$ the-wire · showcase
DJANGO TIGHTENS REDIRECT LIMITS AND CRYPTO DEFAULTS
By RepoJournal · Filed · About Django · Composed from the cited sources · methodology
2 people shipped this
Django now lets you override hardcoded redirect URL length caps, while quietly deprecating SHA-1 as the default hash algorithm ahead of a breaking change in 7.0.
The headline story: HttpResponseRedirect and the redirect() shortcut now accept an optional max_length parameter [1], finally giving you control over URL length validation instead of hitting a wall. This ships with a sensible default but lets you disable the limit entirely for edge cases that demand it. Separately, Django is deprecating SHA-1 as the default algorithm for salted_hmac() and base64_hmac() [2]—the shift to SHA-256 lands in 7.0, so any custom crypto code relying on implicit SHA-1 needs attention now. On the accessibility front, AdminDate Widget buttons now carry proper Aria labels [3], closing a long-standing a11y gap that affects screen reader users. The ecosystem page also corrected a routing error: django-impersonate was pointing to an unmaintained fork; the original repository is now the official link [4]. Documentation cleanup continued with outdated iterator() notes removed .
Action items
- → Audit code using salted_hmac() or base64_hmac() — add explicit algorithm='sha256' before Django 7.0 django/django [plan]
- → If you've hit redirect URL limits, test the new max_length parameter in your next sprint django/django [monitor]
- → Update any bookmarks or docs pointing to django-impersonate — use the maintained original repo django/djangoproject.com [plan]
References
- [1] Fixed #36767 -- Allowed max redirect URL length to be set on HttpResponseRedirect. ↗ django/django
- [2] Fixed #37078 -- Deprecated SHA-1 default for salted_hmac() and base64_hmac() algorithm. ↗ django/django
- [3] Fixed #36459 -- Added Aria labels to the buttons inside the AdminDate Widget. ↗ django/django
- [4] Link maintained version of django-impersonate ↗ django/djangoproject.com
