$ the-wire · showcase
CSP nonces for streaming responses, frozendict preserved in migrations
By RepoJournal · Filed · About Django · Composed from the cited sources · methodology
Django fixed two long-tail correctness bugs that silently corrupted output: streaming responses dropped CSP nonces and migration serialization flattened frozendict values.
Fixed #37419 -- Included CSP nonces in headers for streaming responses. django/django
Streaming responses now carry the CSP nonce in their headers instead of only on buffered ones, so templates rendered through StreamingHttpResponse get nonce-gated scripts that the CSP directive will actually admit. Reported by Michael Codispoti as ticket-37419 and reviewed by Jake Howard, Jacob Walls and Rob Hudson.
Fixed #37431 -- Preserved frozendict values in migration serialization. django/django
MigrationWriter used to treat a Python 3.15 built-in frozendict as a generic iterable and serialize it as ("('answer',)", set()), discarding every value; it now emits frozendict({'answer': 42}). Field defaults hit this directly: the generated AddField migration was corrupt as soon as it ran on SQLite.
Fixed #37407 -- Prevented UUIDTextMixin from mutating the lookup in-place. django/django
UUIDTextMixin was mutating the lookup passed to it in place, leaking state into a caller that had no reason to expect its argument rewritten. The fix copies before adjusting so repeated lookups against the same object stay independent.
Bump certifi to 2026.10.19 django/djangoproject.com
djangoproject.com moved certifi to 2026.10.19 against GHSA-6q48-6c7w-9gw2, regenerating the prod, dev and tests requirement files from the upgraded uv lock. Unless you ship the site's own requirements, this one is theirs, not yours.
Fixed #37426 -- Added a pull request limit for new contributors. django/django
Contributor workflow only: a new GitHub action caps open PRs against django/django at one per author for new contributors, so a first-time patch can wait behind a second submission until the first lands.
