summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
13 daysRefs #35007 -- Added biome to lint and format CSS files.Tom Carrick
14 daysFixed #37028 -- Added BitAnd(), BitOr(), and BitXor() aggregates.Mariusz Felisiak
14 daysClarified that reporters shouldn't set their own tickets as "Accepted".Jonathan Biemond
2026-04-16Refs #35514 -- Cleaned up email docs.Mike Edmunds
* Indented get_connection() details into its function block. * Updated introductory paragraph to better reflect current capabilities. * Changed link in "Quick examples" to go to descriptive text rather than reference for send_mail(). * Avoided implying that send_mail() is only reliable "in most cases." * Improved description of development SMTP server. * Expanded information on third-party backends. * Moved "Email backends" introductory paragraph above API methods and expanded it to match section content.
2026-04-16Refs #35514 -- Added "Configuring email" section to email docs.Mike Edmunds
2026-04-16Refs #35514 -- Moved and renamed "Sending multiple emails" in email docs.Mike Edmunds
Moved "Sending multiple emails" from the "Email backends" section to the "Sending messages" section and renamed it to "Sending many messages efficiently" to better reflect its content. Moved the related connection manager example from the "Email backends" intro into the same section.
2026-04-16Refs #35514 -- Moved get_connection() after backends in email docs.Mike Edmunds
Moved "Obtaining an instance of an email backend" after documentation for individual backends (matching similar approach in Tasks docs).
2026-04-16Added automated quality checks for PRs as a GitHub Actions workflow.Natalia
This work adds automated PR quality checks as a GitHub Actions workflow to enforce contribution requirements consistently and reduce the manual burden on reviewers for incoming PRs. Thanks to the many reviewers providing meaningful feedback. Co-authored-by: Frank Wiles <frank@revsys.com>
2026-04-16Added DatabaseFeatures.disallowed_simple_test_case_connection_methods.Tim Graham
2026-04-15Refs #35514 -- Corrected email backends' outline levels in email docs.Mike Edmunds
Moved documentation section for each email backend to be a direct child of "Email backends" (rather than subsections of "Obtaining an instance of an email backend"). Added a section header for "Third-party backends" to surface it in the outline and separate it from "Dummy backend."
2026-04-15Refs #35514 -- Moved EmailMessage class up in email docs.Mike Edmunds
Moved the "Preventing header injection" discussion below sections on EmailMessage and related classes.
2026-04-15Refs #35514 -- Grouped sending-related features in email docs.Mike Edmunds
Introduced a top-level "Sending messages" section to group together send_mail(), send_mass_mail(), mail_admins(), mail_managers(), the EmailMessage and EmailMultiAlternatives classes, and other topics related to sending.
2026-04-15Refs #35514 -- Moved email docs examples to relevant section.Mike Edmunds
The top-level "Examples" section of docs/topics/email.txt seemed intended to illustrate the difference between send_mail() and send_mass_mail(), not to provide general examples of sending email. Moved it into the existing "send_mass_mail() vs. send_mail()" section. (There's already a "Quick examples" section at the top of the page with general examples.)
2026-04-15Fixed broken link in email docs.Mike Edmunds
2026-04-15Fixed incomplete comment in email docs.Natalia
2026-04-14Fixed #27150 -- Made base File objects truthy by default.VIZZARD-X
2026-04-14Fixed #37029 -- Corrected placement of </div> in change_list.html's ↵Tim Graham
pagination block. Bug in 3f59711581bd22ebd0f13fb040b15b69c0eee21f.
2026-04-13Removed unused code checkout step from labels.yml GitHub Action.Jacob Walls
2026-04-13Clarified "Add another question" as the plus sign button.Sarah Boyce
2026-04-13Fixed #33113 -- Documented usage and caveats of HTML5 date input in ↵Samriddha9619
DateInput widget.
2026-04-11Fixed #36953 -- Split EmailBackend tests to separate file.Mike Edmunds
Moved tests for specific email backends from tests/mail/tests.py to test_backends.py to reduce file size and discourage adding non-backend-specific tests to BaseEmailBackendTests.
2026-04-11Refs #36953 -- Moved non-backend-dependent BaseEmailBackendTests.Mike Edmunds
Relocated BaseEmailBackendTests that are _not_ dependent on the email backend. - In general, moved test cases to EmailMessageTests or SendMailTests as appropriate, and changed them to work with the testing outbox. - Replaced BaseEmailBackendTests.test_send_verbose_name() with EmailMessageTests.test_unicode_display_name_in_from_email(). (EmailMessageTests.test_address_header_handling() also partly covers the behavior, as well as Python's own message serialization tests.) - Removed BaseEmailBackendTests.test_message_cc_header(), which was already covered by EmailMessageTests.test_cc*() (and Python's own message serialization tests). - Replaced BaseEmailBackendTests.test_idn_send() with EmailMessageTests.test_idn_addresses() to cover from_email and cc. (EmailMessageTests.test_address_header_handling() already covered to.) - Removed BaseEmailBackendTests.test_recipient_without_domain(), which was partly covered by EmailMessageTests.test_localpart_only_address(). Updated the latter to cover a localpart-only from_email. - Updated docstrings and comments to clarify a few tests that _do_ depend on the email backend.
2026-04-11Refs #36953 -- Split apart catchall MailTests.Mike Edmunds
Replaced large MailTests class with smaller classes focused on specific django.core.mail APIs: - EmailMessageTests: covering EmailMessage and EmailMultiAlternatives classes (the bulk of the former MailTests cases). - SendMailTests, SendMassMailTests, MailAdminsAndManagersTests: covering the function-based mail APIs. - GetConnectionTests: covering get_connection(). - DeprecatedInternalsTests: covering deprecated internal methods used in deprecated functionality. - DummyBackendTests: covering the dummy EmailBackend. In the process, moved the two cases from MailTimeZoneTests into the new EmailMessageTests, as they related to EmailMessage Date headers.
2026-04-11Refs #36953 -- Split compound mail tests.Mike Edmunds
Broke apart independent cases in mail tests using subTest() or separate methods.
2026-04-11Refs #36953 -- Removed unnecessary overrides from mail tests.Mike Edmunds
Django automatically substitutes the locmem EmailBackend during tests, and SimpleTestCase empties mail.outbox before each test.
2026-04-10Fixed #37020 -- Removed guidance to edit fetched .po files by hand.Jacob Walls
Altering the .po files by hand was causing incorrect line numbers and plural forms. Since our fetching procedure does not recompile any hand-edited .po files to .mo files for production use, just accept Transifex's plural forms as a source of truth. https://forum.djangoproject.com/t/discourage-releasers-from-editing-po-files-by-hand/44441
2026-04-10Refs #37020 -- Corrected example command to update translation catalogs.Jacob Walls
Passing the --domain flag again just overwrites the prior value.
2026-04-09Fixed typo in docs/howto/delete-app.txt.Jonathan Wu
2026-04-08Refs #35440 -- Optimized parse_header_parameters() for the simplest case.Pravin Kamble
Added a fast-path to parse_header_parameters Benchmark results (50,000 iterations): - Simple headers: ~73% improvement Thanks Nick Pope (@ngnpope) for the review.
2026-04-08Refs CVE-2026-4292 -- Isolated new test in AdminViewListEditable.Jacob Walls
As originally written, this test interfered with admin_views.tests.SeleniumTests.test_inline_uuid_pk_add_with_popup. To fix this, register the new ModelAdmin with a different AdminSite.
2026-04-08Removed PY38 and PY39 version constants.Jacob Walls
As the oldest supported version is Django 5.2, we only need constants for PY310+.
2026-04-07Fixed #37021 -- Added Permission.user_perm_str property.mariatta
For use in checking user permissions via has_perm(). Co-authored-by: 사재혁 <jaehyuck.sa.dev@gmail.com>
2026-04-07Updated Apache links to the current docs.Mariusz Felisiak
2026-04-07Removed outdated note about uwsgi LTS from docs.Mariusz Felisiak
projects.unbit.it has an invalid certificate and provides old packages.
2026-04-07Fixed #36816 -- Allowed **kwargs in @task decorator.Nilesh Kumar Pahari
The decorator was updated to accept **kwargs and forward them to task_class, allowing additional parameters to be passed to custom Task subclasses.
2026-04-07Fixed two issues in release helper scripts/verify_release.sh.Natalia
The artifacts downloaded from media.djangoproject.com use a lowercase "django-" prefix but the script searched for capital D. Error was: "ls: cannot access 'Django-*.tar.gz': No such file or directory" The tarball and wheel smoke-tests used the same `test_one` folder inside the same working directory, so the second invocation failed with "CommandError: '/tmp/tmp.1234567890' already exists".
2026-04-07Refs CVE-2026-33034 -- Improved security documentation on handling large ↵Jake Howard
request bodies. Notably that the limit can be bypassed under ASGI.
2026-04-07Added CVE-2026-3902, CVE-2026-4277, CVE-2026-4292, CVE-2026-33033, and ↵Jacob Walls
CVE-2026-33034 to security archive.
2026-04-07Added stub release notes for 6.0.5.Jacob Walls
2026-04-07Fixed CVE-2026-33034 -- Enforced DATA_UPLOAD_MAX_MEMORY_SIZE on body size in ↵Natalia
ASGI requests. The `body` property in `HttpRequest` checks DATA_UPLOAD_MAX_MEMORY_SIZE against the declared `Content-Length` header before reading. On the ASGI path, chunked requests carry no `Content-Length`, so the check evaluated to 0 and always passed regardless of the actual body size. This work adds a new check on the actual number of bytes consumed. Thanks to Superior for the report, and to Jake Howard and Jacob Walls for reviews.
2026-04-07Fixed CVE-2026-33033 -- Mitigated potential DoS in MultiPartParser.Natalia
When a multipart file part used `Content-Transfer-Encoding: base64` and the non-whitespace base64 bytes did not align to a multiple of 4 within a chunk, the parser entered a loop calling `field_stream.read(1-3)` once per whitespace byte. Each such call fetched the entire internal buffer, sliced off 1-3 bytes, and pushed the remainder back via unget(), doing an O(n) memory copy per call. A 2.5 MB payload of mostly whitespace produced CPU amplification relative to a normal upload of the same size. The alignment loop now reads `self._chunk_size` bytes at a time, and accumulates stripped parts in a list joined once at the end. Thanks to Seokchan Yoon for the report and the fixing patch.
2026-04-07Fixed CVE-2026-4292 -- Disallowed instance creation via ↵Jacob Walls
ModelAdmin.list_editable. Thanks Natalia Bidart, Jake Howard, and Markus Holtermann for reviews.
2026-04-07Fixed CVE-2026-4277 -- Checked add permissions in GenericInlineModelAdmin.Jacob Walls
Edit permissions were still checked as part of ordinary form validation, but because GenericInlineModelAdmin overrides get_formset(), it lacked InlineModelAdmin's dynamic DeleteProtectedModelForm.has_changed() logic for checking permissions server-side, leaving the add case unaddressed. This change reimplements the relevant part of InlineModelAdmin.get_formset(). Thanks N05ec@LZU-DSLab for the report, and Natalia Bidart, Markus Holtermann, and Simon Charette for reviews.
2026-04-07Fixed CVE-2026-3902 -- Ignored headers with underscores in ASGIRequest.Jacob Walls
Thanks Tarek Nakkouch for the report and Jake Howard and Natalia Bidart for reviews.
2026-04-06Fixed #37023 -- Made XML serializer put each ManyToManyField object on its ↵Tim Graham
own line.
2026-04-06Refs #37023 -- Removed hardcoded indent levels from XML serializer.Tim Graham
This facilitates nested fields and objects.
2026-04-06Fixed #37009 -- Fixed alignment of "Show/Hide counts" icons in admin changelist.kyb
2026-04-03Fixed #37016 -- Avoided propagating invalid arguments from When() to Q().varunkasyap
2026-04-03Refs #36949 -- Removed hardcoded pks in modeladmin tests.Tim Graham
2026-04-02Fixed #36973 -- Made fields.E348 check detect further clashes between ↵Clifford Gama
managers and related_names. Clashes were only detected for self-referential relationships, i.e. ForeignKey("self"). Refs #22977. Bug in 6888375c53476011754f778deabc6cdbfa327011. Thanks JaeHyuckSa for the thorough review!