django.git, branch 4.2.27

[4.2.x] Bumped version for 4.2.27 release.

2025-12-02T12:45:57Z

[4.2.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation in XML serializer.

2025-12-02T12:44:40Z

Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.

[4.2.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL injection in column aliases on PostgreSQL.

2025-12-02T12:44:19Z

Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews. Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.

[4.2.x] Added script to archive EOL stable branches.

2025-11-26T23:08:24Z

This also fixed a small bash issue in `confirm_release.sh` script. Backport of 532c1058a7dd2616181259c94eb92f2477038d2c from main.

[4.2.x] Refs #36743 -- Added missing release notes for 5.1.15 and 4.2.27.

2025-11-26T23:04:08Z

The fix landed in a8cf8c292cfee98fe6cc873ca5221935f1d02271 will be backported to 5.1 and 4.2 since the 2048 limit was rolled out as part of the security release for CVE-2025-64458. Backport of 18b13cf6c48ff0a20b2a74d3b90d1fc1602608e4 from main.

[4.2.x] Fixed #36743 -- Increased URL max length enforced in HttpResponseRedirectBase.

2025-11-26T20:31:17Z

Refs CVE-2025-64458. The previous limit of 2048 characters reused the URLValidator constant and proved too restrictive for legitimate redirects to some third-party services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH` constant (defaulting to 16384) and uses it in HttpResponseRedirectBase. Thanks Jacob Walls for report and review. Backport of a8cf8c292cfee98fe6cc873ca5221935f1d02271 from main.

[4.2.x] Added timeout-minutes directive to all GitHub Actions workflows.

2025-11-26T13:05:32Z

GitHub Actions defaults to a 360-minute (6-hour) timeout. We've had jobs hang due to issues in the parallel test runner, causing them to run for the full 6 hours. This wastes resources and negatively impacts CI availability, so explicit timeouts have been added to prevent long-running hangs. Backport of e48527f91d341c85a652499a5baaf725d36ae54f from main.

[4.2.x] Added stub release notes and release date for 4.2.27.

2025-11-25T18:21:18Z

Backport of d62e811acfc6a056e847bfcc460092a98511ed00 from main.

[4.2.x] Configured dangerous-triggers zizmor rule.

2025-11-21T20:06:02Z

Backport of 846613e521104fa2f2e1c2023e4a1a9886a2ff48 from main.

[4.2.x] Addressed unpinned-uses zizmor finding.

2025-11-21T20:01:37Z

Backport of 86b8058b40145fb5ba4fd859676225f533eca986 from main.