Bumps django from 2.1.10 to 2.1.11. This update includes security fixes.
Vulnerabilities fixed
*Sourced from The GitHub Security Advisory Database.*
> **Moderate severity vulnerability that affects django**
> An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
>
> Affected versions: >= 2.1.0, < 2.1.11
*Sourced from The GitHub Security Advisory Database.*
> **Moderate severity vulnerability that affects django**
> An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
>
> Affected versions: >= 2.1.0, < 2.1.11
*Sourced from The GitHub Security Advisory Database.*
> **Moderate severity vulnerability that affects django**
> An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
>
> Affected versions: >= 2.1.0, < 2.1.11
Commits
- [`ff9dcc0`](https://github.com/django/django/commit/ff9dcc0867eba90e9ab1b07a4b3eb79928717918) [2.1.x] Bumped version for 2.1.11 release.
- [`5d50a2e`](https://github.com/django/django/commit/5d50a2e5fa36ad23ab532fc54cf4073de84b3306) [2.1.x] Fixed CVE-2019-14235 -- Fixed potential memory exhaustion in django.u...
- [`f74b3ae`](https://github.com/django/django/commit/f74b3ae3628c26e1b4f8db3d13a91d52a833a975) [2.1.x] Fixed CVE-2019-14234 -- Protected JSONField/HStoreField key and index...
- [`5ff8e79`](https://github.com/django/django/commit/5ff8e791148bd451180124d76a55cb2b2b9556eb) [2.1.X] Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in s...
- [`c23723a`](https://github.com/django/django/commit/c23723a1551340cc7d3126f04fcfd178fa224193) [2.1.X] Fixed CVE-2019-14232 -- Adjusted regex to avoid backtracking issues w...
- [`24eba90`](https://github.com/django/django/commit/24eba901eb9795ee87eddd5447ede62053fe59d4) [2.1.x] Added stub release notes for security releases.
- [`765dac3`](https://github.com/django/django/commit/765dac3d76c5632258176b77a5687c83d464d52d) [2.1.x] Added CVE-2019-12781 to the security release archive.
- [`fafde97`](https://github.com/django/django/commit/fafde97fd70b0ac135eed570f07c3a15f1728391) [2.1.x] Post-release version bump.
- See full diff in [compare view](https://github.com/django/django/compare/2.1.10...2.1.11)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it). To ignore the version in this PR you can just close it
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
Finally, you can contact us by mentioning @dependabot.
Bumps django from 2.1.10 to 2.1.11. This update includes security fixes.
Vulnerabilities fixed
*Sourced from The GitHub Security Advisory Database.* > **Moderate severity vulnerability that affects django** > An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. > > Affected versions: >= 2.1.0, < 2.1.11 *Sourced from The GitHub Security Advisory Database.* > **Moderate severity vulnerability that affects django** > An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences. > > Affected versions: >= 2.1.0, < 2.1.11 *Sourced from The GitHub Security Advisory Database.* > **Moderate severity vulnerability that affects django** > An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. > > Affected versions: >= 2.1.0, < 2.1.11Commits
- [`ff9dcc0`](https://github.com/django/django/commit/ff9dcc0867eba90e9ab1b07a4b3eb79928717918) [2.1.x] Bumped version for 2.1.11 release. - [`5d50a2e`](https://github.com/django/django/commit/5d50a2e5fa36ad23ab532fc54cf4073de84b3306) [2.1.x] Fixed CVE-2019-14235 -- Fixed potential memory exhaustion in django.u... - [`f74b3ae`](https://github.com/django/django/commit/f74b3ae3628c26e1b4f8db3d13a91d52a833a975) [2.1.x] Fixed CVE-2019-14234 -- Protected JSONField/HStoreField key and index... - [`5ff8e79`](https://github.com/django/django/commit/5ff8e791148bd451180124d76a55cb2b2b9556eb) [2.1.X] Fixed CVE-2019-14233 -- Prevented excessive HTMLParser recursion in s... - [`c23723a`](https://github.com/django/django/commit/c23723a1551340cc7d3126f04fcfd178fa224193) [2.1.X] Fixed CVE-2019-14232 -- Adjusted regex to avoid backtracking issues w... - [`24eba90`](https://github.com/django/django/commit/24eba901eb9795ee87eddd5447ede62053fe59d4) [2.1.x] Added stub release notes for security releases. - [`765dac3`](https://github.com/django/django/commit/765dac3d76c5632258176b77a5687c83d464d52d) [2.1.x] Added CVE-2019-12781 to the security release archive. - [`fafde97`](https://github.com/django/django/commit/fafde97fd70b0ac135eed570f07c3a15f1728391) [2.1.x] Post-release version bump. - See full diff in [compare view](https://github.com/django/django/compare/2.1.10...2.1.11)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it). To ignore the version in this PR you can just close it - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) Finally, you can contact us by mentioning @dependabot.