summaryrefslogtreecommitdiff
path: root/django/core
AgeCommit message (Collapse)Author
2026-04-07[5.2.x] Fixed CVE-2026-3902 -- Ignored headers with underscores in ASGIRequest.Jacob Walls
Thanks Tarek Nakkouch for the report and Jake Howard and Natalia Bidart for reviews. Backport of caf90a971f09323775ed0cacf94eadaf39d040e0 from main.
2026-03-30[5.2.x] Applied Black's 2026 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/26.1.0 Backport of 6cff02078799b7c683a0d39630d49ab4fe532e7c from main.
2026-03-03[5.2.x] Fixed CVE-2026-25674 -- Prevented potentially incorrect permissions ↵Natalia
on file system object creation. This fix introduces `safe_makedirs()` in the `os` utils as a safer alternative to `os.makedirs()` that avoids umask-related race conditions in multi-threaded environments. This is a workaround for https://github.com/python/cpython/issues/86533 and the solution is based on the fix being proposed for CPython. Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Zackery Spytz <zspytz@gmail.com> Refs CVE-2020-24583 and #31921. Thanks Tarek Nakkouch for the report, and Jake Howard, Jacob Walls, and Shai Berger for reviews. Backport of 019e44f67a8dace67b786e2818938c8691132988 from main.
2026-02-10[5.2.x] Fixed #36903 -- Fixed further NameErrors when inspecting functions ↵93578237
with deferred annotations. Provide a wrapper for safe introspection of user functions on Python 3.14+. Follow-up to 601914722956cc41f1f2c53972d669ddee6ffc04. Backport of 56ed37e17e5b1a509aa68a0c797dcff34fcc1366 from main.
2026-02-03[5.2.x] Fixed CVE-2025-14550 -- Optimized repeated header parsing in ASGI ↵Jake Howard
requests. Thanks Jiyong Yang for the report, and Natalia Bidart, Jacob Walls, and Shai Berger for reviews. Backport of eb22e1d6d643360e952609ef562c139a100ea4eb from main.
2025-12-22[5.2.x] Fixed #36376 -- Fixed --no-color for command help in Python 3.14+.Skyiesac
https://github.com/python/cpython/pull/136809 made `color` default to True in ArgumentParser. Backport of d0d85cd165e54582cce98cf685252e771460a9d4 from main.
2025-12-02[5.2.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation ↵Shai Berger
in XML serializer. Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.
2025-12-01[5.2.x] Refs #36743 -- Corrected docstring for DisallowedRedirect.Jacob Walls
Backport of ce36c35e76f82f76cdfa5777456e794d481e5afc from main.
2025-06-06[5.2.x] Refs CVE-2025-48432 -- Made SuspiciousOperation logging use ↵Natalia
log_response() for consistency. Backport of ff835f439cb1ecd8d74a24de12e3c03e5477dc9d from main.
2025-04-30[5.2.x] Fixed #36357 -- Skipped unique_together in inspectdb output for ↵Baptiste Mispelon
composite primary keys. Thanks to Baptiste Mispelon for the report and quick fix, and to Simon Charette and Jacob Walls for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 66f9eb0ff1e7147406318c5ba609729678e4e6f6 from main.
2025-04-24[5.2.x] Fixed #36309 -- Made email alternatives and attachments pickleable.nessita
Regression in aba0e541caaa086f183197eaaca0ac20a730bbe4 and in d5bebc1c26d4c0ec9eaa057aefc5b38649c0ba3b. Thanks Florent Messa for the report, and Jake Howard and Claude Paroz for the review. Backport of 0596263c3136bc26cffa670e5322bd0aa56c4d34 from main.
2025-04-07[5.2.x] Fixed #36298 -- Truncated the overwritten file content in ↵Sarah Boyce
file_move_safe(). Regression in 58cd4902a71a3695dd6c21dc957f59c333db364c. Thanks Baptiste Mispelon for the report. Backport of 8ad3e80e88201f4c557f6fa79fcfc0f8a0961830 from main.
2025-04-02[5.2.x] Fixed CVE-2025-27556 -- Mitigated potential DoS in ↵Sarah Boyce
url_has_allowed_host_and_scheme() on Windows. Thank you sw0rd1ight for the report. Backport of 39e2297210d9d2938c75fc911d45f0e863dc4821 from main.
2025-03-21[5.2.x] Fixed #36266 -- Renamed HIDE_PRODUCTION_WARNING environment variable ↵Johanan Oppong Amoateng
to DJANGO_RUNSERVER_HIDE_WARNING. Backport of 5adadf6e8c74ab14d432e9d682ca1914789386de from main.
2025-03-17[5.2.x] Fixed #36252 -- Handled duplicate automatic imports in the shell ↵hesham942
command. Backport of e804a07d76fc85468f27f7130ae1442fabcd650d from main.
2025-03-07[5.2.x] Fixed #36224 -- Fixed shell imports when settings not configured.Sarah Boyce
Thank you Raffaella for the report. Thank you Tim Schilling and Natalia Bidart for the reviews. Backport of de1117ea8eabe0ee0aa048e5a4e249eab7c4245e from main.
2025-03-05[5.2.x] Clarified cryptic comment in django/core/cache/backends/redis.py.Tim Graham
Backport of 9a729fb61add16d89a4b42b491aec2d22f1ae69a from main.
2025-03-01[5.2.x] Applied Black's 2025 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/25.1.0 Backport of ff3aaf036f0cb66cd8f404cd51c603e68aaa7676 from main
2025-02-17[5.2.x] Fixed #36191 -- Truncated the overwritten file content in ↵Gaël Utard
FileSystemStorage. Backport of 0d1dd6bba0c18b7feb6caa5cbd8df80fbac54afd from main.
2025-02-13[5.2.x] Fixed #36158 -- Refactored shell command to improve auto-imported ↵Natalia
objects reporting. Backport of 56e23b2319cc29e6f8518f8f21f95a530dddb930 from main.
2025-02-10[5.2.x] Refs #35515 -- Fixed shell command verbose output when ↵Natalia
auto-importing 0 or 1 object. Co-authored-by: Salvo Polizzi <salvopolizzi03@gmail.com> Backport of 0597e8ad1e55b565292ead732916aa0e39bdf37b from main.
2025-02-10[5.2.x] Refs #35515 -- Refactored internal `get_and_report_namespace` in the ↵Natalia
shell command. Backport of 44ccd20375ba0d4da869ef994bc10a2311e9dc88 from main.
2025-01-31[5.2.x] Fixed #36119 -- Fixed UnicodeEncodeError when attaching a file with ↵greg
8bit Content-Transfer-Encoding. Backport of 89e28e13ecbf9fbcf235e16d453c08bbf2271244 from main.
2025-01-23[5.2.x] Fixed #36010 -- Avoided touching mo files while checking writability.Claude Paroz
Backport of 2c47207b3c8412d16e61e388f176b47b41b40794 from main.
2025-01-13Refs #35844 -- Removed unnecessary ArgumentParser.add_argument_group()'s ↵Mariusz Felisiak
prefix_chars argument. The `prefix_chars` argument is deprecated since https://github.com/python/cpython/commit/7b04496e5c7ed47e9653f4591674fc9ffef34587.
2025-01-09Fixed #35515 -- Added automatic model imports to shell management command.Salvo Polizzi
Thanks to Bhuvnesh Sharma and Adam Johnson for mentoring this Google Summer of Code 2024 project. Thanks to Sarah Boyce, David Smith, Jacob Walls and Natalia Bidart for reviews.
2025-01-08Fixed #36062 -- Handled serialization of CompositePrimaryKeys.Sarah Boyce
2025-01-08Fixed #36014 -- Supported international domains in EmailValidator.Chaitanya Rahalkar
2025-01-04Fixed #36056 -- Made OutputWrapper a virtual subclass of TextIOBase.Adam Johnson
This fixes the ignored exception in self._out.flush() from django.core.management.base.OutputWrapper: `ValueError: I/O operation on closed file.`
2025-01-03Fixed #36052 -- Supported CompositePrimaryKey in inspectdb.Jacob Walls
2024-12-18Fixed #35996 -- Fixed database serialization crash when serializing a ↵Erica Pisani
many-to-many field that had a prefetch.
2024-12-13Fixed #36007 -- Removed dead code from URLValidator.Mike Edmunds
The "Trivial case failed. Try for possible IDN domain" handling was obsoleted by ticket-20003, which adjusted the regular expressions to allow all international domain names (Refs #20003). Uses of `ul` were moved to DomainNameValidator in ticket-18119 (Refs #18119).
2024-12-11Fixed #35920 -- Observed requires_system_checks in migrate and runserver.Jacob Walls
Before, the full suite of system checks was run by these commands regardless if requires_system_checks had been overridden. Co-authored-by: Simon Charette <charette.s@gmail.com>
2024-12-09Fixed #35973 -- Improved makemessages locale validation to handle numeric ↵Juan Pablo Mallarino
region codes.
2024-12-09Fixed #35935 -- Colorized system checks when running sqlmigrate.Jacob Walls
2024-11-29Fixed #35308 -- Handled OSError when launching code formatters.Jacob Walls
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2024-11-29Fixed #373 -- Added CompositePrimaryKey.Bendeguz Csirmaz
Thanks Lily Foote and Simon Charette for reviews and mentoring this Google Summer of Code 2024 project. Co-authored-by: Simon Charette <charette.s@gmail.com> Co-authored-by: Lily Foote <code@lilyf.org>
2024-11-12Refs #21286 -- Fixed YAML serialization of TimeField primary key.Adam Zapletal
Handling for PyYAML not being able to serialize `datetime.time` values is moved from `handle_field` to `_value_from_field` as only non-primary key, non-relation fields are passed into `handle_field`.
2024-10-28Refs #34900 -- Removed usage of deprecated glob.glob1().earthyoung
2024-10-17Fixed #35845 -- Updated DomainNameValidator to require entire string to be a ↵Justin Thurman
valid domain name. Bug in 4971a9afe5642569f3dcfcd3972ebb39e88dd457. Thank you to kazet for the report and Claude Paroz for the review.
2024-10-15Fixed #35656 -- Added an autodetector attribute to the makemigrations and ↵leondaz
migrate commands.
2024-10-10Fixed docstring for django.core.exceptions module.Baptiste Mispelon
2024-09-17Fixed #29522 -- Refactored the Deserializer functions to classes.Amir Karimi
Co-authored-by: Emad Mokhtar <emad.mokhtar@veneficus.nl>
2024-08-30Dropped safeguards against very old versions of gettext.Claude Paroz
gettext 0.19 was released in 2014.
2024-08-28Refs #35326 -- Adjusted deprecation warning stacklevel in ↵Simon Charette
FileSystemStorage.OS_OPEN_FLAGS.
2024-08-23Fixed #35689 -- Handled custom labels in LabelCommand.missing_args_message.Giovanni Fabbretti
2024-08-12Refs #35591 -- Removed hardcoded "stable" version in runserver warning.Mariusz Felisiak
2024-08-09Fixed #35658 -- Initialized InMemoryFileNode instances with a name.lucasesposito
2024-08-09Fixed #35591 -- Added unsuitable for production console warning to runserver.Andrew Miller
2024-08-05Refs #35537 -- Improved documentation and test coverage for email ↵Jake Howard
attachments and alternatives.
generated by cgit v1.3 (git 2.53.0) at 2026-10-17 13:19:02 +0000