January 4, 2019
Django 2.1.5 fixes a security issue and several bugs in 2.1.4.
An attacker could craft a malicious URL that could make spoofed content appear
on the default page generated by the
The URL path is no longer displayed in the default 404 template and the
request_path context variable is now quoted to fix the issue for custom
templates that use the path.
Fixed compatibility with mysqlclient 1.3.14 (#30013).
Fixed a schema corruption issue on SQLite 3.26+. You might have to drop and rebuild your SQLite database if you applied a migration while using an older version of Django with SQLite 3.26 or later (#29182).
Prevented SQLite schema alterations while foreign key checks are enabled to avoid the possibility of schema corruption (#30023).
Fixed a regression in Django 2.1.4 (which enabled keep-alive connections) where request body data isn’t properly consumed for such connections (#30015).
Fixed a regression in Django 2.1.4 where
InlineModelAdmin.has_change_permission() is incorrectly called with a
obj argument during an object add (#30050).