[pull] main from django:main#443

Merged

pull[bot] merged 10 commits into

threatcode:mainfrom

Jun 3, 2026

Commits on Jun 3, 2026

Fixed CVE-2026-6873 -- Prevented signed cookie salt namespace collisions.

committed
Fixed CVE-2026-7666 -- Delayed setting SMTP connection until fully configured.

RealOrangeOne
authored and
nessita
committed
Fixed CVE-2026-8404 -- Used Cache-Control directives case-insensitively in UpdateCacheMiddleware.

RealOrangeOne
authored and
nessita
committed
Fixed CVE-2026-35193 -- Varied on Authorization when caching non-public responses.

jacobtylerwalls
authored and
nessita
committed
Fixed CVE-2026-48587 -- Ignored whitespace padding when checking Vary header values.

RealOrangeOne
authored and
nessita
committed
Added stub release notes for 6.0.7.
nessita
committed
Added CVE-2026-6873, CVE-2026-7666, CVE-2026-8404, CVE-2026-35193, and CVE-2026-48587 to security archive.
nessita
committed
Fixed #34699 -- Added examples of database comparisons against Extract()/Trunc().

coolbootscoder
authored and
jacobtylerwalls
committed
Refs #36499 -- Added coverage for non-UTC TIME_ZONE with Trunc().
jacobtylerwalls
committed
Refs CVE-2026-6873 -- Defaulted SIGNED_COOKIE_LEGACY_SALT_FALLBACK transitional setting to False.
jacobtylerwalls
committed