Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-Django for openSUSE:Factory checked in at 2026-11-10 14:39:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-Django (Old) and /work/SRC/openSUSE:Factory/.python-Django.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-Django" Tue Nov 10 14:39:13 2026 rev:155 rq:1396338 version:6.1.3 Changes: -------- --- /work/SRC/openSUSE:Factory/python-Django/python-Django.changes 2026-10-10 14:59:05.001235882 +0200 +++ /work/SRC/openSUSE:Factory/.python-Django.new.3759290/python-Django.changes 2026-11-10 14:39:49.396065890 +0100 @@ -1,0 +2,19 @@ +Mon Nov 9 13:05:49 UTC 2026 - Markéta Machová <[email protected]> + +- Update to 6.1.3 + * CVE-2026-108147: Potential memory exhaustion in MultiPartParser + via base64-encoded file upload (bsc#1289340) + * CVE-2026-111211: Potential log injection via unescaped geometry + form values (bsc#1289344) + * CVE-2026-111362: Server-side request forgery via crs member of + GeoJSON geometries (bsc#1289345) + * CVE-2026-113593: Potential exposure of private data via empty + and missing Vary headers (bsc#1289348) + * CVE-2026-113733: Password hash disclosure to “view only” admin + users with custom user models (bsc#1289349) + * CVE-2026-114582: Server-side request forgery via SpatialReference + string input (bsc#1289350) + * Added compatibility for oracledb 26.0.0+ + * Fixed some bugs and regressions in Django 6.1 + +------------------------------------------------------------------- Old: ---- Django-6.1.2.checksum.txt django-6.1.2.tar.gz New: ---- Django-6.1.3.checksum.txt django-6.1.3.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-Django.spec ++++++ --- /var/tmp/diff_new_pack.R6x7i9/_old 2026-11-10 14:39:51.549156002 +0100 +++ /var/tmp/diff_new_pack.R6x7i9/_new 2026-11-10 14:39:51.550156043 +0100 @@ -27,7 +27,7 @@ %endif %define skip_python311 1 Name: python-Django -Version: 6.1.2 +Version: 6.1.3 Release: 0 Summary: A high-level Python Web framework License: BSD-3-Clause ++++++ django-6.1.2.tar.gz -> django-6.1.3.tar.gz ++++++ /work/SRC/openSUSE:Factory/python-Django/django-6.1.2.tar.gz /work/SRC/openSUSE:Factory/.python-Django.new.3759290/django-6.1.3.tar.gz differ: char 5, line 1
