Release notes Django 5.2.8 release notes
QuerySet.filter(), exclude(), get(), and Q were subject to SQL injection using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
1413 sections across all versions Narrow to Django 6.0 (current) →
Release notes Django 1.11 release notes What’s new in Django 1.11Minor features
Added the skip_locked argument to QuerySet.select_for_update() on PostgreSQL 9.5+ and Oracle to execute queries with FOR UPDATE SKIP LOCKED. Added the TEST['TEMPLATE'] setting to let PostgreSQL users specify a template for creating the test database.
Release notes Django 1.11 release notes What’s new in Django 1.11Minor features
Added support for callable values in the defaults argument of QuerySet.update_or_create() and get_or_create(). ImageField now has a default validate_image_file_extension validator. (This validator moved to the form field in Django 1.11.2.) Added support for time truncation to Trunc functions.
Release notes Django 1.11 release notes Backwards incompatible changes in 1.11
The change to make QuerySet.iterator() use server-side cursors on PostgreSQL prevents running Django with PgBouncer in transaction pooling mode. To reallow that, use the DISABLE_SERVER_SIDE_CURSORS setting (added in Django 1.11.1) in DATABASES.
Release notes Django 1.4 release notes What’s new in Django 1.4
Django 1.4 includes a QuerySet.select_for_update() method, which generates a SELECT ... FOR UPDATE SQL query. This will lock rows until the end of the transaction, meaning other transactions cannot modify or delete rows matched by a FOR UPDATE query.
Release notes Django 1.5.2 release notes
Fixed a crash with prefetch_related() (#19607) as well as some pickle regressions with prefetch_related (#20157 and #20257). Fixed a regression in django.contrib.gis in the Google Map output on Python 3 (#20773).
Release notes Django 2.2.4 release notes
Fixed a regression in Django 2.2 when ordering a QuerySet.union(), intersection(), or difference() by a field type present more than once results in the wrong ordering being used (#30628).
Release notes Django 4.2.26 release notes
QuerySet.filter(), exclude(), get(), and Q were subject to SQL injection using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Release notes Django 5.0 release notes What’s new in Django 5.0Minor features
QuerySet.prefetch_related() now supports prefetching GenericForeignKey with non-homogeneous set of results.
Release notes Django 5.1.14 release notes
QuerySet.filter(), exclude(), get(), and Q were subject to SQL injection using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Release notes Django 5.2.8 release notes
QuerySet.filter(), exclude(), get(), and Q were subject to SQL injection using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Release notes Django 1.7.11 release notes
Fixed a data loss possibility with Prefetch if to_attr is set to a ManyToManyField (#25693).
Release notes Django 1.7.11 release notes
Fixed a data loss possibility with Prefetch if to_attr is set to a ManyToManyField (#25693).
Release notes Django 1.11.1 release notes
The change in Django 1.11 to make QuerySet.iterator() use server-side cursors on PostgreSQL prevents running Django with PgBouncer in transaction pooling mode. To reallow that, use the DISABLE_SERVER_SIDE_CURSORS setting in DATABASES. See Transaction pooling and server-side cursors for more discussion.
Release notes Django 1.11.25 release notes
Fixed a crash when filtering with a Subquery() annotation of a queryset containing django.contrib.postgres.fields.JSONField or HStoreField (#30769).
Release notes Django 1.5 release notes
django.forms.ModelMultipleChoiceField now returns an empty QuerySet as the empty value instead of an empty list. int_to_base36() properly raises a TypeError instead of ValueError for non-integer inputs. The slugify template filter is now available as a standard Python function at django.utils.text.slugify().
Release notes Django 1.5 release notes
The depth keyword argument in select_related() has been deprecated. You should use field names instead.
Release notes Django 1.7 release notes
The new Prefetch object allows customizing prefetch operations. You can specify the QuerySet used to traverse a given relation or customize the storage location of prefetch results.
Release notes Django 1.8.6 release notes
Fixed a regression causing ModelChoiceField to ignore prefetch_related() on its queryset (#25496). Allowed “mode=memory” in SQLite test database name if supported (#12118). Fixed system check crash on ForeignKey to abstract model (#25503).
Release notes Django 2.0.4 release notes
Fixed a crash when filtering with an Exists() annotation of a queryset containing a single field (#29195). Fixed admin autocomplete widget’s translations for zh-hans and zh-hant languages (#29213). Corrected admin’s autocomplete widget to add a space after custom classes (#29221).