summaryrefslogtreecommitdiff
path: root/docs/releases
AgeCommit message (Collapse)Author
3 daysFixed #37257, Refs #35738 -- Prevented double-dot deprecation warnings for ↵Adam Johnson
template literals. The deprecation warning for double-dot variable lookups checked str(filter_expression.var), which for constants is the resolved literal value rather than a variable lookup. Templates containing string or translated string literals with two consecutive dots, such as {{ "a..b" }} or {{ 'a..b'|upper }}, therefore incorrectly raised a RemovedInDjango70Warning. The check now only applies when the filter expression's variable is a Variable lookup. Regression in 5d911f2d2fecc703be91b2b9b28acc59d34b35f3.
8 daysAdded stub release notes for 6.1.1.Jacob Walls
8 daysFinalized release notes for Django 6.1.Jacob Walls
9 daysAdded CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, and CVE-2026-15920 to ↵Natalia
security archive.
9 daysFixed CVE-2026-15920 -- Made display_for_field() validate URLs before ↵Natalia
rendering admin links. The admin renders URLField values as clickable links on changelists and read-only change forms. The link was built without validating the URL, so a potentially dangerous stored value could be rendered as a link that runs script in a staff member's authenticated session when clicked. The admin renders URLField values as clickable links on changelists and read-only change forms. The link was built without validating the URL, so a stored value using a potentially dangerous value was rendered as a link, which could lead to cross-site scripting in an authenticated admin session. Refs CVE-2019-12308, #36032. Thanks to Egor Saltykov for the report, and Sarah Boyce for reviews.
9 daysFixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry collections.Jacob Walls
Since deeply nested geometry collections can lead to fatal errors in GEOS, a new `max_geom_collections` argument on geometry model and form fields, passed down to `GEOSGeometry` itself, allows limiting either depth (WKT) or total number (WKB) before reaching GEOS. Thanks Andrew MacPherson and kimchunbok_ for the reports, and Natalia Bidart, Simon Charette, and Sarah Boyce for reviews.
9 daysFixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language().Natalia
Language codes longer than 500 characters are now rejected before the cached lookup, so they are no longer retained as cache keys consuming memory from each process. Thanks Jaeyoung Jang for the report, and Sarah Boyce for reviews.
9 daysFixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial lookups.Jacob Walls
Spatial lookups optimistically parse values as rasters before retrying as geometries. If a malicious value reached the GDALRaster constructor, depending on the raster driver, it might write to disk or fetch from the network regardless of the constructor's `write=False` default argument. Although this works as designed for model field assignment, this is potentially unexpected for querying, for example, in the admin's changelist view, which allows staff users to execute arbitrary lookups on models registered with the admin. Network rasters didn't even work in lookup contexts before, providing further evidence that this use case was unintentional. (The failure point was after the fetching, however.) Now, strings and dicts representing rasters are rejected by spatial lookups. To opt in to using them, wrap them in a `GDALRaster` first. Although it would simplify the implementation to try geometries before rasters (instead of stashing a raster exception and raising it later), we maintain the current order, which has been stable for a decade. Thanks Bence Nagy, localhost-detect, and kimchunbok_ for providing information useful in evaluating this report. Thanks Simon Charette, Natalia Bidart, and Sarah Boyce for reviews.
10 daysRefs #28586 -- Renamed RAISE fetch mode to FETCH_RAISE.Jacob Walls
This aims for consistency in the django.db.models namespace. Thanks Natalia Bidart and Simon Charette for the idea.
13 daysFixed #36626 -- Preserved milliseconds in DataSource time fields.Francesco Bruni
13 daysRefs #37139 -- Doc'd _is_pk_set() handling of DatabaseDefault.Jacob Walls
13 daysFixed #37235 -- Added compatibility for sqlparse 0.5.5.Sarah Boyce
Thank you to Jacob Walls and Nick Pope for the review.
2026-07-29Fixed #37234 -- Fixed bulk_create() for late-saved related primary keys.Filip Sedlák
Objects with a primary key supplied by a late-saved related instance were partitioned before their related fields were prepared. This caused an assertion failure on backends returning rows from bulk inserts. Regression in 7d9aab8da0a06787d649762a702e1a518d843a63.
2026-07-28Added stub release notes and release date for 6.0.8 and 5.2.17.Natalia
2026-07-24Fixed #37160 -- Made admin views raise PermissionDenied consistently.Natalia
The admin view_on_site and history views now return an HTTP 403 response when a staff user lacks view or change permission for the target model, consistent with the changeform and autocomplete views. Thanks Bence Nagy for the report.
2026-07-24Fixed minor typos and grammatical errors in docs and docstrings.Jacob Walls
Thanks to these people for pointing these out: * Hojeong Park * Natalia Bidart * Sulav Raj Bista
2026-07-23Fixed #36027 -- Made error response rendering thread-sensitive.Carlton Gibson
Error response handling frequently makes use of the database, and so must use the request specific connection sensitive worker thread. Previously response_for_exception was dispatched on the event loop's default executor. This potentially leads to pool exhaustion, and deadlock, when using database pooling option, or a large number of permanently held open database connections when not using pooling. Connections held open were not subject to cleanup. If closed server side, the reported "connection is closed" would be seen until application restart. Moving error response rendering to the request specific connection sensitive worker thread resolves both of these issues. The `thread_sensitive=False` was set in e17ee4468875077b90b70bb6a589ebad7493f757 to maintain the prior behaviour when asgiref switched the thread_sensitive default to `True`. There was no specific reason for the non-tread-sensitive behaviour beyond that. (With hindsight it was always incorrect for the reasons here.)
2026-07-22Added expected end of support dates for 6.1.Jacob Walls
2026-07-16Fixed #32915 -- Suppressed fewer ImportErrors in management commands.Ben Cail
Before, exceptions during settings loading were swallowed by management commands. Now, if the new command attribute settings_required is True (default), the error will be printed to stderr, and the command will exit non-zero. makemessages, runserver, shell, and startproject continue to tolerate missing settings (via settings_required=False). Regression in c6864a01b25591d3a709da8071413b69c9e35341, which added support for some commands (e.g. startproject) to cope with missing settings. Thanks Mariusz Felisiak, Sarah Boyce, Jacob Walls, Mike Edmunds, and Brian Helba for reviews. Co-authored-by: Rohith PR <praroh2@gmail.com>
2026-07-15Updated asgiref dependency.Carlton Gibson
2026-07-13Fixed #37178 -- Moved MiddlewareMixin out of utils.deprecation.CharulL00
2026-07-10Fixed #36864 -- Supported modules and submodules in import_string().Leland
Before, only submodules worked (and only if already imported). Now, all modules work regardless of prior import state. Updated expected exception in auth tests where import_string() returns a non-callable.
2026-07-10Fixed #35813 -- Made migrations track all changes to unmanaged models.Hanny
Previously, only create and delete operations were generated.
2026-07-08Refs #36277 -- Added release note for Postgres 18+ virtual column.Simon Charette
2026-07-07Added CVE-2026-48588, CVE-2026-53877, and CVE-2026-53878 to security archive.Jacob Walls
2026-07-07Added stub release notes for 6.0.8.Jacob Walls
2026-07-06Fixed CVE-2026-53878 -- Prevented newlines from being accepted in ↵Natalia
DomainNameValidator. Thanks Bence Nagy for the report, and Jake Howard for reviews.
2026-07-06Fixed CVE-2026-53877 -- Prevented heap buffer over-read when creating ↵Jacob Walls
GDALRaster from bytes. Previously, `sys.getsizeof()` included the size of the `PyBytesObject` wrapper which is bigger. `len(bytes_object)` is the accurate size. Thanks Bence Nagy for the report, and Simon Charette for reviews.
2026-07-06Fixed CVE-2026-48588 -- Prevented caching of responses that set cookies and ↵Natalia
vary on Cookie. `UpdateCacheMiddleware` skipped caching `Set-Cookie` responses that vary on `Cookie` only when the request had no cookies at all. A request carrying an unrelated cookie bypassed the guard, allowing a newly-issued session cookie to be stored in Django's shared cache. The guard now applies whenever a response both sets a cookie and varies on Cookie, regardless of what cookies the incoming request carried. Thanks Chris Whyland for the report, Jake Howard for initial triage, and Jacob Walls for reviews.
2026-06-30Added stub release notes and release date for 6.0.7 and 5.2.16.Jacob Walls
2026-06-26Fixed #37184 -- Allowed non-UTF-8 bytes passwords in the PBKDF2 and MD5 ↵Jacob Walls
password hashers. An unnecessary force_str() call in the PBKDF2 hasher raised UnicodeDecodeError on perfectly valid password values. The MD5 hasher had a similar issue, however the same commit that introduced the bug also happened to allow bytes in general, so preserve the support while removing the constraint on UTF-8 validity by concatenating like: force_bytes(salt) + force_bytes(password) Regression in 78fac1b0473ed8960ecd2a30aca4fa8420d150b8. Co-authored-by: Vishy <vis.pypi@gmail.com>
2026-06-24Refs #35514 -- Added migration guide link to `AdminEmailHandler` deprecation ↵Adam Johnson
note.
2026-06-24Refs #35870 -- Mentioned transitional setting in BLANK_CHOICE_DASH release note.Jacob Walls
2026-06-24Refs #37101, #37174 -- Added release note for cache misses when varying on ↵Jacob Walls
arguments. Thanks Natalia Bidart for the review.
2026-06-23Fixed #37166 -- Added deploy system check for dev-only 'default' MAILERS.Mike Edmunds
Added mail.E001 deployment-only system check to detect one of Django's not-for-production-use email backends in the "default" MAILERS entry.
2026-06-22Fixed #37161 -- Warned via system check on missing "default" entry in ↵badereddinebenhirt
MAILERS setting. Thanks Mike Edmunds for reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2026-06-22Refs #32785 -- Fixed Sphinx reference in release note.Jacob Walls
2026-06-18Fixed #37143 -- Added missing chunk_size=None check to QuerySet.aiterator().zhengkangyang
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2026-06-16Fixed #37152 -- Raised ValueError when Bcc is used in EmailMessage headers.diaxoaine
Bcc addresses are sent via the SMTP envelope and must never appear in the message itself. A "Bcc" key in `extra_headers` was not excluded like From/To/Cc/Reply-To, so it leaked into the generated message as a visible header. Thanks Mike Edmunds for reviews.
2026-06-16Refs #37142 -- Removed docs for django.utils.warnings.django_file_prefixes().Natalia
This reverts docs changes from commit f970a98e464320c09dde8d45009eadfb4d038a57.
2026-06-11Fixed #37141 -- Added --using option to sendtestemail command.NagaKartheekReddy
2026-06-11Fixed #36837 -- Skipped backends not implementing (a)get_user() in ↵Sezer BOZKIR
(a)force_login(). Co-authored-by: Mykhailo Havelia <Arfey17.mg@gmail.com>
2026-06-10Fixed #37142 -- Moved django_file_prefixes() to django.utils.warnings.zhengkangyang
2026-06-08Fixed #32785 -- Optimized cull frequency for DBCache.eevelweezel
2026-06-05Fixed #36984 -- Made inline formset error messages respect ↵Karolis Ryselis
delete_confirmation_max_display.
2026-06-03Refs CVE-2026-6873 -- Defaulted SIGNED_COOKIE_LEGACY_SALT_FALLBACK ↵Jacob Walls
transitional setting to False.
2026-06-03Added CVE-2026-6873, CVE-2026-7666, CVE-2026-8404, CVE-2026-35193, and ↵Natalia
CVE-2026-48587 to security archive.
2026-06-03Added stub release notes for 6.0.7.Natalia
2026-06-03Fixed CVE-2026-48587 -- Ignored whitespace padding when checking Vary header ↵Jake Howard
values. Thanks to Navid Rezazadeh for the report and Jacob Walls for review.
2026-06-03Fixed CVE-2026-35193 -- Varied on Authorization when caching non-public ↵Jacob Walls
responses. Thanks Shai Berger for the report, and Natalia Bidart and Sarah Boyce for reviews.
generated by cgit v1.3 (git 2.53.0) at 2026-08-13 14:30:11 +0000