From a959c2596f8a1d1ef9f321b8b227a399e86409e2 Mon Sep 17 00:00:00 2001
From: Jacob Walls <jacobtylerwalls@gmail.com>
Date: Wed, 8 Jul 2026 11:29:51 -0400
Subject: [PATCH 1/3] Removed PR number artifact from coverage comment
 workflows.

Retrieving the PR number directly instead of from an artifact prevents
it from being spoofed.

Thanks Sarah Boyce for the review.
---
 .github/workflows/coverage_comment.yml | 30 ++++++++++++++------------
 .github/workflows/coverage_tests.yml   |  8 +------
 zizmor.yml                             |  1 -
 3 files changed, 17 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/coverage_comment.yml b/.github/workflows/coverage_comment.yml
index c826b8a7257b..da94d0d81f8c 100644
--- a/.github/workflows/coverage_comment.yml
+++ b/.github/workflows/coverage_comment.yml
@@ -1,7 +1,10 @@
 name: Coverage Comment
 
 on:
-  workflow_run:
+  # The so-called dangerous workflow_run trigger is necessary for letting forks
+  # gain workflow-scoped pull-requests: write permission. The only
+  # user-controlled content is the content of diff-cover-report.md.
+  workflow_run:  # zizmor: ignore[dangerous-triggers]
     workflows: ["Coverage Tests"]
     types:
       - completed
@@ -27,15 +30,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           run-id: ${{ github.event.workflow_run.id }}
 
-      - name: Read PR number
-        id: pr
-        run: |
-          pr_number=$(cat pr_number.txt)
-          echo "number=$pr_number" >> $GITHUB_OUTPUT
-
       - name: Post/update PR comment
-        env:
-          PR_NUMBER: ${{ steps.pr.outputs.number }}
         uses: actions/github-script@v9
         with:
           script: |
@@ -54,16 +49,23 @@ jobs:
               '**Note:** Missing lines are warnings only. Some database-specific lines may not be measured. [More information](https://docs.djangoproject.com/en/dev/internals/contributing/writing-code/unit-tests/#code-coverage-on-pull-requests)'
             );
 
-            const prNumber = parseInt(process.env.PR_NUMBER);
-            if (isNaN(prNumber)) {
-              core.setFailed('PR number is not available or invalid.');
+            const headSha = context.payload.workflow_run.head_sha;
+            const { data: prs } =
+              await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                commit_sha: headSha,
+              });
+            const pr = prs.find((p) => p.head.sha === headSha);
+            if (!pr) {
+              core.setFailed(`No PR found for commit ${headSha}.`);
               return;
             }
             
             const { data: comments } = await github.rest.issues.listComments({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              issue_number: prNumber,
+              issue_number: pr.number,
             });
             
             for (const c of comments) {
@@ -79,6 +81,6 @@ jobs:
             await github.rest.issues.createComment({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              issue_number: prNumber,
+              issue_number: pr.number,
               body: commentBody,
             });
diff --git a/.github/workflows/coverage_tests.yml b/.github/workflows/coverage_tests.yml
index 4ac6751e5da8..0020694597f3 100644
--- a/.github/workflows/coverage_tests.yml
+++ b/.github/workflows/coverage_tests.yml
@@ -87,16 +87,10 @@ jobs:
             echo "No coverage data available." > diff-cover-report.md
           fi
 
-      - name: Save PR number
-        if: success()
-        run: echo "${{ github.event.pull_request.number }}" > pr_number.txt
-
       - name: Upload artifacts
         if: success()
         uses: actions/upload-artifact@v7
         with:
           name: coverage-artifacts
-          path: |
-            diff-cover-report.md
-            pr_number.txt
+          path: diff-cover-report.md
           retention-days: 1
diff --git a/zizmor.yml b/zizmor.yml
index 40cc34254e9b..0eea96ed7da9 100644
--- a/zizmor.yml
+++ b/zizmor.yml
@@ -3,7 +3,6 @@ rules:
     # Before ignoring a file, assume all inputs are malicious, assign explicit
     # minimal permissions, and do not use actions/checkout.
     ignore:
-      - coverage_comment.yml
       - labels.yml
       - new_contributor_pr.yml
       - check_pr_quality.yml

From e1feeee45ea8bcd4325554c9b94fcd75fcd8dbdc Mon Sep 17 00:00:00 2001
From: maheen8q <mah.een8q@gmai.com>
Date: Sun, 5 Jul 2026 00:22:53 +0500
Subject: [PATCH 2/3] Fixed #37194 -- Removed redundant choice widget
 documentation.

The removed section primarily provided usage examples and recommendations
rather than documenting the widget API. The interaction between a choice
field and its widget is already documented in the Select.choices reference.
---
 docs/ref/forms/widgets.txt | 33 ---------------------------------
 1 file changed, 33 deletions(-)

diff --git a/docs/ref/forms/widgets.txt b/docs/ref/forms/widgets.txt
index 25f6079a0aeb..edb6d8c783af 100644
--- a/docs/ref/forms/widgets.txt
+++ b/docs/ref/forms/widgets.txt
@@ -79,39 +79,6 @@ widget on the field. In the following example, the
 See the :ref:`built-in widgets` for more information about which widgets
 are available and which arguments they accept.
 
-Widgets inheriting from the ``Select`` widget
-=============================================
-
-Widgets inheriting from the :class:`Select` widget deal with choices. They
-present the user with a list of options to choose from. The different widgets
-present this choice differently; the :class:`Select` widget itself uses a
-``<select>`` HTML list representation, while :class:`RadioSelect` uses radio
-buttons.
-
-:class:`Select` widgets are used by default on :class:`ChoiceField` fields. The
-choices displayed on the widget are inherited from the :class:`ChoiceField` and
-changing :attr:`ChoiceField.choices` will update :attr:`Select.choices`. For
-example:
-
-.. code-block:: pycon
-
-    >>> from django import forms
-    >>> CHOICES = {"1": "First", "2": "Second"}
-    >>> choice_field = forms.ChoiceField(widget=forms.RadioSelect, choices=CHOICES)
-    >>> choice_field.choices
-    [('1', 'First'), ('2', 'Second')]
-    >>> choice_field.widget.choices
-    [('1', 'First'), ('2', 'Second')]
-    >>> choice_field.widget.choices = []
-    >>> choice_field.choices = [("1", "First and only")]
-    >>> choice_field.widget.choices
-    [('1', 'First and only')]
-
-Widgets which offer a :attr:`~Select.choices` attribute can however be used
-with fields which are not based on choice -- such as a :class:`CharField` --
-but it is recommended to use a :class:`ChoiceField`-based field when the
-choices are inherent to the model and not just the representational widget.
-
 Customizing widget instances
 ============================
 

From 2936a0a99719e3c3777039a0d6968deecb55c752 Mon Sep 17 00:00:00 2001
From: VIZZARD-X <vigneshanandmay13@gmail.com>
Date: Sat, 3 Jan 2026 18:11:03 +0530
Subject: [PATCH 3/3] Fixed #27752 -- Fixed ordering by Model.__str__ in the
 admin.

Co-authored-by: blighj <blighj@users.noreply.github.com>
---
 django/contrib/admin/utils.py      |  2 +-
 django/contrib/admin/views/main.py |  2 +-
 tests/admin_utils/models.py        |  1 +
 tests/admin_utils/tests.py         |  6 ++++++
 tests/admin_views/models.py        |  1 +
 tests/admin_views/tests.py         | 15 +++++++++++++++
 6 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/django/contrib/admin/utils.py b/django/contrib/admin/utils.py
index 34f53a4df2c2..38aa98b6bdb6 100644
--- a/django/contrib/admin/utils.py
+++ b/django/contrib/admin/utils.py
@@ -372,7 +372,7 @@ def label_for_field(name, model, model_admin=None, return_attr=False, form=None)
     except FieldDoesNotExist:
         if name == "__str__":
             label = str(model._meta.verbose_name)
-            attr = str
+            attr = model.__str__
         else:
             if callable(name):
                 attr = name
diff --git a/django/contrib/admin/views/main.py b/django/contrib/admin/views/main.py
index 0ceaf5f7a5c4..1bfe48082933 100644
--- a/django/contrib/admin/views/main.py
+++ b/django/contrib/admin/views/main.py
@@ -359,7 +359,7 @@ def get_ordering_field(self, field_name):
             # that allows sorting.
             if callable(field_name):
                 attr = field_name
-            elif hasattr(self.model_admin, field_name):
+            elif hasattr(self.model_admin, field_name) and field_name != "__str__":
                 attr = getattr(self.model_admin, field_name)
             else:
                 try:
diff --git a/tests/admin_utils/models.py b/tests/admin_utils/models.py
index 59b4eab5c6af..055ef07b7550 100644
--- a/tests/admin_utils/models.py
+++ b/tests/admin_utils/models.py
@@ -47,6 +47,7 @@ class Cascade(models.Model):
     num = models.PositiveSmallIntegerField()
     parent = models.ForeignKey("self", models.CASCADE, null=True)
 
+    @admin.display(ordering="num")
     def __str__(self):
         return str(self.num)
 
diff --git a/tests/admin_utils/tests.py b/tests/admin_utils/tests.py
index a04393933681..a2426d9f04d4 100644
--- a/tests/admin_utils/tests.py
+++ b/tests/admin_utils/tests.py
@@ -445,6 +445,12 @@ def test_from_property(self):
             "property short description",
         )
 
+    def test_label_for_field_str_admin_order_field(self):
+        _, attr = label_for_field("__str__", Cascade, return_attr=True)
+        self.assertIs(attr, Cascade.__str__)
+        self.assertTrue(hasattr(attr, "admin_order_field"))
+        self.assertEqual(attr.admin_order_field, "num")
+
     def test_help_text_for_field(self):
         tests = [
             ("article", ""),
diff --git a/tests/admin_views/models.py b/tests/admin_views/models.py
index 13f092d0b4d3..427317507732 100644
--- a/tests/admin_views/models.py
+++ b/tests/admin_views/models.py
@@ -47,6 +47,7 @@ class Article(models.Model):
         Section, models.SET_NULL, null=True, blank=True, related_name="+"
     )
 
+    @admin.display(ordering="title")
     def __str__(self):
         return self.title
 
diff --git a/tests/admin_views/tests.py b/tests/admin_views/tests.py
index 4ba2fa225549..b3be31380f8e 100644
--- a/tests/admin_views/tests.py
+++ b/tests/admin_views/tests.py
@@ -799,6 +799,21 @@ def test_change_list_sorting_model(self):
             "Results of sorting on Model method are out of order.",
         )
 
+    def test_change_list_sorting_model_str(self):
+        """Ensure we can sort on a Model.__str__ list_display field."""
+
+        class ArticleStrAdmin(admin.ModelAdmin):
+            list_display = ["__str__"]
+
+        model_admin = ArticleStrAdmin(Article, site)
+        request = RequestFactory().get("/?o=1")
+        request.user = self.superuser
+        cl = model_admin.get_changelist_instance(request)
+        self.assertEqual(cl.get_ordering_field("__str__"), "title")
+        self.assertQuerySetEqual(
+            cl.get_queryset(request), Article.objects.order_by("title", "-pk")
+        )
+
     def test_change_list_sorting_model_admin(self):
         """
         Ensure we can sort on a list_display field that is a ModelAdmin method