March 4, 2024
Django 5.0.3 fixes a security issue with severity “moderate” and several bugs in 5.0.2.
django.utils.text.Truncator.words()
¶django.utils.text.Truncator.words()
method (with html=True
) and
truncatewords_html
template filter were subject to a potential
regular expression denial-of-service attack using a suitably crafted string
(follow up to CVE-2019-14232 and CVE-2023-43665).
intcomma
template filter could
return a leading comma for string representation of floats (#35172).Signal.asend()
and
asend_robust()
when all receivers were asynchronous functions
(#35174).ModelAdmin.lookup_allowed()
would prevent filtering against foreign keys using lookups like __isnull
when the field was not included in ModelAdmin.list_filter
(#35173).@sensitive_variables
and @sensitive_post_parameters
decorators on
functions loaded from .pyc
files (#35187).prefetch_related()
(#35238).SimpleListFilter
using a queryset without primary keys (#35198).Jun 25, 2024