Django

==========================

*March 6, 2025*

Django 5.1.7 fixes a security issue with severity "moderate" and several bugs
in 5.1.6.

CVE-2025-26699: Potential denial-of-service vulnerability in ``django.utils.text.wrap()``
=========================================================================================

The ``wrap()`` and :tfilter:`wordwrap` template filter were subject to a
potential denial-of-service attack when used with very long strings.

Bugfixes
========

* Fixed a bug in Django 5.1 where the ``{% querystring %}`` template tag
returned an empty string rather than ``"?"`` when all parameters had been
removed from the query string (:ticket:`36182`).

* Fixed a bug in Django 5.1 where ``FileSystemStorage``, with
``allow_overwrite`` set to ``True``, did not truncate the overwritten file
content (:ticket:`36191`).

* Fixed a regression in Django 5.1 where the ``count`` and ``exists`` methods
of ``ManyToManyField`` related managers would always return ``0`` and
``False`` when the intermediary model back references used ``to_field``
(:ticket:`36197`).

* Fixed a regression in Django 5.1 where the ``pre_save`` and ``post_save``
signals for ``LogEntry`` were not sent when deleting a single object in the
admin (:ticket:`36217`).


==========================

==========================

*February 5, 2025*

Django 5.1.6 fixes several bugs in 5.1.5.

Bugfixes
========

* Fixed a regression in Django 5.1.5 that caused ``validate_ipv6_address()``
and ``validate_ipv46_address()`` to crash when handling non-string values
(:ticket:`36098`).

* Fixed a regression in Django 5.1 where password fields, despite being set to
``required=False``, were still treated as required in forms derived from
:class:`~django.contrib.auth.forms.BaseUserCreationForm` (:ticket:`36140`).


==========================

==========================

*January 14, 2025*

Django 5.1.5 fixes a security issue with severity "moderate" and one bug in
5.1.4.

CVE-2024-56374: Potential denial-of-service vulnerability in IPv6 validation
============================================================================

Lack of upper bound limit enforcement in strings passed when performing IPv6
validation could lead to a potential denial-of-service attack. The undocumented
and private functions ``clean_ipv6_address`` and ``is_valid_ipv6_address`` were
vulnerable, as was the :class:`django.forms.GenericIPAddressField` form field,
which has now been updated to define a ``max_length`` of 39 characters.

The :class:`django.db.models.GenericIPAddressField` model field was not
affected.

Bugfixes
========

* Fixed a crash when applying migrations with references to the removed
``Meta.index_together`` option (:ticket:`34856`).


==========================

==========================

*December 4, 2024*

Django 5.1.4 fixes one security issue with severity "high", one security issue
with severity "moderate", and several bugs in 5.1.3.

CVE-2024-53907: Denial-of-service possibility in ``strip_tags()``
=================================================================

:func:`~django.utils.html.strip_tags` would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML entities.
The ``strip_tags()`` method is used to implement the corresponding
:tfilter:`striptags` template filter, which was thus also vulnerable.

``strip_tags()`` now has an upper limit of recursive calls to ``HTMLParser``
before raising a :exc:`.SuspiciousOperation` exception.

Remember that absolutely NO guarantee is provided about the results of
``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
``strip_tags()`` call without escaping it first, for example with
:func:`django.utils.html.escape`.

CVE-2024-53908: Potential SQL injection via ``HasKey(lhs, rhs)`` on Oracle
==========================================================================

Direct usage of the ``django.db.models.fields.json.HasKey`` lookup on Oracle
was subject to SQL injection if untrusted data was used as a ``lhs`` value.

Applications that use the :lookup:`has_key <jsonfield.has_key>` lookup through
the ``__`` syntax are unaffected.

Bugfixes
========

* Fixed a crash in ``createsuperuser`` on Python 3.13+ caused by an unhandled
``OSError`` when the username could not be determined (:ticket:`35942`).

* Fixed a regression in Django 5.1 where relational fields were not updated
when calling ``Model.refresh_from_db()`` on instances with deferred fields
(:ticket:`35950`).


==========================

==========================

*November 5, 2024*

Django 5.1.3 fixes several bugs in 5.1.2 and adds compatibility with Python
3.13.

Bugfixes
========

* Fixed a bug in Django 5.1 where
:class:`~django.core.validators.DomainNameValidator` accepted any input value
that contained a valid domain name, rather than only input values that were a
valid domain name (:ticket:`35845`).

* Fixed a regression in Django 5.1 that prevented the use of DB-IP databases
with :class:`~django.contrib.gis.geoip2.GeoIP2` (:ticket:`35841`).

* Fixed a regression in Django 5.1 where non-ASCII fieldset names were not
displayed when rendering admin fieldsets (:ticket:`35876`).


==========================

==========================

*October 8, 2024*

Django 5.1.2 fixes several bugs in 5.1.1. Also, the latest string translations
from Transifex are incorporated.

Bugfixes
========

* Fixed a regression in Django 5.1 that caused a crash when using the
PostgreSQL lookup :lookup:`trigram_similar` on output fields from ``Concat``
(:ticket:`35732`).

* Fixed a regression in Django 5.1 that caused a crash of ``JSONObject()``
when using server-side binding with PostgreSQL 16+ (:ticket:`35734`).

* Fixed a regression in Django 5.1 that made selected items in multi-select
widgets indistinguishable from non-selected items in the admin dark theme
(:ticket:`35809`).


==========================