chango.git/django/utils, branch devmain

Fixed #37102 -- Used **kwargs instead of *kwargs in CountsDict.init().

2026-06-10T23:14:18Z

Fixed #37142 -- Moved django_file_prefixes() to django.utils.warnings.

2026-06-10T14:17:34Z

Refs CVE-2026-48587 -- Added helper to properly split header values.

2026-06-08T23:06:46Z

Extracted the repeated `split(",")` + per-token `.strip()` pattern into a `split_header_value()` generator in django/utils/http.py. The previous `cc_delim_re` regex only stripped whitespace adjacent to the comma delimiter, leaving leading or trailing whitespace on the first and last tokens. Now, `split_header_value()` strips every token fully, matching RFC 9110's optional-whitespace rules. Thanks to Shai Berger, Jacob Walls, and Sarah Boyce for reviews.

Fixed CVE-2026-48587 -- Ignored whitespace padding when checking Vary header values.

2026-06-03T11:37:26Z

Thanks to Navid Rezazadeh for the report and Jacob Walls for review.

Fixed #28800 -- Added a listurls management command.

2026-06-01T19:24:49Z

Thanks JaeHyuck Sa, Jacob Walls, and Tim McCurrach for reviews. Co-authored-by: Ülgen Sarıkavak

Advanced deprecation warnings for Django 6.2.

2026-05-20T20:17:41Z

Fixed #35514 -- Implemented dictionary-based MAILERS.

2026-05-13T21:00:56Z

See DEP 0018. Added: * MAILERS setting. * django.core.mail.mailers dict-like EmailBackend factory. * `using` argument to mail sending APIs. * `sent_using` attribute to mail.outbox messages in locmem backend. * MAILERS in startproject settings template, set to console backend. * AdminLogHandler.using argument. * BrokenLinkEmailsMiddleware.send_mail() method. Updated: * BaseEmailBackend to track the MAILERS alias used to construct it, and to report errors for unknown kwargs (OPTIONS). * EmailBackend implementations to initialize from kwargs (OPTIONS) only when MAILERS is being used. * smtp.EmailBackend to require `host` option and to default `port` option based on SSL/TLS options. * SimpleTestCase setup to substitute the locmem backend for all defined MAILERS configurations. * Django's tests that send mail to define MAILERS. Deprecated: * EMAIL_BACKEND and other backend-related EMAIL_* settings. * mail.get_connection(). * The `connection`, `fail_silently`, `auth_user`, and `auth_password` arguments to mail functions. * The EmailMessage.connection attribute. * BaseEmailBackend support for `fail_silently`. Backends that support fail_silently (SMTP, console, file) now implement it directly. * AdminEmailHandler.email_backend argument. Removed undocumented features without deprecation: * EmailMessage.get_connection() method. (send() now raises an error if a subclass has attempted to override it.) * EmailMessage.send() no longer sets self.connection to the connection used for sending. (It still _uses_ a pre-existing self.connection.) * AdminEmailHandler.connection() method. (Init now raises an error if a subclass has attempted to override it.) Thanks to Natalia Bidart for shepherding DEP 0018 and for extensive reviews and suggestions on the implementation. Thanks to Jacob Rief for the initial implementation and multiple iterations while refining the design. Co-authored-by: Jacob Rief

Refs #36712, #36664 -- Used annotation_format parameter of getfullargspec() on Python 3.15.

2026-05-08T15:52:50Z

https://github.com/python/cpython/pull/149457

Fixed #36784 -- Added csp_nonce_attr template tag for CSP nonce inclusion.

2026-05-06T23:43:37Z

New default tag `{% csp_nonce_attr %}` was added for explicit CSP nonce inclusion into `