summaryrefslogtreecommitdiff
path: root/docs
AgeCommit message (Collapse)Author
2025-12-02Added stub release notes for 5.2.10.Natalia
2025-12-02Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation in XML ↵Shai Berger
serializer. Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-12-02Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL injection in ↵Jacob Walls
column aliases on PostgreSQL. Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews.
2025-12-01Fixed #36712 -- Evaluated type annotations lazily in template tag registration.Jacob Walls
Ideally, this will be reverted when an upstream solution is available for https://github.com/python/cpython/issues/141560. Thanks Patrick Rauscher for the report and Augusto Pontes for the first iteration and test.
2025-11-30Added link to Python Pickle documentation in docs/topics/cache.txt.Rida Zouga
Co-authored-by: Rida Zouga <ridazouga@gmail.com>
2025-11-27Fixed outdated redis-py link in cache docs.Bruno Alla
2025-11-27Highlighted community package upgrade utilities in ↵Tim Schilling
docs/howto/upgrade-version.txt.
2025-11-27Reduced subjective tone and improved clarity in docs/howto/upgrade-version.txt.Natalia
2025-11-26Included usage of new scripts in docs/internals/howto-release-django.txt.Natalia
2025-11-26Refs #36743 -- Added missing release notes for 5.1.15 and 4.2.27.Natalia
The fix landed in a8cf8c292cfee98fe6cc873ca5221935f1d02271 will be backported to 5.1 and 4.2 since the 2048 limit was rolled out as part of the security release for CVE-2025-64458.
2025-11-26Fixed #36743 -- Increased URL max length enforced in HttpResponseRedirectBase.varunkasyap
Refs CVE-2025-64458. The previous limit of 2048 characters reused the URLValidator constant and proved too restrictive for legitimate redirects to some third-party services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH` constant (defaulting to 16384) and uses it in HttpResponseRedirectBase. Thanks Jacob Walls for report and review.
2025-11-26Fixed #31506 -- Clarified that ExpressionWrapper does not perform database ↵Cha Hwa Young
casts. Added warning in DateField documentation about type differences when using timedelta on PostgreSQL and MySQL. Mentioned Cast() and integer arithmetic solutions.
2025-11-25Reverted "Fixed #36620 -- Added coverage workflow to summarize coverage in ↵Natalia
pull requests." This reverts commit a89183e63844a937aacd3ddb73c4952ef869d2cc.
2025-11-25Added stub release notes and release date for 5.2.9, 5.1.15, and 4.2.27.Natalia
2025-11-25Fixed #36756 -- Dropped support for GDAL 3.1 and 3.2.Mariusz Felisiak
2025-11-25Fixed #35783 -- Added NumDimensions GIS database function and ↵David Smith
__num_dimensions lookup.
2025-11-24Fixed #36738 -- Confirmed support for GDAL 3.12.Varun Kasyap Pentamaraju
Thanks David Smith for reviews.
2025-11-24Fixed #36751 -- Fixed empty filtered aggregation crash over annotated queryset.Simon Charette
Regression in b8e5a8a9a2a767f584cbe89a878a42363706f939. Refs #36404. The replace_expressions method was innapropriately dealing with falsey but not None source expressions causing them to also be potentially evaluated when __bool__ was invoked (e.g. QuerySet.__bool__ evaluates the queryset). The changes introduced in b8e5a8a9a2, which were to deal with a similar issue, surfaced the problem as aggregation over an annotated queryset requires an inlining (or pushdown) of aggregate references which is achieved through replace_expressions. In cases where an empty Q object was provided as an aggregate filter, such as when the admin facetting feature was used as reported, it would wrongly be turned into None, instead of an empty WhereNode, causing a crash at aggregate filter compilation. Note that the crash signature differed depending on whether or not the backend natively supports aggregate filtering (supports_aggregate_filter_clause) as the fallback, which makes use Case / When expressions, would result in a TypeError instead of a NoneType AttributeError. Thanks Rafael Urben for the report, Antoliny and Youngkwang Yang for the triage.
2025-11-23Refs #21961 -- Added DatabaseFeatures.supports_on_delete_db_(cascade/null) ↵Tim Graham
feature flags. Needed on MongoDB. Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2025-11-22Removed outdated build guidance in release docs.Jacob Walls
Follow-up to 4686541691dbe986f58ac87630c3b7a04db4ff93.
2025-11-22Fixed #35774 -- Dropped support for GEOS 3.8.David Smith
GEOS 3.8 (released Oct-2019) will be more than 5 years old when Django 6.1 is released (Aug-2026).
2025-11-21Fixed #36741 -- Linked to custom save()/delete() caveats in ↵VIZZARD-X
docs/ref/models/querysets.txt.
2025-11-21Fixed #36620 -- Added coverage workflow to summarize coverage in pull requests.saurabh
Part of GSoC 2025. Thanks Lily for mentorship, and Sarah Boyce and Jacob Walls for reviews.
2025-11-21Added GitHub Actions linter (zizmor).Jacob Walls
At the direction of the Security Team. Thanks Markus Holtermann, Jake Howard, and Natalia Bidart for reviews.
2025-11-21Fixed #36718 -- Added JSONField support for negative array indexing on ↵Clifford Gama
Oracle 21c+.
2025-11-20Added missing ticket links in docs/releases/5.2.8.txt.Jacob Walls
2025-11-20Fixed #36748 -- Filtered non-standard placeholders from UNNEST queries.Chris Wesseling
2025-11-20Fixed #36734 -- Clarified the behavior of View.http_method_not_allowed.Zubair Hassan
2025-11-20Fixed #36321 -- Defaulted suggest_on_error=True in management commands.kihuni
Python 3.15 defaults suggest_on_error=True, but the feature is available from 3.14, so this change opts in earlier. This change can be reverted when Python 3.15 is the minimum supported version.
2025-11-20Ensured that Sitemap.items is described as a method in ↵nessita
docs/ref/contrib/sitemaps.txt.
2025-11-20Fixed typo in docs/howto/deployment/wsgi/apache-auth.txt.Jacob Walls
2025-11-20Refs #36663, #36739 -- Added release note for running checks against all ↵Storm B. Heg
databases.
2025-11-19Fixed #26609 -- Extended fields.E004 system check for unordered iterables.Mariusz Felisiak
Co-authored-by: Karl Wooster <karl.wooster@alleima.com>
2025-11-18Fixed #36733 -- Escaped attributes in Stylesheet.__str__().varunkasyap
Thanks Mustafa Barakat for the report, Baptiste Mispelon for the triage, and Jake Howard for the review.
2025-11-17Fixed #26379 -- Doc'd that the first filter() on a many-to-many relation is ↵Annabelle Wiegart
sticky.
2025-11-17Fixed #24920 -- Added support for DecimalField with no precision.Mariusz Felisiak
Thanks Lily for the review.
2025-11-14Refs #24928 -- Added introspection support for PostgreSQL HStoreField.Mariusz Felisiak
2025-11-13Fixed #36686 -- Clarified Meta.ordering is ignored in GROUP BY queries.Kasyap Pentamaraju
2025-11-12Fixed #36717 -- Redirect authenticated users on admin login view to next URL.Benedict Etzel
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-11-10Fixed typo in docs/ref/databases.txt.Clifford Gama
2025-11-10Clarified "get_db_prep_value" default result in docs/ref/models/fields.txt.Clifford Gama
2025-11-10Clarified EmailValidator docs to specify it validates an email address.Hong Xu
Updated the EmailValidator docs in docs/ref/validators.txt to explicitly state that it validates an email address, to avoid confusion with validating email message content.
2025-11-07Fixed #36705 -- Avoided string concatenation in utils.Kasyap Pentamaraju
Repeated string concatenation performs poorly on PyPy. Thanks Seokchan Yoon for the report.
2025-11-07Fixed #36315 -- Used TaskGroup instead of asyncio.gather().Thomas Grainger
2025-11-06Removed community packages admonition from settings docs.Tim Schilling
2025-11-06Added community package email backends mention to docs.Tim Schilling
Co-authored-by: Clifford Gama <cliffygamy@gmail.com>
2025-11-05Added CVE-2025-64458 and CVE-2025-64459 to security archive.Natalia
2025-11-05Added stub release notes for 5.2.9.Natalia
2025-11-05Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via the ↵Jacob Walls
_connector kwarg. Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon Charette, and Jake Howard for the reviews.
2025-11-05Fixed CVE-2025-64458 -- Mitigated potential DoS in ↵Jacob Walls
HttpResponseRedirect/HttpResponsePermanentRedirect on Windows. Thanks Seokchan Yoon for the report, Markus Holtermann for the triage, and Jake Howard for the review. Follow-up to CVE-2025-27556 and 39e2297210d9d2938c75fc911d45f0e863dc4821.
generated by cgit v1.3 (git 2.53.0) at 2026-07-01 17:47:46 +0000