1413 sections across all versions Narrow to Django 6.0 (current) →
Release notes Django 3.1 release notes What’s new in Django 3.1Minor features
QuerySet.explain() now supports: TREE format on MySQL 8.0.16+, analyze option on MySQL 8.0.18+ and MariaDB. Added PositiveBigIntegerField which acts much like a PositiveIntegerField except that it only allows values under a certain (database-dependent) limit.
Release notes Django 3.1 release notes Features deprecated in 3.1
Passing raw column aliases to QuerySet.order_by() is deprecated. The same result can be achieved by passing aliases in a RawSQL instead beforehand. The NullBooleanField model field is deprecated in favor of BooleanField(null=True, blank=True). django.conf.urls.url() alias of django.urls.re_path() is deprecated.
Release notes Django 3.1.2 release notes
Fixed a regression in Django 3.1 where the QuerySet.ordered attribute returned incorrectly True for GROUP BY queries (e.g. .annotate().values()) on models with Meta.ordering. A model’s Meta.ordering doesn’t affect such queries (#31990).
Release notes Django 4.0 release notes Features deprecated in 4.0
Accordingly, the is_dst arguments to the following are also deprecated: django.db.models.query.QuerySet.datetimes() django.db.models.functions.Trunc() django.db.models.functions.TruncSecond() django.db.models.functions.TruncMinute() django.db.models.functions.TruncHour() django.db.models.functions.TruncDay() django.db.models.functions.TruncWeek() django.db.models.functions.TruncMonth() django.db.models.functions.TruncQuarter() django.db.models.functions.TruncYear() django.utils.timezone.make_aware() Support for use of pytz will be removed in Django 5.0.
Release notes Django 4.0.5 release notes
Fixed a bug in Django 4.0 that caused a crash of QuerySet.filter() on IsNull() expressions (#33705). Fixed a bug in Django 4.0 where a hidden quick filter toolbar in the admin’s navigation sidebar was focusable (#33725).
Release notes Django 4.1.2 release notes
Fixed a regression in Django 4.1 that caused aggregation over a queryset that contained an Exists annotation to crash due to too many selected columns (#33992).
Release notes Django 4.2 release notes Backwards incompatible changes in 4.2
In order to avoid updating unnecessary columns, QuerySet.update_or_create() now passes update_fields to the Model.save() calls. As a consequence, any fields modified in the custom save() methods should be added to the update_fields keyword argument before calling super().
Release notes Django 4.2.8 release notes
Fixed a regression in Django 4.2 that caused makemigrations --check to stop displaying pending migrations (#34457). Fixed a regression in Django 4.2 that caused a crash of QuerySet.aggregate() with aggregates referencing other aggregates or window functions through conditional expressions (#34975).
Release notes Django 5.0 release notes What’s new in Django 5.0Minor features
The new AdminSite.get_log_entries() method allows customizing the queryset for the site’s listed log entries. The django.contrib.admin.AllValuesFieldListFilter, ChoicesFieldListFilter, RelatedFieldListFilter, and RelatedOnlyFieldListFilter admin filters now handle multi-valued query parameters. XRegExp is upgraded from version 3.2.0 to 5.1.1.
Release notes Django 5.1.1 release notes
Fixed a regression in Django 5.1 that caused a crash of Window() when passing an empty sequence to the order_by parameter, and a crash of Prefetch() for a sliced queryset without ordering (#35665).
Release notes Archive of security issues Issues under Django’s security process
Potential SQL injection via QuerySet.order_by and FilteredRelation. Full description Django 6.0 (patch) Django 5.2 (patch) Django 4.2 (patch)
Release notes Archive of security issues Issues under Django’s security process
Potential SQL injection via _connector keyword argument in QuerySet and Q objects. Full description Django 6.0 (patch) Django 5.2 (patch) Django 5.1 (patch) Django 4.2 (patch)
Release notes Archive of security issues Issues under Django’s security process
Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB. Full description Django 6.0 (patch) Django 5.2 (patch) Django 5.1 (patch) Django 4.2 (patch)
Release notes Archive of security issues Issues under Django’s security process
Potential SQL injection in QuerySet.values() and values_list(). Full description Django 5.0 (patch) Django 4.2 (patch)
Release notes Archive of security issues Issues under Django’s security process
Potential SQL injection in QuerySet.annotate(), aggregate(), and extra(). Full description Django 4.0 (patch) Django 3.2 (patch) Django 2.2 (patch)
Release notes Archive of security issues Issues under Django’s security process
Potential SQL injection via QuerySet.explain(**options) on PostgreSQL. Full description Django 4.0 (patch) Django 3.2 (patch) Django 2.2 (patch)
Release notes Archive of security issues Issues under Django’s security process
Potential SQL injection via unsanitized QuerySet.order_by() input. Full description
Release notes Django 5.2.18 release notes
Model formsets incorrectly allowed forged POST data to either delete instances outside the limiting queryset or create instances via edit-only formsets when the model’s primary key could be set through the form, such as with: a OneToOneField (or parent link …
Release notes Django 6.0.9 release notes
Model formsets incorrectly allowed forged POST data to either delete instances outside the limiting queryset or create instances via edit-only formsets when the model’s primary key could be set through the form, such as with: a OneToOneField (or parent link …
Release notes Django 6.1.2 release notes
Model formsets incorrectly allowed forged POST data to either delete instances outside the limiting queryset or create instances via edit-only formsets when the model’s primary key could be set through the form, such as with: a OneToOneField (or parent link …