Bump django from 4.2.27 to 4.2.28
Open
Number: #1097
Type: Pull Request
State: Open
Type: Pull Request
State: Open
Author:
![dependabot[bot]](https://github.com/dependabot.png)
dependabot[bot]
Association: Unknown
Comments: 1
dependabot[bot]Association: Unknown
Comments: 1
Created:
February 03, 2026 at 08:50 PM UTC
(16 days ago)
(16 days ago)
Updated:
February 18, 2026 at 11:18 AM UTC
(1 day ago)
(1 day ago)
Labels:
dependencies python
dependencies python
Description:
Bumps django from 4.2.27 to 4.2.28.
Commits
20c71f6[4.2.x] Bumped version for 4.2.28 release.881ff2c[4.2.x] Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases...90f5b10[4.2.x] Fixed CVE-2026-1312 -- Protected order_by() from SQL injection via al...f75f8f3[4.2.x] Fixed CVE-2026-1287 -- Protected against SQL injection in column alia...b40cfc6[4.2.x] Fixed CVE-2026-1285 -- Mitigated potential DoS in django.utils.text.T...a143631[4.2.x] Fixed CVE-2026-1207 -- Prevented SQL injections in RasterField lookup...f578acc[4.2.x] Fixed CVE-2025-14550 -- Optimized repeated header parsing in ASGI req...6dc2350[4.2.x] Fixed CVE-2025-13473 -- Standardized timing of check_password() in mo...a28c3c7[4.2.x] Refs #36499 -- Adjusted test_strip_tags to run on Python 3.8.4a439c6[4.2.x] Added stub release notes and release date for 4.2.28.- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.
Package Dependencies
Security Advisories
Django has an SQL Injection issue
GHSA-gvg8-93h5-g6qq
CVE-2026-1287
HIGH
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
`FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably cra...
Django has an SQL Injection issue
GHSA-6426-9fv3-65x8
CVE-2026-1312
MODERATE
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
`.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias i...
Django has Observable Timing Discrepancy
GHSA-2mcm-79hx-8fxw
CVE-2025-13473
LOW
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
The `django.contrib.auth.handlers.modwsgi.check_password()` function for authentication via `mod_wsgi` allows...
Django has Inefficient Algorithmic Complexity
GHSA-33mw-q7rj-mjwj
CVE-2025-14550
LOW
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
`ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with mult...
Django has Inefficient Algorithmic Complexity
GHSA-4rrr-2h4v-f3j9
CVE-2026-1285
LOW
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
`django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatecha...
Django has an SQL Injection issue
GHSA-mwm9-4648-f68q
CVE-2026-1207
HIGH
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28.
Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the...
Technical Details
| ID: | 13926024 |
| UUID: | 3893168681 |
| Node ID: | PR_kwDOBjX6Ks7BSsQe |
| Host: | GitHub |
| Repository: | python-openapi/openapi-core |