$ the-wire · showcase
Django adds HTTP QUERY support, fixes a template lexer regression
By RepoJournal · Filed · About Django · Composed from the cited sources · methodology
3 people shipped this
Django implemented the HTTP QUERY method end to end across request handling and the test clients, while a whitespace regression in the template lexer leaves {%endcomment%} and {%endverbatim%} unclosed.
Fixed #37232 -- Added support for the HTTP QUERY method. django/django
QUERY (RFC 10008) is treated as safe and idempotent throughout: exempt from CSRF, precondition-checked like GET, accepted by require_safe(), and dispatched from View through a new query() handler, with the request content exposed as HttpRequest.body rather than parsed into HttpRequest.POST. Client.query() lands on the test client, the async client, and both request factories; caching is explici...
Fixed #37450 -- Fixed parsing of comment and verbatim tags without spaces. django/django
Since 1a9fba7a6c2a0acead19bbb45c25ceb0fdcca7c8, _comment_end_re and _verbatim_end_re demand whitespace after {% and _raw_start_re demands it before comment/verbatim, so {%endcomment%} and {%endverbatim%} never close a raw block and {%verbatim%} is not lexed as raw text when debug=False. Templates mixing spaced opening tags with tight closing tags fail to parse; this patch restores the required ...
Fixed #37370 -- Reorganized the security policy page. django/django
docs/internals/security.txt is restructured into three top-level sections matching the externally visible process, starting with reporting: how to report, what to include, scope and reporting requirements (the six existing "must" subsections), and respecting maintainer time. No code changes; anyone who links into the old page anchor structure will need a new target.
Fixed #37370 -- Reorganized the security policy page. django/django
The same reorganization merged to the repository as commit e9414948e9660ee4c167eebb187710ee3031d9d8, so the docs change is now on main rather than sitting in review.
