chango.git/tests/cache, branch devmain django http://cgit.adnoto.dev/chango.git/atom?h=devmain 2026-06-09T18:53:30Z Fixed #37130 -- Skipped DB cache deletion when culling offset is zero. 2026-06-09T18:53:30Z vishwa vis.pypi@gmail.com 2026-06-07T14:16:27Z urn:sha1:867c7c0451f2e67e715da5b55b5bf6696747fdc3 Refs #36560, CVE-2026-35193 -- Replaced substring check on cache-control directives in UpdateCacheMiddleware. 2026-06-09T14:56:46Z Jacob Walls jacobtylerwalls@gmail.com 2026-06-09T12:46:36Z urn:sha1:142b881cecaddc334cabec139e701c0e4b9798da Avoid false positives from hypothetical extension directives that could be superstrings of the ones we are checking. Refs CVE-2026-48587 -- Added helper to properly split header values. 2026-06-08T23:06:46Z Natalia 124304+nessita@users.noreply.github.com 2026-06-03T00:38:35Z urn:sha1:526b1b414d8e215bf627b5722df12a09346dbf6b Extracted the repeated `split(",")` + per-token `.strip()` pattern into a `split_header_value()` generator in django/utils/http.py. The previous `cc_delim_re` regex only stripped whitespace adjacent to the comma delimiter, leaving leading or trailing whitespace on the first and last tokens. Now, `split_header_value()` strips every token fully, matching RFC 9110's optional-whitespace rules. Thanks to Shai Berger, Jacob Walls, and Sarah Boyce for reviews. Fixed #32785 -- Optimized cull frequency for DBCache. 2026-06-08T13:30:15Z eevelweezel eevel.weezel@gmail.com 2026-06-04T21:51:44Z urn:sha1:a7a57a21a8cf42ecc767c204f7939ad4419ae25f Fixed CVE-2026-48587 -- Ignored whitespace padding when checking Vary header values. 2026-06-03T11:37:26Z Jake Howard git@theorangeone.net 2026-05-15T13:44:28Z urn:sha1:42aa0b3364d312e7c6472258d8b0e9c0277fbf22 Thanks to Navid Rezazadeh for the report and Jacob Walls for review. Fixed CVE-2026-35193 -- Varied on Authorization when caching non-public responses. 2026-06-03T11:37:26Z Jacob Walls jacobtylerwalls@gmail.com 2026-03-24T18:06:22Z urn:sha1:a2faa8e895926ac5d63f72879b5ccf671b5b4ba9 Thanks Shai Berger for the report, and Natalia Bidart and Sarah Boyce for reviews. Fixed CVE-2026-8404 -- Used Cache-Control directives case-insensitively in UpdateCacheMiddleware. 2026-06-03T11:37:26Z Jake Howard git@theorangeone.net 2026-05-12T15:29:56Z urn:sha1:d618d7ae4fec727d5b582bd24f803c28d17bf7cd Thanks Ahmed Badawe for the report, and Jacob Walls for reviews. Fixed CVE-2026-6907 -- Prevented caching of requests when Vary header contains an asterisk. 2026-05-05T12:34:21Z Sarah Boyce 42296566+sarahboyce@users.noreply.github.com 2026-04-23T12:53:28Z urn:sha1:c79bdfc1351ef2a2ad95df36241a74c736ef20a1 Thank you Ahmad Sadeddin for the report and Jacob Walls for the review. Refs #36879, #36936 -- Fixed typo in RedisCacheTests.test_client_driver_info. 2026-02-25T21:53:22Z pmppk prosenbl@gmail.com 2026-02-25T21:53:22Z urn:sha1:a91e03d7c388ada569a212bafdbdff9c9bff47f2 Fixed #36879 -- Identified Django client in Redis client metadata. 2026-02-03T11:40:29Z ar3ph 192461522+ar3ph@users.noreply.github.com 2026-02-02T18:26:18Z urn:sha1:72ae25a9c2bb1a9e369e52e696a8b7d1a8df245e