Bump the minor group with 2 updates

[dependabot]

Bumps the minor group with 2 updates: django and servestatic.

Updates django from 6.1 to 6.1.1

Commits

• 249b13d [6.1.x] Bumped version for 6.1.1 release.
• 5f26fa8 [6.1.x] Added release date for 6.1.1.
• fdcf78a [6.1.x] Added remaining community package mentions to the documentation.
• 7241568 [6.1.x] Fixed #37222 -- Fixed QuerySet.distinct() crash on duplicated selecti...
• ef3fc80 [6.1.x] Fixed #37312, Refs #36605 -- Fixed annotation preservation and key se...
• b09cb6b [6.1.x] Clarified scope of object-level admin view permissions.
• a6d3aa2 [6.1.x] Corrected heading hierarchy in the admin actions documentation.
• 9031d41 [6.1.x] Clarified object-level permission checks in admin actions.
• fc805c6 [6.1.x] Fixed #37311 -- Prevented consumption of rhs iterators in annotation ...
• 4b0185a [6.1.x] Fixed #37300 -- Preserved parent instance hints on custom Prefetch qu...
• Additional commits viewable in compare view

Updates servestatic from 4.3.1 to 4.3.4

Release notes

Sourced from servestatic's releases.

4.3.4

Fixed

• Prevent an unhandled ValueError crash when a request path contains a NUL byte (%00) that survives normalization, which could be triggered by an unauthenticated request to crash the server (DoS / log-flood).

4.3.3

Changed

• Parse the Accept-Encoding header rather than matching it as a substring. A coding refused with q=0, such as gzip;q=0, is no longer served, and a coding is only offered when its name appears as a whole token.

Fixed

• Keep CORS / cache headers on 416 (Range Not Satisfiable) and 304 (Not Modified) responses, so that cross-origin media probes are not broken.

4.3.2

Changed

• Remove the redundant packaging build dependency.

Changelog

Sourced from servestatic's changelog.

[4.3.4] - 2026-09-07

Fixed

• Prevent an unhandled ValueError crash when a request path contains a NUL byte (%00) that survives normalization, which could be triggered by an unauthenticated request to crash the server (DoS / log-flood).

[4.3.3] - 2026-09-02

Changed

• Parse the Accept-Encoding header rather than matching it as a substring. A coding refused with q=0, such as gzip;q=0, is no longer served, and a coding is only offered when its name appears as a whole token.

Fixed

• Keep CORS / cache headers on 416 (Range Not Satisfiable) and 304 (Not Modified) responses, so that cross-origin media probes are not broken.

[4.3.2] - 2026-09-01

Changed

• Remove the redundant packaging build dependency.

Commits

• f1d627d 4.3.4 (#115)
• 7227d98 Fix unhandled ValueError crash on NUL-byte request paths (#114)
• ea6828f Add webserver to dictionary (#113)
• 0d74aad Add quick start to readme (#112)
• f7f0d02 4.3.3 (#111)
• a362b1a Keep CORS and cache headers on 416 and 304 responses (#110)
• 6757a82 Parse Accept-Encoding instead of matching it as a substring (#109)
• e5e92cc 4.3.2 (#108)
• 446d429 Remove upper bound on packaging dependency (#107)
• 63ad205 [pre-commit.ci] pre-commit autoupdate (#106)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions