From e92e0902caa5976a6132b6d2fc5efbc2eeb0b48c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 3 Apr 2025 08:52:04 +0200 Subject: [PATCH 1/2] Bump flake8 from 7.1.2 to 7.2.0 (#322) Bumps [flake8](https://github.com/pycqa/flake8) from 7.1.2 to 7.2.0.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=flake8&package-manager=pip&previous-version=7.1.2&new-version=7.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- linter-requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linter-requirements.txt b/linter-requirements.txt index f9f720f9..f879331e 100644 --- a/linter-requirements.txt +++ b/linter-requirements.txt @@ -1,5 +1,5 @@ bandit==1.8.3 black==25.1.0 -flake8==7.1.2 +flake8==7.2.0 isort==6.0.1 pydocstyle[toml]==6.3.0 From e5f41e6edba004d35f94915ff5e2559f44853412 Mon Sep 17 00:00:00 2001 From: Johannes Maron Date: Mon, 26 May 2025 14:52:29 +0200 Subject: [PATCH 2/2] Merge commit from fork --- django_select2/forms.py | 4 ++-- tests/test_forms.py | 11 +++++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/django_select2/forms.py b/django_select2/forms.py index 6c5e191e..f94a8c1e 100644 --- a/django_select2/forms.py +++ b/django_select2/forms.py @@ -255,8 +255,6 @@ def __init__(self, attrs=None, choices=(), **kwargs): """ super().__init__(attrs, choices) - self.uuid = str(uuid.uuid4()) - self.field_id = signing.dumps(self.uuid) self.data_view = kwargs.pop("data_view", self.data_view) self.data_url = kwargs.pop("data_url", self.data_url) @@ -275,6 +273,8 @@ def get_url(http://github.com/self): def build_attrs(self, base_attrs, extra_attrs=None): """Set select2's AJAX attributes.""" + self.uuid = str(uuid.uuid4()) + self.field_id = signing.dumps(self.uuid) default_attrs = { "data-ajax--url": self.get_url(), "data-ajax--cache": "true", diff --git a/tests/test_forms.py b/tests/test_forms.py index c42d457f..a2b87522 100644 --- a/tests/test_forms.py +++ b/tests/test_forms.py @@ -359,6 +359,17 @@ def test_theme_setting(self, settings): widget = self.widget_cls(data_view="heavy_data_1") assert 'data-theme="classic"' in widget.render("name", None) + def test_cache_key_leak(self): + bob = self.widget_cls(data_url="/test/") + alice = self.widget_cls(data_url="/test/") + bob.render("name", "value") + bob_key_request_1 = bob._get_cache_key() + alice.render("name", "value") + assert bob._get_cache_key() != alice._get_cache_key() + bob.render("name", "value") + bob_key_request_2 = bob._get_cache_key() + assert bob_key_request_1 != bob_key_request_2 + class TestModelSelect2Mixin(TestHeavySelect2Mixin): form = forms.AlbumModelSelect2WidgetForm(initial={"primary_genre": 1})