Release 3.73.40

Author: pulpbot

CHANGES.md

@@ -8,6 +8,28 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.73.40 (2026-07-20) {: #3.73.40 }
+
+### REST API {: #3.73.40-rest-api }
+
+#### Bugfixes {: #3.73.40-rest-api-bugfix }
+
+- Improved validation of relative paths to prevent a path traversal attack in filesystem exports. (CVE-2026-12701)
+
+### Plugin API {: #3.73.40-plugin-api }
+
+No significant changes.
+
+### Pulp File {: #3.73.40-pulp-file }
+
+No significant changes.
+
+### Pulp Cert Guard {: #3.73.40-pulp-cert-guard }
+
+No significant changes.
+
+---
+
 ## 3.73.39 (2026-07-16) {: #3.73.39 }
 
 ### REST API {: #3.73.39-rest-api }

CHANGES/+fs_export_traversal.bugfix

@@ -6,6 +6,6 @@ class PulpCertGuardPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_certguard.app"
     label = "certguard"
-    version = "3.73.40.dev"
+    version = "3.73.40"
     python_package_name = "pulpcore"
     domain_compatible = True

pulp_certguard/app/__init__.py

@@ -8,6 +8,6 @@ class PulpFilePluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_file.app"
     label = "file"
-    version = "3.73.40.dev"
+    version = "3.73.40"
     python_package_name = "pulpcore"
     domain_compatible = True

pulp_file/app/__init__.py

@@ -245,7 +245,7 @@ class PulpAppConfig(PulpPluginAppConfig):
     label = "core"
 
     # The version of this app
-    version = "3.73.40.dev"
+    version = "3.73.40"
 
     # The python package name providing this app
     python_package_name = "pulpcore"

pulpcore/app/apps.py

@@ -7,7 +7,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = "pulpcore"
-version = "3.73.40.dev"
+version = "3.73.40"
 description = "Pulp Django Application and Related Modules"
 readme = "README.md"
 authors = [
@@ -210,7 +210,7 @@ ignore = [
 [tool.bumpversion]
 # This section is managed by the plugin template. Do not edit manually.
 
-current_version = "3.73.40.dev"
+current_version = "3.73.40"
 commit = false
 tag = false
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<alpha>0a)?(?P<patch>\\d+)(\\.(?P<release>[a-z]+))?"