This update for python3-Django fixes the following issues:

- CVE-2026-15307: server-side file-write and request forgery via spatial lookups (boo#1272997)
- CVE-2026-15337: potential denial-of-service vulnerability in `check_for_language()` (boo#1272998)
- CVE-2026-15830: potential denial-of-service vulnerability via nested geometry collections (boo#1272999)
- CVE-2026-15920: potential cross-site scripting via `URLField` values in the admin (boo#1273000)
- CVE-2026-48588: Potential exposure of private data via cached Set-Cookie response (boo#1271029)
- CVE-2026-53877: Heap buffer over-read in GDALRaster (boo#1271030)
- CVE-2026-6873: Signed cookie salt namespace collision (boo#1267578)
- CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend (boo#1267579)
- CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives (boo#1267580)
- CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization (boo#1267576)
- CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header (boo#1267577)
- CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass (boo#1264153)
- CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST (boo#1264154)
- CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware (boo#1264152)
- CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin (boo#1261731)
- CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable (boo#1261732)
- CVE-2026-33033: Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload (boo#1261722)
- CVE-2026-25674: python-Django: race condition can lead to potential incorrect permissions on newly created file system objects (boo#1259142)
- CVE-2026-1312: Potential SQL injection via QuerySet.order_by and FilteredRelation (boo#1257408)
- CVE-2026-1287: Potential SQL injection in column aliases via control characters (boo#1257407)
- CVE-2026-1207: Potential SQL injection via raster lookups on PostGIS (boo#1257405)
- CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler (boo#1257401)
- CVE-2026-1285: Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods (boo#1257406)
- CVE-2025-13372, CVE-2025-64460: Denial of service in django.core.serializers.xml_serializer.getInnerText() (boo#1254437)
- CVE-2025-64459: Potential SQL injection via `_connector` keyword argument in `QuerySet` and `Q` objects (boo#1252926)
- CVE-2025-59681: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB (boo#1250485)
- CVE-2025-59682: Potential partial directory-traversal via archive.extract() (boo#1250487)
- CVE-2025-57833: Potential SQL injection in FilteredRelation column aliases (boo#1248810)
- CVE-2025-48432: potential log injection via unescaped request path (boo#1244095)

- Let django-admin be the master alternative
  * django-admin.py was dropped in newer releases of Django
  * uninstall the alternatives in postun as is standard in SUSE