Release notes Django 5.2.6 release notes
FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias().
1413 sections across all versions Narrow to Django 6.0 (current) →
Release notes Django 5.2.9 release notes
FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL.
Release notes Django 6.0.2 release notes
FilteredRelation was subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias().
Release notes Django 6.0.8 release notes
Fixed a regression in Django 6.0 that caused bulk_create() to crash on databases that support returning rows from bulk inserts when a related object providing the primary key was saved after assignment (#37234). Added compatibility for sqlparse 0.5.5 (#37235).
Release notes Django 6.0.8 release notes
Fixed a regression in Django 6.0 that caused bulk_create() to crash on databases that support returning rows from bulk inserts when a related object providing the primary key was saved after assignment (#37234). Added compatibility for sqlparse 0.5.5 (#37235).
Release notes Django 6.1.1 release notes
Fixed a regression in Django 6.1 where custom querysets used with Prefetch for forward foreign key or reverse one-to-one relationships were not routed using the parent queryset’s database (#37300).
Release notes Django 1.11.12 release notes
Fixed a regression in Django 1.11.8 where combining two annotated values_list() querysets with union(), difference(), or intersection() crashed due to mismatching columns (#29229).
Release notes Django 2.2.3 release notes
Fixed a regression in Django 2.2 where Avg, StdDev, and Variance crash with filter argument (#30542). Fixed a regression in Django 2.2.2 where auto-reloader crashes with AttributeError, e.g. when using ipdb (#30588).
Release notes Django 1.11.12 release notes
Fixed a regression in Django 1.11.8 where combining two annotated values_list() querysets with union(), difference(), or intersection() crashed due to mismatching columns (#29229).
Release notes Django 2.2.3 release notes CVE-2019-12781: Incorrect HTTP detection with reverse-proxy connecting via HTTPS
Fixed a regression in Django 2.2 where Avg, StdDev, and Variance crash with filter argument (#30542). Fixed a regression in Django 2.2.2 where auto-reloader crashes with AttributeError, e.g. when using ipdb (#30588).
Release notes Django 1.6 release notes
The support for time zones introduced in Django 1.4 didn’t work well with QuerySet.dates(): aggregation was always performed in UTC. This limitation was lifted in Django 1.6. Use QuerySet.datetimes() to perform time zone aware aggregation on a DateTimeField.
Release notes Django 1.6.3 release notes
Historically, queries that use select_for_update() could be executed in autocommit mode, outside of a transaction. Before Django 1.6, Django’s automatic transactions mode allowed this to be used to lock records until the next write operation.
Release notes Django 1.7 release notes
Historically, queries that use select_for_update() could be executed in autocommit mode, outside of a transaction. Before Django 1.6, Django’s automatic transactions mode allowed this to be used to lock records until the next write operation.
Release notes Django 3.0 release notes
Expressions that output BooleanField may now be used directly in QuerySet filters, without having to first annotate and then filter against the annotation.
Release notes Django 3.0.6 release notes
Fixed a regression in Django 3.0 that caused a crash when filtering a Subquery() annotation of a queryset containing a single related field against a SimpleLazyObject (#31420).
Release notes Django 5.2.10 release notes
Fixed a bug in Django 5.2 where data exceeding max_length was silently truncated by QuerySet.bulk_create() on PostgreSQL (#33647). Fixed a bug where management command colorized help (introduced in Python 3.14) ignored the --no-color option and the DJANGO_COLORS setting (#36376).
Release notes Django 5.2.5 release notes
Fixed a regression in Django 5.2.1 that prevented the usage of UNNEST PostgreSQL strategy of QuerySet.bulk_create() with foreign keys (#36502). Fixed a crash in Django 5.2 when filtering against a composite primary key using a tuple containing expressions (#36522).
Release notes Django 5.2.8 release notes
Added compatibility for oracledb 3.4.0 (#36646). Fixed a bug in Django 5.2 where QuerySet.first() and QuerySet.last() raised an error on querysets performing aggregation that selected all fields of a composite primary key (#36648).
Release notes Django 6.0.1 release notes
Fixed a bug in Django 5.2 where data exceeding max_length was silently truncated by QuerySet.bulk_create() on PostgreSQL (#33647).
Release notes Django 1.6 release notes What’s new in Django 1.6
The support for time zones introduced in Django 1.4 didn’t work well with QuerySet.dates(): aggregation was always performed in UTC. This limitation was lifted in Django 1.6. Use QuerySet.datetimes() to perform time zone aware aggregation on a DateTimeField.