---
title: "Django 3.0.1 release notes"
version: 5.1
locale: id
source: https://docs.djangoproject.com/id/5.1/releases/3.0.1/
canonical: https://djangodocs.dev/id/5.1/releases/3.0.1/
---
# Django 3.0.1 release notes

*December 18, 2019*

Django 3.0.1 fixes a security issue and several bugs in 3.0.

## CVE-2019-19844: Potential account hijack via password reset form

By submitting a suitably crafted email address making use of Unicode
characters, that compared equal to an existing user email when lower-cased for
comparison, an attacker could be sent a password reset token for the matched
account.

In order to avoid this vulnerability, password reset requests now compare the
submitted email using the stricter, recommended algorithm for case-insensitive
comparison of two identifiers from [Unicode Technical Report 36, section
2.11.2(B)(2)](https://www.unicode.org/reports/tr36/#Recommendations_General). Upon a match, the email containing the reset token will be
sent to the email address on record rather than the submitted address.

## Perbaikan kesalahan

- Fixed a regression in Django 3.0 by restoring the ability to use Django
  inside Jupyter and other environments that force an async context, by adding
  an option to disable [Keamanan asinkronus](/id/5.1/topics/async/#async-safety) mechanism with
  [`DJANGO_ALLOW_ASYNC_UNSAFE`](/id/5.1/topics/async/#envvar-DJANGO_ALLOW_ASYNC_UNSAFE) environment variable ([#31056](https://code.djangoproject.com/ticket/31056)).
- Fixed a regression in Django 3.0 where `RegexPattern`, used by
  [`re_path()`](/id/5.1/ref/urls/#django.urls.re_path), returned positional arguments to be passed to
  the view when all optional named groups were missing ([#31061](https://code.djangoproject.com/ticket/31061)).
- Reallowed, following a regression in Django 3.0,
  [`Window`](/id/5.1/ref/models/expressions/#django.db.models.expressions.Window) expressions to be used in
  conditions outside of queryset filters, e.g. in
  [`When`](/id/5.1/ref/models/conditional-expressions/#django.db.models.expressions.When) conditions ([#31060](https://code.djangoproject.com/ticket/31060)).
- Fixed a data loss possibility in
  [`SplitArrayField`](/id/5.1/ref/contrib/postgres/forms/#django.contrib.postgres.forms.SplitArrayField). When using with
  `ArrayField(BooleanField())`, all values after the first `True` value
  were marked as checked instead of preserving passed values ([#31073](https://code.djangoproject.com/ticket/31073)).