summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-11-05Added CVE-2025-64458 and CVE-2025-64459 to security archive.Natalia
2025-11-05Added stub release notes for 5.2.9.Natalia
2025-11-05Refs CVE-2025-64459 -- Avoided propagating invalid arguments to Q on ↵Jacob Walls
dictionary expansion.
2025-11-05Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via the ↵Jacob Walls
_connector kwarg. Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews.
2025-11-05Fixed CVE-2025-64458 -- Mitigated potential DoS in ↵Jacob Walls
HttpResponseRedirect/HttpResponsePermanentRedirect on Windows. Thanks Seokchan Yoon for the report, Markus Holtermann for the triage, and Jake Howard for the review. Follow-up to CVE-2025-27556 and 39e2297210d9d2938c75fc911d45f0e863dc4821.
2025-11-04Fixed #36704 -- Fixed system check error for proxy model with a composite pk.Hal Blackburn
Proxy models subclassing a model with a CompositePrimaryKey were incorrectly reporting check errors because the check that requires only local fields to be used in a composite pk was evaluated against the proxy subclass, which has no fields. To fix this, composite pk field checks are not evaluated against proxy subclasses, as none of the checks are applicable to proxy subclasses. This also has the benefit of not double-reporting real check errors from an invalid superclass pk. Thanks Clifford Gama for the review.
2025-11-04Fixed #36652 -- Increased determinism when loading migrations from disk.Jayden Kneller
Ordering still depends on pkgutil.iter_modules, which does not guarantee order, but at least now Django is not introducing additional indeterminism, causing CircularDependencyError to appear or not appear in some edge cases. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2025-11-04Updated ticket triage process diagram and contributing docs.ontowhee
2025-11-03Fixed #36695 -- Fixed handling of parameterized generics in migration ↵Augusto Pontes
serialization. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2025-10-31Fixed #36661 -- Added introspection of database-level delete options.Mariusz Felisiak
2025-10-31Fixed #36696 -- Fixed NameError when inspecting functions with deferred ↵Patrick Rauscher
annotations. In Python 3.14, annotations are deferred by default, so we should not assume that the names in them have been imported unconditionally.
2025-10-30Added community package storage backends mention to docs.Tim Schilling
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2025-10-30Refs #36680 -- Fixed admin_scripts tests crash when black is not installed.Mariusz Felisiak
Regression in 6436ec321073bf0622af815e0af08f54c97f9b30.
2025-10-29Refs #35381 -- Clarified key and index lookup handling of None in exact ↵Clifford Gama
lookup docs.
2025-10-29Refs #35381 -- Deprecated using None in JSONExact rhs to mean JSON null.Clifford Gama
Key and index lookups are exempt from the deprecation. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2025-10-29Refs #35381 -- Delegated ArrayField element prepping to ↵Clifford Gama
base_field.get_db_prep_save. Previously, ArrayField always used base_field.get_db_prep_value when saving, which could differ from how base_field prepares data for save. This change overrides ArrayField.get_db_prep_save to delegate to the base_field's get_db_prep_save, ensuring elements like None in JSONField arrays are saved correctly as SQL NULL instead of JSON null.
2025-10-29Fixed #35381 -- Added JSONNull() expression.Clifford Gama
Thanks Jacob Walls for the review.
2025-10-29Added stub release notes and release date for 5.2.8, 5.1.14, and 4.2.26.Jacob Walls
2025-10-29Fixed #36329 -- Removed non-code custom link text when cross-referencing ↵Clifford Gama
Python objects. Thanks Bruno Alla, Sarah Boyce, and Jacob Walls for reviews. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2025-10-29Fixed #36678 -- Limited retries in ParallelTestRunner.Jacob Walls
Thanks Natalia Bidart for the review.
2025-10-29Refs #35972 -- Returned params in a tuple in further lookups.Jacob Walls
2025-10-28Reverted "Fixed #26434 -- Removed faulty clearing of ordering field when ↵Jacob Walls
missing from explicit grouping." This reverts commit ea3a71c2d09f8281d8a50ed20e40e1fb13db5cd9. The implementation was flawed, as self.group_by contains Cols, not aliases.
2025-10-28Fixed #36596 -- Made parallel test runner respect django_test_skips and ↵Mariusz Felisiak
django_test_expected_failures.
2025-10-28Fixed #36680 -- Parametrized formatter discovery in AdminScriptTestCase.Jacob Walls
2025-10-27Fixed #26434 -- Removed faulty clearing of ordering field when missing from ↵Michal Mládek
explicit grouping. Co-authored-by: Simon Charette <charette.s@gmail.com>
2025-10-27Fixed #36681 -- Removed English pluralization bias from example in ↵Kasyap Pentamaraju
docs/topics/i18n/translation.txt.
2025-10-27Fixed #36624 -- Dropped support for MySQL < 8.4.Mariusz Felisiak
2025-10-25Fixed #36683 -- Added error message on QuerySet.update() following ↵Matthew Shirley
distinct(*fields).
2025-10-24Fixed #36674 -- Fixed memory leak in select_related().Ken Nzioka
2025-10-24Fixed IntegrityError in bulk_create.tests.BulkCreateTransactionTests due to ↵Natalia
duplicate primary keys. Some tests in BulkCreateTransactionTests were inserting Country objects with hardcoded primary keys, which could conflict with existing rows (if the sequence value wasn't bumped by another test). Updated the tests to dynamically select an unused primary key instead. Thanks to Simon Charette for the exhaustive and enlightening review.
2025-10-23Fixed #35095 -- Clarified Swiss number formatting in ↵Annabelle Wiegart
docs/topics/i18n/formatting.txt. Co-authored-by: Ahmed Nassar <a.moh.nassar00@gmail.com>
2025-10-22Made cosmetic edits to docs/releases/6.0.txt.Natalia
2025-10-22Refs #36664 -- Added Python 3.15 to daily builds.Mariusz Felisiak
2025-10-22Refs #36499 -- Made TestUtilsHtml.test_strip_tags() assume behavior change ↵Mariusz Felisiak
in X.Y.0 version for Python 3.14+. This also removes unsupported versions of Python from the test dict.
2025-10-21Fixed #36677 -- Fixed scheduling of system checks in ParallelTestSuite workers.Jacob Walls
Running system checks in workers must happen after database aliases are set up. Regression in 606fc352799e372928fa2c978ab99f0fb6d6017c.
2025-10-21Made RemoteTestResultTest.test_pickle_errors_detection() compatible with ↵Mariusz Felisiak
tblib 3.2+. tblib 3.2+ makes exception subclasses with __init__() and the default __reduce__() picklable. This broke the test for RemoteTestResult._confirm_picklable(), which expects a specific exception to fail unpickling. https://github.com/ionelmc/python-tblib/blob/master/CHANGELOG.rst#320-2025-10-21 This fix defines ExceptionThatFailsUnpickling.__reduce__() in a way that pickle.dumps(obj) succeeds, but pickle.loads(pickle.dumps(obj)) raises TypeError. Refs #27301. This preserves the intent of the regression test from 52188a5ca6bafea0a66f17baacb315d61c7b99cd without skipping it.
2025-10-21Fixed #36656 -- Avoided truncating async streaming responses in GZipMiddleware.Adam Johnson
2025-10-20Fixed #36470 -- Prevented log injection in runserver when handling NOT FOUND.YashRaj1506
Migrated `WSGIRequestHandler.log_message()` to use a more robust `log_message()` helper, which was based of `log_response()` via factoring out the common bits. Refs CVE-2025-48432. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-10-20Removed duplicate display_raw key in expected data in GeometryWidgetTests.Emmanuel Ferdman
Signed-off-by: Emmanuel Ferdman <emmanuelferdman@gmail.com>
2025-10-20Fixed RelatedGeoModelTest.test_related_union_aggregate() test on Oracle and ↵Mariusz Felisiak
GEOS 3.12+.
2025-10-19Refs #36005 -- Bumped minimum supported versions of docutils to 0.22.Mariusz Felisiak
2025-10-18Fixed #36671 -- Dropped support for SQLite < 3.37.Mariusz Felisiak
2025-10-18Fixed #21961 -- Added support for database-level delete options for ForeignKey.Mariusz Felisiak
Thanks Simon Charette for pair programming. Co-authored-by: Nick Stefan <NickStefan12@gmail.com> Co-authored-by: Akash Kumar Sen <71623442+Akash-Kumar-Sen@users.noreply.github.com> Co-authored-by: Simon Charette <charette.s@gmail.com>
2025-10-17Fixed #36665 -- Improved manager usage guidance in ↵Segni Mekonnen
docs/topics/db/optimization.txt.
2025-10-17Refs #35844 -- Doc'd Python 3.14 compatibility.Mariusz Felisiak
2025-10-17Refs #35844 -- Relaxed GEOSIOTest.test02_wktwriter() test assertion.Mariusz Felisiak
2025-10-17Fixed #36669 -- Doc'd that negative indexes are not supported in F() slices.aj2s
2025-10-16Bumped minimum isort version to 7.0.0.Jacob Walls
Added ignores relating to https://github.com/PyCQA/isort/issues/2352.
2025-10-16Refs #28586 - Copied fetch mode in QuerySet.create().Adam Johnson
This change allows the pattern `MyModel.objects.fetch_mode(...).create(...)` to set the fetch mode for a new object.
2025-10-16Refs #28586 -- Copied fetch modes to related objects.Adam Johnson
This change ensures that behavior and performance remain consistent when traversing relationships.
generated by cgit v1.3 (git 2.53.0) at 2026-07-07 15:31:30 +0000