Bump the production-version-updates group with 2 updates

[dependabot]

Bumps the production-version-updates group with 2 updates: django and asgiref.

Updates django from 6.0.1 to 6.0.2

Commits

• ba00558 [6.0.x] Bumped version for 6.0.2 release.
• 259dff0 [6.0.x] Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases...
• 15e70cb [6.0.x] Fixed CVE-2026-1312 -- Protected order_by() from SQL injection via al...
• 0c0f5c2 [6.0.x] Fixed CVE-2026-1287 -- Protected against SQL injection in column alia...
• 4b86ba5 [6.0.x] Fixed CVE-2026-1285 -- Mitigated potential DoS in django.utils.text.T...
• 8f77e73 [6.0.x] Fixed CVE-2026-1207 -- Prevented SQL injections in RasterField lookup...
• 972dbdd [6.0.x] Fixed CVE-2025-14550 -- Optimized repeated header parsing in ASGI req...
• d72cc3b [6.0.x] Fixed CVE-2025-13473 -- Standardized timing of check_password() in mo...
• d64ef24 [6.0.x] Refs #36788 -- Added missing CSS selector for fieldsets in the admin.
• f9bfb52 [6.0.x] Fixed #36788 -- Fixed horizontal form field alignment under <fieldset...
• Additional commits viewable in compare view

Updates asgiref from 3.11.0 to 3.11.1

Changelog

Sourced from asgiref's changelog.

3.11.1 (2026-02-03)

• SECURITY FIX CVE-2025-14550: There was a potential DoS vector for users of the asgiref.wsgi.WsgiToAsgi adapter. Malicious requests, including an unreasonably large number of values for the same header, could lead to resource exhaustion when building the WSGI environment.

  To mitigate this, the algorithm is changed to be more efficient, and WsgiToAsgi gains a new optional duplicate_header_limit parameter, which defaults to 100. This specifies the number of times a single header may be repeated before the request is rejected as malformed.

  You may override duplicate_header_limit when configuring your application::

  application = WsgiToAsgi(wsgi_app, duplicate_header_limit=200)
  

  Set duplicate_header_limit=None if you wish to disable this check.

• Fixed a regression in 3.11.0 in sync_to_async when wrapping a callable with an attribute named context. (#537)

Commits

• d97a733 Releasing 3.11.1.
• a50968a CVE-2025-14550: Fixed duplicate header handling in WsgiToAsgi.
• 0fb85a4 Fixed sync_to_async wrapping callables with attribute named context.
• 2b28409 Updated Hypercorn homepage URL (#539)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions