Django 4.0.1 release notes

Django 4.0.1 fixes one security issue with severity “medium”, two security issues with severity “low”, and several bugs in 4.0.

UserAttributeSimilarityValidator incurred significant overhead evaluating submitted password that were artificially large in relative to the comparison values. On the assumption that access to user registration was unrestricted this provided a potential vector for a denial-of-service attack.

This issue has severity “medium” according to the .

Due to leveraging the Django Template Language’s variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure or unintended method calls, if passed a suitably crafted key.

As a reminder, all untrusted user input should be validated before use.

This issue has severity “low” according to the .

This issue has severity “low” according to the Django security policy.

• Fixed a regression in Django 4.0 that caused a crash of on a formset named form (#33346).
• Relaxed the check added in Django 4.0 to reallow use of a duck-typed HttpRequest in django.views.decorators.cache.cache_control() and never_cache() decorators ().
• Fixed a regression in Django 4.0 that caused creating bogus migrations for models that reference swappable models such as auth.User (#33366).