chango.git/django/utils/crypto.py, branch devmain

Fixed #37142 -- Moved django_file_prefixes() to django.utils.warnings.

2026-06-10T14:17:34Z

Fixed #37078 -- Deprecated SHA-1 default for salted_hmac() and base64_hmac() algorithm.

2026-05-04T17:45:16Z

Deprecated the default value of the algorithm argument in django.utils.crypto.salted_hmac() and django.core.signing.base64_hmac(), which will change from 'sha1' to 'sha256' in Django 7.0.

Fixed #36572 -- Revert "Fixed #36546 -- Deprecated django.utils.crypto.constant_time_compare() in favor of hmac.compare_digest()."

2025-08-27T08:50:50Z

This reverts commit 0246f478882c26bc1fe293224653074cd46a90d0.

Fixed #36546 -- Deprecated django.utils.crypto.constant_time_compare() in favor of hmac.compare_digest().

2025-08-25T12:45:16Z

Signed-off-by: SaJH

Removed double spaces after periods and within phrases.

2025-07-23T13:09:43Z

Applied Black's 2024 stable style.

2024-01-26T11:45:07Z

https://github.com/psf/black/releases/tag/24.1.0

Fixed #34233 -- Dropped support for Python 3.8 and 3.9.

2023-01-18T08:46:01Z

Refs #33476 -- Reformatted code with Black.

2022-02-07T19:37:05Z

Fixed #28401 -- Allowed hashlib.md5() calls to work with FIPS kernels.

2021-10-12T06:58:27Z

md5 is not an approved algorithm in FIPS mode, and trying to instantiate a hashlib.md5() will fail when the system is running in FIPS mode. md5 is allowed when in a non-security context. There is a plan to add a keyword parameter (usedforsecurity) to hashlib.md5() to annotate whether or not the instance is being used in a security context. In the case where it is not, the instantiation of md5 will be allowed. See https://bugs.python.org/issue9216 for more details. Some downstream python versions already support this parameter. To support these versions, a new encapsulation of md5() has been added. This encapsulation will pass through the usedforsecurity parameter in the case where the parameter is supported, and strip it if it is not. Co-authored-by: Mariusz Felisiak

Refs #31359 -- Made get_random_string()'s length argument required.

2021-01-14T16:50:04Z

Per deprecation timeline.