In Python 3.9.5+ urllib.parse() automatically removes ASCII newlines
and tabs from URLs [1, 2]. Unfortunately it created an issue in
the URLValidator. URLValidator uses urllib.urlsplit() and
urllib.urlunsplit() for creating a URL variant with Punycode which no
longer contains newlines and tabs in Python 3.9.5+. As a consequence,
the regular expression matched the URL (without unsafe characters) and
the source value (with unsafe characters) was considered valid.
[1] https://bugs.python.org/issue43882 and
[2] 76cd81d603
Backport of e1e81aa1c4 from main.
The validate_file_name() sanitation introduced in
0b79eb3691 correctly rejects the example
file name as containing path elements on Windows. This breaks the test
introduced in 914c72be2a to allow path
components for storages that may allow them.
Test is skipped pending a discussed storage refactoring to support this
use-case.
Backport of a708f39ce6 from main
Subquery deconstruction support required implementing complex and
expensive equality rules for sql.Query objects for little benefit as
the latter cannot themselves be made deconstructible to their reference
to model classes.
Making Expression @deconstructible and not BaseExpression allows
interested parties to conform to the "expression" API even if they are
not deconstructible as it's only a requirement for expressions allowed
in Model fields and meta options (e.g. constraints, indexes).
Thanks Phillip Cutter for the report.
This also fixes a performance regression in bbf141bcdc.
Backport of c8b6594305 from main
Thanks Zain Patel for the report and Simon Charette for reviews.
The exception introduced in 6307c3f1a1
revealed a possible data loss issue in the admin.
Backport of 1871182031 from main
This issue started manifesting itself when nesting a combined subquery
relying on exclude() since 8593e162c9 but
sql.Query.combine never properly handled subqueries outer refs in the
first place, see QuerySetBitwiseOperationTests.test_subquery_aliases()
(refs #27149).
Thanks Raffaele Salmaso for the report.
Backport of 6d0cbe42c3 from main
Different PROJ versions use different transformations, all are correct
as having a 1 meter accuracy.
These are differences in PROJ versions that cannot and should not be
handled in Django itself.
Thanks Jani Tiainen and David Smith for reports.
See: https://github.com/OSGeo/gdal/issues/3377
Backport of 2cd4026334 from main
In MTI or ForeignKey as primary key cases, it is required to fetch the attname
from the field instance on the remote model in order to reliably resolve the
to_field_name.
Backport of ceb4b9ee68 from main Backport of 03d0f12c82 from main
Co-authored-by: Johannes Maron <info@johanneshoppe.com>
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Co-authored-by: Carlton Gibson <carlton.gibson@noumenal.es>
This fixes flushing test databases when two aliases point to the same
database.
Use a list() to store the test database aliases so the order remains
stable by following the order of the connections. Also, always use the
"default" database alias as the first alias to accommodate `migrate`.
Previously `migrate` could be executed on a secondary alias which
caused truncating the "default" database.
Backport of 06e5f7ae16 from master
The subquery pushdown only happens because another table is involved in
filter. It's not the distinct usage that causes the pushdown.
The distinct('description').order_by('pk') expression is not valid
because SELECT DISTINCT ON must match initial ORDER BY expressions
which is not the case here.
Backport of 4e8ecf0cb6 from master
Mariusz Felisiak
Carlton Gibson
Simon Charette
Florian Apolloner
Konstantin Alekseev
Zain Patel
Jonathan Richards
Arthur Jovart
Hasan Ramezani
Iuri de Silvio
Adam Johnson
Claude Paroz
Johannes Maron
Tim Graham
Markus Holtermann
Nick Pope
starryrbs
Hannes Ljungberg
Harm Geerts
Chris Jerdonek
Egidijus Macijauskas
Jordan Bae
Mikolaj Rybinski