CVE-2019-19844

Advisory

Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

**[Security updates]**

**[Dropped support]**

**[Added support]**

**[New features]**

**[Breaking changes]**

- The following classes have moved to a new namespace and need to be changed in your
settings and code where appropriate.
<pre>
idempotency_key.locks.IdempotencyKeyLock -> <strong>idempotency_key.locks.basic.IdempotencyKeyLock</strong>

idempotency_key.locks.ThreadLock -> <strong>idempotency_key.locks.basic.ThreadLock</strong>

idempotency_key.locks.MultiProcessRedisLock -> <strong>idempotency_key.locks.redis.MultiProcessRedisLock</strong>
</pre>

- Drop support for Django (1.9, 1.10, 1.11)
- 1.11 was dropped because of security issues and is near to end of life support.

- Added support for Django (2.2)

- Added testing with django rest framework (3.10, 3.11)

- Added optional flag so that clients can choose to use idempotency keys on an API that
is used to expect it.

- Updated packages with security issues:
Django (>=2.x)
bleach (>=3.1.4)
urllib3 (>=1.24.2)

---

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19844