django.git, branch 6.0.3

[6.0.x] Bumped version for 6.0.3 release.

2026-03-03T12:13:06Z

[6.0.x] Fixed CVE-2026-25674 -- Prevented potentially incorrect permissions on file system object creation.

2026-03-03T12:12:00Z

This fix introduces `safe_makedirs()` in the `os` utils as a safer alternative to `os.makedirs()` that avoids umask-related race conditions in multi-threaded environments. This is a workaround for https://github.com/python/cpython/issues/86533 and the solution is based on the fix being proposed for CPython. Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Zackery Spytz Refs CVE-2020-24583 and #31921. Thanks Tarek Nakkouch for the report, and Jake Howard, Jacob Walls, and Shai Berger for reviews. Backport of 019e44f67a8dace67b786e2818938c8691132988 from main.

[6.0.x] Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

2026-03-03T12:10:53Z

This simplicaftion mitigates a potential DoS in URLField on Windows. The usage of `urlsplit()` in `URLField.to_python()` was replaced with `str.partition(":")` for URL scheme detection. On Windows, `urlsplit()` performs Unicode normalization which is slow for certain characters, making `URLField` vulnerable to DoS via specially crafted POST payloads. Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger for the review. Refs #36923. Co-authored-by: Jacob Walls Backport of 951ffb3832cd83ba672c1e3deae2bda128eb9cca from main.

[6.0.x] Fixed #36961 -- Fixed TypeError in deprecation warnings if Django is imported by namespace.

2026-03-02T19:08:42Z

Backport of c1d8646ec219b8b90ebdd463f40e5767876658a0 from main.

[6.0.x] Ensured spelling checks pass OK.

2026-03-02T18:52:45Z

Follow up to 659bacfe54c2a28eb2e0589c1c721f1a99720ad2.

[6.0.x] Aligned docs checks between GitHub Actions and local development.

2026-03-02T18:07:30Z

Backport of 3f21cb06e76044ad753055700395e54a1fc4f1e9 from main.

[6.0.x] Adjusted default DoS severity level in Security Policy.

2026-02-26T15:21:01Z

Backport of 1f2a56567c565d91d797b8a9071ff77a75b52080 from main.

[6.0.x] Fixed #36848 -- Mentioned BadRequest exception in docs/ref/views.txt.

2026-02-25T19:55:47Z

Backport of 4aefc9ea51cc2d78f43b1dc2aa69732e55d18a56 from main.

[6.0.x] Fixed #36951 -- Removed empty exc_info from log_task_finished signal handler.

2026-02-25T18:53:10Z

Before, if no exception occurred, "None Type: None" was logged. Backport of 497d9cdc67f0bdae929fcde677b5f441e94a6c8b from main.

[6.0.x] Fixed #36944 -- Removed MAX_LENGTH_HTML and related 5M chars limit references from HTML truncation docs.

2026-02-25T16:09:57Z

Backport of bbc6818bc12f14c1764a7eb68556018195f56b59 from main.