Safety CI > cookiecutter/cookiecutter-django

master

1 year, 1 month ago

be4ad111

Update django from 5.1.8 to 5.1.9 (#5828)

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

dependabot/docker/{{cookiecutter.project_slug}}/compose/production/aws/amazon/aws-cli-2.27.11

1 year, 1 month ago

155bae8e

Bump amazon/aws-cli Bumps amazon/aws-cli from 2.25.0 to 2.27.11. --- updated-dependencies: - depen

django 5.1.8 and django-stubs 5.1.3 have known security vulnerabilities.

Package	Installed	Affected	Info
django	5.1.8	<4.2.21 , >=5.2a1,<5.2.1 , >=5.1.0a1,<5.1.9	show An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().
django	5.1.8	>=4.2,<4.2.25 , >=5.1,<5.1.13 , >=5.2,<5.2.7	show Affected versions of the Django package are vulnerable to Path Traversal due to improper validation of archive member paths during extraction. The django.utils.archive.extract() function—used by the startapp --template and startproject --template commands—checked path prefixes instead of using canonicalised paths, allowing archive entries whose names share a prefix with the destination to resolve outside the intended directory.
django	5.1.8	<4.2.27 , >=5.1,<5.1.15 , >=5.2,<5.2.9	show Django fixes a potential denial-of-service vulnerability in XML ``Deserializer``.
django	5.1.8	>=4.2,<4.2.25 , >=5.1,<5.1.13 , >=5.2,<5.2.7	show Affected versions of the Django package are vulnerable to SQL Injection due to insufficient neutralization of user-controlled column alias names provided via dictionary expansion. The QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() methods accept **kwargs whose keys are used as column aliases, and on MySQL and MariaDB, those identifiers are not safely quoted, permitting crafted input to be incorporated into the generated SQL.
django	5.1.8	<4.2.24 , >=5.0a1,<5.1.12 , >=5.2a1,<5.2.6	show Affected versions of the Django package are vulnerable to SQL Injection due to insufficient input sanitization in FilteredRelation column aliases. The FilteredRelation class fails to properly validate or escape column alias names when they are provided through dictionary expansion as keyword arguments to QuerySet.annotate() or QuerySet.alias() methods, allowing malicious SQL code to be injected directly into the generated database queries.
django	5.1.8	<4.2.26 , >=5.1a1,<5.1.14 , >=5.2a1,<5.2.8	show CVE-2025-64458: Affected versions of the Django package are vulnerable to Denial of Service (DoS) due to slow Unicode NFKC normalization on Windows being applied to untrusted inputs. The django.contrib.auth.views.LoginView and django.contrib.auth.views.LogoutView, and django.views.i18n.set_language normalize user-controlled strings using Python’s NFKC algorithm, which is unusually slow on Windows for huge Unicode sequences and can be triggered to consume excessive CPU.
django	5.1.8	>=5.2,<5.2.2 , >=5.0a1,<5.1.10 , <4.2.22	show An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
django	5.1.8	<4.2.26 , >=5.1a1,<5.1.14 , >=5.2a1,<5.2.8	show CVE-2025-64459: Affected versions of the Django package are vulnerable to SQL Injection due to improper input validation, allowing the internal _connector keyword argument to be accepted from untrusted dictionaries via expansion. The .filter(), .exclude(), and .get() methods on QuerySet, as well as the Q class, resolve **kwargs and will treat a supplied _connector value as the logical connector without constraining it to the expected set (AND/OR), permitting attacker-controlled tokens to influence SQL predicate construction.
django	5.1.8	<4.2.27 , >=5.1,<5.1.15 , >=5.2,<5.2.9	show Django fixes potential SQL injection in ``FilteredRelation`` column aliases on PostgreSQL.
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

pyup-update-django-allauth-65.7.0-to-65.8.0

1 year, 1 month ago

40a6640e

Update django-allauth from 65.7.0 to 65.8.0

django 5.1.8 and django-stubs 5.1.3 have known security vulnerabilities.

Package	Installed	Affected	Info
django	5.1.8	<4.2.21 , >=5.2a1,<5.2.1 , >=5.1.0a1,<5.1.9	show An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().
django	5.1.8	>=4.2,<4.2.25 , >=5.1,<5.1.13 , >=5.2,<5.2.7	show Affected versions of the Django package are vulnerable to Path Traversal due to improper validation of archive member paths during extraction. The django.utils.archive.extract() function—used by the startapp --template and startproject --template commands—checked path prefixes instead of using canonicalised paths, allowing archive entries whose names share a prefix with the destination to resolve outside the intended directory.
django	5.1.8	<4.2.27 , >=5.1,<5.1.15 , >=5.2,<5.2.9	show Django fixes a potential denial-of-service vulnerability in XML ``Deserializer``.
django	5.1.8	>=4.2,<4.2.25 , >=5.1,<5.1.13 , >=5.2,<5.2.7	show Affected versions of the Django package are vulnerable to SQL Injection due to insufficient neutralization of user-controlled column alias names provided via dictionary expansion. The QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() methods accept **kwargs whose keys are used as column aliases, and on MySQL and MariaDB, those identifiers are not safely quoted, permitting crafted input to be incorporated into the generated SQL.
django	5.1.8	<4.2.24 , >=5.0a1,<5.1.12 , >=5.2a1,<5.2.6	show Affected versions of the Django package are vulnerable to SQL Injection due to insufficient input sanitization in FilteredRelation column aliases. The FilteredRelation class fails to properly validate or escape column alias names when they are provided through dictionary expansion as keyword arguments to QuerySet.annotate() or QuerySet.alias() methods, allowing malicious SQL code to be injected directly into the generated database queries.
django	5.1.8	<4.2.26 , >=5.1a1,<5.1.14 , >=5.2a1,<5.2.8	show CVE-2025-64458: Affected versions of the Django package are vulnerable to Denial of Service (DoS) due to slow Unicode NFKC normalization on Windows being applied to untrusted inputs. The django.contrib.auth.views.LoginView and django.contrib.auth.views.LogoutView, and django.views.i18n.set_language normalize user-controlled strings using Python’s NFKC algorithm, which is unusually slow on Windows for huge Unicode sequences and can be triggered to consume excessive CPU.
django	5.1.8	>=5.2,<5.2.2 , >=5.0a1,<5.1.10 , <4.2.22	show An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
django	5.1.8	<4.2.26 , >=5.1a1,<5.1.14 , >=5.2a1,<5.2.8	show CVE-2025-64459: Affected versions of the Django package are vulnerable to SQL Injection due to improper input validation, allowing the internal _connector keyword argument to be accepted from untrusted dictionaries via expansion. The .filter(), .exclude(), and .get() methods on QuerySet, as well as the Q class, resolve **kwargs and will treat a supplied _connector value as the logical connector without constraining it to the expected set (AND/OR), permitting attacker-controlled tokens to influence SQL predicate construction.
django	5.1.8	<4.2.27 , >=5.1,<5.1.15 , >=5.2,<5.2.9	show Django fixes potential SQL injection in ``FilteredRelation`` column aliases on PostgreSQL.
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

dependabot/docker/{{cookiecutter.project_slug}}/compose/production/aws/amazon/aws-cli-2.27.10

1 year, 1 month ago

02be91a8

Bump amazon/aws-cli Bumps amazon/aws-cli from 2.25.0 to 2.27.10. --- updated-dependencies: - depen

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

pyup-update-django-5.1.8-to-5.1.9

1 year, 1 month ago

30dc9156

Update django from 5.1.8 to 5.1.9

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

dependabot/docker/{{cookiecutter.project_slug}}/compose/production/aws/amazon/aws-cli-2.27.9

1 year, 1 month ago

5348f74f

Bump amazon/aws-cli Bumps amazon/aws-cli from 2.25.0 to 2.27.9. --- updated-dependencies: - depend

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

dependabot/docker/{{cookiecutter.project_slug}}/compose/local/node/node-24.0-bookworm-slim

1 year, 1 month ago

a20b930c

Bump node in /{{cookiecutter.project_slug}}/compose/local/node Bumps node from 22.14-bookworm-slim

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

dependabot/docker/{{cookiecutter.project_slug}}/compose/production/aws/amazon/aws-cli-2.27.8

1 year, 1 month ago

347cb4f5

Bump amazon/aws-cli Bumps amazon/aws-cli from 2.25.0 to 2.27.8. --- updated-dependencies: - depend

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

dependabot/docker/{{cookiecutter.project_slug}}/compose/production/traefik/traefik-3.4.0

1 year, 1 month ago

fc0e4cf8

Bump traefik Bumps traefik from 3.3.5 to 3.4.0. --- updated-dependencies: - dependency-name: traef

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

dependabot/docker/{{cookiecutter.project_slug}}/compose/production/aws/amazon/aws-cli-2.27.7

1 year, 1 month ago

3c6ce91a

Bump amazon/aws-cli Bumps amazon/aws-cli from 2.25.0 to 2.27.7. --- updated-dependencies: - depend

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

master

1 year, 1 month ago

c534821b

Release 2025.05.02

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

master

1 year, 1 month ago

38373810

Update ruff to 0.11.8 (#5819) * Update ruff from 0.11.7 to 0.11.8 * Align versions --------- Co-

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

dependabot/docker/{{cookiecutter.project_slug}}/compose/production/aws/amazon/aws-cli-2.27.6

1 year, 1 month ago

5265c564

Bump amazon/aws-cli Bumps amazon/aws-cli from 2.25.0 to 2.27.6. --- updated-dependencies: - depend

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

update/pre-commit-autoupdate

1 year, 1 month ago

7db55e03

Auto-update pre-commit hooks

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

pyup-update-ruff-0.11.7-to-0.11.8

1 year, 1 month ago

a76407a7

Align versions

django-stubs 5.1.3 has known security vulnerabilities.

Package	Installed	Affected	Info
django-stubs	5.1.3	<5.2.0	show Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.

Package

Installed

Affected

Info

django-stubs

5.1.3

<5.2.0

show

Affected versions of django-stubs are potentially vulnerable to Security Misconfiguration. The inclusion of type stubs for deprecated and insecure password hashers (MD5PasswordHasher, SHA1PasswordHasher, and CryptPasswordHasher) may inadvertently encourage their use in Django applications. This can lead to the storage of user passwords using weak hashing algorithms, making them susceptible to brute-force attacks.