Skip to content

[pull] main from django:main#465

Merged
pull[bot] merged 4 commits into
threatcode:mainfrom
django:main
Jun 19, 2026
Merged

[pull] main from django:main#465
pull[bot] merged 4 commits into
threatcode:mainfrom
django:main

Conversation

@pull

@pull pull Bot commented Jun 19, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

jacobtylerwalls and others added 4 commits June 19, 2026 09:10
Removed outdated warnings, and updated performance considerations to
reflect current realities.

Thanks to Mykhailo Havelia for the detailed review.
…ectives.

The switch from substring matching to exact token membership in
142b881 caused qualified directive
forms permitted by RFC 9111 (e.g. `Cache-Control: private="Set-Cookie"`)
to be missed, allowing such responses to be stored in a shared cache.

This work added a new `split_directive_names()` helper that yields the
lowercased directive name from each token, dropping any qualified value
and stripping whitespace around "=", so qualified forms reduce to their
directive name. `UpdateCacheMiddleware` now uses it so `private`,
`no-cache`, and `no-store` (and the `public` exception for
`Authorization`) match regardless of qualified form.

Aligned `ConditionalGetMiddleware.needs_etag()` to use the same helper,
since it relied on the same brittle exact-token check. Sharing one
helper keeps the two directive lookups consistent and means malformed
input (e.g. `no-store="x"`) now correctly suppresses the `ETag` instead
of being silently ignored.

Also stripped whitespace around `=` in `patch_cache_control`'s directive
parsing so a qualified directive with stray whitespace is still recognized.

Thanks to Jacob Walls for reviews.
@pull pull Bot locked and limited conversation to collaborators Jun 19, 2026
@pull pull Bot added the ⤵️ pull label Jun 19, 2026
@pull pull Bot merged commit b461519 into threatcode:main Jun 19, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants