chore(deps): update dependency django to v5.2.16 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
django (changelog)	5.2.14 → 5.2.15

---

Django fails to prevent reuse of a partially-initialized connection after a failed STARTTLS handshake

CVE-2026-7666 / GHSA-mm6v-q8q9-pgcf

More information

Details

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.

django.core.mail.backends.smtp.EmailBackend in Django fails to prevent reuse of a partially-initialized connection after a failed STARTTLS handshake when fail_silently=True, which allows on-path network attackers to read email content via cleartext interception.

Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Kasper Dupont for reporting this issue.

Severity

• CVSS Score: 2.3 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-7666
• https://docs.djangoproject.com/en/dev/releases/security
• https://groups.google.com/g/django-announce
• https://www.djangoproject.com/weblog/2026/jun/03/security-releases
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2026-200.yaml
• https://github.com/advisories/GHSA-mm6v-q8q9-pgcf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

django/django (django)

v5.2.15

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.