Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-Django5 for openSUSE:Factory
checked in at 2026-10-09 21:45:50
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-Django5 (Old)
and /work/SRC/openSUSE:Factory/.python-Django5.new.3698736 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-Django5"
Fri Oct 9 21:45:50 2026 rev:4 rq:1383713 version:5.2.18
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-Django5/python-Django5.changes
2026-09-11 18:08:42.104344493 +0200
+++
/work/SRC/openSUSE:Factory/.python-Django5.new.3698736/python-Django5.changes
2026-10-09 21:46:53.042106780 +0200
@@ -1,0 +2,24 @@
+Fri Oct 9 09:04:20 UTC 2026 - Markéta Machová <[email protected]>
+
+- Update to 5.2.18
+ * CVE-2026-87975: an authenticated user permitted to submit a
+ formset to delete rows outside the limiting queryset, without any
+ permission on the targeted object, marking an out-of-queryset
+ object for deletion (bsc#1284471)
+ * CVE-2026-87890: An incomplete fix for CVE-2026-15307 in Django
+ spatial lookups allows an attacker who can supply `bytes` values
+ to cause the Django process to make network requests via a
+ crafted VRT document (bsc#1284472)
+ * CVE-2026-84429: potential denial-of-service attack due to
+ quadratic time complexity when parsing a value with many
+ separators inside a quoted parameter (bsc#1284476)
+ * CVE-2026-77050: potential denial-of-service in
+ `get_supported_language_variant()` when processing many distinct,
+ very long language codes (bsc#1284481)
+ * Fixed a class of bugs in Django 5.2.17 that allowed bypassing
+ the depth limiter for deeply nested geometry collections
+ (CVE 2026-15830).
+ * Fixed a data loss issue in Django 4.0 where network rasters were
+ deleted by GeoDjango when closed.
+
+-------------------------------------------------------------------
Old:
----
Django-5.2.17.checksum.txt
django-5.2.17.tar.gz
New:
----
Django-5.2.18.checksum.txt
django-5.2.18.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-Django5.spec ++++++
--- /var/tmp/diff_new_pack.16gt0D/_old 2026-10-09 21:46:54.145153195 +0200
+++ /var/tmp/diff_new_pack.16gt0D/_new 2026-10-09 21:46:54.148153322 +0200
@@ -26,7 +26,7 @@
%bcond_with libalternatives
%endif
Name: python-Django5
-Version: 5.2.17
+Version: 5.2.18
Release: 0
Summary: A high-level Python Web framework
License: BSD-3-Clause
++++++ django-5.2.17.tar.gz -> django-5.2.18.tar.gz ++++++
/work/SRC/openSUSE:Factory/python-Django5/django-5.2.17.tar.gz
/work/SRC/openSUSE:Factory/.python-Django5.new.3698736/django-5.2.18.tar.gz
differ: char 5, line 1
