django.git, branch 5.2.1

[5.2.x] Bumped version for 5.2.1 release.

2025-05-07T01:26:17Z

[5.2.x] Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags().

2025-05-07T01:24:24Z

Thanks to Elias Myllymäki for the report, and Shai Berger and Jake Howard for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 9f3419b519799d69f2aba70b9d25abe2e70d03e0 from main.

[5.2.x] Simplified artifact building steps in docs/internals/howto-release-django.txt.

2025-05-06T14:13:07Z

With the recent merge of artifact build updates from https://github.com/django/django/pull/19436, there is no need to have different build instructions for 4.2. Backport of f7d97dd11819be8996798a7197c5695a317334a0 from main.

[5.2.x] Refs #36052, #32234 -- Fixed inspectdb tests for CompositePrimaryKey on Oracle.

2025-05-06T06:21:32Z

Tests regression in 4c75858135589f3a00e32eb4d476074536371a32. Backport of dd133054cb98f77577c06d7ef1f2391a865784bc from main

[5.2.x] Fixed #17461 -- Doc'd the presumed order of foreign keys on the intermediary model of a self-referential m2m.

2025-05-02T07:02:16Z

Thanks Giannis Terzopoulos and Sarah Boyce for the reviews. Backport of 9d93e35c207a001de1aa9ca9165bdec824da9021 from main.

[5.2.x] Made cosmetic edits and added upcoming security release to release notes.

2025-04-30T17:56:07Z

Backport of 0f5dd0dff3049189a3fe71a62670b746543335d5 from main.

[5.2.x] Fixed #36357 -- Skipped unique_together in inspectdb output for composite primary keys.

2025-04-30T14:55:56Z

Thanks to Baptiste Mispelon for the report and quick fix, and to Simon Charette and Jacob Walls for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 66f9eb0ff1e7147406318c5ba609729678e4e6f6 from main.

[5.2.x] Fixed #36358 -- Corrected introspection of composite primary keys on SQLite.

2025-04-30T13:54:17Z

Previously, any first field of a composite primary key with type `INTEGER` was incorrectly introspected as an `AutoField` due to SQLite treating `INTEGER PRIMARY KEY` as an alias for the `ROWID`. This change ensures that integer fields in composite PKs are not mistaken for auto-incrementing fields. Thanks Jacob Walls and Sarah Boyce for the reviews. Backport of 07100db6f46255ec6ef70b860495f977473684d6 from main.

[5.2.x] Refs #36052, #32234 -- Removed create_test_table_with_composite_primary_key flag in favor of using CompositePrimaryKey.

2025-04-30T13:53:39Z

Now that Django properly supports creating models with composite primary keys, the tests should use a `CompositePrimaryKey` field instead of a feature flag to inline backend specific SQL for creating a composite PK. Specifcially, the inspectdb's test_composite_primary_key was adjusted to use schema editor instead of per-backend raw SQL. Backport of 4c75858135589f3a00e32eb4d476074536371a32 from main.

[5.2.x] Fixed #36360 -- Fixed QuerySet.update() crash when referring annotations through values().

2025-04-30T09:39:37Z

The issue was only manifesting itself when also filtering againt a related model as that forces the usage of a subquery because SQLUpdateCompiler doesn't support the UPDATE FROM syntax yet. Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Refs #28900. Thanks Gav O'Connor for the detailed report. Backport of 8ef4e0bd423ac3764004c73c3d1098e7a51a2945 from main.