Release notes Archive of security issues

Potential SQL injection in QuerySet.annotate(), aggregate(), and extra(). Full description Django 4.0 (patch) Django 3.2 (patch) Django 2.2 (patch)

Release notes Archive of security issues

Potential SQL injection via QuerySet.explain(**options) on PostgreSQL. Full description Django 4.0 (patch) Django 3.2 (patch) Django 2.2 (patch)

Release notes Archive of security issues

Potential SQL injection via unsanitized QuerySet.order_by() input. Full description

Release notes Django 6.1.2 release notes

Model formsets incorrectly allowed forged POST data to either delete instances outside the limiting queryset or create instances via edit-only formsets when the model’s primary key could be set through the form, such as with: a OneToOneField (or parent link …

Release notes Django 5.2.18 release notes

Model formsets incorrectly allowed forged POST data to either delete instances outside the limiting queryset or create instances via edit-only formsets when the model’s primary key could be set through the form, such as with: a OneToOneField (or parent link …

Release notes Django 6.0.9 release notes

Model formsets incorrectly allowed forged POST data to either delete instances outside the limiting queryset or create instances via edit-only formsets when the model’s primary key could be set through the form, such as with: a OneToOneField (or parent link …

Release notes Django 1.6 release notes

Django 1.6 introduces time zone support for day, month, and week_day lookups when USE_TZ is True. These lookups were previously performed in UTC regardless of the current time zone. This requires time zone definitions in the database.

Release notes Django 1.8 release notes

ModelChoiceField and ModelMultipleChoiceField took an undocumented, untested option cache_choices. This cached querysets between multiple renderings of the same Form object. This option is subject to an accelerated deprecation and will be removed in Django 1.9.

Release notes Django 2.2 release notes

The undocumented QuerySetPaginator alias of django.core.paginator.Paginator is deprecated. The FloatRangeField model and form fields in django.contrib.postgres are deprecated in favor of a new name, DecimalRangeField, to match the underlying numrange data type used in the database.

Release notes Django 3.1 release notes

django.utils.timezone.FixedOffset is removed. django.core.paginator.QuerySetPaginator is removed. A model’s Meta.ordering doesn’t affect GROUP BY queries. django.contrib.postgres.fields.FloatRangeField and django.contrib.postgres.forms.FloatRangeField are removed. The FILE_CHARSET setting is removed. django.contrib.staticfiles.storage.CachedStaticFilesStorage is removed. The RemoteUserBackend.configure_user() method requires request as the first positional argument.

Release notes Django 3.2.3 release notes

Prepared for mysqlclient > 2.0.3 support (#32732). Fixed a regression in Django 3.2 that caused the incorrect filtering of querysets combined with the | operator (#32717).

Release notes Django 6.0 release notes

BaseDatabaseCreation.create_test_db(serialize) is deprecated. Use serialize_db_to_string() instead. The PostgreSQL StringAgg class is deprecated in favor of the generally available StringAgg class. Passing a string to the delimiter argument of the (deprecated) PostgreSQL StringAgg class is deprecated.

Release notes Django version 0.96 release notes

You can now use any callable as the callback in URLconfs (previously, only strings that referred to callables were allowed). This allows a much more natural use of URLconfs.

Release notes Django 1.1 release notes

COUNT(), MAX(), MIN(), etc.) from within Django’s ORM. You can choose to either return the results of the aggregate directly, or else annotate the objects in a QuerySet with the results of the aggregate query.

Release notes Django 1.1 release notes

If you know you don’t need those particular fields, you can now tell Django not to retrieve them from the database. You’ll do this with the new queryset methods defer() and only().

Release notes Django 1.10.1 release notes

Made QuerySet.bulk_create() properly initialize model instances on backends, such as PostgreSQL, that support returning the IDs of the created records so that many-to-many relationships can be used on the new objects (#27026). Fixed crash of django.views.static.serve() with show_indexes enabled (#26973).

Release notes Django 1.10.3 release notes

Fixed QuerySet.bulk_create() on PostgreSQL when the number of objects is a multiple plus one of batch_size (#27385). Prevented i18n_patterns() from using too much of the URL as the language to fix a use case for prefix_default_language=False (#27063).

Release notes Django 1.10.4 release notes

Fixed a QuerySet.update() crash on SQLite when updating a DateTimeField with an F() expression and a timedelta (#27544). Prevented LocaleMiddleware from redirecting on URLs that should return 404 when using prefix_default_language=False (#27402).

Release notes Django 1.11.1 release notes

Fixed QuerySet.filter() crash when it references the name of a OneToOneField primary key (#28047). Fixed empty POST data table appearing instead of “No POST data” in HTML debug page (#28079). Restored BoundFields without any choices evaluating to True (#28058).

Release notes Django 1.11.13 release notes

Fixed a regression in Django 1.11.12 where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns (#29286).