summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
2025-04-02[5.2.x] Bumped version for 5.2 release.5.2Sarah Boyce
2025-04-02[5.2.x] Fixed CVE-2025-27556 -- Mitigated potential DoS in ↵Sarah Boyce
url_has_allowed_host_and_scheme() on Windows. Thank you sw0rd1ight for the report. Backport of 39e2297210d9d2938c75fc911d45f0e863dc4821 from main.
2025-04-01[5.2.x] Fixed #36284, Refs #31170 -- Ensured related lookup popups are ↵nessita
closed properly. In the admin, when selecting related objects via the helpers defined in `RelatedObjectLookups.js`, the `dismissRelatedLookupPopup` function was attempting to access `window.relatedWindows`, which does not exist in real execution, causing related lookup popups to remain open. This change ensures that this code correctly accesses the module-local `relatedWindows` by explicitly assigning it to `window.relatedWindows`. Regression in 91bebf1adb43561b54bac18e76224759dc70acb3. Thanks Matthias Kestenholz for the report, the fix ideas, and testing. Co-authored-by: Matthias Kestenholz <mk@feinheit.ch> Backport of a245604277eb9edeba234dacf199890766462709 from main.
2025-04-01[5.2.x] Fixed #36283 -- Reverted "Fixed #35798, Refs #31641 -- Prevented ↵Mariusz Felisiak
admin navigation sidebar loading flicker." This reverts commit 747b417a220b0412ed806001a383959449aac6da that caused a visual regression when both navigation and filter sidebars are visible. Backport of 12385b4fa7059aab8e4f671853cc09ae8509501f from main.
2025-03-31[5.2.x] Updated translations from Transifex.Sarah Boyce
2025-03-31[5.2.x] Refs #36055 -- Prevented overlap of object-tools buttons and page ↵Mariusz Felisiak
header in the admin on small screens. Visual regression in b1324a680add78de24c763911d0eefa19b9263bc. Backport of 02a5cbfe76382da2a0414df17017185be5bd47f9 from main.
2025-03-30[5.2.x] Fixed warnings per flake8 7.2.0.Mariusz Felisiak
https://github.com/PyCQA/flake8/releases/tag/7.2.0 Backport of 281910ff8e9ae98fa78ee5d26ae3f0b713ccf418 from main
2025-03-28[5.2.x] Refs #34619 -- Fixed labels width in FilteredSelectMultiple in the ↵Mariusz Felisiak
admin. Visual regression in 857b1048d53ebf5fc5581c110e85c212b81ca83a. Backport of a0f50c2a483678d31bd1ad6f08fd3a0b8399e27b from main.
2025-03-26[5.2.x] Refs #34619 -- Corrected selector description in the admin.Mariusz Felisiak
Backport of 0d92428d77fafff373e05dd5a6cdb62bd1dfbda0 from main
2025-03-21[5.2.x] Fixed #36266 -- Renamed HIDE_PRODUCTION_WARNING environment variable ↵Johanan Oppong Amoateng
to DJANGO_RUNSERVER_HIDE_WARNING. Backport of 5adadf6e8c74ab14d432e9d682ca1914789386de from main.
2025-03-19[5.2.x] Updated source translation catalogs.Mariusz Felisiak
2025-03-19[5.2.x] Bumped version for 5.2 release candidate 1.5.2rc1Sarah Boyce
2025-03-17[5.2.x] Fixed #36252 -- Handled duplicate automatic imports in the shell ↵hesham942
command. Backport of e804a07d76fc85468f27f7130ae1442fabcd650d from main.
2025-03-12[5.2.x] Fixed #36234 -- Restored single_object argument to ↵Adam Johnson
LogEntry.objects.log_actions(). Thank you Adam Johnson for the report and fix. Thank you Sarah Boyce for your spot on analysis. Regression in c09bceef68e5abb79accedd12dade16aa6577a09, which is partially reverted in this branch. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Backport of 27b68bcadf1ab2e9f7fd223aed42db352ccdc62d from main.
2025-03-07[5.2.x] Fixed #36224 -- Fixed shell imports when settings not configured.Sarah Boyce
Thank you Raffaella for the report. Thank you Tim Schilling and Natalia Bidart for the reviews. Backport of de1117ea8eabe0ee0aa048e5a4e249eab7c4245e from main.
2025-03-06[5.2.x] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap template ↵Sarah Boyce
filter. Thanks sw0rd1ight for the report. Backport of 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b from main.
2025-03-05[5.2.x] Clarified cryptic comment in django/core/cache/backends/redis.py.Tim Graham
Backport of 9a729fb61add16d89a4b42b491aec2d22f1ae69a from main.
2025-03-04[5.2.x] Fixed #36217 -- Restored pre_save/post_save signal emission via ↵antoliny0919
LogEntry.save() for single-object deletion in the admin. Regression in 40b3975e7d3e1464a733c69171ad7d38f8814280. Thanks smiling-watermelon for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Backport of c09bceef68e5abb79accedd12dade16aa6577a09 from main.
2025-03-01[5.2.x] Applied Black's 2025 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/25.1.0 Backport of ff3aaf036f0cb66cd8f404cd51c603e68aaa7676 from main
2025-02-19[5.2.x] Bumped version for 5.2 beta 1.5.2b1Sarah Boyce
2025-02-18[5.2.x] Fixed #35167 -- Delegated to super() in JSONField.get_db_prep_save().Jacob Walls
Avoids reports of bulk_update() sending Cast expressions to JSONField.get_prep_value(). Co-authored-by: Simon Charette <charette.s@gmail.com> Backport of 0bf412111be686b6b23e00863f5d449d63557dbf from main.
2025-02-18[5.2.x] Fixed #36197 -- Fixed improper many-to-many count() and exists() for ↵Simon Charette
non-pk to_field. Regression in 66e47ac69a7e71cf32eee312d05668d8f1ba24bb. Thanks mfontana-elem for the report and Sarah for the tests. Backport of c3a23aa02faa1cf1d32e43d66858e793cd9ecac4 from main.
2025-02-18[5.2.x] Fixed #31170 -- Added change event trigger to dismissRelatedLookupPopup.Кайрат Макым
Backport of 51398f8bd568a6324a8cafe20c068d0974913ad5 from main.
2025-02-18[5.2.x] Refs #31170 -- Added JavaScript tests for RelatedObjectLookups.js.Кайрат Макым
Backport of 91bebf1adb43561b54bac18e76224759dc70acb3 from main.
2025-02-18[5.2.x] Fixed #36179 -- Unhexed entries and removed duplicates in ↵mimi89999
auth/common-passwords.txt.gz. Backport of 727731d76d9dfd5304d536478d862778f6dd6d9b from main.
2025-02-17[5.2.x] Fixed #36191 -- Truncated the overwritten file content in ↵Gaël Utard
FileSystemStorage. Backport of 0d1dd6bba0c18b7feb6caa5cbd8df80fbac54afd from main.
2025-02-16[5.2.x] Fixed #35967 -- Deferred test suite fixtures serialization after all ↵Simon Charette
dbs setup. While the top-level objects fed to serialization are bound to the test database being created nothing prevents code invoked during serialization from performing queries against other connections entries that haven't been swapped yet. The reported example of that is a database router directing all reads to a test mirror for a set of models involving auto-created many-to-many fields. It might be tempting to address the many-to-many field case but this a symptom of a larger problem where the test framework yields the flow execution to user code that could interact with non-test databases in unexpected ways. Deferring test database fixture serialization until the point where all connections entries have been swapped for their test equivalent ensures that no code triggered during serialization can interact with non-test databases. Thanks Jake Howard for the report and Jacob Walls for the initial investigation. Backport of dc69a63f844b2ef3bc3371edde91644cf0bef0ee from main
2025-02-15[5.2.x] Refs #36181 -- Removed the obsolete SubqueryConstraint machinery.Mariusz Felisiak
Adding proper support for subquery right-hand-sides to TupleIn made it obsolete. Backport of d386405e04dac50656af50d100a14efdf8c58e8f from main Co-authored-by: Simon Charette <charette.s@gmail.com>
2025-02-15[5.2.x] Fixed #36173 -- Stabilized identity of Concat with an explicit ↵Simon Charette
output_field. When Expression.__init__() overrides make use of *args, **kwargs captures their argument values are respectively bound as a tuple and dict instances. These composite values might themselves contain values that require special identity treatments such as Concat(output_field) as it's a Field instance. Refs #30628 which introduced bound Field differentiation but lacked argument captures handling. Thanks erchenstein for the report. Backport of df2c4952df6d93c575fb8a3c853dc9d4c2449f36 from main
2025-02-14[5.2.x] Fixed #36102 -- Moved i18n comments directly above the translatable ↵Julien Palard
string. xgettext only extracts comment blocks if there is no program code between the comment and the string that gets extracted. For details, see: https://www.gnu.org/software/gettext/manual/html_node/xgettext-Invocation.html#Operation-mode Black formatting has been turned off in some places to ensure the comments are not moved, which previously resulted in them being removed from the po files when scripts/manage_translations.py was run. Backport of 6fcd0440aaa7601aa258d1c956eecfaedf72fbf4 from main.
2025-02-13[5.2.x] Corrected SHORT_DATE_FORMAT for Korean (ko).Kim Yeongbin
Backport of 14b46c1b848d846fad55c8634daeabd8787cf0d6 from main
2025-02-13[5.2.x] Fixed #36158 -- Refactored shell command to improve auto-imported ↵Natalia
objects reporting. Backport of 56e23b2319cc29e6f8518f8f21f95a530dddb930 from main.
2025-02-13[5.2.x] Fixed #36182 -- Returned "?" if all parameters are removed in ↵Sarah Boyce
querystring template tag. Thank you to David Feeley for the report and Natalia Bidart for the review. Backport of 05002c153c5018e4429a326a6699c7c45e5ea957 from main.
2025-02-13[5.2.x] Reverted "Refs #35803 -- Added support for __coveredby GIS lookup on ↵Mariusz Felisiak
MariaDB 11.7+." This partly reverts commit 0b7edb9fcdd33d47ec5701b4f9b9553e27a88e95. MariaDB reverted GIS functions. Backport of 54a902c6e81214462388f79a7c42f1c88c863dfd from main.
2025-02-13[5.2.x] Reverted "Fixed #35803 -- Added support for Collect, GeoHash, and ↵Mariusz Felisiak
IsValid on MariaDB 11.7+." This reverts commit c77573716a58af32ffcfc4fe87ff9e5c97909bd2. MariaDB reverted GIS functions. Backport of eb70aafdba18ac30e53056162c32ee6c21dea0b4 from main.
2025-02-13[5.2.x] Fixed #36181 -- Allowed Subquery usage in __in lookups against ↵Simon Charette
composite pks. Thanks Jacob Walls for the report. Backport of 8561100425876bde3be4b2a22324655f74ff9609 from main.
2025-02-11[5.2.x] Fixed #36149 -- Allowed subquery values against tuple exact and in ↵Simon Charette
lookups. Non-tuple exact and in lookups have specialized logic for subqueries that can be adapted to properly assign select mask if unspecified and ensure the number of involved members are matching on both side of the operator. Backport of 41239fe34d64e801212dccaa4585e4802d0fac68 from main.
2025-02-11[5.2.x] Refs #36148 -- Relied on a feature switch to define tuple lookups ↵Simon Charette
support. This should allow backends more easily opt-in or out of native support and rely on the fallback if unavailable. Backport of a0a765ddeb5056c85e084773d3f6432e2a426638 from main.
2025-02-10[5.2.x] Refs #35515 -- Fixed shell command verbose output when ↵Natalia
auto-importing 0 or 1 object. Co-authored-by: Salvo Polizzi <salvopolizzi03@gmail.com> Backport of 0597e8ad1e55b565292ead732916aa0e39bdf37b from main.
2025-02-10[5.2.x] Refs #35515 -- Refactored internal `get_and_report_namespace` in the ↵Natalia
shell command. Backport of 44ccd20375ba0d4da869ef994bc10a2311e9dc88 from main.
2025-02-09[5.2.x] Refs #373 -- Delegated Tuple compilation to compiler.Simon Charette
This should allow third-party backends to define Tuple.as_vendor() overrides that are taken into consideration which calling as_sql() directly prevents. Backport of c326cfe3b1683e6c205f53a4ad11feba6623a399 from main
2025-02-06[5.2.x] Refs #34975 -- Removed unnecessary lookups.In.get_refs().Simon Charette
Now that In.get_source_expression() includes its right-hand-side when it contains expressions (refs #36025) it no longer requires a specialized get_refs() method. Backport of 0bac41fc7e4a842e8d20319cba31cc645501c245 from main.
2025-02-06[5.2.x] Fixed #36025 -- Fixed re-aliasing of iterable (in/range) lookups rhs.Simon Charette
In order for Expression.relabeled_clone to work appropriately its get_source_expressions method must return all resolvable which wasn't the case for Lookup when its right-hand-side is "direct" (not a compilable). While refs #22288 added support for non-literals iterable right-hand-side lookups it predated the subclassing of Lookup(Expression) refs #27021 which could have been an opportunity to ensure right-hand-sides are always resolvable (ValueList and ExpressionList). Addressing all edge case with non-resolvable right-hand-sides would require a significant refactor and deprecation of some parts of the Lookup interface so this patch only focuses on FieldGetDbPrepValueIterableMixin (In and Range lookups) by making sure that a right-hand-side containing resolvables are dealt with appropriately during the resolving phase. Thanks Aashay Amballi for the report. Backport of 089deb82b9ac2d002af36fd36f288368cdac4b53 from main.
2025-02-06[5.2.x] Fixed #36061 -- Added migration support for ↵brian
ManyToManyField.through_fields. Added through_fields support to ManyToManyField.deconstruct. Thanks to Simon Charette for pointers and the review. Backport of b13b8684a04d0bc1081104c5973c62c27dc673b0 from main.
2025-02-06[5.2.x] Fixed #35677 -- Avoided non-sticky filtering of prefetched many-to-many.Simon Charette
The original queryset._next_is_sticky() call never had the intended effect as no further filtering was applied internally after the pk__in lookup making it a noop. In order to be coherent with how related filters are applied when retrieving objects from a related manager the effects of what calling _next_is_sticky() prior to applying annotations and filters to the queryset provided for prefetching are emulated by allowing the reuse of all pre-existing JOINs. Thanks David Glenck and Thiago Bellini Ribeiro for the detailed reports and tests. Backport of 2598b371a93e21d84b7a2a99b2329535c8c0c138 from main.
2025-02-06[5.2.x] Refs #22997 -- Prevented requesting a default value for auto fields.Ben Cail
Backport of db7b1ae9f6d9e26facbb3da4cf5f5a513704bfe5 from main.
2025-02-04[5.2.x] Fixed #36069 -- Fixed the delete button position in TabularInlines.antoliny0919
Backport of 1330cb570519170bb4397b4fb02c7e3e0657855a from main.
2025-02-04[5.2.x] Fixed #36055 -- Prevented overlap of object-tools buttons and page ↵antoliny0919
header in the admin. Backport of b1324a680add78de24c763911d0eefa19b9263bc from main.
2025-02-03[5.2.x] Fixed #36135 -- Fixed reverse GenericRelation prefetching.Simon Charette
The get_(local|foreign)_related_value methods of GenericRelation must be reversed because it defines (from|to)_fields and associated related_fields in the reversed order as it's effectively a reverse GenericForeignKey itself. The related value methods must also account for the fact that referenced primary key values might be stored as a string on the model defining the GenericForeignKey but as integer on the model defining the GenericRelation. This is achieved by calling the to_python method of the involved content type in get_foreign_related_value just like GenericRelatedObjectManager does. Lastly reverse many-to-one manager's prefetch_related_querysets should use set_cached_value instead of direct attribute assignment as direct assignment might are disallowed on ReverseManyToOneDescriptor descriptors. This is likely something that was missed in f5233dc (refs #32511) when the is_cached guard was added. Thanks 1xinghuan for the report. Backport of 198b30168d4e94af42e0dc7967bd3259b5c5790b from main.
2025-02-01[5.2.x] Fixed #36140 -- Allowed BaseUserCreationForm to define non required ↵nessita
password fields. Regression in e626716c28b6286f8cf0f8174077f3d2244f3eb3. Thanks buffgecko12 for the report and Sarah Boyce for the review. Backport of d15454a6e84a595ffc8dc1b926282f484f782a8f from main.
generated by cgit v1.3 (git 2.53.0) at 2026-07-07 05:02:54 +0000