Stole the Makefile for building packages from master.
[1.4.x] Removed 1.5.2 release notes
Bump version post-release.
Fixed regression in validation tests since example.com is available via https now.
[1.4.x] Fixed #20905 -- Fixed an Oracle-specific test case failure

Made a test checking ORM-generated query string case-insensitive.

Backport of ee0a7c741e from master
[1.4.x] Fixed #20906 -- Fixed a dependence on set-ordering in tests

Backport of 1ae64e96c1 from master
[1.4.x] Fixed #20904: Test failure on Oracle
Just skip the failing test, the failure isn't really relevant; also,
both the test and the reason for its failure were removed in 1.5.

Thanks Tim Graham for advice on 1.5.
[1.4.x] Fixed #20907 - Test failure on Oracle

Backport of the Oracle-specific part of commit a18e43c5bb8cb7c82
from master. This commit made get_indexes more consistent across
backends.

Thanks Tim Graham for pointer to the commit, akaariai and ikelly
for the original commit.
[1.4.x] Fixed #20707 -- Added explicit quota assignment to Oracle test user
To enable testing on Oracle 12c
[1.4.x] Prevented arbitrary file inclusion with {% ssi %} tag and relative paths.

Thanks Rainer Koirikivi for the report and draft patch.

This is a security fix; disclosure to follow shortly.

Backport of 7fe5b656c9 from master
Added 1.4.7 release notes

Backport of baec6a26dd from master
[1.4.x] Bump version numbers for 1.4.7 security release.
Fixed failing test introduced by 87d2750b39.

The {% ssi %} tag in Django 1.4 doesn't support spaces in its argument.
Skip the test if run from a location that contains a space.
[1.4.x] Bump version post-release.
Merge pull request #1616 from loic/fix1.4

Fixed failing test introduced by 87d2750b39.
[1.4.x] Fixed #20887 -- Added a warning to GzipMiddleware in light of BREACH.

Thanks EvilDMP for the report and Russell Keith-Magee
for the draft text.

Backport of da843e7dba from master
Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.auth

Thanks Collin Anderson for the report.

Backport of 425d076d0c from master
[1.4.x] Ensure that passwords are never long enough for a DoS.

 * Limit the password length to 4096 bytes
  * Password hashers will raise a ValueError
  * django.contrib.auth forms will fail validation
 * Document in release notes that this is a backwards incompatible change

Thanks to Josh Wright for the report, and Donald Stufft for the patch.

This is a security fix; disclosure to follow shortly.

Backport of aae5a96d5754ad34e48b7f673ef2411a3bbc1015 from master.
[1.4.x] Add release notes and bump version numbers for 1.4.8 security release.
[1.4.x] Removed usage of b"" string syntax for Python 2.5 compatibility.

Refs commit 3f3d887a6844ec2db743fee64c9e53e04d39a368.