Bump django-filer from 3.5.0 to 3.5.1

[dependabot]

Bumps django-filer from 3.5.0 to 3.5.1.

Release notes

Sourced from django-filer's releases.

3.5.1

What's Changed

• fix: Made mime type detection consistent for up- and download by @​fsbraun in django-cms/django-filer#1610
• fix: Check read permissions in admin icon view and change views by @​fsbraun in django-cms/django-filer#1613
• chore: Add tests for filer tags, views and fix whitespace/truncate by @​fsbraun in django-cms/django-filer#1607
• ci: pre-commit autoupdate by @​pre-commit-ci[bot] in django-cms/django-filer#1608
• chore(deps-dev): bump ip-address from 10.0.1 to 10.4.0 by @​dependabot[bot] in django-cms/django-filer#1612
• chore(deps): bump socket.io-parser from 4.2.4 to 4.2.7 by @​dependabot[bot] in django-cms/django-filer#1611

Full Changelog: django-cms/django-filer@3.5.0...3.5.1

Changelog

Sourced from django-filer's changelog.

3.5.1 (2026-08-26)

• fix: FileAdmin.icon_view() did not check read permissions. Any staff user could enumerate file ids to obtain the name and private storage path of images in folders they have no read permission on (reported by Denny).
• fix: The file and folder admin change views only consulted the global Django model permissions, which are not folder aware. Any staff user holding filer.change_file could open the change view of a file in a folder they have no read permission on.
• fix: Upload validators could be bypassed by declaring an unknown Content-Type, allowing stored XSS (reported by Miguel Rafael Martín de Nicolás Acedo). The MIME type of an upload is now always derived from the file name, never from the client-supplied Content-Type.
• fix: The AJAX upload endpoint no longer is @csrf_exempt and now requires a staff user. The bundled uploaders send the X-CSRFToken header.
• fix: A malformed MIME type without a slash no longer raises an error, and upload errors return a JSON error response instead of an HTTP 500.
• fix: A failed upload now answers with a 4xx/5xx status code instead of HTTP 200, so that uploaders and proxies can tell a rejected upload from an accepted one. The bundled uploaders report the server's error message accordingly.
• fix: The AJAX upload endpoint no longer echoes internal exception text back to the client; unexpected failures are logged instead.
• chore: Add tests for filer tags, views and fix whitespace/truncate by @​fsbraun in django-cms/django-filer#1607
• chore: Let ruff sort imports, matching the isort configuration by @​fsbraun
• ci: Replace flake8 and isort with ruff, which already runs as a pre-commit hook. tox -e flake8 and tox -e isort become tox -e ruff.
• ci: pre-commit autoupdate by @​pre-commit-ci[bot] in django-cms/django-filer#1608

.. warning::

Uploads whose file extension is unknown to Python's mimetypes module are now treated as application/octet-stream and are rejected by the default validators. Register additional extensions with mimetypes.add_type() if you need them.

Custom uploaders posting to filer-ajax_upload must now send a CSRF token and authenticate as a staff user. They also need to handle non-2xx responses: a rejected upload is answered with HTTP 400 (or 403 for a permission problem) carrying the {"error": ...} body that was previously returned with HTTP 200.

Commits

• 82aae5e chore: Prepare release 3.5.1 (#1614)
• a815ef4 fix: Check read permissions in admin icon view and change views (#1613)
• 531110d fix: Made mime type detection consistent for up- and download (#1610)
• 43557bd chore(deps): bump socket.io-parser from 4.2.4 to 4.2.7 (#1611)
• 23af9b2 chore(deps-dev): bump ip-address from 10.0.1 to 10.4.0 (#1612)
• 29cd537 ci: pre-commit autoupdate (#1608)
• 22c7abc chore: Add tests for filer tags, views and fix whitespace/truncate (#1607)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)