django.git/docs/topics/serialization.txt, branch main

Refs #36769 -- Raised SuspiciousOperation for unexpected nested tags in XML Deserializer.

2026-01-12T21:38:32Z

Thanks Shai Berger and Natalia Bidart for reviews.

Fixed #35729 -- Enabled natural key serialization opt-out for subclasses.

2025-12-03T20:04:52Z

Refactored serialization logic to allow models inheriting a natural_key() method (e.g. AbstractBaseUser) to explicitly opt out of natural key serialization by returning an empty tuple from the method. Thanks Jonas Dittrich for the report. Co-authored-by: Jacob Walls

Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation in XML serializer.

2025-12-02T12:21:07Z

Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Fixed #36581 -- Updated serialization examples from XML to JSON.

2025-09-18T13:44:05Z

Removed versionadded/changed annotations for 5.2.

2025-09-17T18:17:05Z

Refs #36485 -- Rewrapped docs to 79 columns line length.

2025-08-25T13:51:10Z

Lines in the docs files were manually adjusted to conform to the 79 columns limit per line (plus newline), improving readability and consistency across the content.

Fixed #29522 -- Refactored the Deserializer functions to classes.

2024-09-17T09:00:49Z

Co-authored-by: Emad Mokhtar

Fixed #34140 -- Reformatted code blocks in docs with blacken-docs.

2023-03-01T12:03:56Z

Refs #34140 -- Corrected rst code-block and various formatting issues in docs.

2023-02-28T11:21:37Z

Refs #34140 -- Applied rst code-block to non-Python examples.

2023-02-10T18:19:13Z

Thanks to J.V. Zammit, Paolo Melchiorre, and Mariusz Felisiak for reviews.