django.git/django/forms, branch stable/5.2.x

[5.2.x] Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

2026-03-03T12:16:53Z

This simplicaftion mitigates a potential DoS in URLField on Windows. The usage of `urlsplit()` in `URLField.to_python()` was replaced with `str.partition(":")` for URL scheme detection. On Windows, `urlsplit()` performs Unicode normalization which is slow for certain characters, making `URLField` vulnerable to DoS via specially crafted POST payloads. Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger for the review. Refs #36923. Co-authored-by: Jacob Walls Backport of 951ffb3832cd83ba672c1e3deae2bda128eb9cca from main.

[5.2.x] Applied Black's 2025 stable style.

2025-03-01T18:47:17Z

https://github.com/psf/black/releases/tag/25.1.0 Backport of ff3aaf036f0cb66cd8f404cd51c603e68aaa7676 from main

Fixed #35521 -- Allowed overriding BoundField class on fields, forms and renderers.

2025-01-15T20:04:26Z

Thank you Sarah Boyce, Carlton Gibson, Tim Schilling and Adam Johnson for reviews. Co-authored-by: Christophe Henry Co-authored-by: David Smith Co-authored-by: Natalia <124304+nessita@users.noreply.github.com> Co-authored-by: Matthias Kestenholz

Fixed CVE-2024-56374 -- Mitigated potential DoS in IPv6 validation.

2025-01-14T11:42:24Z

Thanks Saravana Kumar for the report, and Sarah Boyce and Mariusz Felisiak for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Fixed #32819 -- Added aria-describedby to fields with errors.

2025-01-02T15:40:39Z

Fixed #35886 -- Added support for object-based form media script assets.

2025-01-02T12:08:13Z

Refs #32819 -- Added aria-describedby property to BoundField.

2024-12-17T11:04:44Z

Fixed #35987 -- Made ErrorList.copy() copy the renderer attribute.

2024-12-10T11:14:52Z

Fixed #35988 -- Made BaseForm.full_clean() pass renderer to ErrorDict.

2024-12-10T11:13:43Z

Refs #32819 -- Added id to ErrorList class and template.

2024-12-05T09:24:39Z