diff --git a/.bumpversion.cfg b/.bumpversion.cfg
index 0e01e07dff..816f1ffe9a 100644
--- a/.bumpversion.cfg
+++ b/.bumpversion.cfg
@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 5.19.1.dev0
+current_version = 5.20.1.dev0
 commit = True
 tag = True
 sign_tags = True
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2606fe31bd..7822bbf83e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,15 @@
+5.20.0 (May 2023)
+-----------------
+
+## Other changes
+
+- Fix multi-file upload validation and support Django 3.2.19 security update [#465](https://github.com/ome/omero-web/pull/465)
+- Declare portalocker as external dependency [#457](https://github.com/ome/omero-web/pull/457)
+
+## Bug fixes
+
+- Avoid creation of empty file annotations [#466](https://github.com/ome/omero-web/pull/466)
+
 5.19.0 (March 2023)
 -------------------
 
diff --git a/omeroweb/version.py b/omeroweb/version.py
index 06b3fd01a0..75506082d8 100644
--- a/omeroweb/version.py
+++ b/omeroweb/version.py
@@ -7,5 +7,5 @@
     omero_buildyear = "unknown"
 
 
-omeroweb_version = "5.19.1.dev0"
+omeroweb_version = "5.20.1.dev0"
 omeroweb_buildyear = "2022"
diff --git a/omeroweb/webclient/custom_forms.py b/omeroweb/webclient/custom_forms.py
index 58fcbe5435..9651b965db 100644
--- a/omeroweb/webclient/custom_forms.py
+++ b/omeroweb/webclient/custom_forms.py
@@ -379,3 +379,24 @@ def clean(self, value):
                 else:
                     final_values.append(val)
         return final_values
+
+
+# Custom widget and validation for multiple file uploads
+# See https://docs.djangoproject.com/en/3.2/topics/http/
+# file-uploads/#uploading-multiple-files
+class MultipleFileInput(forms.ClearableFileInput):
+    allow_multiple_selected = True
+
+
+class MultipleFileField(forms.FileField):
+    def __init__(self, *args, **kwargs):
+        kwargs.setdefault("widget", MultipleFileInput())
+        super().__init__(*args, **kwargs)
+
+    def clean(self, data, initial=None):
+        single_file_clean = super().clean
+        if isinstance(data, (list, tuple)):
+            result = [single_file_clean(d, initial) for d in data]
+        else:
+            result = single_file_clean(data, initial)
+        return result
diff --git a/omeroweb/webclient/forms.py b/omeroweb/webclient/forms.py
index debb7fd833..62045b5398 100644
--- a/omeroweb/webclient/forms.py
+++ b/omeroweb/webclient/forms.py
@@ -34,6 +34,7 @@
 
 from omeroweb.custom_forms import NonASCIIForm
 from .custom_forms import MetadataModelChoiceField
+from .custom_forms import MultipleFileField
 from .custom_forms import AnnotationModelMultipleChoiceField
 from .custom_forms import ObjectModelMultipleChoiceField
 from omeroweb.webadmin.custom_forms import ExperimenterModelMultipleChoiceField
@@ -334,9 +335,7 @@ def __init__(self, *args, **kwargs):
             required=False,
         )
 
-    annotation_file = forms.FileField(
-        widget=forms.ClearableFileInput(attrs={"multiple": True}), required=False
-    )
+    annotation_file = MultipleFileField(required=False)
 
 
 class CommentAnnotationForm(BaseAnnotationForm):
diff --git a/omeroweb/webclient/views.py b/omeroweb/webclient/views.py
index 8a0b3cb567..82da8ce467 100755
--- a/omeroweb/webclient/views.py
+++ b/omeroweb/webclient/views.py
@@ -2399,7 +2399,9 @@ def annotate_file(request, conn=None, **kwargs):
 
     if request.method == "POST":
         # handle form submission
-        form_file = FilesAnnotationForm(initial=initial, data=request.POST.copy())
+        form_file = FilesAnnotationForm(
+            initial=initial, data=request.POST.copy(), files=request.FILES
+        )
         if form_file.is_valid():
             # Link existing files...
             files = form_file.cleaned_data["files"]
diff --git a/setup.py b/setup.py
index b119f6c9a6..cdfaaa600b 100755
--- a/setup.py
+++ b/setup.py
@@ -54,7 +54,7 @@ def read(fname):
         "omero-py>=5.7.0",
         # minimum requirements for `omero web start`
         "concurrent-log-handler>=0.9.20",
-        "Django>=3.2.18,<4.0",
+        "Django>=3.2.19,<4.0",
         "django-pipeline==2.0.7",
         "django-cors-headers==3.7.0",
         "whitenoise>=5.3.0",