From 0955700ceb031bafb223e813b85d4ebeaebfb999 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sun, 28 Dec 2025 19:18:40 +0100 Subject: [PATCH] package/python-django: security bump to 5.1.15 For more details on the version bump, see the release note: - https://docs.djangoproject.com/en/dev/releases/5.1.15/ Fixes the following security issue: - CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL. For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-13372 - CVE-2025-64460: Potential denial-of-service vulnerability in XML Deserializer. For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-64460 (cherry picked from commit 2622f9ca25cdc179ed1be3d733fb9b963a7fc5b8) Signed-off-by: Thomas Perale --- package/python-django/python-django.hash | 4 ++-- package/python-django/python-django.mk | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/python-django/python-django.hash b/package/python-django/python-django.hash index 97e568ea14..0c9b70959f 100644 --- a/package/python-django/python-django.hash +++ b/package/python-django/python-django.hash @@ -1,6 +1,6 @@ # md5, sha256 from https://pypi.org/pypi/django/json -md5 b0c6556282e4ef15209b34b09604b9a1 django-5.1.14.tar.gz -sha256 b98409fb31fdd6e8c3a6ba2eef3415cc5c0020057b43b21ba7af6eff5f014831 django-5.1.14.tar.gz +md5 232748d1f2d6d1074f873dde91f7d75b django-5.1.15.tar.gz +sha256 46a356b5ff867bece73fc6365e081f21c569973403ee7e9b9a0316f27d0eb947 django-5.1.15.tar.gz # Locally computed sha256 checksums sha256 b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669 LICENSE sha256 dcac1c86cb7ab491702bdb4c41be680fafde51536748cc8aaee3840eec53ed17 django/contrib/gis/measure.py diff --git a/package/python-django/python-django.mk b/package/python-django/python-django.mk index fc5494cd80..32821e19a0 100644 --- a/package/python-django/python-django.mk +++ b/package/python-django/python-django.mk @@ -4,10 +4,10 @@ # ################################################################################ -PYTHON_DJANGO_VERSION = 5.1.14 +PYTHON_DJANGO_VERSION = 5.1.15 PYTHON_DJANGO_SOURCE = django-$(PYTHON_DJANGO_VERSION).tar.gz # The official Django site has an unpractical URL -PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/6e/f9/284077f0e61f633e5279518a9ac5924ade4bef12bc841174ca48c57f2438 +PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/10/45/1ac68964193cfcc0b0912a0f68025d5bdb54f71ba7b8716e85b959874bd0 PYTHON_DJANGO_LICENSE = BSD-3-Clause, MIT (jquery, utils/archive.py), BSD-2-Clause (inlines.js) PYTHON_DJANGO_LICENSE_FILES = LICENSE \ django/contrib/gis/measure.py \