Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection via QuerySet.order_by and FilteredRelation. Full description Django 6.0 (patch) Django 5.2 (patch) Django 4.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection via _connector keyword argument in QuerySet and Q objects. Full description Django 6.0 (patch) Django 5.2 (patch) Django 5.1 (patch) Django 4.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB. Full description Django 6.0 (patch) Django 5.2 (patch) Django 5.1 (patch) Django 4.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection in QuerySet.values() and values_list(). Full description Django 5.0 (patch) Django 4.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection in QuerySet.annotate(), aggregate(), and extra(). Full description Django 4.0 (patch) Django 3.2 (patch) Django 2.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection via QuerySet.explain(**options) on PostgreSQL. Full description Django 4.0 (patch) Django 3.2 (patch) Django 2.2 (patch)

Release notes Archive of security issues Issues under Django’s security process

Potential SQL injection via unsanitized QuerySet.order_by() input. Full description

Release notes Django 1.6 release notes Backwards incompatible changes in 1.6

Django 1.6 introduces time zone support for day, month, and week_day lookups when USE_TZ is True. These lookups were previously performed in UTC regardless of the current time zone. This requires time zone definitions in the database.

Release notes Django 1.8 release notes Features deprecated in 1.8

ModelChoiceField and ModelMultipleChoiceField took an undocumented, untested option cache_choices. This cached querysets between multiple renderings of the same Form object. This option is subject to an accelerated deprecation and will be removed in Django 1.9.

Release notes Django 2.2 release notes Features deprecated in 2.2

The undocumented QuerySetPaginator alias of django.core.paginator.Paginator is deprecated. The FloatRangeField model and form fields in django.contrib.postgres are deprecated in favor of a new name, DecimalRangeField, to match the underlying numrange data type used in the database.

Release notes Django 3.1 release notes

django.utils.timezone.FixedOffset is removed. django.core.paginator.QuerySetPaginator is removed. A model’s Meta.ordering doesn’t affect GROUP BY queries. django.contrib.postgres.fields.FloatRangeField and django.contrib.postgres.forms.FloatRangeField are removed. The FILE_CHARSET setting is removed. django.contrib.staticfiles.storage.CachedStaticFilesStorage is removed. The RemoteUserBackend.configure_user() method requires request as the first positional argument.

Release notes Django 3.2.3 release notes

Prepared for mysqlclient > 2.0.3 support (#32732). Fixed a regression in Django 3.2 that caused the incorrect filtering of querysets combined with the | operator (#32717).

Release notes Django 6.0 release notes Features deprecated in 6.0

BaseDatabaseCreation.create_test_db(serialize) is deprecated. Use serialize_db_to_string() instead. The PostgreSQL StringAgg class is deprecated in favor of the generally available StringAgg class. Passing a string to the delimiter argument of the (deprecated) PostgreSQL StringAgg class is deprecated.

Release notes Django version 0.96 release notes What’s new in 0.96?

You can now use any callable as the callback in URLconfs (previously, only strings that referred to callables were allowed). This allows a much more natural use of URLconfs.

Release notes Django 1.1 release notes What’s new in Django 1.1ORM improvements

COUNT(), MAX(), MIN(), etc.) from within Django’s ORM. You can choose to either return the results of the aggregate directly, or else annotate the objects in a QuerySet with the results of the aggregate query.

Release notes Django 1.1 release notes What’s new in Django 1.1Model improvements

If you know you don’t need those particular fields, you can now tell Django not to retrieve them from the database. You’ll do this with the new queryset methods defer() and only().

Release notes Django 1.10.1 release notes

Made QuerySet.bulk_create() properly initialize model instances on backends, such as PostgreSQL, that support returning the IDs of the created records so that many-to-many relationships can be used on the new objects (#27026). Fixed crash of django.views.static.serve() with show_indexes enabled (#26973).

Release notes Django 1.10.3 release notes

Fixed QuerySet.bulk_create() on PostgreSQL when the number of objects is a multiple plus one of batch_size (#27385). Prevented i18n_patterns() from using too much of the URL as the language to fix a use case for prefix_default_language=False (#27063).

Release notes Django 1.10.4 release notes

Fixed a QuerySet.update() crash on SQLite when updating a DateTimeField with an F() expression and a timedelta (#27544). Prevented LocaleMiddleware from redirecting on URLs that should return 404 when using prefix_default_language=False (#27402).

Release notes Django 1.11.1 release notes

Fixed QuerySet.filter() crash when it references the name of a OneToOneField primary key (#28047). Fixed empty POST data table appearing instead of “No POST data” in HTML debug page (#28079). Restored BoundFields without any choices evaluating to True (#28058).