{"title":"Django 1.5.5 release notes","version":"dev","locale":"en","docname":"releases/1.5.5","url":"/en/dev/releases/1.5.5/","canonical":"https://djangodocs.dev/en/dev/releases/1.5.5/","summary":"Django 1.5.5 fixes a couple security-related bugs and several other bugs in the 1.5 series.","html":"<h1>Django 1.5.5 release notes<a class=\"heading-anchor\" href=\"#django-1-5-5-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>October 23, 2013</em></p>\n<p>Django 1.5.5 fixes a couple security-related bugs and several other bugs in the\n1.5 series.</p>\n<section id=\"readdressed-denial-of-service-via-password-hashers\">\n<h2>Readdressed denial-of-service via password hashers<a class=\"heading-anchor\" href=\"#readdressed-denial-of-service-via-password-hashers\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Django 1.5.4 imposes a 4096-byte limit on passwords in order to mitigate a\ndenial-of-service attack through submission of bogus but extremely large\npasswords. In Django 1.5.5, we’ve reverted this change and instead improved\nthe speed of our PBKDF2 algorithm by not rehashing the key on every iteration.</p>\n</section>\n<section id=\"properly-rotate-csrf-token-on-login\">\n<h2>Properly rotate CSRF token on login<a class=\"heading-anchor\" href=\"#properly-rotate-csrf-token-on-login\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>This behavior introduced as a security hardening measure in Django 1.5.2 did\nnot work properly and is now fixed.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a data corruption bug with <code class=\"docutils literal notranslate\">datetime_safe.datetime.combine</code> (#21256).</p></li>\n<li><p>Fixed a Python 3 incompatibility in <code class=\"docutils literal notranslate\">django.utils.text.unescape_entities()</code>\n(#21185).</p></li>\n<li><p>Fixed a couple data corruption issues with <code class=\"docutils literal notranslate\">QuerySet</code> edge cases under\nOracle and MySQL (#21203, #21126).</p></li>\n<li><p>Fixed crashes when using combinations of <code class=\"docutils literal notranslate\">annotate()</code>,\n<code class=\"docutils literal notranslate\">select_related()</code>, and <code class=\"docutils literal notranslate\">only()</code> (#16436).</p></li>\n</ul>\n</section>\n<section id=\"backwards-incompatible-changes\">\n<h2>Backwards incompatible changes<a class=\"heading-anchor\" href=\"#backwards-incompatible-changes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>The undocumented <code class=\"docutils literal notranslate\">django.core.servers.basehttp.WSGIServerException</code> has\nbeen removed. Use <code class=\"docutils literal notranslate\">socket.error</code> provided by the standard library instead.</p></li>\n</ul>\n</section>","rootId":"django-1-5-5-release-notes","toc":[{"title":"Readdressed denial-of-service via password hashers","anchor":"readdressed-denial-of-service-via-password-hashers","children":[]},{"title":"Properly rotate CSRF token on login","anchor":"properly-rotate-csrf-token-on-login","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]},{"title":"Backwards incompatible changes","anchor":"backwards-incompatible-changes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.5.6","title":"Django 1.5.6 release notes","url":"/en/dev/releases/1.5.6/"},"next":{"docname":"releases/1.5.4","title":"Django 1.5.4 release notes","url":"/en/dev/releases/1.5.4/"},"formats":{"html":"/en/dev/releases/1.5.5/","markdown":"/en/dev/releases/1.5.5.md","json":"/en/dev/releases/1.5.5.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.5.5.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.5.5/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}