Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection in QuerySet.annotate(), aggregate(), and extra(). Full description Django 4.0 (patch) Django 3.2 (patch) Django 2.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection via QuerySet.explain(**options) on PostgreSQL. Full description Django 4.0 (patch) Django 3.2 (patch) Django 2.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection via unsanitized QuerySet.order_by() input. Full description

Release notes Django 1.6 release notes Backwards incompatible changes in 1.6

Django 1.6 introduces time zone support for day, month, and week_day lookups when USE_TZ is True. These lookups were previously performed in UTC regardless of the current time zone. This requires time zone definitions in the database.

Release notes Django 1.8 release notes Features deprecated in 1.8

ModelChoiceField and ModelMultipleChoiceField took an undocumented, untested option cache_choices. This cached querysets between multiple renderings of the same Form object. This option is subject to an accelerated deprecation and will be removed in Django 1.9.

Release notes Django 2.2 release notes Features deprecated in 2.2

The undocumented QuerySetPaginator alias of django.core.paginator.Paginator is deprecated. The FloatRangeField model and form fields in django.contrib.postgres are deprecated in favor of a new name, DecimalRangeField, to match the underlying numrange data type used in the database.

Release notes Django 3.1 release notes

django.utils.timezone.FixedOffset is removed. django.core.paginator.QuerySetPaginator is removed. A model’s Meta.ordering doesn’t affect GROUP BY queries. django.contrib.postgres.fields.FloatRangeField and django.contrib.postgres.forms.FloatRangeField are removed. The FILE_CHARSET setting is removed. django.contrib.staticfiles.storage.CachedStaticFilesStorage is removed. The RemoteUserBackend.configure_user() method requires request as the first positional argument.

Release notes Django 3.2.3 release notes

Prepared for mysqlclient > 2.0.3 support (#32732). Fixed a regression in Django 3.2 that caused the incorrect filtering of querysets combined with the | operator (#32717).

Release notes Django version 0.96 release notes What’s new in 0.96?

You can now use any callable as the callback in URLconfs (previously, only strings that referred to callables were allowed). This allows a much more natural use of URLconfs.

Release notes Django 1.1 release notes What’s new in Django 1.1ORM improvements

COUNT(), MAX(), MIN(), etc.) from within Django’s ORM. You can choose to either return the results of the aggregate directly, or else annotate the objects in a QuerySet with the results of the aggregate query.

Release notes Django 1.1 release notes What’s new in Django 1.1Model improvements

If you know you don’t need those particular fields, you can now tell Django not to retrieve them from the database. You’ll do this with the new queryset methods defer() and only().

Release notes Django 1.10.1 release notes

Made QuerySet.bulk_create() properly initialize model instances on backends, such as PostgreSQL, that support returning the IDs of the created records so that many-to-many relationships can be used on the new objects (#27026). Fixed crash of django.views.static.serve() with show_indexes enabled (#26973).

Release notes Django 1.10.3 release notes

Fixed QuerySet.bulk_create() on PostgreSQL when the number of objects is a multiple plus one of batch_size (#27385). Prevented i18n_patterns() from using too much of the URL as the language to fix a use case for prefix_default_language=False (#27063).

Release notes Django 1.10.4 release notes

Fixed a QuerySet.update() crash on SQLite when updating a DateTimeField with an F() expression and a timedelta (#27544). Prevented LocaleMiddleware from redirecting on URLs that should return 404 when using prefix_default_language=False (#27402).

Release notes Django 1.11.1 release notes

Fixed QuerySet.filter() crash when it references the name of a OneToOneField primary key (#28047). Fixed empty POST data table appearing instead of “No POST data” in HTML debug page (#28079). Restored BoundFields without any choices evaluating to True (#28058).

Release notes Django 1.11.13 release notes

Fixed a regression in Django 1.11.12 where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns (#29286).

Release notes Django 1.11.2 release notes

Relaxed the validation added in Django 1.11 of the fields in the defaults argument of QuerySet.get_or_create() and update_or_create() to reallow settable model properties (#28222). Fixed MultipleObjectMixin.paginate_queryset() crash on Python 2 if the InvalidPage message contains non-ASCII (#28204).

Release notes Django 1.11.23 release notes

Key and index lookups for django.contrib.postgres.fields.JSONField and key lookups for HStoreField were subject to SQL injection, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.filter().

Release notes Django 1.11.3 release notes

Fixed admin’s FieldListFilter.get_queryset() crash on invalid input (#28202). Fixed invalid HTML for a required AdminFileWidget (#28278). Fixed model initialization to set the name of class-based model indexes for models that only inherit models.Model (#28282).

Release notes Django 1.4 release notes

… number of ORM improvements, including SELECT FOR UPDATE support, the ability to bulk insert large datasets for improved performance, and QuerySet.prefetch_related, a method to batch-load related objects in areas where select_related() doesn’t work. Some nice security additions, including improved password …