1413 sections across all versions Narrow to Django 6.0 (current) →
Release notes Django 4.0.5 release notes
Fixed a bug in Django 4.0 that caused a crash of QuerySet.filter() on IsNull() expressions (#33705). Fixed a bug in Django 4.0 where a hidden quick filter toolbar in the admin’s navigation sidebar was focusable (#33725).
Release notes Django 4.1.2 release notes
Fixed a regression in Django 4.1 that caused aggregation over a queryset that contained an Exists annotation to crash due to too many selected columns (#33992).
Release notes Django 4.2 release notes
In order to avoid updating unnecessary columns, QuerySet.update_or_create() now passes update_fields to the Model.save() calls. As a consequence, any fields modified in the custom save() methods should be added to the update_fields keyword argument before calling super().
Release notes Django 4.2.8 release notes
Fixed a regression in Django 4.2 that caused makemigrations --check to stop displaying pending migrations (#34457). Fixed a regression in Django 4.2 that caused a crash of QuerySet.aggregate() with aggregates referencing other aggregates or window functions through conditional expressions (#34975).
Release notes Django 5.0 release notes
The new AdminSite.get_log_entries() method allows customizing the queryset for the site’s listed log entries. The django.contrib.admin.AllValuesFieldListFilter, ChoicesFieldListFilter, RelatedFieldListFilter, and RelatedOnlyFieldListFilter admin filters now handle multi-valued query parameters. XRegExp is upgraded from version 3.2.0 to 5.1.1.
Release notes Django 5.1.1 release notes
Fixed a regression in Django 5.1 that caused a crash of Window() when passing an empty sequence to the order_by parameter, and a crash of Prefetch() for a sliced queryset without ordering (#35665).
Release notes Archive of security issues
Potential SQL injection via QuerySet.order_by and FilteredRelation. Full description Django 6.0 (patch) Django 5.2 (patch) Django 4.2 (patch)
Release notes Archive of security issues
Potential SQL injection via _connector keyword argument in QuerySet and Q objects. Full description Django 6.0 (patch) Django 5.2 (patch) Django 5.1 (patch) Django 4.2 (patch)
Release notes Archive of security issues
Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB. Full description Django 6.0 (patch) Django 5.2 (patch) Django 5.1 (patch) Django 4.2 (patch)
Release notes Archive of security issues
Potential SQL injection in QuerySet.values() and values_list(). Full description Django 5.0 (patch) Django 4.2 (patch)
Release notes Archive of security issues
Potential SQL injection in QuerySet.annotate(), aggregate(), and extra(). Full description Django 4.0 (patch) Django 3.2 (patch) Django 2.2 (patch)
Release notes Archive of security issues
Potential SQL injection via QuerySet.explain(**options) on PostgreSQL. Full description Django 4.0 (patch) Django 3.2 (patch) Django 2.2 (patch)
Release notes Archive of security issues
Potential SQL injection via unsanitized QuerySet.order_by() input. Full description
Release notes Django 1.10 release notes What’s new in Django 1.10Minor features
Temporal data subtraction was unified on all backends. If the database supports it, backends can set DatabaseFeatures.can_return_ids_from_bulk_insert=True and implement DatabaseOperations.fetch_returned_insert_ids() to set primary keys on objects created using QuerySet.bulk_create().
Release notes Django 1.10 release notes What’s new in Django 1.10Minor features
The reverse relation attached by a ForeignKey pointing to a proxy model is now accessible as a descriptor on the proxied model class and may be referenced in queryset filtering.
Release notes Django 1.10 release notes Features deprecated in 1.10
This method must accept a QuerySet instance as its single argument and return a filtered version of the queryset for the model instance the manager is bound to.
Release notes Django 1.11 release notes What’s new in Django 1.11
The new Subquery and Exists database expressions allow creating explicit subqueries. Subqueries may refer to fields from the outer queryset using the OuterRef class.
Release notes Django 1.11.4 release notes
Fixed QuerySet.union() and difference() when combining with a queryset raising EmptyResultSet (#28378). Fixed a regression in pickling of LazyObject on Python 2 when the wrapped object doesn’t have __reduce__() (#28389).
Release notes Django 1.11.7 release notes
Prevented cache.get_or_set() from caching None if the default argument is a callable that returns None (#28601). Fixed the Basque DATE_FORMAT string (#28710). Made QuerySet.reverse() affect nulls_first and nulls_last (#28722). Fixed unquoted table names in Subquery SQL when using OuterRef (#28689).
Release notes Django 1.11.8 release notes
Added support for QuerySet.values() and values_list() for union(), difference(), and intersection() queries (#28781). Fixed incorrect index name truncation when using a namespaced db_table (#28792). Made QuerySet.iterator() use server-side cursors on PostgreSQL after values() and values_list() (#28817).