django.git/django/utils/html.py, branch main

Fixed #32568 -- Replaced mark_safe() with SafeString for literal values.

2025-12-17T17:15:18Z

Replaced instances of mark_safe('some string literal') with SafeString to avoid the overhead of managing lazy objects. Thanks Tim McCurrach for the idea and David Smith and Jacob Walls for reviews.

Fixed #36737 -- Escaped further control characters in escapejs.

2025-11-20T14:35:59Z

Fixed #36705 -- Avoided string concatenation in utils.

2025-11-07T19:06:42Z

Repeated string concatenation performs poorly on PyPy. Thanks Seokchan Yoon for the report.

Fixed #36710 -- Fixed a regression in urlize for multipart domain names.

2025-11-05T22:05:54Z

Thanks Mehraz Hossain Rumman for the report and Bruno Alla for the triage. Regression in a9fe98d5bd4212d069afe8316101984aadecfbb2.

Fixed #35533 -- Prevented urlize creating broken links given a markdown link input.

2025-08-28T06:54:56Z

Signed-off-by: SaJH

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23T23:17:55Z

Rewrapped long docstrings and block comments to 79 characters + newline using script from https://github.com/medmunds/autofix-w505.

Fixed CVE-2025-32873 -- Mitigated potential DoS in strip_tags().

2025-05-07T01:21:42Z

Thanks to Elias Myllymäki for the report, and Shai Berger and Jake Howard for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Fixed CVE-2025-27556 -- Mitigated potential DoS in url_has_allowed_host_and_scheme() on Windows.

2025-04-02T08:21:33Z

Thank you sw0rd1ight for the report.

Fixed #36000 -- Deprecated HTTP as the default protocol in urlize and urlizetrunc.

2025-03-19T13:28:42Z

Fixed #36013 -- Removed use of IDNA-2003 in django.utils.html.

2025-01-23T09:38:15Z

Removed obsolete and potentially problematic IDNA 2003 ("punycode") encoding of international domain names in smart_urlquote() and Urlizer, which are used (only) by AdminURLFieldWidget and the urlize/urlizetrunc template filters. Changed to use percent-encoded UTF-8, which defers IDNA details to the browser (like other URLs rendered by Django).