Release notes Django 5.0.8 release notes
QuerySet.values() and values_list() methods on models with a JSONField were subject to SQL injection in column aliases, via a crafted JSON object key as a passed *arg.
1413 sections across all versions Narrow to Django 6.0 (current) →
Release notes Django 5.1.13 release notes
QuerySet.annotate(), alias(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (follow up to CVE 2022-28346).
Release notes Django 5.2.11 release notes
QuerySet.order_by() was subject to SQL injection in column aliases containing periods when the same alias was, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. This issue has severity “high” according to the Django security policy.
Release notes Django 5.2.7 release notes
QuerySet.annotate(), alias(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods (follow up to CVE 2022-28346).
Release notes Django 6.0.2 release notes
QuerySet.order_by() was subject to SQL injection in column aliases containing periods when the same alias was, using a suitably crafted dictionary, with dictionary expansion, used in FilteredRelation. This issue has severity “high” according to the Django security policy.
Release notes Django 1.6 release notes
Methods that return a QuerySet such as Manager.get_query_set or ModelAdmin.queryset have been renamed to get_queryset.
Release notes Django 3.1.13 release notes
Unsanitized user input passed to QuerySet.order_by() could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted.
Release notes Django 3.2.5 release notes
Unsanitized user input passed to QuerySet.order_by() could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted.
Release notes Django 5.0 release notes
QuerySet.update_or_create() now supports the parameter create_defaults. As a consequence, any models that have a field named create_defaults that are used with an update_or_create() should specify the field in the lookup with create_defaults__exact.
Release notes Django 1.6 release notes Features deprecated in 1.6
Methods that return a QuerySet such as Manager.get_query_set or ModelAdmin.queryset have been renamed to get_queryset.
Release notes Django 3.1.13 release notes
Unsanitized user input passed to QuerySet.order_by() could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted.
Release notes Django 3.2.5 release notes
Unsanitized user input passed to QuerySet.order_by() could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted.
Release notes Django 5.0 release notes Backwards incompatible changes in 5.0
QuerySet.update_or_create() now supports the parameter create_defaults. As a consequence, any models that have a field named create_defaults that are used with an update_or_create() should specify the field in the lookup with create_defaults__exact.
Release notes Django 1.9 release notes
QuerySet.bulk_create() now works on proxy models. Database configuration gained a TIME_ZONE option for interacting with databases that store datetimes in local time and don’t support time zones when USE_TZ is True.
Release notes Django 4.2 release notes
QuerySet now extensively supports filtering against UUID functions with the exception of disjunctive filter lookups against window functions when performing aggregation. prefetch_related() now supports Prefetch objects with sliced querysets. Registering lookups on Field instances is now supported.
Release notes Django 5.1 release notes
QuerySet.explain() now supports the generic_plan option on PostgreSQL 16+. RowRange now accepts positive integers for the start argument and negative integers for the end argument.
Release notes Django 6.1 release notes
QuerySet.in_bulk() now supports chaining after QuerySet.values() and QuerySet.values_list(). The new JSONNull expression provides an explicit way to represent the JSON scalar null.
Release notes Django 1.9 release notes What’s new in Django 1.9Minor features
QuerySet.bulk_create() now works on proxy models. Database configuration gained a TIME_ZONE option for interacting with databases that store datetimes in local time and don’t support time zones when USE_TZ is True.
Release notes Django 4.2 release notes What’s new in Django 4.2Minor features
QuerySet now extensively supports filtering against Window functions with the exception of disjunctive filter lookups against window functions when performing aggregation. prefetch_related() now supports Prefetch objects with sliced querysets. Registering lookups on Field instances is now supported.
Release notes Django 5.1 release notes What’s new in Django 5.1Minor features
QuerySet.explain() now supports the generic_plan option on PostgreSQL 16+. RowRange now accepts positive integers for the start argument and negative integers for the end argument.