google-api-php-client-services

google-api-php-client-services copied to clipboard

Reame
Issues

Update dependency django to v4 [SECURITY]

Open renovate-bot opened this issue 1 year ago • 1 comments

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
django (changelog)	`==2.2.28` -> `==4.2.16`

GitHub Vulnerability Alerts

CVE-2022-36359

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.

CVE-2024-45231

An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by sending password reset requests and observing the outcome (only when e-mail sending is consistently failing).

Release Notes

django/django (django)

`v4.2.16`

`v4.2.15`

`v4.2.14`

`v4.2.13`

`v4.2.12`

`v4.2.11`

`v4.2.10`

`v4.2.9`

`v4.2.8`

`v4.2.7`

`v4.2.6`

`v4.2.5`

`v4.2.4`

`v4.2.3`

`v4.2.2`

`v4.2.1`

`v4.2`

`v4.1.13`

`v4.1.12`

`v4.1.11`

`v4.1.10`

`v4.1.9`

`v4.1.8`

`v4.1.7`

`v4.1.6`

`v4.1.5`

`v4.1.4`

`v4.1.3`

`v4.1.2`

`v4.1.1`

`v4.1`

`v4.0.10`

`v4.0.9`

`v4.0.8`

`v4.0.7`

`v4.0.6`

`v4.0.5`

`v4.0.4`

`v4.0.3`

`v4.0.2`

`v4.0.1`

`v4.0`

`v3.2.25`

`v3.2.24`

`v3.2.23`

`v3.2.22`

`v3.2.21`

`v3.2.20`

`v3.2.19`

`v3.2.18`

`v3.2.17`

`v3.2.16`

`v3.2.15`

`v3.2.14`

`v3.2.13`

`v3.2.12`

`v3.2.11`

`v3.2.10`

`v3.2.9`

`v3.2.8`

`v3.2.7`

`v3.2.6`

`v3.2.5`

`v3.2.4`

`v3.2.3`

`v3.2.2`

`v3.2.1`

`v3.2`

`v3.1.14`

`v3.1.13`

`v3.1.12`

`v3.1.11`

`v3.1.10`

`v3.1.9`

`v3.1.8`

`v3.1.7`

`v3.1.6`

`v3.1.5`

`v3.1.4`

`v3.1.3`

`v3.1.2`

`v3.1.1`

`v3.1`

`v3.0.14`

`v3.0.13`

`v3.0.12`

`v3.0.11`

`v3.0.10`

`v3.0.9`

`v3.0.8`

`v3.0.7`

`v3.0.6`

`v3.0.5`

`v3.0.4`

`v3.0.3`

`v3.0.2`

`v3.0.1`

`v3.0`

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Aug 27 '24 18:08 renovate-bot

🤖 I detect that the PR title and the commit message differ and there's only one commit. To use the PR title for the commit history, you can use Github's automerge feature with squashing, or use automerge label. Good luck human!

-- conventional-commit-lint bot https://conventionalcommits.org/

Aug 30 '24 01:08 conventional-commit-lint-gcf[bot]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 4.x releases. But if you manually upgrade to 4.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

Sep 12 '25 07:09 forking-renovate[bot]