| Age | Commit message (Collapse) | Author |
|---|
|
Refs #37159 -- Documented building release wheel reproducibly.
|
|
Refs #37159 -- Documented building release wheel reproducibly.
|
|
|
|
Thank you to Mike Edmunds for the review.
|
|
Thank you to James Bligh and Tim Schilling for the reviews.
|
|
database-level on_delete.
|
|
|
|
|
|
|
|
Co-authored-by: David Smith <39445562+smithdc1@users.noreply.github.com>
|
|
|
|
|
|
Updated widget templates to render the `hidden` attribute if the input_type
is set to "hidden".
|
|
|
|
|
|
|
|
Applying a transform to an annotation alias in values() crashed with
AttributeError when the annotation's output_field was not attached to a
model:
Book.objects.annotate(published=TruncMonth("pubdate")).values("published__year")
AttributeError: 'DateField' object has no attribute 'model'
Thanks David Smith for offering a useful test case during triage.
Co-authored-by: ontowhee <82607723+ontowhee@users.noreply.github.com>
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
|
|
|
|
This change implements DEP 16: to rename the django-admin command to django.
django-admin is kept as an alias.
Docs references to the "django-admin" command are updated to "django" or
“The django command”.
Renamed the `django-admin` Sphinx directive to `cmd`, and the
`django-admin-option` directive to `cli-option`.
Thanks Johannes Maron, Mike Edmunds, and Jacob Walls for reviews.
|
|
The distapp, geoapp, geogapp, and relatedapp test apps each shipped a
fixture named "initial". Since loaddata loads every match found in
different fixture directories, each test case using fixtures=["initial"]
loaded all four fixtures when the full gis_tests suite ran.
|
|
Avoided preprocessing of raster lookup values, as regardless of the preprocessing
outcome, the result is disallowed.
Larger JSON strings should not incur the extra cost of json.loads().
Thanks David Smith for reviews.
|
|
Thank you Mike Edmunds for the review.
|
|
Since 9158562, Django docs have replaced "new in Django development
version" with Sphinx's standard "added in version ___" change note.
Corrected advice to keep an eye out for the old phrase, and generalized
it to cover any version mismatches.
|
|
for Windows users in docs.
Co-authored-by: Shabir Ahmad Shaik <shabirahmadshaik@gmail.com>
|
|
|
|
|
|
The adapter for psycopg2 serialized None to SQL NULL [1]. This behavior
should be maintained for psycopg3, as psql_escape returns None when no
value remain after escaping and stripping.
Thanks to Camille Daniel for the initial bug report.
[1] https://github.com/psycopg/psycopg2/blob/7d0375492ec3707b82b89f632c9654b400466d86/psycopg/adapter_asis.c#L42-L45
|
|
|
|
CVE-2026-113733, and CVE-2026-114582 to security archive.
|
|
|
|
GDAL 3.9+.
Anything instantating `SpatialReference`, including vector and raster
`transform()` methods and `srs`/`srid` setters, was subject to request
forgery from untrusted strings, since GDAL resolves file and network
references by default.
On GDAL 3.9+, Django now uses `OSRSetFromUserInputEx()` to block file
and network access in this path. On lower GDAL versions, users should
compare inputs to an allow list or use integers when setting or
transforming a spatial reference system (SRS). A new `gis.W001` check
warns if a lower GDAL version is installed.
Thanks Adraca for the report and Sarah Boyce and David Smith for reviews.
|
|
users with custom user models.
Since Django 6.0, the admin obfuscated the password hash only when the
field's model was exactly AUTH_USER_MODEL. Other user models, and user
models inheriting the password field from a concrete parent model,
failed that check, so the full hash was displayed to users with only
the view permission.
Thanks to Aaron chen for the report, and Jake Howard for the review.
|
|
response cache.
When learning the cache key for a response, a missing header must be
cached differently to an empty one, as per RFC 9111.
Thanks to Andrew Gonzalez for the report.
Co-authored-by: Jake Howard <git@theorangeone.net>
|
|
Even though the "crs" member was removed from the GeoJSON spec in 2016,
GDAL's GeoJSON parser still supports this value and can resolve file and
network locations. An attacker could submit a malicious CRS that would
make a network request as the Django process user, or read a file, or
both. Django now rejects these values when constructing geometries and
in forms and lookups. (Utilities for processing trusted data such as
`DataSource` and `LayerMapping` continue to forward these values to GDAL
without validation.)
Any `crs` definition with `"type": "link"` or `"type": "url"` is now
rejected outright. Any definition with `"type": "name"` has its
`properties.name` compared to an allow list of known authorities, or a
regex for an OGC CRS URN, or well-known shorthands, e.g. "CRS84".
Thanks to Submersion Security Research Team for the report, and David
Smith and Sarah Boyce for the reviews.
|
|
BaseGeometryWidget.deserialize().
Suitably crafted values submitted to a GeometryField may have allowed
log injection, potentially corrupting log files, obscuring other
attacks, misleading log post-processing tools, or forging log entries.
To mitigate this, invalid values logged on deserialization errors are
now escaped using "unicode_escape" encoding, and trimmed to 4096
characters to avoid flooding logs with large inputs.
Thanks to Aaron chen for the report, and to Jacob Walls, Jake Howard,
and Shai Berger for the reviews.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
MultiPartParser.
The mitigation for CVE-2026-33033 aligned base64 data to a multiple of
4 by reading whole chunks. As the chunk size is itself a multiple of 4,
those reads never restored the alignment, so a misaligned upload was
read and decoded in full before reaching upload handlers.
Trailing undecoded bytes are now carried over to the next chunk, so no
extra reads are needed and memory use stays bounded by the chunk size.
Thanks to Ignacy Kujawa for the report, and Jake Howard for the review.
|
|
values.
|
|
If a deferred field has been plucked via `refresh_from_db(fields=...)`
or modified by assigning an attribute, it shouldn't be overwritten when
attribute access on a peer triggers a `fetch_many()`.
The peer fetching should also tolerate deleted instances.
Co-authored-by: Vishy <vishyzero@gmail.com>
|
|
prefixes.
|
|
release notes.
|
|
Updated custom djangodocs Sphinx theme to switch to pydata-sphinx-theme
(PST) with minimal customizations:
* Replaced PST's split top/left main nav with single left sidebar main
nav. (Borrowed approach from sphinx-book-theme.)
* Moved `docstitle` from navbar_start (in "logo") to navbar_center, to
avoid wrapping in the header with long development version numbers.
Thanks to Natalia Bidart for review and improvements.
|
|
Starting with Django 2028, DEP 20 changes the Python version support
policy, gives every feature release three years of support, and moves
to calendar versions. Documented these in the Python version FAQ, the
upgrade guide, and the release how-to.
|
|
The target called the lint, black, and spelling subroutines in sequence
and then exited with the status of the last one, so a failure in an
earlier check was printed to the screen but still reported overall
success. It now records each failure and exits non-zero if any check
failed, matching the equivalent `Makefile` target.
Spelling is also run with `-q -W` under `check`, as the `Makefile` does.
|
|
Created a docs_win.yml workflow paralleling docs.yml but on Windows, to
verify the make.bat checks work like their Makefile counterparts.
Used a separate workflow to limit runs to changes that might affect docs
tooling on Windows.
Spelling is not checked on Windows. PyEnchant resolves en_US from the
hunspell dictionary bundled in its own wheel rather than from a system
dictionary, so a Windows run would enforce a different word list than
the one used on Ubuntu.
Thanks to Natalia Bidart for review and improvements.
|
|
Updated fix from commit 8274ae1 to build the path with `os.path.join()`.
Sphinx matches `epub_exclude_files` against OS native paths, so the
hardcoded forward slash never matched on Windows.
|
|
Updated docs `make black` and `make lint` checks to use Sphinx's own
source file discovery to get the list of docs source files. This makes
docs/conf.py the single source of truth for which files are/aren't docs
sources. The exclusions were previously duplicated by hand in Makefile,
make.bat, and lint.py, where they could drift from conf.py.
Created a Python blacken-sources.py wrapper around blacken-docs, similar
to the existing lint.py for sphinx-lint. This replaces shell and batch
file commands that tried (only partially successfully) to replicate
Sphinx's source discovery.
Removed `--jobs 0` from the sphinx-lint arguments to allow parallel
linting, since sphinx-lint treats `--jobs 0` as serial instead of
defaulting to `auto`.
Also added Sphinx to the tox environments running the docs checks, since
neither `blacken-docs` nor `sphinx-lint` depends on Sphinx.
Thanks to Natalia Bidart for review and improvements.
|
|
Regression in 0eec2a163a4b2ea4e82c53ae1d7b71bf43ac911d.
|
|
object key order.
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
|
|
Thank you Mike Edmunds for the review.
|
|
|
