---
title: "Django 1.8.7 release notes"
version: 2.1
locale: el
source: https://docs.djangoproject.com/el/2.1/releases/1.8.7/
canonical: https://djangodocs.dev/el/2.1/releases/1.8.7/
---
# Django 1.8.7 release notes

*November 24, 2015*

Django 1.8.7 fixes a security issue and several bugs in 1.8.6.

Additionally, Django’s vendored version of six, `django.utils.six`, has
been upgraded to the latest release (1.10.0).

## Fixed settings leak possibility in `date` template filter

If an application allows users to specify an unvalidated format for dates and
passes this format to the [`date`](/el/2.1/ref/templates/builtins/#std-templatefilter-date) filter, e.g.
`{{ last_updated|date:user_date_format }}`, then a malicious user could
obtain any secret in the application’s settings by specifying a settings key
instead of a date format. e.g. `"SECRET_KEY"` instead of `"j/m/Y"`.

To remedy this, the underlying function used by the `date` template filter,
`django.utils.formats.get_format()`, now only allows accessing the date/time
formatting settings.

## Bugfixes

- Fixed a crash of the debug view during the autumn DST change when
  [`USE_TZ`](/el/2.1/ref/settings/#std-setting-USE_TZ) is `False` and `pytz` is installed.
- Fixed a regression in 1.8.6 that caused database routers without an
  `allow_migrate()` method to crash ([#25686](https://code.djangoproject.com/ticket/25686)).
- Fixed a regression in 1.8.6 by restoring the ability to use `Manager`
  objects for the `queryset` argument of `ModelChoiceField`
  ([#25683](https://code.djangoproject.com/ticket/25683)).
- Fixed a regression in 1.8.6 that caused an application with South migrations
  in the `migrations` directory to fail ([#25618](https://code.djangoproject.com/ticket/25618)).
- Fixed a data loss possibility with [`Prefetch`](/el/2.1/ref/models/querysets/#django.db.models.Prefetch) if
  `to_attr` is set to a `ManyToManyField` ([#25693](https://code.djangoproject.com/ticket/25693)).
- Fixed a regression in 1.8 by making `gettext()` once again return UTF-8
  bytestrings on Python 2 if the input is a bytestring ([#25720](https://code.djangoproject.com/ticket/25720)).
- Fixed serialization of
  [`DateRangeField`](/el/2.1/ref/contrib/postgres/fields/#django.contrib.postgres.fields.DateRangeField) and
  [`DateTimeRangeField`](/el/2.1/ref/contrib/postgres/fields/#django.contrib.postgres.fields.DateTimeRangeField) ([#24937](https://code.djangoproject.com/ticket/24937)).
- Fixed the exact lookup of `ArrayField` ([#25666](https://code.djangoproject.com/ticket/25666)).
- Fixed `Model.refresh_from_db()` updating of `ForeignKey` fields with
  `on_delete=models.SET_NULL` ([#25715](https://code.djangoproject.com/ticket/25715)).
- Fixed a duplicate query regression in 1.8 on proxied model deletion
  ([#25685](https://code.djangoproject.com/ticket/25685)).
- Fixed `set_FOO_order()` crash when the `ForeignKey` of a model with
  `order_with_respect_to` references a model with a `OneToOneField`
  primary key ([#25786](https://code.djangoproject.com/ticket/25786)).
- Fixed incorrect validation for `PositiveIntegerField` and
  `PositiveSmallIntegerField` on MySQL resulting in values greater than
  4294967295 or 65535, respectively, passing validation and being silently
  truncated by the database ([#25767](https://code.djangoproject.com/ticket/25767)).