chango.git/django/forms, branch main

Fixed #16429 -- Extracted set_choices() method from FilePathField.init().

2026-04-29T18:52:25Z

Fixed #35870 -- Made blank choice label in forms more accessible.

2026-04-22T21:06:29Z

Added new constant django.db.models.fields.BLANK_CHOICE_LABEL for an accessible and translatable blank choice label in forms. Deprecated django.db.models.fields.BLANK_CHOICE_DASH constant. Added the immediately deprecated transitional setting USE_BLANK_CHOICE_DASH. Co-Authored-By: Marijke Luttekes

Fixed #37004 -- Used QuerySet.totally_ordered in BaseModelFormSet.get_queryset() for stable ordering.

2026-04-01T17:51:37Z

Refs #36913 -- Maintained error message determinism in MultipleChoiceField.validate().

2026-03-26T19:21:00Z

Used Django's OrderedSet datastructure instead of set() in MultipleChoiceField.validate() to prevent submission ordering from being discarded during validation. Thanks to Jacob Walls, JaeHyuck Sa, Jake Howard and Simon Charette for the reviews.

Fixed #36913 -- Optimized MultipleChoiceField.validate().

2026-03-25T13:23:10Z

Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

2026-03-03T12:08:46Z

This simplicaftion mitigates a potential DoS in URLField on Windows. The usage of `urlsplit()` in `URLField.to_python()` was replaced with `str.partition(":")` for URL scheme detection. On Windows, `urlsplit()` performs Unicode normalization which is slow for certain characters, making `URLField` vulnerable to DoS via specially crafted POST payloads. Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger for the review. Refs #36923. Co-authored-by: Jacob Walls

Fixed #36829 -- Reverted value of ClearableFileInput.use_fieldset to True.

2025-12-31T15:14:00Z

There was unresolved discussion regarding whether to set ClearableFileInput.use_fieldset to True or False when use_fieldset was introduced in Django 4.1, since the clear checkbox appears only sometimes. Although using

is likely desirable, since the primary motivation in #35892 was just to improve markup in the admin, and a deprecation path was not provided for general form usage, future work is deferred to #36828. Regression in 4187da258fe212d494cb578a0bc2b52c4979ab95. Thanks Tim Graham, Antoliny, and David Smith for triage.

Fixed #36618 -- Corrected error message in BaseForm.add_error().

2025-12-19T20:10:12Z

The error message now correctly states that the error argument is a dictionary.

Fixed #36724 -- Removed invalid "for" attribute on tags.

2025-11-13T16:22:44Z

Fixed #36251 -- Avoided mutating form Meta.fields in BaseInlineFormSet.

2025-08-25T08:05:45Z

Signed-off-by: SaJH