Django: Step Validation Precision and Cookie Deletion Fix
Two proposals target the same step validator flaw where float conversion accepted invalid large integers and decimals and turned extreme values into server errors, while a merged fix corrects deletion of secure prefixed cookies.
Duration: PT2M8S
Episode overview
This episode is a short developer briefing from Django.
It explains recent repository work in plain language.
- Show: Django
- Published: 2026-11-02T14:03:57Z
- Audio duration: PT2M8S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning, it's Monday, November second, 2026, and this is your Django briefing.
The top signal today is input validation you can trust. Two separate proposals tackle the same flaw where step validation mishandled very large numbers, letting bad data through and turning some inputs into server errors.
The issue centers on the step value validator, which checks that a number aligns with a defined increment. Both PR 22231 and PR 22232 trace the problem to float conversion during the remainder check. That conversion loses precision for large integers and decimals, so for example a large odd integer could be accepted…
Second, a merged fix for cookie handling. PR 22230, now in as commit 308b6d6, allows cookie deletion to support the secure HTTP and host HTTP prefixed names by enforcing the HTTP-only flag. Previously, deletion would not line up with browser requirements for those prefixes. If you use those prefixes, deletion should…
Finally, PR 22233 clarifies documentation around changing primary keys to existing values — a warning that in-place key changes have side effects worth understanding before you rely on model save behavior.
What's next: watch which of the two validator…
Nearby episodes from Django
- Command Rename, Query Fixes and Session Hardening
- Query Reliability Fixes and Docs Polish
- Database Crash Fixes and Security Hardening
- Primary Key Fixes and Translation Safety
- Weekly Recap - Docs Platform Reset and Request Hardening
- Server Time Logging Fix
- 2028 Prep and Silent-Failure Fixes
- Docs Theme Tests and Tooling Reliability