Bumps django from 2.0.4 to 2.0.12. This update includes security fixes.
Vulnerabilities fixed
*Sourced from The GitHub Security Advisory Database.*
> **Moderate severity vulnerability that affects django**
> django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
>
> Affected versions: >= 2.0, < 2.0.8
*Sourced from The GitHub Security Advisory Database.*
> **Low severity vulnerability that affects django**
> In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
>
> Affected versions: >= 2.0.0, < 2.0.10
*Sourced from The GitHub Security Advisory Database.*
> **Memory exhaustion in django.utils.numberformat.format()**
> If django.utils.numberformat.format() -- used by contrib.admin as well as the the floatformat, filesizeformat, and intcomma templates filters -- received a Decimal with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format().
>
> Affected versions: >= 1.11.0, < 1.11.19; >= 2.0.0, < 2.0.11; >= 2.1.0, < 2.1.6
*Sourced from The GitHub Security Advisory Database.*
> **Moderate severity vulnerability that affects django**
> Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.
>
> Affected versions: >= 2.0.0, < 2.0.11
Commits
- [`6d0a300`](https://github.com/django/django/commit/6d0a3002ed727fc1ce54d58226eb0dddbb2f4e31) [2.0.x] Bumped version for 2.0.12 release.
- [`11485a3`](https://github.com/django/django/commit/11485a349b20cc8775cc17c51f3b1a05c5fc5c3d) [2.0.x] Refs [#30175](https://github-redirect.dependabot.com/django/django/issues/30175) -- Added release notes for 2.0.12, and 1.11.20 releases.
- [`be439e5`](https://github.com/django/django/commit/be439e58768cd827ca8ac8ff9263c4aae0f75907) [2.0.x] Bumped version for 2.0.11 release.
- [`1f42f82`](https://github.com/django/django/commit/1f42f82566c9d2d73aff1c42790d6b1b243f7676) [2.0.x] Fixed CVE-2019-6975 -- Fixed memory exhaustion in utils.numberformat....
- [`f6f0f52`](https://github.com/django/django/commit/f6f0f524c3c96830fdaf1b49ed4ca12d54d37c89) [2.0.x] Removed extra characters in docs header underlines.
- [`cfadb0e`](https://github.com/django/django/commit/cfadb0e13c3509354f7b8dd432be2f93f3bb3f87) [2.0.x] Added stub release notes for security releases.
- [`071238f`](https://github.com/django/django/commit/071238f79d353476dcd83469e60eeaad8782e1c8) [2.0.x] Fixed duplicate word in docs/releases/2.0.txt.
- [`c89ab95`](https://github.com/django/django/commit/c89ab95a3684c48dd377602686b85631f3f2be3c) [2.0.x] Used extlinks for GitHub commits.
- [`ab5fc25`](https://github.com/django/django/commit/ab5fc25635faad0ed7232e0a936efd8177138205) [2.0.x] Replaced CVE/ticket roles with extlinks.
- [`9518450`](https://github.com/django/django/commit/95184509733a2994cc2738c2788ed3e2539f5a42) [2.0.x] Fixed E117 and F405 flake8 warnings.
- Additional commits viewable in [compare view](https://github.com/django/django/compare/2.0.4...2.0.12)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
Finally, you can contact us by mentioning @dependabot.
Bumps django from 2.0.4 to 2.0.12. This update includes security fixes.
Vulnerabilities fixed
*Sourced from The GitHub Security Advisory Database.* > **Moderate severity vulnerability that affects django** > django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. > > Affected versions: >= 2.0, < 2.0.8 *Sourced from The GitHub Security Advisory Database.* > **Low severity vulnerability that affects django** > In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. > > Affected versions: >= 2.0.0, < 2.0.10 *Sourced from The GitHub Security Advisory Database.* > **Memory exhaustion in django.utils.numberformat.format()** > If django.utils.numberformat.format() -- used by contrib.admin as well as the the floatformat, filesizeformat, and intcomma templates filters -- received a Decimal with a large number of digits or a large exponent, it could lead to significant memory usage due to a call to '{:f}'.format(). > > Affected versions: >= 1.11.0, < 1.11.19; >= 2.0.0, < 2.0.11; >= 2.1.0, < 2.1.6 *Sourced from The GitHub Security Advisory Database.* > **Moderate severity vulnerability that affects django** > Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function. > > Affected versions: >= 2.0.0, < 2.0.11Commits
- [`6d0a300`](https://github.com/django/django/commit/6d0a3002ed727fc1ce54d58226eb0dddbb2f4e31) [2.0.x] Bumped version for 2.0.12 release. - [`11485a3`](https://github.com/django/django/commit/11485a349b20cc8775cc17c51f3b1a05c5fc5c3d) [2.0.x] Refs [#30175](https://github-redirect.dependabot.com/django/django/issues/30175) -- Added release notes for 2.0.12, and 1.11.20 releases. - [`be439e5`](https://github.com/django/django/commit/be439e58768cd827ca8ac8ff9263c4aae0f75907) [2.0.x] Bumped version for 2.0.11 release. - [`1f42f82`](https://github.com/django/django/commit/1f42f82566c9d2d73aff1c42790d6b1b243f7676) [2.0.x] Fixed CVE-2019-6975 -- Fixed memory exhaustion in utils.numberformat.... - [`f6f0f52`](https://github.com/django/django/commit/f6f0f524c3c96830fdaf1b49ed4ca12d54d37c89) [2.0.x] Removed extra characters in docs header underlines. - [`cfadb0e`](https://github.com/django/django/commit/cfadb0e13c3509354f7b8dd432be2f93f3bb3f87) [2.0.x] Added stub release notes for security releases. - [`071238f`](https://github.com/django/django/commit/071238f79d353476dcd83469e60eeaad8782e1c8) [2.0.x] Fixed duplicate word in docs/releases/2.0.txt. - [`c89ab95`](https://github.com/django/django/commit/c89ab95a3684c48dd377602686b85631f3f2be3c) [2.0.x] Used extlinks for GitHub commits. - [`ab5fc25`](https://github.com/django/django/commit/ab5fc25635faad0ed7232e0a936efd8177138205) [2.0.x] Replaced CVE/ticket roles with extlinks. - [`9518450`](https://github.com/django/django/commit/95184509733a2994cc2738c2788ed3e2539f5a42) [2.0.x] Fixed E117 and F405 flake8 warnings. - Additional commits viewable in [compare view](https://github.com/django/django/compare/2.0.4...2.0.12)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) Finally, you can contact us by mentioning @dependabot.