Scheduled weekly dependency update for week 50

[pyup-bot]

Update django from 5.1.3 to 5.1.4.

Changelog

5.1.4

==========================

*December 4, 2024*

Django 5.1.4 fixes one security issue with severity "high", one security issue
with severity "moderate", and several bugs in 5.1.3.

CVE-2024-53907: Denial-of-service possibility in ``strip_tags()``
=================================================================

:func:`~django.utils.html.strip_tags` would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML entities.
The ``strip_tags()`` method is used to implement the corresponding
:tfilter:`striptags` template filter, which was thus also vulnerable.

``strip_tags()`` now has an upper limit of recursive calls to ``HTMLParser``
before raising a :exc:`.SuspiciousOperation` exception.

Remember that absolutely NO guarantee is provided about the results of
``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
``strip_tags()`` call without escaping it first, for example with
:func:`django.utils.html.escape`.

CVE-2024-53908: Potential SQL injection via ``HasKey(lhs, rhs)`` on Oracle
==========================================================================

Direct usage of the ``django.db.models.fields.json.HasKey`` lookup on Oracle
was subject to SQL injection if untrusted data was used as a ``lhs`` value.

Applications that use the :lookup:`has_key <jsonfield.has_key>` lookup through
the ``__`` syntax are unaffected.

Bugfixes
========

* Fixed a crash in ``createsuperuser`` on Python 3.13+ caused by an unhandled
``OSError`` when the username could not be determined (:ticket:`35942`).

* Fixed a regression in Django 5.1 where relational fields were not updated
when calling ``Model.refresh_from_db()`` on instances with deferred fields
(:ticket:`35950`).


==========================

Links

• PyPI: https://pypi.org/project/django
• Changelog: https://data.safetycli.com/changelogs/django/

Update setuptools from 75.5.0 to 75.6.0.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/setuptools

Update sqlparse from 0.5.2 to 0.5.3.

Changelog

0.5.3

----------------------------

Bug Fixes

* This version introduces a more generalized handling of potential denial of
service attack (DOS) due to recursion errors for deeply nested statements.
Brought up and fixed by living180. Thanks a lot!

Links

• PyPI: https://pypi.org/project/sqlparse
• Changelog: https://data.safetycli.com/changelogs/sqlparse/

[pyup-bot]

Closing this in favor of #153