... a lot of details, so please read on. Use the checklists app To generate a checklist compiling the tasks described below as relevant to the specific release(s) you are issuing, use the checklists app in the project admin . This populates a lot of boilerpl ... xport CVE_USER = <user-email>@djangoproject.com CVE_ORG = DSF Reserve: $ cve --interactive reserve <quantity> Generate the relevant (private) patch(es) using git format-patch , one for the main branch and one for each stable branch being patched. A week ... recipients are in the private django-security GitHub wiki. BCC the pre-notification recipients, and be sure to include the relevant CVE IDs. Attach all the relevant patches (targeting main and the stable branches), and sign the email text with the key yo ... ... a lot of details, so please read on. Use the checklists app To generate a checklist compiling the tasks described below as relevant to the specific release(s) you are issuing, use the checklists app in the project admin . This populates a lot of boilerpl ... xport CVE_USER = <user-email>@djangoproject.com CVE_ORG = DSF Reserve: $ cve --interactive reserve <quantity> Generate the relevant (private) patch(es) using git format-patch , one for the main branch and one for each stable branch being patched. A week ... recipients are in the private django-security GitHub wiki. BCC the pre-notification recipients, and be sure to include the relevant CVE IDs. Attach all the relevant patches (targeting main and the stable branches), and sign the email text with the key yo ... ... weeks before the security team comes to a conclusion. There is no need to chase the security team unless you discover new, relevant information. All reports aim to be resolved within the industry-standard 90 days. Confirmed vulnerabilities with a high se ... de for issues that are clearly and directly related to an already reported finding. Feedback on an initial report is often relevant to subsequent ones, and taking the time to read and incorporate it leads to better reports overall. The security team is n ... Django only officially supports the latest micro release (A.B.C) of Python. Vulnerabilities must be reproducible when all relevant dependencies (not limited to Python) are at supported versions. For example, vulnerabilities that only occur when Django i ... ... weeks before the security team comes to a conclusion. There is no need to chase the security team unless you discover new, relevant information. All reports aim to be resolved within the industry-standard 90 days. Confirmed vulnerabilities with a high se ... de for issues that are clearly and directly related to an already reported finding. Feedback on an initial report is often relevant to subsequent ones, and taking the time to read and incorporate it leads to better reports overall. The security team is n ... Django only officially supports the latest micro release (A.B.C) of Python. Vulnerabilities must be reproducible when all relevant dependencies (not limited to Python) are at supported versions. For example, vulnerabilities that only occur when Django i ... ... ld consider refactoring that part of the code. If a trend is emerging, you should raise it for discussion (referencing the relevant tickets) on the Django Forum . Verify if solutions submitted by others are correct. If they are correct and also contain a ... he APIs and documentation accessible and well explained? Domain expertise review. Do you have a personal expertise that is relevant such as databases, HTTP, security, etc? Benchmarking and performance review. There are benchmarking tests, but sometimes c ... ... ld consider refactoring that part of the code. If a trend is emerging, you should raise it for discussion (referencing the relevant tickets) on the Django Forum . Verify if solutions submitted by others are correct. If they are correct and also contain a ... he APIs and documentation accessible and well explained? Domain expertise review. Do you have a personal expertise that is relevant such as databases, HTTP, security, etc? Benchmarking and performance review. There are benchmarking tests, but sometimes c ... ... incompatible with older but still supported versions of Python. Run the tests and make sure they pass. Where possible and relevant, try them out on a database other than SQLite. Leave comments and feedback! Keep old patches up-to-date ¶ Oftentimes the c ... ... ments to execute without relying on 'unsafe-inline' . Nonces are enabled by including the special placeholder NONCE in the relevant directive(s) of your CSP settings , such as script-src or style-src . When present, the ContentSecurityPolicyMiddleware wi ... ... incompatible with older but still supported versions of Python. Run the tests and make sure they pass. Where possible and relevant, try them out on a database other than SQLite. Leave comments and feedback! Keep old patches up-to-date ¶ Oftentimes the c ... ... ments to execute without relying on 'unsafe-inline' . Nonces are enabled by including the special placeholder NONCE in the relevant directive(s) of your CSP settings , such as script-src or style-src . When present, the ContentSecurityPolicyMiddleware wi ... 2026年10月08日