Release notes Django 4.2.28 release notes

FilteredRelation was subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias().

Release notes Django 4.2.4 release notes

Fixed a regression in Django 4.2 that caused a crash of QuerySet.aggregate() with aggregates referencing window functions (#34717). Fixed a regression in Django 4.2 that caused a crash when grouping by a reference in a subquery (#34748).

Release notes Django 4.2.7 release notes

Fixed a regression in Django 4.2 that caused a crash of QuerySet.aggregate() with aggregates referencing expressions containing subqueries (#34798). Restored, following a regression in Django 4.2, creating varchar/text_pattern_ops indexes on CharField and TextField with deterministic collations on PostgreSQL (#34932).

Release notes Django 5.1.12 release notes

FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias().

Release notes Django 5.1.15 release notes

FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL.

Release notes Django 5.2.11 release notes

FilteredRelation was subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias().

Release notes Django 5.2.6 release notes

FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias().

Release notes Django 5.2.9 release notes

FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL.

Release notes Django 6.0.2 release notes

FilteredRelation was subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate(), aggregate(), extra(), values(), values_list(), and alias().

Release notes Django 6.0.8 release notes

Fixed a regression in Django 6.0 that caused bulk_create() to crash on databases that support returning rows from bulk inserts when a related object providing the primary key was saved after assignment (#37234). Added compatibility for sqlparse 0.5.5 (#37235).

Release notes Django 6.1.1 release notes

Fixed a regression in Django 6.1 where custom querysets used with Prefetch for forward foreign key or reverse one-to-one relationships were not routed using the parent queryset’s database (#37300).

Release notes Django 1.11.12 release notes

Fixed a regression in Django 1.11.8 where combining two annotated values_list() querysets with union(), difference(), or intersection() crashed due to mismatching columns (#29229).

Release notes Django 2.2.3 release notes CVE-2019-12781: Incorrect HTTP detection with reverse-proxy connecting via HTTPS

Fixed a regression in Django 2.2 where Avg, StdDev, and Variance crash with filter argument (#30542). Fixed a regression in Django 2.2.2 where auto-reloader crashes with AttributeError, e.g. when using ipdb (#30588).

Release notes Django 1.6 release notes What’s new in Django 1.6

The support for time zones introduced in Django 1.4 didn’t work well with QuerySet.dates(): aggregation was always performed in UTC. This limitation was lifted in Django 1.6. Use QuerySet.datetimes() to perform time zone aware aggregation on a DateTimeField.

Release notes Django 1.6.3 release notes

Historically, queries that use select_for_update() could be executed in autocommit mode, outside of a transaction. Before Django 1.6, Django’s automatic transactions mode allowed this to be used to lock records until the next write operation.

Release notes Django 1.7 release notes Backwards incompatible changes in 1.7

Historically, queries that use select_for_update() could be executed in autocommit mode, outside of a transaction. Before Django 1.6, Django’s automatic transactions mode allowed this to be used to lock records until the next write operation.

Release notes Django 3.0 release notes What’s new in Django 3.0

Expressions that output BooleanField may now be used directly in QuerySet filters, without having to first annotate and then filter against the annotation.

Release notes Django 3.0.6 release notes

Fixed a regression in Django 3.0 that caused a crash when filtering a Subquery() annotation of a queryset containing a single related field against a SimpleLazyObject (#31420).

Release notes Django 5.2.10 release notes

Fixed a bug in Django 5.2 where data exceeding max_length was silently truncated by QuerySet.bulk_create() on PostgreSQL (#33647). Fixed a bug where management command colorized help (introduced in Python 3.14) ignored the --no-color option and the DJANGO_COLORS setting (#36376).

Release notes Django 5.2.5 release notes

Fixed a regression in Django 5.2.1 that prevented the usage of UNNEST PostgreSQL strategy of QuerySet.bulk_create() with foreign keys (#36502). Fixed a crash in Django 5.2 when filtering against a composite primary key using a tuple containing expressions (#36522).