Django 4.2.5 release notes¶
September 4, 2023
Django 4.2.5 fixes a security issue with severity “moderate” and several bugs in 4.2.4.
CVE-2023-41164: Potential denial of service vulnerability in django.utils.encoding.uri_to_iri()¶
django.utils.encoding.uri_to_iri() was subject to potential denial of
service attack via certain inputs with a very large number of Unicode
characters.
Bugfixes¶
- Fixed a regression in Django 4.2 that caused an incorrect validation of
CheckConstraintson__isnulllookups againstJSONField(#34754). - Fixed a bug in Django 4.2 where the deprecated
DEFAULT_FILE_STORAGEandSTATICFILES_STORAGEsettings were not synced withSTORAGES(#34773). - Fixed a regression in Django 4.2.2 that caused an unnecessary selection of a
non-nullable
ManyToManyFieldwithout a natural key during serialization (#34779). - Fixed a regression in Django 4.2 that caused a crash of a queryset when
filtering against deeply nested
OuterRef()annotations (#34803).
