April 16, 2026 » django-simple-deploy - Mostly Python » [Archived Version]
MP 165: TIL about secrets.token_hex().I've been working on dsd-scalingo recently, a django-simple-deploy plugin that automates the process of deploying Django projects to Scalingo. I'm excited about this work, because Scalingo seems to be one of the best platforms available at the moment for
Read MoreApril 15, 2026 » The Django weblog » [Archived Version]
We’re excited to announce that Django has officially adopted Contributor Covenant 3 as our new Code of Conduct! This milestone represents the completion of a careful, community-driven process that began earlier this year. What We’ve Accomplished Back in February, we announced our plan to adopt Contributor Covenant 3 through a transparent, multi-step process. Today, we’re proud to share that we’ve completed all three steps: Step 1 (Completed February 2026): Established a community-driven process…
Read MoreApril 14, 2026 » Paolo Melchiorre » [Archived Version]
DjangoCon Europe is an international conference for the community by the community about the Django web framework, held each year in Europe.
Read MoreApril 14, 2026 » @ch4n3.yoon » [Archived Version]
A deep dive into CVE-2026-33033, a pre-auth CPU exhaustion issue in Django's multipart parser triggered by base64 file parts made mostly of whitespace.
Read MoreApril 10, 2026 » Django News » [Archived Version]
Introduction Hi everyone, sorry for the late send of Issue #331. Last week, our provider, Curated, which is owned by Buttondown, went down and wasn’t able to send our newsletter for six days. You might have received it yesterday, but not everyone did. It’s the first time in several years we haven’t been able to land in your inbox. We’ve been in touch with their support all week and appreciate your patience while this gets sorted out. In the meantime, Will and I are looking at other provider opt…
Read MoreApril 10, 2026 » Better Simple » [Archived Version]
A review of Lisa Dusseault's DjangoCon US talk on creating the data pipeline framework, Phaser.
Read MoreApril 8, 2026 » Matthias Kestenholz » [Archived Version]
Switching all of my Python packages to PyPI trusted publishing As I have teased on Mastodon, I’m switching all of my packages to PyPI trusted publishing. I have been using it to release the django-debug-toolbar a few times but never set it up myself. The process seemed tedious. The malicious releases uploaded to PyPI two weeks ago and the blog post about digital attestations in pylock.toml finally pushed me to make the switch. All of my PyPI tokens have been revoked so there is no quick shortcu…
Read MoreApril 8, 2026 » Software Crafts » [Archived Version]
Understanding the interaction between Django apps as you build
Read MoreApril 7, 2026 » @ch4n3.yoon » [Archived Version]
Django의 `MultiPartParser`에서, `Content-Transfer-Encoding: base64` 파일 파트의 본문이 공백 위주로 구성되어 있을 때 발생하는 단일 요청 기반 CPU exhaustion 취약점을 다룹니다. 약 2.5MB 크기의 예시 요청 한 건으로 워커 하나가 약 5.3초간 묶입니다. 정상 요청 대비 약 2,100배 증폭됩니다.
Read MoreApril 7, 2026 » The Django weblog » [Archived Version]
In accordance with our security release policy, the Django team is issuing releases for Django 6.0.4, Django 5.2.13, and Django 4.2.30. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. Django 4.2 has reached the end of extended support Note that with this release, Django 4.2 has reached the end of extended support. All Django 4.2 users are encouraged to upgrade to Django 5.2 or later to continue receiving fixes for secu…
Read More