chango.git - django

Age	Commit message (Collapse)	Author
2026-04-07	[4.2.x] Fixed CVE-2026-33034 -- Enforced DATA_UPLOAD_MAX_MEMORY_SIZE on body ↵	Natalia
	size in ASGI requests. The `body` property in `HttpRequest` checks DATA_UPLOAD_MAX_MEMORY_SIZE against the declared `Content-Length` header before reading. On the ASGI path, chunked requests carry no `Content-Length`, so the check evaluated to 0 and always passed regardless of the actual body size. This work adds a new check on the actual number of bytes consumed. Thanks to Superior for the report, and to Jake Howard and Jacob Walls for reviews. Backport of 953c238058c0ce387a1a41cb491bfc1875d73ad0 from main.
2026-04-07	[4.2.x] Fixed CVE-2026-3902 -- Ignored headers with underscores in ASGIRequest.	Jacob Walls
	Thanks Tarek Nakkouch for the report and Jake Howard and Natalia Bidart for reviews. Backport of caf90a971f09323775ed0cacf94eadaf39d040e0 from main.
2026-02-03	[4.2.x] Fixed CVE-2025-14550 -- Optimized repeated header parsing in ASGI ↵	Jake Howard
	requests. Thanks Jiyong Yang for the report, and Natalia Bidart, Jacob Walls, and Shai Berger for reviews. Backport of eb22e1d6d643360e952609ef562c139a100ea4eb from main.
2023-03-21	[4.2.x] Fixed #34428 -- Made ASGIStaticFilesHandler adapt response to async ↵	Carlton Gibson
	iterator. Bug in 0bd2c0c9015b53c41394a1c0989afbfd94dc2830. Backport of 02c356f2f3945b8075735d485c3cf48cad991011 from main
2022-12-22	Fixed #33735 -- Added async support to StreamingHttpResponse.	Carlton Gibson
	Thanks to Florian Vazelle for initial exploratory work, and to Nick Pope and Mariusz Felisiak for review.
2022-08-04	Refs #33173, Refs #33755 -- Fixed ResourceWarning from unclosed files in ↵	Carlton Gibson
	ASGI tests.
2022-06-09	Fixed #33755 -- Moved ASGI body-file cleanup into request class.	Jonas Lundberg

2022-05-31	Fixed #33754 -- Fixed crash with prematurely closed ASGI request body.	Jonas Lundberg
	Regression in 441103a04d1d167dc870eaaf90e3fba974f67c93.
2022-04-14	Removed stale Windows asyncio test skips.	Carlton Gibson
	Underlying issue was fixed in Python 3.8.1, now many versions ago. https://bugs.python.org/issue38563
2022-02-07	Refs #33476 -- Reformatted code with Black.	django-bot

2021-07-01	Fixed #32889 -- Allowed per-request sync_to_async context in ASGIHandler .	Allan Feldman
	By using a asgiref's ThreadSensitiveContext context manager, requests will be able to execute independently of other requests when sync work is involved. Prior to this commit, a single global thread was used to execute any sync work independent of the request from which that work was scheduled. This could result in contention for the global sync thread in the case of a slow sync function. Requests are now isolated to their own sync thread.
2021-02-06	Refs #32394 -- Changed STATIC_URL/MEDIA_URL to relative paths in tests and ↵	Markus Holtermann
	docs where appropriate.
2020-11-05	Fixed #31550 -- Adjusted ASGI test_file_response for various Windows content ↵	Christopher Keith
	types.
2020-06-08	Fixed #31594 -- Added ASGIStaticFilesHandler.get_response_async().	Joshua Massover

2020-05-06	Fixed #31515 -- Made ASGIHandler dispatch lifecycle signals with thread ↵	Carlton Gibson
	sensitive.
2020-03-18	Fixed #31224 -- Added support for asynchronous views and middleware.	Andrew Godwin
	This implements support for asynchronous views, asynchronous tests, asynchronous middleware, and an asynchronous test client.
2020-03-05	Refs #31224 -- Added autoconversion of test async methods.	Andrew Godwin

2019-11-06	Harmonized Windows checks in tests to a single style.	Jon Dufresne

2019-10-24	Fixed #30900 -- Skipped async-related tests on Windows using Python 3.8.0.	Carlton Gibson
	Refs https://bugs.python.org/issue38563.
2019-06-20	Refs #30451 -- Added more tests for ASGIRequest and ASGIHandler.	Mariusz Felisiak

2019-06-20	Fixed #30451 -- Added ASGI handler and coroutine-safety.	Andrew Godwin
	This adds an ASGI handler, asgi.py file for the default project layout, a few async utilities and adds async-safety to many parts of Django.