1293 sections across all versions Narrow to Django 6.0 (current) →
Release notes Django 1.10.2 release notes
Fixed a crash in MySQL database validation where SELECT @@sql_mode doesn’t return a result (#27180). Allowed combining contrib.postgres.search.SearchQuery with more than one & or | operators (#27143). Disabled system check for URL patterns beginning with a ‘/’ when APPEND_SLASH=False (#27238).
Release notes Django 1.6.10 release notes
Given a form that uses ModelMultipleChoiceField and show_hidden_initial=True (not a documented API), it was possible for a user to cause an unreasonable number of SQL queries by submitting duplicate values for the field’s data.
Release notes Django 1.7.3 release notes
Given a form that uses ModelMultipleChoiceField and show_hidden_initial=True (not a documented API), it was possible for a user to cause an unreasonable number of SQL queries by submitting duplicate values for the field’s data.
Release notes Django 1.10.2 release notes
Fixed a crash in MySQL database validation where SELECT @@sql_mode doesn’t return a result (#27180). Allowed combining contrib.postgres.search.SearchQuery with more than one & or | operators (#27143). Disabled system check for URL patterns beginning with a ‘/’ when APPEND_SLASH=False (#27238).
Release notes Django 1.6.10 release notes
Given a form that uses ModelMultipleChoiceField and show_hidden_initial=True (not a documented API), it was possible for a user to cause an unreasonable number of SQL queries by submitting duplicate values for the field’s data.
Release notes Django 1.7.3 release notes
Given a form that uses ModelMultipleChoiceField and show_hidden_initial=True (not a documented API), it was possible for a user to cause an unreasonable number of SQL queries by submitting duplicate values for the field’s data.
Release notes Django 1.3 release notes
Previously this field’s clean() method accepted a second, gender, argument which allowed stronger validation checks to be made, however since this argument could never actually be passed from the Django form machinery it is now pending deprecation.
Release notes Django 1.6 release notes
Fields included in the localized_fields list will be localized (by setting localize on the form field). The labels, help_texts and error_messages options may be used to customize the default fields, see Overriding the default fields for details.
Release notes Django 1.7 release notes
Heavy changes to the various error containers were necessary in order to support the features above, specifically Form.errors, django.forms.utils.ErrorList, and the internal storages of ValidationError.
Release notes Archive of security issues
Potential bypass of validation when uploading multiple files using one form field. Full description Django 4.2 (patch) Django 4.1 (patch) Django 3.2 (patch)
Release notes Django 1.3 release notes Features deprecated in 1.3
Previously this field’s clean() method accepted a second, gender, argument which allowed stronger validation checks to be made, however since this argument could never actually be passed from the Django form machinery it is now pending deprecation.
Release notes Django 1.6 release notes What’s new in Django 1.6
Fields included in the localized_fields list will be localized (by setting localize on the form field). The labels, help_texts and error_messages options may be used to customize the default fields, see Overriding the default fields for details.
Release notes Django 1.7 release notes What’s new in Django 1.7Improvements to Form error handling
Heavy changes to the various error containers were necessary in order to support the features above, specifically Form.errors, django.forms.utils.ErrorList, and the internal storages of ValidationError.
Release notes Archive of security issues Issues under Django’s security process
Potential bypass of validation when uploading multiple files using one form field. Full description Django 4.2 (patch) Django 4.1 (patch) Django 3.2 (patch)
Release notes Django 4.0 release notes
ModelChoiceField now includes the provided value in the params argument of a raised ValidationError for the invalid_choice error message. This allows custom error messages to use the %(value)s placeholder.
Release notes Django 4.0 release notes What’s new in Django 4.0Minor features
ModelChoiceField now includes the provided value in the params argument of a raised ValidationError for the invalid_choice error message. This allows custom error messages to use the %(value)s placeholder.
Release notes Django 4.2.29 release notes
The URLField form field’s to_python() method used urlsplit() to determine whether to prepend a URL scheme to the submitted value. On Windows, urlsplit() performs NFKC normalization, which can be disproportionately slow for large inputs containing certain characters.
Release notes Django 5.2.12 release notes
The URLField form field’s to_python() method used urlsplit() to determine whether to prepend a URL scheme to the submitted value. On Windows, urlsplit() performs NFKC normalization, which can be disproportionately slow for large inputs containing certain characters.
Release notes Django 6.0.3 release notes
The URLField form field’s to_python() method used urlsplit() to determine whether to prepend a URL scheme to the submitted value. On Windows, urlsplit() performs NFKC normalization, which can be disproportionately slow for large inputs containing certain characters.
Release notes Django 4.2.29 release notes
The URLField form field’s to_python() method used urlsplit() to determine whether to prepend a URL scheme to the submitted value. On Windows, urlsplit() performs NFKC normalization, which can be disproportionately slow for large inputs containing certain characters.