From 00152276e9a26fb06ccf44d8d56525a892c27125 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Wed, 3 May 2023 13:51:05 +0200
Subject: [PATCH 01/47] [4.2.x] Post-release version bump.

---
 django/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/django/__init__.py b/django/__init__.py
index e5fc759960bf..addd783d90f7 100644
--- a/django/__init__.py
+++ b/django/__init__.py
@@ -1,6 +1,6 @@
 from django.utils.version import get_version
 
-VERSION = (4, 2, 1, "final", 0)
+VERSION = (4, 2, 2, "alpha", 0)
 
 __version__ = get_version(VERSION)
 

From 110919987b9a19644f5b650d4de345fea76d4a9b Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Wed, 3 May 2023 15:13:07 +0200
Subject: [PATCH 02/47] [4.2.x] Added stub release notes for 4.2.2.

Backport of b0d3a5de95c9966075c38f10e790dced70c81ebf from main
---
 docs/releases/4.2.2.txt | 12 ++++++++++++
 docs/releases/index.txt |  1 +
 2 files changed, 13 insertions(+)
 create mode 100644 docs/releases/4.2.2.txt

diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
new file mode 100644
index 000000000000..31f854b00411
--- /dev/null
+++ b/docs/releases/4.2.2.txt
@@ -0,0 +1,12 @@
+==========================
+Django 4.2.2 release notes
+==========================
+
+*Expected June 5, 2023*
+
+Django 4.2.2 fixes several bugs in 4.2.1.
+
+Bugfixes
+========
+
+* ...
diff --git a/docs/releases/index.txt b/docs/releases/index.txt
index 03f88db8f609..8c186a582001 100644
--- a/docs/releases/index.txt
+++ b/docs/releases/index.txt
@@ -26,6 +26,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   4.2.2
    4.2.1
    4.2
 

From 2756c6960163f0263a15633fd3cfd93281f47496 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Wed, 3 May 2023 15:20:31 +0200
Subject: [PATCH 03/47] [4.2.x] Added CVE-2023-31047 to security archive.

Backport of 49830025c992fbc8d8f213e7c16dba1391c6adf2 from main
---
 docs/releases/security.txt | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/docs/releases/security.txt b/docs/releases/security.txt
index 0a8273870943..c90d7323978b 100644
--- a/docs/releases/security.txt
+++ b/docs/releases/security.txt
@@ -36,6 +36,17 @@ Issues under Django's security process
 All security issues have been handled under versions of Django's security
 process. These are listed below.
 
+May 3, 2023 - :cve:`2023-31047`
+-------------------------------
+
+Potential bypass of validation when uploading multiple files using one form
+field. `Full description
+<https://www.djangoproject.com/weblog/2023/may/03/security-releases/>`__
+
+* Django 4.2 :commit:`(patch) <21b1b1fc03e5f9e9f8c977ee6e35618dd3b353dd>`
+* Django 4.1 :commit:`(patch) <e7c3a2ccc3a562328600be05068ed9149e12ce64>`
+* Django 3.2 :commit:`(patch) <eed53d0011622e70b936e203005f0e6f4ac48965>`
+
 February 14, 2023 - :cve:`2023-24580`
 -------------------------------------
 

From 9ec1ff7879563942bb43cfb33ac40a94cdca3b40 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Thu, 4 May 2023 08:09:02 +0200
Subject: [PATCH 04/47] [4.2.x] Fixed
 MultipleFileFieldTest.test_file_multiple_validation() test if Pillow isn't
 installed.

Follow up to fb4c55d9ec4bb812a7fb91fa20510d91645e411b.
Backport of fcfbf08abe3e6dc54894df6988024f055abc6c40 from main
---
 tests/forms_tests/field_tests/test_filefield.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tests/forms_tests/field_tests/test_filefield.py b/tests/forms_tests/field_tests/test_filefield.py
index 00c74a7c1aa2..11388bdc09df 100644
--- a/tests/forms_tests/field_tests/test_filefield.py
+++ b/tests/forms_tests/field_tests/test_filefield.py
@@ -1,4 +1,5 @@
 import pickle
+import unittest
 
 from django.core.exceptions import ValidationError
 from django.core.files.uploadedfile import SimpleUploadedFile
@@ -6,6 +7,13 @@
 from django.forms import FileField, FileInput
 from django.test import SimpleTestCase
 
+try:
+    from PIL import Image  # NOQA
+except ImportError:
+    HAS_PILLOW = False
+else:
+    HAS_PILLOW = True
+
 
 class FileFieldTest(SimpleTestCase):
     def test_filefield_1(self):
@@ -151,6 +159,7 @@ def test_file_multiple_empty(self):
         with self.assertRaisesMessage(ValidationError, msg):
             f.clean(files[::-1])
 
+    @unittest.skipUnless(HAS_PILLOW, "Pillow not installed")
     def test_file_multiple_validation(self):
         f = MultipleFileField(validators=[validate_image_file_extension])
 

From 4eaed191b6514dc577fdba31b31c0a7571b176e5 Mon Sep 17 00:00:00 2001
From: Jannis Vajen <jvajen@gmail.com>
Date: Thu, 4 May 2023 13:56:36 +0200
Subject: [PATCH 05/47] [4.2.x] Corrected code-block directives in docs.

Backport of 024954aad4c422a091b7afab42fff1a9d7478fce from main
---
 docs/ref/files/file.txt         | 2 +-
 docs/ref/templates/builtins.txt | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/ref/files/file.txt b/docs/ref/files/file.txt
index f5c1b10917be..650bbb70795d 100644
--- a/docs/ref/files/file.txt
+++ b/docs/ref/files/file.txt
@@ -135,7 +135,7 @@ below) will also have a couple of extra methods:
     Saves a new file with the file name and contents provided. This will not
     replace the existing file, but will create a new file and update the object
     to point to it. If ``save`` is ``True``, the model's ``save()`` method will
-    be called once the file is saved. That is, these two lines::
+    be called once the file is saved. That is, these two lines:
 
     .. code-block:: pycon
 
diff --git a/docs/ref/templates/builtins.txt b/docs/ref/templates/builtins.txt
index c7a849896105..8a0457791941 100644
--- a/docs/ref/templates/builtins.txt
+++ b/docs/ref/templates/builtins.txt
@@ -1116,7 +1116,7 @@ Example usage:
         {% resetcycle %}
     {% endfor %}
 
-This example would return this HTML::
+This example would return this HTML:
 
 .. code-block:: html
 

From bcf66f135595c4a305f45bcfeafcd86af72b5290 Mon Sep 17 00:00:00 2001
From: Pan Dango <76955186+hoopandango@users.noreply.github.com>
Date: Sun, 7 May 2023 18:21:27 +0530
Subject: [PATCH 06/47] [4.2.x] Corrected code-block directive in
 docs/ref/templates/builtins.txt.

Backport of 12ec80726f33e8dbd80de3cecf48d76ac4c0aa89 from main
---
 docs/ref/templates/builtins.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/ref/templates/builtins.txt b/docs/ref/templates/builtins.txt
index 8a0457791941..853a62e71962 100644
--- a/docs/ref/templates/builtins.txt
+++ b/docs/ref/templates/builtins.txt
@@ -1264,7 +1264,7 @@ such as this:
 
     path("clients/", include("project_name.app_name.urls"))
 
-...then, in a template, you can create a link to this view like this::
+...then, in a template, you can create a link to this view like this:
 
 .. code-block:: html+django
 

From dc3b8190ed2b01e450c81df28023f0b6352b4a27 Mon Sep 17 00:00:00 2001
From: Akash Kumar Sen <71623442+Akash-Kumar-Sen@users.noreply.github.com>
Date: Mon, 8 May 2023 12:04:23 +0530
Subject: [PATCH 07/47] [4.2.x] Fixed #34545 -- Corrected the number of months
 in installation FAQ.

Backport of aaf8c76c567e8311f4a85cf74c82fc3d70cc6f12 from main
---
 docs/faq/install.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/faq/install.txt b/docs/faq/install.txt
index a0731fc71736..fc19dda0ab07 100644
--- a/docs/faq/install.txt
+++ b/docs/faq/install.txt
@@ -82,7 +82,7 @@ Should I use the stable version or development version?
 
 Generally, if you're using code in production, you should be using a
 stable release. The Django project publishes a full stable release
-every nine months or so, with bugfix updates in between. These stable
+every eight months or so, with bugfix updates in between. These stable
 releases contain the API that is covered by our backwards
 compatibility guarantees; if you write code against stable releases,
 you shouldn't have any problems upgrading when the next official

From e0d8981139cd329962e509efb575fdfb2dad4073 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Mon, 8 May 2023 19:34:30 +0200
Subject: [PATCH 08/47] [4.2.x] Fixed #34544 -- Avoided DBMS_LOB.SUBSTR()
 wrapping with IS NULL condition on Oracle.

Regression in 09ffc5c1212d4ced58b708cbbf3dfbfb77b782ca.

Thanks Michael Smith for the report.

This also reverts commit 1e4da439556cdd69eb9f91e07f99cf77997e70d2.
Backport of 1586a09b7949bbb7b0d84cb74ce1cadc25cbb355 from main
---
 django/db/backends/oracle/operations.py   | 10 +++-------
 django/db/backends/postgresql/features.py |  3 +++
 docs/releases/4.2.2.txt                   |  4 +++-
 tests/lookup/models.py                    | 12 +-----------
 tests/lookup/tests.py                     |  9 ++++++++-
 5 files changed, 18 insertions(+), 20 deletions(-)

diff --git a/django/db/backends/oracle/operations.py b/django/db/backends/oracle/operations.py
index d34ca23bae3a..64b1f82071e6 100644
--- a/django/db/backends/oracle/operations.py
+++ b/django/db/backends/oracle/operations.py
@@ -296,12 +296,6 @@ def fetch_returned_insert_columns(self, cursor, returning_params):
             columns.append(value[0])
         return tuple(columns)
 
-    def field_cast_sql(self, db_type, internal_type):
-        if db_type and db_type.endswith("LOB") and internal_type != "JSONField":
-            return "DBMS_LOB.SUBSTR(%s)"
-        else:
-            return "%s"
-
     def no_limit_value(self):
         return None
 
@@ -344,7 +338,9 @@ def last_insert_id(self, cursor, table_name, pk_name):
     def lookup_cast(self, lookup_type, internal_type=None):
         if lookup_type in ("iexact", "icontains", "istartswith", "iendswith"):
             return "UPPER(%s)"
-        if internal_type == "JSONField" and lookup_type == "exact":
+        if (
+            lookup_type != "isnull" and internal_type in ("BinaryField", "TextField")
+        ) or (lookup_type == "exact" and internal_type == "JSONField"):
             return "DBMS_LOB.SUBSTR(%s)"
         return "%s"
 
diff --git a/django/db/backends/postgresql/features.py b/django/db/backends/postgresql/features.py
index aa68465df900..732b30b0a45f 100644
--- a/django/db/backends/postgresql/features.py
+++ b/django/db/backends/postgresql/features.py
@@ -82,6 +82,9 @@ class DatabaseFeatures(BaseDatabaseFeatures):
             "indexes.tests.SchemaIndexesNotPostgreSQLTests."
             "test_create_index_ignores_opclasses",
         },
+        "PostgreSQL requires casting to text.": {
+            "lookup.tests.LookupTests.test_textfield_exact_null",
+        },
     }
 
     @cached_property
diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
index 31f854b00411..9d16e7ef6f77 100644
--- a/docs/releases/4.2.2.txt
+++ b/docs/releases/4.2.2.txt
@@ -9,4 +9,6 @@ Django 4.2.2 fixes several bugs in 4.2.1.
 Bugfixes
 ========
 
-* ...
+* Fixed a regression in Django 4.2 that caused an unnecessary
+  ``DBMS_LOB.SUBSTR()`` wrapping in the ``__isnull`` and ``__exact=None``
+  lookups for ``TextField()``/``BinaryField()`` on Oracle (:ticket:`34544`).
diff --git a/tests/lookup/models.py b/tests/lookup/models.py
index 9bb3412c33eb..75f3e3b6ba4a 100644
--- a/tests/lookup/models.py
+++ b/tests/lookup/models.py
@@ -19,6 +19,7 @@ def __str__(self):
 class Author(models.Model):
     name = models.CharField(max_length=100)
     alias = models.CharField(max_length=50, null=True, blank=True)
+    bio = models.TextField(null=True)
 
     class Meta:
         ordering = ("name",)
@@ -50,22 +51,11 @@ def get_prep_value(self, value):
         return None if value == "" else value
 
 
-class NullField(models.Field):
-    pass
-
-
-NullField.register_lookup(IsNull)
-
-
 @NulledTextField.register_lookup
 class NulledTransform(models.Transform):
     lookup_name = "nulled"
     template = "NULL"
 
-    @property
-    def output_field(self):
-        return NullField()
-
 
 @NulledTextField.register_lookup
 class IsNullWithNoneAsRHS(IsNull):
diff --git a/tests/lookup/tests.py b/tests/lookup/tests.py
index 503bae18fc09..ab3d968aaceb 100644
--- a/tests/lookup/tests.py
+++ b/tests/lookup/tests.py
@@ -49,7 +49,7 @@ class LookupTests(TestCase):
     @classmethod
     def setUpTestData(cls):
         # Create a few Authors.
-        cls.au1 = Author.objects.create(name="Author 1", alias="a1")
+        cls.au1 = Author.objects.create(name="Author 1", alias="a1", bio="x" * 4001)
         cls.au2 = Author.objects.create(name="Author 2", alias="a2")
         # Create a few Articles.
         cls.a1 = Article.objects.create(
@@ -1000,6 +1000,13 @@ def test_regex_null(self):
         Season.objects.create(year=2012, gt=None)
         self.assertQuerySetEqual(Season.objects.filter(gt__regex=r"^$"), [])
 
+    def test_textfield_exact_null(self):
+        with self.assertNumQueries(1) as ctx:
+            self.assertSequenceEqual(Author.objects.filter(bio=None), [self.au2])
+        # Columns with IS NULL condition are not wrapped (except PostgreSQL).
+        bio_column = connection.ops.quote_name(Author._meta.get_field("bio").column)
+        self.assertIn(f"{bio_column} IS NULL", ctx.captured_queries[0]["sql"])
+
     def test_regex_non_string(self):
         """
         A regex lookup does not fail on non-string fields

From e50fe33e13f15ddeafd6354817b9d96002559751 Mon Sep 17 00:00:00 2001
From: nessita <124304+nessita@users.noreply.github.com>
Date: Thu, 11 May 2023 07:55:45 -0300
Subject: [PATCH 09/47] [4.2.x] Made explicit the location of locally-built
 HTML docs.

Backport of 2b11740e1d9d23ef53d94a1c45896fb7b91df908 from main
---
 docs/internals/contributing/writing-documentation.txt | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/docs/internals/contributing/writing-documentation.txt b/docs/internals/contributing/writing-documentation.txt
index 73147c82bf27..fa3cd749f9a5 100644
--- a/docs/internals/contributing/writing-documentation.txt
+++ b/docs/internals/contributing/writing-documentation.txt
@@ -60,10 +60,11 @@ Then from the ``docs`` directory, build the HTML:
 To get started contributing, you'll want to read the :ref:`reStructuredText
 reference <sphinx:rst-index>`.
 
-Your locally-built documentation will be themed differently than the
-documentation at `docs.djangoproject.com <https://docs.djangoproject.com/>`_.
-This is OK! If your changes look good on your local machine, they'll look good
-on the website.
+Your locally-built documentation will be accessible at
+``docs/_build/html/index.html`` and it can be viewed in any web browser, though
+it will be themed differently than the documentation at
+`docs.djangoproject.com <https://docs.djangoproject.com/>`_. This is OK! If
+your changes look good on your local machine, they'll look good on the website.
 
 How the documentation is organized
 ==================================

From dbe263751cf80732c2cd47d409f5f0a9701ec327 Mon Sep 17 00:00:00 2001
From: Alberto Sottile <alby128@gmail.com>
Date: Fri, 12 May 2023 13:09:38 +0200
Subject: [PATCH 10/47] [4.2.x] Clarified database connections lifetime outside
 HTTP requests.

Backport of e901407e2369ddb16a5c866e1f2fbf8ea8acf549 from main
---
 docs/ref/databases.txt | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/docs/ref/databases.txt b/docs/ref/databases.txt
index 3334619f9191..5a26520501ae 100644
--- a/docs/ref/databases.txt
+++ b/docs/ref/databases.txt
@@ -31,7 +31,7 @@ Persistent connections
 ----------------------
 
 Persistent connections avoid the overhead of reestablishing a connection to
-the database in each request. They're controlled by the
+the database in each HTTP request. They're controlled by the
 :setting:`CONN_MAX_AGE` parameter which defines the maximum lifetime of a
 connection. It can be set independently for each database.
 
@@ -101,6 +101,10 @@ either restore Django's defaults at the end of each request, force an
 appropriate value at the beginning of each request, or disable persistent
 connections.
 
+If a connection is created in a long-running process, outside of Django’s
+request-response cycle, the connection will remain open until explicitly
+closed, or timeout occurs.
+
 Encoding
 --------
 

From ddccecee91601ce790c82b0aa03b2fa751580361 Mon Sep 17 00:00:00 2001
From: Alexerson <Alexerson@users.noreply.github.com>
Date: Fri, 12 May 2023 06:34:47 -0700
Subject: [PATCH 11/47] [4.2.x] Fixed #34556 -- Doc'd that
 StreamingHttpResponse accepts memoryviews and strings iterators.

Backport of 599f3e2cda50ab084915ffd08edb5ad6cad61415 from main
---
 docs/ref/request-response.txt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/ref/request-response.txt b/docs/ref/request-response.txt
index 2c195b6f9001..c8e55ea37036 100644
--- a/docs/ref/request-response.txt
+++ b/docs/ref/request-response.txt
@@ -1204,9 +1204,9 @@ The :class:`StreamingHttpResponse` is not a subclass of :class:`HttpResponse`,
 because it features a slightly different API. However, it is almost identical,
 with the following notable differences:
 
-* It should be given an iterator that yields bytestrings as content. When
-  serving under WSGI, this should be a sync iterator. When serving under ASGI,
-  this is should an async iterator.
+* It should be given an iterator that yields bytestrings, :class:`memoryview`,
+  or strings as content. When serving under WSGI, this should be a sync
+  iterator. When serving under ASGI, then it should be an async iterator.
 
 * You cannot access its content, except by iterating the response object
   itself. This should only occur when the response is returned to the client:

From 9c301814b0d342bfc5f10c1513594ce5fbb6c6a9 Mon Sep 17 00:00:00 2001
From: Julie Rymer <rymerjulie.pro@gmail.com>
Date: Mon, 15 May 2023 15:19:38 +0200
Subject: [PATCH 12/47] [4.2.x] Fixed #34539 -- Restored get_prep_value() call
 when adapting JSONFields.

Regression in 5c23d9f0c32f166c81ecb6f3f01d5077a6084318.

Backport of 0ec60661e61b153e6bcec64649b1b7f524eb3e18 from main
---
 AUTHORS                              |  1 +
 django/db/models/fields/json.py      |  2 ++
 docs/releases/4.2.2.txt              |  3 +++
 tests/model_fields/test_jsonfield.py | 23 +++++++++++++++++++++++
 4 files changed, 29 insertions(+)

diff --git a/AUTHORS b/AUTHORS
index 2cddbf9280b2..af30e8d78efc 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -530,6 +530,7 @@ answer newbie questions, and generally made Django that much better:
     Julia Elman
     Julia Matsieva <julia.matsieva@gmail.com>
     Julian Bez
+    Julie Rymer <rymerjulie.pro@gmail.com>
     Julien Phalip <jphalip@gmail.com>
     Junyoung Choi <cupjoo@gmail.com>
     junzhang.jn@gmail.com
diff --git a/django/db/models/fields/json.py b/django/db/models/fields/json.py
index eb2d35f10058..b7cde157c4fa 100644
--- a/django/db/models/fields/json.py
+++ b/django/db/models/fields/json.py
@@ -99,6 +99,8 @@ def get_internal_type(self):
         return "JSONField"
 
     def get_db_prep_value(self, value, connection, prepared=False):
+        if not prepared:
+            value = self.get_prep_value(value)
         # RemovedInDjango51Warning: When the deprecation ends, replace with:
         # if (
         #     isinstance(value, expressions.Value)
diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
index 9d16e7ef6f77..a92582b7a03e 100644
--- a/docs/releases/4.2.2.txt
+++ b/docs/releases/4.2.2.txt
@@ -12,3 +12,6 @@ Bugfixes
 * Fixed a regression in Django 4.2 that caused an unnecessary
   ``DBMS_LOB.SUBSTR()`` wrapping in the ``__isnull`` and ``__exact=None``
   lookups for ``TextField()``/``BinaryField()`` on Oracle (:ticket:`34544`).
+
+* Restored, following a regression in Django 4.2, ``get_prep_value()`` call in
+  ``JSONField`` subclasses (:ticket:`34539`).
diff --git a/tests/model_fields/test_jsonfield.py b/tests/model_fields/test_jsonfield.py
index 60357d87b2db..4a1cc075b4c4 100644
--- a/tests/model_fields/test_jsonfield.py
+++ b/tests/model_fields/test_jsonfield.py
@@ -103,6 +103,29 @@ def test_key_transform_text_lookup_mixin_non_key_transform(self):
         with self.assertRaisesMessage(TypeError, msg):
             KeyTransformTextLookupMixin(transform)
 
+    def test_get_prep_value(self):
+        class JSONFieldGetPrepValue(models.JSONField):
+            def get_prep_value(self, value):
+                if value is True:
+                    return {"value": True}
+                return value
+
+        def noop_adapt_json_value(value, encoder):
+            return value
+
+        field = JSONFieldGetPrepValue()
+        with mock.patch.object(
+            connection.ops, "adapt_json_value", noop_adapt_json_value
+        ):
+            self.assertEqual(
+                field.get_db_prep_value(True, connection, prepared=False),
+                {"value": True},
+            )
+            self.assertIs(
+                field.get_db_prep_value(True, connection, prepared=True), True
+            )
+            self.assertEqual(field.get_db_prep_value(1, connection, prepared=False), 1)
+
 
 class TestValidation(SimpleTestCase):
     def test_invalid_encoder(self):

From 201d29b3719ef15637648be7bd947ef90a66ab55 Mon Sep 17 00:00:00 2001
From: Simon Charette <charette.s@gmail.com>
Date: Tue, 16 May 2023 15:11:19 -0400
Subject: [PATCH 13/47] [4.2.x] Fixed #34570 -- Silenced noop deferral of
 many-to-many and GFK.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While deferring many-to-many and GFK has no effect, the previous
implementation of QuerySet.defer() ignore them instead of crashing.

Regression in b3db6c8dcb5145f7d45eff517bcd96460475c879.

Thanks Paco Martínez for the report.

Backport of 99e5dff737cd20b12d060e4794e097063b61ec40 from main
---
 django/db/models/sql/query.py | 10 +++++++++-
 docs/releases/4.2.2.txt       |  4 ++++
 tests/defer_regress/tests.py  |  6 ++++++
 3 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/django/db/models/sql/query.py b/django/db/models/sql/query.py
index b347c6bf3f10..b615d06f28fb 100644
--- a/django/db/models/sql/query.py
+++ b/django/db/models/sql/query.py
@@ -725,7 +725,15 @@ def _get_defer_select_mask(self, opts, mask, select_mask=None):
                 field_select_mask = select_mask.setdefault((field_name, relation), {})
                 field = relation.field
             else:
-                field = opts.get_field(field_name).field
+                reverse_rel = opts.get_field(field_name)
+                # While virtual fields such as many-to-many and generic foreign
+                # keys cannot be effectively deferred we've historically
+                # allowed them to be passed to QuerySet.defer(). Ignore such
+                # field references until a layer of validation at mask
+                # alteration time will be implemented eventually.
+                if not hasattr(reverse_rel, "field"):
+                    continue
+                field = reverse_rel.field
                 field_select_mask = select_mask.setdefault(field, {})
             related_model = field.model._meta.concrete_model
             self._get_defer_select_mask(
diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
index a92582b7a03e..ca21e5f1ec94 100644
--- a/docs/releases/4.2.2.txt
+++ b/docs/releases/4.2.2.txt
@@ -15,3 +15,7 @@ Bugfixes
 
 * Restored, following a regression in Django 4.2, ``get_prep_value()`` call in
   ``JSONField`` subclasses (:ticket:`34539`).
+
+* Fixed a regression in Django 4.2 that caused a crash of ``QuerySet.defer()``
+  when passing a ``ManyToManyField`` or ``GenericForeignKey`` reference. While
+  doing so is a no-op, it was allowed in older version (:ticket:`34570`).
diff --git a/tests/defer_regress/tests.py b/tests/defer_regress/tests.py
index 9f94d5fac125..ab2be085c6a7 100644
--- a/tests/defer_regress/tests.py
+++ b/tests/defer_regress/tests.py
@@ -296,6 +296,12 @@ def test_common_model_different_mask(self):
         with self.assertNumQueries(1):
             self.assertEqual(leaf.second_child.value, 64)
 
+    def test_defer_many_to_many_ignored(self):
+        location = Location.objects.create()
+        request = Request.objects.create(location=location)
+        with self.assertNumQueries(1):
+            self.assertEqual(Request.objects.defer("items").get(), request)
+
 
 class DeferDeletionSignalsTests(TestCase):
     senders = [Item, Proxy]

From 2b5c5e54de6545c6cf3cc97996b37618cbae87bd Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Wed, 17 May 2023 12:13:10 +0200
Subject: [PATCH 14/47] [4.2.x] Updated broken links in docs.

Backport of 93830abf7694e0f281931f10eeaa34993855e7dd from main
---
 docs/howto/outputting-pdf.txt                           | 2 +-
 docs/internals/contributing/writing-code/unit-tests.txt | 2 +-
 docs/ref/contrib/gis/feeds.txt                          | 2 +-
 docs/ref/models/fields.txt                              | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/howto/outputting-pdf.txt b/docs/howto/outputting-pdf.txt
index 11b3fb97a5c3..bcdfa6acc49c 100644
--- a/docs/howto/outputting-pdf.txt
+++ b/docs/howto/outputting-pdf.txt
@@ -14,7 +14,7 @@ For example, Django was used at kusports.com_ to generate customized,
 printer-friendly NCAA tournament brackets, as PDF files, for people
 participating in a March Madness contest.
 
-.. _ReportLab: https://www.reportlab.com/opensource/
+.. _ReportLab: https://docs.reportlab.com/
 .. _kusports.com: http://www2.kusports.com/
 
 Install ReportLab
diff --git a/docs/internals/contributing/writing-code/unit-tests.txt b/docs/internals/contributing/writing-code/unit-tests.txt
index a0b985c8a0fd..2d0ba67144c7 100644
--- a/docs/internals/contributing/writing-code/unit-tests.txt
+++ b/docs/internals/contributing/writing-code/unit-tests.txt
@@ -292,7 +292,7 @@ dependencies:
 * :pypi:`pywatchman`
 * :pypi:`redis` 3.4+
 * :pypi:`setuptools`
-* :pypi:`memcached`, plus a `supported Python binding
+* :pypi:`python-memcached`, plus a `supported Python binding
   <https://memcached.org/>`_
 * `gettext <https://www.gnu.org/software/gettext/manual/gettext.html>`_
   (:ref:`gettext_on_windows`)
diff --git a/docs/ref/contrib/gis/feeds.txt b/docs/ref/contrib/gis/feeds.txt
index d22c728b5ff4..9ae9d4f03a4b 100644
--- a/docs/ref/contrib/gis/feeds.txt
+++ b/docs/ref/contrib/gis/feeds.txt
@@ -13,7 +13,7 @@ Django's, please consult :doc:`Django's syndication documentation
 
 .. _W3C Geo: https://www.w3.org/2003/01/geo/
 
-__ https://georss.org
+__ https://www.ogc.org/standard/georss/
 
 Example
 =======
diff --git a/docs/ref/models/fields.txt b/docs/ref/models/fields.txt
index 7374ea6b6374..139b338460d8 100644
--- a/docs/ref/models/fields.txt
+++ b/docs/ref/models/fields.txt
@@ -279,7 +279,7 @@ Django provides an ``IntegerChoices`` class. For example::
         suit = models.IntegerField(choices=Suit.choices)
 
 It is also possible to make use of the `Enum Functional API
-<https://docs.python.org/3/library/enum.html#functional-api>`_ with the caveat
+<https://docs.python.org/3/howto/enum.html#functional-api>`_ with the caveat
 that labels are automatically generated as highlighted above:
 
 .. code-block:: pycon

From cdd970ae22303e6c58b5c1f3ba695c470a811b56 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Wed, 17 May 2023 13:14:43 +0200
Subject: [PATCH 15/47] [4.2.x] Fixed #34568 -- Made makemigrations --update
 respect --name option.

Thanks David Sanders for the report.
Backport of c52f4295f254e1c14af769d22b1a5f516a941f58 from main
---
 .../management/commands/makemigrations.py     |  5 ++--
 docs/ref/django-admin.txt                     |  3 +++
 docs/releases/4.2.2.txt                       |  3 +++
 tests/migrations/test_commands.py             | 26 +++++++++++++++++++
 4 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/django/core/management/commands/makemigrations.py b/django/core/management/commands/makemigrations.py
index 284a95409f6b..35661d49972d 100644
--- a/django/core/management/commands/makemigrations.py
+++ b/django/core/management/commands/makemigrations.py
@@ -316,9 +316,8 @@ def write_to_last_migration_files(self, changes):
             )
             # Update name.
             previous_migration_path = MigrationWriter(leaf_migration).path
-            suggested_name = (
-                leaf_migration.name[:4] + "_" + leaf_migration.suggest_name()
-            )
+            name_fragment = self.migration_name or leaf_migration.suggest_name()
+            suggested_name = leaf_migration.name[:4] + f"_{name_fragment}"
             if leaf_migration.name == suggested_name:
                 new_name = leaf_migration.name + "_updated"
             else:
diff --git a/docs/ref/django-admin.txt b/docs/ref/django-admin.txt
index 5e1be0d206d7..1c43523d67ac 100644
--- a/docs/ref/django-admin.txt
+++ b/docs/ref/django-admin.txt
@@ -759,6 +759,9 @@ generated migration files to ``stdout``.
 Merges model changes into the latest migration and optimize the resulting
 operations.
 
+The updated migration will have a generated name. In order to preserve the
+previous name, set it using ``--name``.
+
 ``migrate``
 -----------
 
diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
index ca21e5f1ec94..7506b8a2371e 100644
--- a/docs/releases/4.2.2.txt
+++ b/docs/releases/4.2.2.txt
@@ -19,3 +19,6 @@ Bugfixes
 * Fixed a regression in Django 4.2 that caused a crash of ``QuerySet.defer()``
   when passing a ``ManyToManyField`` or ``GenericForeignKey`` reference. While
   doing so is a no-op, it was allowed in older version (:ticket:`34570`).
+
+* Fixed a bug in Django 4.2 where :option:`makemigrations --update` didn't
+  respect the ``--name`` option (:ticket:`34568`).
diff --git a/tests/migrations/test_commands.py b/tests/migrations/test_commands.py
index 0117d1e4aa33..cabf0ec71208 100644
--- a/tests/migrations/test_commands.py
+++ b/tests/migrations/test_commands.py
@@ -2649,6 +2649,32 @@ def test_makemigrations_update_existing_name(self):
                 self.assertNotEqual(initial_content, fp.read())
             self.assertIn(f"Deleted {migration_file}", out.getvalue())
 
+    def test_makemigrations_update_custom_name(self):
+        custom_name = "delete_something"
+        with self.temporary_migration_module(
+            module="migrations.test_migrations"
+        ) as migration_dir:
+            old_migration_file = os.path.join(migration_dir, "0002_second.py")
+            with open(old_migration_file) as fp:
+                initial_content = fp.read()
+
+            with captured_stdout() as out:
+                call_command(
+                    "makemigrations", "migrations", update=True, name=custom_name
+                )
+            self.assertFalse(
+                any(
+                    filename.startswith("0003")
+                    for filename in os.listdir(migration_dir)
+                )
+            )
+            self.assertIs(os.path.exists(old_migration_file), False)
+            new_migration_file = os.path.join(migration_dir, f"0002_{custom_name}.py")
+            self.assertIs(os.path.exists(new_migration_file), True)
+            with open(new_migration_file) as fp:
+                self.assertNotEqual(initial_content, fp.read())
+            self.assertIn(f"Deleted {old_migration_file}", out.getvalue())
+
     def test_makemigrations_update_applied_migration(self):
         recorder = MigrationRecorder(connection)
         recorder.record_applied("migrations", "0001_initial")

From e1c00f8b361bf89deb68733bbc5189734bbcd6b5 Mon Sep 17 00:00:00 2001
From: Simon Charette <charette.s@gmail.com>
Date: Sun, 21 May 2023 16:59:56 +0100
Subject: [PATCH 16/47] [4.2.x] Fixed #34580 -- Avoided unnecessary computation
 of selected expressions in SQLCompiler.

Performance regression in 278881e37619278789942513916acafaa88d26f3.

Co-authored-by: David Smith <smithdc@gmail.com>

Backport of 98f6ada0e2058d67d91fb6c16482411ec2ca0967 from main
---
 django/db/models/sql/compiler.py | 4 +++-
 docs/releases/4.2.2.txt          | 3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/django/db/models/sql/compiler.py b/django/db/models/sql/compiler.py
index 1c16217ae78f..3b438a1de67f 100644
--- a/django/db/models/sql/compiler.py
+++ b/django/db/models/sql/compiler.py
@@ -331,7 +331,9 @@ def _order_by_pairs(self):
             default_order, _ = ORDER_DIR["DESC"]
 
         selected_exprs = {}
-        if select := self.select:
+        # Avoid computing `selected_exprs` if there is no `ordering` as it's
+        # relatively expensive.
+        if ordering and (select := self.select):
             for ordinal, (expr, _, alias) in enumerate(select, start=1):
                 pos_expr = PositionRef(ordinal, alias, expr)
                 if alias:
diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
index 7506b8a2371e..475531b53136 100644
--- a/docs/releases/4.2.2.txt
+++ b/docs/releases/4.2.2.txt
@@ -22,3 +22,6 @@ Bugfixes
 
 * Fixed a bug in Django 4.2 where :option:`makemigrations --update` didn't
   respect the ``--name`` option (:ticket:`34568`).
+
+* Fixed a performance regression in Django 4.2 when compiling queries without
+  ordering (:ticket:`34580`).

From 6b76481fb968c3d35ee01af38a84d210c0623e62 Mon Sep 17 00:00:00 2001
From: gtleee <gtleee@hotmail.com>
Date: Mon, 22 May 2023 05:43:15 +0000
Subject: [PATCH 17/47] [4.2.x] Fixed #34588 -- Removed usage of nonexistent
 stylesheet in the 'Congrats' page.

Regression in d46cc15c51219c3418e0287bf018c5ba1346f825.

Backport of 0a324f1b66b9b948041b1c557fc18b3fb40743c4 from main
---
 django/views/templates/default_urlconf.html | 1 -
 docs/releases/4.2.2.txt                     | 3 +++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/django/views/templates/default_urlconf.html b/django/views/templates/default_urlconf.html
index bdef8b5a0a9e..c54ce842d1e7 100644
--- a/django/views/templates/default_urlconf.html
+++ b/django/views/templates/default_urlconf.html
@@ -6,7 +6,6 @@
         <meta charset="utf-8">
         <title>{% translate "The install worked successfully! Congratulations!" %}</title>
         <meta name="viewport" content="width=device-width, initial-scale=1">
-        <link rel="stylesheet" href="/static/admin/css/fonts.css">
         <style>
           html {
             line-height: 1.15;
diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
index 475531b53136..af2e60f2e7e6 100644
--- a/docs/releases/4.2.2.txt
+++ b/docs/releases/4.2.2.txt
@@ -25,3 +25,6 @@ Bugfixes
 
 * Fixed a performance regression in Django 4.2 when compiling queries without
   ordering (:ticket:`34580`).
+
+* Fixed a regression in Django 4.2 where nonexistent stylesheet was linked on a
+  “Congratulations!” page (:ticket:`34588`).

From 37ba4c3a94b0c2d3e98be11ea4ac27316efb5f5e Mon Sep 17 00:00:00 2001
From: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
Date: Mon, 22 May 2023 14:02:01 +0200
Subject: [PATCH 18/47] [4.2.x] Fixed references to django.core.cache in docs.

Backport of c3862735cd8c268e99fb8d54c3955aacc4f2dc25 from main
---
 docs/releases/2.1.txt | 2 +-
 docs/releases/3.1.txt | 2 +-
 docs/topics/cache.txt | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/releases/2.1.txt b/docs/releases/2.1.txt
index c46475947f56..e4a2788c8644 100644
--- a/docs/releases/2.1.txt
+++ b/docs/releases/2.1.txt
@@ -115,7 +115,7 @@ Cache
 * The :ref:`local-memory cache backend <local-memory-caching>` now uses a
   least-recently-used (LRU) culling strategy rather than a pseudo-random one.
 
-* The new :meth:`~django.core.caches.cache.touch` method of the :ref:`low-level
+* The new :meth:`~django.core.cache.cache.touch` method of the :ref:`low-level
   cache API <low-level-cache-api>` updates the timeout of cache keys.
 
 CSRF
diff --git a/docs/releases/3.1.txt b/docs/releases/3.1.txt
index 50430ec1be7b..cac75dcb4129 100644
--- a/docs/releases/3.1.txt
+++ b/docs/releases/3.1.txt
@@ -263,7 +263,7 @@ Cache
   field names in the ``no-cache`` directive for the ``Cache-Control`` header,
   according to :rfc:`7234#section-5.2.2.2`.
 
-* :meth:`~django.core.caches.cache.delete` now returns ``True`` if the key was
+* :meth:`~django.core.cache.cache.delete` now returns ``True`` if the key was
   successfully deleted, ``False`` otherwise.
 
 CSRF
diff --git a/docs/topics/cache.txt b/docs/topics/cache.txt
index 3c3aba898dbb..abdbea0e0ab5 100644
--- a/docs/topics/cache.txt
+++ b/docs/topics/cache.txt
@@ -900,7 +900,7 @@ Accessing the cache
 Basic usage
 -----------
 
-.. currentmodule:: django.core.caches
+.. currentmodule:: django.core.cache
 
 The basic interface is:
 

From b4563cdd23ef0361588430c1f51bea819b3e0692 Mon Sep 17 00:00:00 2001
From: Mohit Singh Sinsniwal <mohit.sinsniwal@gmail.com>
Date: Sat, 20 May 2023 04:55:41 +0530
Subject: [PATCH 19/47] [4.2.x] Fixed #34579 -- Added Django Forum to
 contributing guides.

Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>

Backport of 89f10a80d7e681cd0cccf22d932e380f51bd3524 from main
---
 .../contributing/bugs-and-features.txt        | 19 +++++++-------
 .../contributing/committing-code.txt          | 23 ++++++++--------
 .../contributing/triaging-tickets.txt         | 26 ++++++++++---------
 .../writing-code/submitting-patches.txt       |  4 ++-
 docs/internals/howto-release-django.txt       |  4 +--
 docs/intro/contributing.txt                   |  6 +++--
 6 files changed, 44 insertions(+), 38 deletions(-)

diff --git a/docs/internals/contributing/bugs-and-features.txt b/docs/internals/contributing/bugs-and-features.txt
index 2e5ca8de3401..b6b3265ba6bf 100644
--- a/docs/internals/contributing/bugs-and-features.txt
+++ b/docs/internals/contributing/bugs-and-features.txt
@@ -20,11 +20,11 @@ Otherwise, before reporting a bug or requesting a new feature on the
   |django-users| list or the `#django`_ IRC channel for that.
 
 * Don't reopen issues that have been marked "wontfix" without finding consensus
-  to do so on |django-developers|.
+  to do so on the `Django Forum`_ or |django-developers| list.
 
 * Don't use the ticket tracker for lengthy discussions, because they're
   likely to get lost. If a particular ticket is controversial, please move the
-  discussion to |django-developers|.
+  discussion to the `Django Forum`_ or |django-developers| list.
 
 .. _reporting-bugs:
 
@@ -94,11 +94,10 @@ part of that. Here are some tips on how to make a request most effectively:
   suggest that you develop it independently. Then, if your project gathers
   sufficient community support, we may consider it for inclusion in Django.
 
-* First request the feature on the |django-developers| list, not in the
-  ticket tracker. It'll get read more closely if it's on the mailing list.
-  This is even more important for large-scale feature requests. We like to
-  discuss any big changes to Django's core on the mailing list before
-  actually working on them.
+* First request the feature on the `Django Forum`_ or |django-developers| list,
+  not in the ticket tracker. It'll get read more closely if it's on the mailing
+  list. This is even more important for large-scale feature requests. We like
+  to discuss any big changes to Django's core before actually working on them.
 
 * Describe clearly and concisely what the missing feature is and how you'd
   like to see it implemented. Include example code (non-functional is OK)
@@ -109,8 +108,7 @@ part of that. Here are some tips on how to make a request most effectively:
   achieving the same thing.
 
 If there's a consensus agreement on the feature, then it's appropriate to
-create a ticket. Include a link to the discussion on |django-developers| in the
-ticket description.
+create a ticket. Include a link to the discussion in the ticket description.
 
 As with most open-source projects, code talks. If you are willing to write the
 code for the feature yourself or, even better, if you've already written it,
@@ -160,8 +158,9 @@ Since this process allows any steering council member to veto a proposal, a
 convert that "-1" into at least a "+0".
 
 Votes on technical matters should be announced and held in public on the
-|django-developers| mailing list or on the Django Forum.
+|django-developers| mailing list or on the `Django Forum`_.
 
 .. _searching: https://code.djangoproject.com/search
 .. _custom queries: https://code.djangoproject.com/query
 .. _#django: https://web.libera.chat/#django
+.. _Django Forum: https://forum.djangoproject.com/
diff --git a/docs/internals/contributing/committing-code.txt b/docs/internals/contributing/committing-code.txt
index f5be86238e33..91c6d21beb56 100644
--- a/docs/internals/contributing/committing-code.txt
+++ b/docs/internals/contributing/committing-code.txt
@@ -109,14 +109,14 @@ Django's Git repository:
   discuss the situation with the team.
 
 * For any medium-to-big changes, where "medium-to-big" is according to
-  your judgment, please bring things up on the |django-developers|
-  mailing list before making the change.
+  your judgment, please bring things up on the `Django Forum`_ or
+  |django-developers| mailing list before making the change.
 
-  If you bring something up on |django-developers| and nobody responds,
-  please don't take that to mean your idea is great and should be
-  implemented immediately because nobody contested it. Everyone doesn't always
-  have a lot of time to read mailing list discussions immediately, so you may
-  have to wait a couple of days before getting a response.
+  If you bring something up and nobody responds, please don't take that
+  to mean your idea is great and should be implemented immediately because
+  nobody contested it. Everyone doesn't always have a lot of time to read
+  mailing list discussions immediately, so you may have to wait a couple of
+  days before getting a response.
 
 * Write detailed commit messages in the past tense, not present tense.
 
@@ -227,15 +227,15 @@ When a mistaken commit is discovered, please follow these guidelines:
 
 * If the original author can't be reached (within a reasonable amount
   of time -- a day or so) and the problem is severe -- crashing bug,
-  major test failures, etc. -- then ask for objections on the
-  |django-developers| mailing list then revert if there are none.
+  major test failures, etc. -- then ask for objections on the `Django Forum`_
+  or |django-developers| mailing list then revert if there are none.
 
 * If the problem is small (a feature commit after feature freeze,
   say), wait it out.
 
 * If there's a disagreement between the merger and the reverter-to-be then try
-  to work it out on the |django-developers| mailing list. If an agreement can't
-  be reached then it should be put to a vote.
+  to work it out on the `Django Forum`_ or |django-developers| mailing list. If
+  an agreement can't be reached then it should be put to a vote.
 
 * If the commit introduced a confirmed, disclosed security
   vulnerability then the commit may be reverted immediately without
@@ -249,3 +249,4 @@ When a mistaken commit is discovered, please follow these guidelines:
   do a reverse push: ``git push upstream :feature_antigravity``.
 
 .. _ticket tracker: https://code.djangoproject.com/
+.. _Django Forum: https://forum.djangoproject.com/
diff --git a/docs/internals/contributing/triaging-tickets.txt b/docs/internals/contributing/triaging-tickets.txt
index c660c34e9172..74734050077a 100644
--- a/docs/internals/contributing/triaging-tickets.txt
+++ b/docs/internals/contributing/triaging-tickets.txt
@@ -308,11 +308,12 @@ A ticket can be resolved in a number of ways:
 * wontfix
       Used when someone decides that the request isn't appropriate for
       consideration in Django. Sometimes a ticket is closed as "wontfix" with a
-      request for the reporter to start a discussion on the |django-developers|
-      mailing list if they feel differently from the rationale provided by the
-      person who closed the ticket. Other times, a mailing list discussion
-      precedes the decision to close a ticket. Always use the mailing list to
-      get a consensus before reopening tickets closed as "wontfix".
+      request for the reporter to start a discussion on the `Django Forum`_ or
+      |django-developers| mailing list if they feel differently from the
+      rationale provided by the person who closed the ticket. Other times, a
+      discussion precedes the decision to close a ticket. Always use the forum
+      or mailing list to get a consensus before reopening tickets closed as
+      "wontfix".
 
 * duplicate
       Used when another ticket covers the same issue. By closing duplicate
@@ -332,7 +333,7 @@ If you believe that the ticket was closed in error -- because you're
 still having the issue, or it's popped up somewhere else, or the triagers have
 made a mistake -- please reopen the ticket and provide further information.
 Again, please do not reopen tickets that have been marked as "wontfix" and
-bring the issue to |django-developers| instead.
+bring the issue to the `Django Forum`_ or |django-developers| instead.
 
 .. _how-can-i-help-with-triaging:
 
@@ -353,7 +354,7 @@ Then, you can help out by:
 
 * Closing "Unreviewed" tickets as "needsinfo" when the description is too
   sparse to be actionable, or when they're feature requests requiring a
-  discussion on |django-developers|.
+  discussion on the `Django Forum`_ or |django-developers|.
 
 * Correcting the "Needs tests", "Needs documentation", or "Has patch"
   flags for tickets where they are incorrectly set.
@@ -371,7 +372,7 @@ Then, you can help out by:
   reports about a particular part of Django, it may indicate we should
   consider refactoring that part of the code. If a trend is emerging,
   you should raise it for discussion (referencing the relevant tickets)
-  on |django-developers|.
+  on the `Django Forum`_ or |django-developers|.
 
 * Verify if patches submitted by other users are correct. If they are correct
   and also contain appropriate documentation and tests then move them to the
@@ -397,18 +398,19 @@ the ticket database:
   checkin", but you should get at minimum one other community member to
   review a patch that you submit.
 
-* Please **don't** reverse a decision without posting a message to
-  |django-developers| to find consensus.
+* Please **don't** reverse a decision without posting a message to the
+  `Django Forum`_ or |django-developers| to find consensus.
 
 * If you're unsure if you should be making a change, don't make the
   change but instead leave a comment with your concerns on the ticket,
-  or post a message to |django-developers|. It's okay to be unsure,
-  but your input is still valuable.
+  or post a message to the `Django Forum`_ or |django-developers|. It's okay to
+  be unsure, but your input is still valuable.
 
 .. _Trac: https://code.djangoproject.com/
 .. _`easy pickings`: https://code.djangoproject.com/query?status=!closed&easy=1
 .. _`creating an account on Trac`: https://www.djangoproject.com/accounts/register/
 .. _password reset page: https://www.djangoproject.com/accounts/password/reset/
+.. _Django Forum: https://forum.djangoproject.com/
 
 Bisecting a regression
 ======================
diff --git a/docs/internals/contributing/writing-code/submitting-patches.txt b/docs/internals/contributing/writing-code/submitting-patches.txt
index 59c17ce9a385..be031f1f68c6 100644
--- a/docs/internals/contributing/writing-code/submitting-patches.txt
+++ b/docs/internals/contributing/writing-code/submitting-patches.txt
@@ -147,11 +147,13 @@ A "non-trivial" patch is one that is more than a small bug fix. It's a patch
 that introduces Django functionality and makes some sort of design decision.
 
 If you provide a non-trivial patch, include evidence that alternatives have
-been discussed on |django-developers|.
+been discussed on the `Django Forum`_ or |django-developers| list.
 
 If you're not sure whether your patch should be considered non-trivial, ask on
 the ticket for opinions.
 
+.. _Django Forum: https://forum.djangoproject.com/
+
 .. _deprecating-a-feature:
 
 Deprecating a feature
diff --git a/docs/internals/howto-release-django.txt b/docs/internals/howto-release-django.txt
index 4c86265ab38a..4b63f6ec82bc 100644
--- a/docs/internals/howto-release-django.txt
+++ b/docs/internals/howto-release-django.txt
@@ -402,8 +402,8 @@ Now you're ready to actually put the release out there. To do this:
    __ https://github.com/django/djangoproject.com/blob/main/djangoproject/static/robots.docs.txt
 
 #. Post the release announcement to the |django-announce|, |django-developers|,
-   and |django-users| mailing lists. This should include a link to the
-   announcement blog post.
+   |django-users| mailing lists, and the Django Forum. This should include a
+   link to the announcement blog post.
 
 #. If this is a security release, send a separate email to
    oss-security@lists.openwall.com. Provide a descriptive subject, for example,
diff --git a/docs/intro/contributing.txt b/docs/intro/contributing.txt
index c8601cb14d21..c9b5734569c5 100644
--- a/docs/intro/contributing.txt
+++ b/docs/intro/contributing.txt
@@ -41,11 +41,13 @@ so that it can be of use to the widest audience.
 .. admonition:: Where to get help:
 
     If you're having trouble going through this tutorial, please post a message
-    to |django-developers| or drop by `#django-dev on irc.libera.chat`__ to
-    chat with other Django users who might be able to help.
+    on the `Django Forum`_, |django-developers|, or drop by
+    `#django-dev on irc.libera.chat`__ to chat with other Django users who
+    might be able to help.
 
 __ https://diveinto.org/python3/table-of-contents.html
 __ https://web.libera.chat/#django-dev
+.. _Django Forum: https://forum.djangoproject.com/
 
 What does this tutorial cover?
 ------------------------------

From 57f499e412c7c28b4a1f1b740468bf6eabbdb695 Mon Sep 17 00:00:00 2001
From: Simon Charette <charette.s@gmail.com>
Date: Sun, 21 May 2023 23:49:05 -0400
Subject: [PATCH 20/47] [4.2.x] Refs #34551 -- Fixed QuerySet.aggregate() crash
 on precending aggregation reference.

Regression in 1297c0d0d76a708017fe196b61a0ab324df76954.

Refs #31679.

Backport of 2ee01747c32a7275a7a1a5f7862acba7db764921 from main
---
 django/db/models/aggregates.py |  9 ++++++++-
 django/db/models/sql/query.py  | 16 ++++++++++++++--
 docs/releases/4.2.2.txt        |  4 ++++
 tests/aggregation/tests.py     | 17 +++++++++++------
 4 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/django/db/models/aggregates.py b/django/db/models/aggregates.py
index e672f0aeb09c..a778cd413b3e 100644
--- a/django/db/models/aggregates.py
+++ b/django/db/models/aggregates.py
@@ -65,7 +65,14 @@ def resolve_expression(
         c.filter = c.filter and c.filter.resolve_expression(
             query, allow_joins, reuse, summarize
         )
-        if not summarize:
+        if summarize:
+            # Summarized aggregates cannot refer to summarized aggregates.
+            for ref in c.get_refs():
+                if query.annotations[ref].is_summary:
+                    raise FieldError(
+                        f"Cannot compute {c.name}('{ref}'): '{ref}' is an aggregate"
+                    )
+        elif not self.is_summary:
             # Call Aggregate.get_source_expressions() to avoid
             # returning self.filter and including that in this loop.
             expressions = super(Aggregate, c).get_source_expressions()
diff --git a/django/db/models/sql/query.py b/django/db/models/sql/query.py
index b615d06f28fb..8739a7b09c1a 100644
--- a/django/db/models/sql/query.py
+++ b/django/db/models/sql/query.py
@@ -387,7 +387,10 @@ def get_aggregation(self, using, aggregate_exprs):
         """
         if not aggregate_exprs:
             return {}
-        aggregates = {}
+        # Store annotation mask prior to temporarily adding aggregations for
+        # resolving purpose to facilitate their subsequent removal.
+        replacements = {}
+        annotation_select_mask = self.annotation_select_mask
         for alias, aggregate_expr in aggregate_exprs.items():
             self.check_alias(alias)
             aggregate = aggregate_expr.resolve_expression(
@@ -395,7 +398,16 @@ def get_aggregation(self, using, aggregate_exprs):
             )
             if not aggregate.contains_aggregate:
                 raise TypeError("%s is not an aggregate expression" % alias)
-            aggregates[alias] = aggregate
+            # Temporarily add aggregate to annotations to allow remaining
+            # members of `aggregates` to resolve against each others.
+            self.append_annotation_mask([alias])
+            aggregate = aggregate.replace_expressions(replacements)
+            self.annotations[alias] = aggregate
+            replacements[Ref(alias, aggregate)] = aggregate
+        # Stash resolved aggregates now that they have been allowed to resolve
+        # against each other.
+        aggregates = {alias: self.annotations.pop(alias) for alias in aggregate_exprs}
+        self.set_annotation_mask(annotation_select_mask)
         # Existing usage of aggregation can be determined by the presence of
         # selected aggregates but also by filters against aliased aggregates.
         _, having, qualify = self.where.split_having_qualify()
diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
index af2e60f2e7e6..d17fb7c2d3de 100644
--- a/docs/releases/4.2.2.txt
+++ b/docs/releases/4.2.2.txt
@@ -28,3 +28,7 @@ Bugfixes
 
 * Fixed a regression in Django 4.2 where nonexistent stylesheet was linked on a
   “Congratulations!” page (:ticket:`34588`).
+
+* Fixed a regression in Django 4.2 that caused a crash of
+  ``QuerySet.aggregate()`` with expressions referencing other aggregates
+  (:ticket:`34551`).
diff --git a/tests/aggregation/tests.py b/tests/aggregation/tests.py
index ae68c2456341..513545866861 100644
--- a/tests/aggregation/tests.py
+++ b/tests/aggregation/tests.py
@@ -1260,7 +1260,7 @@ def test_annotate_over_annotate(self):
         self.assertEqual(author.sum_age, other_author.sum_age)
 
     def test_aggregate_over_aggregate(self):
-        msg = "Cannot resolve keyword 'age_agg' into field."
+        msg = "Cannot compute Avg('age_agg'): 'age_agg' is an aggregate"
         with self.assertRaisesMessage(FieldError, msg):
             Author.objects.aggregate(
                 age_agg=Sum(F("age")),
@@ -2102,12 +2102,17 @@ def test_exists_extra_where_with_aggregate(self):
         )
         self.assertEqual(len(qs), 6)
 
-    def test_aggregation_over_annotation_shared_alias(self):
+    def test_multiple_aggregate_references(self):
+        aggregates = Author.objects.aggregate(
+            total_books=Count("book"),
+            coalesced_total_books=Coalesce("total_books", 0),
+        )
         self.assertEqual(
-            Publisher.objects.annotate(agg=Count("book__authors")).aggregate(
-                agg=Count("agg"),
-            ),
-            {"agg": 5},
+            aggregates,
+            {
+                "total_books": 10,
+                "coalesced_total_books": 10,
+            },
         )
 
 

From c78a4421de0fc3240b91d59e8f9028331777c624 Mon Sep 17 00:00:00 2001
From: Simon Charette <charette.s@gmail.com>
Date: Sun, 21 May 2023 23:57:49 -0400
Subject: [PATCH 21/47] [4.2.x] Fixed #34551 -- Fixed QuerySet.aggregate()
 crash when referencing subqueries.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Regression in 59bea9efd2768102fc9d3aedda469502c218e9b7.

Refs #28477.

Thanks Denis Roldán and Mariusz for the test.

Backport of e5c844d6f2a4ac6ae674d741b5f1fa2a688cedf4 from main
---
 django/db/models/expressions.py |  1 +
 django/db/models/sql/query.py   |  6 ++++++
 docs/releases/4.2.2.txt         |  4 ++++
 tests/aggregation/tests.py      | 20 ++++++++++++++++++++
 4 files changed, 31 insertions(+)

diff --git a/django/db/models/expressions.py b/django/db/models/expressions.py
index 3dfb21a8a4d1..b3fee9052d70 100644
--- a/django/db/models/expressions.py
+++ b/django/db/models/expressions.py
@@ -1506,6 +1506,7 @@ class Subquery(BaseExpression, Combinable):
     template = "(%(subquery)s)"
     contains_aggregate = False
     empty_result_set_value = None
+    subquery = True
 
     def __init__(self, queryset, output_field=None, **extra):
         # Allow the usage of both QuerySet and sql.Query objects.
diff --git a/django/db/models/sql/query.py b/django/db/models/sql/query.py
index 8739a7b09c1a..eda37d15f025 100644
--- a/django/db/models/sql/query.py
+++ b/django/db/models/sql/query.py
@@ -389,6 +389,7 @@ def get_aggregation(self, using, aggregate_exprs):
             return {}
         # Store annotation mask prior to temporarily adding aggregations for
         # resolving purpose to facilitate their subsequent removal.
+        refs_subquery = False
         replacements = {}
         annotation_select_mask = self.annotation_select_mask
         for alias, aggregate_expr in aggregate_exprs.items():
@@ -401,6 +402,10 @@ def get_aggregation(self, using, aggregate_exprs):
             # Temporarily add aggregate to annotations to allow remaining
             # members of `aggregates` to resolve against each others.
             self.append_annotation_mask([alias])
+            refs_subquery |= any(
+                getattr(self.annotations[ref], "subquery", False)
+                for ref in aggregate.get_refs()
+            )
             aggregate = aggregate.replace_expressions(replacements)
             self.annotations[alias] = aggregate
             replacements[Ref(alias, aggregate)] = aggregate
@@ -432,6 +437,7 @@ def get_aggregation(self, using, aggregate_exprs):
             isinstance(self.group_by, tuple)
             or self.is_sliced
             or has_existing_aggregation
+            or refs_subquery
             or qualify
             or self.distinct
             or self.combinator
diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
index d17fb7c2d3de..df3f2a2710d8 100644
--- a/docs/releases/4.2.2.txt
+++ b/docs/releases/4.2.2.txt
@@ -32,3 +32,7 @@ Bugfixes
 * Fixed a regression in Django 4.2 that caused a crash of
   ``QuerySet.aggregate()`` with expressions referencing other aggregates
   (:ticket:`34551`).
+
+* Fixed a regression in Django 4.2 that caused a crash of
+  ``QuerySet.aggregate()`` with aggregates referencing subqueries
+  (:ticket:`34551`).
diff --git a/tests/aggregation/tests.py b/tests/aggregation/tests.py
index 513545866861..366b8434e542 100644
--- a/tests/aggregation/tests.py
+++ b/tests/aggregation/tests.py
@@ -2187,3 +2187,23 @@ def test_referenced_group_by_annotation_kept(self):
             mod_count=Count("*")
         )
         self.assertEqual(queryset.count(), 1)
+
+    def test_referenced_subquery_requires_wrapping(self):
+        total_books_qs = (
+            Author.book_set.through.objects.values("author")
+            .filter(author=OuterRef("pk"))
+            .annotate(total=Count("book"))
+        )
+        with self.assertNumQueries(1) as ctx:
+            aggregate = (
+                Author.objects.annotate(
+                    total_books=Subquery(total_books_qs.values("total"))
+                )
+                .values("pk", "total_books")
+                .aggregate(
+                    sum_total_books=Sum("total_books"),
+                )
+            )
+        sql = ctx.captured_queries[0]["sql"].lower()
+        self.assertEqual(sql.count("select"), 3, "Subquery wrapping required")
+        self.assertEqual(aggregate, {"sum_total_books": 3})

From bf5249fc8e0dd6e0c4c3101fda500d6966b6dcfc Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Tue, 23 May 2023 12:56:33 +0200
Subject: [PATCH 22/47] [4.2.x] Refs #34118 -- Fixed
 FunctionalTests.test_cached_property_reuse_different_names() on Python 3.12+.

Python 3.12+ no longer wraps exceptions in __set_name__, see
https://github.com/python/cpython/commit/55c99d97e14618dfce41472dd4446f763b0da13f
Backport of fc9c90d9c4611d441d2617a7d74f622b1f520f7c from main
---
 tests/utils_tests/test_functional.py | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/tests/utils_tests/test_functional.py b/tests/utils_tests/test_functional.py
index 1e403f351b96..803978e6047a 100644
--- a/tests/utils_tests/test_functional.py
+++ b/tests/utils_tests/test_functional.py
@@ -4,6 +4,7 @@
 from django.test.utils import ignore_warnings
 from django.utils.deprecation import RemovedInDjango50Warning
 from django.utils.functional import cached_property, classproperty, lazy
+from django.utils.version import PY312
 
 
 class FunctionalTests(SimpleTestCase):
@@ -156,7 +157,18 @@ def other_value(self):
 
     def test_cached_property_reuse_different_names(self):
         """Disallow this case because the decorated function wouldn't be cached."""
-        with self.assertRaises(RuntimeError) as ctx:
+        type_msg = (
+            "Cannot assign the same cached_property to two different names ('a' and "
+            "'b')."
+        )
+        if PY312:
+            error_type = TypeError
+            msg = type_msg
+        else:
+            error_type = RuntimeError
+            msg = "Error calling __set_name__"
+
+        with self.assertRaisesMessage(error_type, msg) as ctx:
 
             class ReusedCachedProperty:
                 @cached_property
@@ -165,15 +177,8 @@ def a(self):
 
                 b = a
 
-        self.assertEqual(
-            str(ctx.exception.__context__),
-            str(
-                TypeError(
-                    "Cannot assign the same cached_property to two different "
-                    "names ('a' and 'b')."
-                )
-            ),
-        )
+        if not PY312:
+            self.assertEqual(str(ctx.exception.__context__), str(TypeError(type_msg)))
 
     def test_cached_property_reuse_same_name(self):
         """

From a44e974412e1f1172fd3948cdaf03eb2f79cf693 Mon Sep 17 00:00:00 2001
From: Stefan Brand <StefanBrand@users.noreply.github.com>
Date: Wed, 24 May 2023 05:29:50 +0200
Subject: [PATCH 23/47] [4.2.x] Corrected documentation of Log database
 function.

Backport of eb9df03a43f34c44131ec3a295643327b8a68bb4 from main
---
 docs/ref/models/database-functions.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/ref/models/database-functions.txt b/docs/ref/models/database-functions.txt
index 9a3f17325ce8..c99f6714c98a 100644
--- a/docs/ref/models/database-functions.txt
+++ b/docs/ref/models/database-functions.txt
@@ -1215,7 +1215,7 @@ It can also be registered as a transform. For example:
 .. class:: Log(expression1, expression2, **extra)
 
 Accepts two numeric fields or expressions and returns the logarithm of
-the first to base of the second.
+the second to base of the first.
 
 Usage example:
 

From 91f8df5c2e711ff4b3d10602181d8a6daa62a93a Mon Sep 17 00:00:00 2001
From: David Sanders <shang.xiao.sanders@gmail.com>
Date: Wed, 24 May 2023 18:59:55 +1000
Subject: [PATCH 24/47] [4.2.x] Fixed #34590 -- Reverted "Refs #33308 --
 Improved adapting DecimalField values to decimal."

This reverts 7990d254b0af158baf827fafbd90fe8e890f23bd.

Thanks Marc Odermatt for the report.
Backport of 0c1518ee429b01c145cf5b34eab01b0b92f8c246 from main
---
 django/db/models/fields/__init__.py     | 6 ++----
 docs/releases/4.2.2.txt                 | 4 ++++
 tests/model_fields/test_decimalfield.py | 5 ++++-
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/django/db/models/fields/__init__.py b/django/db/models/fields/__init__.py
index 060e1be60576..b65948d783ae 100644
--- a/django/db/models/fields/__init__.py
+++ b/django/db/models/fields/__init__.py
@@ -1753,13 +1753,11 @@ def to_python(self, value):
             )
         return decimal_value
 
-    def get_db_prep_value(self, value, connection, prepared=False):
-        if not prepared:
-            value = self.get_prep_value(value)
+    def get_db_prep_save(self, value, connection):
         if hasattr(value, "as_sql"):
             return value
         return connection.ops.adapt_decimalfield_value(
-            value, self.max_digits, self.decimal_places
+            self.to_python(value), self.max_digits, self.decimal_places
         )
 
     def get_prep_value(self, value):
diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
index df3f2a2710d8..fef5d8d364e5 100644
--- a/docs/releases/4.2.2.txt
+++ b/docs/releases/4.2.2.txt
@@ -36,3 +36,7 @@ Bugfixes
 * Fixed a regression in Django 4.2 that caused a crash of
   ``QuerySet.aggregate()`` with aggregates referencing subqueries
   (:ticket:`34551`).
+
+* Fixed a regression in Django 4.2 that caused a crash of querysets on SQLite
+  when filtering on ``DecimalField`` against values outside of the defined
+  range (:ticket:`34590`).
diff --git a/tests/model_fields/test_decimalfield.py b/tests/model_fields/test_decimalfield.py
index 88c6878f5901..588bb64a3a12 100644
--- a/tests/model_fields/test_decimalfield.py
+++ b/tests/model_fields/test_decimalfield.py
@@ -91,7 +91,10 @@ def test_lookup_really_big_value(self):
         Really big values can be used in a filter statement.
         """
         # This should not crash.
-        Foo.objects.filter(d__gte=100000000000)
+        self.assertSequenceEqual(Foo.objects.filter(d__gte=100000000000), [])
+
+    def test_lookup_decimal_larger_than_max_digits(self):
+        self.assertSequenceEqual(Foo.objects.filter(d__lte=Decimal("123456")), [])
 
     def test_max_digits_validation(self):
         field = models.DecimalField(max_digits=2)

From 25bd9faf327c7c0a45b9ca6e0ea678d898af8838 Mon Sep 17 00:00:00 2001
From: Natalia <124304+nessita@users.noreply.github.com>
Date: Wed, 24 May 2023 13:59:00 -0300
Subject: [PATCH 25/47] [4.2.x] Fixed #34574 -- Noted unexpected outcomes in
 autoescape/escape docs.

Backport of 1a59a324cec5caf12ea0c4947564828aa7bda02a from main.
---
 docs/ref/templates/builtins.txt | 46 ++++++++++++++++++++++++++-------
 docs/spelling_wordlist          |  1 +
 2 files changed, 38 insertions(+), 9 deletions(-)

diff --git a/docs/ref/templates/builtins.txt b/docs/ref/templates/builtins.txt
index 853a62e71962..2677e3581508 100644
--- a/docs/ref/templates/builtins.txt
+++ b/docs/ref/templates/builtins.txt
@@ -21,15 +21,6 @@ Controls the current auto-escaping behavior. This tag takes either ``on`` or
 ``off`` as an argument and that determines whether auto-escaping is in effect
 inside the block. The block is closed with an ``endautoescape`` ending tag.
 
-When auto-escaping is in effect, all variable content has HTML escaping applied
-to it before placing the result into the output (but after any filters have
-been applied). This is equivalent to manually applying the :tfilter:`escape`
-filter to each variable.
-
-The only exceptions are variables that are already marked as "safe" from
-escaping, either by the code that populated the variable, or because it has had
-the :tfilter:`safe` or :tfilter:`escape` filters applied.
-
 Sample usage:
 
 .. code-block:: html+django
@@ -38,6 +29,33 @@ Sample usage:
         {{ body }}
     {% endautoescape %}
 
+When auto-escaping is in effect, all content derived from variables has HTML
+escaping applied before placing the result into the output (but after any
+filters are applied). This is equivalent to manually applying the
+:tfilter:`escape` filter to each variable.
+
+The only exceptions are variables already marked as "safe" from escaping.
+Variables could be marked as "safe" by the code which populated the variable,
+by applying the :tfilter:`safe` or :tfilter:`escape` filters, or because it's
+the result of a previous filter that marked the string as "safe".
+
+Within the scope of disabled auto-escaping, chaining filters, including
+:tfilter:`escape`, may cause unexpected (but documented) results such as the
+following:
+
+.. code-block:: html+django
+
+    {% autoescape off %}
+        {{ my_list|join:", "|escape }}
+    {% endautoescape %}
+
+The above code will output the joined elements of ``my_list`` unescaped. This
+is because the filter chaining sequence executes first :tfilter:`join` on
+``my_list`` (without applying escaping to each item since ``autoescape`` is
+``off``), marking the result as safe. Subsequently, this safe result will be
+fed to :tfilter:`escape` filter, which does not apply a second round of
+escaping.
+
 .. templatetag:: block
 
 ``block``
@@ -1832,6 +1850,16 @@ For example, you can apply ``escape`` to fields when :ttag:`autoescape` is off:
         {{ title|escape }}
     {% endautoescape %}
 
+.. admonition:: Chaining ``escape`` with other filters
+
+    As mentioned in the :ttag:`autoescape` section, when filters including
+    ``escape`` are chained together, it can result in unexpected outcomes if
+    preceding filters mark a potentially unsafe string as safe due to the lack
+    of escaping caused by :ttag:`autoescape` being ``off``.
+
+    In such cases, chaining ``escape`` would not reescape strings that have
+    already been marked as safe.
+
 .. templatefilter:: escapejs
 
 ``escapejs``
diff --git a/docs/spelling_wordlist b/docs/spelling_wordlist
index 4ed4f49cf2e6..26d777ab6842 100644
--- a/docs/spelling_wordlist
+++ b/docs/spelling_wordlist
@@ -415,6 +415,7 @@ redisplayed
 redisplaying
 redisplays
 reenable
+reescape
 referer
 referers
 reflow

From dca5f5d58af8b8d82c96bdf3d28be74886bb955f Mon Sep 17 00:00:00 2001
From: Akash Kumar Sen <Akash-Kumar-Sen@users.noreply.github.com>
Date: Wed, 31 May 2023 13:02:45 +0530
Subject: [PATCH 26/47] [4.2.x] Fixed #34600 -- Removed references to bleach in
 docs.

Backport of b0a6cc7f5738d6b959faf10354b772338f611fd9 from main
---
 docs/ref/templates/builtins.txt | 5 +----
 docs/ref/utils.txt              | 4 ++--
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/docs/ref/templates/builtins.txt b/docs/ref/templates/builtins.txt
index 2677e3581508..bee78073a237 100644
--- a/docs/ref/templates/builtins.txt
+++ b/docs/ref/templates/builtins.txt
@@ -2482,10 +2482,7 @@ output will be ``"Joel is a slug"``.
     Note that ``striptags`` doesn't give any guarantee about its output being
     HTML safe, particularly with non valid HTML input. So **NEVER** apply the
     ``safe`` filter to a ``striptags`` output. If you are looking for something
-    more robust, you can use the ``bleach`` Python library, notably its
-    `clean`_ method.
-
-.. _clean: https://bleach.readthedocs.io/en/latest/clean.html
+    more robust, consider using a third-party HTML sanitizing tool.
 
 .. templatefilter:: time
 
diff --git a/docs/ref/utils.txt b/docs/ref/utils.txt
index 644532f6210a..22d52acbfe3c 100644
--- a/docs/ref/utils.txt
+++ b/docs/ref/utils.txt
@@ -707,8 +707,8 @@ escaping HTML.
     If ``value`` is ``"<b>Joel</b> <button>is</button> a <span>slug</span>"``
     the return value will be ``"Joel is a slug"``.
 
-    If you are looking for a more robust solution, take a look at the
-    :pypi:`bleach` Python package.
+    If you are looking for a more robust solution, consider using a third-party
+    HTML sanitizing tool.
 
 .. function:: html_safe()
 

From dae052d823dd66edcd0dd7fe5542d2c6a3a498d0 Mon Sep 17 00:00:00 2001
From: AP Jama <apjama@icloud.com>
Date: Thu, 1 Jun 2023 10:23:53 +0000
Subject: [PATCH 27/47] [4.2.x] Fixed #34595 -- Doc'd that format_string arg of
 format_html() is not escaped.

Backport of 4037223d0f12c44ecd6f369ccbabcbd279a1bdbc from main
---
 docs/ref/utils.txt | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/ref/utils.txt b/docs/ref/utils.txt
index 22d52acbfe3c..b2b826684dba 100644
--- a/docs/ref/utils.txt
+++ b/docs/ref/utils.txt
@@ -617,8 +617,10 @@ escaping HTML.
 .. function:: format_html(format_string, *args, **kwargs)
 
     This is similar to :meth:`str.format`, except that it is appropriate for
-    building up HTML fragments. All args and kwargs are passed through
+    building up HTML fragments. The first argument ``format_string`` is not
+    escaped but all other args and kwargs are passed through
     :func:`conditional_escape` before being passed to ``str.format()``.
+    Finally, the output has :func:`~django.utils.safestring.mark_safe` applied.
 
     For the case of building up small HTML fragments, this function is to be
     preferred over string interpolation using ``%`` or ``str.format()``

From 738386470d899c61cb1980233c1e7872ba78e679 Mon Sep 17 00:00:00 2001
From: Simon Charette <charette.s@gmail.com>
Date: Wed, 31 May 2023 18:04:17 -0400
Subject: [PATCH 28/47] [4.2.x] Fixed #34612 -- Fixed QuerySet.only() crash on
 reverse relationships.

Regression in b3db6c8dcb5145f7d45eff517bcd96460475c879.

Thanks Ian Cubitt for the report.

This also corrected test_inheritance_deferred2() test which was
previously properly defined and marked as an expected failure but was
then wrongly adjusted to mask the lack of support for per-alias
deferral that was fixed by #21204.

Backport of 2cf76f2d5d1aa16acfadaf53db3d30128a34b088 from main
---
 django/db/models/sql/query.py          |  8 +++++++-
 docs/releases/4.2.2.txt                |  3 +++
 tests/defer_regress/tests.py           | 10 ++++++++++
 tests/select_related_onetoone/tests.py |  3 +++
 4 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/django/db/models/sql/query.py b/django/db/models/sql/query.py
index eda37d15f025..97c0bb4a08a4 100644
--- a/django/db/models/sql/query.py
+++ b/django/db/models/sql/query.py
@@ -766,7 +766,13 @@ def _get_only_select_mask(self, opts, mask, select_mask=None):
         # Only include fields mentioned in the mask.
         for field_name, field_mask in mask.items():
             field = opts.get_field(field_name)
-            field_select_mask = select_mask.setdefault(field, {})
+            # Retrieve the actual field associated with reverse relationships
+            # as that's what is expected in the select mask.
+            if field in opts.related_objects:
+                field_key = field.field
+            else:
+                field_key = field
+            field_select_mask = select_mask.setdefault(field_key, {})
             if field_mask:
                 if not field.is_relation:
                     raise FieldError(next(iter(field_mask)))
diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
index fef5d8d364e5..1bada4073baa 100644
--- a/docs/releases/4.2.2.txt
+++ b/docs/releases/4.2.2.txt
@@ -20,6 +20,9 @@ Bugfixes
   when passing a ``ManyToManyField`` or ``GenericForeignKey`` reference. While
   doing so is a no-op, it was allowed in older version (:ticket:`34570`).
 
+* Fixed a regression in Django 4.2 that caused a crash of ``QuerySet.only()``
+  when passing a reverse ``OneToOneField`` reference (:ticket:`34612`).
+
 * Fixed a bug in Django 4.2 where :option:`makemigrations --update` didn't
   respect the ``--name`` option (:ticket:`34568`).
 
diff --git a/tests/defer_regress/tests.py b/tests/defer_regress/tests.py
index ab2be085c6a7..0d389777a167 100644
--- a/tests/defer_regress/tests.py
+++ b/tests/defer_regress/tests.py
@@ -203,6 +203,16 @@ def test_reverse_one_to_one_relations(self):
             self.assertEqual(i.one_to_one_item.name, "second")
         with self.assertNumQueries(1):
             self.assertEqual(i.value, 42)
+        with self.assertNumQueries(1):
+            i = Item.objects.select_related("one_to_one_item").only(
+                "name", "one_to_one_item__item"
+            )[0]
+            self.assertEqual(i.one_to_one_item.pk, o2o.pk)
+            self.assertEqual(i.name, "first")
+        with self.assertNumQueries(1):
+            self.assertEqual(i.one_to_one_item.name, "second")
+        with self.assertNumQueries(1):
+            self.assertEqual(i.value, 42)
 
     def test_defer_with_select_related(self):
         item1 = Item.objects.create(name="first", value=47)
diff --git a/tests/select_related_onetoone/tests.py b/tests/select_related_onetoone/tests.py
index 8bdfb83fe85f..83462ed07166 100644
--- a/tests/select_related_onetoone/tests.py
+++ b/tests/select_related_onetoone/tests.py
@@ -249,6 +249,9 @@ def test_inheritance_deferred2(self):
             self.assertEqual(p.child1.name2, "n2")
         p = qs.get(name2="n2")
         with self.assertNumQueries(0):
+            self.assertEqual(p.child1.value, 1)
+            self.assertEqual(p.child1.child4.value4, 4)
+        with self.assertNumQueries(2):
             self.assertEqual(p.child1.name1, "n1")
             self.assertEqual(p.child1.child4.name1, "n1")
 

From 92ad551afd51d0d3691ed5c83cf46c656664b1e5 Mon Sep 17 00:00:00 2001
From: DevilsAutumn <bhuvnesh875@gmail.com>
Date: Tue, 16 May 2023 15:29:01 +0530
Subject: [PATCH 29/47] [4.2.x] Fixed #23528 -- Doc'd
 django.db.migrations.swappable_dependency().

Backport of 7d96ce68ae2c1bab1f2ab64ddc2b2c6004278af0 from main
---
 docs/topics/migrations.txt | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/docs/topics/migrations.txt b/docs/topics/migrations.txt
index 884a884d116f..b62472266c5d 100644
--- a/docs/topics/migrations.txt
+++ b/docs/topics/migrations.txt
@@ -218,6 +218,26 @@ Apps without migrations must not have relations (``ForeignKey``,
 ``ManyToManyField``, etc.) to apps with migrations. Sometimes it may work, but
 it's not supported.
 
+Swappable dependencies
+----------------------
+
+.. function:: django.db.migrations.swappable_dependency(value)
+
+The ``swappable_dependency()`` function is used in migrations to declare
+"swappable" dependencies on migrations in the app of the swapped-in model.
+Currently, the first migration of this app and as a consequence the swapped-in
+model should be created in the initial migration. The argument ``value`` is a
+string ``"<app label>.<model>"`` describing an app label and a model name, e.g.
+``"myapp.MyModel"``.
+
+By using ``swappable_dependency()``, you inform the migration framework that
+the migration relies on a migration which sets up up a swappable model,
+allowing for the possibility of substituting the model with a different
+implementation in the future. This is typically used for referencing models
+that are subject to customization or replacement, such as the custom user
+model (``settings.AUTH_USER_MODEL``, which defaults to ``"auth.User"``) in
+Django's authentication system.
+
 .. _migration-files:
 
 Migration files

From 66d9fa43718461de1d083650a4fee1b16ba80f91 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Sat, 3 Jun 2023 11:01:15 +0100
Subject: [PATCH 30/47] [4.2.x] Refs #23528 -- Made cosmetic edits to
 swappable_dependency() docs.

Backport of 1136aa5005f0ae70fea12796b7e37d6f027b9263 from main
---
 docs/topics/migrations.txt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/topics/migrations.txt b/docs/topics/migrations.txt
index b62472266c5d..3f5ccb53184f 100644
--- a/docs/topics/migrations.txt
+++ b/docs/topics/migrations.txt
@@ -224,14 +224,14 @@ Swappable dependencies
 .. function:: django.db.migrations.swappable_dependency(value)
 
 The ``swappable_dependency()`` function is used in migrations to declare
-"swappable" dependencies on migrations in the app of the swapped-in model.
-Currently, the first migration of this app and as a consequence the swapped-in
+"swappable" dependencies on migrations in the app of the swapped-in model,
+currently, on the first migration of this app. As a consequence, the swapped-in
 model should be created in the initial migration. The argument ``value`` is a
 string ``"<app label>.<model>"`` describing an app label and a model name, e.g.
 ``"myapp.MyModel"``.
 
 By using ``swappable_dependency()``, you inform the migration framework that
-the migration relies on a migration which sets up up a swappable model,
+the migration relies on another migration which sets up a swappable model,
 allowing for the possibility of substituting the model with a different
 implementation in the future. This is typically used for referencing models
 that are subject to customization or replacement, such as the custom user

From 87a4cd559bc47a53c717a45a8b0a181681fe8a32 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Sun, 4 Jun 2023 20:49:07 +0200
Subject: [PATCH 31/47] [4.2.x] Fixed #34620 -- Fixed serialization crash on
 m2m fields without natural keys when base querysets use select_related().

Regression in 19e0587ee596debf77540d6a08ccb6507e60b6a7.

Thanks Martin Svoboda for the report.
Backport of f9936deed1ff13b20e18bd9ca2b0750b52706b6c from main
---
 django/core/serializers/python.py         |  4 +++-
 django/core/serializers/xml_serializer.py |  4 +++-
 docs/releases/4.2.2.txt                   |  4 ++++
 tests/serializers/models/base.py          | 12 ++++++++++++
 tests/serializers/test_json.py            |  3 ++-
 tests/serializers/test_jsonl.py           |  3 ++-
 tests/serializers/test_xml.py             |  1 +
 tests/serializers/test_yaml.py            |  1 +
 tests/serializers/tests.py                | 16 ++++++++++------
 9 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/django/core/serializers/python.py b/django/core/serializers/python.py
index 36048601afd2..0dc504aa34e1 100644
--- a/django/core/serializers/python.py
+++ b/django/core/serializers/python.py
@@ -79,7 +79,9 @@ def m2m_value(value):
                     return self._value_from_field(value, value._meta.pk)
 
                 def queryset_iterator(obj, field):
-                    return getattr(obj, field.name).only("pk").iterator()
+                    return (
+                        getattr(obj, field.name).select_related().only("pk").iterator()
+                    )
 
             m2m_iter = getattr(obj, "_prefetched_objects_cache", {}).get(
                 field.name,
diff --git a/django/core/serializers/xml_serializer.py b/django/core/serializers/xml_serializer.py
index 1d3269c41a5c..e0129a59bb80 100644
--- a/django/core/serializers/xml_serializer.py
+++ b/django/core/serializers/xml_serializer.py
@@ -155,7 +155,9 @@ def handle_m2m(value):
                     self.xml.addQuickElement("object", attrs={"pk": str(value.pk)})
 
                 def queryset_iterator(obj, field):
-                    return getattr(obj, field.name).only("pk").iterator()
+                    return (
+                        getattr(obj, field.name).select_related().only("pk").iterator()
+                    )
 
             m2m_iter = getattr(obj, "_prefetched_objects_cache", {}).get(
                 field.name,
diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
index 1bada4073baa..9b7d6c1b66e6 100644
--- a/docs/releases/4.2.2.txt
+++ b/docs/releases/4.2.2.txt
@@ -43,3 +43,7 @@ Bugfixes
 * Fixed a regression in Django 4.2 that caused a crash of querysets on SQLite
   when filtering on ``DecimalField`` against values outside of the defined
   range (:ticket:`34590`).
+
+* Fixed a regression in Django 4.2 that caused a serialization crash on a
+  ``ManyToManyField`` without a natural key when its ``Manager``’s base
+  ``QuerySet`` used ``select_related()`` (:ticket:`34620`).
diff --git a/tests/serializers/models/base.py b/tests/serializers/models/base.py
index af9ca2b20a5d..e9f548ad3c64 100644
--- a/tests/serializers/models/base.py
+++ b/tests/serializers/models/base.py
@@ -53,12 +53,24 @@ def __str__(self):
         return self.name
 
 
+class TopicManager(models.Manager):
+    def get_queryset(self):
+        return super().get_queryset().select_related("category")
+
+
+class Topic(models.Model):
+    name = models.CharField(max_length=255)
+    category = models.ForeignKey(Category, models.CASCADE, null=True)
+    objects = TopicManager()
+
+
 class Article(models.Model):
     author = models.ForeignKey(Author, models.CASCADE)
     headline = models.CharField(max_length=50)
     pub_date = models.DateTimeField()
     categories = models.ManyToManyField(Category)
     meta_data = models.ManyToManyField(CategoryMetaData)
+    topics = models.ManyToManyField(Topic)
 
     class Meta:
         ordering = ("pub_date",)
diff --git a/tests/serializers/test_json.py b/tests/serializers/test_json.py
index 0c625684acad..65d521faacb1 100644
--- a/tests/serializers/test_json.py
+++ b/tests/serializers/test_json.py
@@ -38,7 +38,8 @@ class JsonSerializerTestCase(SerializersTestBase, TestCase):
       %(first_category_pk)s,
       %(second_category_pk)s
     ],
-    "meta_data": []
+    "meta_data": [],
+    "topics": []
   }
 }
 ]
diff --git a/tests/serializers/test_jsonl.py b/tests/serializers/test_jsonl.py
index 16a0759e7439..3137b037a982 100644
--- a/tests/serializers/test_jsonl.py
+++ b/tests/serializers/test_jsonl.py
@@ -27,7 +27,8 @@ class JsonlSerializerTestCase(SerializersTestBase, TestCase):
         '"headline": "Poker has no place on ESPN",'
         '"pub_date": "2006-06-16T11:00:00",'
         '"categories": [%(first_category_pk)s,%(second_category_pk)s],'
-        '"meta_data": []}}\n'
+        '"meta_data": [],'
+        '"topics": []}}\n'
     )
 
     @staticmethod
diff --git a/tests/serializers/test_xml.py b/tests/serializers/test_xml.py
index 5d8b9c04ccce..c9df2f2a5bc5 100644
--- a/tests/serializers/test_xml.py
+++ b/tests/serializers/test_xml.py
@@ -26,6 +26,7 @@ class XmlSerializerTestCase(SerializersTestBase, TestCase):
     <field name="pub_date" type="DateTimeField">2006-06-16T11:00:00</field>
     <field name="categories" rel="ManyToManyRel" to="serializers.category"><object pk="%(first_category_pk)s"></object><object pk="%(second_category_pk)s"></object></field>
     <field name="meta_data" rel="ManyToManyRel" to="serializers.categorymetadata"></field>
+    <field name="topics" rel="ManyToManyRel" to="serializers.topic"></field>
   </object>
 </django-objects>"""  # NOQA
 
diff --git a/tests/serializers/test_yaml.py b/tests/serializers/test_yaml.py
index 683e0e06889f..6db6f046fd49 100644
--- a/tests/serializers/test_yaml.py
+++ b/tests/serializers/test_yaml.py
@@ -113,6 +113,7 @@ class YamlSerializerTestCase(SerializersTestBase, TestCase):
         )
         + """
     meta_data: []
+    topics: []
 """
     )
 
diff --git a/tests/serializers/tests.py b/tests/serializers/tests.py
index 8656137c2019..3847df477fb6 100644
--- a/tests/serializers/tests.py
+++ b/tests/serializers/tests.py
@@ -279,14 +279,14 @@ def test_serialize_superfluous_queries(self):
     def test_serialize_prefetch_related_m2m(self):
         # One query for the Article table and one for each prefetched m2m
         # field.
-        with self.assertNumQueries(3):
+        with self.assertNumQueries(4):
             serializers.serialize(
                 self.serializer_name,
-                Article.objects.prefetch_related("categories", "meta_data"),
+                Article.objects.prefetch_related("categories", "meta_data", "topics"),
             )
-        # One query for the Article table, and two m2m queries for each
+        # One query for the Article table, and three m2m queries for each
         # article.
-        with self.assertNumQueries(5):
+        with self.assertNumQueries(7):
             serializers.serialize(self.serializer_name, Article.objects.all())
 
     def test_serialize_with_null_pk(self):
@@ -411,7 +411,7 @@ def test_serialize_inherited_fields(self):
         self.assertEqual(self._get_field_values(child_data, "parent_data"), [])
 
     def test_serialize_only_pk(self):
-        with self.assertNumQueries(5) as ctx:
+        with self.assertNumQueries(7) as ctx:
             serializers.serialize(
                 self.serializer_name,
                 Article.objects.all(),
@@ -422,9 +422,11 @@ def test_serialize_only_pk(self):
         self.assertNotIn(connection.ops.quote_name("meta_data_id"), categories_sql)
         meta_data_sql = ctx[2]["sql"]
         self.assertNotIn(connection.ops.quote_name("kind"), meta_data_sql)
+        topics_data_sql = ctx[3]["sql"]
+        self.assertNotIn(connection.ops.quote_name("category_id"), topics_data_sql)
 
     def test_serialize_no_only_pk_with_natural_keys(self):
-        with self.assertNumQueries(5) as ctx:
+        with self.assertNumQueries(7) as ctx:
             serializers.serialize(
                 self.serializer_name,
                 Article.objects.all(),
@@ -436,6 +438,8 @@ def test_serialize_no_only_pk_with_natural_keys(self):
         # CategoryMetaData has natural_key().
         meta_data_sql = ctx[2]["sql"]
         self.assertIn(connection.ops.quote_name("kind"), meta_data_sql)
+        topics_data_sql = ctx[3]["sql"]
+        self.assertNotIn(connection.ops.quote_name("category_id"), topics_data_sql)
 
 
 class SerializerAPITests(SimpleTestCase):

From e84d38ab36137bbcb4daa4c4c17c42a28236bee7 Mon Sep 17 00:00:00 2001
From: Natalia <124304+nessita@users.noreply.github.com>
Date: Mon, 5 Jun 2023 08:21:56 -0300
Subject: [PATCH 32/47] [4.2.x] Added release date for 4.2.2.

Backport of 0faad0193815c5f07a08dba4eaa04193ca9eb268 from main
---
 docs/releases/4.2.2.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/releases/4.2.2.txt b/docs/releases/4.2.2.txt
index 9b7d6c1b66e6..7dc86e053978 100644
--- a/docs/releases/4.2.2.txt
+++ b/docs/releases/4.2.2.txt
@@ -2,7 +2,7 @@
 Django 4.2.2 release notes
 ==========================
 
-*Expected June 5, 2023*
+*June 5, 2023*
 
 Django 4.2.2 fixes several bugs in 4.2.1.
 

From 6218ed34541bfc1e49c0f169c5b3a216a63cd985 Mon Sep 17 00:00:00 2001
From: Natalia <124304+nessita@users.noreply.github.com>
Date: Mon, 5 Jun 2023 08:31:58 -0300
Subject: [PATCH 33/47] [4.2.x] Bumped version for 4.2.2 release.

---
 django/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/django/__init__.py b/django/__init__.py
index addd783d90f7..21e9e7a31ff7 100644
--- a/django/__init__.py
+++ b/django/__init__.py
@@ -1,6 +1,6 @@
 from django.utils.version import get_version
 
-VERSION = (4, 2, 2, "alpha", 0)
+VERSION = (4, 2, 2, "final", 0)
 
 __version__ = get_version(VERSION)
 

From 10de2140559ba8e7614f9d27094a20bf75c7234d Mon Sep 17 00:00:00 2001
From: Natalia <124304+nessita@users.noreply.github.com>
Date: Mon, 5 Jun 2023 13:21:43 -0300
Subject: [PATCH 34/47] [4.2.x] Post-release version bump.

---
 django/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/django/__init__.py b/django/__init__.py
index 21e9e7a31ff7..457dfc7de65e 100644
--- a/django/__init__.py
+++ b/django/__init__.py
@@ -1,6 +1,6 @@
 from django.utils.version import get_version
 
-VERSION = (4, 2, 2, "final", 0)
+VERSION = (4, 2, 3, "alpha", 0)
 
 __version__ = get_version(VERSION)
 

From b2355a8df308b160b1a20b2263faf4238b32a371 Mon Sep 17 00:00:00 2001
From: nessita <124304+nessita@users.noreply.github.com>
Date: Mon, 5 Jun 2023 14:55:23 -0300
Subject: [PATCH 35/47] [4.2.x] Added stub release notes for 4.2.3.

Backport of e26d1a91d7de6e9d44655dc4fc6a99654a0dd925 from main
---
 docs/releases/4.2.3.txt | 12 ++++++++++++
 docs/releases/index.txt |  1 +
 2 files changed, 13 insertions(+)
 create mode 100644 docs/releases/4.2.3.txt

diff --git a/docs/releases/4.2.3.txt b/docs/releases/4.2.3.txt
new file mode 100644
index 000000000000..4279175df97b
--- /dev/null
+++ b/docs/releases/4.2.3.txt
@@ -0,0 +1,12 @@
+==========================
+Django 4.2.3 release notes
+==========================
+
+*Expected July 3, 2023*
+
+Django 4.2.3 fixes several bugs in 4.2.2.
+
+Bugfixes
+========
+
+* ...
diff --git a/docs/releases/index.txt b/docs/releases/index.txt
index 8c186a582001..a94e72f3b0e0 100644
--- a/docs/releases/index.txt
+++ b/docs/releases/index.txt
@@ -26,6 +26,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   4.2.3
    4.2.2
    4.2.1
    4.2

From eb84c068ed7c2982389b8d331418e99dd9709ff7 Mon Sep 17 00:00:00 2001
From: Akash Kumar Sen <Akash-Kumar-Sen@users.noreply.github.com>
Date: Fri, 26 May 2023 21:28:59 +0530
Subject: [PATCH 36/47] [4.2.x] Fixed #30355 -- Doc'd interaction between
 custom managers and prefetch_related().

Backport of 5f2308710b5a3d9f5f135b7ade08214f5c154ec4 from main
---
 docs/topics/db/queries.txt | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/docs/topics/db/queries.txt b/docs/topics/db/queries.txt
index 7c6c9e18ac31..84fbfabe4550 100644
--- a/docs/topics/db/queries.txt
+++ b/docs/topics/db/queries.txt
@@ -1802,6 +1802,18 @@ methods::
 
     b.entry_set(manager="entries").is_published()
 
+.. admonition:: Interaction with prefetching
+
+    When calling :meth:`~django.db.models.query.QuerySet.prefetch_related` with
+    a reverse relation, the default manager will be used. If you want to
+    prefetch related objects using a custom reverse manager, use
+    :class:`Prefetch() <django.db.models.Prefetch>`. For example::
+
+        from django.db.models import Prefetch
+
+        prefetch_manager = Prefetch("entry_set", queryset=Entry.entries.all())
+        Blog.objects.prefetch_related(prefetch_manager)
+
 Additional methods to handle related objects
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

From 31d1fc36b3ae67d51afe718125fc6413e30dd565 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Fri, 9 Jun 2023 21:37:23 +0200
Subject: [PATCH 37/47] [4.2.x] Fixed #34645 -- Restored alignment for admin
 date/time timezone warnings.

Regression in 96a598356a9ea8c2c05b22cadc12e256a3b295fd.
Backport of caf80cb41f13e84803a94928282cae75333bbdfc from main
---
 django/contrib/admin/static/admin/css/forms.css    |  4 +++-
 django/contrib/admin/static/admin/css/rtl.css      |  4 +++-
 .../admin/templates/admin/widgets/date.html        |  3 +++
 .../admin/templates/admin/widgets/time.html        |  3 +++
 django/contrib/admin/widgets.py                    | 14 +++++++++++---
 docs/releases/4.2.3.txt                            |  3 ++-
 tests/admin_widgets/tests.py                       | 12 ++++++++----
 7 files changed, 33 insertions(+), 10 deletions(-)
 create mode 100644 django/contrib/admin/templates/admin/widgets/date.html
 create mode 100644 django/contrib/admin/templates/admin/widgets/time.html

diff --git a/django/contrib/admin/static/admin/css/forms.css b/django/contrib/admin/static/admin/css/forms.css
index 52f956e2cf00..e45abe1c07e9 100644
--- a/django/contrib/admin/static/admin/css/forms.css
+++ b/django/contrib/admin/static/admin/css/forms.css
@@ -130,7 +130,9 @@ form .aligned div.help {
     padding-left: 10px;
 }
 
-form .aligned p.datetime div.help.timezonewarning {
+form .aligned p.date div.help.timezonewarning,
+form .aligned p.datetime div.help.timezonewarning,
+form .aligned p.time div.help.timezonewarning {
     margin-left: 0;
     padding-left: 0;
     font-weight: normal;
diff --git a/django/contrib/admin/static/admin/css/rtl.css b/django/contrib/admin/static/admin/css/rtl.css
index 800f943ee475..53a6dd6ca93e 100644
--- a/django/contrib/admin/static/admin/css/rtl.css
+++ b/django/contrib/admin/static/admin/css/rtl.css
@@ -147,7 +147,9 @@ form .aligned div.help {
 
 form div.help ul,
 form .aligned .checkbox-row + .help,
-form .aligned p.datetime div.help.timezonewarning {
+form .aligned p.date div.help.timezonewarning,
+form .aligned p.datetime div.help.timezonewarning,
+form .aligned p.time div.help.timezonewarning {
     margin-right: 0;
     padding-right: 0;
 }
diff --git a/django/contrib/admin/templates/admin/widgets/date.html b/django/contrib/admin/templates/admin/widgets/date.html
new file mode 100644
index 000000000000..acd5d5fc57e4
--- /dev/null
+++ b/django/contrib/admin/templates/admin/widgets/date.html
@@ -0,0 +1,3 @@
+<p class="date">
+  {% include "django/forms/widgets/date.html" %}
+</p>
diff --git a/django/contrib/admin/templates/admin/widgets/time.html b/django/contrib/admin/templates/admin/widgets/time.html
new file mode 100644
index 000000000000..e4eaca61f251
--- /dev/null
+++ b/django/contrib/admin/templates/admin/widgets/time.html
@@ -0,0 +1,3 @@
+<p class="time">
+  {% include "django/forms/widgets/time.html" %}
+</p>
diff --git a/django/contrib/admin/widgets.py b/django/contrib/admin/widgets.py
index c7d5db209e85..5e3416bc28f4 100644
--- a/django/contrib/admin/widgets.py
+++ b/django/contrib/admin/widgets.py
@@ -48,7 +48,7 @@ def get_context(self, name, value, attrs):
         return context
 
 
-class AdminDateWidget(forms.DateInput):
+class BaseAdminDateWidget(forms.DateInput):
     class Media:
         js = [
             "admin/js/calendar.js",
@@ -60,7 +60,11 @@ def __init__(self, attrs=None, format=None):
         super().__init__(attrs=attrs, format=format)
 
 
-class AdminTimeWidget(forms.TimeInput):
+class AdminDateWidget(BaseAdminDateWidget):
+    template_name = "admin/widgets/date.html"
+
+
+class BaseAdminTimeWidget(forms.TimeInput):
     class Media:
         js = [
             "admin/js/calendar.js",
@@ -72,6 +76,10 @@ def __init__(self, attrs=None, format=None):
         super().__init__(attrs=attrs, format=format)
 
 
+class AdminTimeWidget(BaseAdminTimeWidget):
+    template_name = "admin/widgets/time.html"
+
+
 class AdminSplitDateTime(forms.SplitDateTimeWidget):
     """
     A SplitDateTime Widget that has some admin-specific styling.
@@ -80,7 +88,7 @@ class AdminSplitDateTime(forms.SplitDateTimeWidget):
     template_name = "admin/widgets/split_datetime.html"
 
     def __init__(self, attrs=None):
-        widgets = [AdminDateWidget, AdminTimeWidget]
+        widgets = [BaseAdminDateWidget, BaseAdminTimeWidget]
         # Note that we're calling MultiWidget, not SplitDateTimeWidget, because
         # we want to define widgets.
         forms.MultiWidget.__init__(self, widgets, attrs)
diff --git a/docs/releases/4.2.3.txt b/docs/releases/4.2.3.txt
index 4279175df97b..66d6611b36fd 100644
--- a/docs/releases/4.2.3.txt
+++ b/docs/releases/4.2.3.txt
@@ -9,4 +9,5 @@ Django 4.2.3 fixes several bugs in 4.2.2.
 Bugfixes
 ========
 
-* ...
+* Fixed a regression in Django 4.2 that caused incorrect alignment of timezone
+  warnings for ``DateField`` and ``TimeField`` in the admin (:ticket:`34645`).
diff --git a/tests/admin_widgets/tests.py b/tests/admin_widgets/tests.py
index d23af538ad2b..0e202060482f 100644
--- a/tests/admin_widgets/tests.py
+++ b/tests/admin_widgets/tests.py
@@ -398,15 +398,17 @@ def test_attrs(self):
         w = widgets.AdminDateWidget()
         self.assertHTMLEqual(
             w.render("test", datetime(2007, 12, 1, 9, 30)),
+            '<p class="date">'
             '<input value="2007-12-01" type="text" class="vDateField" name="test" '
-            'size="10">',
+            'size="10"></p>',
         )
         # pass attrs to widget
         w = widgets.AdminDateWidget(attrs={"size": 20, "class": "myDateField"})
         self.assertHTMLEqual(
             w.render("test", datetime(2007, 12, 1, 9, 30)),
+            '<p class="date">'
             '<input value="2007-12-01" type="text" class="myDateField" name="test" '
-            'size="20">',
+            'size="20"></p>',
         )
 
 
@@ -415,15 +417,17 @@ def test_attrs(self):
         w = widgets.AdminTimeWidget()
         self.assertHTMLEqual(
             w.render("test", datetime(2007, 12, 1, 9, 30)),
+            '<p class="time">'
             '<input value="09:30:00" type="text" class="vTimeField" name="test" '
-            'size="8">',
+            'size="8"></p>',
         )
         # pass attrs to widget
         w = widgets.AdminTimeWidget(attrs={"size": 20, "class": "myTimeField"})
         self.assertHTMLEqual(
             w.render("test", datetime(2007, 12, 1, 9, 30)),
+            '<p class="time">'
             '<input value="09:30:00" type="text" class="myTimeField" name="test" '
-            'size="20">',
+            'size="20"></p>',
         )
 
 

From 9e9a286bed4757b6f7ed2b6d5f0296203d99a15f Mon Sep 17 00:00:00 2001
From: Neeraj Kumar <sainineeraj1234@gmail.com>
Date: Wed, 7 Jun 2023 02:13:57 +0530
Subject: [PATCH 38/47] [4.2.x] Fixed #34638 -- Fixed admin change list
 selected row highlight on editable boolean fields.

Regression in 0aa2f16e63887d6053f6fd0da19254fc74c750ae.

Thanks Andrei Shabanski for the report.

Backport of 1d9d32389c652edc56ada65116d39789896f4820 from main.
---
 django/contrib/admin/static/admin/css/changelists.css | 4 ++--
 docs/releases/4.2.3.txt                               | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/django/contrib/admin/static/admin/css/changelists.css b/django/contrib/admin/static/admin/css/changelists.css
index 641dccd7e3b8..a7545131a391 100644
--- a/django/contrib/admin/static/admin/css/changelists.css
+++ b/django/contrib/admin/static/admin/css/changelists.css
@@ -257,11 +257,11 @@
 
 /* Once the :has() pseudo-class is supported by all browsers, the tr.selected
    selector and the JS adding the class can be removed. */
-#changelist table tbody tr.selected {
+#changelist tbody tr.selected {
     background-color: var(--selected-row);
 }
 
-#changelist table tbody tr:has(input[type=checkbox]:checked) {
+#changelist tbody tr:has(.action-select:checked) {
     background-color: var(--selected-row);
 }
 
diff --git a/docs/releases/4.2.3.txt b/docs/releases/4.2.3.txt
index 66d6611b36fd..4ab29b0cff08 100644
--- a/docs/releases/4.2.3.txt
+++ b/docs/releases/4.2.3.txt
@@ -11,3 +11,7 @@ Bugfixes
 
 * Fixed a regression in Django 4.2 that caused incorrect alignment of timezone
   warnings for ``DateField`` and ``TimeField`` in the admin (:ticket:`34645`).
+
+* Fixed a regression in Django 4.2 that caused incorrect highlighting of rows
+  in the admin changelist view when ``ModelAdmin.list_editable`` contained a
+  ``BooleanField`` (:ticket:`34638`).

From 4b433ef236bf1607d5612d4c30f095ec9f6e63dc Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Tue, 13 Jun 2023 10:12:52 +0200
Subject: [PATCH 39/47] [4.2.x] Refs #30220 -- Bumped required version of
 Selenium to 3.8.0.

Follow up to 8d010f39869f107820421631111417298d1c5bb9.
Backport of 06881341d48dd17a4fdf25afc96991de4fb3b1ac from main
---
 docs/internals/contributing/writing-code/unit-tests.txt | 2 +-
 docs/topics/testing/tools.txt                           | 2 +-
 tests/requirements/py3.txt                              | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/internals/contributing/writing-code/unit-tests.txt b/docs/internals/contributing/writing-code/unit-tests.txt
index 2d0ba67144c7..8e8213afe302 100644
--- a/docs/internals/contributing/writing-code/unit-tests.txt
+++ b/docs/internals/contributing/writing-code/unit-tests.txt
@@ -296,7 +296,7 @@ dependencies:
   <https://memcached.org/>`_
 * `gettext <https://www.gnu.org/software/gettext/manual/gettext.html>`_
   (:ref:`gettext_on_windows`)
-* :pypi:`selenium`
+* :pypi:`selenium` 3.8.0+
 * :pypi:`sqlparse` 0.3.1+ (required)
 * :pypi:`tblib` 1.5.0+
 
diff --git a/docs/topics/testing/tools.txt b/docs/topics/testing/tools.txt
index f1bf71809ed0..c5cec226f8d5 100644
--- a/docs/topics/testing/tools.txt
+++ b/docs/topics/testing/tools.txt
@@ -1035,7 +1035,7 @@ First of all, you need to install the :pypi:`selenium` package:
 
 .. console::
 
-    $ python -m pip install selenium
+    $ python -m pip install "selenium >= 3.8.0"
 
 Then, add a ``LiveServerTestCase``-based test to your app's tests module
 (for example: ``myapp/tests.py``). For this example, we'll assume you're using
diff --git a/tests/requirements/py3.txt b/tests/requirements/py3.txt
index f80bf8b2a7bd..5c937218683b 100644
--- a/tests/requirements/py3.txt
+++ b/tests/requirements/py3.txt
@@ -16,7 +16,7 @@ pytz
 pywatchman; sys.platform != 'win32'
 PyYAML
 redis >= 3.4.0
-selenium
+selenium >= 3.8.0
 sqlparse >= 0.3.1
 tblib >= 1.5.0
 tzdata

From fabd0510a0d59760babb071e8c06a892bb1a2f5e Mon Sep 17 00:00:00 2001
From: Ashwin Dharne <ashwindharne@gmail.com>
Date: Fri, 16 Jun 2023 13:34:06 -0400
Subject: [PATCH 40/47] [4.2.x] Fixed typo in docs/topics/db/fixtures.txt.

Backport of 5762b839ff60b57f80c37992fe6beb9d7f740b0e from main
---
 docs/topics/db/fixtures.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/topics/db/fixtures.txt b/docs/topics/db/fixtures.txt
index d07b7343b9c6..4db6de89eb5e 100644
--- a/docs/topics/db/fixtures.txt
+++ b/docs/topics/db/fixtures.txt
@@ -30,8 +30,8 @@ Fixtures can be used to pre-populate database with data for
 :ref:`tests <topics-testing-fixtures>` or to provide some :ref:`initial data
 <initial-data-via-fixtures>`.
 
-Were Django looks for fixtures?
-===============================
+Where Django looks for fixtures?
+================================
 
 Django will search in three locations for fixtures:
 

From a18e0f44d5692b656bd8ea178e830ebdc80a000d Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Tue, 20 Jun 2023 12:59:32 +0200
Subject: [PATCH 41/47] [4.2.x] Corrected admin.E013 check message in docs.

Backport of ddb6506618ea52c6b20e97eefad03ed847a1e3de from main
---
 docs/ref/checks.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/ref/checks.txt b/docs/ref/checks.txt
index fa7c633487e7..90a216deffff 100644
--- a/docs/ref/checks.txt
+++ b/docs/ref/checks.txt
@@ -634,7 +634,7 @@ with the admin site:
 * **admin.E011**: The value of ``fieldsets[n][1]`` must contain the key
   ``fields``.
 * **admin.E012**: There are duplicate field(s) in ``fieldsets[n][1]``.
-* **admin.E013**: ``fields[n]/fieldsets[n][m]`` cannot include the
+* **admin.E013**: The value of ``fields[n]/fieldsets[n][m]`` cannot include the
   ``ManyToManyField`` ``<field name>``, because that field manually specifies a
   relationship model.
 * **admin.E014**: The value of ``exclude`` must be a list or tuple.

From 9ab56e64deb64498b4acfe9e71619b45603c552f Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Wed, 21 Jun 2023 08:59:10 +0200
Subject: [PATCH 42/47] [4.2.x] Added stub release notes and release date for
 4.2.3, 4.1.10, and 3.2.20.

Backport of 2360ba22742c3ee8729697bfe2d508110465af56 from main
---
 docs/releases/3.2.20.txt | 9 +++++++++
 docs/releases/4.1.10.txt | 9 +++++++++
 docs/releases/4.2.3.txt  | 5 +++--
 docs/releases/index.txt  | 2 ++
 4 files changed, 23 insertions(+), 2 deletions(-)
 create mode 100644 docs/releases/3.2.20.txt
 create mode 100644 docs/releases/4.1.10.txt

diff --git a/docs/releases/3.2.20.txt b/docs/releases/3.2.20.txt
new file mode 100644
index 000000000000..e4ef91439405
--- /dev/null
+++ b/docs/releases/3.2.20.txt
@@ -0,0 +1,9 @@
+===========================
+Django 3.2.20 release notes
+===========================
+
+*July 3, 2023*
+
+Django 3.2.20 fixes a security issue with severity "moderate" in 3.2.19.
+
+...
diff --git a/docs/releases/4.1.10.txt b/docs/releases/4.1.10.txt
new file mode 100644
index 000000000000..8aaa9723c84f
--- /dev/null
+++ b/docs/releases/4.1.10.txt
@@ -0,0 +1,9 @@
+===========================
+Django 4.1.10 release notes
+===========================
+
+*July 3, 2023*
+
+Django 4.1.10 fixes a security issue with severity "moderate" in 4.1.9.
+
+...
diff --git a/docs/releases/4.2.3.txt b/docs/releases/4.2.3.txt
index 4ab29b0cff08..835de58116af 100644
--- a/docs/releases/4.2.3.txt
+++ b/docs/releases/4.2.3.txt
@@ -2,9 +2,10 @@
 Django 4.2.3 release notes
 ==========================
 
-*Expected July 3, 2023*
+*July 3, 2023*
 
-Django 4.2.3 fixes several bugs in 4.2.2.
+Django 4.2.3 fixes a security issue with severity "moderate" and several bugs
+in 4.2.2.
 
 Bugfixes
 ========
diff --git a/docs/releases/index.txt b/docs/releases/index.txt
index a94e72f3b0e0..65c622aec158 100644
--- a/docs/releases/index.txt
+++ b/docs/releases/index.txt
@@ -36,6 +36,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   4.1.10
    4.1.9
    4.1.8
    4.1.7
@@ -69,6 +70,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   3.2.20
    3.2.19
    3.2.18
    3.2.17

From 67fe092a858919e3e04e21360c95645bf4673bb0 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Tue, 27 Jun 2023 12:54:11 +0200
Subject: [PATCH 43/47] [4.2.x] Fixed typo in docs/ref/models/querysets.txt.

Backport of c4a09499aa760c92969083b4639703b5b0a562fb from main
---
 docs/ref/models/querysets.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/ref/models/querysets.txt b/docs/ref/models/querysets.txt
index 75bd7fff9b7d..449f1a9931fb 100644
--- a/docs/ref/models/querysets.txt
+++ b/docs/ref/models/querysets.txt
@@ -34,7 +34,7 @@ You can evaluate a ``QuerySet`` in the following ways:
   Note: Don't use this if all you want to do is determine if at least one
   result exists. It's more efficient to use :meth:`~QuerySet.exists`.
 
-* **Asynchronous iteration.**. A ``QuerySet`` can also be iterated over using
+* **Asynchronous iteration.** A ``QuerySet`` can also be iterated over using
   ``async for``::
 
       async for e in Entry.objects.all():

From 7b45fe01abac68ba5c0162529eb6378eec405099 Mon Sep 17 00:00:00 2001
From: nessita <124304+nessita@users.noreply.github.com>
Date: Tue, 27 Jun 2023 15:05:08 -0300
Subject: [PATCH 44/47] [4.2.x] Added dedicated section for output_field in
 query expressions docs.

Backport of 679928834295ebd874ede667dbaae8a7945d3580 from main
---
 docs/ref/models/expressions.txt | 73 +++++++++++++++++----------------
 1 file changed, 38 insertions(+), 35 deletions(-)

diff --git a/docs/ref/models/expressions.txt b/docs/ref/models/expressions.txt
index a21b2e3ca88a..35e1d2c68d06 100644
--- a/docs/ref/models/expressions.txt
+++ b/docs/ref/models/expressions.txt
@@ -18,6 +18,25 @@ Django supports negation, addition, subtraction, multiplication, division,
 modulo arithmetic, and the power operator on query expressions, using Python
 constants, variables, and even other expressions.
 
+.. _output-field:
+
+Output field
+============
+
+Many of the expressions documented in this section support an optional
+``output_field`` parameter. If given, Django will load the value into that
+field after retrieving it from the database.
+
+``output_field`` takes a model field instance, like ``IntegerField()`` or
+``BooleanField()``. Usually, the field doesn't need any arguments, like
+``max_length``, since field arguments relate to data validation which will not
+be performed on the expression's output value.
+
+``output_field`` is only required when Django is unable to automatically
+determine the result's field type, such as complex expressions that mix field
+types. For example, adding a ``DecimalField()`` and a ``FloatField()`` requires
+an output field, like ``output_field=FloatField()``.
+
 Some examples
 =============
 
@@ -220,10 +239,10 @@ different fields with arithmetic::
 
     company = Company.objects.annotate(chairs_needed=F("num_employees") - F("num_chairs"))
 
-If the fields that you're combining are of different types you'll need
-to tell Django what kind of field will be returned. Since ``F()`` does not
-directly support ``output_field`` you will need to wrap the expression with
-:class:`ExpressionWrapper`::
+If the fields that you're combining are of different types you'll need to tell
+Django what kind of field will be returned. Most expressions support
+:ref:`output_field<output-field>` for this case, but since ``F()`` does not, you
+will need to wrap the expression with :class:`ExpressionWrapper`::
 
     from django.db.models import DateTimeField, ExpressionWrapper, F
 
@@ -389,7 +408,8 @@ driver would escape them.
 
 The ``function``, ``template``, and ``arg_joiner`` keywords can be used to
 replace the attributes of the same name without having to define your own
-class. ``output_field`` can be used to define the expected return type.
+class. :ref:`output_field<output-field>` can be used to define the expected
+return type.
 
 ``Aggregate()`` expressions
 ---------------------------
@@ -444,19 +464,6 @@ The ``expressions`` positional arguments can include expressions, transforms of
 the model field, or the names of model fields. They will be converted to a
 string and used as the ``expressions`` placeholder within the ``template``.
 
-The ``output_field`` argument requires a model field instance, like
-``IntegerField()`` or ``BooleanField()``, into which Django will load the value
-after it's retrieved from the database. Usually no arguments are needed when
-instantiating the model field as any arguments relating to data validation
-(``max_length``, ``max_digits``, etc.) will not be enforced on the expression's
-output value.
-
-Note that ``output_field`` is only required when Django is unable to determine
-what field type the result should be. Complex expressions that mix field types
-should define the desired ``output_field``. For example, adding an
-``IntegerField()`` and a ``FloatField()`` together should probably have
-``output_field=FloatField()`` defined.
-
 The ``distinct`` argument determines whether or not the aggregate function
 should be invoked for each distinct value of ``expressions`` (or set of
 values, for multiple ``expressions``). The argument is only supported on
@@ -515,15 +522,10 @@ The ``value`` argument describes the value to be included in the expression,
 such as ``1``, ``True``, or ``None``. Django knows how to convert these Python
 values into their corresponding database type.
 
-The ``output_field`` argument should be a model field instance, like
-``IntegerField()`` or ``BooleanField()``, into which Django will load the value
-after it's retrieved from the database. Usually no arguments are needed when
-instantiating the model field as any arguments relating to data validation
-(``max_length``, ``max_digits``, etc.) will not be enforced on the expression's
-output value. If no ``output_field`` is specified it will be tentatively
-inferred from the :py:class:`type` of the provided ``value``, if possible. For
-example, passing an instance of :py:class:`datetime.datetime` as ``value``
-would default ``output_field`` to :class:`~django.db.models.DateTimeField`.
+If no :ref:`output_field<output-field>` is specified, it will be inferred from
+the type of the provided ``value`` for many common types. For example, passing
+an instance of :py:class:`datetime.datetime` as ``value`` defaults
+``output_field`` to :class:`~django.db.models.DateTimeField`.
 
 ``ExpressionWrapper()`` expressions
 -----------------------------------
@@ -531,9 +533,9 @@ would default ``output_field`` to :class:`~django.db.models.DateTimeField`.
 .. class:: ExpressionWrapper(expression, output_field)
 
 ``ExpressionWrapper`` surrounds another expression and provides access to
-properties, such as ``output_field``, that may not be available on other
-expressions. ``ExpressionWrapper`` is necessary when using arithmetic on
-``F()`` expressions with different types as described in
+properties, such as :ref:`output_field<output-field>`, that may not be
+available on other expressions. ``ExpressionWrapper`` is necessary when using
+arithmetic on ``F()`` expressions with different types as described in
 :ref:`using-f-with-annotations`.
 
 Conditional expressions
@@ -795,7 +797,8 @@ expressions (column names should be wrapped in an ``F``-object) that control
 the partitioning of the rows.  Partitioning narrows which rows are used to
 compute the result set.
 
-The ``output_field`` is specified either as an argument or by the expression.
+The :ref:`output_field<output-field>` is specified either as an argument or by
+the expression.
 
 The ``order_by`` argument accepts an expression on which you can call
 :meth:`~django.db.models.Expression.asc` and
@@ -1172,10 +1175,10 @@ an ``__init__()`` method to set some attributes::
                   raise TypeError("%r is not an Expression" % expression)
           self.expressions = expressions
 
-We do some basic validation on the parameters, including requiring at least
-2 columns or values, and ensuring they are expressions. We are requiring
-``output_field`` here so that Django knows what kind of model field to assign
-the eventual result to.
+We do some basic validation on the parameters, including requiring at least 2
+columns or values, and ensuring they are expressions. We are requiring
+:ref:`output_field<output-field>` here so that Django knows what kind of model
+field to assign the eventual result to.
 
 Now we implement the preprocessing and validation. Since we do not have
 any of our own validation at this point, we delegate to the nested

From 1ea11365f61a78051e196e6123d5f987efa90df1 Mon Sep 17 00:00:00 2001
From: Cerebro Cerberus <sethamek@gmail.com>
Date: Wed, 28 Jun 2023 05:08:51 +0000
Subject: [PATCH 45/47] [4.2.x] Fixed typo in docs/intro/tutorial08.txt.

Backport of 6fbe5287ac46f38faa9634e02da7e7b01e37c34d from main
---
 docs/intro/tutorial08.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/intro/tutorial08.txt b/docs/intro/tutorial08.txt
index e33a02ec2ccb..5a20e29b9d5a 100644
--- a/docs/intro/tutorial08.txt
+++ b/docs/intro/tutorial08.txt
@@ -83,7 +83,7 @@ depends on your needs and goals. Sometimes it's fine to use a package that's
 in its alpha state. Other times, you need to know it's production ready.
 `Adam Johnson has a blog post
 <https://adamj.eu/tech/2021/11/04/the-well-maintained-test/>`_ that outlines
-a set of characteristics a that qualifies a package as "well maintained".
+a set of characteristics that qualifies a package as "well maintained".
 Django Packages shows data for some of these characteristics, such as when the
 package was last updated.
 

From b7c5feb35a31799de6e582ad6a5a91a9de74e0f9 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Wed, 14 Jun 2023 12:23:06 +0200
Subject: [PATCH 46/47] [4.2.x] Fixed CVE-2023-36053 -- Prevented potential
 ReDoS in EmailValidator and URLValidator.

Thanks Seokchan Yoon for reports.
---
 django/core/validators.py                     |  7 ++++--
 django/forms/fields.py                        |  3 +++
 docs/ref/forms/fields.txt                     |  7 +++++-
 docs/ref/validators.txt                       | 25 ++++++++++++++++++-
 docs/releases/3.2.20.txt                      |  7 +++++-
 docs/releases/4.1.10.txt                      |  7 +++++-
 docs/releases/4.2.3.txt                       |  7 ++++++
 .../field_tests/test_emailfield.py            |  3 ++-
 .../tests/test_deprecation_forms.py           |  3 ++-
 tests/forms_tests/tests/test_forms.py         | 19 ++++++++------
 tests/validators/tests.py                     |  3 +++
 11 files changed, 75 insertions(+), 16 deletions(-)

diff --git a/django/core/validators.py b/django/core/validators.py
index c73490588de4..4a5835dbb0d4 100644
--- a/django/core/validators.py
+++ b/django/core/validators.py
@@ -104,6 +104,7 @@ class URLValidator(RegexValidator):
     message = _("Enter a valid URL.")
     schemes = ["http", "https", "ftp", "ftps"]
     unsafe_chars = frozenset("\t\r\n")
+    max_length = 2048
 
     def __init__(self, schemes=None, **kwargs):
         super().__init__(**kwargs)
@@ -111,7 +112,7 @@ def __init__(self, schemes=None, **kwargs):
             self.schemes = schemes
 
     def __call__(self, value):
-        if not isinstance(value, str):
+        if not isinstance(value, str) or len(value) > self.max_length:
             raise ValidationError(self.message, code=self.code, params={"value": value})
         if self.unsafe_chars.intersection(value):
             raise ValidationError(self.message, code=self.code, params={"value": value})
@@ -203,7 +204,9 @@ def __init__(self, message=None, code=None, allowlist=None):
             self.domain_allowlist = allowlist
 
     def __call__(self, value):
-        if not value or "@" not in value:
+        # The maximum length of an email is 320 characters per RFC 3696
+        # section 3.
+        if not value or "@" not in value or len(value) > 320:
             raise ValidationError(self.message, code=self.code, params={"value": value})
 
         user_part, domain_part = value.rsplit("@", 1)
diff --git a/django/forms/fields.py b/django/forms/fields.py
index 46de2f53a00e..01cd831964ea 100644
--- a/django/forms/fields.py
+++ b/django/forms/fields.py
@@ -609,6 +609,9 @@ class EmailField(CharField):
     default_validators = [validators.validate_email]
 
     def __init__(self, **kwargs):
+        # The default maximum length of an email is 320 characters per RFC 3696
+        # section 3.
+        kwargs.setdefault("max_length", 320)
         super().__init__(strip=True, **kwargs)
 
 
diff --git a/docs/ref/forms/fields.txt b/docs/ref/forms/fields.txt
index 6954e3819d5a..1e4f8f957ea8 100644
--- a/docs/ref/forms/fields.txt
+++ b/docs/ref/forms/fields.txt
@@ -592,7 +592,12 @@ For each field, we describe the default widget used if you don't specify
     * Error message keys: ``required``, ``invalid``
 
     Has the optional arguments ``max_length``, ``min_length``, and
-    ``empty_value`` which work just as they do for :class:`CharField`.
+    ``empty_value`` which work just as they do for :class:`CharField`. The
+    ``max_length`` argument defaults to 320 (see :rfc:`3696#section-3`).
+
+    .. versionchanged:: 3.2.20
+
+        The default value for ``max_length`` was changed to 320 characters.
 
 ``FileField``
 -------------
diff --git a/docs/ref/validators.txt b/docs/ref/validators.txt
index f63d100a26ee..327951a9909f 100644
--- a/docs/ref/validators.txt
+++ b/docs/ref/validators.txt
@@ -133,6 +133,11 @@ to, or in lieu of custom ``field.clean()`` methods.
     :param code: If not ``None``, overrides :attr:`code`.
     :param allowlist: If not ``None``, overrides :attr:`allowlist`.
 
+    An :class:`EmailValidator` ensures that a value looks like an email, and
+    raises a :exc:`~django.core.exceptions.ValidationError` with
+    :attr:`message` and :attr:`code` if it doesn't. Values longer than 320
+    characters are always considered invalid.
+
     .. attribute:: message
 
         The error message used by
@@ -154,13 +159,19 @@ to, or in lieu of custom ``field.clean()`` methods.
         validation, so you'd need to add them to the ``allowlist`` as
         necessary.
 
+    .. versionchanged:: 3.2.20
+
+        In older versions, values longer than 320 characters could be
+        considered valid.
+
 ``URLValidator``
 ----------------
 
 .. class:: URLValidator(schemes=None, regex=None, message=None, code=None)
 
     A :class:`RegexValidator` subclass that ensures a value looks like a URL,
-    and raises an error code of ``'invalid'`` if it doesn't.
+    and raises an error code of ``'invalid'`` if it doesn't. Values longer than
+    :attr:`max_length` characters are always considered invalid.
 
     Loopback addresses and reserved IP spaces are considered valid. Literal
     IPv6 addresses (:rfc:`3986#section-3.2.2`) and Unicode domains are both
@@ -177,6 +188,18 @@ to, or in lieu of custom ``field.clean()`` methods.
 
         .. _valid URI schemes: https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml
 
+    .. attribute:: max_length
+
+        .. versionadded:: 3.2.20
+
+        The maximum length of values that could be considered valid. Defaults
+        to 2048 characters.
+
+    .. versionchanged:: 3.2.20
+
+        In older versions, values longer than 2048 characters could be
+        considered valid.
+
 ``validate_email``
 ------------------
 
diff --git a/docs/releases/3.2.20.txt b/docs/releases/3.2.20.txt
index e4ef91439405..c8f60a70e2d9 100644
--- a/docs/releases/3.2.20.txt
+++ b/docs/releases/3.2.20.txt
@@ -6,4 +6,9 @@ Django 3.2.20 release notes
 
 Django 3.2.20 fixes a security issue with severity "moderate" in 3.2.19.
 
-...
+CVE-2023-36053: Potential regular expression denial of service vulnerability in ``EmailValidator``/``URLValidator``
+===================================================================================================================
+
+``EmailValidator`` and ``URLValidator`` were subject to potential regular
+expression denial of service attack via a very large number of domain name
+labels of emails and URLs.
diff --git a/docs/releases/4.1.10.txt b/docs/releases/4.1.10.txt
index 8aaa9723c84f..06c99d0e349d 100644
--- a/docs/releases/4.1.10.txt
+++ b/docs/releases/4.1.10.txt
@@ -6,4 +6,9 @@ Django 4.1.10 release notes
 
 Django 4.1.10 fixes a security issue with severity "moderate" in 4.1.9.
 
-...
+CVE-2023-36053: Potential regular expression denial of service vulnerability in ``EmailValidator``/``URLValidator``
+===================================================================================================================
+
+``EmailValidator`` and ``URLValidator`` were subject to potential regular
+expression denial of service attack via a very large number of domain name
+labels of emails and URLs.
diff --git a/docs/releases/4.2.3.txt b/docs/releases/4.2.3.txt
index 835de58116af..c10584973960 100644
--- a/docs/releases/4.2.3.txt
+++ b/docs/releases/4.2.3.txt
@@ -7,6 +7,13 @@ Django 4.2.3 release notes
 Django 4.2.3 fixes a security issue with severity "moderate" and several bugs
 in 4.2.2.
 
+CVE-2023-36053: Potential regular expression denial of service vulnerability in ``EmailValidator``/``URLValidator``
+===================================================================================================================
+
+``EmailValidator`` and ``URLValidator`` were subject to potential regular
+expression denial of service attack via a very large number of domain name
+labels of emails and URLs.
+
 Bugfixes
 ========
 
diff --git a/tests/forms_tests/field_tests/test_emailfield.py b/tests/forms_tests/field_tests/test_emailfield.py
index 869a1aacc560..079267ca8bd9 100644
--- a/tests/forms_tests/field_tests/test_emailfield.py
+++ b/tests/forms_tests/field_tests/test_emailfield.py
@@ -8,8 +8,9 @@
 class EmailFieldTest(FormFieldAssertionsMixin, SimpleTestCase):
     def test_emailfield_1(self):
         f = EmailField()
+        self.assertEqual(f.max_length, 320)
         self.assertWidgetRendersTo(
-            f, '<input type="email" name="f" id="id_f" required>'
+            f, '<input type="email" name="f" id="id_f" maxlength="320" required>'
         )
         with self.assertRaisesMessage(ValidationError, "'This field is required.'"):
             f.clean("")
diff --git a/tests/forms_tests/tests/test_deprecation_forms.py b/tests/forms_tests/tests/test_deprecation_forms.py
index 2a4fb6b0e16f..d63e83f3cd05 100644
--- a/tests/forms_tests/tests/test_deprecation_forms.py
+++ b/tests/forms_tests/tests/test_deprecation_forms.py
@@ -65,7 +65,8 @@ class CommentForm(Form):
             '<p>Name: <input type="text" name="name" maxlength="50"></p>'
             '<div class="errorlist">'
             '<div class="error">Enter a valid email address.</div></div>'
-            '<p>Email: <input type="email" name="email" value="invalid" required></p>'
+            '<p>Email: <input type="email" name="email" value="invalid" '
+            'maxlength="320" required></p>'
             '<div class="errorlist">'
             '<div class="error">This field is required.</div></div>'
             '<p>Comment: <input type="text" name="comment" required></p>',
diff --git a/tests/forms_tests/tests/test_forms.py b/tests/forms_tests/tests/test_forms.py
index 930a200b14a3..a73e32902ccb 100644
--- a/tests/forms_tests/tests/test_forms.py
+++ b/tests/forms_tests/tests/test_forms.py
@@ -547,7 +547,8 @@ class SignupForm(Form):
 
         f = SignupForm(auto_id=False)
         self.assertHTMLEqual(
-            str(f["email"]), '<input type="email" name="email" required>'
+            str(f["email"]),
+            '<input type="email" name="email" maxlength="320" required>',
         )
         self.assertHTMLEqual(
             str(f["get_spam"]), '<input type="checkbox" name="get_spam" required>'
@@ -556,7 +557,8 @@ class SignupForm(Form):
         f = SignupForm({"email": "test@example.com", "get_spam": True}, auto_id=False)
         self.assertHTMLEqual(
             str(f["email"]),
-            '<input type="email" name="email" value="test@example.com" required>',
+            '<input type="email" name="email" maxlength="320" value="test@example.com" '
+            "required>",
         )
         self.assertHTMLEqual(
             str(f["get_spam"]),
@@ -3522,7 +3524,7 @@ class Person(Form):
             <option value="false">No</option>
             </select></li>
             <li><label for="id_email">Email:</label>
-            <input type="email" name="email" id="id_email"></li>
+            <input type="email" name="email" id="id_email" maxlength="320"></li>
             <li class="required error"><ul class="errorlist">
             <li>This field is required.</li></ul>
             <label class="required" for="id_age">Age:</label>
@@ -3544,7 +3546,7 @@ class Person(Form):
             <option value="false">No</option>
             </select></p>
             <p><label for="id_email">Email:</label>
-            <input type="email" name="email" id="id_email"></p>
+            <input type="email" name="email" id="id_email" maxlength="320"></p>
             <ul class="errorlist"><li>This field is required.</li></ul>
             <p class="required error"><label class="required" for="id_age">Age:</label>
             <input type="number" name="age" id="id_age" required></p>
@@ -3564,7 +3566,7 @@ class Person(Form):
 <option value="false">No</option>
 </select></td></tr>
 <tr><th><label for="id_email">Email:</label></th><td>
-<input type="email" name="email" id="id_email"></td></tr>
+<input type="email" name="email" id="id_email" maxlength="320"></td></tr>
 <tr class="required error"><th><label class="required" for="id_age">Age:</label></th>
 <td><ul class="errorlist"><li>This field is required.</li></ul>
 <input type="number" name="age" id="id_age" required></td></tr>""",
@@ -3579,7 +3581,7 @@ class Person(Form):
             '<option value="unknown" selected>Unknown</option>'
             '<option value="true">Yes</option><option value="false">No</option>'
             '</select></div><div><label for="id_email">Email:</label>'
-            '<input type="email" name="email" id="id_email" /></div>'
+            '<input type="email" name="email" id="id_email" maxlength="320"/></div>'
             '<div class="required error"><label for="id_age" class="required">Age:'
             '</label><ul class="errorlist"><li>This field is required.</li></ul>'
             '<input type="number" name="age" required id="id_age" /></div>',
@@ -5056,8 +5058,9 @@ class CommentForm(Form):
             '<p>Name: <input type="text" name="name" maxlength="50"></p>'
             '<div class="errorlist">'
             '<div class="error">Enter a valid email address.</div></div>'
-            '<p>Email: <input type="email" name="email" value="invalid" required></p>'
-            '<div class="errorlist">'
+            "<p>Email: "
+            '<input type="email" name="email" value="invalid" maxlength="320" required>'
+            '</p><div class="errorlist">'
             '<div class="error">This field is required.</div></div>'
             '<p>Comment: <input type="text" name="comment" required></p>',
         )
diff --git a/tests/validators/tests.py b/tests/validators/tests.py
index 02bee30ac131..e99baab862d9 100644
--- a/tests/validators/tests.py
+++ b/tests/validators/tests.py
@@ -106,6 +106,7 @@
     "ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
     "ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
     "ddddddddddddddddd:password@example.com:8080",
+    "http://userid:password" + "d" * 2000 + "@example.aaaaaaaaaaaaa.com",
     "http://142.42.1.1/",
     "http://142.42.1.1:8080/",
     "http://➡.ws/䨹",
@@ -236,6 +237,7 @@
     "aaaaaa.com",
     "http://example.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
     "aaaaaa",
+    "http://example." + ("a" * 63 + ".") * 1000 + "com",
     "http://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
     "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaa"
     "aaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaa"
@@ -291,6 +293,7 @@
     (validate_email, "example@%s.%s.atm" % ("a" * 63, "b" * 10), None),
     (validate_email, "example@atm.%s" % ("a" * 64), ValidationError),
     (validate_email, "example@%s.atm.%s" % ("b" * 64, "a" * 63), ValidationError),
+    (validate_email, "example@%scom" % (("a" * 63 + ".") * 100), ValidationError),
     (validate_email, None, ValidationError),
     (validate_email, "", ValidationError),
     (validate_email, "abc", ValidationError),

From 1651351386ab31d8ae492c8a4922797714ca97d1 Mon Sep 17 00:00:00 2001
From: Mariusz Felisiak <felisiak.mariusz@gmail.com>
Date: Mon, 3 Jul 2023 08:21:07 +0200
Subject: [PATCH 47/47] [4.2.x] Bumped version for 4.2.3 release.

---
 django/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/django/__init__.py b/django/__init__.py
index 457dfc7de65e..fda005c7ea9c 100644
--- a/django/__init__.py
+++ b/django/__init__.py
@@ -1,6 +1,6 @@
 from django.utils.version import get_version
 
-VERSION = (4, 2, 3, "alpha", 0)
+VERSION = (4, 2, 3, "final", 0)
 
 __version__ = get_version(VERSION)