Release notes Django 2.1.13 release notes
Fixed a crash when filtering with a Subquery() annotation of a queryset containing django.contrib.postgres.fields.JSONField or HStoreField (#30769).
1413 sections across all versions Narrow to Django 6.0 (current) →
Release notes Django 2.1.15 release notes
Fixed a data loss possibility in the select_for_update(). When using 'self' in the of argument with multi-table inheritance, a parent model was locked instead of the queryset’s model (#30953).
Release notes Django 2.2.11 release notes
Fixed a data loss possibility in the select_for_update(). When using related fields or parent link fields with Multi-table inheritance in the of argument, the corresponding models were not locked (#31246).
Release notes Django 2.2.16 release notes
Fixed a data loss possibility in the select_for_update(). When using related fields pointing to a proxy model in the of argument, the corresponding model was not locked (#31866).
Release notes Django 3.0.10 release notes
Fixed a data loss possibility in the select_for_update(). When using related fields pointing to a proxy model in the of argument, the corresponding model was not locked (#31866).
Release notes Django 3.2.5 release notes
Fixed a regression in Django 3.2 that caused a crash of QuerySet.values_list(…, named=True) after prefetch_related() (#32812). Fixed a bug in Django 3.2 that caused a migration crash on MySQL 8.0.13+ when altering BinaryField, JSONField, or TextField to non-nullable (#32503).
Release notes Django 4.2.1 release notes
Fixed a regression in Django 4.2 that caused a crash of QuerySet.defer() when deferring fields by attribute names (#34458). Fixed a regression in Django 4.2 that caused a crash of SearchVector function with % characters (#34459).
Release notes Django 4.2.24 release notes
FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias().
Release notes Django 4.2.27 release notes
FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL.
Release notes Django 4.2.28 release notes
FilteredRelation was subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias().
Release notes Django 4.2.4 release notes
Fixed a regression in Django 4.2 that caused a crash of QuerySet.aggregate() with aggregates referencing window functions (#34717). Fixed a regression in Django 4.2 that caused a crash when grouping by a reference in a subquery (#34748).
Release notes Django 4.2.7 release notes
Fixed a regression in Django 4.2 that caused a crash of QuerySet.aggregate() with aggregates referencing expressions containing subqueries (#34798). Restored, following a regression in Django 4.2, creating varchar/text_pattern_ops indexes on CharField and TextField with deterministic collations on PostgreSQL (#34932).
Release notes Django 5.1.12 release notes
FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias().
Release notes Django 5.1.15 release notes
FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL.
Release notes Django 5.2.11 release notes
FilteredRelation was subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias().
Release notes Django 5.2.6 release notes
FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias().
Release notes Django 5.2.9 release notes
FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL.
Release notes Django 6.0.2 release notes
FilteredRelation was subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias().
Release notes Django 1.11.1 release notes
The change in Django 1.11 to make QuerySet.iterator() use server-side cursors on PostgreSQL prevents running Django with PgBouncer in transaction pooling mode. To reallow that, use the DISABLE_SERVER_SIDE_CURSORS setting in DATABASES. See Transaction pooling and server-side cursors for more discussion.
Release notes Django 1.11.25 release notes
Fixed a crash when filtering with a Subquery() annotation of a queryset containing django.contrib.postgres.fields.JSONField or HStoreField (#30769).