Bugfix release.
- Render query templates with autoescaping disabled, so parameter values are substituted verbatim. HTML-escaping previously corrupted query-significant characters such as
<,&and"(e.g. a valueA & BbecameA & B).
Query values still compile to Django Q objects → parameterized SQL, so this does not affect SQL-injection safety.