chore(deps): update dependency django to v5.2.11 [security]#213
chore(deps): update dependency django to v5.2.11 [security]#213renovate[bot] wants to merge 1 commit intomainfrom
Conversation
Welcome @renovate[bot]! 🎉Great PR! I've analyzed your code changes for:
Ready to see the full review?
Let's make your code even better together! 🚀 |
|
Merging to
|
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the
Comment |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
No reviewable files after applying ignore patterns. |
|
Here's the code health analysis summary for commits Analysis Summary
|
renovate
bot
force-pushed
the
renovate/pypi-django-vulnerability
branch
from
313cf89 to
9b7f92e
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #213 +/- ##
=======================================
Coverage 95.00% 95.00%
=======================================
Files 31 31
Lines 1641 1641
Branches 27 27
=======================================
Hits 1559 1559
Misses 81 81
Partials 1 1 |
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/pypi-django-vulnerability
branch
from
9b7f92e to
354828d
Compare
|
This PR contains the following updates:
5.2.7→5.2.11GitHub Vulnerability Alerts
CVE-2025-64458
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence,
django.http.HttpResponseRedirect,django.http.HttpResponsePermanentRedirect, and the shortcutdjango.shortcuts.redirectwere subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
CVE-2025-64459
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods
QuerySet.filter(),QuerySet.exclude(), andQuerySet.get(), and the classQ(), are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the_connectorargument.Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.
CVE-2025-13372
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
FilteredRelationis subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the**kwargspassed toQuerySet.annotate()orQuerySet.alias()on PostgreSQL.Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Stackered for reporting this issue.
CVE-2025-64460
An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27.
Algorithmic complexity in
django.core.serializers.xml_serializer.getInnerText()allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion via specially crafted XML input processed by the XMLDeserializer.Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.
CVE-2025-13473
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
The
django.contrib.auth.handlers.modwsgi.check_password()function for authentication viamod_wsgiallows remote attackers to enumerate users via a timing attack. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.Django would like to thank Stackered for reporting this issue.
CVE-2025-14550
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
ASGIRequestallows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers.Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Jiyong Yang for reporting this issue.
CVE-2026-1285
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
django.utils.text.Truncator.chars()andTruncator.words()methods (withhtml=True) and thetruncatechars_htmlandtruncatewords_htmltemplate filters allow a remote attacker to cause a potential denial-of-service via crafted inputs containing a large number of unmatched HTML end tags. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.Django would like to thank Seokchan Yoon for reporting this issue.
CVE-2026-1207
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
Raster lookups on
RasterField(only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.Django would like to thank Tarek Nakkouch for reporting this issue.
CVE-2026-1287
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
FilteredRelationis subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the**kwargspassed toQuerySetmethodsannotate(),aggregate(),extra(),values(),values_list(), andalias(). Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.Django would like to thank Solomon Kebede for reporting this issue.
CVE-2026-1312
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
.QuerySet.order_by()is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansion, used inFilteredRelation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.Django would like to thank Solomon Kebede for reporting this issue.
Release Notes
django/django (django)
v5.2.11Compare Source
v5.2.10Compare Source
v5.2.9Compare Source
v5.2.8Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.
This change is