django.git/django/utils/_os.py, branch main

Fixed CVE-2026-25674 -- Prevented potentially incorrect permissions on file system object creation.

2026-03-03T12:09:32Z

This fix introduces `safe_makedirs()` in the `os` utils as a safer alternative to `os.makedirs()` that avoids umask-related race conditions in multi-threaded environments. This is a workaround for https://github.com/python/cpython/issues/86533 and the solution is based on the fix being proposed for CPython. Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Zackery Spytz Refs CVE-2020-24583 and #31921. Thanks Tarek Nakkouch for the report, and Jake Howard, Jacob Walls, and Shai Berger for reviews.

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Corrected exception type in safe_join()'s docstring.

2023-04-20T03:44:01Z

Refs #33476 -- Reformatted code with Black.

2022-02-07T19:37:05Z

Refs #30461 -- Added django.utils._os.to_path().

2019-08-13T15:17:39Z

Refs #27753 -- Removed django.utils._os.abspathu(), upath(), and npath().

2019-02-05T17:57:11Z

Refs #27795 -- Removed force_bytes() usage in utils/_os.py.

2018-09-25T15:27:36Z

Refs #27656 -- Updated django.utils docstring verbs according to PEP 257.

2017-02-11T21:11:08Z

Refs #23919 -- Replaced tempfile.mkdtemp() with TemporaryDirectory() context manager.

2017-01-26T18:54:16Z

Refs #23919 -- Removed django.utils._os.upath()/npath()/abspathu() usage.

2017-01-20T13:01:02Z

These functions do nothing on Python 3.