Oct. 9, 2026 » Django News » [Archived Version]
News Django security releases issued: 6.1.2, 6.0.9, and 5.2.18 Four CVEs fixed: denial-of-service risks in language-code lookups and HTTP header parsing, spatial lookups that could make GDAL fetch external rasters, and model formsets with editable primary keys that forged POST data could use to delete or create instances. Raster bytes passed to spatial lookups must now be wrapped in GDALRaster, a backward-incompatible change, so upgrade and check your GIS code. Welcome to Session 7 Teams 👩🏽‍🚀 D…
Read MoreOct. 9, 2026 » Carlton's latest posts. » [Archived Version]
Today's Stack Report, Towards Async Transactions in Django, relates the story of the async with transaction.atomic() work at Django on the Med 🏖️. It's also about how the feature should behave, and our aim to get it ready for Django 6.2. The Django PR sits on top of a change to asgiref: letting ThreadSensitiveContext nest, so an atomic block gets its own worker thread, and so its own connection. That PR is essentially correct. It needs guiding in, and then a release. So my focus now is an asgir…
Read MoreOct. 8, 2026 » The Django weblog » [Archived Version]
We are no longer accepting new security reports for the Django project through HackerOne. Existing reports submitted through HackerOne will remain open and continue to be handled by the Django Security Team. If you discover a security issue in Django, please follow the reporting process described in the Django security policies. Security issues should be reported by emailing [email protected]
Read MoreOct. 7, 2026 » Adam Johnson » [Archived Version]
When contributing to Django, you’ll want to run its test suite to check your changes. The official contributing docs cover setup in Running the unit tests, using a virtual environment and pip. Here’s an alternative guide using uv. Setup First, clone Django and change into the repository: $ git …
Read MoreOct. 6, 2026 » The Django weblog » [Archived Version]
In accordance with our security release policy, the Django team is issuing releases for Django 6.1.2, Django 6.0.9, and Django 5.2.18. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant() django.utils.translation.get_supported_language_variant() was subject to a potential denial-of-service attack when processing many distinct, very …
Read MoreOct. 6, 2026 » Latest Django Videos » [Archived Version]
We’re experimenting with MCP servers for Wagtail, to provide more efficient mechanisms for content operations with AI agents. In this demo, we’re trialing MCP capabilities via an agent interface integrated within the CMS. The agent has 50+ "tools" made available. At this stage the agent has no particular instructions on how to use them. This was done with DeepSeek V4 Flash. 📹 Related Videos To Watch Next: ▶ Video Tour of Wagtail 7.4 https://youtu.be/XFEmUYoX4OM ▶ The Latest on Wagtail AI ht…
Read MoreOct. 2, 2026 » Carlton's latest posts. » [Archived Version]
This week’s theme was very much Back from Django on the Med 🏖️. Here’s a quick round-up so far, with more to come, and a guarantee that’ll I’ll miss something. Django Chat Will and I kicked off the new season with a retrospective on the event. It’s a short episode, and I think it conveys how significant I think the event is, and ones like it can be, to the community and project. Django on the Med | Django Chat🎙️ Django on the Med - YouTube🎥 Posts Here’s are the posts I’ve seen so far: Look…
Read MoreOct. 2, 2026 » Django News » [Archived Version]
News Nominate Someone for the 2026 Malcolm Tredinnick Memorial Prize The annual prize honors someone who welcomes newcomers, freely helps others, and grows the community, with a stipend meant to fund travel to a DjangoCon, PyCon, or sprint. Nominate someone by October 15 (Anywhere on Earth). Python 3.10.22, 3.11.17, 3.12.15, 3.13.16 and 3.14.8 are now available! Security releases across all five series, with fixes for tarfile extraction filters, zipfile decompression bombs, and SSL hostname val…
Read MoreOct. 1, 2026 » Adam Johnson » [Archived Version]
If your site has companion Apple or Android apps, you probably want links to your site to open in those apps, when installed. Both platforms support this, with Apple calling the feature Universal Links and Android calling it App Links. But an app can’t just claim to handle your …
Read MoreOct. 1, 2026 » The Django weblog » [Archived Version]
Hello Everyone 👋 It is that time of year again when we recognize someone from our community in memory of our friend Malcolm. Malcolm was an early core contributor to Django and had a huge influence on the Django we know today. Besides being knowledgeable, he was also especially friendly to new users and contributors. He exemplified what it means to be an amazing Open Source contributor. We still miss him to this day. The prize Our prizes page summarizes it nicely: The Malcolm Tredinnick Memor…
Read More