django.git/django/utils/text.py, branch main

Fixed #36293 -- Avoided buffering streaming responses in GZipMiddleware.

2026-03-09T12:41:00Z

This avoids latency and/or blocking. The example of streaming a CSV file was rewritten to employ batching for greater efficiency in all layers (db, HTTP, etc.). The improved performance from batching should outweigh the drag introduced by an additional byte for each flush. Co-authored-by: huoyinghui

Fixed #36944 -- Removed MAX_LENGTH_HTML and related 5M chars limit references from HTML truncation docs.

2026-02-25T16:08:52Z

Fixed CVE-2026-1285 -- Mitigated potential DoS in django.utils.text.Truncator for HTML input.

2026-02-03T12:54:16Z

The `TruncateHTMLParser` used `deque.remove()` to remove tags from the stack when processing end tags. With crafted input containing many unmatched end tags, this caused repeated full scans of the tag stack, leading to quadratic time complexity. The fix uses LIFO semantics, only removing a tag from the stack when it matches the most recently opened tag. This avoids linear scans for unmatched end tags and reduces complexity to linear time. Refs #30686 and 6ee37ada3241ed263d8d1c2901b030d964cbd161. Thanks Seokchan Yoon for the report, and Jake Howard and Jacob Walls for reviews.

Fixed #36705 -- Avoided string concatenation in utils.

2025-11-07T19:06:42Z

Repeated string concatenation performs poorly on PyPy. Thanks Seokchan Yoon for the report.

Fixed #36656 -- Avoided truncating async streaming responses in GZipMiddleware.

2025-10-21T14:45:12Z

Fixed #36341 -- Preserved whitespaces in wordwrap template filter.

2025-04-23T19:14:03Z

Regression in 55d89e25f4115c5674cdd9b9bcba2bb2bb6d820b. This work improves the django.utils.text.wrap() function to ensure that empty lines and lines with whitespace only are kept instead of being dropped. Thanks Matti Pohjanvirta for the report and fix. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Fixed CVE-2025-26699 -- Mitigated potential DoS in wordwrap template filter.

2025-03-06T08:38:40Z

Thanks sw0rd1ight for the report.

Refs #30686 -- Removed unused regexes in django.utils.text.

2024-02-15T07:39:14Z

Unused since 6ee37ada3241ed263d8d1c2901b030d964cbd161.

Fixed #30686 -- Used Python HTMLParser in utils.text.Truncator.

2024-02-07T08:46:25Z

Refs #30686 -- Fixed text truncation for negative or zero lengths.

2024-02-07T04:18:35Z