Django Templates 6.1

Apply python/django/6.1 first. These additional rules cover the Django Template Language shipped with Django 6.1.1 on Python 3.12–3.14. Apply separate backend-specific guidance when using Jinja2 or another template engine.

Template authority and loader configuration

• Keep TEMPLATES, DIRS, installed applications, loader order, libraries, and builtins under deployment control. Review template-name shadowing and every extension; builtins makes tags available without {% load %}.
• Map external layout, theme, and email-template choices to approved names before get_template(), select_template(), {% extends %}, or {% include %}. Keep backend using= aliases and complete template.html#partial_name selectors on the same allowlist.
• Keep template roots and their symlink targets unwritable by tenants or upload handlers. The filesystem loader's safe_join() checks normalized path containment, not resolved symlink containment; preserve equivalent containment in custom loaders.
• Give tenant-specific trusted templates distinct names or separate engines with independent loader caches. cached.Loader keys compiled templates and missing-template results by name and skipped origins, not request or tenant; changing a loader's roots per request can reuse another tenant's result.
• Reset compiled-template caches or replace worker processes when deploying changed templates, loaders, or tag libraries. Bound the accepted template-name set because cached misses also consume memory.

Context, callables, and partials

• Expose only the fields and helpers the