| Age | Commit message (Collapse) | Author |
|---|
|
Moved nonce generation in ``django.utils.csp.LazyNonce`` to a function
to avoid infinite recursion in ``SimpleLazyObject.__repr__`` for
unevaluated instances.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
|
|
It isn't safe to set display: flex on <fieldset>, because on Safari this
interferes with display: block on child divs.
Thanks Paulo Coutinho for the report and Antoliny for the review.
Regression in 4187da258fe212d494cb578a0bc2b52c4979ab95.
|
|
Regression in 358fd21c47cdf7bda520ce73c5cfd82bba57827b.
|
|
The project state is cached, so when it was calculated in #27100
during the pre-migrate stage, it was no longer calculated on forward
migrations. Backward migrations still calculate it.
|
|
|
|
|
|
Thanks Jacob Walls for the report.
|
|
https://github.com/python/cpython/pull/136809 made `color` default to
True in ArgumentParser.
|
|
The null argument has no effect on GeneratedField since the nullability
of the column depends on the database and expression used.
|
|
|
|
Signed-off-by: JaeHyuck Sa <wogur981208@gmail.com>
|
|
By trading ValueError for TypeError for omitted name arguments,
we gain a little clarity.
|
|
|
|
|
|
BaseDatabaseSchemaEditor.alter_field().
Regression in f9a44cc0fac653f8e0c2ab1cdfb12b2cc5c63fc2.
Now that ManyToManyField is no longer concrete the decision of whether or not
it should be altered, which is also relied on by field renaming, should take
into consideration name changes even if it doesn't have a column associated
with it, as auto-created many-to-many relationship table names are a base of it.
Note that there is room for optimization here where a rename can be entirely
avoided if ManyToManyField.db_table remains stable between .name changes, just
like we do with Field.db_column remaining stable, but since this is a
regression and meant to be backported the current patch focuses on correctness
over further improvements.
Thanks Josik for the report.
Co-authored-by: Simon Charette <charette.s@gmail.com>
|
|
Clarified that the nulls_distinct argument is not supported, as opposed
to certain values for the argument.
Thanks Russell Owen for the report.
|
|
querystring template tag.
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
(23.7+).
Thanks Jacob Walls for the review.
|
|
|
|
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
|
|
docs/ref/contrib/postgres/aggregates.txt.
|
|
|
|
It is often necessary to reset the cache between tests, or after
preparing test state, when using content types. Django's test suite
already does this when needed, but users will need to do similar in
their own tests.
|
|
docs/internals/_images/contribution_process.svg.
The PDF is needed to build the PDF version of the whole docs.
|
|
expressions.
Thanks Clifford Gama and Simon Charette for reviews.
|
|
1. Added imports and setup for clarity.
2. Removed adding `<` and `>` to Content-ID, as `make_msgid()` already
includes them.
3. Removed `$` from reference in HTML, and instead stripped `<>` there, as
required by HTML `cid:` references.
|
|
This was included in the original reverted patch:
a89183e63844a937aacd3ddb73c4952ef869d2cc
Follow-up to 26b0e2bb92caf2d16cabe455792350f20d6f42ca.
|
|
Documentation regression in 20dbf19fc505f0383e96b323905953c863817fe4.
|
|
- Corrected work_factor description and its requirements.
- Added block_size description.
- Changed parallelism description to mention computations, rather than
threads (currently it's not multithreaded.)
- For all of the above, added standard scrypt terminology (N, r, p).
- Mentioned that in multithreaded implementations, parallelism also
influences the memory requirements.
|
|
Refactored serialization logic to allow models inheriting a natural_key()
method (e.g. AbstractBaseUser) to explicitly opt out of natural key
serialization by returning an empty tuple from the method.
Thanks Jonas Dittrich for the report.
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
serializer.
Previously, `getInnerText()` recursively used `list.extend()` on strings,
which added each character from child nodes as a separate list element.
On deeply nested XML content, this caused the overall deserialization
work to grow quadratically with input size, potentially allowing
disproportionate CPU consumption for crafted XML.
The fix separates collection of inner texts from joining them, so that
each subtree is joined only once, reducing the complexity to linear in
the size of the input. These changes also include a mitigation for a
xml.dom.minidom performance issue.
Thanks Seokchan Yoon (https://ch4n3.kr/) for report.
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
column aliases on PostgreSQL.
Follow-up to CVE-2025-57833.
Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak
for the reviews.
|
|
Ideally, this will be reverted when an upstream solution is available for
https://github.com/python/cpython/issues/141560.
Thanks Patrick Rauscher for the report and Augusto Pontes for the
first iteration and test.
|
|
Co-authored-by: Rida Zouga <ridazouga@gmail.com>
|
|
|
|
docs/howto/upgrade-version.txt.
|
|
|
|
|
|
The fix landed in a8cf8c292cfee98fe6cc873ca5221935f1d02271 will be
backported to 5.1 and 4.2 since the 2048 limit was rolled out as part of
the security release for CVE-2025-64458.
|
|
Refs CVE-2025-64458.
The previous limit of 2048 characters reused the URLValidator constant
and proved too restrictive for legitimate redirects to some third-party
services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH`
constant (defaulting to 16384) and uses it in HttpResponseRedirectBase.
Thanks Jacob Walls for report and review.
|
|
casts.
Added warning in DateField documentation about type differences when using
timedelta on PostgreSQL and MySQL. Mentioned Cast() and integer arithmetic
solutions.
|
|
pull requests."
This reverts commit a89183e63844a937aacd3ddb73c4952ef869d2cc.
|
