summaryrefslogtreecommitdiff
path: root/docs
AgeCommit message (Collapse)Author
2025-12-02[5.2.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation ↵Shai Berger
in XML serializer. Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.
2025-12-02[5.2.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL ↵Jacob Walls
injection in column aliases on PostgreSQL. Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews. Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.
2025-12-01[5.2.x] Fixed #36712 -- Evaluated type annotations lazily in template tag ↵Jacob Walls
registration. Ideally, this will be reverted when an upstream solution is available for https://github.com/python/cpython/issues/141560. Thanks Patrick Rauscher for the report and Augusto Pontes for the first iteration and test. Backport of 34186e731ca20a2344b1f88fd543a854d6b13a00 from main.
2025-11-30[5.2.x] Added link to Python Pickle documentation in docs/topics/cache.txt.Rida Zouga
Co-authored-by: Rida Zouga <ridazouga@gmail.com> Backport of 3ea0195ca57790d7bd6921ecaa32312eabec78d0 from main
2025-11-27[5.2.x] Fixed outdated redis-py link in cache docs.Bruno Alla
Backport of 7b32485ee98edf7e8b94ad9c8acdccee562bf216 from main.
2025-11-27[5.2.x] Highlighted community package upgrade utilities in ↵Tim Schilling
docs/howto/upgrade-version.txt. Backport of bd7940982d6cab386dae7698ab097b91e5d8145e from main.
2025-11-26[5.2.x] Refs #36743 -- Added missing release notes for 5.1.15 and 4.2.27.Natalia
The fix landed in a8cf8c292cfee98fe6cc873ca5221935f1d02271 will be backported to 5.1 and 4.2 since the 2048 limit was rolled out as part of the security release for CVE-2025-64458. Backport of 18b13cf6c48ff0a20b2a74d3b90d1fc1602608e4 from main.
2025-11-26[5.2.x] Fixed #36743 -- Increased URL max length enforced in ↵varunkasyap
HttpResponseRedirectBase. Refs CVE-2025-64458. The previous limit of 2048 characters reused the URLValidator constant and proved too restrictive for legitimate redirects to some third-party services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH` constant (defaulting to 16384) and uses it in HttpResponseRedirectBase. Thanks Jacob Walls for report and review. Backport of a8cf8c292cfee98fe6cc873ca5221935f1d02271 from main.
2025-11-26[5.2.x] Fixed #31506 -- Clarified that ExpressionWrapper does not perform ↵Cha Hwa Young
database casts. Added warning in DateField documentation about type differences when using timedelta on PostgreSQL and MySQL. Mentioned Cast() and integer arithmetic solutions. Backport of 55af4749b9a48b2978e893e7d7be313c0b2abdb1 from main.
2025-11-25[5.2.x] Added stub release notes and release date for 5.2.9, 5.1.15, and 4.2.27.Natalia
Backport of d62e811acfc6a056e847bfcc460092a98511ed00 from main.
2025-11-24[5.2.x] Fixed #36751 -- Fixed empty filtered aggregation crash over ↵Simon Charette
annotated queryset. Regression in b8e5a8a9a2a767f584cbe89a878a42363706f939. Refs #36404. The replace_expressions method was innapropriately dealing with falsey but not None source expressions causing them to also be potentially evaluated when __bool__ was invoked (e.g. QuerySet.__bool__ evaluates the queryset). The changes introduced in b8e5a8a9a2, which were to deal with a similar issue, surfaced the problem as aggregation over an annotated queryset requires an inlining (or pushdown) of aggregate references which is achieved through replace_expressions. In cases where an empty Q object was provided as an aggregate filter, such as when the admin facetting feature was used as reported, it would wrongly be turned into None, instead of an empty WhereNode, causing a crash at aggregate filter compilation. Note that the crash signature differed depending on whether or not the backend natively supports aggregate filtering (supports_aggregate_filter_clause) as the fallback, which makes use Case / When expressions, would result in a TypeError instead of a NoneType AttributeError. Thanks Rafael Urben for the report, Antoliny and Youngkwang Yang for the triage. Backport of 2a6e0bd72d4a69725b957d6748a4b834f21b12b5 from main
2025-11-21[5.2.x] Added GitHub Actions linter (zizmor).Jacob Walls
At the direction of the Security Team. Thanks Markus Holtermann, Jake Howard, and Natalia Bidart for reviews. Backport of 09d4bf5cd9c95c588d3ec22edea5db1f5f146900 from main.
2025-11-20[5.2.x] Added missing ticket links in docs/releases/5.2.8.txt.Jacob Walls
Backport of 8ce3e1f9d0cdfdcba91e7e544804fa33f6fa9177 from main.
2025-11-20[5.2.x] Fixed #36748 -- Filtered non-standard placeholders from UNNEST queries.Chris Wesseling
Backport of 5834643f43a767fe19f2c6d10217b204e7584ec8 from main.
2025-11-18[5.2.x] Fixed #36733 -- Escaped attributes in Stylesheet.__str__().varunkasyap
Thanks Mustafa Barakat for the report, Baptiste Mispelon for the triage, and Jake Howard for the review. Backport of e05f2a75695b5f5faa7682d4053db4776d4d6f93 from main.
2025-11-13[5.2.x] Fixed #36686 -- Clarified Meta.ordering is ignored in GROUP BY queries.Kasyap Pentamaraju
Backport of 7e765a68598b2b798e49bf1f4b431a7bcac085a4 from main.
2025-11-05[5.2.x] Added CVE-2025-64458 and CVE-2025-64459 to security archive.Natalia
Backport of c5a107e8248813f07325ae65232b5e53e9ac4238 from main.
2025-11-05[5.2.x] Added stub release notes for 5.2.9.Natalia
Backport of 6e18c078d5c044a1d22dd6a64ace11d9e5f6d0bc from main.
2025-11-05[5.2.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via ↵Jacob Walls
the _connector kwarg. Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.
2025-11-05[5.2.x] Fixed CVE-2025-64458 -- Mitigated potential DoS in ↵Jacob Walls
HttpResponseRedirect/HttpResponsePermanentRedirect on Windows. Thanks Seokchan Yoon for the report, Markus Holtermann for the triage, and Jake Howard for the review. Follow-up to CVE-2025-27556 and 39e2297210d9d2938c75fc911d45f0e863dc4821. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.
2025-11-04[5.2.x] Fixed #36704 -- Fixed system check error for proxy model with a ↵Hal Blackburn
composite pk. Proxy models subclassing a model with a CompositePrimaryKey were incorrectly reporting check errors because the check that requires only local fields to be used in a composite pk was evaluated against the proxy subclass, which has no fields. To fix this, composite pk field checks are not evaluated against proxy subclasses, as none of the checks are applicable to proxy subclasses. This also has the benefit of not double-reporting real check errors from an invalid superclass pk. Thanks Clifford Gama for the review. Backport of 74564946c3b42a2ef7d087047e49873847a7e1d9 from main.
2025-10-29[5.2.x] Added stub release notes and release date for 5.2.8, 5.1.14, and 4.2.26.Jacob Walls
Backport of ab108bf94dfc06c311d7dc81866b848fe5b5ee6c from main.
2025-10-27[5.2.x] Fixed #36681 -- Removed English pluralization bias from example in ↵Kasyap Pentamaraju
docs/topics/i18n/translation.txt. Backport of 0ea01101c3a35568bc43e9707ac058b9874bd425 from main.
2025-10-23[5.2.x] Fixed #35095 -- Clarified Swiss number formatting in ↵Annabelle Wiegart
docs/topics/i18n/formatting.txt. Co-authored-by: Ahmed Nassar <a.moh.nassar00@gmail.com> Backport of 74239181252ca73bebb84789856f5d8937d421b4 from main.
2025-10-17[5.2.x] Refs #35844 -- Doc'd Python 3.14 compatibility.Mariusz Felisiak
Backport of 56977b466c33ca3da14a1ed2609172425a76a34e from main.
2025-10-17[5.2.x] Fixed #36669 -- Doc'd that negative indexes are not supported in F() ↵aj2s
slices. Backport of f715bc8990b5b8a1df948c2b71e8edbdda47e7db from main.
2025-10-14[5.2.x] Fixed #36648, Refs #33772 -- Accounted for composite pks in ↵Jacob Walls
first()/last() when aggregating. Backport of 02eed4f37879b2077496f86bb1378a076b981233 from main.
2025-10-13[5.2.x] Fixed #36625 -- Mentioned exit() in tutorial's instruction to ↵arsalan64
restart the shell. Backport of 92d0c21e69901cb7b749040670d3e6611353e1fa from main.
2025-10-11[5.2.x] Fixed #36646 -- Added compatibility for oracledb 3.4.0.Simon Charette
The Database.Binary, Date, and Timestamp attributes were changed from aliases to bytes, datetime.date, and datetime.datetime to factory functions in oracle/python-oracledb@869a887819cdac7fcd610f9d9d463ade49ea7 which made their usage inadequate for isinstance checks. Thanks John Wagenleitner for the report and Natalia for the triage. Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com> Backport of 315dbe675df338ae66c8fa43274a76ecbed7ef67 from main
2025-10-09[5.2.x] Corrected admin check IDs in docs.Mariusz Felisiak
Backport of 1167cd1d639c3fee69dbdef351d31e8a17d1fedf from main
2025-10-08[5.2.x] Fixed #36526 -- Doc'd QuerySet.bulk_update() memory usage when batching.Natalia
Thanks Simon Charette for the review. Backport of 608d3ebc8889863d43be1090d634b9507fe4a85e from main.
2025-10-08[5.2.x] Fixed #35961 -- Migrated license metadata in pyproject.toml to ↵Michiel W. Beijen
conform PEP 639. See https://peps.python.org/pep-0639/ and https://packaging.python.org/en/latest/guides/writing-pyproject-toml/#license-and-license-files. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Backport of 96a7a652166bece8acc96d6335ebb8091de2f496 from main.
2025-10-08[5.2.x] Added missing backticks in docs/ref/models/fields.txt.Mariusz Felisiak
Backport of 4a8ca8bd6906b705c4445bc915d71beda2fc4b84 from main
2025-10-03[5.2.x] Fixed #36636, Refs #15902 -- Removed session-based storage reference ↵Dani Fornons
from set_language() docs. Backport of 2514857e3fae831106832cca8823237801cf2cad from main.
2025-10-03[5.2.x] Refs #36143, #28596 -- Avoided mentioning exact query parameter ↵Jacob Walls
limit in bulk_create() docs. Backport of 0a09c60e97166e0188717ff340b4d93b72207e96 from main.
2025-10-01[5.2.x] Rewrapped security archive at 79 chars.Mariusz Felisiak
Backport of 1499c95d990fb776c39ad60e43228cbbbfcad3a8 from main.
2025-10-01[5.2.x] Added CVE-2025-59681 and CVE-2025-59682 to security archive.Jacob Walls
Backport of 43d84aef04a9e71164c21a74885996981857e66e from main.
2025-10-01[5.2.x] Added stub release notes for 5.2.8.Jacob Walls
Backport of 1324d9037e9281ec0fdd88c15b20881c7a6ea8b9 from main.
2025-10-01[5.2.x] Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal ↵Sarah Boyce
via archive.extract(). Thanks stackered for the report. Follow up to 05413afa8c18cdb978fcdf470e09f7a12b234a23. Backport of 924a0c092e65fa2d0953fd1855d2dc8786d94de2 from main.
2025-10-01[5.2.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), ↵Mariusz Felisiak
aggregate(), and extra() against SQL injection in column aliases on MySQL/MariaDB. Thanks sw0rd1ight for the report. Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200. Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.
2025-09-30[5.2.x] Made cosmetic edits to 5.2.7 release notes.Jacob Walls
Backport of 6c82b0bc91fc650891b0b411ac4a5a86cf0cf3e8 from main.
2025-09-29[5.2.x] Fixed #36587 -- Clarified usage of `list.insert()` for upload handlers.okaybro
Thanks Baptiste Mispelon for the report Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of afe6634146d0fe70498976c49d2eb4d745aa9064 from main.
2025-09-29[5.2.x] Fixed #35877, Refs #36128 -- Documented unique constraint when ↵Samriddha9619
migrating a m2m field to use a through model. Backport of daba609a9bdc7a97bcf327c7ba0a5f7b3540b46e from main.
2025-09-24[5.2.x] Added stub release notes and release date for 5.2.7, 5.1.13, and 4.2.25.Mariusz Felisiak
Backport of 00174507f8a91e9577ae233c58af561b379f2695 from main.
2025-09-23[5.2.x] Refs #25508 -- Used QuerySet.__repr__ in ↵Jacob Walls
docs/ref/contrib/postgres/search.txt. Backport of efb96138b4af774c22ae6e949410b45d69960357 from main.
2025-09-18[5.2.x] Fixed #36581 -- Updated serialization examples from XML to JSON.CodingWithSaksham
Backport of 762d3be8c559b0abf415be8d6117f04fb6347983 from main.
2025-09-18[5.2.x] Updated translations from Transifex.Natalia
2025-09-17[5.2.x] Fixed #36601 -- Fixed color contrast of FilteredSelectMultiple ↵antoliny0919
widget chosen labels in TabularInlines. Regression in a0f50c2a483678d31bd1ad6f08fd3a0b8399e27b. Backport of 1e7728888dbbff437ad9847c82b84feb81f785df from main.
2025-09-13[5.2.x] Fixed typo in docs/ref/contrib/contenttypes.txt.Jacob Walls
Backport of c48904a225e2e8f02274257247d5b7d29c5fe183 from main.
2025-09-12[5.2.x] Fixed #36597 -- Corrected directives for functions from email module ↵Mridul Dhall
in docs. Thanks Mike Edmunds for the report. Backport of e183d6c26c8da4486c151f9ce973828e2404a796 from main.
generated by cgit v1.3 (git 2.53.0) at 2026-07-03 13:15:18 +0000