django.git/tests/utils_tests, branch main

Fixed #36991 -- Raised BadRequest for invalid encodings in Content-Type headers.

2026-04-22T18:25:08Z

Fixed #36943 -- Preserved any exception from URLconf module in autoreloader.

2026-03-10T15:32:39Z

Co-authored-by: Jacob Walls

Fixed #36293 -- Avoided buffering streaming responses in GZipMiddleware.

2026-03-09T12:41:00Z

This avoids latency and/or blocking. The example of streaming a CSV file was rewritten to employ batching for greater efficiency in all layers (db, HTTP, etc.). The improved performance from batching should outweigh the drag introduced by an additional byte for each flush. Co-authored-by: huoyinghui

Fixed CVE-2026-25674 -- Prevented potentially incorrect permissions on file system object creation.

2026-03-03T12:09:32Z

This fix introduces `safe_makedirs()` in the `os` utils as a safer alternative to `os.makedirs()` that avoids umask-related race conditions in multi-threaded environments. This is a workaround for https://github.com/python/cpython/issues/86533 and the solution is based on the fix being proposed for CPython. Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> Co-authored-by: Zackery Spytz Refs CVE-2020-24583 and #31921. Thanks Tarek Nakkouch for the report, and Jake Howard, Jacob Walls, and Shai Berger for reviews.

Fixed #36944 -- Removed MAX_LENGTH_HTML and related 5M chars limit references from HTML truncation docs.

2026-02-25T16:08:52Z

Fixed CVE-2026-1285 -- Mitigated potential DoS in django.utils.text.Truncator for HTML input.

2026-02-03T12:54:16Z

The `TruncateHTMLParser` used `deque.remove()` to remove tags from the stack when processing end tags. With crafted input containing many unmatched end tags, this caused repeated full scans of the tag stack, leading to quadratic time complexity. The fix uses LIFO semantics, only removing a tag from the stack when it matches the most recently opened tag. This avoids linear scans for unmatched end tags and reduces complexity to linear time. Refs #30686 and 6ee37ada3241ed263d8d1c2901b030d964cbd161. Thanks Seokchan Yoon for the report, and Jake Howard and Jacob Walls for reviews.

Fixed #36810 -- Avoided infinite recursion in SimpleLazyObject.repr().

2025-12-24T17:46:41Z

Detect when `SimpleLazyObject._setupfunc` is a bound method of the same instance to use a safe representation and avoid infinite recursion.

Refs #36810 -- Avoided infinite recursion in LazyNonce.repr().

2025-12-24T17:46:41Z

Moved nonce generation in ``django.utils.csp.LazyNonce`` to a function to avoid infinite recursion in ``SimpleLazyObject.__repr__`` for unevaluated instances. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

Fixed #36747 -- Parsed weeks from ISO 8601 format in parse_duration().

2025-12-17T15:19:05Z

Refs #36499 -- Adjusted test_strip_tags following Python behavior change for incomplete entities.

2025-12-11T16:28:49Z