[dependabot]

Bumps the patches group with 3 updates in the / directory: django-guardian, py-vapid and django-webtest.

Updates django-guardian from 3.5.0 to 3.5.1

Release notes

Sourced from django-guardian's releases.

3.5.1

🔒 Security

This release fixes GHSA-5729-mvhf-9gq4 (Moderate, affects >= 1.3, < 3.5.1). Upgrading is recommended for all users.

get_objects_for_user(user, perms) with any_perm=False (the default) could return objects the user lacks a required permission on. This happened when the user held a global permission for some of the requested permissions and two or more permissions remained: an object was returned if one of the user's groups held any one of the remaining permissions on it, instead of all of them. PermissionListMixin and the admin filtering helpers use the same code path.

⚠️ Behaviour change: fewer objects may be returned

After upgrading, get_objects_for_user returns an object only if the user holds every remaining requested permission on it, directly or through their groups. If a list view, bulk action or admin screen shows fewer objects than before, this fix is the likely cause, and the objects that disappeared were ones the user did not have full permission on.

Recommended fix: grant the missing permissions explicitly (globally, to the user, or to their groups) so the user really holds every permission the check asks for.

Temporary opt-out: if you need time to migrate, you can restore the pre-3.5.1 behaviour:

# settings.py
GUARDIAN_LEGACY_GLOBAL_PERMS_GROUP_UNION = True

[!WARNING] This setting re-introduces the vulnerability above. It defaults to False, emits a DeprecationWarning on every affected call, and will be removed in 3.6.0. Use it only while you fix your permission assignments. Details: GUARDIAN_LEGACY_GLOBAL_PERMS_GROUP_UNION.

What's Changed

• Bump astral-sh/setup-uv from 10.0.1 to 10.1.0 in the github-actions group by @​dependabot[bot] in django-guardian/django-guardian#1029
• Bump astral-sh/setup-uv from 10.1.0 to 10.2.0 in the github-actions group by @​dependabot[bot] in django-guardian/django-guardian#1032
• Dispatch LoginRequiredMixin asynchronously for asynchronous views by @​tunglambk in django-guardian/django-guardian#1024
• 🤖 Update coverage badge to 97.9% by @​github-actions[bot] in django-guardian/django-guardian#1034
• Update breadcrumbs in template to better support django 6.1 by @​sevdog in django-guardian/django-guardian#1036
• Resolve permissions from direct object permission models during AUTO_… by @​tharunsridhar in django-guardian/django-guardian#1030
• docs: correct deletion signal behavior for permission removal by @​dajiaohuang in django-guardian/django-guardian#1038
• Add GUARDIAN_LEGACY_GLOBAL_PERMS_GROUP_UNION to opt back into pre-3.5.1 get_objects_for_user behaviour by @​Natgho in django-guardian/django-guardian#1039

New Contributors

• @​tunglambk made their first contribution in django-guardian/django-guardian#1024
• @​tharunsridhar made their first contribution in django-guardian/django-guardian#1030
• @​dajiaohuang made their first contribution in django-guardian/django-guardian#1038

Full Changelog: django-guardian/django-guardian@3.5.0...3.5.1

Commits

• d1a406e OPS: Bump version
• dc90ff7 Warn only for get_objects_for_user calls the legacy setting affects
• ac7126c Add GUARDIAN_LEGACY_GLOBAL_PERMS_GROUP_UNION to restore pre-3.5.1 behaviour
• 3a7918c Merge pull request #1038 from dajiaohuang/docs/removal-delete-signals-1037
• 915d58e docs: correct deletion signal behavior for permission removal
• 02465ce Merge pull request #1030 from tharunsridhar/fix/autoprefetch-direct-rel-perms
• 4678dbe docs: make AUTO_PREFETCH direct-model cost warning explicit
• 83925c8 fix: skip proxy/inherited models in direct perms discovery; test group-inheri...
• 8adb911 Merge commit from fork
• ef9804b Merge pull request #1036 from sevdog/fix/admin-breadcrumbs-django-6.1
• Additional commits viewable in compare view

Updates py-vapid from 1.9.4 to 1.9.6

Commits

• See full diff in compare view

Updates django-webtest from 1.9.14 to 1.9.15

Changelog

Sourced from django-webtest's changelog.

1.9.15 (2026-10-10)

• Add Django 6.x support

Commits

• 5f37846 Preparing release 1.9.15
• 3382972 django 6.x support
• 4c59a33 Merge pull request #141 from Azd325/django61-webtest
• 744dba7 Add Django 6.0 and 6.1 to tox
• 194826b Back to development: 1.9.15
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coveralls]

coverage: 81.461%. remained the same — dependabot/uv/patches-3151862c18 into main