Update dependency Django to v5 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
Django (changelog)	==4.2.30 → ==5.2.16

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling

BIT-django-2026-8404 / CVE-2026-8404 / GHSA-8cjm-8mp7-r2xf / PYSEC-2026-201

More information

Details

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
django.middleware.cache.UpdateCacheMiddleware in Django does not match Cache-Control response directives case-insensitively, which allows remote attackers to read responses that were incorrectly cached because their Cache-Control directives used uppercase or mixed-case values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Ahmed Badawe for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-8404
• https://github.com/django/django/commit/366d9ae6e8d1469c04e9ebdc1bcd098fc14a3b1e
• https://github.com/django/django/commit/b4330259ffbe1a031ed14daab1f35697460f10f2
• https://github.com/django/django/commit/d618d7ae4fec727d5b582bd24f803c28d17bf7cd
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-201.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Django: has_vary_header may expose cached responses when Vary values contain whitespace

BIT-django-2026-48587 / CVE-2026-48587 / GHSA-923m-gv2p-w5qp / PYSEC-2026-198

More information

Details

An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6.
django.utils.cache.has_vary_header() in Django does not strip leading or trailing whitespace from Vary response header values before comparison, which allows remote attackers to read cached responses via requests to URLs whose responses contain whitespace-padded Vary header values.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Navid Rezazadeh for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-48587
• https://github.com/django/django/commit/1721035a72624aad7b38dd19b14013efd94b24b8
• https://github.com/django/django/commit/42aa0b3364d312e7c6472258d8b0e9c0277fbf22
• https://github.com/django/django/commit/9b62b0af71a14c657d19d95371630ba839e83d9a
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-198.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Django: signed cookies are vulnerable to salt namespace collisions

BIT-django-2026-6873 / CVE-2026-6873 / GHSA-h7pc-vwp9-298g / PYSEC-2026-199

More information

Details

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
django.http.HttpRequest.get_signed_cookie in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct (name, salt) pairs that produce the same concatenation.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Peng Zhou for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-6873
• https://github.com/django/django/commit/594360cbf58be7f56eb6da96d58644297c99ef85
• https://github.com/django/django/commit/70d36515b9cc71700105a14b275583070d48b689
• https://github.com/django/django/commit/c807d9c398022d23cb27518fa6ecaf343efb30cf
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-199.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Django: cache middleware may expose private responses when unrelated request cookies are present

BIT-django-2026-48588 / CVE-2026-48588 / GHSA-3h9f-r86x-qvjx / PYSEC-2026-2090

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
UpdateCacheMiddleware and the cache_page() decorator cache responses that vary on cookies when the incoming request carries unrelated cookies, which allows remote attackers to read private data from the shared cache.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Chris Whyland for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-48588
• https://github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3
• https://github.com/django/django/commit/6e365f8d01f2ba0bbd90968d76a42600fb8bc4b1
• https://github.com/django/django/commit/721685aa7799cc9327bd202cd1f70bd012ca95a7
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2090.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Django: DomainNameValidator permits newline characters that may enable HTTP header injection

BIT-django-2026-53878 / CVE-2026-53878 / GHSA-8qcx-xf44-272x / PYSEC-2026-2092

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
DomainNameValidator does not prohibit newlines in domain names (unless used via a form field, since CharField strips newlines). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-53878
• https://github.com/django/django/commit/3a720d0d8bf2529253b98968f10ca73daf6d693c
• https://github.com/django/django/commit/a5de13f1491f1dbf2bb0ad9b91570524ebbc8acd
• https://github.com/django/django/commit/d5d60ed0323cddaa0ce0237a26a3d49ac21ee05e
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2092.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Django: GDALRaster may over-read heap memory when constructed from bytes

BIT-django-2026-53877 / CVE-2026-53877 / GHSA-crhf-3pfg-w68w / PYSEC-2026-2091

More information

Details

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16.
django.contrib.gis.gdal.GDALRaster over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the vsi_buffer property is accessed.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Bence Nagy for reporting this issue.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-53877
• https://github.com/django/django/commit/38dfbd27d7d4f4e6eaa087d7a90f2613fbf55b3a
• https://github.com/django/django/commit/6c66eb8cec52b303af85c2c6e4dd00aa37654dbc
• https://github.com/django/django/commit/6ca2bbe2efce21010eff48f1f36a3f621d698ed8
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-2091.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jul/07/security-releases

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

django/django (Django)

v5.2.16

Compare Source

v5.2.15

Compare Source

v5.2.14

Compare Source

v5.2.13

Compare Source

v5.2.12

Compare Source

v5.2.11

Compare Source

v5.2.10

Compare Source

v5.2.9

Compare Source

v5.2.8

Compare Source

v5.2.7

Compare Source

v5.2.6

Compare Source

v5.2.5

Compare Source

v5.2.4

Compare Source

v5.2.3

Compare Source

v5.2.2

Compare Source

v5.2.1

Compare Source

v5.2

Compare Source

v5.1.15

Compare Source

v5.1.14

Compare Source

v5.1.13

Compare Source

v5.1.12

Compare Source

v5.1.11

Compare Source

v5.1.10

Compare Source

v5.1.9

Compare Source

v5.1.8

Compare Source

v5.1.7

Compare Source

v5.1.6

Compare Source

v5.1.5

Compare Source

v5.1.4

Compare Source

v5.1.3

Compare Source

v5.1.2

Compare Source

v5.1.1

Compare Source

v5.1

Compare Source

v5.0.14

Compare Source

v5.0.13

Compare Source

v5.0.12

Compare Source

v5.0.11

Compare Source

v5.0.10

Compare Source

v5.0.9

Compare Source

v5.0.8

Compare Source

v5.0.7

Compare Source

v5.0.6

Compare Source

v5.0.5

Compare Source

v5.0.4

Compare Source

v5.0.3

Compare Source

v5.0.2

Compare Source

v5.0.1

Compare Source

v5.0

Compare Source

---

Configuration

📅 Schedule: (in timezone US/Eastern)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

OpenAPI Changes

No changes detected

View full changelog

Unexpected changes? Ensure your branch is up-to-date with main (consider rebasing).