Django-csp

Latest version: v3.8

Safety actively analyzes 701507 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 3

4.0b2

=====
- Add type hints. ([228](https://github.com/mozilla/django-csp/pull/228))
- Expand ruff configuration and move into pyproject.toml [[234](https://github.com/mozilla/django-csp/pull/234)]
- Documentation fixes by jamesbeith and jcari-dev
- Simplify middleware logic ([226](https://github.com/mozilla/django-csp/pull/226))
- Report percentage of 100% should always send CSP report ([236](https://github.com/mozilla/django-csp/pull/236))
- Changes to make `CSPMiddleware` easier to subclass ([237](https://github.com/mozilla/django-csp/pull/237))
- Change `REPORT_PERCENTAGE` to allow floats (e.g. for values < 1%) ([242](https://github.com/mozilla/django-csp/pull/242))
- Add Django 5.1 support ([243](https://github.com/mozilla/django-csp/pull/243))

4.0b1

=====
BACKWARDS INCOMPATIBLE changes:
- Move to dict-based configuration which allows for setting policies for both enforced and
report-only. See the migration guide in the docs for migrating your settings.
- Switch from specifying which directives should contain the nonce as a separate list, and instead
use a sentinel `NONCE` in the directive itself.

Other changes:
- Add pyproject-fmt to pre-commit, and update pre-commit versions
- Fixes 36: Add support for enforced and report-only policies simultaneously
- Drop support for Django <=3.2, end of extended support
- Add CSP keyword constants in `csp.constants`, e.g. to replace `"'self'"` with `SELF`

3.8

===

Please note: this release folds in a number of fixups, upgrades and documentation tweaks,
but is functionally the same as 3.7. New features will come with 3.9+

- Update Python syntax for modern versions with pyupgrade
- Drop support for EOL Python <3.8 and Django <2.2 version; add support up to Django 5 on Python 3.12
- Switch to ruff instead of pep8 and flake8
- Move from CircleCI to Github Actions for CI
- Add support for using pre-commit with the project
- Remove deprecation warning for child-src
- Fix capturing brackets in script template tags
- Update docs to clarify when nonce will not be added to headers
- Move from setup.py and setup.cfg to pyproject.toml (209)

Note: identical other than release packaging to 3.8rc1

3.8rc1

======
- Move from setup.py and setup.cfg to pyproject.toml (209)

3.8rc

=====

Please note: this release folds in a number of fixups, upgrades and documentation tweaks,
but is functionally the same as 3.7. New features will come with 3.9+

- Update Python syntax for modern versions with pyupgrade
- Drop support for EOL Python <3.8 and Django <2.2 version; add support up to Django 5 on Python 3.12
- Switch to ruff instead of pep8 and flake8
- Move from CircleCI to Github Actions for CI
- Add support for using pre-commit with the project
- Remove deprecation warning for child-src
- Fix capturing brackets in script template tags
- Update docs to clarify when nonce will not be added to headers

3.7

===

- Add support for Trusted Types
- Use 128 bits base64 encoded for nonce

Page 1 of 3

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.