Update vulnerable dependencies [SECURITY] (patch)

[pulumi-renovate]

This PR contains the following updates:

Package	Type	Update	Change
Flask (changelog)		patch	==3.1.0 -> ==3.1.1
django (changelog)		patch	==5.1.8 -> ==5.1.14
github.com/golang-jwt/jwt/v4	indirect	patch	v4.5.1 -> v4.5.2
pg8000		patch	==1.31.2 -> ==1.31.5
requests (source, changelog)		patch	==2.32.3 -> ==2.32.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Flask uses fallback key instead of current signing key

CVE-2025-47278 / GHSA-4grg-w6v8-c28g

More information

Details

In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used for signing, rather than the current signing key.

Signing is provided by the itsdangerous library. A list of keys can be passed, and it expects the last (top) key in the list to be the most recent key, and uses that for signing. Flask was incorrectly constructing that list in reverse, passing the signing key first.

Sites that have opted-in to use key rotation by setting SECRET_KEY_FALLBACKS are likely to unexpectedly be signing their sessions with stale keys, and their transition to fresher keys will be impeded. Sessions are still signed, so this would not cause any sort of data integrity loss.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/pallets/flask/security/advisories/GHSA-4grg-w6v8-c28g
• https://nvd.nist.gov/vuln/detail/CVE-2025-47278
• https://github.com/pallets/flask/commit/73d6504063bfa00666a92b07a28aaf906c532f09
• https://github.com/pallets/flask
• https://github.com/pallets/flask/releases/tag/3.1.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

GitHub Vulnerability Alerts

CVE-2025-64458

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

CVE-2025-64459

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q(), are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.

---

BIT-django-2025-32873 / CVE-2025-32873 / GHSA-8j24-cjrq-gr2m / PYSEC-2025-37

More information

Details

An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().

Severity

Unknown

References

• https://www.djangoproject.com/weblog/2025/may/07/security-releases/
• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/g/django-announce
• http://www.openwall.com/lists/oss-security/2025/05/07/1

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Django has a denial-of-service possibility in strip_tags()

BIT-django-2025-32873 / CVE-2025-32873 / GHSA-8j24-cjrq-gr2m / PYSEC-2025-37

More information

Details

An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-32873
• https://github.com/django/django/commit/9f3419b519799d69f2aba70b9d25abe2e70d03e0
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-37.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/may/07/security-releases
• http://www.openwall.com/lists/oss-security/2025/05/07/1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Django Improper Output Neutralization for Logs vulnerability

BIT-django-2025-48432 / CVE-2025-48432 / GHSA-7xr5-9hcq-chf9 / PYSEC-2025-47

More information

Details

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Severity

• CVSS Score: 4.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-48432
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2025-47.yaml
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/jun/04/security-releases
• https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases
• http://www.openwall.com/lists/oss-security/2025/06/04/5
• http://www.openwall.com/lists/oss-security/2025/06/10/2
• http://www.openwall.com/lists/oss-security/2025/06/10/3
• http://www.openwall.com/lists/oss-security/2025/06/10/4

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

BIT-django-2025-48432 / CVE-2025-48432 / GHSA-7xr5-9hcq-chf9 / PYSEC-2025-47

More information

Details

An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2.22. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

Severity

Unknown

References

• https://www.djangoproject.com/weblog/2025/jun/04/security-releases/
• https://docs.djangoproject.com/en/dev/releases/security/
• https://groups.google.com/g/django-announce
• http://www.openwall.com/lists/oss-security/2025/06/04/5

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

---

Django is subject to SQL injection through its column aliases

BIT-django-2025-57833 / CVE-2025-57833 / GHSA-6w2r-r2m5-xq5w

More information

Details

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-57833
• https://github.com/django/django/commit/102965ea93072fe3c39a30be437c683ec1106ef5
• https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92
• https://github.com/django/django/commit/4c044fcc866ec226f612c475950b690b0139d243
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://groups.google.com/g/django-announce
• https://lists.debian.org/debian-lts-announce/2025/09/msg00017.html
• https://medium.com/@​EyalSec/django-unauthenticated-0-click-rce-and-sql-injection-using-default-configuration-059964f3f898
• https://www.djangoproject.com/weblog/2025/sep/03/security-releases
• http://www.openwall.com/lists/oss-security/2025/09/03/3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to SQL injection in column aliases

BIT-django-2025-59681 / CVE-2025-59681 / GHSA-hpr9-3m2g-3j9p

More information

Details

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and QuerySet.extra() are subject to SQL injection in column aliases, when using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (on MySQL and MariaDB).

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-59681
• https://github.com/django/django/commit/41b43c74bda19753c757036673ea9db74acf494a
• https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/oct/01/security-releases
• http://www.openwall.com/lists/oss-security/2025/10/01/3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to partial directory traversal via archives

BIT-django-2025-59682 / CVE-2025-59682 / GHSA-q95w-c7qg-hrff

More information

Details

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract() function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common prefix with the target directory.

Severity

• CVSS Score: 3.1 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-59682
• https://github.com/django/django/commit/43d84aef04a9e71164c21a74885996981857e66e
• https://github.com/django/django/commit/924a0c092e65fa2d0953fd1855d2dc8786d94de2
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/oct/01/security-releases
• http://www.openwall.com/lists/oss-security/2025/10/01/3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.

BIT-django-2025-64459 / CVE-2025-64459 / GHSA-frmv-pr5f-9mcr

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q(), are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank cyberstan for reporting this issue.

Severity

• CVSS Score: 9.1 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64459
• https://github.com/django/django/commit/06dd38324ac3d60d83d9f3adabf0dcdf423d2a85
• https://github.com/django/django/commit/59ae82e67053d281ff4562a24bbba21299f0a7d4
• https://github.com/django/django/commit/6703f364d767e949c5b0e4016433ef75063b4f9b
• https://github.com/django/django/commit/72d2c87431f2ae0431d65d0ec792047f078c8241
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

BIT-django-2025-64458 / CVE-2025-64458 / GHSA-qw25-v68c-qjf3

More information

Details

An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8.
NFKC normalization in Python is slow on Windows. As a consequence, django.http.HttpResponseRedirect, django.http.HttpResponsePermanentRedirect, and the shortcut django.shortcuts.redirect were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Seokchan Yoon for reporting this issue.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-64458
• https://github.com/django/django/commit/3790593781d26168e7306b5b2f8ea0309de16242
• https://github.com/django/django/commit/4f5d904b63751dea9ffc3b0e046404a7fa5881ac
• https://github.com/django/django/commit/6e13348436fccf8f22982921d6a3a3e65c956a9f
• https://github.com/django/django/commit/770eea38d7a0e9ba9455140b5a9a9e33618226a7
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/django/django
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2025/nov/05/security-releases

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

CVE-2025-30204

Summary

Function parse.ParseUnverified currently splits (via a call to strings.Split) its argument (which is untrusted data) on periods.

As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)

Details

See parse.ParseUnverified

Impact

Excessive memory allocation

---

jwt-go allows excessive memory allocation during header parsing

CVE-2025-30204 / GHSA-mh63-6h87-95cp / GO-2025-3553

More information

Details

Summary

Function parse.ParseUnverified currently splits (via a call to strings.Split) its argument (which is untrusted data) on periods.

As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. Relevant weakness: CWE-405: Asymmetric Resource Consumption (Amplification)

Details

See parse.ParseUnverified

Impact

Excessive memory allocation

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp
• https://nvd.nist.gov/vuln/detail/CVE-2025-30204
• https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3
• https://github.com/golang-jwt/jwt/commit/bf316c48137a1212f8d0af9288cc9ce8e59f1afb
• https://github.com/golang-jwt/jwt
• https://security.netapp.com/advisory/ntap-20250404-0002

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Excessive memory allocation during header parsing in github.com/golang-jwt/jwt

CVE-2025-30204 / GHSA-mh63-6h87-95cp / GO-2025-3553

More information

Details

Excessive memory allocation during header parsing in github.com/golang-jwt/jwt

Severity

Unknown

References

• https://github.com/golang-jwt/jwt/security/advisories/GHSA-mh63-6h87-95cp
• https://github.com/golang-jwt/jwt/commit/0951d184286dece21f73c85673fd308786ffe9c3

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

CVE-2025-61385

SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.

---

pg8000 SQL injection vulnerability via a specially crafted Python list input

CVE-2025-61385 / GHSA-wq2g-r956-j8cc

More information

Details

SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to function pg8000.native.literal.

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-61385
• https://codeberg.org/tlocke/pg8000
• https://codeberg.org/tlocke/pg8000/commit/8663c746b02286c32f19c385f0e2e5da9e4fa140
• https://github.com/bmcyver/vulnerability-research/tree/main/CVE-2025-61385

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Requests vulnerable to .netrc credentials leak via malicious URLs

CVE-2024-47081 / GHSA-9hjg-9r4m-mvj7

More information

Details

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References

https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

• https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7
• https://nvd.nist.gov/vuln/detail/CVE-2024-47081
• https://github.com/psf/requests/pull/6965
• https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef
• https://github.com/psf/requests
• https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env
• https://seclists.org/fulldisclosure/2025/Jun/2
• http://seclists.org/fulldisclosure/2025/Jun/2
• http://www.openwall.com/lists/oss-security/2025/06/03/11
• http://www.openwall.com/lists/oss-security/2025/06/03/9
• http://www.openwall.com/lists/oss-security/2025/06/04/1
• http://www.openwall.com/lists/oss-security/2025/06/04/6

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pallets/flask (Flask)

v3.1.1

Compare Source

Released 2025-05-13

• Fix signing key selection order when key rotation is enabled via
  SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
• Fix type hint for cli_runner.invoke. :issue:5645
• flask --help loads the app and plugins first to make sure all commands
  are shown. :issue:5673
• Mark sans-io base class as being able to handle views that return
  AsyncIterable. This is not accurate for Flask, but makes typing easier
  for Quart. :pr:5659

django/django (django)

v5.1.14

Compare Source

v5.1.13

Compare Source

v5.1.12

Compare Source

v5.1.11

Compare Source

v5.1.10

Compare Source

v5.1.9

Compare Source

golang-jwt/jwt (github.com/golang-jwt/jwt/v4)

v4.5.2

Compare Source

See GHSA-mh63-6h87-95cp

Full Changelog: golang-jwt/jwt@v4.5.1...v4.5.2

psf/requests (requests)

v2.32.4

Compare Source

Security

• CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted
  environment will retrieve credentials for the wrong hostname/machine from a
  netrc file.

Improvements

• Numerous documentation improvements

Deprecations

• Added support for pypy 3.11 for Linux and macOS.
• Dropped support for pypy 3.9 following its end of support.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[pulumi-renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: azure-go-call-azure-sdk/go.sum

Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: github.com/pulumi/pulumi-azure-native-sdk/authorization/v3@v3.0.0-alpha.2: reading github.com/pulumi/pulumi-azure-native-sdk/authorization/go.mod at revision authorization/v3.0.0-alpha.2: unknown revision authorization/v3.0.0-alpha.2