chango.git, branch 5.1.14

[5.1.x] Bumped version for 5.1.14 release.

2025-11-05T12:46:34Z

[5.1.x] Refs CVE-2025-64459 -- Avoided propagating invalid arguments to Q on dictionary expansion.

2025-11-05T12:44:35Z

Backport of 3c3f46357718166069948625354b8315a8505262 from main.

[5.1.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via the _connector kwarg.

2025-11-05T12:44:22Z

Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.

[5.1.x] Fixed CVE-2025-64458 -- Mitigated potential DoS in HttpResponseRedirect/HttpResponsePermanentRedirect on Windows.

2025-11-05T12:43:51Z

Thanks Seokchan Yoon for the report, Markus Holtermann for the triage, and Jake Howard for the review. Follow-up to CVE-2025-27556 and 39e2297210d9d2938c75fc911d45f0e863dc4821. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.

[5.1.x] Added stub release notes and release date for 5.1.14 and 4.2.26.

2025-10-29T18:01:46Z

Backport of ab108bf94dfc06c311d7dc81866b848fe5b5ee6c from main.

[5.1.x] Made RemoteTestResultTest.test_pickle_errors_detection() compatible with tblib 3.2+.

2025-10-22T18:21:29Z

tblib 3.2+ makes exception subclasses with __init__() and the default __reduce__() picklable. This broke the test for RemoteTestResult._confirm_picklable(), which expects a specific exception to fail unpickling. https://github.com/ionelmc/python-tblib/blob/master/CHANGELOG.rst#320-2025-10-21 This fix defines ExceptionThatFailsUnpickling.__reduce__() in a way that pickle.dumps(obj) succeeds, but pickle.loads(pickle.dumps(obj)) raises TypeError. Refs #27301. This preserves the intent of the regression test from 52188a5ca6bafea0a66f17baacb315d61c7b99cd without skipping it. Backport of 548209e620b3ca34396a360453f07c8dbb8aa6c7 from main.

[5.1.x] Fixed RelatedGeoModelTest.test_related_union_aggregate() test on Oracle and GEOS 3.12+.

2025-10-20T14:06:52Z

Backport of 344ae16e1e21ab7c0b594d755519738f7f16eaf1 from main

[5.1.x] Refs #36646 -- Doc'd that oracledb < 3.3.0 is required.

2025-10-10T21:08:19Z

[5.1.x] Fixed OGRInspectTest.test_time_field with memory Spatialite database.

2025-10-10T14:05:35Z

Backport of 82b3b84a78055844ee07d5d97843a4fc72872e28 from main

[5.1.x] Fixed #35961 -- Migrated license metadata in pyproject.toml to conform PEP 639.

2025-10-08T19:44:11Z

See https://peps.python.org/pep-0639/ and https://packaging.python.org/en/latest/guides/writing-pyproject-toml/#license-and-license-files. Co-authored-by: Jacob Walls Backport of 96a7a652166bece8acc96d6335ebb8091de2f496 from main.