summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-03-13Fixed #36966 -- Fixed ValueError when `query_params` and `follow` are used ↵Marc Gibbons
on test client.
2026-03-13Fixed #36885 -- Fixed long verbose names in admin filter sidebar breaking ↵Muhammad Usman
layout.
2026-03-13Refs #36735 -- Adjusted UUID7 assertions for timezone shifts.Mariusz Felisiak
Thanks Simon Charette and Jacob Walls for reviews.
2026-03-12Refs #36727 -- Factored out _must_transform_value() in BaseSpatialOperations.Simon Charette
2026-03-12Fixed #36727 -- Deprecated Field.get_placeholder in favor of ↵Simon Charette
get_placeholder_sql. The lack of ability of the get_placeholder call chain to return SQL and parameters separated so they can be mogrified by the backend at execution time forced implementations to dangerously interpolate potentially user controlled values. The get_placeholder_sql name was chosen due to its proximity to the previous method, but other options such as Field.as_sql were considered but ultimately rejected due to its different input signature compared to Expression.as_sql that might have lead to confusion. There is a lot of overlap between what Field.get_db_prep_value and get_placeholder_sql do but folding the latter in the former would require changing its return signature to return expression which is a way more invasive change than what is proposed here. Given we always call get_db_prep_value it might still be an avenue worth exploring in the future to offer a publicly documented interface to allow field to take an active part in the compilation chain. Thanks Jacob for the review.
2026-03-12Encapsulated loop logic to avoid leaking module-level variables.Emmanuel Ferdman
2026-03-12Discouraged automated AI reviews of pull requests.Natalia
Some contributors have been requesting Copilot reviews on pull requests submitted to the Django repository. These automated reviews add noise to the PR history, making it harder to follow the discussion, and Django does not incorporate them into its review process. This change discourages the practice by: - Adding a `copilot-instructions.md` file instructing Copilot to decline review requests in this repository. - Adding a checklist item to the PR template asking contributors not to request automated AI reviews for their PR. - Documenting the policy in the contributing guidelines.
2026-03-11Refs #28455 -- Avoided QuerySet cloning for Prefetch() when queryset is not ↵Keryn Knight
provided. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2026-03-11Refs #28455 -- Avoided QuerySet cloning in simple prefetch_related() usages.Keryn Knight
manager.get_queryset() always returns freshly instantiated per-instance QuerySet which doesn't need subsequent cloning. Based on work originally done by Anssi Kääriäinen and Tim Graham.
2026-03-11Refs #28455 -- Implemented private API methods for preventing QuerySet cloning.Keryn Knight
Multiple calls are idempotent assuming they're balanced. Also, multiple calls to disable cloning followed by a single call to re-enable cloning will subsequently cause clones to occur - it is not a stack, just a toggle. @contextlib.contextmanager is intentionally not used for performance reasons: - decorator takes 1.1µs to execute, or 2µs if used correctly in a `with ...:` statement - custom class takes 300ns to execute, or 900ns if used correctly in a `with ...:` statement Based on work originally done by Anssi Kääriäinen and Tim Graham.
2026-03-10Fixed #36943 -- Preserved any exception from URLconf module in autoreloader.varunkasyap
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2026-03-10Fixed #36391 -- Doc'd RawSQL usage in docs/topics/db/sql.txt.Amar
2026-03-09Refactored PatternLookup to improve readability.Tim Graham
2026-03-09Fixed a typo in tests/conditional_processing/tests.py.jun
2026-03-09Fixed #36600 -- Clarified the use cases for dispatch_uid in signal connection.Amar
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2026-03-09Fixed #36293 -- Avoided buffering streaming responses in GZipMiddleware.farhan
This avoids latency and/or blocking. The example of streaming a CSV file was rewritten to employ batching for greater efficiency in all layers (db, HTTP, etc.). The improved performance from batching should outweigh the drag introduced by an additional byte for each flush. Co-authored-by: huoyinghui <huoyinghui@users.noreply.github.com>
2026-03-08Added DatabaseFeatures.pattern_lookup_needs_param_pattern.Tim Graham
It's useful on MongoDB.
2026-03-08Fixed #12529 -- Fixed migrate --run-syncdb crash for existing model with ↵Mariusz Felisiak
truncated db_table names.
2026-03-07Optimized check_commit_messages GitHub action.Jacob Walls
2026-03-06Fixed #36940 -- Fixed script name edge case in ASGIRequest.path_info.khadyottakale
Paths that happened to begin with the script name were inappropriately stripped, instead of checking that script name preceded a slash.
2026-03-06Fixed #36968 -- Improved error message when collectstatic can't find a ↵James Bligh
referenced file.
2026-03-06Extended committing code docs to add detailed instructions for backports.Natalia
Thanks to Jacob Walls for the original idea and the review.
2026-03-06Added python script suitable for using as prepare-commit-msg git hook.Natalia
2026-03-06Fixed #36679 -- Fixed Basque date formats to use parenthetical declension ↵Unai Loidi
suffixes. Basque (eu) grammar requires conditional suffixes on years and day articles that depend on the final sound of the preceding word. Since Django's format strings are static, the CLDR parenthetical convention ("(e)ko" instead of "ko") is used to express the optionality. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2026-03-06Extended checks and docs for proper commit message format and edition.Jacob Walls
Thanks to Tim Schilling for the review. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2026-03-06Refs #28877 -- Added special ordinal context when humanizing value 1.Julien Palard
Some languages use a different ordinal suffix for the number 1 than for other values ending in 1 (e.g. 21, 31). Added a dedicated pgettext context "ordinal is 1" to allow translators to handle this distinction. For example, in French, 1 is written as "1er" while 21, 31, etc. use "21e", "31e", etc. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2026-03-05Corrected local name for Basque in django/conf/locale/__init__.py.Julie Rymer
2026-03-04Fixed #21080 -- Ignored urls inside comments during collectstatic.James Bligh
Thanks Mariusz Felisiak for the review. Co-authored-by: Nathan Gaberel <nathan@gnab.fr>
2026-03-03Fixed #36887 -- Improved admin changelist layout for object-tools button.Jacob Walls
2026-03-03Refs #35859 -- Mentioned django-tasks and external resources on ↵Jake Howard
docs/topics/tasks.txt.
2026-03-03Fixed #36923 -- Added tests for non-hierarchical URI schemes in ↵Natalia
URLField.to_python(). Follow up to 951ffb3832cd83ba672c1e3deae2bda128eb9cca.
2026-03-03Fixed #20775 -- Clarified that SQL for text lookups varies per database.Lakshya
2026-03-03Added CVE-2026-25673 and CVE-2026-25674 to security archive.Natalia
2026-03-03Added stub release notes for 6.0.4.Natalia
2026-03-03Fixed CVE-2026-25674 -- Prevented potentially incorrect permissions on file ↵Natalia
system object creation. This fix introduces `safe_makedirs()` in the `os` utils as a safer alternative to `os.makedirs()` that avoids umask-related race conditions in multi-threaded environments. This is a workaround for https://github.com/python/cpython/issues/86533 and the solution is based on the fix being proposed for CPython. Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Zackery Spytz <zspytz@gmail.com> Refs CVE-2020-24583 and #31921. Thanks Tarek Nakkouch for the report, and Jake Howard, Jacob Walls, and Shai Berger for reviews.
2026-03-03Fixed CVE-2026-25673 -- Simplified URLField scheme detection.Natalia
This simplicaftion mitigates a potential DoS in URLField on Windows. The usage of `urlsplit()` in `URLField.to_python()` was replaced with `str.partition(":")` for URL scheme detection. On Windows, `urlsplit()` performs Unicode normalization which is slow for certain characters, making `URLField` vulnerable to DoS via specially crafted POST payloads. Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger for the review. Refs #36923. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2026-03-02Fixed #36961 -- Fixed TypeError in deprecation warnings if Django is ↵Jacob Walls
imported by namespace.
2026-03-02Aligned docs checks between GitHub Actions and local development.Natalia
2026-03-02Refs #35381 -- Moved JSONNull to django.db.models.expressions.Clifford Gama
2026-02-28Added DatabaseOperations.convert_trunc_expression() hook.Tim Graham
Needed on MongoDB.
2026-02-28Refs #36513 -- Fixed font-color to also apply to select options in ↵Antoliny0919
TabularInline.
2026-02-28Fixed #36914 -- Fixed background-color to also apply to select options in ↵Antoliny0919
TabularInline.
2026-02-27Fixed #36946 -- Respected test database name when running tests in parallel ↵S​age Abdullah
on SQLite. The "spawn" and "forkserver" multiprocessing modes were affected.
2026-02-27Refs #35972 -- Returned params in a tuple in further expressions.Jacob Walls
2026-02-27Refs #23919 -- Used yield from in Paginator.Pierre Sassoulas
2026-02-27Fixed #27489 -- Renamed permissions upon model renaming in migrations.Artyom Kotovskiy
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2026-02-27Fixed #34643 -- Moved inputs beneath labels and errors in admin forms.antoliny0919
Thanks Sarah Boyce and Jacob Walls for reviews. Co-authored-by: Hrushikesh Vaidya <hrushikeshrv@gmail.com>
2026-02-26Fixed #22079 -- Added tests for stripping empty list values in RequestFactory.Anurag Verma
2026-02-26Adjusted default DoS severity level in Security Policy.Natalia
2026-02-26Refs #36936 - Adjusted tests to set PYTHON_COLORS environment variable.Pete Rosenblum
When "FORCE_COLOR" was set in the environment (such as in django-docker-box) several test cases that rely on string comparisons against exception messages or command line results would fail due to ANSI escape sequences being present in the output. This change resolved the issue by setting the "PYTHON_COLORS" environment variable to "0" for those specific tests, which takes precendence over the presence of "FORCE_COLOR".
generated by cgit v1.3 (git 2.53.0) at 2026-07-02 13:19:28 +0000