From ccf87033b8a0a1b60c8efce0aad9fb483265a382 Mon Sep 17 00:00:00 2001 From: stumpylog <797416+stumpylog@users.noreply.github.com> Date: Mon, 2 Nov 2026 08:38:27 -0800 Subject: [PATCH] chore(deps): bump Django, django-guardian, django-filter, drf-spectacular-sidecar - django 5.2.17 -> 5.2.18 (security release: DoS fixes in language variant lookup and header parameter parsing, plus other security fixes) - django-guardian 3.5.0 -> 3.5.2 (GHSA-5729-mvhf-9gq4: get_objects_for_user could return objects missing required permissions; also fixes global permission handling in get_objects_for_group and get_40x_or_None) - django-filter 26.1 -> 26.2 (LinkWidget label escaping hardening) - drf-spectacular-sidecar 2026.9.1 -> 2026.10.1 --- pyproject.toml | 8 ++++---- uv.lock | 32 ++++++++++++++++---------------- 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 7c39550733..8559a9e180 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -26,22 +26,22 @@ dependencies = [ "dateparser~=1.4", # WARNING: django does not use semver. # Only patch versions are guaranteed to not introduce breaking changes. - "django~=5.2.13", + "django~=5.2.18", "django-allauth[mfa,socialaccount]~=65.20.0", "django-auditlog~=3.4.1", "django-cachalot~=2.9.0", "django-compression-middleware~=0.5.0", "django-cors-headers~=4.9.0", "django-extensions~=4.1", - "django-filter>=25.1,<27", - "django-guardian>=3.3.3,<3.6", + "django-filter>=26.2,<27", + "django-guardian>=3.5.2,<3.6", "django-multiselectfield~=1.0.1", "django-rich~=2.2.0", "django-soft-delete~=1.0.18", "django-treenode>=0.24", "djangorestframework~=3.16", "drf-spectacular~=0.30", - "drf-spectacular-sidecar>=2026.7.1,<2026.10", + "drf-spectacular-sidecar>=2026.10.1,<2026.11", "drf-writable-nested~=0.7.1", "filelock>=3.32,<4.3", "flower>=2.0.1,<2.3", diff --git a/uv.lock b/uv.lock index ca7166b566..4350e17978 100644 --- a/uv.lock +++ b/uv.lock @@ -1001,15 +1001,15 @@ wheels = [ [[package]] name = "django" -version = "5.2.17" +version = "5.2.18" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "asgiref" }, { name = "sqlparse" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/d5/d8/43e9d000519adceb189620b6869ff88031e046df91c2e9da72f8f6918399/django-5.2.17.tar.gz", hash = "sha256:9d4d93be539a18ab80d058eb515900e10951e04c537c5a6b394fc49528d3251f", size = 10889740, upload-time = "2026-08-04T15:04:03.173Z" } +sdist = { url = "https://files.pythonhosted.org/packages/85/fe/79e692b430c7721bf4b812c328bfe687e73e3f28f56611a6a18a97e887cc/django-5.2.18.tar.gz", hash = "sha256:461c5dd06d2ea16bd5ca37d3f46e4def1d6b0fe7588c6f4e2119517bb0af8b2d", size = 10910238, upload-time = "2026-10-06T13:01:09.371Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/df/f8/ce120525ca78f12b07daf65786679c5d0b54a75285a8958d3ae55e39da35/django-5.2.17-py3-none-any.whl", hash = "sha256:f04fb3b36ee119e1af4fa1d397d5fd6cf12700f49321e84d4f4c642c5b1973db", size = 8315563, upload-time = "2026-08-04T15:03:59.1Z" }, + { url = "https://files.pythonhosted.org/packages/d6/01/6568ec52b26548ca1b83d33249f7274db3bf74698f42c0da42ec9db1a24a/django-5.2.18-py3-none-any.whl", hash = "sha256:92ed81d500be6408ecd704d7bd1366c534f30427bffcc63c5fefb129561aec7c", size = 8316071, upload-time = "2026-10-06T13:01:04.413Z" }, ] [[package]] @@ -1102,14 +1102,14 @@ wheels = [ [[package]] name = "django-filter" -version = "26.1" +version = "26.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "django" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/cb/3e/563965173d4cbb5fc308087e7b3d11a115b7b67273d093622480b1e31f78/django_filter-26.1.tar.gz", hash = "sha256:66ea04031b068c77c86e1ac26ced7a3f8f13ce797f5795751707e3deefc58054", size = 144299, upload-time = "2026-07-11T09:27:02.767Z" } +sdist = { url = "https://files.pythonhosted.org/packages/07/ee/c0f950fe24f3e0b69d054ad957f9229632b50bdc78e968f966d8b4efe16a/django_filter-26.2.tar.gz", hash = "sha256:fd5cc83995fbe9f5f07fb5dcda16fde0f04de1ecf8ef82628b6c0ec921b751af", size = 144828, upload-time = "2026-10-03T12:01:01.007Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/1f/01/afffed1e3c4540fb75bf550a18b6176a9f6371b5f3e52b69a28995b6480c/django_filter-26.1-py3-none-any.whl", hash = "sha256:7d98ef2899218e6242619b532cb1b95af14e09dfcf74844aecb550ad27b59ff2", size = 94069, upload-time = "2026-07-11T09:27:01.012Z" }, + { url = "https://files.pythonhosted.org/packages/4a/92/6b098caa5b980a9d13a8db4825b7670410fa572e9195e39648f7700f2a37/django_filter-26.2-py3-none-any.whl", hash = "sha256:df8f737841d6359df00b84dda9b5ab59067fe60292091f1bdae1e3e6281cedb0", size = 94077, upload-time = "2026-10-03T12:00:59.162Z" }, ] [[package]] @@ -1129,15 +1129,15 @@ wheels = [ [[package]] name = "django-guardian" -version = "3.5.0" +version = "3.5.2" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "django" }, { name = "typing-extensions", marker = "python_full_version < '3.13'" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/63/36/0d3eb841f9d6404fc74fdbc3b4d74b9217a0fcede406ab26cc9840506bf5/django_guardian-3.5.0.tar.gz", hash = "sha256:d80b8ab86c28f92adef816996f4341fbea6790aa1f09006c5afc1ef0ea394871", size = 115602, upload-time = "2026-09-12T18:03:27.082Z" } +sdist = { url = "https://files.pythonhosted.org/packages/84/ed/d31c3befa315d8cf52efea39078ab4871b866f03dddfa01f2ab630a8182d/django_guardian-3.5.2.tar.gz", hash = "sha256:ca14b7c9cc37bc852f3749f8a998a76cfd0ebbd66ac85726ef331289a712d389", size = 124548, upload-time = "2026-10-20T10:51:23.355Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/89/c7/57463fa92db5d472d5be9209b255c901f7e64e4631ebf16818cb04ad0ac4/django_guardian-3.5.0-py3-none-any.whl", hash = "sha256:926eb17caf4991d467fd75d412a3040857bc4e111fc70bfe42e1c021826727e4", size = 151912, upload-time = "2026-09-12T18:03:25.045Z" }, + { url = "https://files.pythonhosted.org/packages/1b/5c/be6e4a9391fb0a87770ad210df9fa1e3ac523ef2e70cb906376c28200aad/django_guardian-3.5.2-py3-none-any.whl", hash = "sha256:545ea01d528830d936c129a125dc2f1aba581da4c3f3daa5d4d1e31654e276a8", size = 159192, upload-time = "2026-10-20T10:51:21.771Z" }, ] [[package]] @@ -1270,14 +1270,14 @@ wheels = [ [[package]] name = "drf-spectacular-sidecar" -version = "2026.9.1" +version = "2026.10.1" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "django" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/67/87/ef9f1693499ac2c1bf3c33ce57e72c423aed51ab51f7ebd5d3a38f20c606/drf_spectacular_sidecar-2026.9.1.tar.gz", hash = "sha256:99c2b845d0a52b01a7a8e96736a48ef2099dc3dedea103012dfea41a9e4e9ecc", size = 2605997, upload-time = "2026-09-01T15:27:00.127Z" } +sdist = { url = "https://files.pythonhosted.org/packages/23/7f/e95c51746e66cae4b6ca35912ad2a211dee979647e9fce4f3b5aca780630/drf_spectacular_sidecar-2026.10.1.tar.gz", hash = "sha256:ec8d20b2594e8a10ebf22e5bab62ec313c7cf8793753a050290b209e16e81c9c", size = 2633804, upload-time = "2026-10-01T17:20:35.255Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/19/3b/c4866e6304d09d8813883774dadc5ff70a355279fc2527af3a4004fdb5f0/drf_spectacular_sidecar-2026.9.1-py3-none-any.whl", hash = "sha256:1e521d0ff78c7ab1a873423fc6e6b82ef6bae863f170762e7410ac63b2c7b72f", size = 2628532, upload-time = "2026-09-01T15:26:58.472Z" }, + { url = "https://files.pythonhosted.org/packages/55/09/13509939a12e953759fa2f281b28dc14813c8c331addf3838fccdc71b364/drf_spectacular_sidecar-2026.10.1-py3-none-any.whl", hash = "sha256:fe1d005d8ac9b5d0472f2fe5deeb2e7d6dcffaa24118044f22578b4b8c4b31f2", size = 2656316, upload-time = "2026-10-01T17:20:33.813Z" }, ] [[package]] @@ -3246,22 +3246,22 @@ requires-dist = [ { name = "channels-redis", specifier = "~=4.2" }, { name = "concurrent-log-handler", specifier = "~=0.9.25" }, { name = "dateparser", specifier = "~=1.4" }, - { name = "django", specifier = "~=5.2.13" }, + { name = "django", specifier = "~=5.2.18" }, { name = "django-allauth", extras = ["mfa", "socialaccount"], specifier = "~=65.20.0" }, { name = "django-auditlog", specifier = "~=3.4.1" }, { name = "django-cachalot", specifier = "~=2.9.0" }, { name = "django-compression-middleware", specifier = "~=0.5.0" }, { name = "django-cors-headers", specifier = "~=4.9.0" }, { name = "django-extensions", specifier = "~=4.1" }, - { name = "django-filter", specifier = ">=25.1,<27" }, - { name = "django-guardian", specifier = ">=3.3.3,<3.6" }, + { name = "django-filter", specifier = ">=26.2,<27" }, + { name = "django-guardian", specifier = ">=3.5.2,<3.6" }, { name = "django-multiselectfield", specifier = "~=1.0.1" }, { name = "django-rich", specifier = "~=2.2.0" }, { name = "django-soft-delete", specifier = "~=1.0.18" }, { name = "django-treenode", specifier = ">=0.24" }, { name = "djangorestframework", specifier = "~=3.16" }, { name = "drf-spectacular", specifier = "~=0.30" }, - { name = "drf-spectacular-sidecar", specifier = ">=2026.7.1,<2026.10" }, + { name = "drf-spectacular-sidecar", specifier = ">=2026.10.1,<2026.11" }, { name = "drf-writable-nested", specifier = "~=0.7.1" }, { name = "filelock", specifier = ">=3.32,<4.3" }, { name = "flower", specifier = ">=2.0.1,<2.3" },