django.git, branch 5.2.8

[5.2.x] Bumped version for 5.2.8 release.

2025-11-05T12:35:08Z

[5.2.x] Refs CVE-2025-64459 -- Avoided propagating invalid arguments to Q on dictionary expansion.

2025-11-05T12:33:29Z

Backport of 3c3f46357718166069948625354b8315a8505262 from main.

[5.2.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via the _connector kwarg.

2025-11-05T12:33:15Z

Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.

[5.2.x] Fixed CVE-2025-64458 -- Mitigated potential DoS in HttpResponseRedirect/HttpResponsePermanentRedirect on Windows.

2025-11-05T12:32:59Z

Thanks Seokchan Yoon for the report, Markus Holtermann for the triage, and Jake Howard for the review. Follow-up to CVE-2025-27556 and 39e2297210d9d2938c75fc911d45f0e863dc4821. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.

[5.2.x] Fixed #36704 -- Fixed system check error for proxy model with a composite pk.

2025-11-04T17:00:58Z

Proxy models subclassing a model with a CompositePrimaryKey were incorrectly reporting check errors because the check that requires only local fields to be used in a composite pk was evaluated against the proxy subclass, which has no fields. To fix this, composite pk field checks are not evaluated against proxy subclasses, as none of the checks are applicable to proxy subclasses. This also has the benefit of not double-reporting real check errors from an invalid superclass pk. Thanks Clifford Gama for the review. Backport of 74564946c3b42a2ef7d087047e49873847a7e1d9 from main.

[5.2.x] Fixed #36696 -- Fixed NameError when inspecting functions with deferred annotations.

2025-10-31T12:47:32Z

In Python 3.14, annotations are deferred by default, so we should not assume that the names in them have been imported unconditionally.

[5.2.x] Added stub release notes and release date for 5.2.8, 5.1.14, and 4.2.26.

2025-10-29T18:00:08Z

Backport of ab108bf94dfc06c311d7dc81866b848fe5b5ee6c from main.

[5.2.x] Fixed #36681 -- Removed English pluralization bias from example in docs/topics/i18n/translation.txt.

2025-10-27T18:43:40Z

Backport of 0ea01101c3a35568bc43e9707ac058b9874bd425 from main.

[5.2.x] Fixed #35095 -- Clarified Swiss number formatting in docs/topics/i18n/formatting.txt.

2025-10-23T14:14:20Z

Co-authored-by: Ahmed Nassar Backport of 74239181252ca73bebb84789856f5d8937d421b4 from main.

[5.2.x] Made RemoteTestResultTest.test_pickle_errors_detection() compatible with tblib 3.2+.

2025-10-22T02:14:05Z

tblib 3.2+ makes exception subclasses with __init__() and the default __reduce__() picklable. This broke the test for RemoteTestResult._confirm_picklable(), which expects a specific exception to fail unpickling. https://github.com/ionelmc/python-tblib/blob/master/CHANGELOG.rst#320-2025-10-21 This fix defines ExceptionThatFailsUnpickling.__reduce__() in a way that pickle.dumps(obj) succeeds, but pickle.loads(pickle.dumps(obj)) raises TypeError. Refs #27301. This preserves the intent of the regression test from 52188a5ca6bafea0a66f17baacb315d61c7b99cd without skipping it. Backport of 548209e620b3ca34396a360453f07c8dbb8aa6c7 from main.