Changes 1.9.5:
Made MultiPartParser ignore filenames that normalize to an empty string to fix crash in MemoryFileUploadHandler on specially crafted user input.
Fixed a race condition in BaseCache.get_or_set(). It now returns the default value instead of False if there窶冱 an error when trying to add the value to the cache.
Fixed data loss on SQLite where DurationField values with fractional seconds could be saved as None.
The forms in contrib.auth no longer strip trailing and leading whitespace from the password fields. The change requires users who set their password to something with such whitespace after a site updated to Django 1.9 to reset their password. It provides backwards-compatibility for earlier versions of Django.
Fixed a memory leak in the cached template loader.
Fixed a regression that caused collectstatic --clear to fail if the storage doesn窶冲 implement path().
Fixed a crash when using a reverse lookup with a subquery when a ForeignKey has a to_field set to something other than the primary key.
Fixed a regression in CommonMiddleware that caused spurious warnings in logs on requests missing a trailing slash.
Restored the functionality of the admin窶冱 raw_id_fields in list_editable.
Fixed a regression with abstract model inheritance and explicit parent links.
Fixed a migrations crash on SQLite when renaming the primary key of a model containing a ForeignKey to 'self'.
Fixed JSONField inadvertently escaping its contents when displaying values after failed form validation.

(adam)