Skip to content

4.1.0

Choose a tag to compare

View all tags
@Archmonger Archmonger released this 07 Mar 09:01
· 16 commits to main since this release
4.1.0
e7cf37a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Tip

This release includes some changes to the default behavior of ServeStatic for security hardening. If you are affected by any of these changes, please read the relevant sections in the documentation on allow_unsafe_symlinks.

Added

  • Added support for zstd compression on Python 3.14+.
  • Added support for the top-level servestatic module to run as a Django app.
  • Added Django system checks to test for common misconfigurations.
  • Added allow_unsafe_symlinks configuration option for WSGI/ASGI
  • Added SERVESTATIC_ALLOW_UNSAFE_SYMLINKS configuration option for Django.
  • Added jxl image support.

Changed

  • Improved event-loop handling for ASGI file iterator.
  • Installing servestatic as a Django app is now the suggested configuration. A warning will appear if it is not detected in INSTALLED_APPS when DEBUG is True.
  • servestatic.runserver_nostatic is no longer the recommended Django app installation path. This import path will be retained to ease WhiteNoise to ServeStatic migration, but now the documentation recommends to use the top-level servestatic module instead.

Fixed

  • Fixed a range-request edge case where the last byte could be requested but would not be served.

Security

  • Hardened autorefresh path matching to prevent potential path traversal or path clobbering.
  • Hardened static file resolution to block symlink breakout by default. If your symlinks point to files outside of your static root, it is highly recommended to copy them instead.
Assets 4
Loading