openstack/horizon — Week of 2026-09-05

Template safety. The headline change tightens XSS defenses by escaping JSON embedded in inline <script> blocks, a ~190-line reworking of how server-rendered data is handed to page scripts. In the same vein, Content-Disposition headers are now built via Django's helper rather than assembled by hand, reducing another class of encoding hazard.

SDK alignment. Migration toward openstacksdk continued on two fronts: flavor test data is now constructed through the SDK, and PortForwardingManager was updated to match current SDK signatures. A one-line trunk fix also corrects child-port detection.

Runtime support. Python 3.14 is now declared supported, and a non-voting job was added to exercise Django 6.0 ahead of any commitment. A stale identity_api_version entry was dropped from the sample clouds.yaml.

Small fixes. Corrections landed for the Flavor Access tab description, a misleading help string, and security-group error messages. Two rounds of Zanata translation imports round out the week.