The Wire · Showcase
DJANGO PATCHES REDIRECT LENGTH BUG AND PYTHON 3.14 TEST FAILURES
By RepoJournal · Filed · About Django
Django shipped fixes for a percent-encoded redirect length vulnerability and Python 3.14 compatibility issues that were breaking test suites.
The core fixes land in django/django this cycle: a critical redirect length check [1] now validates against percent-encoded URLs (catching bypass attempts that rely on encoding tricks), and a test compatibility fix [2] resolves failures on Python 3.14.5+ caused by upstream cpython changes. Documentation also got a clarification [3] on why setting model fields doesn't auto-convert types — a common source of subtle bugs. The redirect fix is the one to watch: it closes a security gap in how Django validates max_length on redirects, and teams relying on that validation should verify their implementations handle encoded URLs correctly. Over on djangoproject.com, dependency updates [4] [5] rolled through: requests 2.33.1 cleans up test artifacts from CVE work, and django-debug-toolbar 6.3.0 shipped new improvements. These are routine maintenance — no breaking changes.
Action items
- → Review redirect validation logic in your views if you use max_length checks django/django [plan]
- → Merge the Python 3.14 test fix before upgrading test infrastructure django/django [monitor]
- → Update requests and django-debug-toolbar in your requirements django/djangoproject.com [plan]
References
- [1] Fixed #37095 -- Checked maximum redirect lengths against percent-encoded URLs. django/django
- [2] Fixed #37096 -- Fixed test_invalid_choice_db_option on Python 3.14.5+. django/django
- [3] Fixed #27825 -- Doc'd that setting model fields does not convert types. django/django
- [4] Bump requests from 2.33.0 to 2.33.1 in /requirements ↗ django/djangoproject.com
- [5] Bump django-debug-toolbar from 6.2.0 to 6.3.0 in /requirements ↗ django/djangoproject.com
FAQ
- What changed in Django on May 13, 2026?
- Django shipped fixes for a percent-encoded redirect length vulnerability and Python 3.14 compatibility issues that were breaking test suites.
- What should Django teams do about it?
- Review redirect validation logic in your views if you use max_length checks • Merge the Python 3.14 test fix before upgrading test infrastructure • Update requests and django-debug-toolbar in your requirements
- Which Django repositories shipped on May 13, 2026?
- django/django, django/djangoproject.com