Django 3.0.4 release notes¶

March 4, 2020

Django 3.0.4 fixes a security issue and several bugs in 3.0.3.

CVE-2020-9402: Potential SQL injection via `tolerance` parameter in GIS functions and aggregates on Oracle¶

GIS functions and aggregates on Oracle were subject to SQL injection, using a suitably crafted tolerance.

Fixed a data loss possibility when using caching from async code (#31253).
Fixed a regression in Django 3.0 that caused a file response using a temporary file to be closed incorrectly (#31240).
Fixed a data loss possibility in the select_for_update(). When using related fields or parent link fields with Multi-table inheritance in the of argument, the corresponding models were not locked (#31246).
Fixed a regression in Django 3.0 that caused misplacing parameters in logged SQL queries on Oracle (#31271).
Fixed a regression in Django 3.0.3 that caused misplacing parameters of SQL queries when subtracting DateField or DateTimeField expressions on MySQL (#31312).
Fixed a regression in Django 3.0 that didn’t include subqueries spanning multivalued relations in the GROUP BY clause (#31150).

FAQ: Try the FAQ — it's got answers to many common questions.
Index, Module Index, or Table of Contents: Handy when looking for specific information.
django-users mailing list: Search for information in the archives of the django-users mailing list, or post a question.
#django IRC channel: Ask a question in the #django IRC channel, or search the IRC logs to see if it’s been asked before.
Django Discord Server: Join the Django Discord Community.
Official Django Forum: Join the community on the Django Forum.
Ticket tracker: Report bugs with Django or Django documentation in our ticket tracker.

Offline (development version): HTML | PDF | ePub
Provided by Read the Docs.