field was not affected.

    <https://www.djangoproject.com/weblog/2025/jan/14/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 15 Jan 2025 17:48:05 +0000

python-django (3:5.1.4-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2024-53907: Potential DoS in django.utils.html.strip_tags.
      The strip_tags() method and striptags template filter were subject to a
      potential denial-of-service attack via certain inputs containing large
      sequences of nested incomplete HTML entities.

    - CVE-2024-53908: Potential SQL injection in HasKey(lhs, rhs) on Oracle
      Direct usage of the django.db.models.fields.json.HasKey lookup on Oracle
      was subject to SQL injection if untrusted data is used as a lhs value.
      Applications that use the jsonfield.has_key lookup through the __ syntax
      are unaffected.

    <https://www.djangoproject.com/weblog/2024/dec/04/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 04 Dec 2024 16:55:05 +0000

python-django (3:5.1.3-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/5.1/releases/5.1.3/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Tue, 05 Nov 2024 07:14:42 -0800

python-django (3:5.1.2-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/5.1/releases/5.1.2/>

 -- Chris Lamb <lamby@debian.org>  Tue, 08 Oct 2024 09:56:10 -0700

python-django (3:5.1.1-1) experimental; urgency=high

  * New upstream security release:

    - CVE-2024-45230: Potential denial-of-service vulnerability in
      django.utils.html.urlize(). urlize and urlizetrunc were subject to a
      potential denial-of-service attack via very large inputs with a specific
      sequence of characters.

    - CVE-2024-45231: Potential user email enumeration via response status on
      password reset. Due to unhandled email sending failures, the
      django.contrib.auth.forms.PasswordResetForm class allowed remote
      attackers to enumerate user emails by issuing password reset requests and
      observing the outcomes. To mitigate this risk, exceptions occurring
      during password reset email sending are now handled and logged using the
      django.contrib.auth logger.

  * Bump Standards-Version to 4.7.0.

 -- Chris Lamb <lamby@debian.org>  Tue, 03 Sep 2024 17:25:15 +0100

python-django (3:5.1-1) experimental; urgency=medium

  * New upstream 5.1 release.
    <https://www.djangoproject.com/weblog/2024/aug/07/django-51-released/>

 -- Chris Lamb <lamby@debian.org>  Wed, 07 Aug 2024 16:14:05 +0100

python-django (3:5.1~rc1-1) experimental; urgency=medium

  * New upstream 5.1 release candidate.
    <https://www.djangoproject.com/weblog/2024/jul/24/django-51-rc1/>

 -- Chris Lamb <lamby@debian.org>  Thu, 25 Jul 2024 11:33:24 +0100

python-django (3:5.1~beta1-1) experimental; urgency=medium

  * New upstream beta release.
    <https://www.djangoproject.com/weblog/2024/jun/26/django-51-beta-1-released/>
  * Add pybuild-plugin-pyproject to Build-Depends.

 -- Chris Lamb <lamby@debian.org>  Wed, 26 Jun 2024 10:15:54 -0700

python-django (3:5.1~alpha1-1) experimental; urgency=medium

  * New upstream experimental alpha release.
    <https://www.djangoproject.com/weblog/2024/may/22/django-51-alpha-1-released/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Thu, 23 May 2024 10:48:03 +0100

python-django (3:5.0.6-1) experimental; urgency=medium

  * New upstream bugfix release, incorporating changes from 5.0.5 as well.
    <https://docs.djangoproject.com/en/5.0/releases/5.0.5/>
    <https://docs.djangoproject.com/en/5.0/releases/5.0.6/>

 -- Chris Lamb <lamby@debian.org>  Wed, 08 May 2024 11:12:00 +0100

python-django (3:5.0.4-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/dev/releases/5.0.4/>

 -- Chris Lamb <lamby@debian.org>  Thu, 04 Apr 2024 10:07:42 +0100

python-django (3:5.0.3-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2024-27351: Fix a potential regular expression denial-of-service
      (ReDoS) attack in django.utils.text.Truncator.words. This method
      (with html=True) and the truncatewords_html template filter were subject
      to a potential regular expression denial-of-service attack via a suitably
      crafted string. This is, in part, a follow up to CVE-2019-14232 and
      CVE-2023-43665.

    <https://docs.djangoproject.com/en/dev/releases/5.0.3/>

 -- Chris Lamb <lamby@debian.org>  Tue, 05 Mar 2024 12:37:11 +0000

python-django (3:5.0.2-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2024-24680: Potential denial-of-service in intcomma template filter.
      The intcomma template filter was subject to a potential denial-of-service
      attack when used with very long strings.

    <https://docs.djangoproject.com/en/dev/releases/5.0.2/>

 -- Chris Lamb <lamby@debian.org>  Tue, 06 Feb 2024 08:08:50 -0800

python-django (3:5.0.1-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/dev/releases/5.0.1/>

 -- Chris Lamb <lamby@debian.org>  Wed, 03 Jan 2024 11:07:26 +0000

python-django (3:5.0-1) experimental; urgency=medium

  * New upstream stable release.
    https://docs.djangoproject.com/en/5.0/releases/5.0/

 -- Chris Lamb <lamby@debian.org>  Thu, 07 Dec 2023 12:52:28 +0000

python-django (3:5.0~rc1-1) experimental; urgency=medium

  * New upstream RC1 release.
    <https://www.djangoproject.com/weblog/2023/nov/20/django-50-rc1/>

 -- Chris Lamb <lamby@debian.org>  Tue, 21 Nov 2023 08:43:43 +0000

python-django (3:5.0~alpha1-1) experimental; urgency=medium

  * New upstream alpha release.
    <https://www.djangoproject.com/weblog/2023/sep/18/django-50-alpha-1-released/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Tue, 19 Sep 2023 11:09:34 -0700

python-django (3:4.2.5-1) experimental; urgency=high

  * New upstream security release:

    - CVE-2023-41164: Potential denial of service vulnerability in
      django.utils.encoding.uri_to_iri(). This method was subject to potential
      denial of service attack via certain inputs with a very large number of
      Unicode characters. (Closes: #1051226)

    <https://www.djangoproject.com/weblog/2023/sep/04/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Mon, 04 Sep 2023 10:41:05 -0700

python-django (3:4.2.4-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/4.2/releases/4.2.4/>

 -- Chris Lamb <lamby@debian.org>  Wed, 02 Aug 2023 07:53:39 +0100

python-django (3:4.2.3-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2023-36053: Potential regular expression denial of service
      vulnerability in EmailValidator/URLValidator.

      EmailValidator and URLValidator were subject to potential regular
      expression denial of service attack via a very large number of domain
      name labels of emails and URLs. (Closes: #1040225)

 -- Chris Lamb <lamby@debian.org>  Mon, 03 Jul 2023 17:28:20 +0100

python-django (3:4.2.2-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/4.2/releases/4.2.2/>

 -- Chris Lamb <lamby@debian.org>  Mon, 05 Jun 2023 08:12:54 -0700

python-django (3:4.2.1-1) experimental; urgency=high

  * New upstream security release.
  * CVE-2023-31047: Prevent a potential bypass of validation when uploading
    multiple files using one form field.

    Uploading multiple files using one form field has never been supported by
    forms.FileField or forms.ImageField as only the last uploaded file was
    validated. Unfortunately, Uploading multiple files topic suggested
    otherwise. In order to avoid the vulnerability, the ClearableFileInput and
    FileInput form widgets now raise ValueError when the multiple HTML
    attribute is set on them. To prevent the exception and keep the old
    behavior, set the allow_multiple_selected attribute to True.

    For more details on using the new attribute and handling of multiple files
    through a single field, see:

      <https://docs.djangoproject.com/en/stable/topics/http/file-uploads/#uploading-multiple-files>

    (Closes: #1035467)

  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Wed, 03 May 2023 09:13:17 -0700

python-django (3:4.2-1) experimental; urgency=medium

  * New upstream stable release:

      This version has been designated as a long-term support (LTS) release,
      which means that security and data loss fixes will be applied for at
      least the next three years. It will also receive fixes for crashing bugs,
      major functionality bugs in newly-introduced features, and regressions
      from older versions of Django for the next eight months until December
      2023.

        -- <https://www.djangoproject.com/weblog/2023/apr/03/django-42-released/>

  * Bump Standards-Version to 4.6.2.

 -- Chris Lamb <lamby@debian.org>  Mon, 03 Apr 2023 12:10:10 +0100

python-django (3:4.2~rc1-1) experimental; urgency=medium

  * New upstream release candidate.

 -- Chris Lamb <lamby@debian.org>  Mon, 20 Mar 2023 08:12:25 +0000

python-django (3:4.2~beta1-1) experimental; urgency=medium

  * New upstream beta release.
    <https://www.djangoproject.com/weblog/2023/feb/20/django-42-beta-1-released/>

 -- Chris Lamb <lamby@debian.org>  Mon, 20 Feb 2023 07:39:15 -0800

python-django (3:4.2~alpha1-1) experimental; urgency=medium

  * New upstream release.
    <https://www.djangoproject.com/weblog/2023/jan/17/django-42-alpha-1-released/>
  * Refresh patches.
  * Upstream does not ship a django/contrib/admin/static/admin/fonts/README.txt
    file anymore, so don't try and install it.
  * Drop old debian/python3-django.NEWS file.

 -- Chris Lamb <lamby@debian.org>  Thu, 19 Jan 2023 10:44:17 -0800

python-django (3:4.1.5-1) experimental; urgency=medium

  * New upstream release.
    <https://docs.djangoproject.com/en/4.1/releases/4.1.5/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Tue, 03 Jan 2023 06:56:56 +0000

python-django (3:4.1.4-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/4.1/releases/4.1.4/>

 -- Chris Lamb <lamby@debian.org>  Tue, 06 Dec 2022 21:01:08 +0000

python-django (3:4.1.3-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/4.1/releases/4.1.3/>

 -- Chris Lamb <lamby@debian.org>  Wed, 02 Nov 2022 11:26:08 +0000

python-django (3:4.1.2-1) experimental; urgency=high

  * New upstream security release.
    <https://www.djangoproject.com/weblog/2022/oct/04/security-releases/>

    - CVE-2022-41323: Prevent a potential denial-of-service vulnerability in
      internationalized URLs. Internationalised URLs were subject to potential
      denial of service attack via the locale parameter. This is now escaped to
      avoid this possibility.

 -- Chris Lamb <lamby@debian.org>  Tue, 04 Oct 2022 07:42:45 -0700

python-django (3:4.1.1-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/4.1/releases/4.1.1/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Tue, 06 Sep 2022 10:52:34 +0100

python-django (3:4.1-1) experimental; urgency=medium

  * New upstream release
    <https://www.djangoproject.com/weblog/2022/aug/03/django-41-released/>
  * Bump epoch to ensure experimental's version is greater than unstable.

 -- Chris Lamb <lamby@debian.org>  Wed, 03 Aug 2022 07:04:46 -0700

python-django (2:4.1~rc1-1) experimental; urgency=medium

  * New upstream release candidate.
    <https://www.djangoproject.com/weblog/2022/jul/19/django-41-rc1/>
  * Bump Standards-Version to 4.6.1.

 -- Chris Lamb <lamby@debian.org>  Tue, 19 Jul 2022 14:56:52 +0100

python-django (2:4.1~beta1-1) experimental; urgency=medium

  * New upstream beta release.
    <https://www.djangoproject.com/weblog/2022/jun/21/django-41-beta-1-released/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Tue, 21 Jun 2022 13:16:45 +0100

python-django (2:4.1~alpha1-1) experimental; urgency=medium

  * New upstream alpha release.
    <https://www.djangoproject.com/weblog/2022/may/18/django-41-alpha-1-released/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Wed, 18 May 2022 09:33:55 -0700

python-django (2:4.0.4-1) experimental; urgency=high

  * New upstream security release:

    - CVE-2022-28346: Potential SQL injection in QuerySet.annotate(),
      aggregate(), and extra().

      QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL
      injection in column aliases, using a suitably crafted dictionary, with
      dictionary expansion, as the **kwargs passed to these methods.

    - CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options)
      on PostgreSQL.

      QuerySet.explain() method was subject to SQL injection in option names,
      using a suitably crafted dictionary, with dictionary expansion, as the
      **options argument.

    See <https://www.djangoproject.com/weblog/2022/apr/11/security-releases/>
    for more info.

 -- Chris Lamb <lamby@debian.org>  Tue, 12 Apr 2022 18:13:56 +0200

python-django (2:4.0.3-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/4.0/releases/4.0.3/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Wed, 02 Mar 2022 07:52:04 +0000

python-django (2:4.0.2-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2022-22818: Possible XSS via {% debug %} template tag.
      The {% debug %} template tag didn't properly encode the current context,
      posing an XSS attack vector.

      In order to avoid this vulnerability, {% debug %} no longer outputs
      information when the DEBUG setting is False, and it ensures all context
      variables are correctly escaped when the DEBUG setting is True.

    - CVE-2022-23833: Denial-of-service possibility in file uploads

      Passing certain inputs to multipart forms could result in an
      infinite loop when parsing files.

    See <https://www.djangoproject.com/weblog/2022/feb/01/security-releases/
    for more information. (Closes: #1004752)

 -- Chris Lamb <lamby@debian.org>  Tue, 01 Feb 2022 09:02:51 -0800

python-django (2:4.0.1-2) experimental; urgency=medium

  * Fix compatibility with SQLite 3.37+. (Closes: #1004464)

 -- Chris Lamb <lamby@debian.org>  Fri, 28 Jan 2022 08:57:31 -0800

python-django (2:4.0.1-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2021-45115: Denial-of-service possibility in
      UserAttributeSimilarityValidator

      UserAttributeSimilarityValidator incurred significant overhead evaluating
      submitted password that were artificially large in relative to the
      comparison values. On the assumption that access to user registration was
      unrestricted this provided a potential vector for a denial-of-service
      attack.

      In order to mitigate this issue, relatively long values are now ignored
      by UserAttributeSimilarityValidator.

    - CVE-2021-45116: Potential information disclosure in dictsort template
      filter

      Due to leveraging the Django Template Language's variable resolution
      logic, the dictsort template filter was potentially vulnerable to
      information disclosure or unintended method calls, if passed a
      suitably crafted key.

      In order to avoid this possibility, dictsort now works with a
      restricted resolution logic, that will not call methods, nor allow
      indexing on dictionaries.

    - CVE-2021-45452: Potential directory-traversal via Storage.save()

      Storage.save() allowed directory-traversal if directly passed suitably
      crafted file names.

    See <https://www.djangoproject.com/weblog/2022/jan/04/security-releases/>
    for more information. (Closes: #1003113)

 -- Chris Lamb <lamby@debian.org>  Tue, 04 Jan 2022 12:03:13 +0000

python-django (2:4.0-1) experimental; urgency=medium

  * New upstream major release.
    <https://www.djangoproject.com/weblog/2021/dec/07/django-40-released/>

 -- Chris Lamb <lamby@debian.org>  Tue, 07 Dec 2021 07:39:47 -0800

python-django (2:4.0~rc1-1) experimental; urgency=medium

  * New upstream RC release.
    <https://www.djangoproject.com/weblog/2021/nov/22/django-40-rc1/>

 -- Chris Lamb <lamby@debian.org>  Mon, 22 Nov 2021 07:44:24 -0800

python-django (2:4.0~beta1-1) experimental; urgency=medium

  * New upstream beta release.
    <https://www.djangoproject.com/weblog/2021/oct/25/django-40-beta-1-released/>

 -- Chris Lamb <lamby@debian.org>  Mon, 25 Oct 2021 15:06:19 +0100

python-django (2:4.0~alpha1-1) experimental; urgency=medium

  * New upstream 4.x alpha release.
    - Update patches.
    - No need to delete django-admin.py script anymore; does not exist.
  * Bump Standards-Version to 4.6.0.

 -- Chris Lamb <lamby@debian.org>  Wed, 22 Sep 2021 09:41:35 +0100

python-django (2:3.2.7-1) experimental; urgency=medium

  * New upstream bugfix release.

 -- Chris Lamb <lamby@debian.org>  Wed, 01 Sep 2021 10:46:07 +0100

python-django (2:3.2.6-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/3.2/releases/3.2.6/>
  * Bump Standards-Version to 4.5.1.

 -- Chris Lamb <lamby@debian.org>  Mon, 02 Aug 2021 09:16:21 +0100

python-django (2:3.2.5-2) experimental; urgency=medium

  * Don't symlink /usr/bin/django-admin to "django-admin.py"; ship the script
    generated by the entry_points system instead, otherwise we introduce a
    confusing "django-admin.py" deprecation message when using "django-admin".
    (Closes: #991098)

 -- Chris Lamb <lamby@debian.org>  Thu, 15 Jul 2021 13:54:57 +0100

python-django (2:3.2.5-1) experimental; urgency=medium

  * New upstream security release:

    - CVE-2021-35042: Potential SQL injection via unsanitized
      QuerySet.order_by() input.

      Unsanitized user input passed to QuerySet.order_by() could bypass
      intended column reference validation in path marked for deprecation
      resulting in a potential SQL injection even if a deprecation warning is
      emitted. As a mitigation, the strict column reference validation was
      restored for the duration of the deprecation period. This regression
      appeared in Django version 3.1 as a side effect of fixing another bug
      (#31426).

    For more information, please see:
    <https://www.djangoproject.com/weblog/2021/jul/01/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Thu, 01 Jul 2021 10:56:07 +0100

python-django (2:3.2.4-1) experimental; urgency=medium

  * New upstream security release. (Closes: #989394)

    - CVE-2021-33203: Potential directory traversal via admindocs

      Staff members could use the admindocs TemplateDetailView view to
      check the existence of arbitrary files. Additionally, if (and only
      if) the default admindocs templates have been customized by the
      developers to also expose the file contents, then not only the
      existence but also the file contents would have been exposed.

      As a mitigation, path sanitation is now applied and only files
      within the template root directories can be loaded.

      This issue has low severity, according to the Django security
      policy.

      Thanks to Rasmus Lerchedahl Petersen and Rasmus Wriedt Larsen from
      the CodeQL Python team for the report.

    - CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks
      since validators accepted leading zeros in IPv4 addresses

      URLValidator, validate_ipv4_address(), and
      validate_ipv46_address() didn't prohibit leading zeros in octal
      literals. If you used such values you could suffer from
      indeterminate SSRF, RFI, and LFI attacks.

      validate_ipv4_address() and validate_ipv46_address() validators
      were not affected on Python 3.9.5+.

      This issue has medium severity, according to the Django security
      policy.

  * Bump Standards-Version to 4.5.1.

 -- Chris Lamb <lamby@debian.org>  Wed, 02 Jun 2021 16:08:13 +0100

python-django (2:3.2.3-1) experimental; urgency=medium

  * New upstream release.
    <https://docs.djangoproject.com/en/3.2/releases/3.2.3/>

 -- Chris Lamb <lamby@debian.org>  Thu, 13 May 2021 10:25:49 +0100

python-django (2:3.2.2-1) experimental; urgency=medium

  * New upstream security release:
    - CVE-2021-32052: Header injection possibility since URLValidator accepted
      newlines in input on Python 3.9.5+. (Closes: #988136)
    - Full release notes:
      <https://www.djangoproject.com/weblog/2021/may/06/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Thu, 06 May 2021 13:04:03 +0100

python-django (2:3.2.1-1) experimental; urgency=medium

  * New upstream security release:
    - CVE-2021-31542: Potential directory-traversal via uploaded files.
      (Closes: #988053)
    - Full release notes:
      <https://www.djangoproject.com/weblog/2021/may/04/security-releases/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Tue, 04 May 2021 12:59:07 +0100

python-django (2:3.2-1) experimental; urgency=medium

  * New upstream major release:

    - Full release notes: <https://docs.djangoproject.com/en/3.2/releases/3.2/>
    - CVE-2021-28658: The MultiPartParser class allowed directory-traversal
      via uploaded files via maliciously crafted filenames. (Closes: #986447)

 -- Chris Lamb <lamby@debian.org>  Tue, 06 Apr 2021 11:38:48 +0100

python-django (2:3.2~rc1-1) experimental; urgency=medium

  * New upstream release candidate.
    <https://www.djangoproject.com/weblog/2021/mar/18/django-32-rc1/#s-id5>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Fri, 19 Mar 2021 09:56:40 +0000

python-django (2:3.2~beta1-1) experimental; urgency=medium

  * New upstream beta release.
    <https://www.djangoproject.com/weblog/2021/feb/19/django-32-beta-1-released/>
  * Apply wrap-and-sort -sa.

 -- Chris Lamb <lamby@debian.org>  Fri, 19 Feb 2021 16:13:21 +0000

python-django (2:3.2~alpha1-2) experimental; urgency=medium

  * Apply security fix from upstream:

    - CVE-2021-23336: Prevent a web cache poisoning attack via "parameter
      cloaking". Django contains a copy of urllib.parse.parse_qsl() which was
      added to backport some security fixes. A further security fix has been
      issued recently such that parse_qsl() no longer allows using ";" as a
      query parameter separator by default. (Closes: #983090)

    <https://www.djangoproject.com/weblog/2021/feb/19/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Fri, 19 Feb 2021 09:28:42 +0000

python-django (2:3.2~alpha1-1) experimental; urgency=medium

  * New upstream alpha release.
    <https://www.djangoproject.com/weblog/2021/jan/19/django-32-alpha-1-released/>
  * Refresh patches.
  * Drop no-upstream-changelog overrides; removed from Lintian.

 -- Chris Lamb <lamby@debian.org>  Wed, 20 Jan 2021 09:27:49 +0000

python-django (2:3.1.5-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/3.1/releases/3.1.5/>

 -- Chris Lamb <lamby@debian.org>  Mon, 04 Jan 2021 12:45:20 +0000

python-django (2:3.1.4-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/3.1/releases/3.1.4/>
  * Bump Standards-Version to 4.5.1.

 -- Chris Lamb <lamby@debian.org>  Tue, 01 Dec 2020 11:25:32 +0000

python-django (2:3.1.3-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/stable/releases/3.1.3/>

 -- Chris Lamb <lamby@debian.org>  Tue, 03 Nov 2020 11:59:29 +0000

python-django (2:3.1.2-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://www.djangoproject.com/weblog/2020/oct/01/django-bugfix-release-312/>
  * Update Maintainer field with new Debian Python Team contact address.
  * Update Vcs-* fields with new Debian Python Team Salsa layout.

 -- Chris Lamb <lamby@debian.org>  Thu, 01 Oct 2020 10:06:16 +0100

python-django (2:3.1.1-1) experimental; urgency=medium

  * New upstream security release to address CVE-2020-24583, CVE-2020-24584.
    (Closes: #969367)
    <https://www.djangoproject.com/weblog/2020/sep/01/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Tue, 01 Sep 2020 12:32:23 +0100

python-django (2:3.1-2) experimental; urgency=medium

  * Set the PYTHONPATH in the autopkgtests in the same way that we do in
    debian/rules. (Closes: #968577)

 -- Chris Lamb <lamby@debian.org>  Mon, 17 Aug 2020 23:11:30 +0100

python-django (2:3.1-1) experimental; urgency=medium

  * New upstream release.
    <https://docs.djangoproject.com/en/3.1/releases/3.1/>

 -- Chris Lamb <lamby@debian.org>  Tue, 04 Aug 2020 10:11:43 +0100

python-django (2:3.1~rc1-1) experimental; urgency=medium

  * New upstream release candidate release.
    <https://www.djangoproject.com/weblog/2020/jul/20/django-31-release-candidate-1-released/>

 -- Chris Lamb <lamby@debian.org>  Mon, 20 Jul 2020 11:43:40 +0100

python-django (2:3.1~beta1-1) experimental; urgency=medium

  * New upstream beta release.
    <https://www.djangoproject.com/weblog/2020/jun/15/django-31-beta-1-released/>
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Mon, 15 Jun 2020 11:30:39 +0100

python-django (2:3.0.7-2) experimental; urgency=medium

  * Fix a regression in the handling of CVE-2020-13596.
  * Refresh patches.

 -- Chris Lamb <lamby@debian.org>  Sat, 13 Jun 2020 15:15:34 +0100

python-django (2:3.0.7-1) experimental; urgency=medium

  * New upstream security release.
    <https://www.djangoproject.com/weblog/2020/jun/03/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Wed, 03 Jun 2020 21:16:00 +0100

python-django (2:3.0.6-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/3.0/releases/3.0.6/>

 -- Chris Lamb <lamby@debian.org>  Mon, 04 May 2020 19:33:25 +0100

python-django (2:3.0.5-1) experimental; urgency=medium

  * New upstream release.
    <https://docs.djangoproject.com/en/3.0/releases/3.0.5/>
  * Refresh all patches.

 -- Chris Lamb <lamby@debian.org>  Wed, 01 Apr 2020 10:35:42 +0100

python-django (2:3.0.4-1) experimental; urgency=medium

  * New upstream security release. (Closes: #953102)
    <https://www.djangoproject.com/weblog/2020/mar/04/security-releases/>
  * Bump Standards-Version to 4.5.0.
  * Refresh debian/patches/0004-Use-locally-installed-documentation-sources.patch.

 -- Chris Lamb <lamby@debian.org>  Wed, 04 Mar 2020 08:22:30 -0800

python-django (2:3.0.2-1) experimental; urgency=medium

  * New upstream bugfix release.
    <https://www.djangoproject.com/weblog/2020/jan/02/django-bugfix-release-302/>
  * Add python3-selenium to test-dependencies and to a runtime "Suggests".
    (Closes: #947549)

 -- Chris Lamb <lamby@debian.org>  Thu, 02 Jan 2020 10:52:39 +0000

python-django (2:3.0.1-1) experimental; urgency=medium

  * New upstream security release.
    <https://www.djangoproject.com/weblog/2019/dec/18/security-releases/>
    (Closes: #946937)

 -- Chris Lamb <lamby@debian.org>  Mon, 30 Dec 2019 10:44:01 +0000

python-django (2:3.0-1) experimental; urgency=medium

  * New upstream release.
    <https://www.djangoproject.com/weblog/2019/dec/02/django-3-released/>

 -- Chris Lamb <lamby@debian.org>  Mon, 02 Dec 2019 12:24:50 +0000

python-django (2:3.0~rc1-1) experimental; urgency=medium

  * New upstream release candidate release.
    <https://www.djangoproject.com/weblog/2019/nov/18/django-30-release-candidate-1-released/>

 -- Chris Lamb <lamby@debian.org>  Mon, 18 Nov 2019 11:25:38 -0500

python-django (2:3.0~beta1-1) experimental; urgency=medium

  * New upstream beta release.
    <https://www.djangoproject.com/weblog/2019/oct/14/django-30-beta-1-released/>
  * Bump Standards-Version to 4.4.1.
  * wrap-and-sort -sa.

 -- Chris Lamb <lamby@debian.org>  Mon, 14 Oct 2019 11:11:10 -0700

python-django (2:3.0~alpha1-1) experimental; urgency=medium

  * New upstream alpha release.
    <https://www.djangoproject.com/weblog/2019/sep/10/django-30-alpha-1-released/>
  * Refresh all patches.
  * Add asgiref to build and runtime dependencies.
  * Update debian/copyright.

 -- Chris Lamb <lamby@debian.org>  Tue, 10 Sep 2019 11:22:45 +0100

python-django (2:2.2.5-1) unstable; urgency=medium

  * New upstream bugfix release.
    <https://docs.djangoproject.com/en/2.2/releases/2.2.5/>

 -- Chris Lamb <lamby@debian.org>  Mon, 02 Sep 2019 14:07:48 +0100

python-django (2:2.2.4-1) unstable; urgency=medium

  * New upstream security release. (Closes: #934026)
    <https://www.djangoproject.com/weblog/2019/aug/01/security-releases/>

 -- Chris Lamb <lamby@debian.org>  Mon, 02 Sep 2019 14:02:43 +0100

python-django (2:2.2.3-5) unstable; urgency=medium

  [ Chris Lamb ]
  * Drop Pre-Depends on version of dpkg that is now satisfied in oldoldstable.

  [ Ondřej Nový ]
  * Bump Standards-Version to 4.4.0

 -- Chris Lamb <lamby@debian.org>  Wed, 24 Jul 2019 11:36:15 -0300

python-django (2:2.2.3-4) unstable; urgency=medium

  * Fixup debian/python-django-doc.doc-base to refer to the new location(s) of
    the documentation. (Closes: #931652)

 -- Chris Lamb <lamby@debian.org>  Mon, 08 Jul 2019 21:49:47 -0300

python-django (2:2.2.3-3) unstable; urgency=medium

  * python3-mysqlclient 1.3.13 or newer is now required so add a "Breaks" on
    versions older than this. Thanks to Zhang Jingqiang for the report.
    (Closes: #931592)
  * Drop "Python 3 version" from package description; we only have this
    version now.
  * Run `wrap-and-sort -sa`.

 -- Chris Lamb <lamby@debian.org>  Mon, 08 Jul 2019 09:57:25 -0300

python-django (2:2.2.3-2) unstable; urgency=medium

  * Upload (Python 3.x-only) branch to unstable after the release of
    Debian "buster".
  * Update debian/gbp.conf to refer to debian/sid after merge.

 -- Chris Lamb <lamby@debian.org>  Sun, 07 Jul 2019 11:59:04 -0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog python-django-doc`.
