CVE records can scope regressions per branch

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

Django's security checklist can now name the first affected release on each branch, cutting over-broad advisory ranges; CSP nonce fixes and a cached_property deprecation also landed.

47 commits 36 PRs merged 7 briefings covered

all django reviews →

← previous week django wire →

[checklists] Allowed choosing the first affected release per branch in CVE records. django/djangoproject.com

by Natalia

The checklist previously forced every branch to be listed as affected from its feature version, which overstated the range for regressions introduced by an earlier security fix within the same series. Security team members composing advisory text get a per-branch starting point instead, so published ranges should stop covering releases that never carried the flaw.

Fixed #37419 -- Included CSP nonces in headers for streaming responses. django/django

by Sarah Boyce

The nonce now appears in headers for streaming responses, so a StreamingHttpResponse no longer loses its CSP nonce when the policy is attached. Reported by Michael Codispoti, reviewed by Jake Howard, Jacob Walls and Rob Hudson.

Fixed #37395 -- Emitted 'none' for CSP directives left empty by an unused nonce. django/django

by MaybeSomeone-arc18

When a directive's only source is CSP.NONCE and the nonce goes unused, the stripped sentinel left the directive empty and it was dropped from the header entirely, falling the browser back to the default. It now emits 'none', which is the difference between a policy and no policy at all.

Fixed #37431 -- Preserved frozendict values in migration serialization. django/django

by amanjain

MigrationWriter treated Python 3.15's built-in frozendict as a generic iterable and dropped its values when writing migrations. Keys and values now serialize, so migrations generated on 3.15 stop silently losing data.

Fixed #37433 -- Escaped database error messages logged by Q.check(). django/django

by nessita

Database error messages can embed the values being validated, and those values may come from user input. Q.check() now escapes them before logging, closing a channel for input to land unescaped in logs.

Allow nesting ThreadSensitiveContext. (#596) django/asgiref

by Caleb Hattingh

A provided executor lets thread-sensitive work move off the wrapping context's worker, which matters when nesting sync_to_async boundaries. Tracked back to ticket 33882.

Fixed #37396 -- Added gettext to PATH in Windows CI. django/django

by HelmiDev03

Chocolatey's gettext bin directory was not on PATH for later steps, so tests needing msgfmt and xgettext were skipped on Windows and failures there could pass unnoticed. PoFileTests.test_no_write_access is skipped on Windows, where chmod() cannot make a directory read-only.

Results for ubuntu-latest added [skip ci] django/django-asv

by Github Bot

Alongside: the benchmark suite now collects ubuntu-latest results, build_doc_release runs each Sphinx build in its own sphinx-build subprocess, the annual release cycle is documented in the release process docs, UUIDTextMixin no longer mutates its lookup in place, and djangosnippets replaced a dependency that no longer exists on PyPI.

$ ls django/week/ # the briefings behind this review

Mon Oct 19 django-asv adds ubuntu-latest benchmark results Tue Oct 20 CVE records can now scope regressions per branch, docs builds move to sphinx-build Wed Oct 21 CSP nonces for streaming responses, frozendict preserved in migrations Thu Oct 22 Windows CI gets gettext, djangosnippets drops a dead dependency Fri Oct 23 ThreadSensitiveContext gains nesting, Q.check() escapes logged DB errors Sat Oct 24 cached_property deprecation lands, asgiref 3.13.0 ships Sun Oct 25 Ubuntu-latest results land in the Django benchmark suite

all django reviews →

← previous week django wire →