Scheduled monthly dependency update for March

[pyup-bot]

Update django from 4.1.3 to 4.1.7.

Changelog

4.1.7

==========================

*February 14, 2023*

Django 4.1.7 fixes a security issue with severity "moderate" and a bug in
4.1.6.

CVE-2023-24580: Potential denial-of-service vulnerability in file uploads
=========================================================================

Passing certain inputs to multipart forms could result in too many open files
or memory exhaustion, and provided a potential vector for a denial-of-service
attack.

The number of files parts parsed is now limited via the new
:setting:`DATA_UPLOAD_MAX_NUMBER_FILES` setting.

Bugfixes
========

* Fixed a bug in Django 4.1 that caused a crash of model validation on
``ValidationError`` with no ``code`` (:ticket:`34319`).


==========================

4.1.6

==========================

*February 1, 2023*

Django 4.1.6 fixes a security issue with severity "moderate" and a bug in
4.1.5.

CVE-2023-23969: Potential denial-of-service via ``Accept-Language`` headers
===========================================================================

The parsed values of ``Accept-Language`` headers are cached in order to avoid
repetitive parsing. This leads to a potential denial-of-service vector via
excessive memory usage if large header values are sent.

In order to avoid this vulnerability, the ``Accept-Language`` header is now
parsed up to a maximum length.

Bugfixes
========

* Fixed a bug in Django 4.1 that caused a crash of model validation on
``UniqueConstraint`` with ordered expressions (:ticket:`34291`).


==========================

4.1.5

==========================

*January 2, 2023*

Django 4.1.5 fixes a bug in 4.1.4. Also, the latest string translations from
Transifex are incorporated.

Bugfixes
========

* Fixed a long standing bug in the ``__len`` lookup for ``ArrayField`` that
caused a crash of model validation on
:attr:`Meta.constraints <django.db.models.Options.constraints>`
(:ticket:`34205`).


==========================

4.1.4

==========================

*December 6, 2022*

Django 4.1.4 fixes several bugs in 4.1.3.

Bugfixes
========

* Fixed a regression in Django 4.1 that caused an unnecessary table rebuild
when adding a ``ManyToManyField`` on SQLite (:ticket:`34138`).

* Fixed a bug in Django 4.1 that caused a crash of the sitemap index view with
an empty :meth:`Sitemap.items() <django.contrib.sitemaps.Sitemap.items>` and
a callable :attr:`~django.contrib.sitemaps.Sitemap.lastmod`
(:ticket:`34088`).

* Fixed a bug in Django 4.1 that caused a crash using ``acreate()``,
``aget_or_create()``, and ``aupdate_or_create()`` asynchronous methods of
related managers (:ticket:`34139`).

* Fixed a bug in Django 4.1 that caused a crash of ``QuerySet.bulk_create()``
with ``"pk"`` in ``unique_fields`` (:ticket:`34177`).

* Fixed a bug in Django 4.1 that caused a crash of ``QuerySet.bulk_create()``
on fields with ``db_column`` (:ticket:`34171`).


==========================

Links

• PyPI: https://pypi.org/project/django
• Changelog: https://pyup.io/changelogs/django/
• Homepage: https://www.djangoproject.com/

Update wheel from 0.38.0 to 0.38.4.

Changelog

0.38.4

- Fixed ``PKG-INFO`` conversion in ``bdist_wheel`` mangling UTF-8 header values in
``METADATA`` (PR by Anderson Bravalheri)

0.38.3

- Fixed install failure when used with ``--no-binary``, reported on Ubuntu 20.04, by
removing ``setup_requires`` from ``setup.cfg``

0.38.2

- Fixed regression introduced in v0.38.1 which broke parsing of wheel file names with
multiple platform tags

0.38.1

- Removed install dependency on setuptools
- The future-proof fix in 0.36.0 for converting PyPy's SOABI into a abi tag was
faulty. Fixed so that future changes in the SOABI will not change the tag.

Links

• PyPI: https://pypi.org/project/wheel
• Changelog: https://pyup.io/changelogs/wheel/
• Repo: https://github.com/pypa/wheel

[pyup-bot]

Closing this in favor of #24