[pull] main from django:main#401

Merged

pull[bot] merged 4 commits into

threatcode:mainfrom

May 6, 2026

Commits on May 6, 2026

Replaced old PR quality comments when writing new ones.
jacobtylerwalls
committed
Fixed #36300 -- Restored the semantic where RemoteUserMiddleware.header corresponds to request.META under ASGI.
jacobtylerwalls
committed
Refs #36862 -- Clarified security note for RemoteUserMiddleware.

committed
Refs #36439 -- Added sync_to_async() to dummy password hasher path.
jacobtylerwalls
committed