Release notes Django 2.2.28 release notes

QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods.

Release notes Django 2.2.28 release notes

QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument.

Release notes Django 3.2.13 release notes

QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods.

Release notes Django 3.2.13 release notes

QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument.

Release notes Django 4.0.4 release notes

QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods.

Release notes Django 4.0.4 release notes

QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument.

Release notes Django 4.2.15 release notes

QuerySet.values() and values_list() methods on models with a JSONField were subject to SQL injection in column aliases, via a crafted JSON object key as a passed *arg.

Release notes Django 4.2.25 release notes

QuerySet.annotate(), alias(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (follow up to CVE 2022-28346).

Release notes Django 4.2.28 release notes

QuerySet.order_by() was subject to SQL injection in column aliases containing periods when the same alias was, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. This issue has severity “high” according to the Django security policy.

Release notes Django 1.6 release notes Features deprecated in 1.6

Methods that return a QuerySet such as Manager.get_query_set or ModelAdmin.queryset have been renamed to get_queryset.

Release notes Django 3.1.13 release notes

Unsanitized user input passed to QuerySet.order_by() could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted.

Release notes Django 3.2.5 release notes

Unsanitized user input passed to QuerySet.order_by() could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted.

Release notes Django 1.9 release notes What’s new in Django 1.9Minor features

QuerySet.bulk_create() now works on proxy models. Database configuration gained a TIME_ZONE option for interacting with databases that store datetimes in local time and don’t support time zones when USE_TZ is True.

Release notes Django 4.2 release notes What’s new in Django 4.2Minor features

QuerySet now extensively supports filtering against Window functions with the exception of disjunctive filter lookups against window functions when performing aggregation. prefetch_related() now supports Prefetch objects with sliced querysets. Registering lookups on Field instances is now supported.

Release notes Django 1.4 release notes What’s new in Django 1.4

The distinct() QuerySet method now accepts an optional list of model field names. If specified, then the DISTINCT statement is limited to these fields. This is only supported in PostgreSQL. For more details, see the documentation for distinct().

Release notes Django 1.7 release notes What’s new in Django 1.7Minor features

The QuerySet.update_or_create() method was added. The new default_permissions model Meta option allows you to customize (or disable) creation of the default add, change, and delete permissions. Explicit OneToOneField for Multi-table inheritance are now discovered in abstract classes.

Release notes Django 4.0 release notes What’s new in Django 4.0Minor features

New QuerySet.contains(obj) method returns whether the queryset contains the given object. This tries to perform the query in the simplest and fastest way possible.

Release notes Django 4.1 release notes What’s new in Django 4.1

QuerySet now provides an asynchronous interface for all data access operations. These are named as-per the existing synchronous operations but with an a prefix, for example acreate(), aget(), and so on.

Release notes Django 1.10 release notes Features deprecated in 1.10

The repr() of a QuerySet is wrapped in <QuerySet > to disambiguate it from a plain list when debugging. utils.version.get_version() returns PEP 440 compliant release candidate versions (e.g. ‘1.10rc1’ instead of ‘1.10c1’).

Release notes Django 1.11.16 release notes

Fixed a race condition in QuerySet.update_or_create() that could result in data loss (#29499).