chango.git - django

Age	Commit message (Collapse)	Author
2025-06-04	Fixed CVE-2025-48432 -- Escaped formatting arguments in `log_response()`.	Natalia
	Suitably crafted requests containing a CRLF sequence in the request path may have allowed log injection, potentially corrupting log files, obscuring other attacks, misleading log post-processing tools, or forging log entries. To mitigate this, all positional formatting arguments passed to the logger are now escaped using "unicode_escape" encoding. Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report. Co-authored-by: Carlton Gibson <carlton@noumenal.es> Co-authored-by: Jake Howard <git@theorangeone.net>
2025-06-04	Fixed #36432 -- Fixed a prefetch_related crash on related target subclass ↵	Simon Charette
	queryset. Regression in 626d77e52a3f247358514bcf51c761283968099c. Refs #36116. Thanks Cornelis Poppema for the excellent report.
2025-06-03	Fixed #36411 -- Made HttpRequest.get_preferred_type() consider media type ↵	Jake Howard
	parameters. HttpRequest.get_preferred_type() did not account for parameters in Accept header media types (e.g., "text/vcard; version=3.0"). This caused incorrect content negotiation when multiple types differed only by parameters, reducing specificity as per RFC 7231 section 5.3.2 (https://datatracker.ietf.org/doc/html/rfc7231.html#section-5.3.2). This fix updates get_preferred_type() to treat media types with parameters as distinct, allowing more precise and standards-compliant matching. Thanks to magicfelix for the report, and to David Sanders and Sarah Boyce for the reviews.
2025-06-03	Fixed #36416 -- Made QuerySet.in_bulk() account for composite pks in id_list.	Jacob Walls

2025-06-02	Fixed #36423 -- Prevented filter_horizontal buttons from intercepting form ↵	Blayze
	submission. In the admin's filter_horizontal widget, optional action buttons like "Choose all", "Remove all", etc. were changed from `<a>` to `<button>` elements in #34619, but without specifying `type="button"`. As a result, when pressing Enter while focused on a form input, these buttons could be triggered and intercept form submission. Explicitly set `type="button"` on these control buttons to prevent them from acting as submit buttons. Thanks Antoliny Lee for the quick triage and review. Regression in 857b1048d53ebf5fc5581c110e85c212b81ca83a.
2025-05-28	Added stub release notes and release date for 5.2.2, 5.1.10, and 4.2.22.	Natalia

2025-05-23	Fixed #36405 -- Fixed Aggregate.order_by using OuterRef.	Adam Johnson
	co-authored-by: Simon Charette <charette.s@gmail.com>
2025-05-23	Fixed #36404 -- Fixed Aggregate.filter using OuterRef.	Adam Johnson
	Regression in a76035e925ff4e6d8676c65cb135c74b993b1039. Thank you to Simon Charette for the review. co-authored-by: Simon Charette <charette.s@gmail.com>
2025-05-23	Fixed #36390 -- Deprecated RemoteUserMiddleware subclasses missing ↵	Sarah Boyce
	aprocess_request(). Regression in 50f89ae850f6b4e35819fe725a08c7e579bfd099. Thank you to shamoon for the report and Natalia Bidart for the review.
2025-05-19	Fixed #36388 -- Made QuerySet.union() return self when called with no arguments.	Colleen Dunlap
	Regression in 9cb8baa0c4fa2c10789c5c8b65f4465932d4d172. Thank you to Antoine Humeau for the report and Simon Charette for the review.
2025-05-16	Fixed #36392 -- Raised ValueError when subquery referencing composite pk ↵	Jacob Walls
	selects too many columns.
2025-05-12	Fixed #36373 -- Fixed select_related() crash on foreign object for a ↵	Simon Charette
	composite pk. Thanks Jacob Walls for the report and Sarah for the in-depth review.
2025-05-07	Added stub release notes for 5.2.2.	Natalia