django.git/django/utils, branch main

Fixed #37067 -- Added trailing slash in django_file_prefixes().

2026-04-29T17:47:49Z

Ensure skip_file_prefixes does not match sibling packages like django*. Bug in f42b89f1bf49a5b89ed852b60f79342320a81c5e and 34bd3ed944bf38792c631b55e581963d44d52284.

Refs #35514 -- Added warn_about_external_use() deprecation utility.

2026-04-28T00:58:06Z

Implemented a new `warn_about_external_use()` helper to conditionally issue warnings depending on whether a deprecated feature is used from within Django. Fixed `LazySettings._show_deprecation_warning()` (Refs #26029) to work correctly when called from anywhere in `LazySettings`. Previously, it assumed a specific code path through `LazyObject.__getattribute__()` and an `@property` getter on `LazySettings`.

Fixed #36991 -- Raised BadRequest for invalid encodings in Content-Type headers.

2026-04-22T18:25:08Z

Refs #35440 -- Optimized parse_header_parameters() for the simplest case.

2026-04-08T21:30:05Z

Added a fast-path to parse_header_parameters Benchmark results (50,000 iterations): - Simple headers: ~73% improvement Thanks Nick Pope (@ngnpope) for the review.

Removed PY38 and PY39 version constants.

2026-04-08T12:44:06Z

As the oldest supported version is Django 5.2, we only need constants for PY310+.

Fixed #36894 -- Added TypeError for conflicting arguments in mail APIs.

2026-03-16T16:51:58Z

A TypeError is now raised if fail_silently=True, auth_user, or auth_password are provided along a connection. Updated AdminEmailHandler in django.utils.log to remove redundant fail_silently=True. Thanks Mike Edmunds for the report and Jacob Tyler Walls for the review.

Fixed #36943 -- Preserved any exception from URLconf module in autoreloader.

2026-03-10T15:32:39Z

Co-authored-by: Jacob Walls

Fixed #36293 -- Avoided buffering streaming responses in GZipMiddleware.

2026-03-09T12:41:00Z

This avoids latency and/or blocking. The example of streaming a CSV file was rewritten to employ batching for greater efficiency in all layers (db, HTTP, etc.). The improved performance from batching should outweigh the drag introduced by an additional byte for each flush. Co-authored-by: huoyinghui

Fixed CVE-2026-25674 -- Prevented potentially incorrect permissions on file system object creation.

2026-03-03T12:09:32Z

This fix introduces `safe_makedirs()` in the `os` utils as a safer alternative to `os.makedirs()` that avoids umask-related race conditions in multi-threaded environments. This is a workaround for https://github.com/python/cpython/issues/86533 and the solution is based on the fix being proposed for CPython. Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Zackery Spytz Refs CVE-2020-24583 and #31921. Thanks Tarek Nakkouch for the report, and Jake Howard, Jacob Walls, and Shai Berger for reviews.

Fixed #36961 -- Fixed TypeError in deprecation warnings if Django is imported by namespace.

2026-03-02T19:08:11Z