summaryrefslogtreecommitdiff
path: root/docs/releases
AgeCommit message (Collapse)Author
2025-12-03Finalized release notes for Django 6.0.Natalia
2025-12-03Made cosmetic edits to docs/releases/6.0.txt.Adam Johnson
2025-12-02Added CVE-2025-13372 and CVE-2025-64460 to security archive.Natalia
2025-12-02Added stub release notes for 5.2.10.Natalia
2025-12-02Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation in XML ↵Shai Berger
serializer. Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-12-02Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL injection in ↵Jacob Walls
column aliases on PostgreSQL. Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews.
2025-12-01Fixed #36712 -- Evaluated type annotations lazily in template tag registration.Jacob Walls
Ideally, this will be reverted when an upstream solution is available for https://github.com/python/cpython/issues/141560. Thanks Patrick Rauscher for the report and Augusto Pontes for the first iteration and test.
2025-11-26Refs #36743 -- Added missing release notes for 5.1.15 and 4.2.27.Natalia
The fix landed in a8cf8c292cfee98fe6cc873ca5221935f1d02271 will be backported to 5.1 and 4.2 since the 2048 limit was rolled out as part of the security release for CVE-2025-64458.
2025-11-26Fixed #36743 -- Increased URL max length enforced in HttpResponseRedirectBase.varunkasyap
Refs CVE-2025-64458. The previous limit of 2048 characters reused the URLValidator constant and proved too restrictive for legitimate redirects to some third-party services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH` constant (defaulting to 16384) and uses it in HttpResponseRedirectBase. Thanks Jacob Walls for report and review.
2025-11-25Added stub release notes and release date for 5.2.9, 5.1.15, and 4.2.27.Natalia
2025-11-25Fixed #36756 -- Dropped support for GDAL 3.1 and 3.2.Mariusz Felisiak
2025-11-25Fixed #35783 -- Added NumDimensions GIS database function and ↵David Smith
__num_dimensions lookup.
2025-11-24Fixed #36751 -- Fixed empty filtered aggregation crash over annotated queryset.Simon Charette
Regression in b8e5a8a9a2a767f584cbe89a878a42363706f939. Refs #36404. The replace_expressions method was innapropriately dealing with falsey but not None source expressions causing them to also be potentially evaluated when __bool__ was invoked (e.g. QuerySet.__bool__ evaluates the queryset). The changes introduced in b8e5a8a9a2, which were to deal with a similar issue, surfaced the problem as aggregation over an annotated queryset requires an inlining (or pushdown) of aggregate references which is achieved through replace_expressions. In cases where an empty Q object was provided as an aggregate filter, such as when the admin facetting feature was used as reported, it would wrongly be turned into None, instead of an empty WhereNode, causing a crash at aggregate filter compilation. Note that the crash signature differed depending on whether or not the backend natively supports aggregate filtering (supports_aggregate_filter_clause) as the fallback, which makes use Case / When expressions, would result in a TypeError instead of a NoneType AttributeError. Thanks Rafael Urben for the report, Antoliny and Youngkwang Yang for the triage.
2025-11-22Fixed #35774 -- Dropped support for GEOS 3.8.David Smith
GEOS 3.8 (released Oct-2019) will be more than 5 years old when Django 6.1 is released (Aug-2026).
2025-11-21Fixed #36718 -- Added JSONField support for negative array indexing on ↵Clifford Gama
Oracle 21c+.
2025-11-20Added missing ticket links in docs/releases/5.2.8.txt.Jacob Walls
2025-11-20Fixed #36748 -- Filtered non-standard placeholders from UNNEST queries.Chris Wesseling
2025-11-20Fixed #36321 -- Defaulted suggest_on_error=True in management commands.kihuni
Python 3.15 defaults suggest_on_error=True, but the feature is available from 3.14, so this change opts in earlier. This change can be reverted when Python 3.15 is the minimum supported version.
2025-11-20Refs #36663, #36739 -- Added release note for running checks against all ↵Storm B. Heg
databases.
2025-11-18Fixed #36733 -- Escaped attributes in Stylesheet.__str__().varunkasyap
Thanks Mustafa Barakat for the report, Baptiste Mispelon for the triage, and Jake Howard for the review.
2025-11-17Fixed #24920 -- Added support for DecimalField with no precision.Mariusz Felisiak
Thanks Lily for the review.
2025-11-14Refs #24928 -- Added introspection support for PostgreSQL HStoreField.Mariusz Felisiak
2025-11-12Fixed #36717 -- Redirect authenticated users on admin login view to next URL.Benedict Etzel
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-11-05Added CVE-2025-64458 and CVE-2025-64459 to security archive.Natalia
2025-11-05Added stub release notes for 5.2.9.Natalia
2025-11-05Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via the ↵Jacob Walls
_connector kwarg. Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews.
2025-11-05Fixed CVE-2025-64458 -- Mitigated potential DoS in ↵Jacob Walls
HttpResponseRedirect/HttpResponsePermanentRedirect on Windows. Thanks Seokchan Yoon for the report, Markus Holtermann for the triage, and Jake Howard for the review. Follow-up to CVE-2025-27556 and 39e2297210d9d2938c75fc911d45f0e863dc4821.
2025-11-04Fixed #36704 -- Fixed system check error for proxy model with a composite pk.Hal Blackburn
Proxy models subclassing a model with a CompositePrimaryKey were incorrectly reporting check errors because the check that requires only local fields to be used in a composite pk was evaluated against the proxy subclass, which has no fields. To fix this, composite pk field checks are not evaluated against proxy subclasses, as none of the checks are applicable to proxy subclasses. This also has the benefit of not double-reporting real check errors from an invalid superclass pk. Thanks Clifford Gama for the review.
2025-10-31Fixed #36661 -- Added introspection of database-level delete options.Mariusz Felisiak
2025-10-29Refs #35381 -- Deprecated using None in JSONExact rhs to mean JSON null.Clifford Gama
Key and index lookups are exempt from the deprecation. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2025-10-29Refs #35381 -- Delegated ArrayField element prepping to ↵Clifford Gama
base_field.get_db_prep_save. Previously, ArrayField always used base_field.get_db_prep_value when saving, which could differ from how base_field prepares data for save. This change overrides ArrayField.get_db_prep_save to delegate to the base_field's get_db_prep_save, ensuring elements like None in JSONField arrays are saved correctly as SQL NULL instead of JSON null.
2025-10-29Fixed #35381 -- Added JSONNull() expression.Clifford Gama
Thanks Jacob Walls for the review.
2025-10-29Added stub release notes and release date for 5.2.8, 5.1.14, and 4.2.26.Jacob Walls
2025-10-27Fixed #36624 -- Dropped support for MySQL < 8.4.Mariusz Felisiak
2025-10-22Made cosmetic edits to docs/releases/6.0.txt.Natalia
2025-10-19Refs #36005 -- Bumped minimum supported versions of docutils to 0.22.Mariusz Felisiak
2025-10-18Fixed #36671 -- Dropped support for SQLite < 3.37.Mariusz Felisiak
2025-10-18Fixed #21961 -- Added support for database-level delete options for ForeignKey.Mariusz Felisiak
Thanks Simon Charette for pair programming. Co-authored-by: Nick Stefan <NickStefan12@gmail.com> Co-authored-by: Akash Kumar Sen <71623442+Akash-Kumar-Sen@users.noreply.github.com> Co-authored-by: Simon Charette <charette.s@gmail.com>
2025-10-17Refs #35844 -- Doc'd Python 3.14 compatibility.Mariusz Felisiak
2025-10-16Fixed #28586 -- Added model field fetch modes.Adam Johnson
May your database queries be much reduced with minimal effort. co-authored-by: Andreas Pelme <andreas@pelme.se> co-authored-by: Simon Charette <charette.s@gmail.com> co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2025-10-14Fixed #36648, Refs #33772 -- Accounted for composite pks in first()/last() ↵Jacob Walls
when aggregating.
2025-10-13Fixed #36611, Refs #36580 -- Added system check for multicolumn ↵Sarah Boyce
ForeignObject in Meta.indexes/constraints/unique_together. ForeignObjects with multiple `from_fields` are not supported in these options. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-10-11Fixed #36646 -- Added compatibility for oracledb 3.4.0.Simon Charette
The Database.Binary, Date, and Timestamp attributes were changed from aliases to bytes, datetime.date, and datetime.datetime to factory functions in oracle/python-oracledb@869a887819cdac7fcd610f9d9d463ade49ea7 which made their usage inadequate for isinstance checks. Thanks John Wagenleitner for the report and Natalia for the triage. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2025-10-03Fixed #36623 -- Dropped support for PostgreSQL 14 and PostGIS 3.1.Mariusz Felisiak
2025-10-01Rewrapped security archive at 79 chars.Mariusz Felisiak
2025-10-01Added CVE-2025-59681 and CVE-2025-59682 to security archive.Jacob Walls
2025-10-01Added stub release notes for 5.2.8.Jacob Walls
2025-10-01Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal via ↵Sarah Boyce
archive.extract(). Thanks stackered for the report. Follow up to 05413afa8c18cdb978fcdf470e09f7a12b234a23.
2025-10-01Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggregate(), ↵Mariusz Felisiak
and extra() against SQL injection in column aliases on MySQL/MariaDB. Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200.
2025-09-30Made cosmetic edits to 5.2.7 release notes.Jacob Walls
generated by cgit v1.3 (git 2.53.0) at 2026-07-14 03:34:14 +0000