---
title: "Django 2.2.2 release notes"
version: 5.2
locale: en
source: https://docs.djangoproject.com/en/5.2/releases/2.2.2/
canonical: https://djangodocs.dev/en/5.2/releases/2.2.2/
---
# Django 2.2.2 release notes

*June 3, 2019*

Django 2.2.2 fixes security issues and several bugs in 2.2.1.

## CVE-2019-12308: AdminURLFieldWidget XSS

The clickable “Current URL” link generated by `AdminURLFieldWidget` displayed
the provided value without validating it as a safe URL. Thus, an unvalidated
value stored in the database, or a value provided as a URL query parameter
payload, could result in an clickable JavaScript link.

`AdminURLFieldWidget` now validates the provided value using
[`URLValidator`](/en/5.2/ref/validators/#django.core.validators.URLValidator) before displaying the clickable
link. You may customize the validator by passing a `validator_class` kwarg to
`AdminURLFieldWidget.__init__()`, e.g. when using
[`formfield_overrides`](/en/5.2/ref/contrib/admin/#django.contrib.admin.ModelAdmin.formfield_overrides).

## Patched bundled jQuery for CVE-2019-11358: Prototype pollution

jQuery before 3.4.0, mishandles `jQuery.extend(true, {}, ...)` because of
`Object.prototype` pollution. If an unsanitized source object contained an
enumerable `__proto__` property, it could extend the native
`Object.prototype`.

The bundled version of jQuery used by the Django admin has been patched to
allow for the `select2` library’s use of `jQuery.extend()`.

### Bugfixes

- Fixed a regression in Django 2.2 that stopped Show/Hide toggles working on
  dynamically added admin inlines ([#30459](https://code.djangoproject.com/ticket/30459)).
- Fixed a regression in Django 2.2 where deprecation message crashes if
  `Meta.ordering` contains an expression ([#30463](https://code.djangoproject.com/ticket/30463)).
- Fixed a regression in Django 2.2.1 where
  [`SearchVector`](/en/5.2/ref/contrib/postgres/search/#django.contrib.postgres.search.SearchVector) generates SQL with a
  redundant `Coalesce` call ([#30488](https://code.djangoproject.com/ticket/30488)).
- Fixed a regression in Django 2.2 where auto-reloader doesn’t detect changes
  in `manage.py` file when using `StatReloader` ([#30479](https://code.djangoproject.com/ticket/30479)).
- Fixed crash of [`ArrayAgg`](/en/5.2/ref/contrib/postgres/aggregates/#django.contrib.postgres.aggregates.ArrayAgg) and
  [`StringAgg`](/en/5.2/ref/contrib/postgres/aggregates/#django.contrib.postgres.aggregates.StringAgg) with `ordering`
  argument when used in a `Subquery` ([#30315](https://code.djangoproject.com/ticket/30315)).
- Fixed a regression in Django 2.2 that caused a crash of auto-reloader when
  an exception with custom signature is raised ([#30516](https://code.djangoproject.com/ticket/30516)).
- Fixed a regression in Django 2.2.1 where auto-reloader unnecessarily reloads
  translation files multiple times when using `StatReloader`
  ([#30523](https://code.djangoproject.com/ticket/30523)).