[pull] main from django:main#355

Merged

pull[bot] merged 10 commits intothreatcode:mainfrom

Apr 7, 2026

Commits on Apr 7, 2026

Fixed CVE-2026-3902 -- Ignored headers with underscores in ASGIRequest.
jacobtylerwalls
committed
Fixed CVE-2026-4277 -- Checked add permissions in GenericInlineModelAdmin.
jacobtylerwalls
committed
Fixed CVE-2026-4292 -- Disallowed instance creation via ModelAdmin.list_editable.
jacobtylerwalls
committed
Fixed CVE-2026-33033 -- Mitigated potential DoS in MultiPartParser.

nessita
authored and
jacobtylerwalls
committed
Fixed CVE-2026-33034 -- Enforced DATA_UPLOAD_MAX_MEMORY_SIZE on body size in ASGI requests.

nessita
authored and
jacobtylerwalls
committed
Added stub release notes for 6.0.5.
jacobtylerwalls
committed
Added CVE-2026-3902, CVE-2026-4277, CVE-2026-4292, CVE-2026-33033, and CVE-2026-33034 to security archive.
jacobtylerwalls
committed
Refs CVE-2026-33034 -- Improved security documentation on handling large request bodies.

RealOrangeOne
authored and
jacobtylerwalls
committed
Fixed two issues in release helper scripts/verify_release.sh.

nessita
authored and
jacobtylerwalls
committed
Fixed #36816 -- Allowed **kwargs in @task decorator.

nileshpahari
authored and
jacobtylerwalls
committed