Remove safe parameter from JsonResponse

[Tim Schilling]

The JsonResponse uses the safe parameter to limit responses to only dictionary-like objects. This was to protect a security vulnerability in browsers due to ECMAScript4. Browsers that use ECMAScript4 are sufficiently old now that we can safely remove this.

This is currently ​mentioned as an antipattern on django-antipatterns.org, but it shouldn't be any more due to adoption of ECMAScript5 which isn't vulnerable to this exploit.

Flask ​did the same in 2016. Their new ​security message is here.

Regarding implementation, I suspect we could immediately deprecate this parameter for the next major release and follow our typical deprecation process. We should also reach out to django-antipatterns.org to have them amend that article with our new stance.

[Jacob Walls]

Thanks, TIL about this history.

[Adam Johnson]

A regular deprecation seems like the right approach to me. We can add a fixer to Django-upgrade to strip the safe kwarg wherever it’s passed.

[Tim Schilling]

@Adam is the fixer to Django-upgrade something you think would be reasonable for a new-ish contributor to be able to figure out? I assigned this to me to hand off to a Djangonaut for the upcoming session.

[Adam Johnson]

Maybe! Planning to write some contribution docs there to make things a bit more comprehensible…

[Praful Gulani]

Hello @Adam @Timothy! I saw this ticket and would love to work on it if it's available. I recently worked on a similar cleanup in #36894, made the required changes, added new testcases, changed a few previous ones and also added the version changed notes in the docs.

However, I noticed you mentioned handing this off to a Djangonaut. If it's officially reserved for that session, I'll leave it be, I actually just learned about Djangonaut Space and am definitely planning to apply for a future session to learn more from experienced contributors like yourself!

Just let me know if I should take it or look for another one.

[Tim Schilling]

Hi @Praful, if this is still assigned to me and shows no activity in 2 months, feel free to reassign it to yourself.

[Tim Harris]

Picking this up at PyCon 2026 sprints.

[Jacob Walls <jacobtylerwalls@…>]

In 6e15ac80:

Fixed #36905 -- Deprecated the safe parameter of JSONResponse.

Peer frameworks have long since dropped their analogous checks for this
vulnerability that was fixed in ES5.

[Jacob Walls <jacobtylerwalls@…>]

In b5d9dbdf:

Refs #36905 -- Moved JSONResponse safe param discussion to versionchanged box.

Follow-up to 6e15ac8066312328de279e3e072667416c205bfc.

[Jacob Walls <jacobtylerwalls@…>]

In c37cc70:

Refs #36905 -- Added missing deprecation note for safe parameter of JSONResponse.

[Jacob Walls]

Fiddling with the Triage State to fool the PR bot, so I can accept a fix for an oversight in the documentation.

​PR

[Jacob Walls <jacobtylerwalls@…>]

In c9eb16a:

Refs #36905 -- Corrected safe param in JSONResponse signature in docs.

The docstring and reference documentation still described the safe
parameter as defaulting to True after its deprecation.

Follow-up to 6e15ac8066312328de279e3e072667416c205bfc.