* CVE-2024-53907: Potential denial-of-service in django.utils.html.strip_tags()
* CVE-2024-53908: Potential SQL injection in HasKey(lhs, rhs) on Oracle
* Fixed a crash in createsuperuser on Python 3.13+ caused by an unhandled OSError
* Fixed a regression in Django 5.1 where relational fields were not updated
* Fixed a bug in Django 5.1 where DomainNameValidator accepted any input value
that contained a valid domain name, rather than only input values that were
a valid domain name
* Fixed a regression in Django 5.1 that prevented the use of DB-IP databases with GeoIP2
* Fixed a regression in Django 5.1 where non-ASCII fieldset names were not displayed
when rendering admin fieldsets
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=183
* Fixed a regression in Django 5.1 that caused a crash when using
the PostgreSQL lookup trigram_similar on output fields from Concat
* Fixed a regression in Django 5.1 that caused a crash of JSONObject()
when using server-side binding with PostgreSQL 16+
* Fixed a regression in Django 5.1 that made selected items in
multi-select widgets indistinguishable from non-selected items in
the admin dark theme
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=181
- Update to 5.1.1 (bsc#1229823, bsc#1229824)
* CVE-2024-45230: Potential denial-of-service vulnerability in
django.utils.html.urlize()
* CVE-2024-45231: Potential user email enumeration via response
status on password reset
* Fixed a regression in Django 5.1 that caused a crash of Window()
when passing an empty sequence to the order_by parameter, and a
crash of Prefetch() for a sliced queryset without ordering
* Fixed a regression in Django 5.1 where a new usable_password field
was included in BaseUserCreationForm (and children). A new
AdminUserCreationForm including this field was added, isolating
the feature to the admin where it was intended
* Adjusted the deprecation warning stacklevel in Model.save() and
Model.asave() to correctly point to the offending call site
* Adjusted the deprecation warning stacklevel when using
OS_OPEN_FLAGS in FileSystemStorage to correctly point to the
offending call site
* Adjusted the deprecation warning stacklevel in
FieldCacheMixin.get_cache_name() to correctly point to the
offending call site
* Restored, following a regression in Django 5.1, the ability to
override the timezone and role setting behavior used within the
init_connection_state method of the PostgreSQL backend
* Fixed a bug in Django 5.1 where variable lookup errors were logged
when rendering admin fieldsets
OBS-URL: https://build.opensuse.org/request/show/1198700
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=122
* Fixed a regression in Django 5.1 that caused a crash of Window() when
passing an empty sequence to the order_by parameter, and a crash of
Prefetch() for a sliced queryset without ordering
* Fixed a regression in Django 5.1 where a new usable_password field was
included in BaseUserCreationForm (and children).
* Adjusted the deprecation warning stacklevel in Model.save() and
Model.asave() to correctly point to the offending call site
* Adjusted the deprecation warning stacklevel when using OS_OPEN_FLAGS
in FileSystemStorage to correctly point to the offending call site
* Adjusted the deprecation warning stacklevel in FieldCacheMixin.get_cache_name()
to correctly point to the offending call site
* Restored, following a regression in Django 5.1, the ability to
override the timezone and role setting behavior used within the
init_connection_state method of the PostgreSQL backend
* Fixed a bug in Django 5.1 where variable lookup errors were logged
when rendering admin fieldsets
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=178
* CVE-2024-45230: Potential denial-of-service vulnerability in
django.utils.html.urlize()
* CVE-2024-45231: Potential user email enumeration via response
status on password reset
* Fixed a regression in Django 5.1 that caused a crash of Window()
when passing an empty sequence to the order_by parameter, and a
crash of Prefetch() for a sliced queryset without ordering
* Fixed a regression in Django 5.1 where a new usable_password field
was included in BaseUserCreationForm (and children). A new
AdminUserCreationForm including this field was added, isolating
the feature to the admin where it was intended
* Adjusted the deprecation warning stacklevel in Model.save() and
Model.asave() to correctly point to the offending call site
* Adjusted the deprecation warning stacklevel when using
OS_OPEN_FLAGS in FileSystemStorage to correctly point to the
offending call site
* Adjusted the deprecation warning stacklevel in
FieldCacheMixin.get_cache_name() to correctly point to the
offending call site
* Restored, following a regression in Django 5.1, the ability to
override the timezone and role setting behavior used within the
init_connection_state method of the PostgreSQL backend
* Fixed a bug in Django 5.1 where variable lookup errors were logged
when rendering admin fieldsets
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=177
* Supports Python >= 3.10.
* Easier guardrails for authentication: the new and shiny
LoginRequiredMiddleware, when added to MIDDLEWARE, enforces
authentication for all views by default.
* A more inclusive framework: Django 5.1 includes several accessibility
enhancements, such as improved screen reader support in the admin
interface, more semantic HTML elements, and better association of
help text and labels with form fieldsets.
* The second oldest ticket fixed in this release provides the long awaited
querystring template tag, which greatly simplifies the handling of query
strings when building URLs in templates.
* For a detailed list of changes see https://docs.djangoproject.com/en/5.1/releases/5.1/
- Refreshed python-Django.keyring
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=175
* CVE-2024-41989: Memory exhaustion in
django.utils.numberformat.floatformat()
* CVE-2024-41990: Potential denial-of-service vulnerability in
django.utils.html.urlize()
* CVE-2024-41991: Potential denial-of-service vulnerability in
django.utils.html.urlize() and AdminURLFieldWidget
* CVE-2024-42005: Potential SQL injection in QuerySet.values() and
values_list()
* Added missing validation for
UniqueConstraint(nulls_distinct=False) when using *expressions
* Fixed a regression in Django 5.0 where ModelAdmin.action_checkbox
could break the admin changelist HTML page when rendering a model
instance with a __html__ method
* Fixed a crash when creating a model with a Field.db_default and a
Meta.constraints constraint composed of __endswith, __startswith,
or __contains lookups
* Fixed a regression in Django 5.0.7 that caused a crash in
LocaleMiddleware when processing a language code over 500
characters
* Fixed a bug in Django 5.0 that caused a system check crash when
ModelAdmin.date_hierarchy was a GeneratedField with an
output_field of DateField or DateTimeField
* Fixed a bug in Django 5.0 which caused constraint validation to
either crash or incorrectly raise validation errors for
constraints referring to fields using Field.db_default
* Fixed a crash in Django 5.0 when saving a model containing a
FileField with a db_default set
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=172
- Update to 5.0.7
* Supports Python >= 3.10.
* Facet counts are now shown for applied filters in the admin changelist
when toggled on via the UI. This behavior can be changed via the new
ModelAdmin.show_facets attribute.
* Django 5.0 introduces the concept of a field group, and field group
templates. This simplifies rendering of the related elements of a
Django form field such as its label, widget, help text, and errors.
* The new Field.db_default parameter sets a database-computed default value.
* The new GeneratedField allows creation of database generated columns.
This field can be used on all supported database backends to create
a field that is always computed from other fields.
* More options for declaring field choices
* Few backwards-incompatible changes in the database backend API,
django.contrib.gis and django.contrib.sitemaps
* Dropped support for MySQL < 8.0.11
* Using create_defaults__exact may now be required with QuerySet.update_or_create()
* Migrating existing UUIDField on MariaDB 10.7+
- Drop no-longer-needed patches:
* dirty-hack-remove-assert.patch
* sanitize_address.patch
OBS-URL: https://build.opensuse.org/request/show/1186489
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=167
- Add python3122.patch to fix tests with python 3.12.2
gh#django/django#17843
- Update to 4.2.10 (bsc#1219683, CVE-2024-24680):
- Django 4.2.10 fixes a security issue with severity "moderate" in
4.2.9.
CVE-2024-24680: Potential denial-of-service in intcomma template
filter The intcomma template filter was subject to a potential
denial-of-service attack when used with very long strings.
OBS-URL: https://build.opensuse.org/request/show/1145400
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=113
gh#django/django#17843
- Update to 4.2.10 (bsc#1219683, CVE-2024-24680):
- Django 4.2.10 fixes a security issue with severity "moderate" in
4.2.9.
CVE-2024-24680: Potential denial-of-service in intcomma template
filter The intcomma template filter was subject to a potential
denial-of-service attack when used with very long strings.
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=158
- Update to 4.2.8
* Fixed a regression in Django 4.2 that caused makemigrations
--check to stop displaying pending migrations
* Fixed a regression in Django 4.2 that caused a crash of
QuerySet.aggregate() with aggregates referencing other aggregates
or window functions through conditional expressions
* Fixed a regression in Django 4.2 that caused a crash when
annotating a QuerySet with a Window expressions composed of a
partition_by clause mixing field types and aggregation expressions
* Fixed a regression in Django 4.2 where the admin’s change list
page had misaligned pagination links and inputs when using
list_editable
* Fixed a regression in Django 4.2 where checkboxes in the admin
would be centered on narrower screen widths
* Fixed a regression in Django 4.2 that caused a crash of querysets
with aggregations on MariaDB when the ONLY_FULL_GROUP_BY SQL mode
was enabled
* Fixed a regression in Django 4.2 where the admin’s read-only
password widget and some help texts were incorrectly aligned at
tablet widths
* Fixed a regression in Django 4.2 that caused a migration crash on
SQLite when altering unsupported Meta.db_table_comment
OBS-URL: https://build.opensuse.org/request/show/1130704
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=153
- add dirty-hack-remove-assert.patch from fedora to fix
minor test failure with python 3.12
- Update to 4.2.5 (CVE-2023-41164)
- Update minimal dependency versions.
+ Fixed a long standing bug in the __len lookup for ArrayField
constraints on expressions and database functions.
customization.
read the egg-info and fail if they are not fulfilled.
+ New decorators for the admin site
* CVE-2020-24584: Permission escalation in intermediate-level directories of the file
* Fixed a data loss possibility in the select_for_update(). When using related fields
* Fixed a regression in Django 3.1 that caused permission errors in CommonPasswordValidator
* Added compatibility for cx_Oracle 8
* many other bugfixes
- Update to 3.0.5
* Fixed a regression in Django 2.0 where combining Q objects with __in lookups
with FileExistsError if concurrent saves try to create the same directory
* Made admin’s RelatedFieldWidgetWrapper use the wrapped widget’s
value_omitted_from_data() method (#27905)
* Fixed ClearableFileInput’s “Clear” checkbox on model form fields where the
model field has a default
* Fixed RequestDataTooBig and TooManyFieldsSent exceptions crashing rather than
* Fixed a crash on Oracle and PostgreSQL when subtracting DurationField or
IntegerField from DateField
* Fixed query expression date subtraction accuracy on PostgreSQL for differences
* Fixed a GDALException raised by GDALClose on GDAL >= 2.0
* Quoted the Oracle test user’s password in queries to fix the “ORA-00922: missing
or invalid option” error when the password starts with a number or
with SLE-12 which provides PIL instead of Pillow.
OBS-URL: https://build.opensuse.org/request/show/1129117
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=151
- Update to 4.2.6 (bsc#1215978, CVE-2023-43665)
* CVE-2023-43665: Denial-of-service possibility in
django.utils.text.Truncator
The input processed by Truncator, when operating in HTML mode, has
been limited to the first five million characters in order to
avoid potential performance and memory issues.
* Fixed a regression in Django 4.2.5 where overriding the deprecated
DEFAULT_FILE_STORAGE and STATICFILES_STORAGE settings in tests
caused the main STORAGES to mutate (#34821).
* Fixed a regression in Django 4.2 that caused unnecessary casting
of string based fields (CharField, EmailField, TextField,
CICharField, CIEmailField, and CITextField) used with the __isnull
lookup on PostgreSQL. As a consequence, indexes using an __isnull
expression or condition created before Django 4.2 wouldn’t be used
by the query planner, leading to a performance regression
(#34840).
OBS-URL: https://build.opensuse.org/request/show/1117946
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=108
* CVE-2023-43665: Denial-of-service possibility in
django.utils.text.Truncator
The input processed by Truncator, when operating in HTML mode, has
been limited to the first five million characters in order to
avoid potential performance and memory issues.
* Fixed a regression in Django 4.2.5 where overriding the deprecated
DEFAULT_FILE_STORAGE and STATICFILES_STORAGE settings in tests
caused the main STORAGES to mutate (#34821).
* Fixed a regression in Django 4.2 that caused unnecessary casting
of string based fields (CharField, EmailField, TextField,
CICharField, CIEmailField, and CITextField) used with the __isnull
lookup on PostgreSQL. As a consequence, indexes using an __isnull
expression or condition created before Django 4.2 wouldn’t be used
by the query planner, leading to a performance regression
(#34840).
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=147
- Update to 4.2.5 (CVE-2023-41164)
+ Bugfixes
* Fixed a regression in Django 4.2 that caused an incorrect
validation of CheckConstraints on __isnull lookups against
JSONField
* Fixed a bug in Django 4.2 where the deprecated
DEFAULT_FILE_STORAGE and STATICFILES_STORAGE settings were not
synced with STORAGES
* Fixed a regression in Django 4.2.2 that caused an unnecessary
selection of a non-nullable ManyToManyField without a natural
key during serialization
* Fixed a regression in Django 4.2 that caused a crash of a
queryset when filtering against deeply nested OuterRef()
annotations
OBS-URL: https://build.opensuse.org/request/show/1108899
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=145
- Update to 4.2.3 (bsc#1212742, CVE-2023-36053)
+ CVE-2023-36053: Potential regular expression denial of service
vulnerability in EmailValidator/URLValidator
+ Bugfixes
* Fixed a regression in Django 4.2 that caused incorrect alignment
of timezone warnings for DateField and TimeField in the admin
* Fixed a regression in Django 4.2 that caused incorrect
highlighting of rows in the admin changelist view when
ModelAdmin.list_editable contained a BooleanField
OBS-URL: https://build.opensuse.org/request/show/1097909
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=139
- Update to 4.2.2
+ Bugfixes
* Fixed a regression in Django 4.2 that caused an unnecessary
DBMS_LOB.SUBSTR() wrapping in the __isnull and __exact=None
lookups for TextField()/BinaryField() on Oracle
* Restored, following a regression in Django 4.2, get_prep_value()
call in JSONField subclasses
* Fixed a regression in Django 4.2 that caused a crash of
QuerySet.defer() when passing a ManyToManyField or
GenericForeignKey reference. While doing so is a no-op, it was
allowed in older version
* Fixed a regression in Django 4.2 that caused a crash of
QuerySet.only() when passing a reverse OneToOneField reference
* Fixed a bug in Django 4.2 where makemigrations --update didn’t
respect the --name option
* Fixed a performance regression in Django 4.2 when compiling
queries without ordering
* Fixed a regression in Django 4.2 where nonexistent stylesheet
was linked on a “Congratulations!” page
* Fixed a regression in Django 4.2 that caused a crash of
QuerySet.aggregate() with expressions referencing other
aggregates
* Fixed a regression in Django 4.2 that caused a crash of
QuerySet.aggregate() with aggregates referencing subqueries
* Fixed a regression in Django 4.2 that caused a crash of
querysets on SQLite when filtering on DecimalField against
values outside of the defined range
* Fixed a regression in Django 4.2 that caused a serialization
crash on a ManyToManyField without a natural key when its
Manager’s base QuerySet used select_related()
OBS-URL: https://build.opensuse.org/request/show/1091039
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=135
- Update to 4.2.1
+ CVE-2023-31047: Potential bypass of validation when uploading multiple files using one form field
+ Bugfixes
* Fixed a regression in Django 4.2 that caused a crash of
QuerySet.defer() when deferring fields by attribute names
* Fixed a regression in Django 4.2 that caused a crash of
SearchVector function with % characters
* Fixed a regression in Django 4.2 that caused aggregation over
query that uses explicit grouping to group against the wrong
columns
* Reallowed, following a regression in Django 4.2, setting the
"cursor_factory" option in OPTIONS on PostgreSQL
* Enforced UTF-8 client encoding on PostgreSQL, following a
regression in Django 4.2
* Fixed a regression in Django 4.2 where i18n_patterns() didn’t
respect the prefix_default_language argument when a fallback
language of the default language was used
* Fixed a regression in Django 4.2 where translated URLs of the
default language from i18n_patterns() with
prefix_default_language set to False raised 404 errors for a
request with a different language
* Fixed a regression in Django 4.2 where creating copies and deep
copies of HttpRequest, HttpResponse, and their subclasses didn’t
always work correctly
* Fixed a regression in Django 4.2 where timesince and timeuntil
template filters returned incorrect results for a datetime with
a non-UTC timezone when a time difference is less than 1 day
* Fixed a regression in Django 4.2 that caused a crash of
SearchHeadline function with psycopg 3
* Fixed a regression in Django 4.2 that caused incorrect
ClearableFileInput margins in the admin
* Fixed a regression in Django 4.2 where breadcrumbs didn’t appear
on admin site app index views
* Made squashing migrations reduce AddIndex, RemoveIndex,
RenameIndex, and CreateModel operations which allows removing a
deprecated Meta.index_together option from historical migrations
and use Meta.indexes instead
OBS-URL: https://build.opensuse.org/request/show/1084538
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=133
- Update to 4.1.4
+ Fixed a regression in Django 4.1 that caused an unnecessary table
rebuild when adding a ManyToManyField on SQLite
+ Fixed a bug in Django 4.1 that caused a crash of the sitemap index
view with an empty Sitemap.items() and a callable lastmod
+ Fixed a bug in Django 4.1 that caused a crash using acreate(),
aget_or_create(), and aupdate_or_create() asynchronous methods of
related managers
+ Fixed a bug in Django 4.1 that caused a crash of
QuerySet.bulk_create() with "pk" in unique_fields
+ Fixed a bug in Django 4.1 that caused a crash of
QuerySet.bulk_create() on fields with db_column
OBS-URL: https://build.opensuse.org/request/show/1040693
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=119
- Update to 4.1.2 (bsc#1203793, CVE-2022-41323)
+ Fixed a regression in Django 4.1 that caused a migration crash on
PostgreSQL when adding a model with ExclusionConstraint
+ Fixed a regression in Django 4.1 that caused aggregation over a
queryset that contained an Exists annotation to crash due to too
many selected columns
+ Fixed a bug in Django 4.1 that caused an incorrect validation of
CheckConstraint on NULL values
+ Fixed a regression in Django 4.1 that caused a
QuerySet.values()/values_list() crash on ArrayAgg() and JSONBAgg()
+ Fixed a bug in Django 4.1 that caused
ModelAdmin.autocomplete_fields to be incorrectly selected after
adding/changing related instances via popups
+ Fixed a regression in Django 4.1 where the app registry was not
populated when running parallel tests with the multiprocessing
start method spawn
+ Fixed a regression in Django 4.1 where the --debug-mode argument
to test did not work when running parallel tests with the
multiprocessing start method spawn
+ Fixed a regression in Django 4.1 that didn’t alter a sequence type
when altering type of pre-Django 4.1 serial columns on PostgreSQL
+ Fixed a regression in Django 4.1 that caused a crash for View
subclasses with asynchronous handlers when handling non-allowed
HTTP methods
+ Reverted caching related managers for ForeignKey, ManyToManyField,
and GenericRelation that caused the incorrect refreshing of
related objects
+ Relaxed the system check added in Django 4.1 for the same name
used for multiple template tag modules to a warning
OBS-URL: https://build.opensuse.org/request/show/1007838
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=115
- Update to 4.1.1
+ Reallowed, following a regression in Django 4.1, using GeoIP2()
when GEOS is not installed
+ Fixed a regression in Django 4.1 that caused a crash of admin’s
autocomplete widgets when translations are deactivated
+ Fixed a regression in Django 4.1 that caused a crash of the test
management command when running in parallel and multiprocessing
start method is spawn
+ Fixed a regression in Django 4.1 that caused an incorrect
redirection to the admin changelist view when using "Save and
continue editing" and "Save and add another" options
+ Fixed a regression in Django 4.1 that caused a crash of Window
expressions with ArrayAgg
+ Fixed a regression in Django 4.1 that caused a migration crash on
SQLite 3.35.5+ when removing an indexed field
+ Fixed a bug in Django 4.1 that caused a crash of model validation
on UniqueConstraint() with field names in expressions
+ Fixed a bug in Django 4.1 that caused an incorrect validation of
CheckConstraint() with range fields on PostgreSQL
+ Fixed a regression in Django 4.1 that caused an incorrect
migration when adding AutoField, BigAutoField, or SmallAutoField
on PostgreSQL
+ Fixed a regression in Django 4.1 that caused a migration crash on
PostgreSQL when altering AutoField, BigAutoField, or
SmallAutoField to OneToOneField
+ Fixed a migration crash on ManyToManyField fields with through
referencing models in different apps
+ Fixed a regression in Django 4.1 that caused an incorrect
migration when renaming a model with ManyToManyField and db_table
+ Reallowed, following a regression in Django 4.1, creating reverse
OBS-URL: https://build.opensuse.org/request/show/1001261
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=113
- Update to 4.0.2 (CVE-2022-22818, bsc#1195086) (CVE-2022-23833, bsc#1195088)
+ CVE-2022-22818: Possible XSS via {% debug %} template tag
+ CVE-2022-23833: Denial-of-service possibility in file uploads
+ Fixed a bug in Django 4.0 where
TestCase.captureOnCommitCallbacks() could execute callbacks
multiple times
+ Fixed a regression in Django 4.0 where help_text was HTML-escaped
in automatically-generated forms
+ Fixed a regression in Django 4.0 that caused displaying an
incorrect name for class-based views on the technical 404 debug
page
+ Fixed a regression in Django 4.0 that caused an incorrect repr of
ResolverMatch for class-based views
+ Fixed a regression in Django 4.0 that caused a crash of
makemigrations on models without Meta.order_with_respect_to but
with a field named _order
+ Fixed a regression in Django 4.0 that caused incorrect
ModelAdmin.radio_fields layout in the admin
+ Fixed a duplicate operation regression in Django 4.0 that caused a
migration crash when altering a primary key type for a concrete
parent model referenced by a foreign key
+ Fixed a bug in Django 4.0 that caused a crash of
QuerySet.aggregate() after annotate() on an aggregate function
with a default
+ Fixed a regression in Django 4.0 that caused a crash of
makemigrations when renaming a field of a renamed model
OBS-URL: https://build.opensuse.org/request/show/950390
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=101
- Update to 4.0.1 (CVE-2021-45115, CVE-2021-45452, bsc#1194117)
+ CVE-2021-45115: Denial-of-service possibility in
UserAttributeSimilarityValidator
+ CVE-2021-45452: Potential directory-traversal via Storage.save()
+ Fixed a regression in Django 4.0 that caused a crash of
assertFormsetError() on a formset named form
+ Fixed a bug in Django 4.0 that caused a crash on booleans with the
RedisCache backend
+ Relaxed the check added in Django 4.0 to reallow use of a
duck-typed HttpRequest in
django.views.decorators.cache.cache_control() and never_cache()
decorators
+ Fixed a regression in Django 4.0 that caused creating bogus
migrations for models that reference swappable models such as
auth.User
+ Fixed a long standing bug in Geometry Collections and Polygon that
caused a crash on some platforms (reported on macOS based on the
ARM64 architecture)
OBS-URL: https://build.opensuse.org/request/show/945252
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=99
- Update to 3.2.5 (CVE-2021-35042, bsc#1187785)
+ Fixed a regression in Django 3.2 that caused a crash of
QuerySet.values_list(..., named=True) after prefetch_related()
+ Fixed a bug in Django 3.2 that caused a migration crash on MySQL
8.0.13+ when altering BinaryField, JSONField, or TextField to
non-nullable
+ Fixed a regression in Django 3.2 that caused a migration crash on
MySQL 8.0.13+ when adding nullable BinaryField, JSONField, or
TextField with a default value
+ Fixed a bug in Django 3.2 where a system check would crash on a
model with an invalid app_label
OBS-URL: https://build.opensuse.org/request/show/903353
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=88
- Update to 3.2.4 (CVE-2021-33203, CVE-2021-33571)
+ CVE-2021-33203: Potential directory traversal via admindocs
+ CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks
since validators accepted leading zeros in IPv4 addresses
+ Fixed a bug in Django 3.2 where a final catch-all view in the
admin didn’t respect the server-provided value of SCRIPT_NAME when
redirecting unauthenticated users to the login page
+ Fixed a bug in Django 3.2 where a system check would crash on an
abstract model
+ Prevented unnecessary initialization of unused caches following a
regression in Django 3.2
+ Fixed a crash in Django 3.2 that could occur when running mod_wsgi
with the recommended settings while the Windows colorama library
was installed
+ Fixed a bug in Django 3.2 that would trigger the auto-reloader for
template changes when directory paths were specified with strings
+ Fixed a regression in Django 3.2 that caused a crash of
auto-reloader with AttributeError, e.g. inside a Conda environment
+ Fixed a regression in Django 3.2 that caused a loss of precision
for operations with DecimalField on MySQL
OBS-URL: https://build.opensuse.org/request/show/896895
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=86
- Update to 3.2.1 (CVE-2021-31542)
+ CVE-2021-31542: Potential directory-traversal via uploaded files
+ Corrected detection of GDAL 3.2 on Windows
+ Fixed a bug in Django 3.2 where subclasses of BigAutoField and
SmallAutoField were not allowed for the DEFAULT_AUTO_FIELD setting
+ Fixed a regression in Django 3.2 that caused a crash of
QuerySet.values()/values_list() after QuerySet.union(),
intersection(), and difference() when it was ordered by an
unannotated field
+ Restored, following a regression in Django 3.2, displaying an
exception message on the technical 404 debug page
+ Fixed a bug in Django 3.2 where a system check would crash on a
reverse one-to-one relationships in CheckConstraint.check or
UniqueConstraint.condition
+ Fixed a regression in Django 3.2 that caused a crash of
ModelAdmin.search_fields when searching against phrases with
unbalanced quotes
+ Fixed a bug in Django 3.2 where variable lookup errors were logged
rendering the sitemap template if alternates were not defined
+ Fixed a regression in Django 3.2 that caused a crash when
combining Q() objects which contains boolean expressions
+ Fixed a regression in Django 3.2 that caused a crash of
QuerySet.update() on a queryset ordered by inherited or joined
fields on MySQL and MariaDB
+ Fixed a regression in Django 3.2 that caused a crash when decoding
a cookie value, used by
django.contrib.messages.storage.cookie.CookieStorage, in the
pre-Django 3.2 format
+ Fixed a regression in Django 3.2 that stopped the shift-key
modifier selecting multiple rows in the admin changelist
+ Fixed a bug in Django 3.2 where a system check would crash on the
STATICFILES_DIRS setting with a list of 2-tuples of (prefix, path)
+ Fixed a long standing bug involving queryset bitwise combination
when used with subqueries that began manifesting in Django 3.2,
due to a separate fix using Exists to exclude() multi-valued
relationships
+ Fixed a bug in Django 3.2 where variable lookup errors were logged
when rendering some admin templates
+ Fixed a bug in Django 3.2 where an admin changelist would crash
when deleting objects filtered against multi-valued relationships
+ Fixed a regression in Django 3.2 where the calling process
environment would not be passed to the dbshell command on PostgreSQL
+ Fixed a performance regression in Django 3.2 when building complex
filters with subqueries
OBS-URL: https://build.opensuse.org/request/show/890638
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=80
- Update to 3.1.4
* Fixed setting the Content-Length HTTP header in AsyncRequestFactory
* Fixed passing extra HTTP headers to AsyncRequestFactory request methods
* Fixed crash of key transforms for JSONField on PostgreSQL when usingi
on a Subquery() annotation
* Fixed a regression in Django 3.1 that caused the incorrect grouping
by a Q object annotation
* Fixed a regression in Django 3.1 that caused suppressing connection errors
when JSONField is used on SQLite
* Fixed a crash on SQLite, when QuerySet.values()/values_list() contained
key transforms for JSONField returning non-string primitive values
OBS-URL: https://build.opensuse.org/request/show/854260
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=70
* Fixed setting the Content-Length HTTP header in AsyncRequestFactory
* Fixed passing extra HTTP headers to AsyncRequestFactory request methods
* Fixed crash of key transforms for JSONField on PostgreSQL when usingi
on a Subquery() annotation
* Fixed a regression in Django 3.1 that caused the incorrect grouping
by a Q object annotation
* Fixed a regression in Django 3.1 that caused suppressing connection errors
when JSONField is used on SQLite
* Fixed a crash on SQLite, when QuerySet.values()/values_list() contained
key transforms for JSONField returning non-string primitive values
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=74
- Update to 3.1.3
* Fixed a regression in Django 3.1.2 that caused the incorrect height of the admin
changelist search bar
* Fixed a regression in Django 3.1.2 that caused the incorrect width of the
admin changelist search bar on a filtered page
* Fixed displaying Unicode characters in forms.JSONField and read-only
models.JSONField values in the admin
* Fixed a regression in Django 3.1 that caused a crash of ArrayAgg and StringAgg
with ordering on key transforms for JSONField
* Fixed a regression in Django 3.1 that caused a crash of __in lookup when using
key transforms for JSONField in the lookup value
* Fixed a regression in Django 3.1 that caused a crash of ExpressionWrapper with
key transforms for JSONField
* Fixed a regression in Django 3.1 that caused a migrations crash on PostgreSQL
when adding an ExclusionConstraint with key transforms for JSONField in expressions
* Fixed a regression in Django 3.1 where ProtectedError.protected_objects
and RestrictedError.restricted_objects attributes returned iterators instead
of set of objects
* Fixed a regression in Django 3.1.2 that caused incorrect form input layout
on small screens in the admin change form view
* Fixed a regression in Django 3.1 that invalidated pre-Django 3.1 password reset tokens
* Added support for asgiref 3.3
* Fixed a regression in Django 3.1 that caused incorrect textarea layout
on medium-sized screens in the admin change form view with the sidebar open
* Fixed a regression in Django 3.0.7 that didn’t use Subquery() aliases
in the GROUP BY clause
* Fixed a bug in Django 3.1 where FileField instances with a callable storage were
not correctly deconstructed
* Fixed a regression in Django 3.1 where the QuerySet.ordered attribute returned
incorrectly True for GROUP BY queries (e.g. .annotate().values()) on models with
OBS-URL: https://build.opensuse.org/request/show/845465
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=69
* Fixed a regression in Django 3.1.2 that caused the incorrect height of the admin
changelist search bar
* Fixed a regression in Django 3.1.2 that caused the incorrect width of the
admin changelist search bar on a filtered page
* Fixed displaying Unicode characters in forms.JSONField and read-only
models.JSONField values in the admin
* Fixed a regression in Django 3.1 that caused a crash of ArrayAgg and StringAgg
with ordering on key transforms for JSONField
* Fixed a regression in Django 3.1 that caused a crash of __in lookup when using
key transforms for JSONField in the lookup value
* Fixed a regression in Django 3.1 that caused a crash of ExpressionWrapper with
key transforms for JSONField
* Fixed a regression in Django 3.1 that caused a migrations crash on PostgreSQL
when adding an ExclusionConstraint with key transforms for JSONField in expressions
* Fixed a regression in Django 3.1 where ProtectedError.protected_objects
and RestrictedError.restricted_objects attributes returned iterators instead
of set of objects
* Fixed a regression in Django 3.1.2 that caused incorrect form input layout
on small screens in the admin change form view
* Fixed a regression in Django 3.1 that invalidated pre-Django 3.1 password reset tokens
* Added support for asgiref 3.3
* Fixed a regression in Django 3.1 that caused incorrect textarea layout
on medium-sized screens in the admin change form view with the sidebar open
* Fixed a regression in Django 3.0.7 that didn’t use Subquery() aliases
in the GROUP BY clause
* Fixed a bug in Django 3.1 where FileField instances with a callable storage were
not correctly deconstructed
* Fixed a regression in Django 3.1 where the QuerySet.ordered attribute returned
incorrectly True for GROUP BY queries (e.g. .annotate().values()) on models with
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=72
- Update to 3.1.1
* CVE-2020-24583: Incorrect permissions on intermediate-level directories on Python 3.7+
* CVE-2020-24584: Permission escalation in intermediate-level directories of the file
system cache on Python 3.7+
* Fixed a data loss possibility in the select_for_update(). When using related fields
pointing to a proxy model in the of argument, the corresponding model was not locked
* Fixed a regression in Django 3.1 that caused a crash when decoding an invalid session data
* Fixed __in lookup on key transforms for JSONField with MariaDB, MySQL, Oracle, and SQLite
* Fixed a regression in Django 3.1 that caused permission errors in CommonPasswordValidator
and settings.py
OBS-URL: https://build.opensuse.org/request/show/833246
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=70
- update to 3.0.8
* Fixed messages of InvalidCacheKey exceptions and CacheKeyWarning warnings
raised by cache key validation
* Fixed a regression in Django 3.0.7 that caused a queryset crash
when grouping by a many-to-one relationship
* Reallowed, following a regression in Django 3.0, non-expressions having
a filterable attribute to be used as the right-hand side in queryset filters
* Fixed a regression in Django 3.0.2 that caused a migration crash
on PostgreSQL when adding a foreign key to a model with a namespaced db_table
* Added compatibility for cx_Oracle 8
OBS-URL: https://build.opensuse.org/request/show/819476
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=66
* Fixed messages of InvalidCacheKey exceptions and CacheKeyWarning warnings
raised by cache key validation
* Fixed a regression in Django 3.0.7 that caused a queryset crash
when grouping by a many-to-one relationship
* Reallowed, following a regression in Django 3.0, non-expressions having
a filterable attribute to be used as the right-hand side in queryset filters
* Fixed a regression in Django 3.0.2 that caused a migration crash
on PostgreSQL when adding a foreign key to a model with a namespaced db_table
* Added compatibility for cx_Oracle 8
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=64
- Update to 2.2.8
* CVE-2019-19118: Privilege escalation in the Django admin (boo#1157705)
* Fixed a data loss possibility in the admin changelist view when a
custom formset’s prefix contains regular expression special
characters, e.g. '$'
* Fixed a regression in Django 2.2.1 that caused a crash when
migrating permissions for proxy models with a multiple database
setup if the default entry was empty
* Fixed a data loss possibility in the select_for_update(). When
using 'self' in the of argument with multi-table inheritance, a
parent model was locked instead of the queryset’s model
- Add patch fix-selenium-test.patch to fix a test when selenium is
missing
OBS-URL: https://build.opensuse.org/request/show/752866
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=45
- Update to 2.2.7:
* Fixed a crash when using a contains, contained_by, has_key, has_keys, or has_any_keys lookup on JSONField, if the right or left hand side of an expression is a key transform (#30826).
* Prevented migrate --plan from showing that RunPython operations are irreversible when reverse_code callables don’t have docstrings or when showing a forward migration plan (#30870).
* Fixed migrations crash on PostgreSQL when adding an Index with fields ordering and opclasses (#30903).
* Restored the ability to override get_FOO_display() (#30931).
- Require full python interpreter on build and runtime
OBS-URL: https://build.opensuse.org/request/show/748860
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=57
* Fixed a crash when using a contains, contained_by, has_key, has_keys, or has_any_keys lookup on JSONField, if the right or left hand side of an expression is a key transform (#30826).
* Prevented migrate --plan from showing that RunPython operations are irreversible when reverse_code callables don’t have docstrings or when showing a forward migration plan (#30870).
* Fixed migrations crash on PostgreSQL when adding an Index with fields ordering and opclasses (#30903).
* Restored the ability to override get_FOO_display() (#30931).
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=43
- Update to 2.2.5:
* Relaxed the system check added in Django 2.2 for models to reallow use of the same db_table by multiple models when database routers are installed (#30673).
* Fixed crash of KeyTransform() for JSONField and HStoreField when using on expressions with params (#30672).
* Fixed a regression in Django 2.2 where ModelAdmin.list_filter choices to foreign objects don’t respect a model’s Meta.ordering (#30449).
* Fixed a race condition in loading URLconf module that could cause a crash of auto-reloader on Python 3.5 and below (#30500).
OBS-URL: https://build.opensuse.org/request/show/731244
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=55
* Relaxed the system check added in Django 2.2 for models to reallow use of the same db_table by multiple models when database routers are installed (#30673).
* Fixed crash of KeyTransform() for JSONField and HStoreField when using on expressions with params (#30672).
* Fixed a regression in Django 2.2 where ModelAdmin.list_filter choices to foreign objects don’t respect a model’s Meta.ordering (#30449).
* Fixed a race condition in loading URLconf module that could cause a crash of auto-reloader on Python 3.5 and below (#30500).
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=38
- Update to 2.2.4:
* CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235
bsc#1142883 bsc#1142885 bsc#1142882 bsc#1142880
* Fixed a regression in Django 2.2 when ordering a QuerySet.union(), intersection(), or difference() by a field type present more than once results in the wrong ordering being used (#30628).
* Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type (#30621).
* Fixed a regression in Django 2.2 where auto-reloader crashes if a file path contains nulls characters ('\x00') (#30506).
* Fixed a regression in Django 2.2 where auto-reloader crashes if a translation directory cannot be resolved (#30647).
OBS-URL: https://build.opensuse.org/request/show/720189
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=54
* CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235
* Fixed a regression in Django 2.2 when ordering a QuerySet.union(), intersection(), or difference() by a field type present more than once results in the wrong ordering being used (#30628).
* Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type (#30621).
* Fixed a regression in Django 2.2 where auto-reloader crashes if a file path contains nulls characters ('\x00') (#30506).
* Fixed a regression in Django 2.2 where auto-reloader crashes if a translation directory cannot be resolved (#30647).
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=35
- Update keyring file
- Update to 2.2.1
* Fixed a regression in Django 2.1 that caused the incorrect quoting
of database user password when using dbshell on Oracle (#30307).
* Added compatibility for psycopg2 2.8 (#30331).
* Fixed a regression in Django 2.2 that caused a crash when loading
the template for the technical 500 debug page (#30324).
* Fixed crash of ordering argument in ArrayAgg and StringAgg when it
contains an expression with params (#30332).
* Fixed a regression in Django 2.2 that caused a single instance
fast-delete to not set the primary key to None (#30330).
* Prevented makemigrations from generating infinite migrations for
check constraints and partial indexes when condition contains a
range object (#30350). Reverted an optimization in Django 2.2
(#29725) that caused the inconsistent behavior of count() and
exists() on a reverse many-to-many relationship with a custom
manager (#30325).
* Fixed a regression in Django 2.2 where Paginator crashes if
object_list is a queryset ordered or aggregated over a nested
JSONField key transform (#30335).
* Fixed a regression in Django 2.2 where IntegerField validation of
database limits crashes if limit_value attribute in a custom
validator is callable (#30328).
* Fixed a regression in Django 2.2 where SearchVector generates SQL
that is not indexable (#30385).
* Fixed a regression in Django 2.2 that caused an exception to be
raised when a custom error handler could not be imported (#30318).
* Relaxed the system check added in Django 2.2 for the admin app’s
dependencies to reallow use of SessionMiddleware subclasses,
OBS-URL: https://build.opensuse.org/request/show/701222
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=51
- Update to 2.2.1
* Fixed a regression in Django 2.1 that caused the incorrect quoting
of database user password when using dbshell on Oracle (#30307).
* Added compatibility for psycopg2 2.8 (#30331).
* Fixed a regression in Django 2.2 that caused a crash when loading
the template for the technical 500 debug page (#30324).
* Fixed crash of ordering argument in ArrayAgg and StringAgg when it
contains an expression with params (#30332).
* Fixed a regression in Django 2.2 that caused a single instance
fast-delete to not set the primary key to None (#30330).
* Prevented makemigrations from generating infinite migrations for
check constraints and partial indexes when condition contains a
range object (#30350). Reverted an optimization in Django 2.2
(#29725) that caused the inconsistent behavior of count() and
exists() on a reverse many-to-many relationship with a custom
manager (#30325).
* Fixed a regression in Django 2.2 where Paginator crashes if
object_list is a queryset ordered or aggregated over a nested
JSONField key transform (#30335).
* Fixed a regression in Django 2.2 where IntegerField validation of
database limits crashes if limit_value attribute in a custom
validator is callable (#30328).
* Fixed a regression in Django 2.2 where SearchVector generates SQL
that is not indexable (#30385).
* Fixed a regression in Django 2.2 that caused an exception to be
raised when a custom error handler could not be imported (#30318).
* Relaxed the system check added in Django 2.2 for the admin app’s
dependencies to reallow use of SessionMiddleware subclasses,
rather than requiring django.contrib.sessions to be in
INSTALLED_APPS (#30312).
OBS-URL: https://build.opensuse.org/request/show/701120
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=28
- update to 2.1.7 (CVE-2019-6975, bsc#1124991):
* Corrected packaging error from 2.1.6
* Memory exhaustion in django.utils.numberformat.format()
If django.utils.numberformat.format() – used by contrib.admin as well
as the the floatformat, filesizeformat, and intcomma templates
filters – received a Decimal with a large number of digits or a
large exponent, it could lead to significant memory usage
due to a call to '{:f}'.format().
To avoid this, decimals with more than 200 digits are now formatted
using scientific notation.
* Made the obj argument of InlineModelAdmin.has_add_permission() optional
to restore backwards compatibility with third-party code that doesn’t
provide it
OBS-URL: https://build.opensuse.org/request/show/673591
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=48
* Corrected packaging error from 2.1.6
* Memory exhaustion in django.utils.numberformat.format()
If django.utils.numberformat.format() – used by contrib.admin as well
as the the floatformat, filesizeformat, and intcomma templates
filters – received a Decimal with a large number of digits or a
large exponent, it could lead to significant memory usage
due to a call to '{:f}'.format().
To avoid this, decimals with more than 200 digits are now formatted
using scientific notation.
* Made the obj argument of InlineModelAdmin.has_add_permission() optional
to restore backwards compatibility with third-party code that doesn’t
provide it
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=20
- update to 2.1.5 (CVE-2019-3498, bsc#1120932):
* CVE-2019-3498: Content spoofing possibility in the default 404 page
* Fixed compatibility with mysqlclient 1.3.14 (#30013).
* Fixed a schema corruption issue on SQLite 3.26+. You might have to drop
and rebuild your SQLite database if you applied a migration while using
an older version of Django with SQLite 3.26 or later (#29182).
* Prevented SQLite schema alterations while foreign key checks are enabled
to avoid the possibility of schema corruption (#30023).
* Fixed a regression in Django 2.1.4 (which enabled keep-alive connections)
where request body data isn’t properly consumed for such
connections (#30015).
* Fixed a regression in Django 2.1.4 where
InlineModelAdmin.has_change_permission() is incorrectly called with
a non-None obj argument during an object add (#30050).
OBS-URL: https://build.opensuse.org/request/show/664341
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=47
* CVE-2019-3498: Content spoofing possibility in the default 404 page
* Fixed compatibility with mysqlclient 1.3.14 (#30013).
* Fixed a schema corruption issue on SQLite 3.26+. You might have to drop
and rebuild your SQLite database if you applied a migration while using
an older version of Django with SQLite 3.26 or later (#29182).
* Prevented SQLite schema alterations while foreign key checks are enabled
to avoid the possibility of schema corruption (#30023).
* Fixed a regression in Django 2.1.4 (which enabled keep-alive connections)
where request body data isn’t properly consumed for such
connections (#30015).
* Fixed a regression in Django 2.1.4 where
InlineModelAdmin.has_change_permission() is incorrectly called with
a non-None obj argument during an object add (#30050).
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=18
- Update to version 2.1.4
* Corrected the default password list that CommonPasswordValidator uses
by lowercasing all passwords to match the format expected by the validator
* Prevented repetitive calls to geos_version_tuple() in the WKBWriter class in
an attempt to fix a random crash involving LooseVersion
* Fixed keep-alive support in runserver after it was disabled o 2.0
* Fixed admin view-only change form crash when using ModelAdmin.prepopulated_fields
* Fixed “Please correct the errors below” error message when editing an object
in the admin if the user only has the “view” permission on inlines
* Fixed a regression in Django 2.0 where combining Q objects with __in lookups
and lists crashed
* Fixed a regression in Django 2.0 where test databases aren’t reused
with manage.py test --keepdb on MySQL
* Fixed a regression where cached foreign keys that use to_field were
incorrectly cleared in Model.save()
* Fixed a regression in Django 2.0 where FileSystemStorage crashes
with FileExistsError if concurrent saves try to create the same directory
OBS-URL: https://build.opensuse.org/request/show/656841
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=16
- Update to version 2.1.2
* CVE-2018-16984: Password hash disclosure to “view only” admin
users
* Fixed a regression where nonexistent joins in F() no longer raised
FieldError (#29727).
* Fixed a regression where files starting with a tilde or underscore
weren’t ignored by the migrations loader (#29749).
* Made migrations detect changes to Meta.default_related_name
(#29755).
* Added compatibility for cx_Oracle 7 (#29759).
* Fixed a regression in Django 2.0 where unique index names weren’t
quoted (#29778).
* Fixed a regression where sliced queries with multiple columns with
the same name crashed on Oracle 12.1 (#29630).
* Fixed a crash when a user with the view (but not change)
permission made a POST request to an admin user change form
(#29809).
OBS-URL: https://build.opensuse.org/request/show/639971
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=12
- update to version 2.1.1
- drop django-urlencode.patch
* Fixed a race condition in QuerySet.update_or_create() that could result
in data loss
* Fixed a regression where QueryDict.urlencode() crashed if the dictionary
contains a non-string value
* Fixed a regression in Django 2.0 where using manage.py test --keepdb fails
on PostgreSQL if the database exists and the user doesn’t have permission
to create databases
* Fixed a regression in Django 2.0 where combining Q objects with __in
lookups and lists crashed
* Fixed translation failure of DurationField’s “overflow” error message
* Fixed a regression where the admin change form crashed if the user doesn’t
have the ‘add’ permission to a model that uses TabularInline
* Fixed a regression where a related_query_name reverse accessor wasn’t
set up when a GenericRelation is declared on an abstract base model
* Fixed the test client’s JSON serialization of a request data dictionary
for structured content type suffixes
* Made the admin change view redirect to the changelist view after a POST
if the user has the ‘view’ permission
* Fixed admin change view crash for view-only users if the form
has an extra form field
* Fixed a regression in Django 2.0.5 where QuerySet.values() or values_list()
after combining querysets with extra() with union(), difference(),
or intersection() crashed due to mismatching columns
OBS-URL: https://build.opensuse.org/request/show/633018
OBS-URL: https://build.opensuse.org/package/show/devel:languages:python:django/python-Django?expand=0&rev=10
- update to version 2.0.4:
* Fixed#29265 -- Removed the suggestion to hardcode static URLs.
* Fixed#29206 -- Fixed PasswordResetConfirmView crash when the URL contains a non-UUID where one is expected.
* Fixed#29195 -- Fixed Exists.output_field resolution on single-valued queries.
* Fixed links to Sphinx docs.
* Fixed typo in docs/releases/2.0.4.txt.
* Clarified docs about ISO 8601 week numbering.
* Fixed#29116 -- Fixed OpenLayersWidget deserialization ignoring the widget map's SRID.
* Added CVE-2018-7536,7 to the security release archive.
* Fixed#29221 -- Corrected admin's autocomplete widget to add a space after custom classes.
* Fixed#29273 -- Prevented initial selection of empty choice in multiple choice widgets.
* Added a pagination example to ListView docs.
* Fixed#28514 -- Clarifed docs about idempotence of RelatedManager.add().
* isorted import statements in tutorial example.
* Fixed#29192 -- Corrected docs regarding overriding fields from abstract base classes.
* Refs #11278 -- Clarified RelatedManager differences between reverse one-to-many and many-to-many relations.
* Added stub release notes for 1.11.12.
* Fixed#29165 -- Clarified how to load initial data with migrations.
* Fixed#29213 -- Fixed autocomplete widget's translations for zh-hans/zh-hant.
* Reverted "Expanded docs for AbstractBaseUser.has_usable_password()."
* Fixed typo in docs/releases/2.0.4/1.11.12.txt.
* Bumped version for 2.0.4 release.
* Fixed#29250 -- Added 'django_version' context to startapp/project docs.
* Added release date for 2.0.4 and 1.11.12.
* Post-release version bump.
* Clarified a sentence in docs/topics/i18n/translation.txt.
* Fixed#29229 -- Fixed column mismatch crash when combining two annotated values_list() querysets with union(), difference(), or intersection().
* Added stub release notes for 2.0.4.
* Fixed a couple mistakes in docs/ref/forms/widgets.txt.
* Fixed#28655 -- Added more examples for customizing widgets in a form.
OBS-URL: https://build.opensuse.org/request/show/594522
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=38
- update to 2.0.3 (bsc#1083305, bsc#1083304, CVE-2018-7536, CVE-2018-7537):
* Fixed#29108 -- Fixed crash in aggregation of distinct+ordered+sliced querysets.
* Added CVE-2018-6188 to the security release archive.
* Post-release version bump.
* Updated translations from Transifex
* Added stub release notes for security releases.
* Fixed incorrect regex in re_path() example.
* Fixed#29125 -- Made Q.deconstruct() deterministic with multiple keyword arguments.
* Fixed#29126 -- Doc'd the behavior of QuerySet.update_or_create() with manually specified pks.
* Used a CSS positioning in tutorial 6 that doesn't differ across browsers.
* Fixed typo in bulk_create() documentation.
* Fixed#29176 -- Fixed AbstractBaseUser.normalize_username() crash if username isn't a string.
* Removed blank lines per isort 4.3.0.
* Added stub release notes for 2.0.3.
* Fixed CVE-2018-7536 -- Fixed catastrophic backtracking in urlize and urlizetrunc template filters.
* Fixed#29172 -- Fixed crash with Window expression in a subquery.
* Fixed#29166 -- Fixed crash in When() expression with a list argument.
* Fixed#24270 -- Doc'd that django_bash_completion is only in the source distribution.
* Improved clarity of docs/topics/install.txt.
* Refs #29125 -- Made Q.deconstruct() omit 'query_utils' in the path and _connector='AND' since it's a default value.
* Fixed CVE-2018-7537 -- Fixed catastrophic backtracking in django.utils.text.Truncator.
* Bumped version for 2.0.3 release.
* Corrected doc'd type of some parameters from string to str.
* Fixed#29146 -- Readded ^ and $ inadvertently removed from re_path() examples.
* Fixed#29107 -- Doc'd that ModelForm doesn't actually inherit from Form.
* Switched test requirement to new psycopg2-binary package.
* Added backticks around obj argument in admin docs.
* Fixed typo in docs/topics/forms/media.txt.
* Fixed#29109 -- Fixed the admin time picker widget for the Thai locale.
* Fixed#29118 -- Fixed crash with QuerySet.order_by(Exists(...)).
OBS-URL: https://build.opensuse.org/request/show/588436
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=37
- update to 2.0.2 (bsc#1077714, CVE-2018-6188):
* Fixed#28883 -- Doc'd that the uuid URL path converter matches lowercase only letters.
* Fixed a GeoIP2 test failure with the latest GeoIP2 database.
* Added stub release notes for 2.0.1.
* Bumped version for 2.0.2 release.
* Fixed location of spatialite_source label.
* Fixed#28958 -- Fixed admin changelist crash when using a query expression in the page's ordering.
* Fixed#28231 -- Doc'd that QuerySet.bulk_create() casts objs to a list.
* Fixed#29032 -- Fixed an example of using expressions in QuerySet.values().
* Disambiguated "settings" in SpatiaLite note.
* Fixed typo in docs/topics/testing/advanced.txt.
* Post-release version bump.
* Refs #25604 -- Removed docs for makemigrations --exit.
* Fixed#29002 -- Corrected cached template loader docs about when it's automatically enabled.
* Fixed typo in TemplateCommand argument help text.
* Added stub release notes for 1.11.9.
* Fixed#28915 -- Prevented SQLite from truncating trailing zeros in the fractional part of DecimalField.
* Refs #29086 -- Doc'd how to detect bytestring mistakes.
* Fixed#28886 -- Updated prefix for example django.contrib.auth.urls URLs.
* Fixed#29081 -- Clarified comments in QuerySet.select_related() example.
* Refs #27985 -- Reallowed using __exact=None as an alias for __isnull=True if a custom lookup class with lookup_name != None is registered as the exact lookup.
* Refs #28876 -- Fixed incorrect class-based model index name generation for models with quoted db_table.
* Removed 'development' word in contributing docs
* Fixed#29055 -- Doc'd that escapejs doesn't make template literals safe.
* Fixed#29016 -- Fixed incorrect foreign key nullification on related instance deletion.
* Fixed grammar in docs/releases/2.0.txt.
* Fixed#29071 -- Fixed contrib.auth.authenticate() crash if a backend doesn't accept a request but a later one does.
* Fixed#28944 -- Fixed crash when chaining values()/values_list() after QuerySet.select_for_update(of=()).
* Fixed#29091 -- Fixed makemigrations crash if migrations directory doesn't have __init__.py.
* Fixed#28898 -- Corrected admin check to allow a OneToOneField in ModelAdmin.autocomplete_fields.
OBS-URL: https://build.opensuse.org/request/show/573722
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=36
- Fix update-alternatives
- Update to version 1.6.2:
+ Prevented the base geometry object of a prepared geometry to be garbage
collected, which could lead to crash Django (#21662).
+ Fixed a crash when executing the changepassword command when the user
object representation contained non-ASCII characters (#21627).
+ The collectstatic command will raise an error rather than default to
using the current working directory if STATIC_ROOT is not set. Combined
with the --clear option, the previous behavior could wipe anything
below the current working directory (#21581).
+ Fixed mail encoding on Python 3.3.3+ (#21093).
+ Fixed an issue where when settings.DATABASES['default']['AUTOCOMMIT'] = False,
the connection wasn’t in autocommit mode but Django pretended it was.
+ Fixed a regression in multiple-table inheritance exclude() queries (#21787).
+ Added missing items to django.utils.timezone.__all__ (#21880).
+ Fixed a field misalignment issue with select_related() and model inheritance (#21413).
+ Fixed join promotion for negated AND conditions (#21748).
+ Oracle database introspection now works with boolean and float fields (#19884).
+ Fixed an issue where lazy objects weren’t actually marked as safe when
passed through mark_safe() and could end up being double-escaped (#21882).
OBS-URL: https://build.opensuse.org/request/show/222292
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-Django?expand=0&rev=3
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
