Release notes Django 3.0.2 release notes

Fixed a regression in Django 3.0 that didn’t include columns referenced by a Subquery() in the GROUP BY clause (#31094). Fixed a regression in Django 3.0 where QuerySet.exists() crashed if a queryset contained an aggregation over a Subquery() (#31109).

Release notes Django 3.0.3 release notes

Fixed a regression in Django 3.0 where QuerySet.values() and values_list() crashed if a queryset contained an aggregation and Exists() annotation (#31136).

Release notes Django 3.0.4 release notes

Fixed a data loss possibility when using caching from async code (#31253). Fixed a regression in Django 3.0 that caused a file response using a temporary file to be closed incorrectly (#31240). Fixed a data loss possibility in the select_for_update().

Release notes Django 3.0.5 release notes

Fixed a regression in Django 3.0 where QuerySet.values() and values_list() crashed if a queryset contained an aggregation and Subquery() annotation that collides with a field name (#31377).

Release notes Django 3.0.7 release notes

Fixed a regression in Django 3.0 by restoring the ability to use field lookups in Meta.ordering (#31538). Fixed a regression in Django 3.0 where QuerySet.values() and values_list() crashed if a queryset contained an aggregation and a subquery annotation (#31566).

Release notes Django 3.0.8 release notes

Fixed messages of InvalidCacheKey exceptions and CacheKeyWarning warnings raised by cache key validation (#31654). Fixed a regression in Django 3.0.7 that caused a queryset crash when grouping by a many-to-one relationship (#31660).

Release notes Django 3.1 release notes

QuerySet.explain() now supports: TREE format on MySQL 8.0.16+, analyze option on MySQL 8.0.18+ and MariaDB. Added PositiveBigIntegerField which acts much like a PositiveIntegerField except that it only allows values under a certain (database-dependent) limit.

Release notes Django 3.1 release notes

Passing raw column aliases to QuerySet.order_by() is deprecated. The same result can be achieved by passing aliases in a RawSQL instead beforehand. The NullBooleanField model field is deprecated in favor of BooleanField(null=True, blank=True). django.conf.urls.url() alias of django.urls.re_path() is deprecated.

Release notes Django 3.1.2 release notes

Fixed a regression in Django 3.1 where the QuerySet.ordered attribute returned incorrectly True for GROUP BY queries (e.g. .annotate().values()) on models with Meta.ordering. A model’s Meta.ordering doesn’t affect such queries (#31990).

Release notes Django 4.0 release notes

Accordingly, the is_dst arguments to the following are also deprecated: django.db.models.query.QuerySet.datetimes() django.db.models.functions.Trunc() django.db.models.functions.TruncSecond() django.db.models.functions.TruncMinute() django.db.models.functions.TruncHour() django.db.models.functions.TruncDay() django.db.models.functions.TruncWeek() django.db.models.functions.TruncMonth() django.db.models.functions.TruncQuarter() django.db.models.functions.TruncYear() django.utils.timezone.make_aware() Support for use of pytz will be removed in Django 5.0.

Release notes Django 4.0.5 release notes

Fixed a bug in Django 4.0 that caused a crash of QuerySet.filter() on IsNull() expressions (#33705). Fixed a bug in Django 4.0 where a hidden quick filter toolbar in the admin’s navigation sidebar was focusable (#33725).

Release notes Django 4.1.2 release notes

Fixed a regression in Django 4.1 that caused aggregation over a queryset that contained an Exists annotation to crash due to too many selected columns (#33992).

Release notes Django 4.2 release notes

In order to avoid updating unnecessary columns, QuerySet.update_or_create() now passes update_fields to the Model.save() calls. As a consequence, any fields modified in the custom save() methods should be added to the update_fields keyword argument before calling super().

Release notes Django 4.2.8 release notes

Fixed a regression in Django 4.2 that caused makemigrations --check to stop displaying pending migrations (#34457). Fixed a regression in Django 4.2 that caused a crash of QuerySet.aggregate() with aggregates referencing other aggregates or window functions through conditional expressions (#34975).

Release notes Django 5.0 release notes

The new AdminSite.get_log_entries() method allows customizing the queryset for the site’s listed log entries. The django.contrib.admin.AllValuesFieldListFilter, ChoicesFieldListFilter, RelatedFieldListFilter, and RelatedOnlyFieldListFilter admin filters now handle multi-valued query parameters. XRegExp is upgraded from version 3.2.0 to 5.1.1.

Release notes Django 5.1.1 release notes

Fixed a regression in Django 5.1 that caused a crash of Window() when passing an empty sequence to the order_by parameter, and a crash of Prefetch() for a sliced queryset without ordering (#35665).

Release notes Archive of security issues

Potential SQL injection via QuerySet.order_by and FilteredRelation. Full description Django 6.0 (patch) Django 5.2 (patch) Django 4.2 (patch)

Release notes Archive of security issues

Potential SQL injection via _connector keyword argument in QuerySet and Q objects. Full description Django 6.0 (patch) Django 5.2 (patch) Django 5.1 (patch) Django 4.2 (patch)

Release notes Archive of security issues

Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB. Full description Django 6.0 (patch) Django 5.2 (patch) Django 5.1 (patch) Django 4.2 (patch)

Release notes Archive of security issues

Potential SQL injection in QuerySet.values() and values_list(). Full description Django 5.0 (patch) Django 4.2 (patch)