django.git, branch 4.2.23

[4.2.x] Bumped version for 4.2.23 release.

2025-06-10T09:51:54Z

[4.2.x] Refs CVE-2025-48432 -- Prevented log injection in remaining response logging.

2025-06-06T12:24:47Z

Migrated remaining response-related logging to use the `log_response()` helper to avoid potential log injection, to ensure untrusted values like request paths are safely escaped. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 957951755259b412d5113333b32bf85871d29814 from main.

[4.2.x] Refs CVE-2025-48432 -- Made SuspiciousOperation logging use log_response() for consistency.

2025-06-06T12:22:03Z

Backport of ff835f439cb1ecd8d74a24de12e3c03e5477dc9d from main.

[4.2.x] Refactored logging_tests to reuse assertions for log records.

2025-06-06T12:21:16Z

Backport of 9d72e7daf7299ef1ece56fd657a02f77a469efe9 from main.

[4.2.x] Added CVE-2025-48432 to security archive.

2025-06-04T13:58:57Z

Backport of 51923c576a596ad00214e44028f9dee9748bce95 from main.

[4.2.x] Post-release version bump.

2025-06-04T11:52:32Z

[4.2.x] Bumped version for 4.2.22 release.

2025-06-04T11:51:01Z

[4.2.x] Fixed CVE-2025-48432 -- Escaped formatting arguments in `log_response()`.

2025-06-04T11:50:05Z

Suitably crafted requests containing a CRLF sequence in the request path may have allowed log injection, potentially corrupting log files, obscuring other attacks, misleading log post-processing tools, or forging log entries. To mitigate this, all positional formatting arguments passed to the logger are now escaped using "unicode_escape" encoding. Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report. Co-authored-by: Carlton Gibson Co-authored-by: Jake Howard Backport of a07ebec5591e233d8bbb38b7d63f35c5479eef0e from main.

[4.2.x] Added stub release notes and release date for 4.2.22.

2025-05-28T13:21:44Z

Backport of 1a744343999c9646912cee76ba0a2fa6ef5e6240 from main.

[4.2.x] Fixed #36402, Refs #35980 -- Updated built package name in reusable apps tutorial for PEP 625.

2025-05-26T15:38:29Z

Backport of 1307b8a1cb05762147736d0f347792b33f645390 from main.