From 4774adfaa18391854bb5449b4bcb0e9ab5e66b73 Mon Sep 17 00:00:00 2001
From: Pravin Kamble <iampbkamble@gmail.com>
Date: Wed, 17 Dec 2025 21:44:48 +0530
Subject: Fixed #32568 -- Replaced mark_safe() with SafeString for literal
 values.

Replaced instances of mark_safe('some string literal') with
SafeString to avoid the overhead of managing lazy objects.

Thanks Tim McCurrach for the idea and David Smith and Jacob Walls
for reviews.
---
 django/contrib/admin/templatetags/admin_list.py | 8 ++++----
 django/utils/html.py                            | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/django/contrib/admin/templatetags/admin_list.py b/django/contrib/admin/templatetags/admin_list.py
index 52aae9e589..3aa937c787 100644
--- a/django/contrib/admin/templatetags/admin_list.py
+++ b/django/contrib/admin/templatetags/admin_list.py
@@ -25,7 +25,7 @@ from django.templatetags.static import static
 from django.urls import NoReverseMatch
 from django.utils import formats, timezone
 from django.utils.html import format_html
-from django.utils.safestring import mark_safe
+from django.utils.safestring import SafeString, mark_safe
 from django.utils.text import capfirst
 from django.utils.translation import gettext as _
 
@@ -103,11 +103,11 @@ def result_headers(cl):
             if field_name == "action_checkbox":
                 aria_label = _("Select all objects on this page for an action")
                 yield {
-                    "text": mark_safe(
+                    "text": SafeString(
                         f'<input type="checkbox" id="action-toggle" '
                         f'aria-label="{aria_label}">'
                     ),
-                    "class_attrib": mark_safe(' class="action-checkbox-column"'),
+                    "class_attrib": SafeString(' class="action-checkbox-column"'),
                     "sortable": False,
                 }
                 continue
@@ -256,7 +256,7 @@ def items_for_result(cl, result, form):
                     f, (models.DateField, models.TimeField, models.ForeignKey)
                 ):
                     row_classes.append("nowrap")
-        row_class = mark_safe(' class="%s"' % " ".join(row_classes))
+        row_class = SafeString(' class="%s"' % " ".join(row_classes))
         # If list_display_links not defined, add the link tag to the first
         # field
         if link_to_changelist:
diff --git a/django/utils/html.py b/django/utils/html.py
index 68260af337..71122ac79e 100644
--- a/django/utils/html.py
+++ b/django/utils/html.py
@@ -397,7 +397,7 @@ class Urlizer:
                     attrs=nofollow_attr,
                     url=trimmed,
                 )
-                return mark_safe(f"{lead}{middle}{trail}")
+                return SafeString(f"{lead}{middle}{trail}")
             else:
                 if safe_input:
                     return mark_safe(word)
-- 
cgit v1.3