summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-02-03[5.2.x] Bumped version for 5.2.11 release.5.2.11Jacob Walls
2026-02-03[5.2.x] Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation ↵Jacob Walls
aliases contain periods. This prevents failures at the database layer, given that aliases in the ON clause are not quoted. Systematically quoting aliases even in FilteredRelation is tracked in https://code.djangoproject.com/ticket/36795. Backport of 005d60d97c4dfb117503bdb6f2facfcaf9315d84 from main.
2026-02-03[5.2.x] Fixed CVE-2026-1312 -- Protected order_by() from SQL injection via ↵Jacob Walls
aliases with periods. Before, `order_by()` treated a period in a field name as a sign that it was requested via `.extra(order_by=...)` and thus should be passed through as raw table and column names, even if `extra()` was not used. Since periods are permitted in aliases, this meant user-controlled aliases could force the `order_by()` clause to resolve to a raw table and column pair instead of the actual target field for the alias. In practice, only `FilteredRelation` was affected, as the other expressions we tested, e.g. `F`, aggressively optimize away the ordering expressions into ordinal positions, e.g. ORDER BY 2, instead of ORDER BY "table".column. Thanks Solomon Kebede for the report, and Simon Charette and Jake Howard for reviews. Backport of 69065ca869b0970dff8fdd8fafb390bf8b3bf222 from main.
2026-02-03[5.2.x] Fixed CVE-2026-1287 -- Protected against SQL injection in column ↵Jake Howard
aliases via control characters. Control characters in FilteredRelation column aliases could be used for SQL injection attacks. This affected QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias() when using dictionary expansion with **kwargs. Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls, and Natalia Bidart for reviews. Backport of e891a84c7ef9962bfcc3b4685690219542f86a22 from main.
2026-02-03[5.2.x] Fixed CVE-2026-1285 -- Mitigated potential DoS in ↵Natalia
django.utils.text.Truncator for HTML input. The `TruncateHTMLParser` used `deque.remove()` to remove tags from the stack when processing end tags. With crafted input containing many unmatched end tags, this caused repeated full scans of the tag stack, leading to quadratic time complexity. The fix uses LIFO semantics, only removing a tag from the stack when it matches the most recently opened tag. This avoids linear scans for unmatched end tags and reduces complexity to linear time. Refs #30686 and 6ee37ada3241ed263d8d1c2901b030d964cbd161. Thanks Seokchan Yoon for the report, and Jake Howard and Jacob Walls for reviews. Backport of a33540b3e20b5d759aa8b2e4b9ca0e8edd285344 from main.
2026-02-03[5.2.x] Fixed CVE-2026-1207 -- Prevented SQL injections in RasterField ↵Jacob Walls
lookups via band index. Thanks Tarek Nakkouch for the report, and Simon Charette for the initial triage and review. Backport of 81aa5292967cd09319c45fe2c1a525ce7b6684d8 from main.
2026-02-03[5.2.x] Fixed CVE-2025-14550 -- Optimized repeated header parsing in ASGI ↵Jake Howard
requests. Thanks Jiyong Yang for the report, and Natalia Bidart, Jacob Walls, and Shai Berger for reviews. Backport of eb22e1d6d643360e952609ef562c139a100ea4eb from main.
2026-02-03[5.2.x] Fixed CVE-2025-13473 -- Standardized timing of check_password() in ↵Jake Howard
mod_wsgi auth handler. Refs CVE-2024-39329, #20760. Thanks Stackered for the report, and Jacob Walls and Markus Holtermann for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 3eb814e02a4c336866d4189fa0c24fd1875863ed from main.
2026-01-27[5.2.x] Added stub release notes and release date for 5.2.11 and 4.2.28.Jacob Walls
Backport of b30e09a94270fdaa4bf282bf442b758c9a6d0bb0 from main.
2026-01-08[5.2.x] Clarified regression nature of data loss bug in ↵Tim Graham
docs/releases/5.2.10.txt. Backport of 2be860d6cfb04c9b3643f7c31ce90df280c8e747 from main.
2026-01-07[5.2.x] Made release test script use a random available port.Jacob Walls
Co-authored-by: Jake Howard <git@theorangeone.net> Backport of c08ed084f9651ab628dad83dd4459d9bba553e22 from main.
2026-01-06[5.2.x] Added stub release notes for 5.2.11.Jacob Walls
Backport of e937be3c1dc02cd06c14875be23d452b426d0d25 from main.
2026-01-06[5.2.x] Post-release version bump.Jacob Walls
2026-01-06[5.2.x] Bumped version for 5.2.10 release.5.2.10Jacob Walls
2026-01-06[5.2.x] Added release date for 5.2.10.Jacob Walls
Backport of f6fd35fc6ddadc93720656b9882e28712f2492fc from main.
2025-12-31[5.2.x] Refs #33647 -- Fixed silent data truncation in bulk_create on Postgres.Simon Charette
Regression in a16eedcf9c69d8a11d94cac1811018c5b996d491. The UNNEST strategy is affected by the same problem bulk_update has wrt/ to silent data truncation due to its usage of db_type which always returns a parametrized subtype. Backport of d6ae2ed868e43671afc4d433c3d8f4d27f7eb555 from main.
2025-12-22[5.2.x] Fixed #36376 -- Fixed --no-color for command help in Python 3.14+.Skyiesac
https://github.com/python/cpython/pull/136809 made `color` default to True in ArgumentParser. Backport of d0d85cd165e54582cce98cf685252e771460a9d4 from main.
2025-12-11[5.2.x] Refs #27890 -- Avoided overwriting TMPDIR in runtests.py under ↵Jacob Walls
forkserver mode. This variable should only be set once. Under forkserver, this module was getting executed multiple times, causing nested temporary dirs that didn't clean up properly, raising FileNotFoundError. This similar to #27890 although a slightly different cause. Backport of cd6278c4c09e4af9b2988d585b372d9abeeb63ee from main.
2025-12-11[5.2.x] Refs #36499 -- Adjusted test_strip_tags following Python behavior ↵Jacob Walls
change for incomplete entities. Backport of 7b80b2186300620931009fd62c2969f108fe7a62 from main.
2025-12-02[5.2.x] Added CVE-2025-13372 and CVE-2025-64460 to security archive.Natalia
Backport of d0d596042e958809a13b681d7a184ac7b95e0aa3 from main.
2025-12-02[5.2.x] Added stub release notes for 5.2.10.Natalia
Backport of 8d4ec9949aedc11a258d718689550eea61ae8d4c from main.
2025-12-02[5.2.x] Post-release version bump.Natalia
2025-12-02[5.2.x] Bumped version for 5.2.9 release.5.2.9Natalia
2025-12-02[5.2.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation ↵Shai Berger
in XML serializer. Previously, `getInnerText()` recursively used `list.extend()` on strings, which added each character from child nodes as a separate list element. On deeply nested XML content, this caused the overall deserialization work to grow quadratically with input size, potentially allowing disproportionate CPU consumption for crafted XML. The fix separates collection of inner texts from joining them, so that each subtree is joined only once, reducing the complexity to linear in the size of the input. These changes also include a mitigation for a xml.dom.minidom performance issue. Thanks Seokchan Yoon (https://ch4n3.kr/) for report. Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.
2025-12-02[5.2.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL ↵Jacob Walls
injection in column aliases on PostgreSQL. Follow-up to CVE-2025-57833. Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak for the reviews. Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.
2025-12-01[5.2.x] Fixed #36712 -- Evaluated type annotations lazily in template tag ↵Jacob Walls
registration. Ideally, this will be reverted when an upstream solution is available for https://github.com/python/cpython/issues/141560. Thanks Patrick Rauscher for the report and Augusto Pontes for the first iteration and test. Backport of 34186e731ca20a2344b1f88fd543a854d6b13a00 from main.
2025-12-01[5.2.x] Refs #36743 -- Corrected docstring for DisallowedRedirect.Jacob Walls
Backport of ce36c35e76f82f76cdfa5777456e794d481e5afc from main.
2025-12-01[5.2.x] Closed temporary files in ↵Jacob Walls
OverwritingStorageTests.test_save_overwrite_behavior_temp_file(). Backport of a08f1693f37e9aae9eca395020cce0638cb5aa5f from main.
2025-12-01[5.2.x] Refs #35535 -- Used intended decorator in ↵Jacob Walls
test_simple_block_tag_parens(). Backport of e94b19f6abdda70689aa17e399ce5fdef7897674 from main.
2025-11-30[5.2.x] Added link to Python Pickle documentation in docs/topics/cache.txt.Rida Zouga
Co-authored-by: Rida Zouga <ridazouga@gmail.com> Backport of 3ea0195ca57790d7bd6921ecaa32312eabec78d0 from main
2025-11-27[5.2.x] Fixed outdated redis-py link in cache docs.Bruno Alla
Backport of 7b32485ee98edf7e8b94ad9c8acdccee562bf216 from main.
2025-11-27[5.2.x] Highlighted community package upgrade utilities in ↵Tim Schilling
docs/howto/upgrade-version.txt. Backport of bd7940982d6cab386dae7698ab097b91e5d8145e from main.
2025-11-26[5.2.x] Added script to archive EOL stable branches.Natalia
This also fixed a small bash issue in `confirm_release.sh` script. Backport of 532c1058a7dd2616181259c94eb92f2477038d2c from main.
2025-11-26[5.2.x] Refs #36743 -- Added missing release notes for 5.1.15 and 4.2.27.Natalia
The fix landed in a8cf8c292cfee98fe6cc873ca5221935f1d02271 will be backported to 5.1 and 4.2 since the 2048 limit was rolled out as part of the security release for CVE-2025-64458. Backport of 18b13cf6c48ff0a20b2a74d3b90d1fc1602608e4 from main.
2025-11-26[5.2.x] Fixed #36743 -- Increased URL max length enforced in ↵varunkasyap
HttpResponseRedirectBase. Refs CVE-2025-64458. The previous limit of 2048 characters reused the URLValidator constant and proved too restrictive for legitimate redirects to some third-party services. This change introduces a separate `MAX_URL_REDIRECT_LENGTH` constant (defaulting to 16384) and uses it in HttpResponseRedirectBase. Thanks Jacob Walls for report and review. Backport of a8cf8c292cfee98fe6cc873ca5221935f1d02271 from main.
2025-11-26[5.2.x] Fixed #31506 -- Clarified that ExpressionWrapper does not perform ↵Cha Hwa Young
database casts. Added warning in DateField documentation about type differences when using timedelta on PostgreSQL and MySQL. Mentioned Cast() and integer arithmetic solutions. Backport of 55af4749b9a48b2978e893e7d7be313c0b2abdb1 from main.
2025-11-26[5.2.x] Added timeout-minutes directive to all GitHub Actions workflows.Natalia
GitHub Actions defaults to a 360-minute (6-hour) timeout. We've had jobs hang due to issues in the parallel test runner, causing them to run for the full 6 hours. This wastes resources and negatively impacts CI availability, so explicit timeouts have been added to prevent long-running hangs. Backport of e48527f91d341c85a652499a5baaf725d36ae54f from main.
2025-11-25[5.2.x] Added stub release notes and release date for 5.2.9, 5.1.15, and 4.2.27.Natalia
Backport of d62e811acfc6a056e847bfcc460092a98511ed00 from main.
2025-11-24[5.2.x] Fixed #36751 -- Fixed empty filtered aggregation crash over ↵Simon Charette
annotated queryset. Regression in b8e5a8a9a2a767f584cbe89a878a42363706f939. Refs #36404. The replace_expressions method was innapropriately dealing with falsey but not None source expressions causing them to also be potentially evaluated when __bool__ was invoked (e.g. QuerySet.__bool__ evaluates the queryset). The changes introduced in b8e5a8a9a2, which were to deal with a similar issue, surfaced the problem as aggregation over an annotated queryset requires an inlining (or pushdown) of aggregate references which is achieved through replace_expressions. In cases where an empty Q object was provided as an aggregate filter, such as when the admin facetting feature was used as reported, it would wrongly be turned into None, instead of an empty WhereNode, causing a crash at aggregate filter compilation. Note that the crash signature differed depending on whether or not the backend natively supports aggregate filtering (supports_aggregate_filter_clause) as the fallback, which makes use Case / When expressions, would result in a TypeError instead of a NoneType AttributeError. Thanks Rafael Urben for the report, Antoliny and Youngkwang Yang for the triage. Backport of 2a6e0bd72d4a69725b957d6748a4b834f21b12b5 from main
2025-11-21[5.2.x] Configured dangerous-triggers zizmor rule.Jacob Walls
Backport of 846613e521104fa2f2e1c2023e4a1a9886a2ff48 from main.
2025-11-21[5.2.x] Addressed unpinned-uses zizmor finding.Jacob Walls
Backport of 86b8058b40145fb5ba4fd859676225f533eca986 from main.
2025-11-21[5.2.x] Simplified actions after applying zizmor auto-fixes.Jacob Walls
Backport of 08f4901b3fd3f352ef9cea830d000aee73152556 from main.
2025-11-21[5.2.x] Applied auto-fixes from zizmor findings.Jacob Walls
Backport of e8958c4690faef27b6715524ecb5c49c3ecb6a09 from main.
2025-11-21[5.2.x] Added GitHub Actions linter (zizmor).Jacob Walls
At the direction of the Security Team. Thanks Markus Holtermann, Jake Howard, and Natalia Bidart for reviews. Backport of 09d4bf5cd9c95c588d3ec22edea5db1f5f146900 from main.
2025-11-21[5.2.x] Added scripts for building and releasing Django artifacts.Natalia
Backport of a523d5c8336f5f7f5e24a1cc8034ce65aedec3c6 from main.
2025-11-21[5.2.x] Skipped scripts/ folder from built release artifacts.Natalia
Backport of 971c76f735d2d61051d887b62a244d743794699a from main.
2025-11-20[5.2.x] Added missing ticket links in docs/releases/5.2.8.txt.Jacob Walls
Backport of 8ce3e1f9d0cdfdcba91e7e544804fa33f6fa9177 from main.
2025-11-20[5.2.x] Fixed #36748 -- Filtered non-standard placeholders from UNNEST queries.Chris Wesseling
Backport of 5834643f43a767fe19f2c6d10217b204e7584ec8 from main.
2025-11-18[5.2.x] Fixed #36733 -- Escaped attributes in Stylesheet.__str__().varunkasyap
Thanks Mustafa Barakat for the report, Baptiste Mispelon for the triage, and Jake Howard for the review. Backport of e05f2a75695b5f5faa7682d4053db4776d4d6f93 from main.
2025-11-13[5.2.x] Fixed #36686 -- Clarified Meta.ordering is ignored in GROUP BY queries.Kasyap Pentamaraju
Backport of 7e765a68598b2b798e49bf1f4b431a7bcac085a4 from main.
generated by cgit v1.3 (git 2.53.0) at 2026-05-01 20:54:36 +0000