django.git, branch 4.2.18

[4.2.x] Bumped version for 4.2.18 release.

2025-01-14T12:08:35Z

[4.2.x] Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.

2025-01-14T12:08:01Z

Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz Felisiak for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

[4.2.x] Added stub release notes and release date for 4.2.18.

2025-01-07T15:37:42Z

Backport of 53e21eebf22bc05c7fa30820b453b7f345b7af40 from main.

[4.2.x] Cleaned up CVE-2024-53907 and CVE-2024-53908 security archive descriptions.

2024-12-04T16:03:55Z

Backport of eb665e076ca3417eb0ac654aed9e9c1853c5af84 from main.

[4.2.x] Added CVE-2024-53907 and CVE-2024-53908 to security archive.

2024-12-04T15:33:06Z

Backport of 595cb4a7aeb1ba1770d10d601ce9a2b4e487c46e from main.

[4.2.x] Post-release version bump.

2024-12-04T13:37:13Z

[4.2.x] Bumped version for 4.2.17 release.

2024-12-04T13:34:11Z

[4.2.x] Fixed CVE-2024-53908 -- Prevented SQL injections in direct HasKeyLookup usage on Oracle.

2024-12-04T13:32:17Z

Thanks Seokchan Yoon for the report, and Mariusz Felisiak and Sarah Boyce for the reviews.

[4.2.x] Fixed CVE-2024-53907 -- Mitigated potential DoS in strip_tags().

2024-12-04T13:32:08Z

Thanks to jiangniao for the report, and Shai Berger and Natalia Bidart for the reviews.

[4.2.x] Refs CVE-2024-11168 -- Updated vendored _urlsplit() to properly validate IPv6 and IPvFuture addresses.

2024-12-03T08:50:11Z

Refs Python CVE-2024-11168. Django should not affected, but others who incorrectly use internal function _urlsplit() with unsanitized input could be at risk. https://github.com/python/cpython/pull/103849