chango.git/django/http, branch devmain

Fixed #37142 -- Moved django_file_prefixes() to django.utils.warnings.

2026-06-10T14:17:34Z

Refs #36905 -- Moved JSONResponse safe param discussion to versionchanged box.

2026-06-03T20:40:21Z

Follow-up to 6e15ac8066312328de279e3e072667416c205bfc.

Fixed CVE-2026-6873 -- Prevented signed cookie salt namespace collisions.

2026-06-03T11:37:26Z

Made signed cookies derive their signer namespace from an injective encoding of `(name, salt)` while preserving compatibility with legacy `name + salt` cookies behind SIGNED_COOKIE_LEGACY_SALT_FALLBACK. Thanks Peng Zhou for the report, and Shai Berger, Markus Holterman, Jake Howard, and Paul McMillan for reviews. Co-authored-by: Jacob Walls Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Fixed #37103 -- Made HttpRequest.body handle malformed CONTENT_LENGTH.

2026-06-02T09:06:28Z

Fixed #36905 -- Deprecated the safe parameter of JSONResponse.

2026-05-27T15:41:48Z

Peer frameworks have long since dropped their analogous checks for this vulnerability that was fixed in ES5.

Fixed #37100 -- Prevented control characters in HttpResponse reason_phrase.

2026-05-22T14:57:39Z

Fixed #37095 -- Checked maximum redirect lengths against percent-encoded URLs.

2026-05-12T19:58:53Z

Fixed #37053 -- Added validate=True to base64.b64decode() calls.

2026-05-06T00:13:40Z

Fixed #36767 -- Allowed max redirect URL length to be set on HttpResponseRedirect.

2026-05-04T21:09:20Z

Fixed #36991 -- Raised BadRequest for invalid encodings in Content-Type headers.

2026-04-22T18:25:08Z