===========================
Django 4.2.24 release notes
===========================

*September 3, 2025*

Django 4.2.24 fixes a security issue with severity "high" in 4.2.23.

CVE-2025-57833: Potential SQL injection in ``FilteredRelation`` column aliases
==============================================================================

:class:`.FilteredRelation` was subject to SQL injection in column aliases,
using a suitably crafted dictionary, with dictionary expansion, as the
``**kwargs`` passed to :meth:`.QuerySet.annotate` or :meth:`.QuerySet.alias`.