django.git/django/forms/fields.py, branch main

Fixed #16429 -- Extracted set_choices() method from FilePathField.init().

2026-04-29T18:52:25Z

Fixed #35870 -- Made blank choice label in forms more accessible.

2026-04-22T21:06:29Z

Added new constant django.db.models.fields.BLANK_CHOICE_LABEL for an accessible and translatable blank choice label in forms. Deprecated django.db.models.fields.BLANK_CHOICE_DASH constant. Added the immediately deprecated transitional setting USE_BLANK_CHOICE_DASH. Co-Authored-By: Marijke Luttekes

Refs #36913 -- Maintained error message determinism in MultipleChoiceField.validate().

2026-03-26T19:21:00Z

Used Django's OrderedSet datastructure instead of set() in MultipleChoiceField.validate() to prevent submission ordering from being discarded during validation. Thanks to Jacob Walls, JaeHyuck Sa, Jake Howard and Simon Charette for the reviews.

Fixed #36913 -- Optimized MultipleChoiceField.validate().

2026-03-25T13:23:10Z

Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

2026-03-03T12:08:46Z

This simplicaftion mitigates a potential DoS in URLField on Windows. The usage of `urlsplit()` in `URLField.to_python()` was replaced with `str.partition(":")` for URL scheme detection. On Windows, `urlsplit()` performs Unicode normalization which is slow for certain characters, making `URLField` vulnerable to DoS via specially crafted POST payloads. Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger for the review. Refs #36923. Co-authored-by: Jacob Walls

Refs #36500 -- Corrected rewrapped long lines fixed via a script.

2025-07-23T23:17:55Z

Manually reformatted some comments and docstrings where autofix_w505.py changed the meaning of the formatting.

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Refs #34380 -- Changed the URLField default scheme to https and removed FORMS_URLFIELD_ASSUME_HTTPS per deprecation timeline.

2025-01-15T21:28:37Z

Fixed #35521 -- Allowed overriding BoundField class on fields, forms and renderers.

2025-01-15T20:04:26Z

Thank you Sarah Boyce, Carlton Gibson, Tim Schilling and Adam Johnson for reviews. Co-authored-by: Christophe Henry Co-authored-by: David Smith Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Matthias Kestenholz

Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.

2025-01-14T11:42:24Z

Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz Felisiak for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>