chango.git, branch 5.2.7

[5.2.x] Bumped version for 5.2.7 release.

2025-10-01T12:26:54Z

[5.2.x] Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal via archive.extract().

2025-10-01T12:25:20Z

Thanks stackered for the report. Follow up to 05413afa8c18cdb978fcdf470e09f7a12b234a23. Backport of 924a0c092e65fa2d0953fd1855d2dc8786d94de2 from main.

[5.2.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB.

2025-10-01T12:24:18Z

Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.

[5.2.x] Made cosmetic edits to 5.2.7 release notes.

2025-09-30T20:34:43Z

Backport of 6c82b0bc91fc650891b0b411ac4a5a86cf0cf3e8 from main.

[5.2.x] Fixed #36587 -- Clarified usage of `list.insert()` for upload handlers.

2025-09-29T12:51:44Z

Thanks Baptiste Mispelon for the report Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of afe6634146d0fe70498976c49d2eb4d745aa9064 from main.

[5.2.x] Fixed #35877, Refs #36128 -- Documented unique constraint when migrating a m2m field to use a through model.

2025-09-29T07:00:19Z

Backport of daba609a9bdc7a97bcf327c7ba0a5f7b3540b46e from main.

[5.2.x] Added stub release notes and release date for 5.2.7, 5.1.13, and 4.2.25.

2025-09-24T15:41:04Z

Backport of 00174507f8a91e9577ae233c58af561b379f2695 from main.

[5.2.x] Refs #25508 -- Used QuerySet.repr in docs/ref/contrib/postgres/search.txt.

2025-09-23T14:09:18Z

Backport of efb96138b4af774c22ae6e949410b45d69960357 from main.

[5.2.x] Fixed #36581 -- Updated serialization examples from XML to JSON.

2025-09-18T13:47:20Z

Backport of 762d3be8c559b0abf415be8d6117f04fb6347983 from main.

[5.2.x] Updated translations from Transifex.

2025-09-18T12:50:46Z