django.git/django/http/request.py, branch maindjango
http://cgit.adnoto.dev/django.git/atom?h=main2026-04-22T18:25:08ZFixed #36991 -- Raised BadRequest for invalid encodings in Content-Type headers.2026-04-22T18:25:08ZDineshdineshthumma15@gmail.com2026-03-21T17:21:11Zurn:sha1:dc467fdc3b5744cec71fab876c23a14013e2510bFixed CVE-2026-33034 -- Enforced DATA_UPLOAD_MAX_MEMORY_SIZE on body size in ASGI requests.2026-04-07T11:12:27ZNatalia124304+nessita@users.noreply.github.com2026-03-11T13:26:18Zurn:sha1:953c238058c0ce387a1a41cb491bfc1875d73ad0
The `body` property in `HttpRequest` checks DATA_UPLOAD_MAX_MEMORY_SIZE
against the declared `Content-Length` header before reading. On the ASGI
path, chunked requests carry no `Content-Length`, so the check evaluated
to 0 and always passed regardless of the actual body size.
This work adds a new check on the actual number of bytes consumed.
Thanks to Superior for the report, and to Jake Howard and Jacob Walls
for reviews.
Fixed #36841 -- Made multipart parser class pluggable on HttpRequest.2026-02-10T22:59:02Zfarhanfarhanalirazaazeemi@gmail.com2026-01-05T19:34:39Zurn:sha1:7732f942a98a709750fc1fed2c69741183844a3cRefs #36500 -- Rewrapped long docstrings and block comments via a script.2025-07-23T23:17:55Zdjango-botops@djangoproject.com2025-07-23T03:41:41Zurn:sha1:69a93a88edb56ba47f624dac7a21aacc47ea474f
Rewrapped long docstrings and block comments to 79 characters + newline
using script from https://github.com/medmunds/autofix-w505.
Removed double spaces after periods and within phrases.2025-07-23T13:09:43ZSarah Boyce42296566+sarahboyce@users.noreply.github.com2025-07-18T13:37:14Zurn:sha1:1ecf6889cabc9f3f60d3fdd651468cddd8f4da6eFixed #36447 -- Selected preferred media type based on quality.2025-06-16T07:25:25ZJake Howardgit@theorangeone.net2025-06-10T22:00:25Zurn:sha1:12c1557060fc94fe5e1fbddc4578a4e29d38f77c
When matching which entry in the `Accept` header should be used for
a given media type, the specificity matters. However once those are
resolved, only the quality matters when selecting preference.
Regression in c075508b4de8edf9db553b409f8a8ed2f26ecead.
Thank you to Anders Kaseorg for the report.
Fixed #36446 -- Restored "q" in internal MediaType.params property.2025-06-09T20:37:40ZNatalia124304+nessita@users.noreply.github.com2025-06-09T12:59:11Zurn:sha1:cf5f36bf903a2854f5e395149cee707115b83744
The "q" key was removed while addressing ticket #36411. Despite
`MediaType.params` is undocumented and considered internal, it was used
in third-party projects (Zulip reported breakage), so this work restored
the `q` key in `params`.
Thanks Anders Kaseorg for the report.
Regression in c075508b4de8edf9db553b409f8a8ed2f26ecead.
Fixed #36411 -- Made HttpRequest.get_preferred_type() consider media type parameters.2025-06-03T19:10:41ZJake Howardgit@theorangeone.net2025-05-27T16:00:29Zurn:sha1:c075508b4de8edf9db553b409f8a8ed2f26ecead
HttpRequest.get_preferred_type() did not account for parameters in
Accept header media types (e.g., "text/vcard; version=3.0"). This caused
incorrect content negotiation when multiple types differed only by
parameters, reducing specificity as per RFC 7231 section 5.3.2
(https://datatracker.ietf.org/doc/html/rfc7231.html#section-5.3.2).
This fix updates get_preferred_type() to treat media types with
parameters as distinct, allowing more precise and standards-compliant
matching.
Thanks to magicfelix for the report, and to David Sanders and Sarah
Boyce for the reviews.
Fixed #35631 -- Added HttpRequest.get_preferred_type().2024-09-09T10:02:18ZJake Howardgit@theorangeone.net2024-07-26T11:34:42Zurn:sha1:e161bd4657177f0e723a14a6e414884363b31a5dApplied Black's 2024 stable style.2024-01-26T11:45:07ZMariusz Felisiakfelisiak.mariusz@gmail.com2024-01-26T11:45:07Zurn:sha1:305757aec19c9d5111e4d76095ae0acd66163e4b
https://github.com/psf/black/releases/tag/24.1.0