| Age | Commit message (Collapse) | Author |
|---|
|
Backport of 496af73bf620ac5478082c06871bb665c620d414 from main.
|
|
Backport of f6fd35fc6ddadc93720656b9882e28712f2492fc from main.
|
|
permissions upon model renaming in migrations."
This reverts commits f02b49d2f3bf84f5225de920ca510149f1f9f1da and 6e89271a8507fe272d11814975500a1b40303a04.
Backport of 030c63d329c4814da221528e823a4aaaaa40e4f1 from main.
|
|
Regression in a16eedcf9c69d8a11d94cac1811018c5b996d491.
The UNNEST strategy is affected by the same problem bulk_update has wrt/
to silent data truncation due to its usage of db_type which always returns
a parametrized subtype.
Backport of d6ae2ed868e43671afc4d433c3d8f4d27f7eb555 from main.
|
|
True.
There was unresolved discussion regarding whether to set
ClearableFileInput.use_fieldset to True or False when use_fieldset was
introduced in Django 4.1, since the clear checkbox appears only
sometimes. Although using <fieldset> is likely desirable, since the
primary motivation in #35892 was just to improve markup in the admin,
and a deprecation path was not provided for general form usage, future
work is deferred to #36828.
Regression in 4187da258fe212d494cb578a0bc2b52c4979ab95.
Thanks Tim Graham, Antoliny, and David Smith for triage.
|
|
docs/topics/http/shortcuts.txt.
Backport of 626c15dba0662d5b9f61cc7eddf985e514293d6f from main.
|
|
Coerce lazy route values to `str` at match time to support prefix and
endpoint matching when using `gettext_lazy()` route paths.
Regression in f920937c8a63df6bea220e4386f59cdb45b2e355.
Thanks to Andrea Angelini for the report, and to Jake Howard and Jacob
Walls for reviews.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
Backport of 7bf3ac3ee255bcfe329e3203c7a2555b1275d506 from main.
|
|
Moved nonce generation in ``django.utils.csp.LazyNonce`` to a function
to avoid infinite recursion in ``SimpleLazyObject.__repr__`` for
unevaluated instances.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
Backport of 165c3599965e63f88649a46fcc2ff681c52f2f66 from main.
|
|
contributing docs.
Backport of bddcefb00f555196d3c488fbad71d303e9f7ede1 from main.
|
|
admin.
It isn't safe to set display: flex on <fieldset>, because on Safari this
interferes with display: block on child divs.
Thanks Paulo Coutinho for the report and Antoliny for the review.
Regression in 4187da258fe212d494cb578a0bc2b52c4979ab95.
Backport of 1eac2659a102d42490f9401b08782633fa51f3e3 from main.
|
|
max_query_params.
Regression in 358fd21c47cdf7bda520ce73c5cfd82bba57827b.
Backport of 84bae9c22a8ae7663c56cce5e0c611ea7c17fce1 from main.
|
|
topic.
The project state is cached, so when it was calculated in #27100
during the pre-migrate stage, it was no longer calculated on forward
migrations. Backward migrations still calculate it.
Backport of 0def695e3cbaa9ede9ae4040a24cfed7417f9065 from main.
|
|
https://github.com/python/cpython/pull/136809 made `color` default to
True in ArgumentParser.
Backport of d0d85cd165e54582cce98cf685252e771460a9d4 from main.
|
|
BaseDatabaseSchemaEditor.alter_field().
Regression in f9a44cc0fac653f8e0c2ab1cdfb12b2cc5c63fc2.
Now that ManyToManyField is no longer concrete the decision of whether or not
it should be altered, which is also relied on by field renaming, should take
into consideration name changes even if it doesn't have a column associated
with it, as auto-created many-to-many relationship table names are a base of it.
Note that there is room for optimization here where a rename can be entirely
avoided if ManyToManyField.db_table remains stable between .name changes, just
like we do with Field.db_column remaining stable, but since this is a
regression and meant to be backported the current patch focuses on correctness
over further improvements.
Thanks Josik for the report.
Co-authored-by: Simon Charette <charette.s@gmail.com>
Backport of 6cc1231285a20b11058143f8cb0a6b4b3999b23a from main.
|
|
querystring template tag.
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
Backport of 922c4cf972e04b1ce7ecee592231106724dcfd09 from main.
|
|
docs/ref/contrib/postgres/aggregates.txt.
Backport of 8932a677258fbda34f24a1be6f426265148b0003 from main.
|
|
Backport of 1651140a80e1b5e19784a6a859b6dd2e44c5d7f7 from main.
|
|
It is often necessary to reset the cache between tests, or after
preparing test state, when using content types. Django's test suite
already does this when needed, but users will need to do similar in
their own tests.
Backport of 37eb8909699d261b9b879e6f04dbfeec75b5e080 from main.
|
|
docs/internals/_images/contribution_process.svg.
The PDF is needed to build the PDF version of the whole docs.
Backport of 2d5a780eb5c83775f428e152517abc05b759cb8a from main.
|
|
query expressions.
Thanks Clifford Gama and Simon Charette for reviews.
Backport of 334308efae8e0c7b1523d5583af32b674a098eba from main.
|
|
1. Added imports and setup for clarity.
2. Removed adding `<` and `>` to Content-ID, as `make_msgid()` already
includes them.
3. Removed `$` from reference in HTML, and instead stripped `<>` there, as
required by HTML `cid:` references.
|
|
reports.
This was included in the original reverted patch:
a89183e63844a937aacd3ddb73c4952ef869d2cc
Follow-up to 26b0e2bb92caf2d16cabe455792350f20d6f42ca.
Backport of e726254a380f2a35a2fcf71143e96cb5987d8102 from main.
|
|
Documentation regression in 20dbf19fc505f0383e96b323905953c863817fe4.
Backport of 020e5799ad74cfafd469f032cd05767c9d670a16 from main.
|
|
- Corrected work_factor description and its requirements.
- Added block_size description.
- Changed parallelism description to mention computations, rather than
threads (currently it's not multithreaded.)
- For all of the above, added standard scrypt terminology (N, r, p).
- Mentioned that in multithreaded implementations, parallelism also
influences the memory requirements.
Backport of 0ca3a0661173b02e2cbb0183d8543e790e7e4a55 from main
|
|
`parse_header_parameters`.
Backport of ddb7236b0ae9be3163c90f799fb79396e9f61cc8 from main.
|
|
Backport of c02e65e34ba59968888c5d684e92a3fd5ce93300 from main.
|
|
|
|
available backends.
Backport of d3f142f2cd36ba0458cc679397555bd5ee7db744 from main.
|
|
Backport of ea4920174e3231ff5b72b3ffb2b20432671047d9 from main.
|
|
Backport of fe42aa6100a2df4702e2399cffb375dbc986b036 from main.
|
|
Backport of d0d596042e958809a13b681d7a184ac7b95e0aa3 from main.
|
|
Backport of 8d4ec9949aedc11a258d718689550eea61ae8d4c from main.
|
|
in XML serializer.
Previously, `getInnerText()` recursively used `list.extend()` on strings,
which added each character from child nodes as a separate list element.
On deeply nested XML content, this caused the overall deserialization
work to grow quadratically with input size, potentially allowing
disproportionate CPU consumption for crafted XML.
The fix separates collection of inner texts from joining them, so that
each subtree is joined only once, reducing the complexity to linear in
the size of the input. These changes also include a mitigation for a
xml.dom.minidom performance issue.
Thanks Seokchan Yoon (https://ch4n3.kr/) for report.
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.
|
|
injection in column aliases on PostgreSQL.
Follow-up to CVE-2025-57833.
Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak
for the reviews.
Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.
|
|
registration.
Ideally, this will be reverted when an upstream solution is available for
https://github.com/python/cpython/issues/141560.
Thanks Patrick Rauscher for the report and Augusto Pontes for the
first iteration and test.
Backport of 34186e731ca20a2344b1f88fd543a854d6b13a00 from main.
|
|
Co-authored-by: Rida Zouga <ridazouga@gmail.com>
Backport of 3ea0195ca57790d7bd6921ecaa32312eabec78d0 from main
|
|
Backport of 7b32485ee98edf7e8b94ad9c8acdccee562bf216 from main
|
|
docs/howto/upgrade-version.txt.
Backport of bd7940982d6cab386dae7698ab097b91e5d8145e from main.
|
|
docs/internals/howto-release-django.txt.
Backport of 60b08ad5e1701b1a9b2a03e5897670d5af32d379 from main.
|
|
The fix landed in a8cf8c292cfee98fe6cc873ca5221935f1d02271 will be
backported to 5.1 and 4.2 since the 2048 limit was rolled out as part of
the security release for CVE-2025-64458.
Backport of 18b13cf6c48ff0a20b2a74d3b90d1fc1602608e4 from main.
|
|
HttpResponseRedirectBase.
Refs CVE-2025-64458.
The previous limit of 2048 characters reused the URLValidator constant
and proved too restrictive for legitimate redirects to some third-party
services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH`
constant (defaulting to 16384) and uses it in HttpResponseRedirectBase.
Thanks Jacob Walls for report and review.
Backport of a8cf8c292cfee98fe6cc873ca5221935f1d02271 from main.
|
|
database casts.
Added warning in DateField documentation about type differences when using
timedelta on PostgreSQL and MySQL. Mentioned Cast() and integer arithmetic
solutions.
Backport of 55af4749b9a48b2978e893e7d7be313c0b2abdb1 from main.
|
|
Backport of d62e811acfc6a056e847bfcc460092a98511ed00 from main.
|
|
annotated queryset.
Regression in b8e5a8a9a2a767f584cbe89a878a42363706f939.
Refs #36404.
The replace_expressions method was innapropriately dealing with falsey
but not None source expressions causing them to also be potentially
evaluated when __bool__ was invoked (e.g. QuerySet.__bool__ evaluates
the queryset).
The changes introduced in b8e5a8a9a2, which were to deal with a similar
issue, surfaced the problem as aggregation over an annotated queryset
requires an inlining (or pushdown) of aggregate references which is
achieved through replace_expressions.
In cases where an empty Q object was provided as an aggregate filter,
such as when the admin facetting feature was used as reported, it would
wrongly be turned into None, instead of an empty WhereNode, causing a
crash at aggregate filter compilation.
Note that the crash signature differed depending on whether or not the
backend natively supports aggregate filtering
(supports_aggregate_filter_clause) as the fallback, which makes use
Case / When expressions, would result in a TypeError instead of a
NoneType AttributeError.
Thanks Rafael Urben for the report, Antoliny and Youngkwang Yang for
the triage.
Backport of 2a6e0bd72d4a69725b957d6748a4b834f21b12b5 from main
|
|
At the direction of the Security Team. Thanks Markus Holtermann,
Jake Howard, and Natalia Bidart for reviews.
Backport of 09d4bf5cd9c95c588d3ec22edea5db1f5f146900 from main.
|
|
Backport of 8ce3e1f9d0cdfdcba91e7e544804fa33f6fa9177 from main.
|
|
Backport of 5834643f43a767fe19f2c6d10217b204e7584ec8 from main.
|
|
docs/ref/contrib/sitemaps.txt.
Backport of ee2e0e202874db31449d3c7c292504652fa87f69 from main.
|
|
Thanks Mustafa Barakat for the report, Baptiste Mispelon for
the triage, and Jake Howard for the review.
Backport of e05f2a75695b5f5faa7682d4053db4776d4d6f93 from main.
|
|
relation is sticky.
Backport of 3c005b5f79bf6d71f3f4c3692ed670e1722b0fb6 from main.
|
