Django adds HTTP QUERY method support

By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology

♥

Alongside it, a join promotion fix for XOR conditions and the security policy page reorganized into three sections.

45 commits 31 PRs merged 7 briefings covered

all django reviews →

← previous week django wire →

Fixed #37232 -- Added support for the HTTP QUERY method. django/django

by mbeijen

Implements the HTTP QUERY method (RFC 10008) as a safe, idempotent method throughout Django: exempt from CSRF protection, evaluated for request preconditions as GET is, accepted by require_safe(), and dispatched by View via a query handler. If you route or middleware-filter on request method, audit those paths before a release ships with this.

Fixed #37438 -- Fixed join promotion for XOR conditions. django/django

by Pravin Kamble

JoinPromoter did not handle XOR conditions, so a negated XOR could use an INNER JOIN and drop rows that should be returned. QuerySets with .xor() excluded from a filter were the exposure.

Fixed #37089 -- Made ignore_warnings() match substrings by default. django/django

by HelmiDev03

ignore_warnings() now matches substrings by default instead of requiring exact matches, so filter strings can be fragments of the warning message. Replaces two earlier attempts that never merged.

Fixed #35899 -- Allowed multiline template tags. django/django

by sarahboyce

Template tags can now span lines, matching what other template engines already allow. Long {% if %} and {% include %} expressions no longer have to be squeezed onto one line.

Fixed #37450 -- Fixed parsing of comment and verbatim tags without spaces. django/django

by spokodev

Since an earlier lexer change, _comment_end_re and _verbatim_end_re required whitespace after {% and _raw_start_re required it before the tag name, so {%endcomment%} and {%endverbatim%} never closed a raw block. Templates written without spaces around the tag name broke; this restores them.

Fixed #37370 -- Reorganized the security policy page. django/django

by OsmnvAslan

docs/internals/security.txt now follows the structure proposed on the ticket and refined by Jake Howard: three top-level sections matching the externally visible processes, in order. Reporters following the page will find the disclosure steps where they expect them.

Ensured docs checks cover same files as docs builds. django/django

by Mike Edmunds

The docs make black and make lint checks now take their file list from Sphinx's own source discovery, making docs/conf.py the single source of truth for what counts as a docs source. A file in the build is now a file the checks see.

Fixed `make.bat check` to exit non-zero when a check fails. django/django

by Natalia

The Windows make.bat check target ran lint, black, and spelling in sequence and exited with the status of the last one, so an early failure still reported overall success. It now records each failure and returns non-zero.

$ ls django/week/ # the briefings behind this review

Mon Oct 26 GeoDjango CI version labels corrected, ubuntu-latest results land in django-asv Tue Oct 27 Django adds HTTP QUERY support, fixes a template lexer regression Wed Oct 28 Join promotion learns XOR, docs build gains EPUBCheck Thu Oct 29 Multiline template tags and substring warning filters land Fri Oct 30 Windows docs checks get a real exit code, and one file list to rule them all Sat Oct 31 Django's docs move to pydata-sphinx-theme, with deploys pre-staged Sun Nov 1 Dependabot config fixed, ubuntu-latest benchmarks landed

all django reviews →

← previous week django wire →