django-import-export 4.4.2__tar.gz → 4.4.4__tar.gz

{django_import_export-4.4.2 → django_import_export-4.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-import-export
-Version: 4.4.2
+Version: 4.4.4
 Summary: Django application and library for importing and exporting data with included admin integration.
 Author-email: Bojan Mihelač <djangoimportexport@gmail.com>
 Maintainer-email: Matthew Hegarty <djangoimportexport@gmail.com>

{django_import_export-4.4.2 → django_import_export-4.4.4}/django_import_export.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-import-export
-Version: 4.4.2
+Version: 4.4.4
 Summary: Django application and library for importing and exporting data with included admin integration.
 Author-email: Bojan Mihelač <djangoimportexport@gmail.com>
 Maintainer-email: Matthew Hegarty <djangoimportexport@gmail.com>

django_import_export-4.4.4/django_import_export.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "4.4.4",
+  "distance": 0,
+  "node": "gc1c4100281857e8cc03916bc330ae5b6d6e2d173",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-27"
+}

{django_import_export-4.4.2 → django_import_export-4.4.4}/docs/changelog.rst

@@ -5,11 +5,26 @@ Changelog
 
     If upgrading from v3, v4 introduces breaking changes.  Please refer to :doc:`release notes<release_notes>`.
 
+4.4.4 (2026-10-27)
+-------------------
+
+- Fixed ``CSV`` being omitted from the default formats on Python 3.15 because tablib 3.10+ lazily imports ``tablib.core``, leaving the format registry empty when the first ``is_available()`` check runs (`2210 <https://github.com/django-import-export/django-import-export/issues/2210>`_)
+- Fixed ``django.utils.functional.cached_property is deprecated`` warning on Django 6.2 by using ``functools.cached_property``
+- Fixed ``ExportActionMixin.get_actions()`` for Django 6.1, which deprecates overriding it without the new ``action_location`` parameter and, with the old signature, disables all change form actions on the admin. (`2214 <https://github.com/django-import-export/django-import-export/pull/2214>`_)
+
+4.4.3 (2026-10-19)
+-------------------
+
+- Fixed a denial-of-service issue where importing a crafted large-magnitude integer value could stall the process during conversion to a Python integer.
+  See :ref:`release notes <release_notes_integer_widget_dos>` for details and mitigations.
+  (`GHSA-fcgw-hjjv-4rh6 <https://github.com/django-import-export/django-import-export/security/advisories/GHSA-fcgw-hjjv-4rh6>`_)
+
 4.4.2 (2026-10-15)
 -------------------
 
 - Fixed a security and data integrity issue where an import row classified as "new" could silently overwrite an existing database row.
   See :ref:`release notes <release_notes_force_insert_on_create>` for details and mitigations.
+  (`GHSA-8xvj-4m4r-g62h <https://github.com/django-import-export/django-import-export/security/advisories/GHSA-8xvj-4m4r-g62h>`_)
 
 4.4.1 (2026-05-05)
 -------------------

{django_import_export-4.4.2 → django_import_export-4.4.4}/docs/release_notes.rst

@@ -2,6 +2,49 @@
 Release Notes
 =============
 
+v4.4.3
+------
+
+.. _release_notes_integer_widget_dos:
+
+* This release patches a denial-of-service vulnerability in :class:`~import_export.widgets.IntegerWidget`.
+
+  ``IntegerWidget.clean()`` converted imported values using ``int(Decimal(value))`` with no bound on the
+  value's magnitude.  A value written in exponent notation, such as ``1e1000000``, is cheap to parse as a
+  ``Decimal`` but forces Python to expand every digit when converted to ``int``, a cost that grows
+  superlinearly with the digit count.  A single such value could stall the importing process for several
+  seconds while pinning a CPU core, and a file containing many such rows multiplied the cost.
+
+  ``IntegerWidget`` is the default widget for all integer model fields, including the ``id`` column used by
+  every resource that does not override ``import_id_fields``, so almost every import was affected.  The stall
+  occurred during the initial dry run, before the confirmation step.  Python's
+  ``sys.set_int_max_str_digits()`` limit did not protect this path, as it only guards conversions between
+  ``int`` and ``str``, not ``Decimal.__int__``.
+
+  This was an availability issue only.  The resulting integers exceed the range of any standard database
+  integer column, so no data could be written or corrupted through this path.
+
+  The fix rejects values whose magnitude exceeds ``sys.get_int_max_str_digits()`` digits (4300 by default)
+  before the conversion is attempted.  Such values are now reported as row errors.  Values within the limit,
+  including those in exponent notation such as ``1e5``, are unaffected, and no value a standard integer column
+  could store is rejected.  All users are advised to upgrade.
+
+  If you import integers larger than the default limit into a field that can store them, raise the limit with
+  ``sys.set_int_max_str_digits()``; the widget honours the configured value.
+
+  If you subclass :class:`~import_export.widgets.IntegerWidget` and override ``clean()``, you receive this fix
+  automatically only if your override delegates to ``super().clean()``.  An override that reimplements the
+  ``int(Decimal(...))`` conversion itself is not protected, and should apply the same magnitude check before
+  converting.
+
+  If you cannot upgrade, either of the following prevents the stall:
+
+  - Set :ref:`IMPORT_EXPORT_IMPORT_PERMISSION_CODE` to restrict import access to trusted users.
+  - Subclass :class:`~import_export.widgets.IntegerWidget`, override ``clean()`` to reject values whose
+    magnitude exceeds a sensible bound before calling ``super().clean()``, and assign the subclass to the
+    integer fields on your resources.  This suits deployments where all staff legitimately need import
+    permission.
+
 v4.4.2
 ------
 
@@ -41,6 +84,10 @@ v4.4.2
   If you have overridden :meth:`~import_export.resources.Resource.do_instance_save`, review it to ensure that
   ``is_create`` is honoured.
 
+  If any of your models override ``save()``, the override must accept ``*args`` and ``**kwargs`` and pass them to
+  ``super().save()``, as required by Django.  An override declared as ``def save(self)`` will now fail with a
+  ``TypeError`` when a new instance is imported, because ``force_insert`` is passed as a keyword argument.
+
   If you have understood the implications and need to restore the previous behaviour, override
   :meth:`~import_export.resources.Resource.do_instance_save` to call ``instance.save()`` without ``force_insert``.
   Note that this reinstates the overwrite described above for your resource.

{django_import_export-4.4.2 → django_import_export-4.4.4}/import_export/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '4.4.2'
-__version_tuple__ = version_tuple = (4, 4, 2)
+__version__ = version = '4.4.4'
+__version_tuple__ = version_tuple = (4, 4, 4)
 
-__commit_id__ = commit_id = 'g6c991f289'
+__commit_id__ = commit_id = 'gc1c410028'

{django_import_export-4.4.2 → django_import_export-4.4.4}/import_export/admin.py

@@ -916,6 +916,7 @@ class ExportActionMixin(ExportMixin):
             )
         return super().response_change(request, obj)
 
+    @admin.action(description=_("Export selected %(verbose_name_plural)s"))
     def export_admin_action(self, request, queryset):
         """
         Action runs on POST from instance action menu (if enabled).
@@ -959,19 +960,22 @@ class ExportActionMixin(ExportMixin):
 
         return render(request, "admin/import_export/export.html", context=context)
 
-    def get_actions(self, request):
+    def get_actions(self, request, action_location=None):
         """
         Adds the export action to the list of available actions.
-        """
-        actions = super().get_actions(request)
-        if self.has_export_permission(request):
-            actions.update(
-                export_admin_action=(
-                    type(self).export_admin_action,
-                    "export_admin_action",
-                    _("Export selected %(verbose_name_plural)s"),
-                )
-            )
+
+        ``action_location`` was added in Django 6.1 (``ActionLocation.CHANGE_LIST``
+        or ``ActionLocation.CHANGE_FORM``).  ``None`` means the change list, which
+        is also what Django itself defaults to.  The export action is only offered
+        on the change list.
+        """
+        # only forward the parameter when given, so that Django < 6.1 (which
+        # does not accept it) keeps working unchanged
+        kwargs = {} if action_location is None else {"action_location": action_location}
+        actions = super().get_actions(request, **kwargs)
+        export_action = self.get_action("export_admin_action", **kwargs)
+        if export_action is not None and self.has_export_permission(request):
+            actions["export_admin_action"] = export_action
         return actions
 
 

{django_import_export-4.4.2 → django_import_export-4.4.4}/import_export/formats/base_formats.py

@@ -13,6 +13,19 @@ from tablib.formats import registry
 logger = logging.getLogger(__name__)
 
 
+def _ensure_tablib_registry():
+    """
+    Make sure tablib's builtin formats are registered.
+
+    tablib registers its builtin formats as a side effect of importing
+    ``tablib.core``.  With tablib 3.10+ on Python 3.15+, ``tablib.core`` is a
+    lazy module, so the registry can still be empty when a format is first
+    looked up (see issue 2210).
+    """
+    if not registry._formats:
+        registry.register_builtins()
+
+
 class Format:
     def get_title(self):
         return type(self)
@@ -77,6 +90,7 @@ class TablibFormat(Format):
         if not self.TABLIB_MODULE:
             raise AttributeError("TABLIB_MODULE must be defined")
         key = self.TABLIB_MODULE.split(".")[-1].replace("_", "")
+        _ensure_tablib_registry()
         return registry.get_format(key)
 
     @classmethod

{django_import_export-4.4.2 → django_import_export-4.4.4}/import_export/results.py

@@ -2,10 +2,10 @@ import logging
 import sys
 import traceback
 from collections import OrderedDict
+from functools import cached_property
 
 from django.core.exceptions import NON_FIELD_ERRORS
 from django.utils.encoding import force_str
-from django.utils.functional import cached_property
 from django.utils.translation import gettext_lazy as _
 from tablib import Dataset
 

{django_import_export-4.4.2 → django_import_export-4.4.4}/import_export/widgets.py

@@ -1,6 +1,7 @@
 import json
 import logging
 import numbers
+import sys
 from collections import defaultdict, namedtuple
 from datetime import date, datetime, time, timedelta
 from decimal import Decimal
@@ -168,12 +169,24 @@ class IntegerWidget(NumberWidget):
         :param row: The current row being processed.
         :param **kwargs: Optional keyword arguments.
         :returns: A Python int instance, or None if value is empty.
-        :raises ValueError: If the value cannot be converted to integer.
+        :raises ValueError: If the value cannot be converted to integer, or if
+            its magnitude exceeds ``sys.get_int_max_str_digits()`` digits.
         :raises InvalidOperation: If Decimal conversion fails.
         """
         if self.is_empty(value):
             return None
-        return int(Decimal(sanitize_separators(value)))
+        d = Decimal(sanitize_separators(value))
+        # Reject values whose magnitude would make the Decimal-to-int conversion
+        # disproportionately expensive. ``sys.set_int_max_str_digits`` does not
+        # guard ``Decimal.__int__``, so the same limit is applied explicitly.
+        # See GHSA-fcgw-hjjv-4rh6.
+        max_digits = sys.get_int_max_str_digits()
+        if d.is_finite() and d.adjusted() >= max_digits:
+            raise ValueError(
+                f"the value's magnitude exceeds the maximum of {max_digits} "
+                "digits allowed for integer conversion"
+            )
+        return int(d)
 
 
 class DecimalWidget(NumberWidget):

{django_import_export-4.4.2 → django_import_export-4.4.4}/tests/core/tests/admin_integration/test_action_export.py

@@ -1,6 +1,6 @@
 import warnings
 from datetime import date, datetime
-from unittest import mock
+from unittest import mock, skipUnless
 from unittest.mock import MagicMock, PropertyMock, patch
 
 from core.admin import CategoryAdmin
@@ -18,6 +18,11 @@ from django.urls import reverse
 
 from import_export.admin import ExportMixin
 
+try:
+    from django.contrib.admin.options import ActionLocation
+except ImportError:  # Django < 6.1
+    ActionLocation = None
+
 
 class ExportActionAdminIntegrationTest(AdminTestMixin, TestCase):
     def setUp(self):
@@ -111,8 +116,10 @@ class ExportActionAdminIntegrationTest(AdminTestMixin, TestCase):
         self.assertEqual(target_str.encode(), response.content)
 
     def test_export_admin_action(self):
+        # autospec so that Django's get_action() sees a function, not a MagicMock
+        # which would answer any attribute lookup (e.g. 'locations')
         with mock.patch(
-            "core.admin.CategoryAdmin.export_admin_action"
+            "core.admin.CategoryAdmin.export_admin_action", autospec=True
         ) as mock_export_admin_action:
             response = self.client.post(
                 self.category_change_url,
@@ -541,3 +548,54 @@ class TestSkipExportFormFromChangeForm(AdminTestMixin, TestCase):
             )
             target_re = r"This exporter will export the following fields:"
             self.assertRegex(response.content.decode(), target_re)
+
+
+class ExportActionGetActionsTest(AdminTestMixin, TestCase):
+    """
+    ``get_actions()`` must integrate with Django's action API, which gained an
+    ``action_location`` parameter in Django 6.1.
+    """
+
+    def setUp(self):
+        super().setUp()
+        # the admin only renders the action form when there are results
+        Category.objects.create(name="Cat 1")
+        self.model_admin = CategoryAdmin(Category, AdminSite())
+        self.request = RequestFactory().get(self.category_change_url)
+        self.request.user = User.objects.create_superuser(
+            "superuser", "superuser@example.com", "password"
+        )
+
+    def test_export_action_in_change_list_actions(self):
+        actions = self.model_admin.get_actions(self.request)
+        self.assertIn("export_admin_action", actions)
+
+    def test_export_action_choice_description(self):
+        choices = self.model_admin.get_action_choices(self.request)
+        self.assertIn(("export_admin_action", "Export selected categories"), choices)
+
+    @skipUnless(ActionLocation, "requires Django 6.1+")
+    def test_export_action_in_change_list_location(self):
+        actions = self.model_admin.get_actions(
+            self.request, action_location=ActionLocation.CHANGE_LIST
+        )
+        self.assertIn("export_admin_action", actions)
+
+    @skipUnless(ActionLocation, "requires Django 6.1+")
+    def test_export_action_not_in_change_form_location(self):
+        actions = self.model_admin.get_actions(
+            self.request, action_location=ActionLocation.CHANGE_FORM
+        )
+        self.assertNotIn("export_admin_action", actions)
+
+    @skipUnless(ActionLocation, "requires Django 6.1+")
+    def test_change_list_does_not_emit_get_actions_deprecation_warning(self):
+        with warnings.catch_warnings():
+            warnings.simplefilter("error", DeprecationWarning)
+            warnings.simplefilter("error", PendingDeprecationWarning)
+            response = self.client.get(self.category_change_url)
+        self.assertEqual(200, response.status_code)
+        self.assertIn(
+            '<option value="export_admin_action">Export selected categories</option>',
+            response.content.decode(),
+        )

{django_import_export-4.4.2 → django_import_export-4.4.4}/tests/core/tests/test_base_formats.py

@@ -34,6 +34,14 @@ class FormatTest(TestCase):
     def test_format_available(self):
         self.assertTrue(base_formats.CSV.is_available())
 
+    def test_format_available_when_tablib_registry_empty(self):
+        # Regression test for issue 2210.  With tablib 3.10+ on Python 3.15+,
+        # `tablib.core` is a lazy module, so the builtin formats may not have
+        # been registered when the first `is_available()` check runs.
+        with mock.patch.dict(tablib.formats.registry._formats, clear=True):
+            self.assertTrue(base_formats.CSV.is_available())
+            self.assertIn("csv", tablib.formats.registry._formats)
+
     def test_get_title(self):
         self.assertEqual(
             "<class 'import_export.formats.base_formats.Format'>",

{django_import_export-4.4.2 → django_import_export-4.4.4}/tests/core/tests/test_widgets.py

@@ -1,6 +1,8 @@
 import json
+import sys
 from datetime import date, datetime, time, timedelta
 from decimal import Decimal
+from time import process_time
 from unittest import mock
 from unittest.mock import patch
 
@@ -552,6 +554,28 @@ class IntegerWidgetTest(TestCase, RowDeprecationTestMixin):
     def test_locale_render_gte_django4(self):
         self.assertEqual(self.widget_coerce_to_string.render(self.value), "0")
 
+    def test_clean_exponent_notation(self):
+        # legitimate exponent notation within bounds is still accepted
+        self.assertEqual(self.widget.clean("1e5"), 100000)
+
+    def test_clean_oversized_magnitude_raises(self):
+        # a crafted large-exponent value must be rejected rather than stalling
+        # the process on an expensive Decimal-to-int conversion (DoS guard).
+        start = process_time()
+        with self.assertRaises(ValueError):
+            self.widget.clean("1e1000000")
+        # the guard must trip before any costly conversion is attempted
+        self.assertLess(process_time() - start, 1.0)
+
+    def test_clean_oversized_digit_string_raises(self):
+        with self.assertRaises(ValueError):
+            self.widget.clean("9" * (sys.get_int_max_str_digits() + 1))
+
+    def test_clean_at_digit_limit_boundary(self):
+        # a value just under the limit is still accepted
+        digits = sys.get_int_max_str_digits() - 1
+        self.assertEqual(self.widget.clean("9" * digits), int("9" * digits))
+
 
 class ForeignKeyWidgetTest(TestCase, RowDeprecationTestMixin):
     def setUp(self):

django_import_export-4.4.2/django_import_export.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "4.4.2",
-  "distance": 0,
-  "node": "g6c991f2899cc8fcd776de1eb1f8e0b259c439ba0",
-  "dirty": false,
-  "branch": "HEAD",
-  "node_date": "2026-10-15"
-}