docs/conf.py | 5 4 + 1 - 0 !
1 file changed, 4 insertions(+), 1 deletion(-)

 disable creation of _sources directory by sphinx

 We do this to save some space as the sources of the documentation
 are not really useful in a binary package.
 .
 This is a Debian specific patch.

django/contrib/gis/geoip2/base.py | 9 6 + 3 - 0 !
1 file changed, 6 insertions(+), 3 deletions(-)

 use debian geoip database path as default

 Default to Debian standard path for GeoIP directory and for GeoIP city
 file. Avoids the need to declare them in each project.
 .
 This is a Debian specific patch.
Bug-Debian: http://bugs.debian.org/645094

docs/conf.py | 6 3 + 3 - 0 !
1 file changed, 3 insertions(+), 3 deletions(-)

 use locally installed documentation sources

django/conf/project_template/manage.py-tpl | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 set the default shebang to new projects to use python 3.

django/bin/django-admin.py | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 use #!/usr/bin/env python3 shebang for django-admin.py.

django/db/models/lookups.py | 9 9 + 0 - 0 !
tests/aggregation_regress/tests.py | 8 8 + 0 - 0 !
2 files changed, 17 insertions(+)

 fixed #32690 -- fixed __in lookup crash when combining with filtered
 aggregates.

Having lookups group by subquery right-hand-sides is likely unnecessary
in the first place but relatively large amount of work would be needed
to achieve that such as making Lookup instances proper resolvable
expressions.

Regression in 35431298226165986ad07e91f9d3aca721ff38ec.

Thanks James A. Munsch for the report.

(cherry picked from commit 136ff592ad8aa8b7fa1e61435e5501cc98ce8573)

django/db/models/query.py | 8 4 + 4 - 0 !
django/db/models/sql/compiler.py | 2 1 + 1 - 0 !
django/db/models/sql/query.py | 29 16 + 13 - 0 !
3 files changed, 21 insertions(+), 18 deletions(-)

 refs #32786 -- made query.clear_ordering() not to cause side effects
 by default.

(cherry picked from commit 053141d31fe5aef1c255a1be183383860e0ccce9)

django/db/models/fields/related_lookups.py | 58 32 + 26 - 0 !
django/db/models/lookups.py | 30 13 + 17 - 0 !
2 files changed, 45 insertions(+), 43 deletions(-)

 refs #32690 -- altered lookups query rhs alterations during
 initialization.

Having it happen at the lookup creation time ensures entry points
called before the compilation phase (e.g. get_group_by_cols) don't have
to duplicate the logic in charge of altering Query instances used as
rhs.

It also has the nice effect of reducing the amount of time the
alteration logic to once as opposed to multiple times if the queryset
is compiled more than once.

(cherry picked from commit e3bde71676a704e27d62e5f96dd967f7305db7f2)

django/db/models/expressions.py | 9 5 + 4 - 0 !
django/db/models/sql/query.py | 8 8 + 0 - 0 !
tests/aggregation/tests.py | 35 31 + 4 - 0 !
3 files changed, 44 insertions(+), 8 deletions(-)

 fixed #33282 -- fixed a crash when or'ing subquery and aggregation
 lookups.

As a QuerySet resolves to Query the outer column references grouping logic
should be defined on the latter and proxied from Subquery for the cases where
get_group_by_cols is called on unresolved expressions.

Thanks Antonio Terceiro for the report and initial patch.

(cherry picked from commit e5a92d400acb4ca6a8e1375d1ab8121f2c7220be)

django/contrib/sites/shortcuts.py | 7 4 + 3 - 0 !
1 file changed, 4 insertions(+), 3 deletions(-)

 moved requestsite import to the toplevel.

Via https://github.com/django/django/commit/78163d1ac4407d59bfc5fdf1f84f2dbbb2ed3443

django/utils/version.py | 1 1 + 0 - 0 !
tests/test_runner/test_debug_sql.py | 14 9 + 5 - 0 !
tests/test_runner/test_parallel.py | 8 6 + 2 - 0 !
tests/test_utils/tests.py | 9 7 + 2 - 0 !
4 files changed, 23 insertions(+), 9 deletions(-)

 fix test_runner/test_utils tests on python 3.11+.

django/core/validators.py | 13 7 + 6 - 0 !
1 file changed, 7 insertions(+), 6 deletions(-)

 fixed urlvalidator crash in some edge cases

django/contrib/auth/hashers.py | 10 8 + 2 - 0 !
tests/auth_tests/test_hashers.py | 32 32 + 0 - 0 !
2 files changed, 40 insertions(+), 2 deletions(-)

 [patch] [4.2.x] fixed cve-2024-39329 -- standarized timing of
  verify_password() when checking unusuable passwords.

Refs #20760.

Thanks Michael Manfre for the fix and to Adam Johnson for the review.

django/core/files/storage.py | 11 11 + 0 - 0 !
django/core/files/utils.py | 7 3 + 4 - 0 !
tests/file_storage/test_base.py | 70 70 + 0 - 0 !
tests/file_storage/tests.py | 6 0 + 6 - 0 !
4 files changed, 84 insertions(+), 10 deletions(-)

 [patch] [4.2.x] fixed cve-2024-39330 -- added extra file name
  validation in Storage's save method.

Thanks to Josh Schneier for the report, and to Carlton Gibson and Sarah
Boyce for the reviews.

django/utils/translation/trans_real.py | 23 18 + 5 - 0 !
docs/ref/utils.txt | 10 10 + 0 - 0 !
tests/i18n/tests.py | 11 11 + 0 - 0 !
3 files changed, 39 insertions(+), 5 deletions(-)

 [patch] [4.2.x] fixed cve-2024-39614 -- mitigated potential dos in
  get_supported_language_variant().

Language codes are now parsed with a maximum length limit of 500 chars.

Thanks to MProgrammer for the report.

django/template/defaultfilters.py | 13 13 + 0 - 0 !
tests/template_tests/filter_tests/test_floatformat.py | 17 17 + 0 - 0 !
2 files changed, 30 insertions(+)

 [patch] [4.2.x] fixed cve-2024-41989 -- prevented excessive memory
  consumption in floatformat. MIME-Version: 1.0 Content-Type: text/plain;
 charset=UTF-8 Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

Thanks Elias Myllymki for the report.

Co-authored-by: Shai Berger <shai@platonix.com>

django/contrib/admin/widgets.py | 2 1 + 1 - 0 !
django/utils/html.py | 10 8 + 2 - 0 !
tests/admin_widgets/tests.py | 7 6 + 1 - 0 !
tests/utils_tests/test_html.py | 13 13 + 0 - 0 !
4 files changed, 28 insertions(+), 4 deletions(-)

 [patch] [4.2.x] fixed cve-2024-41991 -- prevented potential redos in
  django.utils.html.urlize() and AdminURLFieldWidget.

Thanks Seokchan Yoon for the report.

Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>

django/db/models/sql/query.py | 2 2 + 0 - 0 !
tests/expressions/models.py | 7 7 + 0 - 0 !
tests/expressions/test_queryset_values.py | 17 15 + 2 - 0 !
3 files changed, 24 insertions(+), 2 deletions(-)

 [patch] [4.2.x] fixed cve-2024-42005 -- mitigated queryset.values()
  SQL injection attacks against JSON fields.

Thanks Eyal (eyalgabay) for the report.

django/contrib/auth/forms.py | 9 8 + 1 - 0 !
docs/topics/auth/default.txt | 4 3 + 1 - 0 !
tests/auth_tests/test_forms.py | 21 21 + 0 - 0 !
tests/mail/custombackend.py | 5 5 + 0 - 0 !
4 files changed, 37 insertions(+), 2 deletions(-)

 [patch] [4.2.x] fixed cve-2024-45231 -- avoided server error on
  password reset when email sending fails.

On successful submission of a password reset request, an email is sent
to the accounts known to the system. If sending this email fails (due to
email backend misconfiguration, service provider outage, network issues,
etc.), an attacker might exploit this by detecting which password reset
requests succeed and which ones generate a 500 error response.

Thanks to Thibaut Spriet for the report, and to Mariusz Felisiak, Adam
Johnson, and Sarah Boyce for the reviews.

django/utils/html.py | 10 8 + 2 - 0 !
tests/utils_tests/test_html.py | 7 7 + 0 - 0 !
2 files changed, 15 insertions(+), 2 deletions(-)

 [patch] [4.2.x] fixed cve-2024-53907 -- mitigated potential dos in
  strip_tags().

Thanks to jiangniao for the report, and Shai Berger and Natalia Bidart
for the reviews.

django/db/models/fields/__init__.py | 6 3 + 3 - 0 !
django/forms/fields.py | 7 5 + 2 - 0 !
django/utils/ipv6.py | 16 13 + 3 - 0 !
docs/ref/forms/fields.txt | 4 2 + 2 - 0 !
tests/forms_tests/field_tests/test_genericipaddressfield.py | 32 31 + 1 - 0 !
tests/utils_tests/test_ipv6.py | 40 37 + 3 - 0 !
6 files changed, 91 insertions(+), 14 deletions(-)

 [patch] [4.2.x] fixed cve-2024-56374 -- mitigated potential dos in
  IPv6 validation.

Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz
Felisiak for the reviews.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

django/db/backends/postgresql/compiler.py | 24 24 + 0 - 0 !
django/db/backends/postgresql/operations.py | 1 1 + 0 - 0 !
tests/annotations/tests.py | 13 13 + 0 - 0 !
3 files changed, 38 insertions(+)

 [patch] [4.2.x] fixed cve-2025-13372 -- protected filteredrelation
  against SQL injection in column aliases on PostgreSQL.

Follow-up to CVE-2025-57833.

Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak
for the reviews.

Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.

django/utils/text.py | 27 10 + 17 - 0 !
tests/template_tests/filter_tests/test_wordwrap.py | 11 11 + 0 - 0 !
2 files changed, 21 insertions(+), 17 deletions(-)

 [patch] [4.2.x] fixed cve-2025-26699 -- mitigated potential dos in
  wordwrap template filter.

Thanks sw0rd1ight for the report.

Backport of 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b from main.

django/utils/html.py | 6 6 + 0 - 0 !
tests/utils_tests/test_html.py | 15 14 + 1 - 0 !
2 files changed, 20 insertions(+), 1 deletion(-)

 [patch] [4.2.x] fixed cve-2025-32873 -- mitigated potential dos in
  strip_tags(). MIME-Version: 1.0 Content-Type: text/plain;
 charset=UTF-8 Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

Thanks to Elias Myllymki for the report, and Shai Berger and Jake
Howard for the reviews.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Backport of 9f3419b519799d69f2aba70b9d25abe2e70d03e0 from main.

django/utils/log.py | 7 6 + 1 - 0 !
tests/logging_tests/tests.py | 14 14 + 0 - 0 !
2 files changed, 20 insertions(+), 1 deletion(-)

 [patch] [4.2.x] fixed cve-2025-48432 -- escaped formatting arguments
  in `log_response()`.

Suitably crafted requests containing a CRLF sequence in the request
path may have allowed log injection, potentially corrupting log files,
obscuring other attacks, misleading log post-processing tools, or
forging log entries.

To mitigate this, all positional formatting arguments passed to the
logger are now escaped using "unicode_escape" encoding.

Thanks to Seokchan Yoon (https://ch4n3.kr/) for the report.

Co-authored-by: Carlton Gibson <carlton@noumenal.es>
Co-authored-by: Jake Howard <git@theorangeone.net>

Backport of a07ebec5591e233d8bbb38b7d63f35c5479eef0e from main.

django/views/generic/base.py | 17 9 + 8 - 0 !
tests/generic_views/test_base.py | 28 26 + 2 - 0 !
2 files changed, 35 insertions(+), 10 deletions(-)

 [patch] [4.2.x] refs cve-2025-48432 -- prevented log injection in
  remaining response logging.

Migrated remaining response-related logging to use the `log_response()`
helper to avoid potential log injection, to ensure untrusted values like
request paths are safely escaped.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Backport of 957951755259b412d5113333b32bf85871d29814 from main.

django/db/models/sql/query.py | 1 1 + 0 - 0 !
tests/annotations/tests.py | 23 23 + 0 - 0 !
2 files changed, 24 insertions(+)

 [patch] [4.2.x] fixed cve-2025-57833 -- protected filteredrelation
  against SQL injection in column aliases.

Thanks Eyal Gabay (EyalSec) for the report.

Backport of 51711717098d3f469f795dfa6bc3758b24f69ef7 from main.

django/db/models/sql/query.py | 8 4 + 4 - 0 !
tests/aggregation/tests.py | 4 2 + 2 - 0 !
tests/annotations/tests.py | 21 11 + 10 - 0 !
tests/expressions/test_queryset_values.py | 8 4 + 4 - 0 !
tests/queries/tests.py | 4 2 + 2 - 0 !
5 files changed, 23 insertions(+), 22 deletions(-)

 [patch] [4.2.x] fixed cve-2025-59681 -- protected
  QuerySet.annotate(), alias(), aggregate(),
 and extra() against SQL injection  in column aliases on MySQL/MariaDB.

Thanks sw0rd1ight for the report.

Follow up to 93cae5cb2f9a4ef1514cf1a41f714fef08005200.

Backport of 41b43c74bda19753c757036673ea9db74acf494a from main.

django/utils/archive.py | 6 5 + 1 - 0 !
tests/utils_tests/test_archive.py | 19 19 + 0 - 0 !
2 files changed, 24 insertions(+), 1 deletion(-)

 [patch] [4.2.x] fixed cve-2025-59682 -- fixed potential partial
  directory-traversal via archive.extract().

Thanks stackered for the report.

Follow up to 05413afa8c18cdb978fcdf470e09f7a12b234a23.

Backport of 924a0c092e65fa2d0953fd1855d2dc8786d94de2 from main.

django/db/models/query_utils.py | 4 4 + 0 - 0 !
tests/queries/test_q.py | 5 5 + 0 - 0 !
2 files changed, 9 insertions(+)

 [patch] [4.2.x] fixed cve-2025-64459 -- prevented sql injections in
  Q/QuerySet via the _connector kwarg.

Thanks cyberstan for the report, Sarah Boyce, Adam Johnson, Simon
Charette, and Jake Howard for the reviews.

Backport of c880530ddd4fabd5939bab0e148bebe36699432a from main.

django/core/serializers/xml_serializer.py | 38 32 + 6 - 0 !
1 file changed, 32 insertions(+), 6 deletions(-)

 [patch] [4.2.x] fixed cve-2025-64460 -- corrected quadratic inner
  text accumulation in XML serializer.

Previously, `getInnerText()` recursively used `list.extend()` on strings,
which added each character from child nodes as a separate list element.
On deeply nested XML content, this caused the overall deserialization
work to grow quadratically with input size, potentially allowing
disproportionate CPU consumption for crafted XML.

The fix separates collection of inner texts from joining them, so that
each subtree is joined only once, reducing the complexity to linear in
the size of the input. These changes also include a mitigation for a
xml.dom.minidom performance issue.

Thanks Seokchan Yoon (https://ch4n3.kr/) for report.

Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Backport of 50efb718b31333051bc2dcb06911b8fa1358c98c from main.

django/contrib/auth/handlers/modwsgi.py | 37 30 + 7 - 0 !
tests/auth_tests/test_handlers.py | 26 26 + 0 - 0 !
2 files changed, 56 insertions(+), 7 deletions(-)

 [patch] [4.2.x] fixed cve-2025-13473 -- standardized timing of
  check_password() in mod_wsgi auth handler.

Refs CVE-2024-39329, #20760.

Thanks Stackered for the report, and Jacob Walls and Markus Holtermann
for the reviews.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Backport of 3eb814e02a4c336866d4189fa0c24fd1875863ed from main.

django/core/handlers/asgi.py | 7 4 + 3 - 0 !
tests/asgi/tests.py | 27 27 + 0 - 0 !
2 files changed, 31 insertions(+), 3 deletions(-)

 [patch] [4.2.x] fixed cve-2025-14550 -- optimized repeated header
  parsing in ASGI requests.

Thanks Jiyong Yang for the report, and Natalia Bidart, Jacob Walls, and
Shai Berger for reviews.

Backport of eb22e1d6d643360e952609ef562c139a100ea4eb from main.

django/contrib/gis/db/backends/postgis/operations.py | 6 6 + 0 - 0 !
tests/gis_tests/rasterapp/test_rasterfield.py | 47 46 + 1 - 0 !
2 files changed, 52 insertions(+), 1 deletion(-)

 [patch] [4.2.x] fixed cve-2026-1207 -- prevented sql injections in
  RasterField lookups via band index.

Thanks Tarek Nakkouch for the report, and Simon Charette for the initial
triage and review.

Backport of 81aa5292967cd09319c45fe2c1a525ce7b6684d8 from main.

django/utils/text.py | 14 5 + 9 - 0 !
tests/utils_tests/test_text.py | 10 10 + 0 - 0 !
2 files changed, 15 insertions(+), 9 deletions(-)

 [patch] [4.2.x] fixed cve-2026-1285 -- mitigated potential dos in
  django.utils.text.Truncator for HTML input.

The `TruncateHTMLParser` used `deque.remove()` to remove tags from the
stack when processing end tags. With crafted input containing many
unmatched end tags, this caused repeated full scans of the tag stack,
leading to quadratic time complexity.

The fix uses LIFO semantics, only removing a tag from the stack when it
matches the most recently opened tag. This avoids linear scans for
unmatched end tags and reduces complexity to linear time.

Refs #30686 and 6ee37ada3241ed263d8d1c2901b030d964cbd161.

Thanks Seokchan Yoon for the report.

Backport of a33540b3e20b5d759aa8b2e4b9ca0e8edd285344 from main.

django/db/models/sql/query.py | 10 6 + 4 - 0 !
tests/aggregation/tests.py | 18 12 + 6 - 0 !
tests/annotations/tests.py | 66 44 + 22 - 0 !
tests/expressions/test_queryset_values.py | 36 24 + 12 - 0 !
tests/queries/tests.py | 18 12 + 6 - 0 !
5 files changed, 98 insertions(+), 50 deletions(-)

 [patch] [4.2.x] fixed cve-2026-1287 -- protected against sql
  injection in column aliases via control characters.

Control characters in FilteredRelation column aliases could be used for
SQL injection attacks. This affected QuerySet.annotate(), aggregate(),
extra(), values(), values_list(), and alias() when using dictionary
expansion with **kwargs.

Thanks Solomon Kebede for the report, and Simon Charette, Jacob Walls,
and Natalia Bidart for reviews.

Backport of e891a84c7ef9962bfcc3b4685690219542f86a22 from main.

django/db/models/sql/compiler.py | 2 1 + 1 - 0 !
tests/ordering/tests.py | 29 28 + 1 - 0 !
tests/queries/tests.py | 7 0 + 7 - 0 !
3 files changed, 29 insertions(+), 9 deletions(-)

 [patch] [4.2.x] fixed cve-2026-1312 -- protected order_by() from sql
  injection via aliases with periods.

Before, `order_by()` treated a period in a field name as a sign that it
was requested via `.extra(order_by=...)` and thus should be passed
through as raw table and column names, even if `extra()` was not used.
Since periods are permitted in aliases, this meant user-controlled
aliases could force the `order_by()` clause to resolve to a raw table
and column pair instead of the actual target field for the alias.

In practice, only `FilteredRelation` was affected, as the other
expressions we tested, e.g. `F`, aggressively optimize away the ordering
expressions into ordinal positions, e.g. ORDER BY 2, instead of ORDER BY
"table".column.

Thanks Solomon Kebede for the report, and Simon Charette and Jake Howard
for reviews.

Backport of 69065ca869b0970dff8fdd8fafb390bf8b3bf222 from main.