django.git/tests/auth_tests, branch main

Fixed #36542 -- Marked authenticate() with @sensitive_variables() decorator.

2026-04-24T18:19:15Z

Thanks Olivier Dalang, Tim McCurrach, Sarah Boyce, and Mar Bartolome for reviews.

Fixed #37021 -- Added Permission.user_perm_str property.

2026-04-07T19:38:35Z

For use in checking user permissions via has_perm(). Co-authored-by: 사재혁

Fixed #37017 -- Fixed setting or clearing of request.user after alogin/alogout().

2026-04-02T13:00:55Z

Regression in 31a43c571f4d036827d4fd7a5f615591637dc1be.

Fixed #27489 -- Renamed permissions upon model renaming in migrations.

2026-02-27T12:45:21Z

Co-authored-by: Jacob Walls

Fixed #34643 -- Moved inputs beneath labels and errors in admin forms.

2026-02-27T12:43:45Z

Thanks Sarah Boyce and Jacob Walls for reviews. Co-authored-by: Hrushikesh Vaidya

Fixed #36903 -- Fixed further NameErrors when inspecting functions with deferred annotations.

2026-02-10T21:51:55Z

Provide a wrapper for safe introspection of user functions on Python 3.14+. Follow-up to 601914722956cc41f1f2c53972d669ddee6ffc04.

Modified tests to format PKs with %s rather than %d.

2026-02-10T21:04:24Z

It's how Django formats values internally and makes tests compatible with databases that use non-integer primary keys.

Fixed CVE-2025-13473 -- Standardized timing of check_password() in mod_wsgi auth handler.

2026-02-03T12:52:25Z

Refs CVE-2024-39329, #20760. Thanks Stackered for the report, and Jacob Walls and Markus Holtermann for the reviews. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Refs #34118 -- Removed asgiref coroutine detection shims.

2026-01-31T13:59:54Z

As Python 3.12 is now the floor, we can drop the shims and use the `inspect` module.

Applied Black's 2026 stable style.

2026-01-18T20:26:56Z

https://github.com/psf/black/releases/tag/26.1.0