chango.git, branch 5.0.8 django http://cgit.adnoto.dev/chango.git/atom?h=5.0.8 2024-08-06T13:19:37Z [5.0.x] Bumped version for 5.0.8 release. 2024-08-06T13:19:37Z Sarah Boyce 42296566+sarahboyce@users.noreply.github.com 2024-08-06T13:19:37Z urn:sha1:84d1102a8a3bba64bcc1b14a7117c26a83fb7fe5 [5.0.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection attacks against JSON fields. 2024-08-06T06:51:55Z Simon Charette charette.s@gmail.com 2024-07-25T16:19:13Z urn:sha1:32ebcbf2e1fe3e5ba79a6554a167efce81f7422d Thanks Eyal (eyalgabay) for the report. [5.0.x] Fixed CVE-2024-41991 -- Prevented potential ReDoS in django.utils.html.urlize() and AdminURLFieldWidget. 2024-08-06T06:51:55Z Mariusz Felisiak felisiak.mariusz@gmail.com 2024-07-10T18:30:12Z urn:sha1:523da8771bce321023f490f70d71a9e973ddc927 Thanks Seokchan Yoon for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> [5.0.x] Fixed CVE-2024-41990 -- Mitigated potential DoS in urlize and urlizetrunc template filters. 2024-08-06T06:51:55Z Sarah Boyce 42296566+sarahboyce@users.noreply.github.com 2024-07-18T11:19:34Z urn:sha1:7b7b909579c8311c140c89b8a9431bf537febf93 Thanks to MProgrammer for the report. [5.0.x] Fixed CVE-2024-41989 -- Prevented excessive memory consumption in floatformat. 2024-08-06T06:51:55Z Sarah Boyce 42296566+sarahboyce@users.noreply.github.com 2024-07-12T09:38:34Z urn:sha1:27900fe56f3d3cabb4aeb6ccb82f92bab29073a8 Thanks Elias Myllymäki for the report. Co-authored-by: Shai Berger <shai@platonix.com> [5.0.x] Fixed #35657 -- Made FileField handle db_default values. 2024-08-05T19:38:20Z Sarah Boyce 42296566+sarahboyce@users.noreply.github.com 2024-08-05T19:36:49Z urn:sha1:d7f955462cb17e74c2a1701ea7f722f2ed2bc168 Backport of 8deb6bb1fc427762d56646bf7306cbd11fb5bb68 from main. [5.0.x] Fixed #35638 -- Updated validate_constraints to consider db_default. 2024-08-05T15:42:19Z David Sanders shang.xiao.sanders@gmail.com 2024-08-05T06:22:29Z urn:sha1:333cfab512689490ea8a6a95598a94d77816fa2d Backport of 509763c79952cde02d9f5b584af4278bdbed77b2 from main. [5.0.x] Refs #35638 -- Avoided wrapping expressions with Value in _get_field_value_map() and renamed to _get_field_expression_map(). 2024-08-05T15:42:19Z David Sanders shang.xiao.sanders@gmail.com 2024-08-05T06:20:48Z urn:sha1:e88ef6a27d125da95e530be20b879fb4f540f7f6 Backport of 91a038754bb516d29cb79f0fed4025436b5c5346 from main. [5.0.x] Fixed #35628 -- Allowed compatible GeneratedFields for ModelAdmin.date_hierarchy. 2024-08-05T13:30:40Z John Parton john.parton.iv@gmail.com 2024-07-24T18:53:06Z urn:sha1:c822ad638a746c4f2bcc2629586aca1cb03cb513 Backport of 7f8d839722b72aeb3ec5a4278ae57c18283acacd from main. [5.0.x] Added stub release notes and release date for 5.0.8 and 4.2.15. 2024-07-31T09:26:43Z Sarah Boyce 42296566+sarahboyce@users.noreply.github.com 2024-07-31T09:21:32Z urn:sha1:3aa9acd856beb67f6afae01768be473b91ea8b95 Backport of 3f880890699d4412cf23b59dba425111f62afb3a from main.