Content-Transfer-Encoding: 7bit
Content-Type: multipart/mixed; boundary="_----------=_1676368216178540"
MIME-Version: 1.0
Date: Tue, 14 Feb 2023 09:50:16 +0000
From: "Thomas Klausner" <wiz@netbsd.org>
Subject: CVS commit: pkgsrc/www/py-django3
To: pkgsrc-changes@NetBSD.org
Reply-To: wiz@netbsd.org
Message-Id: <20230214095016.84ACEFA90@cvs.NetBSD.org>
Sender: pkgsrc-changes-owner@NetBSD.org
Precedence: bulk

This is a multi-part message in MIME format.

--_----------=_1676368216178540
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="US-ASCII"

Module Name:	pkgsrc
Committed By:	wiz
Date:		Tue Feb 14 09:50:16 UTC 2023

Modified Files:
	pkgsrc/www/py-django3: Makefile distinfo

Log Message:
py-django: update to 3.2.18.

===========================
Django 3.2.18 release notes
===========================

*February 14, 2023*

Django 3.2.18 fixes a security issue with severity "moderate" in 3.2.17.

CVE-2023-24580: Potential denial-of-service vulnerability in file uploads
=========================================================================

Passing certain inputs to multipart forms could result in too many open files
or memory exhaustion, and provided a potential vector for a denial-of-service
attack.

The number of files parts parsed is now limited via the new
:setting:`DATA_UPLOAD_MAX_NUMBER_FILES` setting.

===========================
Django 3.2.17 release notes
===========================

*February 1, 2023*

Django 3.2.17 fixes a security issue with severity "moderate" in 3.2.16.

CVE-2023-23969: Potential denial-of-service via ``Accept-Language`` headers
===========================================================================

The parsed values of ``Accept-Language`` headers are cached in order to avoid
repetitive parsing. This leads to a potential denial-of-service vector via
excessive memory usage if large header values are sent.

In order to avoid this vulnerability, the ``Accept-Language`` header is now
parsed up to a maximum length.


To generate a diff of this commit:
cvs rdiff -u -r1.30 -r1.31 pkgsrc/www/py-django3/Makefile
cvs rdiff -u -r1.29 -r1.30 pkgsrc/www/py-django3/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


--_----------=_1676368216178540
Content-Disposition: inline
Content-Length: 1576
Content-Transfer-Encoding: binary
Content-Type: text/x-diff; charset=us-ascii

Modified files:

Index: pkgsrc/www/py-django3/Makefile
diff -u pkgsrc/www/py-django3/Makefile:1.30 pkgsrc/www/py-django3/Makefile:1.31
--- pkgsrc/www/py-django3/Makefile:1.30	Fri Nov 18 06:00:20 2022
+++ pkgsrc/www/py-django3/Makefile	Tue Feb 14 09:50:16 2023
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.30 2022/11/18 06:00:20 adam Exp $
+# $NetBSD: Makefile,v 1.31 2023/02/14 09:50:16 wiz Exp $
 
-DISTNAME=	Django-3.2.16
+DISTNAME=	Django-3.2.18
 PKGNAME=	${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=	www python
 MASTER_SITES=	https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/

Index: pkgsrc/www/py-django3/distinfo
diff -u pkgsrc/www/py-django3/distinfo:1.29 pkgsrc/www/py-django3/distinfo:1.30
--- pkgsrc/www/py-django3/distinfo:1.29	Fri Nov 18 06:00:20 2022
+++ pkgsrc/www/py-django3/distinfo	Tue Feb 14 09:50:16 2023
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.29 2022/11/18 06:00:20 adam Exp $
+$NetBSD: distinfo,v 1.30 2023/02/14 09:50:16 wiz Exp $
 
-BLAKE2s (Django-3.2.16.tar.gz) = 32b7e8638cb5f1c1fcd1ab39c12f2172aaf393c368875533a0c8255f0fbf0b81
-SHA512 (Django-3.2.16.tar.gz) = 628263370b4d073d5e88db8607f5b082b03c4e6e6ed6aca059dce18f61725eb4ff69da77f5f98ff7b3e6d9046a701aca5a32687670bf7ea5fdcf92d6d13d7373
-Size (Django-3.2.16.tar.gz) = 9847052 bytes
+BLAKE2s (Django-3.2.18.tar.gz) = 9d8085c04044fdc95ee1149eef9fabcf4e7c27bbeeaa443394f2d892c851106d
+SHA512 (Django-3.2.18.tar.gz) = dbcf8daa4edf3666bfcb366b09e1c3de12a4176770ab2e6cd22b459ff77aa4cdbd72c445f53e7b23a907f663dc37b07c15d5d0d67e63fdec98eb4832dcc57d6d
+Size (Django-3.2.18.tar.gz) = 9848949 bytes


--_----------=_1676368216178540--