summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
2025-06-04[5.2.x] Bumped version for 5.2.2 release.5.2.2Natalia
2025-06-04[5.2.x] Fixed CVE-2025-48432 -- Escaped formatting arguments in ↵Natalia
`log_response()`. Suitably crafted requests containing a CRLF sequence in the request path may have allowed log injection, potentially corrupting log files, obscuring other attacks, misleading log post-processing tools, or forging log entries. To mitigate this, all positional formatting arguments passed to the logger are now escaped using "unicode_escape" encoding. Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report. Co-authored-by: Carlton Gibson <carlton@noumenal.es> Co-authored-by: Jake Howard <git@theorangeone.net> Backport of a07ebec5591e233d8bbb38b7d63f35c5479eef0e from main.
2025-06-04[5.2.x] Fixed #36432 -- Fixed a prefetch_related crash on related target ↵Simon Charette
subclass queryset. Regression in 626d77e52a3f247358514bcf51c761283968099c. Refs #36116. Thanks Cornelis Poppema for the excellent report. Backport of 08187c94ed02c45ad40a32244dedeaa7ac71ca87 from main.
2025-06-03[5.2.x] Fixed #36411 -- Made HttpRequest.get_preferred_type() consider media ↵Jake Howard
type parameters. HttpRequest.get_preferred_type() did not account for parameters in Accept header media types (e.g., "text/vcard; version=3.0"). This caused incorrect content negotiation when multiple types differed only by parameters, reducing specificity as per RFC 7231 section 5.3.2 (https://datatracker.ietf.org/doc/html/rfc7231.html#section-5.3.2). This fix updates get_preferred_type() to treat media types with parameters as distinct, allowing more precise and standards-compliant matching. Thanks to magicfelix for the report, and to David Sanders and Sarah Boyce for the reviews. Backport of c075508b4de8edf9db553b409f8a8ed2f26ecead from main.
2025-06-03[5.2.x] Fixed #36416 -- Made QuerySet.in_bulk() account for composite pks in ↵Jacob Walls
id_list. Backport of 26313bc21932d0d3af278ab387549d63b1f64575 from main.
2025-06-02[5.2.x] Fixed #36423 -- Prevented filter_horizontal buttons from ↵Blayze
intercepting form submission. In the admin's filter_horizontal widget, optional action buttons like "Choose all", "Remove all", etc. were changed from `<a>` to `<button>` elements in #34619, but without specifying `type="button"`. As a result, when pressing Enter while focused on a form input, these buttons could be triggered and intercept form submission. Explicitly set `type="button"` on these control buttons to prevent them from acting as submit buttons. Thanks Antoliny Lee for the quick triage and review. Regression in 857b1048d53ebf5fc5581c110e85c212b81ca83a. Backport of 90429625a85f1f77dfea200c91bd2dabab57974f from main.
2025-05-23[5.2.x] Fixed #36405 -- Fixed OrderableAggMixin.order_by using OuterRef.Adam Johnson
co-authored-by: Simon Charette <charette.s@gmail.com> Backport of c2615a050036eda0bca090c707191076220cee9f from main.
2025-05-23[5.2.x] Fixed #36404 -- Fixed Aggregate.filter using OuterRef.Adam Johnson
Regression in a76035e925ff4e6d8676c65cb135c74b993b1039. Thank you to Simon Charette for the review. co-authored-by: Simon Charette <charette.s@gmail.com> Backport of b8e5a8a9a2a767f584cbe89a878a42363706f939 from main.
2025-05-23[5.2.x] Fixed #36390 -- Deprecated RemoteUserMiddleware subclasses missing ↵Sarah Boyce
aprocess_request(). Regression in 50f89ae850f6b4e35819fe725a08c7e579bfd099. Thank you to shamoon for the report and Natalia Bidart for the review. Backport of 1704c49a9b149b66b6a0e67abc8c95293bc35649 from main.
2025-05-19[5.2.x] Fixed #36388 -- Made QuerySet.union() return self when called with ↵Colleen Dunlap
no arguments. Regression in 9cb8baa0c4fa2c10789c5c8b65f4465932d4d172. Thank you to Antoine Humeau for the report and Simon Charette for the review. Backport of 802baf5da5b8d8b44990a8214a43b951e7ab8b39 from main.
2025-05-16[5.2.x] Fixed #36392 -- Raised ValueError when subquery referencing ↵Jacob Walls
composite pk selects too many columns. Backport of 994dc6d8a1bae717baa236b65e11cf91ce181c53 from main.
2025-05-12[5.2.x] Fixed #36373 -- Fixed select_related() crash on foreign object for a ↵Simon Charette
composite pk. Thanks Jacob Walls for the report and Sarah for the in-depth review. Backport of 8be0c0d6901669661fca578f474cd51cd284d35a from main.
2025-05-06[5.2.x] Post-release version bump.Natalia
2025-05-06[5.2.x] Bumped version for 5.2.1 release.5.2.1Natalia
2025-05-06[5.2.x] Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags().Sarah Boyce
Thanks to Elias Myllymäki for the report, and Shai Berger and Jake Howard for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 9f3419b519799d69f2aba70b9d25abe2e70d03e0 from main.
2025-04-30[5.2.x] Fixed #36357 -- Skipped unique_together in inspectdb output for ↵Baptiste Mispelon
composite primary keys. Thanks to Baptiste Mispelon for the report and quick fix, and to Simon Charette and Jacob Walls for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 66f9eb0ff1e7147406318c5ba609729678e4e6f6 from main.
2025-04-30[5.2.x] Fixed #36358 -- Corrected introspection of composite primary keys on ↵Simon Charette
SQLite. Previously, any first field of a composite primary key with type `INTEGER` was incorrectly introspected as an `AutoField` due to SQLite treating `INTEGER PRIMARY KEY` as an alias for the `ROWID`. This change ensures that integer fields in composite PKs are not mistaken for auto-incrementing fields. Thanks Jacob Walls and Sarah Boyce for the reviews. Backport of 07100db6f46255ec6ef70b860495f977473684d6 from main.
2025-04-30[5.2.x] Refs #36052, #32234 -- Removed ↵Simon Charette
create_test_table_with_composite_primary_key flag in favor of using CompositePrimaryKey. Now that Django properly supports creating models with composite primary keys, the tests should use a `CompositePrimaryKey` field instead of a feature flag to inline backend specific SQL for creating a composite PK. Specifcially, the inspectdb's test_composite_primary_key was adjusted to use schema editor instead of per-backend raw SQL. Backport of 4c75858135589f3a00e32eb4d476074536371a32 from main.
2025-04-30[5.2.x] Fixed #36360 -- Fixed QuerySet.update() crash when referring ↵Simon Charette
annotations through values(). The issue was only manifesting itself when also filtering againt a related model as that forces the usage of a subquery because SQLUpdateCompiler doesn't support the UPDATE FROM syntax yet. Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Refs #28900. Thanks Gav O'Connor for the detailed report. Backport of 8ef4e0bd423ac3764004c73c3d1098e7a51a2945 from main.
2025-04-24[5.2.x] Fixed #36309 -- Made email alternatives and attachments pickleable.nessita
Regression in aba0e541caaa086f183197eaaca0ac20a730bbe4 and in d5bebc1c26d4c0ec9eaa057aefc5b38649c0ba3b. Thanks Florent Messa for the report, and Jake Howard and Claude Paroz for the review. Backport of 0596263c3136bc26cffa670e5322bd0aa56c4d34 from main.
2025-04-23[5.2.x] Fixed #36341 -- Preserved whitespaces in wordwrap template filter.Matti Pohjanvirta
Regression in 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b. This work improves the django.utils.text.wrap() function to ensure that empty lines and lines with whitespace only are kept instead of being dropped. Thanks Matti Pohjanvirta for the report and fix. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 1e9db35836d42a3c72f3d1015c2f302eb6fee046 from main.
2025-04-22[5.2.x] Fixed #36331 -- Reverted "Fixed #36055 -- Prevented overlap of ↵antoliny0919
object-tools buttons and page header in the admin." This reverts commits b1324a680add78de24c763911d0eefa19b9263bc and 02a5cbfe76382da2a0414df17017185be5bd47f9. The former caused a regression in admin sites that relied on the `object-tools` block being inside the `content` block. Thank you to Fabian Braun for the report. Backport of 1bc805e23b73a580b82a1d416ab0fb59a1073047 from main.
2025-04-17[5.2.x] Fixed #36314 -- Fixed MinimumLengthValidator error message translation.Ahmed Nassar
Regression in ec7d69035a408b357f1803ca05a7c991cc358cfa. Thank you Gabriel Trouvé for the report and Claude Paroz for the review. Backport of d469db978ea6a705549b9519313d9adc198e4232 from main.
2025-04-11[5.2.x] Fixed #36288 -- Addressed improper handling of duplicates in ↵Simon Charette
values_list(). Now that selected aliases are stored in sql.Query.selected: dict[str, Any] the values_list() method must ensures that duplicate field name references are assigned unique aliases. Refs #28900. Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Thanks Claude for the report. Backport of 21f8be76d43aa1ee5ae41c1e0a428cfea1f231c1 from main.
2025-04-07[5.2.x] Fixed #36301 -- Fixed select_for_update(of) crash when using ↵Simon Charette
values()/values_list(). Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a which allowed for annotations to be SELECT'ed before model field references through values()/values_list() and broke assumptions the select_for_update(of) table infererence logic had about model fields always being first. Refs #28900. Thanks OutOfFocus4 for the report and Sarah for the test. Backport of 71a19a0e475165dbc14c1fe02f552013ee670e4c from main
2025-04-07[5.2.x] Fixed #36298 -- Truncated the overwritten file content in ↵Sarah Boyce
file_move_safe(). Regression in 58cd4902a71a3695dd6c21dc957f59c333db364c. Thanks Baptiste Mispelon for the report. Backport of 8ad3e80e88201f4c557f6fa79fcfc0f8a0961830 from main.
2025-04-05[5.2.x] Fixed #36299 -- Prevented field selection on QuerySet.alias() after ↵Simon Charette
values(). Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Refs #28900. Thanks Jeff Iadarola for the report and tests. Co-Authored-By: OutOfFocus4 <jeff.iadarola@gmail.com> Backport of 12b771a1ec4bbfe82405176f5601e6441855a303 from main
2025-04-04[5.2.x] Fixed #36289 -- Fixed bulk_create() crash with nullable geometry ↵Simon Charette
fields on PostGIS. Swapped to an allow list instead of a deny list for field types to determine if the UNNEST optimization can be enabled to avoid further surprises with other types that would require further specialization to adapt. Regression in a16eedcf9c69d8a11d94cac1811018c5b996d491. Thanks Joshua Goodwin for the report and Sarah Boyce for the test. Backport of 764af7a3d6c0b543dcf659a2c327f214da768fe4 from main
2025-04-03[5.2.x] Fixed #36290 -- Made TupleIn() lookup discard tuples containing None.Simon Charette
Just like the In() lookup discards of None members TupleIn() should discard tuples containing any None as NULL != NULL in SQL and the framework expects such queries to be elided under some circumstances. Refs #31667, #36116. Thanks Basptise Mispelon for bisecting the regression to 626d77e. Backport of f7f38f3a0b44d8c6d14344dae66b6ce52cd77b55 from main
2025-04-03[5.2.x] Fixed #36292 -- Fixed crash when aggregating over a group mixing ↵Simon Charette
transforms and references. Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a. Refs #28900 Thanks Patrick Altman for the report. Backport of 543e17c4405dfdac4f18759fc78b190406d14239 from main
2025-04-02[5.2.x] Post-release version bump.Sarah Boyce
2025-04-02[5.2.x] Bumped version for 5.2 release.5.2Sarah Boyce
2025-04-02[5.2.x] Fixed CVE-2025-27556 -- Mitigated potential DoS in ↵Sarah Boyce
url_has_allowed_host_and_scheme() on Windows. Thank you sw0rd1ight for the report. Backport of 39e2297210d9d2938c75fc911d45f0e863dc4821 from main.
2025-04-01[5.2.x] Fixed #36284, Refs #31170 -- Ensured related lookup popups are ↵nessita
closed properly. In the admin, when selecting related objects via the helpers defined in `RelatedObjectLookups.js`, the `dismissRelatedLookupPopup` function was attempting to access `window.relatedWindows`, which does not exist in real execution, causing related lookup popups to remain open. This change ensures that this code correctly accesses the module-local `relatedWindows` by explicitly assigning it to `window.relatedWindows`. Regression in 91bebf1adb43561b54bac18e76224759dc70acb3. Thanks Matthias Kestenholz for the report, the fix ideas, and testing. Co-authored-by: Matthias Kestenholz <mk@feinheit.ch> Backport of a245604277eb9edeba234dacf199890766462709 from main.
2025-04-01[5.2.x] Fixed #36283 -- Reverted "Fixed #35798, Refs #31641 -- Prevented ↵Mariusz Felisiak
admin navigation sidebar loading flicker." This reverts commit 747b417a220b0412ed806001a383959449aac6da that caused a visual regression when both navigation and filter sidebars are visible. Backport of 12385b4fa7059aab8e4f671853cc09ae8509501f from main.
2025-03-31[5.2.x] Updated translations from Transifex.Sarah Boyce
2025-03-31[5.2.x] Refs #36055 -- Prevented overlap of object-tools buttons and page ↵Mariusz Felisiak
header in the admin on small screens. Visual regression in b1324a680add78de24c763911d0eefa19b9263bc. Backport of 02a5cbfe76382da2a0414df17017185be5bd47f9 from main.
2025-03-30[5.2.x] Fixed warnings per flake8 7.2.0.Mariusz Felisiak
https://github.com/PyCQA/flake8/releases/tag/7.2.0 Backport of 281910ff8e9ae98fa78ee5d26ae3f0b713ccf418 from main
2025-03-28[5.2.x] Refs #34619 -- Fixed labels width in FilteredSelectMultiple in the ↵Mariusz Felisiak
admin. Visual regression in 857b1048d53ebf5fc5581c110e85c212b81ca83a. Backport of a0f50c2a483678d31bd1ad6f08fd3a0b8399e27b from main.
2025-03-26[5.2.x] Refs #34619 -- Corrected selector description in the admin.Mariusz Felisiak
Backport of 0d92428d77fafff373e05dd5a6cdb62bd1dfbda0 from main
2025-03-21[5.2.x] Fixed #36266 -- Renamed HIDE_PRODUCTION_WARNING environment variable ↵Johanan Oppong Amoateng
to DJANGO_RUNSERVER_HIDE_WARNING. Backport of 5adadf6e8c74ab14d432e9d682ca1914789386de from main.
2025-03-19[5.2.x] Updated source translation catalogs.Mariusz Felisiak
2025-03-19[5.2.x] Bumped version for 5.2 release candidate 1.5.2rc1Sarah Boyce
2025-03-17[5.2.x] Fixed #36252 -- Handled duplicate automatic imports in the shell ↵hesham942
command. Backport of e804a07d76fc85468f27f7130ae1442fabcd650d from main.
2025-03-12[5.2.x] Fixed #36234 -- Restored single_object argument to ↵Adam Johnson
LogEntry.objects.log_actions(). Thank you Adam Johnson for the report and fix. Thank you Sarah Boyce for your spot on analysis. Regression in c09bceef68e5abb79accedd12dade16aa6577a09, which is partially reverted in this branch. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Backport of 27b68bcadf1ab2e9f7fd223aed42db352ccdc62d from main.
2025-03-07[5.2.x] Fixed #36224 -- Fixed shell imports when settings not configured.Sarah Boyce
Thank you Raffaella for the report. Thank you Tim Schilling and Natalia Bidart for the reviews. Backport of de1117ea8eabe0ee0aa048e5a4e249eab7c4245e from main.
2025-03-06[5.2.x] Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap template ↵Sarah Boyce
filter. Thanks sw0rd1ight for the report. Backport of 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b from main.
2025-03-05[5.2.x] Clarified cryptic comment in django/core/cache/backends/redis.py.Tim Graham
Backport of 9a729fb61add16d89a4b42b491aec2d22f1ae69a from main.
2025-03-04[5.2.x] Fixed #36217 -- Restored pre_save/post_save signal emission via ↵antoliny0919
LogEntry.save() for single-object deletion in the admin. Regression in 40b3975e7d3e1464a733c69171ad7d38f8814280. Thanks smiling-watermelon for the report. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> Backport of c09bceef68e5abb79accedd12dade16aa6577a09 from main.
2025-03-01[5.2.x] Applied Black's 2025 stable style.Mariusz Felisiak
https://github.com/psf/black/releases/tag/25.1.0 Backport of ff3aaf036f0cb66cd8f404cd51c603e68aaa7676 from main
generated by cgit v1.3 (git 2.53.0) at 2026-07-10 06:30:46 +0000