Release notes Django 3.1.2 release notes

Fixed a regression in Django 3.1 where the QuerySet.ordered attribute returned incorrectly True for GROUP BY queries (e.g. .annotate().values()) on models with Meta.ordering. A model’s Meta.ordering doesn’t affect such queries (#31990).

Release notes Django 4.0 release notes Features deprecated in 4.0

Accordingly, the is_dst arguments to the following are also deprecated: django.db.models.query.QuerySet.datetimes() django.db.models.functions.Trunc() django.db.models.functions.TruncSecond() django.db.models.functions.TruncMinute() django.db.models.functions.TruncHour() django.db.models.functions.TruncDay() django.db.models.functions.TruncWeek() django.db.models.functions.TruncMonth() django.db.models.functions.TruncQuarter() django.db.models.functions.TruncYear() django.utils.timezone.make_aware() Support for use of pytz will be removed in Django 5.0.

Release notes Django 4.0.5 release notes

Fixed a bug in Django 4.0 that caused a crash of QuerySet.filter() on IsNull() expressions (#33705). Fixed a bug in Django 4.0 where a hidden quick filter toolbar in the admin’s navigation sidebar was focusable (#33725).

Release notes Django 4.1.2 release notes

Fixed a regression in Django 4.1 that caused aggregation over a queryset that contained an Exists annotation to crash due to too many selected columns (#33992).

Release notes Django 4.2 release notes Backwards incompatible changes in 4.2

In order to avoid updating unnecessary columns, QuerySet.update_or_create() now passes update_fields to the Model.save() calls. As a consequence, any fields modified in the custom save() methods should be added to the update_fields keyword argument before calling super().

Release notes Django 4.2.8 release notes

Fixed a regression in Django 4.2 that caused makemigrations --check to stop displaying pending migrations (#34457). Fixed a regression in Django 4.2 that caused a crash of QuerySet.aggregate() with aggregates referencing other aggregates or window functions through conditional expressions (#34975).

Release notes Django 5.0 release notes What’s new in Django 5.0Minor features

The new AdminSite.get_log_entries() method allows customizing the queryset for the site’s listed log entries. The django.contrib.admin.AllValuesFieldListFilter, ChoicesFieldListFilter, RelatedFieldListFilter, and RelatedOnlyFieldListFilter admin filters now handle multi-valued query parameters. XRegExp is upgraded from version 3.2.0 to 5.1.1.

Release notes Django 5.1.1 release notes

Fixed a regression in Django 5.1 that caused a crash of Window() when passing an empty sequence to the order_by parameter, and a crash of Prefetch() for a sliced queryset without ordering (#35665).

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection via QuerySet.order_by and FilteredRelation. Full description Django 6.0 (patch) Django 5.2 (patch) Django 4.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection via _connector keyword argument in QuerySet and Q objects. Full description Django 6.0 (patch) Django 5.2 (patch) Django 5.1 (patch) Django 4.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB. Full description Django 6.0 (patch) Django 5.2 (patch) Django 5.1 (patch) Django 4.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection in QuerySet.values() and values_list(). Full description Django 5.0 (patch) Django 4.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection in QuerySet.annotate(), aggregate(), and extra(). Full description Django 4.0 (patch) Django 3.2 (patch) Django 2.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection via QuerySet.explain(**options) on PostgreSQL. Full description Django 4.0 (patch) Django 3.2 (patch) Django 2.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection via unsanitized QuerySet.order_by() input. Full description

Release notes Django 1.6 release notes Backwards incompatible changes in 1.6

Django 1.6 introduces time zone support for day, month, and week_day lookups when USE_TZ is True. These lookups were previously performed in UTC regardless of the current time zone. This requires time zone definitions in the database.

Release notes Django 1.8 release notes Features deprecated in 1.8

ModelChoiceField and ModelMultipleChoiceField took an undocumented, untested option cache_choices. This cached querysets between multiple renderings of the same Form object. This option is subject to an accelerated deprecation and will be removed in Django 1.9.

Release notes Django 2.2 release notes Features deprecated in 2.2

The undocumented QuerySetPaginator alias of django.core.paginator.Paginator is deprecated. The FloatRangeField model and form fields in django.contrib.postgres are deprecated in favor of a new name, DecimalRangeField, to match the underlying numrange data type used in the database.

Release notes Django 3.1 release notes

django.utils.timezone.FixedOffset is removed. django.core.paginator.QuerySetPaginator is removed. A model’s Meta.ordering doesn’t affect GROUP BY queries. django.contrib.postgres.fields.FloatRangeField and django.contrib.postgres.forms.FloatRangeField are removed. The FILE_CHARSET setting is removed. django.contrib.staticfiles.storage.CachedStaticFilesStorage is removed. The RemoteUserBackend.configure_user() method requires request as the first positional argument.

Release notes Django 3.2.3 release notes

Prepared for mysqlclient > 2.0.3 support (#32732). Fixed a regression in Django 3.2 that caused the incorrect filtering of querysets combined with the | operator (#32717).