id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
35090	Enforce uniqueness on custom path converters	Adam Johnson	Salvo Polizzi	"`register_converter()` allows [https://docs.djangoproject.com/en/5.0/topics/http/urls/#registering-custom-path-converters custom path converters] to silently replace existing converters. This could lead to surprising behaviour, both when two places accidentally use the same custom name or when replacing a default converter. This could be particularly hard to debug if a third-party package uses a custom converter.

For example, say two modules register path converters named “year”. The first allows 1-4 digits:

{{{
class YearConverter:
    regex = r""[0-9]{1,4}""
    ...

register_converter(YearConverter, ""year"")
}}}

Whilst the second requires exactly four digits:

{{{
class YearConverter:
    regex = r""[0-9]{4}""
    ...

register_converter(YearConverter, ""year"")
}}}

Whichever module is loaded last will silently overwrite the other’s converter. URLs will then only be interpreted with that converter, leading to fewer URLs being matched than intended. This can be particularly difficult to spot as import order may change accidentally due to other code being rearranged.

See the full example project at https://github.com/adamchainz/django-ticket-35090

I propose that support for reusing path converter names be deprecated, eventually raising an exception. I think this should include the default names (`int` etc.) as replacing them can break URLs from third-party packages."	Cleanup/optimization	closed	Core (URLs)	dev	Normal	fixed		Salvo Polizzi	Ready for checkin	1	0	0	0	0	0