django.git/docs/releases/6.0.3.txt, branch main

Fixed CVE-2026-25674 -- Prevented potentially incorrect permissions on file system object creation.

2026-03-03T12:09:32Z

This fix introduces `safe_makedirs()` in the `os` utils as a safer alternative to `os.makedirs()` that avoids umask-related race conditions in multi-threaded environments. This is a workaround for https://github.com/python/cpython/issues/86533 and the solution is based on the fix being proposed for CPython. Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Zackery Spytz Refs CVE-2020-24583 and #31921. Thanks Tarek Nakkouch for the report, and Jake Howard, Jacob Walls, and Shai Berger for reviews.

Fixed CVE-2026-25673 -- Simplified URLField scheme detection.

2026-03-03T12:08:46Z

This simplicaftion mitigates a potential DoS in URLField on Windows. The usage of `urlsplit()` in `URLField.to_python()` was replaced with `str.partition(":")` for URL scheme detection. On Windows, `urlsplit()` performs Unicode normalization which is slow for certain characters, making `URLField` vulnerable to DoS via specially crafted POST payloads. Thanks Seokchan Yoon for the report, and Jake Howard and Shai Berger for the review. Refs #36923. Co-authored-by: Jacob Walls

Fixed #36961 -- Fixed TypeError in deprecation warnings if Django is imported by namespace.

2026-03-02T19:08:11Z

Fixed #36951 -- Removed empty exc_info from log_task_finished signal handler.

2026-02-25T18:52:23Z

Before, if no exception occurred, "None Type: None" was logged.

Added stub release notes and release date for 6.0.3, 5.2.12, and 4.2.29.

2026-02-24T16:47:37Z

Fixed #36920 -- Fixed alignment of fieldset legends in wide admin forms.

2026-02-20T20:30:23Z

Visual regression in 4187da258fe212d494cb578a0bc2b52c4979ab95.

Refs #36934, #35972 -- Forwardported release note for tolerating sequences in BuiltinLookup.as_sql().

2026-02-20T14:18:57Z

Instead of cherry-picking a larger changeset (787cc96ef6197d73c7d4ad96f25500910c399603) and removing changes unsuitable for a backport, a partial backport was applied directly to stable/6.0.x to resolve #36934, so the release note needs to be forwardported. Forwardport of f9b820f8ac50aad025949087e660a551691832e4 from stable/6.0.x.

Fixed #36903 -- Fixed further NameErrors when inspecting functions with deferred annotations.

2026-02-10T21:51:55Z

Provide a wrapper for safe introspection of user functions on Python 3.14+. Follow-up to 601914722956cc41f1f2c53972d669ddee6ffc04.

Added stub release notes for 6.0.3.

2026-02-03T14:05:18Z