This is a security fix. Disclosure and advisory coming shortly.
Widget.id_for_label()
django/forms.forms.py