[dependabot]

Bumps the patches group with 3 updates in the / directory: django-guardian, py-vapid and django-webtest.

Updates django-guardian from 3.5.0 to 3.5.2

Release notes

Sourced from django-guardian's releases.

3.5.2

Bug fixes

• get_objects_for_group honoured global permissions from other models (#1046, #1059). The group's global permissions were matched by codename only, without the content type. A group with a global permission on one model got every object of any other model with the same codename, e.g. blog.view_post granted access to all forum.Post objects, or a custom can_publish defined on two models. Global permissions are now filtered by the queried model's content type.
• get_40x_or_None ignored any_perm in the global permission check (#1048, #1058). With accept_global_perms=True and any_perm=True, a user holding only one of the required permissions globally was denied. The global check now uses any() when any_perm is set. This affects PermissionRequiredMixin. The permission_required decorators check a single permission and are not affected.
• get_perms() returned no permissions for superusers with GUARDIAN_AUTO_PREFETCH (#1049, #1056). ObjectPermissionChecker.get_perms() returned [], or only explicitly assigned permissions, for an active superuser, while has_perm() returned True. Superusers now get every permission for the object's content type, the same as with AUTO_PREFETCH off. The get_perms() shortcut and the get_obj_perms template tag are fixed too.
• Batched clean_orphan_obj_perms skipped rows (#1045, #1057). With batch_size set, deleting orphans shifted the remaining rows, so the next batch skipped as many rows as were just deleted. The last group batch could also be missed when the user permissions ended in a partial batch. Batches now continue from the last seen primary key, and the logged resume hint no longer skips rows.
• The backend ignored GUARDIAN_ANONYMOUS_USER_CACHE_TTL (#1050, #1054). ObjectPermissionBackend looked up the anonymous user with its own query, so every anonymous has_perm() / get_all_permissions() call hit the database. It now uses get_anonymous_user(), which applies the cache.

⚠️ Behaviour changes

These fixes can change results for existing code:

• get_objects_for_group(..., accept_global_perms=True) may return fewer objects. This happens when a group's global permission was on a different model with the same codename. If objects disappear, grant the global permission on the model you are querying.
• PermissionRequiredMixin with any_perm=True and accept_global_perms=True may now allow requests it used to deny. A user who holds any one of the required permissions globally now gets access. Check that this is what you intended for those views.
• With GUARDIAN_AUTO_PREFETCH = True, get_perms() and {% get_obj_perms %} return the full permission list for superusers. Templates or code that branch on this list will now show superusers everything.
• Batched clean_orphan_obj_perms may remove more orphans than before, because it no longer skips rows. Don't reuse a skip_batches value logged by an older version. Rerun the cleanup from the start instead.

[!NOTE] Reminder: GUARDIAN_LEGACY_GLOBAL_PERMS_GROUP_UNION, added in 3.5.1, will be removed in 3.6.0.

What's Changed

• Return all permissions for superusers in get_perms() with AUTO_PREFETCH by @​wang2-lat in django-guardian/django-guardian#1056
• Scope the global permissions of get_objects_for_group to the queried model by @​Anikesh0001 in django-guardian/django-guardian#1059
• Honor any_perm in the global permission check of get_40x_or_None by @​Anikesh0001 in django-guardian/django-guardian#1058
• Fix batched clean_orphan_obj_perms skipping rows after deleting orphans by @​Anikesh0001 in django-guardian/django-guardian#1057
• Use get_anonymous_user() in the backend's anonymous user lookup by @​kayaal34 in django-guardian/django-guardian#1054
• Bump version to 3.5.2 by @​Natgho in django-guardian/django-guardian#1060

New Contributors

• @​wang2-lat made their first contribution in django-guardian/django-guardian#1056
• @​Anikesh0001 made their first contribution in django-guardian/django-guardian#1059
• @​kayaal34 made their first contribution in django-guardian/django-guardian#1054

Full Changelog: django-guardian/django-guardian@3.5.1...3.5.2

3.5.1

🔒 Security

This release fixes GHSA-5729-mvhf-9gq4 (Moderate, affects >= 1.3, < 3.5.1). Upgrading is recommended for all users.

get_objects_for_user(user, perms) with any_perm=False (the default) could return objects the user lacks a required permission on. This happened when the user held a global permission for some of the requested permissions and two or more permissions remained: an object was returned if one of the user's groups held any one of the remaining permissions on it, instead of all of them. PermissionListMixin and the admin filtering helpers use the same code path.

⚠️ Behaviour change: fewer objects may be returned

After upgrading, get_objects_for_user returns an object only if the user holds every remaining requested permission on it, directly or through their groups. If a list view, bulk action or admin screen shows fewer objects than before, this fix is the likely cause, and the objects that disappeared were ones the user did not have full permission on.

Recommended fix: grant the missing permissions explicitly (globally, to the user, or to their groups) so the user really holds every permission the check asks for.

Temporary opt-out: if you need time to migrate, you can restore the pre-3.5.1 behaviour:

... (truncated)

Commits

• 35d7ddc Merge pull request #1060 from django-guardian/version-update-3-5-2
• 13a25a5 Merge pull request #1054 from kayaal34/fix/backend-anonymous-user-cache
• 62d43d8 Merge pull request #1057 from Anikesh0001/fix/clean-orphan-obj-perms-batch-skip
• 5423944 Merge branch 'main' into fix/clean-orphan-obj-perms-batch-skip
• c7c624a Bump version to 3.5.2
• 8fe29fa Merge pull request #1058 from Anikesh0001/fix/get-40x-any-perm-global
• 1d6d5e0 Merge branch 'main' into fix/get-40x-any-perm-global
• 1edccdf Merge pull request #1059 from Anikesh0001/fix/get-objects-for-group-global-ctype
• 8fd5bad Merge branch 'main' into fix/get-objects-for-group-global-ctype
• 9cdda6b Merge pull request #1056 from wang2-lat/fix/1049-superuser-prefetch-get-perms
• Additional commits viewable in compare view

Updates py-vapid from 1.9.4 to 1.9.6

Commits

• See full diff in compare view

Updates django-webtest from 1.9.14 to 1.9.15

Changelog

Sourced from django-webtest's changelog.

1.9.15 (2026-10-10)

• Add Django 6.x support

Commits

• 5f37846 Preparing release 1.9.15
• 3382972 django 6.x support
• 4c59a33 Merge pull request #141 from Azd325/django61-webtest
• 744dba7 Add Django 6.0 and 6.1 to tox
• 194826b Back to development: 1.9.15
• See full diff in compare view

[coveralls]

coverage: 81.461%. remained the same — dependabot/uv/patches-3151862c18 into main