[pull] main from django:main#351

Merged

pull[bot] merged 7 commits intothreatcode:mainfrom

Apr 2, 2026

Commits on Apr 2, 2026

Fixed #37017 -- Fixed setting or clearing of request.user after alogin/alogout().
jacobtylerwalls
committed
Fixed #36862 -- Doc'd the need for a proxy when deploying RemoteUserMiddleware under ASGI.
jacobtylerwalls
committed
Added section for respecting maintainer time to the security policy.
nessita
committed
Fixed #36949 -- Improved RelatedFieldWidgetWrapper <label>s.

smithdc1
authored and
jacobtylerwalls
committed
Refs #20024 -- Tested __in lookups with None against composite pk fields.

Eddy-123
authored and
jacobtylerwalls
committed
Fixed #20024 -- Fixed handling of __in lookups with None in exclude().

Eddy-123
authored and
jacobtylerwalls
committed
Refs #36862 -- Reiterated security note on both variants of RemoteUserMiddleware.
jacobtylerwalls
committed