django.git/docs/releases/5.2.3.txt, branch main

Fixed #36446 -- Restored "q" in internal MediaType.params property.

2025-06-09T20:37:40Z

The "q" key was removed while addressing ticket #36411. Despite `MediaType.params` is undocumented and considered internal, it was used in third-party projects (Zulip reported breakage), so this work restored the `q` key in `params`. Thanks Anders Kaseorg for the report. Regression in c075508b4de8edf9db553b409f8a8ed2f26ecead.

Fixed #36419 -- Ensured for_save was propagated when resolving expressions.

2025-06-06T15:40:35Z

The for_save flag wasn't properly propagated when resolving expressions, which prevented get_db_prep_save() from being called in some cases. This affected fields like JSONField where None would be saved as JSON null instead of SQL NULL. Regression in 00c690efbc0b10f67924687f24a7b30397bf47d9. Thanks to David Sanders and Simon Charette for reviews. Co-authored-by: Adam Johnson

Refs CVE-2025-48432 -- Prevented log injection in remaining response logging.

2025-06-06T12:05:32Z

Migrated remaining response-related logging to use the `log_response()` helper to avoid potential log injection, to ensure untrusted values like request paths are safely escaped. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Updated translations from Transifex.

2025-06-06T11:57:27Z

Forwardport of 5901cfe591139b4389171ba738be81e8f4d5cfc9 from stable/5.2.x.

Added stub release notes for 5.2.3.

2025-06-04T13:55:33Z