From 3e4e0db66961a48a080ff3ff91f6c0d954261366 Mon Sep 17 00:00:00 2001
From: Johannes Maron <johannes@maron.family>
Date: Mon, 11 May 2026 17:35:36 +0200
Subject: Fixed #36825 -- Extended admin templates so CSP nonce is included if
 available.

Error pages, admin, and registration templates were updated to use
`{% csp_nonce %}` on their explicit `<script>`, `<link>`, and `<style>`
HTML elements.

Co-authored-by: Antoliny0919 <antoliny0919@gmail.com>
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
---
 docs/releases/6.1.txt | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'docs')

diff --git a/docs/releases/6.1.txt b/docs/releases/6.1.txt
index 8f7172256e..0415856c95 100644
--- a/docs/releases/6.1.txt
+++ b/docs/releases/6.1.txt
@@ -282,6 +282,11 @@ CSP
   with ``CSP.NONCE`` in a CSP policy but
   ``django.template.context_processors.csp`` is not configured.
 
+* CSP nonce attributes are now added on ``<script>``, ``<style>``, and
+  ``<link>`` elements in admin templates and all built-in templates when the
+  :func:`~django.template.context_processors.csp` context processor is
+  configured. See :ref:`csp-nonce-config` for setup instructions.
+
 CSRF
 ~~~~
 
-- 
cgit v1.3