[pull] main from django:main#282

Merged

pull[bot] merged 10 commits intothreatcode:mainfrom

Feb 3, 2026

Commits on Feb 3, 2026

Fixed CVE-2025-13473 -- Standardized timing of check_password() in mod_wsgi auth handler.

authored and
jacobtylerwalls
committed
Fixed CVE-2025-14550 -- Optimized repeated header parsing in ASGI requests.

RealOrangeOne
authored and
jacobtylerwalls
committed
Fixed CVE-2026-1207 -- Prevented SQL injections in RasterField lookups via band index.
jacobtylerwalls
committed
Fixed CVE-2026-1285 -- Mitigated potential DoS in django.utils.text.Truncator for HTML input.

nessita
authored and
jacobtylerwalls
committed
Fixed CVE-2026-1287 -- Protected against SQL injection in column aliases via control characters.

RealOrangeOne
authored and
jacobtylerwalls
committed
Fixed CVE-2026-1312 -- Protected order_by() from SQL injection via aliases with periods.
jacobtylerwalls
committed
Refs CVE-2026-1312 -- Raised ValueError when FilteredRelation aliases contain periods.
jacobtylerwalls
committed
Added stub release notes for 6.0.3.
jacobtylerwalls
committed
Added CVE-2025-13473, CVE-2025-14550, CVE-2026-1207, CVE-2026-1285, CVE-2026-1287, and CVE-2026-1312 to security archive.
jacobtylerwalls
committed
Fixed #36898 -- Documented SessionBase.is_empty().

jafarkhan83
authored and
jacobtylerwalls
committed