$ the-wire · showcase
DJANGO FIXES UNIQUE VALIDATION REGRESSION AND SCHEMA BLOAT
By RepoJournal · Filed · About Django · Composed from the cited sources · methodology
3 people shipped this
Django patches a critical validation bug that embeds unresolved database defaults into uniqueness checks, forcing sequential scans on every insert.
The fix addresses a regression where `Model._perform_unique_checks()` and `UniqueConstraint.validate()` embedded unresolved `db_default` expressions into uniqueness queries during `full_clean()` [1]. The database generates the actual value on INSERT and cannot know it beforehand, so the query tested a different value from what gets stored; with volatile defaults like `uuidv7()` it also forced sequential scans on every insert [1]. A second critical fix eliminates unnecessary schema changes when altering only Python-level `on_delete` options like `CASCADE` to `PROTECT` [2]. The regression came from removing "on_delete" from `Field.non_db_attrs` to support new database-level options, which inadvertently forced DDL whenever a Python-only delete option changed [2]. Separately, form media rendering now correctly handles html-safe strings passed via `mark_safe()`, restoring the documented pattern for including complete asset tags without percent-encoding [3]. One security-related test refactor tightens GIS lookup coverage [4]. These fixes span 7 commits and 7 PRs across the core repository.
Action items
- → Update to latest Django if you use db_default with volatile expressions or run frequent unique validation checks django/django [immediate]
- → Review any AlterField operations changing on_delete options to confirm no unnecessary migrations are queued django/django [plan]
- → Test form media rendering if you use mark_safe() for asset tags django/django [monitor]
References
- [1] Fixed #37248 -- Skipped unique validation on fields with unresolved dynamic db_default. ↗ django/django
- [2] Fixed #37260 -- Avoided DDL when altering only Python-level on_delete options. ↗ django/django
- [3] Fixed #37262 -- Restored rendering of html-safe strings in form media. ↗ django/django
- [4] Refs CVE-2026-15307 -- Used a more common lookup in raster lookup tests. ↗ django/django
