summaryrefslogtreecommitdiff
path: root/django
AgeCommit message (Collapse)Author
2025-10-22[6.0.x] Bumped version for 6.0 beta 1 release.6.0b1Natalia
2025-10-21[6.0.x] Fixed #36677 -- Fixed scheduling of system checks in ↵Jacob Walls
ParallelTestSuite workers. Running system checks in workers must happen after database aliases are set up. Regression in 606fc352799e372928fa2c978ab99f0fb6d6017c. Backport of b6c9246d0a3ef5f9a40b15cc289b495351eae109 from main.
2025-10-21[6.0.x] Fixed #36656 -- Avoided truncating async streaming responses in ↵Adam Johnson
GZipMiddleware. Backport of a0323a0c44135c28134672e6e633e5f4a7a68d5d from main.
2025-10-20[6.0.x] Fixed #36470 -- Prevented log injection in runserver when handling ↵YashRaj1506
NOT FOUND. Migrated `WSGIRequestHandler.log_message()` to use a more robust `log_message()` helper, which was based of `log_response()` via factoring out the common bits. Refs CVE-2025-48432. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 9bb83925d6c231e964f8b54efbc982fb1333da27 from main.
2025-10-16[6.0.x] Bumped minimum isort version to 7.0.0.Jacob Walls
Added ignores relating to https://github.com/PyCQA/isort/issues/2352. Backport of d980d68609448a4c85763fa34e471ff80540888b from main.
2025-10-15[6.0.x] Fixed 36622 -- Prevented LazyObject FileField storages from ↵Clifford Gama
evaluating at boot time. Co-authored-by: Fabien MICHEL <fmichel@adista.fr> Backport of 6862d46dd96d71d80d6d2fa9873a93d811b39562 from main.
2025-10-15[6.0.x] Fixed #36659 -- Fixed flatpage content selector in admin forms.css.Baptiste Mispelon
Regression in bb145e2c47d71b7f68280c00ced727442d2effa2. Backport of 2b62951fecf0024ce9ce0ce9f5be512c10747c0d from main.
2025-10-14[6.0.x] Fixed #36648, Refs #33772 -- Accounted for composite pks in ↵Jacob Walls
first()/last() when aggregating. Backport of 02eed4f37879b2077496f86bb1378a076b981233 from main.
2025-10-14[6.0.x] Refs #31223 -- Added __class_getitem__() to SetPasswordMixin.Thibaut Decombe
Backport of d0c8f89c942d1379724bdd37127076d13452f71d from main.
2025-10-13[6.0.x] Fixed #36611, Refs #36580 -- Added system check for multicolumn ↵Sarah Boyce
ForeignObject in Meta.indexes/constraints/unique_together. ForeignObjects with multiple `from_fields` are not supported in these options. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 5b51e6f759f2ba993219347435149173c756c478 from main.
2025-10-13[6.0.x] Fixed #36660 -- Fixed a regression in descending Index local field ↵Simon Charette
checks. Regression in 8638d8bf74c1a58302c97d4436ad2eb08438145b. Refs #36273. Thanks Federico Bond for the report. Backport of edde2891c355103ba455f3fea95cff962e40962c from main.
2025-10-11[6.0.x] Fixed #36646 -- Added compatibility for oracledb 3.4.0.Simon Charette
The Database.Binary, Date, and Timestamp attributes were changed from aliases to bytes, datetime.date, and datetime.datetime to factory functions in oracle/python-oracledb@869a887819cdac7fcd610f9d9d463ade49ea7 which made their usage inadequate for isinstance checks. Thanks John Wagenleitner for the report and Natalia for the triage. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com> Backport of 315dbe675df338ae66c8fa43274a76ecbed7ef67 from main
2025-10-03[6.0.x] Fixed #36636, Refs #15902 -- Removed session-based storage reference ↵Dani Fornons
from set_language() docs. Backport of 2514857e3fae831106832cca8823237801cf2cad from main.
2025-10-01[6.0.x] Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal ↵Sarah Boyce
via archive.extract(). Thanks stackered for the report. Follow up to 05413afa8c18cdb978fcdf470e09f7a12b234a23. Backport of 924a0c092e65fa2d0953fd1855d2dc8786d94de2 from main.
2025-10-01[6.0.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), ↵Mariusz Felisiak
aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB. Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.
2025-09-26[6.0.x] Fixed #36491 -- Fixed crash in ParallelTestRunner with --buffer.Shubham Singh
Thanks Javier Buzzi and Adam Johnson for reviews. Co-authored-by: Simon Charette <charette.s@gmail.com> Backport of be581ff473e8ade6365975db2df602f295a4cb4b from main.
2025-09-25[6.0.x] Fixed #36434 -- Preserved unbuffered stdio (-u) in autoreloader child.SaJH
Signed-off-by: SaJH <wogur981208@gmail.com> Backport of 68aae8878ff90dd787db55ecc44ee712525ccdc6 from main.
2025-09-23[6.0.x] Fixed #36543 -- Fixed time formats for fr_CA.Mridul Dhall
Thanks Chris Anderson for the report. Backport of b67a36ec6f5895f3fa6147264bae55cb014fa2a7 from main.
2025-09-23[6.0.x] Fixed #36264 -- Excluded proxy neighbors of parents from deletion ↵saJaeHyukc
collection when keep_parents=True. Signed-off-by: saJaeHyukc <wogur981208@gmail.com> Backport of 748551fea0b4e37231203a063356572a47e09efb from main.
2025-09-23[6.0.x] Fixed #36609 -- Added Haitian Creole (ht) language.Jean Patrick Prenis
Thanks Rebecca Conley for the review. Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com> Backport of 9af8225117bbc845a41ca27332c0ee1946322b90 from main
2025-09-22[6.0.x] Fixed #35453 -- Made ManyToManyField.concrete False.Ryan P Kilby
ManyToManyField was already excluded from fields, concrete_fields, and local_concrete_fields in Options. Backport of f9a44cc0fac653f8e0c2ab1cdfb12b2cc5c63fc2 from main
2025-09-22[6.0.x] Fixed #36612 -- Fixed a KeyTextTransform crash on MySQL against ↵Simon Charette
annotations. MySQL only supports the ->> when used directly against columns, this can be inferred by the presence of lhs.output_field.model as model bounds fields are directly tied to columns. Purposely don't systematically switch to using JSON_QUOTE(JSON_EXTRACT(...)) as there might be functional indices out there that rely on the SQL remaining stable between versions. Thanks Jacob Tavener for the report. Backport of af84cfba5970fda8306860b650937701c7c03c6f from main.
2025-09-22[6.0.x] Fixed #36488 -- Fixed merging of query strings in RedirectView.Samriddha9619
Co-authored-by: Ethan Jucovy <ethan.jucovy@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of a36df6890d8995480f2e95ba556b77cef975d4f6 from main.
2025-09-18[6.0.x] Updated source translation catalogs.Natalia
2025-09-18[6.0.x] Updated translations from Transifex.Natalia
Forwardport of 2a2936c3e6444a0f37156773ca405cedaf28dea7 from stable/5.2.x. Backport of 4840ab09651e4770e24d72895bc701d70d8e4f34 from main.
2025-09-17[6.0.x] Bumped version for 6.0 alpha 1 release.6.0a1Natalia
2025-09-17Refs #35859 -- Removed support for Task enqueuing on transaction commit.Jacob Walls
This removes the ability to configure Task enqueueing via a setting, since the proposed `ENQUEUE_ON_COMMIT` did not support multi-database setups. Thanks to Simon Charette for the report. Follow-up to 4289966d1b8e848e5e460b7c782dac009d746b20.
2025-09-17Refs #27222 -- Restored Model.save()'s refreshing of db_returning fields ↵Simon Charette
even if a value is set. The logic could likely be adjusted to assign the pre_save value in most cases to avoid the database transit but it could break in subtle ways so it's not worth the complexity it would require. Regression in 94680437a45a71c70ca8bd2e68b72aa1e2eff337. Co-authored-by: Tim Graham <timograham@gmail.com>
2025-09-17Fixed #36601 -- Fixed color contrast of FilteredSelectMultiple widget chosen ↵antoliny0919
labels in TabularInlines. Regression in a0f50c2a483678d31bd1ad6f08fd3a0b8399e27b.
2025-09-16Fixed #36083 -- Ran system checks in ParallelTestSuite workers.Adam Zapletal
Workers created by ParallelTestSuite were not running system checks in the spawn multiprocessing mode. In general this is fine, but system checks can have side effects expected by tests. This patch runs system checks inside of _init_worker, which is only called by ParallelTestSuite.
2025-09-16Fixed #36606 -- Optimized QuerySet.values_list(flat=True) without fields.Adam Johnson
2025-09-16Fixed #35859 -- Added background Tasks framework interface.Jake Howard
This work implements what was defined in DEP 14 (https://github.com/django/deps/blob/main/accepted/0014-background-workers.rst). Thanks to Raphael Gaschignard, Eric Holscher, Ran Benita, Sarah Boyce, Jacob Walls, and Natalia Bidart for the reviews.
2025-09-16Fixed #28041 -- Added Lexeme expression to contrib.postgres.search.GappleBee
This expression automatically escapes its input and allows fine-grained control over prefix matching and term weighting via logical combinations. Thanks Mariusz Felisiak, Adam Zapletal, Paolo Melchiorre, Jacob Walls, Adam Johnson, and Simon Charette for reviews. Co-authored-by: joetsoi <joetsoi@users.noreply.github.com> Co-authored-by: Karl Hobley <karl@kaed.uk> Co-authored-by: Alexandr Tatarinov <tatarinov1997@gmail.com>
2025-09-16Fixed #36426 -- Added support for further iterables in ↵blingblin-g
prefetch_related_objects(). Thanks Sarah Boyce for the review.
2025-09-16Refs #27222 -- Deduplicated db_returning fields in Model.save().Jacob Walls
Follow-up to 94680437a45a71c70ca8bd2e68b72aa1e2eff337.
2025-09-16Fixed #36580 -- Fixed constraint validation crash when condition uses a ↵SaJH
ForeignObject. Follow-up to e44e8327d3d88d86895735c0e427102063ff5b55. Refs #36222.
2025-09-15Fixed #36520 -- Reverted "Fixed #35440 -- Simplified parse_header_parameters ↵Natalia
by leveraging stdlid's Message." This partially reverts commit 9aabe7eae3eeb3e64c5a0f3687118cd806158550. The simplification of parse_header_parameters using stdlib's Message is reverted due to a performance regression. The check for the header maximum length remains in place, per Security Team guidance. Thanks to David Smith for reporting the regression, and Jacob Walls for the review.
2025-09-15Fixed #36589 -- Made assertTemplateUsed/NotUsed track full path for ↵Caitie Baca
PartialTemplate. Previously, assertTemplateUsed only matched partial names, ignoring the template origin. This caused assertions on partials specified by origin ("template.html#partial") to fail. Refs #36410.
2025-09-15Refs #27489 -- Made RenamePermission() operation respect database.David Sanders
Regression in f02b49d2f3bf84f5225de920ca510149f1f9f1da. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2025-09-15Renamed local variables in CsrfViewMiddleware._origin_verified() for clarity.Klaas van Schelven
2025-09-14Fixed typo in django/core/files/storage/base.py docstring.Siyabonga Dlikilili
2025-09-14Fixed #27222 -- Refreshed model field values assigned expressions on save().Simon Charette
Removed the can_return_columns_from_insert skip gates on existing field_defaults tests to confirm the expected number of queries are performed and that returning field overrides are respected.
2025-09-14Refs #27222 -- Refreshed GeneratedFields values on save() initiated update.Simon Charette
This required implementing UPDATE RETURNING machinery that heavily borrows from the INSERT one.
2025-09-12Refs #35667 -- Cached Django file prefixes for warnings.Adam Johnson
2025-09-11Fixed #36603 -- Optimized check order in LoginRequiredMiddleware.Adam Johnson
2025-09-05Fixed #36564 -- Changed DEFAULT_AUTO_FIELD from AutoField to BigAutoField.Tim Graham
2025-09-04Fixed #36578, Refs #35791 -- Ensured inline delete icon scales and stays ↵Sarah Boyce
centered in the admin. Regression in 87ab54b488cb58d810939112f208bb37068710e0. Refs #35829. Thank you Natalia Bidart for the review.
2025-09-04Fixed #36481 -- Fixed QuerySet.update concrete fields check.Ryan P Kilby
FieldError is now emitted for invalid update calls involving reverse relations, where previously they failed with AttributeError.
2025-09-04Refs #36559, #35667 -- Used skip_file_prefixes in PartialTemplate.source ↵farhan
warning.
2025-09-03Refs #34989 -- Ensured the Content-Length header is set when redirect with ↵Ronan LE HAY
APPEND_SLASH.
generated by cgit v1.3 (git 2.53.0) at 2026-10-16 15:52:24 +0000