@@ -40,6 +40,16 @@ You can determine your currently installed version using `pip freeze`:
## 2.4.x series
### 2.4.4
**Date**:[3rd November 2014](https://github.com/tomchristie/django-rest-framework/issues?q=milestone%3A%222.4.4+Release%22+).
***Securityfix**:Escape URLs when replacing `format=` query parameter, as used in dropdown on `GET` button in browsable API to allow explicit selection of JSON vs HTML output.
*Maintain ordering of URLs in API root view for `DefaultRouter`.
*Fix `follow=True` in `APIRequestFactory`
*Resolve issue with invalid `read_only=True`, `required=True` fields being automatically generated by `ModelSerializer` in some cases.
*Resolve issue with `OPTIONS` requests returning incorrect information for views using `get_serializer_class` to dynamically determine serializer based on request method.
### 2.4.3
**Date**:[19th September 2014](https://github.com/tomchristie/django-rest-framework/issues?q=milestone%3A%222.4.3+Release%22+).