Django ships five security fixes, including formsets

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

October also landed Address objects in email settings, Oracle UUID and JSONField fixes, and HTTP QUERY method support.

210 commits 150 PRs merged 30 briefings covered

all django reviews →

← previous month django wire →

Fixed #37167 -- Allowed Address objects as email addresses. django/django

by VIZZARD-X

email.headerregistry.Address is now accepted wherever Django takes a recipient string, so ADMINS and MANAGERS no longer reject it. Address was already the safe way to build an address with a display name from variable parts, and it was unusable in exactly those settings.

Fixed #37322 -- Avoided transforms on spatial fields with srid=None. django/django

by Yassin Bahri

After spatial queries stopped interpolating the SRID into the SQL template, a field with srid=None reached ST_Transform() on PostGIS and SpatiaLite and returned NULL. Those transforms are now skipped.

Fixed #37361 -- Fixed permission renames for chained RenameModel operations. django/django

by Md. Saikat Islam

rename_permissions_after_model_rename() queried the database for permissions at each rename step before saving the planned changes, so chains like A to B to C left intermediate permission names behind. The rename now works from the planned state.

Fixed #37376 -- Made UUID4() persist data in lowercase on Oracle. django/django

by Jacob Walls

Oracle implicitly ran RAWTOHEX() when storing UUID4() into VARCHAR2(32), so values came back uppercased while every other part of UUIDField() prepared lowercase, and lookups failed. Oracle UUID data now persists lowercase.

Fixed #37291 -- Prevented tuple lookups from hanging on F() expressions. django/django

by Yassin Bahri

The hang is prevented now; the release notes say the underlying unsafety with iterating F() expressions "will be handled later (#37384), to allow time to consider backward compatibility". A ValueError from the underlying query is also deferred.

Refs #37140 -- Limited NULL handling warning for __in lookups to subqueries. django/django

by SnippyCodes

The NULL-handling documentation warning for __in lookups now applies only to subqueries, a follow-up that scopes where the warning fires.

Fixed #37212 -- Improved djangodocs Sphinx extension portability. django/django

by Mike Edmunds

DjangoHTMLTranslator lost its table and parameterlist customizations, which existed to avoid HTML4-era output from Docutils, and the docs builds also moved to sphinx-build and gained EPUBCheck and pydata-sphinx-theme this month. Nothing here changes your code, but anyone maintaining the docs toolchain should expect the extension to behave differently.

$ ls django/month/ # the briefings behind this review

Thu Oct 1 Tuple lookups stop hanging on F() expressions, admindocs breadcrumb regression fixed Fri Oct 2 Address objects gain first-class support in email settings Sat Oct 3 Chained model renames fix permission renames; Oracle UUID4 lowercased Sun Oct 4 A geo test's decimal comparison and fresh ubuntu-latest benchmarks Mon Oct 5 django-asv adds ubuntu-latest benchmark results Tue Oct 6 Spatial SRID validation, JSONField __in fixes land in Django Wed Oct 7 Django ships five security fixes, including formsets and spatial lookups Thu Oct 8 JSONField integer keys stop crashing Postgres and Oracle Fri Oct 9 Django softens PR auto-close, fixes JSONField __in crash on SQLite Sat Oct 10 Dynamic {% now %} formatting, async support in @non_atomic_requests Sun Oct 11 asgiref drops Python 3.10 and its custom timeout, Django patches oracledb 26 Mon Oct 12 asgiref drops its custom timeout for asyncio.timeout, Python 3.11 now the floor Tue Oct 13 UnorderedObjectListWarning points at user code again Wed Oct 14 Faster M2M related managers, verbatim tokenization fixed Thu Oct 15 Table-valued expressions clear the Steering Council, asgiref Local stops paying for context managers Fri Oct 16 Release checklists learn calendar versioning, docs annotations untangled Sat Oct 17 django-asv moves its benchmarks to Python 3.14 and 3.15 Mon Oct 19 django-asv adds ubuntu-latest benchmark results Tue Oct 20 CVE records can now scope regressions per branch, docs builds move to sphinx-build Wed Oct 21 CSP nonces for streaming responses, frozendict preserved in migrations Thu Oct 22 Windows CI gets gettext, djangosnippets drops a dead dependency Fri Oct 23 ThreadSensitiveContext gains nesting, Q.check() escapes logged DB errors Sat Oct 24 cached_property deprecation lands, asgiref 3.13.0 ships Sun Oct 25 Ubuntu-latest results land in the Django benchmark suite Mon Oct 26 GeoDjango CI version labels corrected, ubuntu-latest results land in django-asv Tue Oct 27 Django adds HTTP QUERY support, fixes a template lexer regression Wed Oct 28 Join promotion learns XOR, docs build gains EPUBCheck Thu Oct 29 Multiline template tags and substring warning filters land Fri Oct 30 Windows docs checks get a real exit code, and one file list to rule them all Sat Oct 31 Django's docs move to pydata-sphinx-theme, with deploys pre-staged

all django reviews →

← previous month django wire →