chango.git, branch 5.1.11

[5.1.x] Bumped version for 5.1.11 release.

2025-06-10T09:47:54Z

[5.1.x] Refs CVE-2025-48432 -- Prevented log injection in remaining response logging.

2025-06-06T12:09:06Z

Migrated remaining response-related logging to use the `log_response()` helper to avoid potential log injection, to ensure untrusted values like request paths are safely escaped. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 957951755259b412d5113333b32bf85871d29814 from main.

[5.1.x] Refs CVE-2025-48432 -- Made SuspiciousOperation logging use log_response() for consistency.

2025-06-06T12:07:54Z

Backport of ff835f439cb1ecd8d74a24de12e3c03e5477dc9d from main.

[5.1.x] Refactored logging_tests to reuse assertions for log records.

2025-06-06T12:07:48Z

Backport of 9d72e7daf7299ef1ece56fd657a02f77a469efe9 from main.

[5.1.x] Added CVE-2025-48432 to security archive.

2025-06-04T13:58:49Z

Backport of 51923c576a596ad00214e44028f9dee9748bce95 from main.

[5.1.x] Post-release version bump.

2025-06-04T11:49:22Z

[5.1.x] Bumped version for 5.1.10 release.

2025-06-04T11:46:54Z

[5.1.x] Fixed CVE-2025-48432 -- Escaped formatting arguments in `log_response()`.

2025-06-04T11:46:07Z

Suitably crafted requests containing a CRLF sequence in the request path may have allowed log injection, potentially corrupting log files, obscuring other attacks, misleading log post-processing tools, or forging log entries. To mitigate this, all positional formatting arguments passed to the logger are now escaped using "unicode_escape" encoding. Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report. Co-authored-by: Carlton Gibson Co-authored-by: Jake Howard Backport of a07ebec5591e233d8bbb38b7d63f35c5479eef0e from main.

[5.1.x] Added stub release notes and release date for 5.1.10 and 4.2.22.

2025-05-28T13:19:23Z

Backport of 1a744343999c9646912cee76ba0a2fa6ef5e6240 from main.

[5.1.x] Fixed #36402, Refs #35980 -- Updated built package name in reusable apps tutorial for PEP 625.

2025-05-26T15:37:29Z

Backport of 1307b8a1cb05762147736d0f347792b33f645390 from main.