November 1, 2023
Django 4.2.7 fixes a security issue with severity „moderate” and several bugs in 4.2.6.
UsernameField on Windows¶The NFKC normalization is slow on
Windows. As a consequence, django.contrib.auth.forms.UsernameField was
subject to a potential denial of service attack via certain inputs with a very
large number of Unicode characters.
In order to avoid the vulnerability, invalid values longer than
UsernameField.max_length are no longer normalized, since they cannot pass
validation anyway.
QuerySet.aggregate() with aggregates referencing expressions containing
subqueries (#34798).varchar/text_pattern_ops indexes on CharField and TextField with
deterministic collations on PostgreSQL (#34932).sie 06, 2024