[pull] main from django:main - #522

Merged

pull[bot] merged 6 commits into

threatcode:mainfrom

Aug 4, 2026

Commits on Aug 4, 2026

Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial lookups.

jacobtylerwalls
authored and
nessita
committed
f1949c1
Fixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language().
nessita
committed
27137e6
Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry collections.

jacobtylerwalls
authored and
nessita
committed
d2e59b7
Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before rendering admin links.
nessita
committed
47511a2
Added CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, and CVE-2026-15920 to security archive.
nessita
committed
7d75c0b
Refs #36735 -- Added DatabaseFeatures.supports_uuid4_function_in_default feature flag.
jacobtylerwalls
committed
f00270d