summaryrefslogtreecommitdiff
path: root/docs
AgeCommit message (Collapse)Author
2025-12-03[6.0.x] Updated man page for Django 6.0.Natalia
2025-12-03[6.0.x] Refs #35859 -- Clarified Tasks ref and topics docs regarding ↵Jacob Walls
available backends. Backport of d3f142f2cd36ba0458cc679397555bd5ee7db744 from main.
2025-12-03[6.0.x] Finalized release notes for Django 6.0.Natalia
Backport of ea4920174e3231ff5b72b3ffb2b20432671047d9 from main.
2025-12-03[6.0.x] Made cosmetic edits to docs/releases/6.0.txt.Adam Johnson
Backport of fe42aa6100a2df4702e2399cffb375dbc986b036 from main.
2025-12-02[6.0.x] Added CVE-2025-13372 and CVE-2025-64460 to security archive.Natalia
Backport of d0d596042e958809a13b681d7a184ac7b95e0aa3 from main.
2025-12-02[6.0.x] Added stub release notes for 5.2.10.Natalia
Backport of 8d4ec9949aedc11a258d718689550eea61ae8d4c from main.
2025-12-02[6.0.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation ↵Shai Berger
in XML serializer. Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.
2025-12-02[6.0.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL ↵Jacob Walls
injection in column aliases on PostgreSQL. Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews. Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.
2025-12-01[6.0.x] Fixed #36712 -- Evaluated type annotations lazily in template tag ↵Jacob Walls
registration. Ideally, this will be reverted when an upstream solution is available for https://github.com/python/cpython/issues/141560. Thanks Patrick Rauscher for the report and Augusto Pontes for the first iteration and test. Backport of 34186e731ca20a2344b1f88fd543a854d6b13a00 from main.
2025-11-30[6.0.x] Added link to Python Pickle documentation in docs/topics/cache.txt.Rida Zouga
Co-authored-by: Rida Zouga <ridazouga@gmail.com> Backport of 3ea0195ca57790d7bd6921ecaa32312eabec78d0 from main
2025-11-27[6.0.x] Fixed outdated redis-py link in cache docs.Bruno Alla
Backport of 7b32485ee98edf7e8b94ad9c8acdccee562bf216 from main
2025-11-27[6.0.x] Highlighted community package upgrade utilities in ↵Tim Schilling
docs/howto/upgrade-version.txt. Backport of bd7940982d6cab386dae7698ab097b91e5d8145e from main.
2025-11-26[6.0.x] Included usage of new scripts in ↵Natalia
docs/internals/howto-release-django.txt. Backport of 60b08ad5e1701b1a9b2a03e5897670d5af32d379 from main.
2025-11-26[6.0.x] Refs #36743 -- Added missing release notes for 5.1.15 and 4.2.27.Natalia
The fix landed in a8cf8c292cfee98fe6cc873ca5221935f1d02271 will be backported to 5.1 and 4.2 since the 2048 limit was rolled out as part of the security release for CVE-2025-64458. Backport of 18b13cf6c48ff0a20b2a74d3b90d1fc1602608e4 from main.
2025-11-26[6.0.x] Fixed #36743 -- Increased URL max length enforced in ↵varunkasyap
HttpResponseRedirectBase. Refs CVE-2025-64458. The previous limit of 2048 characters reused the URLValidator constant and proved too restrictive for legitimate redirects to some third-party services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH` constant (defaulting to 16384) and uses it in HttpResponseRedirectBase. Thanks Jacob Walls for report and review. Backport of a8cf8c292cfee98fe6cc873ca5221935f1d02271 from main.
2025-11-26[6.0.x] Fixed #31506 -- Clarified that ExpressionWrapper does not perform ↵Cha Hwa Young
database casts. Added warning in DateField documentation about type differences when using timedelta on PostgreSQL and MySQL. Mentioned Cast() and integer arithmetic solutions. Backport of 55af4749b9a48b2978e893e7d7be313c0b2abdb1 from main.
2025-11-25[6.0.x] Added stub release notes and release date for 5.2.9, 5.1.15, and 4.2.27.Natalia
Backport of d62e811acfc6a056e847bfcc460092a98511ed00 from main.
2025-11-24[6.0.x] Fixed #36751 -- Fixed empty filtered aggregation crash over ↵Simon Charette
annotated queryset. Regression in b8e5a8a9a2a767f584cbe89a878a42363706f939. Refs #36404. The replace_expressions method was innapropriately dealing with falsey but not None source expressions causing them to also be potentially evaluated when __bool__ was invoked (e.g. QuerySet.__bool__ evaluates the queryset). The changes introduced in b8e5a8a9a2, which were to deal with a similar issue, surfaced the problem as aggregation over an annotated queryset requires an inlining (or pushdown) of aggregate references which is achieved through replace_expressions. In cases where an empty Q object was provided as an aggregate filter, such as when the admin facetting feature was used as reported, it would wrongly be turned into None, instead of an empty WhereNode, causing a crash at aggregate filter compilation. Note that the crash signature differed depending on whether or not the backend natively supports aggregate filtering (supports_aggregate_filter_clause) as the fallback, which makes use Case / When expressions, would result in a TypeError instead of a NoneType AttributeError. Thanks Rafael Urben for the report, Antoliny and Youngkwang Yang for the triage. Backport of 2a6e0bd72d4a69725b957d6748a4b834f21b12b5 from main
2025-11-21[6.0.x] Added GitHub Actions linter (zizmor).Jacob Walls
At the direction of the Security Team. Thanks Markus Holtermann, Jake Howard, and Natalia Bidart for reviews. Backport of 09d4bf5cd9c95c588d3ec22edea5db1f5f146900 from main.
2025-11-20[6.0.x] Added missing ticket links in docs/releases/5.2.8.txt.Jacob Walls
Backport of 8ce3e1f9d0cdfdcba91e7e544804fa33f6fa9177 from main.
2025-11-20[6.0.x] Fixed #36748 -- Filtered non-standard placeholders from UNNEST queries.Chris Wesseling
Backport of 5834643f43a767fe19f2c6d10217b204e7584ec8 from main.
2025-11-20[6.0.x] Ensured that Sitemap.items is described as a method in ↵nessita
docs/ref/contrib/sitemaps.txt. Backport of ee2e0e202874db31449d3c7c292504652fa87f69 from main.
2025-11-18[6.0.x] Fixed #36733 -- Escaped attributes in Stylesheet.__str__().varunkasyap
Thanks Mustafa Barakat for the report, Baptiste Mispelon for the triage, and Jake Howard for the review. Backport of e05f2a75695b5f5faa7682d4053db4776d4d6f93 from main.
2025-11-17[6.0.x] Fixed #26379 -- Doc'd that the first filter() on a many-to-many ↵Annabelle Wiegart
relation is sticky. Backport of 3c005b5f79bf6d71f3f4c3692ed670e1722b0fb6 from main.
2025-11-13[6.0.x] Fixed #36686 -- Clarified Meta.ordering is ignored in GROUP BY queries.Kasyap Pentamaraju
Backport of 7e765a68598b2b798e49bf1f4b431a7bcac085a4 from main.
2025-11-10[6.0.x] Fixed typo in docs/ref/databases.txt.Clifford Gama
Backport of 2b0f24e6223bf7e294fba63741f58eb7b0bf49ff from main.
2025-11-10[6.0.x] Clarified "get_db_prep_value" default result in ↵Clifford Gama
docs/ref/models/fields.txt. Backport of c135be349ddd9fd71b15d4b20e7fc46814e4ca7c from main.
2025-11-10[6.0.x] Clarified EmailValidator docs to specify it validates an email address.Hong Xu
Updated the EmailValidator docs in docs/ref/validators.txt to explicitly state that it validates an email address, to avoid confusion with validating email message content. Backport of a4f76741340fb23566795e83f830a3f2d49acce0 from main.
2025-11-06[6.0.x] Removed community packages admonition from settings docs.Tim Schilling
Backport of 5ef870fbc5a65cce65b42a8f9cdb208a32d3dd31 from main.
2025-11-06[6.0.x] Added community package email backends mention to docs.Tim Schilling
Co-authored-by: Clifford Gama <cliffygamy@gmail.com> Backport of 47ac64ed8bba4de98376b961c739036b3199394b from main.
2025-11-05[6.0.x] Added CVE-2025-64458 and CVE-2025-64459 to security archive.Natalia
Backport of c5a107e8248813f07325ae65232b5e53e9ac4238 from main.
2025-11-05[6.0.x] Added stub release notes for 5.2.9.Natalia
Backport of 6e18c078d5c044a1d22dd6a64ace11d9e5f6d0bc from main.
2025-11-05[6.0.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via ↵Jacob Walls
the _connector kwarg. Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews. Backport of 98e642c69181c942d60a10ca0085d48c6b3068bb from main.
2025-11-05[6.0.x] Fixed CVE-2025-64458 -- Mitigated potential DoS in ↵Jacob Walls
HttpResponseRedirect/HttpResponsePermanentRedirect on Windows. Thanks Seokchan Yoon for the report, Markus Holtermann for the triage, and Jake Howard for the review. Follow-up to CVE-2025-27556 and 39e2297210d9d2938c75fc911d45f0e863dc4821. Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.
2025-11-04[6.0.x] Fixed #36704 -- Fixed system check error for proxy model with a ↵Hal Blackburn
composite pk. Proxy models subclassing a model with a CompositePrimaryKey were incorrectly reporting check errors because the check that requires only local fields to be used in a composite pk was evaluated against the proxy subclass, which has no fields. To fix this, composite pk field checks are not evaluated against proxy subclasses, as none of the checks are applicable to proxy subclasses. This also has the benefit of not double-reporting real check errors from an invalid superclass pk. Thanks Clifford Gama for the review. Backport of 74564946c3b42a2ef7d087047e49873847a7e1d9 from main.
2025-11-04[6.0.x] Updated ticket triage process diagram and contributing docs.ontowhee
Backport of eaf7b563a5d3861026242fdb503a58f71acf17f6 from main.
2025-10-30[6.0.x] Added community package storage backends mention to docs.Tim Schilling
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Backport of 340e4f832e1ea74a27770e38635bbc781979f2e0 from main.
2025-10-29[6.0.x] Added stub release notes and release date for 5.2.8, 5.1.14, and 4.2.26.Jacob Walls
Backport of ab108bf94dfc06c311d7dc81866b848fe5b5ee6c from main.
2025-10-27[6.0.x] Fixed #36681 -- Removed English pluralization bias from example in ↵Kasyap Pentamaraju
docs/topics/i18n/translation.txt. Backport of 0ea01101c3a35568bc43e9707ac058b9874bd425 from main.
2025-10-23[6.0.x] Fixed #35095 -- Clarified Swiss number formatting in ↵Annabelle Wiegart
docs/topics/i18n/formatting.txt. Co-authored-by: Ahmed Nassar <a.moh.nassar00@gmail.com> Backport of 74239181252ca73bebb84789856f5d8937d421b4 from main.
2025-10-22[6.0.x] Made cosmetic edits to docs/releases/6.0.txt.Natalia
Backport of 42d6e20feba81fb1182c8111d0c18e492fbe4e87 from main.
2025-10-19[6.0.x] Refs #36005 -- Bumped minimum supported versions of docutils to 0.22.Mariusz Felisiak
Backport of ca3e0484ef31d13053af6a9d50667813e22fc282 from main.
2025-10-17[6.0.x] Refs #35844 -- Doc'd Python 3.14 compatibility.Mariusz Felisiak
Backport of 56977b466c33ca3da14a1ed2609172425a76a34e from main.
2025-10-17[6.0.x] Fixed #36669 -- Doc'd that negative indexes are not supported in F() ↵aj2s
slices. Backport of f715bc8990b5b8a1df948c2b71e8edbdda47e7db from main.
2025-10-16[6.0.x] Bumped minimum isort version to 7.0.0.Jacob Walls
Added ignores relating to https://github.com/PyCQA/isort/issues/2352. Backport of d980d68609448a4c85763fa34e471ff80540888b from main.
2025-10-14[6.0.x] Fixed #36648, Refs #33772 -- Accounted for composite pks in ↵Jacob Walls
first()/last() when aggregating. Backport of 02eed4f37879b2077496f86bb1378a076b981233 from main.
2025-10-14[6.0.x] Removed pre-release wheel-only advice in ↵Jacob Walls
docs/internals/howto-release-django.txt. The practice since 2.2a1 (2019) has been to upload source distributions as well. Backport of cc9df52666b90e2e6fdebd2213493c1c396e804a from main.
2025-10-14[6.0.x] Removed mention of setuptools in ↵Jacob Walls
docs/internals/contributing/writing-code/unit-tests.txt. Backport of 19101158070429c8d314926a67ec22a88220f316 from main.
2025-10-13[6.0.x] Cautioned against multi-level relative imports in coding style docs.lyova24
Backport of a545eb0c1ad5dcbb4e4cf22ce6cf486224c0ba8a from main.
2025-10-13[6.0.x] Added notes about automatic roadmap generation for next version in ↵Natalia
docs/internals/howto-release-django.txt. Backport of d5543a23d32d6438edae060081a054f617193341 from main.
generated by cgit v1.3 (git 2.53.0) at 2026-07-02 20:45:04 +0000