Repository navigation

[pull] main from django:main - #399

Merged

pull[bot] merged 5 commits into

threatcode:mainfrom

May 5, 2026

Merged

[pull] main from django:main#399
pull[bot] merged 5 commits into
threatcode:mainfrom
django:main

Commits on May 5, 2026
- Fixed CVE-2026-5766 -- Enforced DATA_UPLOAD_MAX_MEMORY_SIZE in MemoryFileUploadHandler on ASGI.
  
  authored and
  sarahboyce
  committed
  5a89e34
- Fixed CVE-2026-35192 -- Ensured Vary header is sent when setting session cookie with SESSION_SAVE_EVERY_REQUEST=True.
  
  RealOrangeOne
  authored and
  sarahboyce
  committed
  7f6e9b5
- Fixed CVE-2026-6907 -- Prevented caching of requests when Vary header contains an asterisk.
  sarahboyce
  committed
  c79bdfc
- Added stub release notes for 6.0.6.
  sarahboyce
  committed
  fcfc4b2
- Added CVE-2026-5766, CVE-2026-35192, and CVE-2026-6907 to security archive.
  sarahboyce
  committed
  17b93fa