The Wire · Showcase
DJANGO DROPS UNSAFE JSON RESPONSE PARAMETER
By RepoJournal · Filed · About Django
Django is deprecating the safe parameter in JSONResponse, finally closing a vulnerability that JavaScript frameworks eliminated years ago.
The safe parameter, a quirk of pre-ES5 JavaScript that allowed JSON injection attacks, is being removed [1]. Every peer framework has already dropped this check. This is a straightforward deprecation path for anyone still passing safe=False to JSONResponse. In related infrastructure work, the release script got hardened with git tag commit hashes and expanded test coverage [2], so future releases will be even more bulletproof. The security docs also got a cleanup pass to link directly to severity level definitions instead of burying context in the disclosure process [3]. On the async auth front, login() and logout() now properly update request.auser when it exists on the request object [4], completing a follow-up that started with earlier async authentication work. Documentation also got a minor fix removing outdated language about unlimited results in QuerySet.get() [5]. The djangoproject.com admin gained better security issue tracking with discovery field exposure and UTC time rendering for checklists [6] [7] [8].
Action items
- → Review code using JSONResponse with safe parameter - plan deprecation removal django/django [plan]
- → Test async login/logout flows to confirm request.auser updates correctly django/django [monitor]
- → Run security issue audits against updated admin checklist tools django/djangoproject.com [monitor]
References
- [1] Fixed #36905 -- Deprecated the safe parameter of JSONResponse. django/django
- [2] Improved release script by adding git tag commit hash and extra tests. ↗ django/django
- [3] Updated links to severity levels in release notes. ↗ django/django
- [4] Fixed #37019 -- Updated login() and logout() to set request.auser. ↗ django/django
- [5] Fixed #35596 -- Removed mention of unlimited results from QuerySet.get(). django/django
- [6] [checklists] Expose "discovery" in SecurityIssue admin fields. ↗ django/djangoproject.com
- [7] [checklists] Render checklists title using UTC time. django/djangoproject.com
- [8] [checklists] Expose "discovery" in SecurityIssue admin fields. django/djangoproject.com
FAQ
- What changed in Django on May 28, 2026?
- Django is deprecating the safe parameter in JSONResponse, finally closing a vulnerability that JavaScript frameworks eliminated years ago.
- What should Django teams do about it?
- Review code using JSONResponse with safe parameter - plan deprecation removal • Test async login/logout flows to confirm request.auser updates correctly • Run security issue audits against updated admin checklist tools
- Which Django repositories shipped on May 28, 2026?
- django/django, django/djangoproject.com