# Django 5.2.9 documentation

# Django 4.2.1 release notes

May 3, 2023

Django 4.2.1 fixes a security issue with severity “low” and several bugs in 4.2.

## CVE-2023-31047: Potential bypass of validation when uploading multiple files using one form field

Uploading multiple files using one form field has never been supported by `forms.FileField` or `forms.ImageField` as only the last uploaded file was validated. Unfortunately, Uploading multiple files topic suggested otherwise.

In order to avoid the vulnerability, `ClearableFileInput` and `FileInput` form widgets now raise `ValueError` when the `multiple` HTML attribute is set on them. To prevent the exception and keep the old behavior, set `allow_multiple_selected` to `True`.

For more details on using the new attribute and handling of multiple files through a single field, see Uploading multiple files.

## Bugfixes

- Fixed a regression in Django 4.2 that caused a crash of `QuerySet.defer()` when deferring fields by attribute names (#34458).

- Fixed a regression in Django 4.2 that caused a crash of `SearchVector` function with `%` characters (#34459).

- Fixed a regression in Django 4.2 that caused aggregation over query that uses explicit grouping to group against the wrong columns (#34464).

- Reallowed, following a regression in Django 4.2, setting the `"cursor_factory"` option in `OPTIONS` on PostgreSQL (#34466).

- Enforced UTF-8 client encoding on PostgreSQL, following a regression in Django 4.2 (#34470).

- Fixed a regression in Django 4.2 where `i18n_patterns()` didn’t respect the `prefix_default_language` argument when a fallback language of the default language was used (#34455).

- Fixed a regression in Django 4.2 where translated URLs of the default language from `i18n_patterns()` with `prefix_default_language` set to `False` raised 404 errors for a request with a different language (#34515).

- Fixed a regression in Django 4.2 where creating copies and deep copies of `HttpRequest`, `HttpResponse`, and their subclasses didn’t always work correctly (#34482, #34484).

- Fixed a regression in Django 4.2 where `timesince` and `timeuntil` template filters returned incorrect results for a datetime with a non-UTC timezone when a time difference is less than 1 day (#34483).

- Fixed a regression in Django 4.2 that caused a crash of `SearchHeadline` function with `psycopg` 3 (#34486).

- Fixed a regression in Django 4.2 that caused incorrect `ClearableFileInput` margins in the admin (#34506).

- Fixed a regression in Django 4.2 where breadcrumbs didn’t appear on admin site app index views (#34512).

- Made squashing migrations reduce `AddIndex`, `RemoveIndex`, `RenameIndex`, and `CreateModel` operations which allows removing a deprecated `Meta.index_together` option from historical migrations and use `Meta.indexes` instead (#34525).