django/docs/releases/4.2.7.txt

==========================
Django 4.2.7 release notes
==========================

*November 1, 2023*

Django 4.2.7 fixes a security issue with severity "moderate" and several bugs
in 4.2.6.

CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows
=========================================================================================

The :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was
subject to a potential denial of service attack via certain inputs with a very
large number of Unicode characters.

In order to avoid the vulnerability, invalid values longer than
``UsernameField.max_length`` are no longer normalized, since they cannot pass
validation anyway.

Bugfixes
========

* Fixed a regression in Django 4.2 that caused a crash of
  ``QuerySet.aggregate()`` with aggregates referencing expressions containing
  subqueries (:ticket:`34798`).

* Restored, following a regression in Django 4.2, creating
  ``varchar/text_pattern_ops`` indexes on ``CharField`` and ``TextField`` with
  deterministic collations on PostgreSQL (:ticket:`34932`).