chango.git, branch 5.0.7

[5.0.x] Bumped version for 5.0.7 release.

2024-07-09T13:29:34Z

[5.0.x] Made cosmetic edits to 5.0.7 release notes.

2024-07-09T13:04:57Z

Backport of 1062bf730235ecc90f2087f1c2d346615377a006 from main.

[5.0.x] Fixed CVE-2024-39614 -- Mitigated potential DoS in get_supported_language_variant().

2024-07-09T13:03:38Z

Language codes are now parsed with a maximum length limit of 500 chars. Thanks to MProgrammer for the report.

[5.0.x] Fixed CVE-2024-39330 -- Added extra file name validation in Storage's save method.

2024-07-09T13:03:32Z

Thanks to Josh Schneier for the report, and to Carlton Gibson and Sarah Boyce for the reviews.

[5.0.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when checking unusuable passwords.

2024-07-09T13:03:20Z

Refs #20760. Thanks Michael Manfre for the fix and to Adam Johnson for the review.

[5.0.x] Fixed CVE-2024-38875 -- Mitigated potential DoS in urlize and urlizetrunc template filters.

2024-07-09T13:03:07Z

Thank you to Elias Myllymäki for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>

[5.0.x] Fixed 35506 -- Clarified initial references to URLconf in tutorial 1.

2024-07-09T01:03:50Z

Backport of 2c931fda5b341e0febf68269d2c2447a64875127 from main.

[5.0.x] Refs #35560 -- Corrected CheckConstraint argument name in model_fields tests.

2024-07-08T10:38:04Z

[5.0.x] Removed outdated note about limitations in Clickjacking protection.

2024-07-04T21:13:25Z

There is no need to list old browser versions or point users to workarounds. Backport of f302343380c77e1eb5dab3b64dd70895a95926ca from main.

[5.0.x] Fixed #35560 -- Made Model.full_clean() ignore GeneratedFields for constraints.

2024-07-04T09:49:27Z

Accessing generated field values on unsaved models caused a crash when validating CheckConstraints and UniqueConstraints with expressions. Backport of 1005c2abd1ef0c156f449641e38c33e473989d37 from main.