1
0
mirror of https://github.com/django/django.git synced 2025-08-23 18:29:12 +00:00

5095 Commits

Author SHA1 Message Date
Sarah Boyce
1704c49a9b Fixed #36390 -- Deprecated RemoteUserMiddleware subclasses missing aprocess_request().
Regression in 50f89ae850f6b4e35819fe725a08c7e579bfd099.
Thank you to shamoon for the report and Natalia Bidart for the review.
2025-05-23 10:22:36 +02:00
ontowhee
ddb8529415 Fixed #34262 -- Added support for AnyValue for SQLite, MySQL, Oracle, and Postgresql 16+.
Thanks Simon Charette for the guidance and review. Thanks Tim Schilling for the
documentation review. Thanks David Wobrock for investigation and solution proposals.
2025-05-20 10:01:42 +02:00
Jacob Walls
f603ece016
Fixed typo in docs/releases/6.0.txt. 2025-05-19 15:09:09 -03:00
Colleen Dunlap
802baf5da5 Fixed #36388 -- Made QuerySet.union() return self when called with no arguments.
Regression in 9cb8baa0c4fa2c10789c5c8b65f4465932d4d172.
Thank you to Antoine Humeau for the report and Simon Charette for the review.
2025-05-19 10:34:14 +02:00
Jacob Walls
994dc6d8a1 Fixed #36392 -- Raised ValueError when subquery referencing composite pk selects too many columns. 2025-05-16 08:19:38 +02:00
Pablo Bengoechea
87ab54b488 Fixed #35829 -- Updated admin icons using Font Awesome Free version 6.7.2.
Co-authored-by: Stefan <96178532+stefan6419846@users.noreply.github.com>
2025-05-15 09:09:27 -03:00
savanto
8620a3b0c7 Fixed #36085 -- Added JSONField support for negative array indexing on SQLite. 2025-05-14 13:21:18 +02:00
Adam Johnson
4647e2b866 Refs #36383 -- Extended DeconstructibleSerializer to support non-identifier keyword arguments.
In Python, keyword arguments must normally be valid identifiers (i.e.,
variable names that follow Python's naming rules). However, Python dicts
can have keys that aren't valid identifiers, like "foo-bar" or "123foo".

This commit ensures that keyword arguments that are nt valid
identifiers, are properly handled when deconstructing an object.
2025-05-13 21:42:19 -03:00
Simon Charette
8be0c0d690 Fixed #36373 -- Fixed select_related() crash on foreign object for a composite pk.
Thanks Jacob Walls for the report and Sarah for the in-depth review.
2025-05-12 12:33:07 +01:00
Natalia
42ab99309d Refs #35980 -- Added release note about changes in release artifacts filenames. 2025-05-09 13:29:19 -03:00
Natalia
c86156378d Removed "Expected" from release date for 5.2.1, 5.1.9, and 4.2.21. 2025-05-09 13:29:19 -03:00
Natalia
37f2a77c72 Cleaned up CVE-2025-32873 security archive description. 2025-05-07 11:36:05 -03:00
Natalia
fdabda4e05 Added CVE-2025-32873 to security archive. 2025-05-07 10:59:55 -03:00
Natalia
d8397bf6cd Added stub release notes for 5.2.2. 2025-05-07 10:56:00 -03:00
Sarah Boyce
9f3419b519 Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags().
Thanks to Elias Myllymäki for the report, and Shai Berger and Jake
Howard for the reviews.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-05-06 22:21:42 -03:00
Natalia
0f5dd0dff3 Made cosmetic edits and added upcoming security release to release notes. 2025-04-30 14:55:12 -03:00
Baptiste Mispelon
66f9eb0ff1 Fixed #36357 -- Skipped unique_together in inspectdb output for composite primary keys.
Thanks to Baptiste Mispelon for the report and quick fix, and to Simon
Charette and Jacob Walls for the reviews.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-04-30 11:55:25 -03:00
Simon Charette
07100db6f4 Fixed #36358 -- Corrected introspection of composite primary keys on SQLite.
Previously, any first field of a composite primary key with type
`INTEGER` was incorrectly introspected as an `AutoField` due to SQLite
treating `INTEGER PRIMARY KEY` as an alias for the `ROWID`.

This change ensures that integer fields in composite PKs are not
mistaken for auto-incrementing fields.

Thanks Jacob Walls and Sarah Boyce for the reviews.
2025-04-30 10:51:48 -03:00
Simon Charette
8ef4e0bd42 Fixed #36360 -- Fixed QuerySet.update() crash when referring annotations through values().
The issue was only manifesting itself when also filtering againt a related
model as that forces the usage of a subquery because SQLUpdateCompiler doesn't
support the UPDATE FROM syntax yet.

Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a.

Refs #28900.

Thanks Gav O'Connor for the detailed report.
2025-04-30 10:38:19 +01:00
Bruno Alla
bc21bc4282 Fixed #18296 -- Created missing custom target directory for startproject and startapp. 2025-04-27 14:41:27 +01:00
nessita
0596263c31
Fixed #36309 -- Made email alternatives and attachments pickleable.
Regression in aba0e541caaa086f183197eaaca0ac20a730bbe4 and in
d5bebc1c26d4c0ec9eaa057aefc5b38649c0ba3b.

Thanks Florent Messa for the report, and Jake Howard and Claude
Paroz for the review.
2025-04-24 10:11:16 -03:00
nessita
c86242d61f
Refs #36341 -- Added release notes for 5.1.9 and 4.2.21 for fix in wordwrap template filter.
Revision 1e9db35836d42a3c72f3d1015c2f302eb6fee046 fixed a regression in
55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b, which also needs to be
backported to the stable branches in extended support (5.1.x and 4.2.x).
2025-04-23 17:26:48 -03:00
Matti Pohjanvirta
1e9db35836 Fixed #36341 -- Preserved whitespaces in wordwrap template filter.
Regression in 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b.

This work improves the django.utils.text.wrap() function to ensure that
empty lines and lines with whitespace only are kept instead of being
dropped.

Thanks Matti Pohjanvirta for the report and fix.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-04-23 16:14:03 -03:00
antoliny0919
1bc805e23b Fixed #36331 -- Reverted "Fixed #36055 -- Prevented overlap of object-tools buttons and page header in the admin."
This reverts commits b1324a680add78de24c763911d0eefa19b9263bc and
02a5cbfe76382da2a0414df17017185be5bd47f9. The former caused a regression
in admin sites that relied on the `object-tools` block being inside the
`content` block.

Thank you to Fabian Braun for the report.
2025-04-22 22:13:38 -03:00
SaJH
1831f7733d Fixed #36326 -- Added CompositePrimaryKey support in QuerySet.raw().
Signed-off-by: SaJH <wogur981208@gmail.com>
2025-04-17 17:23:06 +02:00
Ahmed Nassar
d469db978e Fixed #36314 -- Fixed MinimumLengthValidator error message translation.
Regression in ec7d69035a408b357f1803ca05a7c991cc358cfa.

Thank you Gabriel Trouvé for the report and Claude Paroz for the review.
2025-04-17 12:30:20 +02:00
Ahmed Nassar
be402891cd Fixed #36311 -- Unified spelling of "hardcode" and its variants in docs.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-04-15 14:48:55 -03:00
Simon Charette
21f8be76d4 Fixed #36288 -- Addressed improper handling of duplicates in values_list().
Now that selected aliases are stored in sql.Query.selected: dict[str, Any]
the values_list() method must ensures that duplicate field name references are
assigned unique aliases.

Refs #28900.

Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a.

Thanks Claude for the report.
2025-04-11 09:04:49 +02:00
Simon Charette
71a19a0e47 Fixed #36301 -- Fixed select_for_update(of) crash when using values()/values_list().
Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a which allowed for
annotations to be SELECT'ed before model field references through
values()/values_list() and broke assumptions the select_for_update(of)
table infererence logic had about model fields always being first.

Refs #28900.

Thanks OutOfFocus4 for the report and Sarah for the test.
2025-04-07 22:56:40 +02:00
Sarah Boyce
8ad3e80e88 Fixed #36298 -- Truncated the overwritten file content in file_move_safe().
Regression in 58cd4902a71a3695dd6c21dc957f59c333db364c.

Thanks Baptiste Mispelon for the report.
2025-04-07 16:11:36 +02:00
Simon Charette
12b771a1ec Fixed #36299 -- Prevented field selection on QuerySet.alias() after values().
Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a.

Refs #28900.

Thanks Jeff Iadarola for the report and tests.

Co-Authored-By: OutOfFocus4 <jeff.iadarola@gmail.com>
2025-04-05 20:43:50 +02:00
Simon Charette
764af7a3d6 Fixed #36289 -- Fixed bulk_create() crash with nullable geometry fields on PostGIS.
Swapped to an allow list instead of a deny list for field types to
determine if the UNNEST optimization can be enabled to avoid further
surprises with other types that would require further specialization to
adapt.

Regression in a16eedcf9c69d8a11d94cac1811018c5b996d491.

Thanks Joshua Goodwin for the report and Sarah Boyce for the test.
2025-04-04 21:33:04 +02:00
Simon Charette
f7f38f3a0b Fixed #36290 -- Made TupleIn() lookup discard tuples containing None.
Just like the In() lookup discards of None members TupleIn() should
discard tuples containing any None as NULL != NULL in SQL and the
framework expects such queries to be elided under some circumstances.

Refs #31667, #36116.

Thanks Basptise Mispelon for bisecting the regression to 626d77e.
2025-04-03 20:40:43 +02:00
Simon Charette
543e17c440 Fixed #36292 -- Fixed crash when aggregating over a group mixing transforms and references.
Regression in 65ad4ade74dc9208b9d686a451cd6045df0c9c3a.

Refs #28900

Thanks Patrick Altman for the report.
2025-04-03 17:51:26 +02:00
Sarah Boyce
c7ff347c64 Added stub release notes for 5.2.1. 2025-04-02 15:24:48 +02:00
Sarah Boyce
345ba995c0 Finalized release notes for Django 5.2. 2025-04-02 14:43:00 +02:00
Sarah Boyce
b83dab7d8d Added CVE-2025-27556 to security archive. 2025-04-02 13:31:24 +02:00
Sarah Boyce
39e2297210 Fixed CVE-2025-27556 -- Mitigated potential DoS in url_has_allowed_host_and_scheme() on Windows.
Thank you sw0rd1ight for the report.
2025-04-02 10:21:33 +02:00
Song Junho
126417be43 Fixed #36265 -- Added support for serialization of ZoneInfo instances in migrations. 2025-03-31 13:44:54 +02:00
Khudyakov Artem
9aabe7eae3 Fixed #35440 -- Simplified parse_header_parameters by leveraging stdlid's Message.
The `parse_header_parameters` function historically used Python's `cgi`
module  (now deprecated). In 34e2148fc725e7200050f74130d7523e3cd8507a,
the logic was inlined to work around this deprecation ( #33173). Later,
in d4d5427571b4bf3a21c902276c2a00215c2a37cc, the header parsing logic
was further cleaned up to align with `multipartparser.py` (#33697).

This change takes it a step further by replacing the copied `cgi` logic with
Python's `email.message.Message` API for a more robust and maintainable header
parsing implementation.

Thanks to Raphael Gaschignard for testing, and to Adam Johnson and Shai
Berger for reviews.

Co-authored-by: Ben Cail <bcail@crossway.org>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-03-27 08:57:03 -03:00
Sarah Boyce
c75fbe8430 Added stub release notes and release date for 5.1.8 and 5.0.14. 2025-03-26 09:00:27 +01:00
Giannis Terzopoulos
a39c28706a Fixed #35529 -- Added support for positional arguments in querystring template tag.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2025-03-25 12:23:41 -03:00
wookkl
334677ad57 Fixed #35452 -- Deprecated orphans being more than or equal to page_size in pagination. 2025-03-25 12:04:13 +01:00
Natalia
0b4f2d8d39 Fixed #36268 -- Added leading ? in every querystring template tag result.
Thanks Sarah Boyce for the report.
2025-03-24 11:53:42 -03:00
Johanan Oppong Amoateng
5adadf6e8c Fixed #36266 -- Renamed HIDE_PRODUCTION_WARNING environment variable to DJANGO_RUNSERVER_HIDE_WARNING. 2025-03-21 10:19:36 +01:00
Mike Edmunds
e295033144 Fixed #36138 -- Changed ADMINS and MANAGERS settings to lists of strings.
Previously, the ADMINS and MANAGERS settings were lists of (name, address)
tuples (where the name had been unused). Deprecated use of tuples.

Updated settings value sanity checks, and changed from ValueError to
ImproperlyConfigured.
2025-03-21 10:17:57 +01:00
Ahmed Nassar
ec7044c706 Fixed #36000 -- Deprecated HTTP as the default protocol in urlize and urlizetrunc. 2025-03-19 14:28:42 +01:00
Adam Johnson
27b68bcadf Fixed #36234 -- Restored single_object argument to LogEntry.objects.log_actions().
Thank you Adam Johnson for the report and fix. Thank you Sarah Boyce for
your spot on analysis.

Regression in c09bceef68e5abb79accedd12dade16aa6577a09, which is
partially reverted in this branch.

Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2025-03-12 16:25:28 -03:00
Adam Johnson
c70dbcf835 Refs #25582 -- Doc'd query and fragment arguments for reverse_lazy(). 2025-03-12 16:41:44 +01:00
Hisham Mahmood
955b7c6ba1 Removed duplicate entries in docs/releases/5.2.txt. 2025-03-12 11:04:21 +01:00