Django Templates 6.0

Apply python/django/6.0 first. These additional rules cover the Django Template Language (DTL) shipped with Django 6.0.8, including template partials, on supported Python 3.12–3.14 micro releases. Stay on the latest security patch in the 6.0 line.

Template loading and partials

• Keep TEMPLATES entries, DIRS, APP_DIRS, OPTIONS["loaders"], and installed application templates under trusted deployment control. Review loader and INSTALLED_APPS precedence when names collide; pass an explicit engine name through using when selecting among engines with different trust or escaping policies.
• Preserve path containment when implementing custom filesystem loaders. Django's filesystem loader uses safe_join(), which checks normalized paths without resolving symlinks; prevent untrusted writes to template roots, their ancestors, and symlink targets rather than treating a configured root as a filesystem sandbox.
• Map external display choices to server-owned template names before calling get_template(), select_template(), {% include %}, or {% extends %}. Allowlist the complete page.html#partial_name target and every fallback candidate; include targets can also be objects with render(), so accept those only from trusted application code.
• Authorize and scope data independently in views that render page.html#partial_name. Loading a partial renders that fragment without the surrounding page's conditions or layout; a permission check around its original definition or use does not protect a separate fragment endpoint.
• Give reusable includes only their