From c760b163e2e45ef51509fafe61f6f1a0715fcd23 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Wirtel?= Date: Thu, 24 Sep 2026 07:51:42 +0200 Subject: [PATCH] fix(deps): upgrade django to 6.0.8 for security fixes Resolves medium severity Dependabot alerts: the cache middleware potentially exposing private responses when unrelated request cookies are present, GDALRaster over-reading heap memory when constructed from bytes, and DomainNameValidator permitting newline characters that could enable HTTP header injection. Pinned to the 6.0.x branch (django<6.1) to keep this a security-only patch rather than a minor version upgrade. GHSA-3h9f-r86x-qvjx, GHSA-crhf-3pfg-w68w, GHSA-8qcx-xf44-272x Co-Authored-By: Claude Sonnet 5 --- requirements/dev.txt | 2 +- requirements/main.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/dev.txt b/requirements/dev.txt index 7cf9a6c..a12b7c7 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -33,7 +33,7 @@ defusedxml==0.7.1 # -c requirements/main.txt # py-serializable # willow -django==6.0.6 +django==6.0.8 # via # -c requirements/main.txt # django-debug-toolbar diff --git a/requirements/main.txt b/requirements/main.txt index 30b053d..733dc6c 100644 --- a/requirements/main.txt +++ b/requirements/main.txt @@ -32,7 +32,7 @@ dj-database-url==3.1.2 # via -r requirements/main.in dj-static==0.0.6 # via -r requirements/main.in -django==6.0.6 +django==6.0.8 # via # -r requirements/main.in # dj-database-url