Django: Cookie Security Fix and a Flood of Duplicate PRs
A new security fast-fail for browser-rejected cookie prefixes landed alongside a wave of near-duplicate cleanup pull requests, highlighting a recurring pattern of contributors resubmitting the same fix multiple times instead of iterating on one branch.
Duration: PT2M33S
Episode overview
This episode is a short developer briefing from Django.
It explains recent repository work in plain language.
- Show: Django
- Published: 2026-09-12T13:05:21Z
- Audio duration: PT2M33S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good day, it's September 12th, and this is Django.
Today's activity is dominated by duplication. Three separate pull requests, numbers 21967, 21968, and 21969, all fix the same issue: Django's set cookie method was silently issuing cookies with the "underscore-underscore-Secure" or "underscore-underscore-Host" prefixes without the attributes browsers actually…
That same pattern shows up again with flake8-bugbear cleanup. Five pull requests, 21957 through 21962, all attempt the identical fix: replacing broad "assertRaises Exception" checks in test files with specific exception types, since catching a bare Exception can accidentally swallow things like keyboard interrupts.…
Beyond the duplicates, a few solid, distinct improvements moved forward. PR 21964 fixes Oracle-specific text lookup failures, addressing a real byte-limit constraint in Oracle's VARCHAR2 type that was breaking "contains," "exact," and "regex" queries. PR 21956 allows standard library IP address objects to be…
Two small documentation grammar fixes, PRs 21965 and 21966, rounded out the day.
What's next: maintainers will need to pick one canonical pull request from each duplicate cluster, and closing the redundant…
Nearby episodes from Django
- Cookie Prefix Safety Check
- When Duplicate Fixes Flood the Queue
- Fixing Old Bugs and Cleaning Up Assumptions
- Test Reliability and Geospatial Cleanup
- Quiet Fixes for Old, Sneaky Bugs
- Weekly Recap - Calendar Versioning Arrives, Query Layer Cleanup Continues
- Spam in the Docs, Substance in the Backend
- Versioning Overhaul and Duplicate Fix Cleanup