summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
14 hoursRefs #37159 -- Documented building release wheel reproducibly.refs-37159Charles Roelli
38 hoursFixed #37257, Refs #35738 -- Prevented double-dot deprecation warnings for ↵Adam Johnson
template literals. The deprecation warning for double-dot variable lookups checked str(filter_expression.var), which for constants is the resolved literal value rather than a variable lookup. Templates containing string or translated string literals with two consecutive dots, such as {{ "a..b" }} or {{ 'a..b'|upper }}, therefore incorrectly raised a RemovedInDjango70Warning. The check now only applies when the filter expression's variable is a Variable lookup. Regression in 5d911f2d2fecc703be91b2b9b28acc59d34b35f3.
5 daysRefs #36905 -- Corrected safe param in JSONResponse signature in docs.Aslan Osmanov
The docstring and reference documentation still described the safe parameter as defaulting to True after its deprecation. Follow-up to 6e15ac8066312328de279e3e072667416c205bfc.
5 daysDocumented additional caveats for inspectdb.Clifford Gama
6 daysFixed #37196 -- Documented SimpleTestCase.async_client_class and ↵VIZZARD-X
async_client in testing tools.
6 daysFixed #29969 -- Omitted inlines without add permission on save-as-new.Jakob Friedrich
6 daysAdded stub release notes for 6.1.1.Jacob Walls
6 daysFinalized release notes for Django 6.1.Jacob Walls
6 daysUpdated translations from Transifex.Jacob Walls
Forwardport of c58d86162cd59602df96f0e716cae9849acb3ddb from stable/6.1.x.
6 daysAdded missing lang override in translation fetching helper for Serbian ↵Jacob Walls
(Latin script).
7 daysFixed #37224 -- Skipped questioner for field changes on unmanaged models.Vishy
7 daysFixed #37205 -- Asserted exact HttpResponse types in tests.Jonathan Biemond
assertIsInstance passes when the expected is a superclass of the returned object. Thanks James Bligh for the review!
7 daysFixed #37239 -- Cleared stale db_default when pk comes from related object.Jacob Walls
7 daysRefs #36735 -- Added DatabaseFeatures.supports_uuid4_function_in_default ↵Jacob Walls
feature flag. Oracle 23.9 supported UUID() in SELECT contexts, but use in column defaults fails until 23.26.2.0 with: django.db.utils.DatabaseError: ORA-04044: procedure, function, package, or type is not allowed here
8 daysAdded CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, and CVE-2026-15920 to ↵Natalia
security archive.
8 daysFixed CVE-2026-15920 -- Made display_for_field() validate URLs before ↵Natalia
rendering admin links. The admin renders URLField values as clickable links on changelists and read-only change forms. The link was built without validating the URL, so a potentially dangerous stored value could be rendered as a link that runs script in a staff member's authenticated session when clicked. The admin renders URLField values as clickable links on changelists and read-only change forms. The link was built without validating the URL, so a stored value using a potentially dangerous value was rendered as a link, which could lead to cross-site scripting in an authenticated admin session. Refs CVE-2019-12308, #36032. Thanks to Egor Saltykov for the report, and Sarah Boyce for reviews.
8 daysFixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry collections.Jacob Walls
Since deeply nested geometry collections can lead to fatal errors in GEOS, a new `max_geom_collections` argument on geometry model and form fields, passed down to `GEOSGeometry` itself, allows limiting either depth (WKT) or total number (WKB) before reaching GEOS. Thanks Andrew MacPherson and kimchunbok_ for the reports, and Natalia Bidart, Simon Charette, and Sarah Boyce for reviews.
8 daysFixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language().Natalia
Language codes longer than 500 characters are now rejected before the cached lookup, so they are no longer retained as cache keys consuming memory from each process. Thanks Jaeyoung Jang for the report, and Sarah Boyce for reviews.
8 daysFixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial lookups.Jacob Walls
Spatial lookups optimistically parse values as rasters before retrying as geometries. If a malicious value reached the GDALRaster constructor, depending on the raster driver, it might write to disk or fetch from the network regardless of the constructor's `write=False` default argument. Although this works as designed for model field assignment, this is potentially unexpected for querying, for example, in the admin's changelist view, which allows staff users to execute arbitrary lookups on models registered with the admin. Network rasters didn't even work in lookup contexts before, providing further evidence that this use case was unintentional. (The failure point was after the fetching, however.) Now, strings and dicts representing rasters are rejected by spatial lookups. To opt in to using them, wrap them in a `GDALRaster` first. Although it would simplify the implementation to try geometries before rasters (instead of stashing a raster exception and raising it later), we maintain the current order, which has been stable for a decade. Thanks Bence Nagy, localhost-detect, and kimchunbok_ for providing information useful in evaluating this report. Thanks Simon Charette, Natalia Bidart, and Sarah Boyce for reviews.
9 daysAdded free-threaded Python 3.14t to PostGIS CI workflow.David Smith
9 daysFixed #37069 -- Clarified that UniqueConstraint may create a unique index.Clifford Gama
Thanks Jacob for the triage and James for the review.
9 daysRefs #28586 -- Renamed RAISE fetch mode to FETCH_RAISE.Jacob Walls
This aims for consistency in the django.db.models namespace. Thanks Natalia Bidart and Simon Charette for the idea.
9 daysFixed #36770 -- Fixed incomplete mocking in SQLiteInMemoryTestDbs.Jacob Walls
Without also mocking the global settings, there was pollution of the test database name, since create_test_db() writes like so: self.connection.settings_dict["NAME"] = test_database_name This caused other tests that explicitly reopen database connections to fail under parallel test execution (in forkserver mode) because at the moment of reopening, the db name was `memorydb_default` rather than the suffixed version `memorydb_default_3`: backends.sqlite.tests.ThreadSharing.test_database_sharing_in_threads servers.tests.LiveServerInMemoryDatabaseLockTest.test_in_memory_database_lock
9 daysFixed #37242 -- Fixed reading null time fields in LayerMapping.Jacob Walls
Follow-up to 75d627888bf42f8de6064a0bd665c98c0df66c55.
11 daysFixed #36626 -- Preserved milliseconds in DataSource time fields.Francesco Bruni
12 daysFixed #37236 -- Allowed altering spatial indexes on RasterField.Mariano Baragiola
12 daysFixed #27734 -- Made parallel test workers reuse database clones of exited ↵Ahmed Mohamed
workers. This prevents newly spawned workers from attempting to access nonexistent clones. Thanks James Bligh for the review.
12 daysRemoved advice to include ticket numbers in tests.Jacob Walls
12 daysRefs #37139 -- Doc'd _is_pk_set() handling of DatabaseDefault.Jacob Walls
12 daysFixed #37238 -- Prevented fallback to python default for a pk with a db_default.Jacob Walls
Regression in a2348c85fc6c20087935c74cd99340dd4ef2dcdc.
12 daysFixed #37235 -- Added compatibility for sqlparse 0.5.5.Sarah Boyce
Thank you to Jacob Walls and Nick Pope for the review.
12 daysFixed #37240 -- Fixed simplify_regex() with multiple unnamed groups.SEPURI-SAI-KRISHNA
12 daysUpdated asgiref dependency in free-threaded requirements.Jacob Walls
Follow-up to 0bba6363b0ecf3426defbdada17c5efbd51a77c8.
13 daysFixed PR number lookup in coverage comment workflow.Jacob Walls
This didn't handle cross-fork PRs correctly. Follow-up to a959c2596f8a1d1ef9f321b8b227a399e86409e2.
13 daysFixed #37111 -- Added sprints quickstart docs page.Tim Schilling
Added a documentation page that contains a concise set of guidelines to help new contributors be more effective at sprints or other events with in-person Django contributors. Included a pair of links on how to filter down tickets, which calls out adding the additional columns and filtering to docs components, and a internal reference link for django-docker-box. Thanks Annabelle Wiegart, Natalia Bidart, Paolo Melchiorre, Jacob Walls, and Tim Mccurrachd for reviews. Co-authored-by: tim-mccurrach <34194722+tim-mccurrach@users.noreply.github.com> Co-authored-by: nessita <124304+nessita@users.noreply.github.com>
13 daysRefs #28586 -- Doc'd fetch_mode attribute on ModelState.Jacob Walls
13 daysRefs #12227 -- Added test for PREPEND_WWW redirect following in test client.anurag629
13 daysRefs #28586 -- Added coverage for from_queryset's fetch mode in ↵Jacob Walls
refresh_from_db().
13 daysFixed #37234 -- Fixed bulk_create() for late-saved related primary keys.Filip Sedlák
Objects with a primary key supplied by a late-saved related instance were partitioned before their related fields were prepared. This caused an assertion failure on backends returning rows from bulk inserts. Regression in 7d9aab8da0a06787d649762a702e1a518d843a63.
14 daysFixed #27752 -- Fixed ordering by Model.__str__ in the admin.VIZZARD-X
Co-authored-by: blighj <blighj@users.noreply.github.com>
14 daysFixed #37194 -- Removed redundant choice widget documentation.maheen8q
The removed section primarily provided usage examples and recommendations rather than documenting the widget API. The interaction between a choice field and its widget is already documented in the Select.choices reference.
14 daysRemoved PR number artifact from coverage comment workflows.Jacob Walls
Retrieving the PR number directly instead of from an artifact prevents it from being spoofed. Thanks Sarah Boyce for the review.
14 daysFixed #37233 -- Prevented sort controls for unordered __str__ admin columns.Akshat Sparsh
2026-07-28Allowed the full Python test matrix to run on GitHub Actions.Natalia
2026-07-28Fixed #37230 -- Fixed a crash for second-degree relations in ↵Zubair Hassan
ModelAdmin.list_display. Thanks Rob Kuipers for the report. Regression in 4b2b4bf0ac2707dc9c4d51cabfa72168eaea95fe. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2026-07-28Added stub release notes and release date for 6.0.8 and 5.2.17.Natalia
2026-07-28Bumped minimum setuptools version to 83.Jacob Walls
2026-07-27Refs #22712 -- Restored django.contrib.staticfiles.finders.BaseFinder.find().Nick Pope
This was overzealously removed in a146fe293099d7f860ba13e4b3a571bbda55af22.
2026-07-27Fixed #37198 -- Fixed content_disposition_header() quoting of filenames ↵Vishy
ending with newlines.
2026-07-27Fixed #20023 -- Added custom validation example for admin inlines.Joseano Sousa
Thank you to James Bligh and Sarah Boyce for the review.
generated by cgit v1.3 (git 2.53.0) at 2026-08-12 04:00:49 +0000