Release notes Django 4.2.26 release notes
QuerySet.filter(), exclude(), get(), and Q were subject to SQL injection using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
743 sections across all versions Narrow to Django 6.0 (current) →
Release notes Django 5.0 release notes What’s new in Django 5.0Minor features
QuerySet.prefetch_related() now supports prefetching GenericForeignKey with non-homogeneous set of results.
Release notes Django 5.1.14 release notes
QuerySet.filter(), exclude(), get(), and Q were subject to SQL injection using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Release notes Django 5.2.8 release notes
QuerySet.filter(), exclude(), get(), and Q were subject to SQL injection using a suitably crafted dictionary, with dictionary expansion, as the _connector argument.
Release notes Django 1.7.11 release notes
Fixed a data loss possibility with Prefetch if to_attr is set to a ManyToManyField (#25693).
Release notes Django 1.11.1 release notes
The change in Django 1.11 to make QuerySet.iterator() use server-side cursors on PostgreSQL prevents running Django with PgBouncer in transaction pooling mode. To reallow that, use the DISABLE_SERVER_SIDE_CURSORS setting in DATABASES. See Transaction pooling and server-side cursors for more discussion.
Release notes Django 1.11.25 release notes
Fixed a crash when filtering with a Subquery() annotation of a queryset containing django.contrib.postgres.fields.JSONField or HStoreField (#30769).
Release notes Django 1.5 release notes Backwards incompatible changes in 1.5
django.forms.ModelMultipleChoiceField now returns an empty QuerySet as the empty value instead of an empty list. int_to_base36() properly raises a TypeError instead of ValueError for non-integer inputs. The slugify template filter is now available as a standard Python function at django.utils.text.slugify().
Release notes Django 1.5 release notes Features deprecated in 1.5
The depth keyword argument in select_related() has been deprecated. You should use field names instead.
Release notes Django 1.7 release notes What’s new in Django 1.7
The new Prefetch object allows customizing prefetch operations. You can specify the QuerySet used to traverse a given relation or customize the storage location of prefetch results.
Release notes Django 1.8.6 release notes
Fixed a regression causing ModelChoiceField to ignore prefetch_related() on its queryset (#25496). Allowed “mode=memory” in SQLite test database name if supported (#12118). Fixed system check crash on ForeignKey to abstract model (#25503).
Release notes Django 2.0.4 release notes
Fixed a crash when filtering with an Exists() annotation of a queryset containing a single field (#29195). Fixed admin autocomplete widget’s translations for zh-hans and zh-hant languages (#29213). Corrected admin’s autocomplete widget to add a space after custom classes (#29221).
Release notes Django 2.1.13 release notes
Fixed a crash when filtering with a Subquery() annotation of a queryset containing django.contrib.postgres.fields.JSONField or HStoreField (#30769).
Release notes Django 2.1.15 release notes
Fixed a data loss possibility in the select_for_update(). When using 'self' in the of argument with multi-table inheritance, a parent model was locked instead of the queryset’s model (#30953).
Release notes Django 2.2.11 release notes
Fixed a data loss possibility in the select_for_update(). When using related fields or parent link fields with Multi-table inheritance in the of argument, the corresponding models were not locked (#31246).
Release notes Django 2.2.16 release notes
Fixed a data loss possibility in the select_for_update(). When using related fields pointing to a proxy model in the of argument, the corresponding model was not locked (#31866).
Release notes Django 3.0.10 release notes
Fixed a data loss possibility in the select_for_update(). When using related fields pointing to a proxy model in the of argument, the corresponding model was not locked (#31866).
Release notes Django 3.2.5 release notes
Fixed a regression in Django 3.2 that caused a crash of QuerySet.values_list(…, named=True) after prefetch_related() (#32812). Fixed a bug in Django 3.2 that caused a migration crash on MySQL 8.0.13+ when altering BinaryField, JSONField, or TextField to non-nullable (#32503).
Release notes Django 4.2.1 release notes
Fixed a regression in Django 4.2 that caused a crash of QuerySet.defer() when deferring fields by attribute names (#34458). Fixed a regression in Django 4.2 that caused a crash of SearchVector function with % characters (#34459).
Release notes Django 4.2.24 release notes
FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias().