Release notes Django 2.1 release notes What’s new in Django 2.1Minor features

ModelAdmin.search_fields now accepts any lookup such as field__exact. jQuery is upgraded from version 2.2.3 to 3.3.1. The new ModelAdmin.delete_queryset() method allows customizing the deletion process of the “delete selected objects” action. You can now override the default admin site.

Release notes Django 2.2.6 release notes

Fixed migrations crash on SQLite when altering a model containing partial indexes (#30754). Fixed a regression in Django 2.2.4 that caused a crash when filtering with a Subquery() annotation of a queryset containing django.contrib.postgres.fields.JSONField or HStoreField (#30769).

Release notes Django 3.0.2 release notes

Fixed a regression in Django 3.0 that didn’t include columns referenced by a Subquery() in the GROUP BY clause (#31094). Fixed a regression in Django 3.0 where QuerySet.exists() crashed if a queryset contained an aggregation over a Subquery() (#31109).

Release notes Django 3.0.3 release notes

Fixed a regression in Django 3.0 where QuerySet.values() and values_list() crashed if a queryset contained an aggregation and Exists() annotation (#31136).

Release notes Django 3.0.4 release notes

Fixed a data loss possibility when using caching from async code (#31253). Fixed a regression in Django 3.0 that caused a file response using a temporary file to be closed incorrectly (#31240). Fixed a data loss possibility in the select_for_update().

Release notes Django 3.0.5 release notes

Fixed a regression in Django 3.0 where QuerySet.values() and values_list() crashed if a queryset contained an aggregation and Subquery() annotation that collides with a field name (#31377).

Release notes Django 3.0.7 release notes

Fixed a regression in Django 3.0 by restoring the ability to use field lookups in Meta.ordering (#31538). Fixed a regression in Django 3.0 where QuerySet.values() and values_list() crashed if a queryset contained an aggregation and a subquery annotation (#31566).

Release notes Django 3.0.8 release notes

Fixed messages of InvalidCacheKey exceptions and CacheKeyWarning warnings raised by cache key validation (#31654). Fixed a regression in Django 3.0.7 that caused a queryset crash when grouping by a many-to-one relationship (#31660).

Release notes Django 3.1 release notes What’s new in Django 3.1Minor features

QuerySet.explain() now supports: TREE format on MySQL 8.0.16+, analyze option on MySQL 8.0.18+ and MariaDB. Added PositiveBigIntegerField which acts much like a PositiveIntegerField except that it only allows values under a certain (database-dependent) limit.

Release notes Django 3.1 release notes Features deprecated in 3.1

Passing raw column aliases to QuerySet.order_by() is deprecated. The same result can be achieved by passing aliases in a RawSQL instead beforehand. The NullBooleanField model field is deprecated in favor of BooleanField(null=True). django.conf.urls.url() alias of django.urls.re_path() is deprecated.

Release notes Django 3.1.2 release notes

Fixed a regression in Django 3.1 where the QuerySet.ordered attribute returned incorrectly True for GROUP BY queries (e.g. .annotate().values()) on models with Meta.ordering. A model’s Meta.ordering doesn’t affect such queries (#31990).

Release notes Django 4.0 release notes Features deprecated in 4.0

Accordingly, the is_dst arguments to the following are also deprecated: django.db.models.query.QuerySet.datetimes() django.db.models.functions.Trunc() django.db.models.functions.TruncSecond() django.db.models.functions.TruncMinute() django.db.models.functions.TruncHour() django.db.models.functions.TruncDay() django.db.models.functions.TruncWeek() django.db.models.functions.TruncMonth() django.db.models.functions.TruncQuarter() django.db.models.functions.TruncYear() django.utils.timezone.make_aware() Support for use of pytz will be removed in Django 5.0.

Release notes Django 4.0.5 release notes

Fixed a bug in Django 4.0 that caused a crash of QuerySet.filter() on IsNull() expressions (#33705). Fixed a bug in Django 4.0 where a hidden quick filter toolbar in the admin’s navigation sidebar was focusable (#33725).

Release notes Django 4.1.2 release notes

Fixed a regression in Django 4.1 that caused aggregation over a queryset that contained an Exists annotation to crash due to too many selected columns (#33992).

Release notes Django 4.2 release notes Backwards incompatible changes in 4.2

In order to avoid updating unnecessary columns, QuerySet.update_or_create() now passes update_fields to the Model.save() calls. As a consequence, any fields modified in the custom save() methods should be added to the update_fields keyword argument before calling super().

Release notes Django 4.2.8 release notes

Fixed a regression in Django 4.2 that caused makemigrations --check to stop displaying pending migrations (#34457). Fixed a regression in Django 4.2 that caused a crash of QuerySet.aggregate() with aggregates referencing other aggregates or window functions through conditional expressions (#34975).

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection via QuerySet.order_by and FilteredRelation. Full description Django 6.0 (patch) Django 5.2 (patch) Django 4.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection via _connector keyword argument in QuerySet and Q objects. Full description Django 6.0 (patch) Django 5.2 (patch) Django 5.1 (patch) Django 4.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB. Full description Django 6.0 (patch) Django 5.2 (patch) Django 5.1 (patch) Django 4.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection in QuerySet.values() and values_list(). Full description Django 5.0 (patch) Django 4.2 (patch)