Issue 348: One month until DjangoCon US
| in blog | Django News |
|---|---|
| published date | 2026-07-31 |
| original entry | Issue 348: One month until DjangoCon US |
News
In just one month, developers, maintainers, educators, and Django enthusiasts from around the world will gather in Chicago for DjangoCon US 2026.
Kati is a longtime member of the Django community who has been a speaker, organizer of DjangoCon US, and member of DEFNA's board of directors. She shares some insightful thoughts on the current state of Django and where it can go from here, especially around AI.
Looking forward to this year’s Django on the Med 🏖️? Perhaps you should come? And what to do if you can’t!
Updates to Django
Today, "Updates to Django" is presented by Raffaella from Djangonaut Space! 🚀
Last week we had 13 pull requests merged into Django by 10 different contributors - including 2 first-time contributors! Congratulations to Mundur and Philip Narteh for having their first commits merged into Django - welcome on board!
News in Django 6.2:
- In the asynchronous request path, error responses (such as those rendered by
handler404andhandler500) are now rendered on the request’s thread-sensitive thread, rather than on a shared thread pool, so that database connections used during error handling are managed byclose_old_connections(). - The admin
view_on_siteURL now consistently returns an HTTP 403 response when a staff user lacks view or change permission for the target model. - The admin history view now checks permissions before object existence, consistently returning an HTTP 403 response for staff users without the view or change permission regardless of whether the object exists.
Django Fellow Reports
Focus this week was on the djangoproject.com email incident 📧🧱 and security work 🔐. I worked with Ops to diagnose and resolve the outage, addressing the source of abuse in the account registration flow. In parallel, I continued security reviews (including GeoDjango) and handled incoming reports 👁️. Overall brain ended up quite fried 🧠🍳😩.
Triaged a couple of interesting tickets, including one around paginator solutions. Reviewed four more and authored three. Also weighed in on the move to Playwright for integration testing and worked on six security reports.
And her baby boy now has his first two teeth.
Like last week, I focused almost all of my attention on improving our patches for the same two pending security reports. One reporter thanked us for our professional handling and brought a smile to my face when adding, “as I am sure you are getting completely slop cannoned all the way down.”
More steady progress reviewing the GSoC work on expressions in SQL FROM clauses, too.
DjangoCon US
LAST DAY! 10% off + guaranteed t-shirt +swag ends July 31st)
Quick heads-up: today is the last day to save on DjangoCon US 2026 and the last day we can guarantee your t-shirt and tote bag for in-person registrations.
Articles
DEBUG=True does far more than turn on pretty error pages: it exposes stack traces and configuration to attackers, disables error reporting, degrades query performance, and serves unminified static files. A grep of Django's own source shows the setting changing behavior across more than two dozen files, which is the real argument for never letting production depend on it.
setUpTestData() runs once per test class where setUp() runs again for every test method, so moving shared fixtures into it cuts repeated create and destroy work off your suite. A short Pet and Species example makes the difference concrete: the species row is built once for the whole class, while anything created in setUp is rebuilt for each test.
Every Django release announcement hides a "code word" introducing the new features, and this post tables them all from 1.7 through 6.1, each linked to its Wiktionary definition and scored for rarity using the wordfreq package. Carlton's mezcla (3.2) wins on obscurity by not appearing in the English frequency data at all, while Sarah's composite (5.2) was a wink at that release's composite primary keys.
Despite the name, unittest.mock builds spies as well as mocks: pass wraps and calls fall through to the real function and return real results, while the mock still records them for assertions. A caching example checks that compute_owl_sound() runs only once across two owl_sound() calls, and pairs it with autospec=True, which is optional when spying on functions but required for methods.
To assert the order of calls across several mocks, attach them to a parent so its mock_calls records everything on one interleaved timeline. Methods attach themselves when you build the parent with create_autospec(Kettle, instance=True), while separate module-level functions need an explicit attach_mock() before you can check the whole sequence in a single assertion.
Podcasts
Carlton answers all your questions on Django, async, what to be excited about in Django 6.1, and more. Well worth the full listen.
Sponsored
It's hard to ask to meet a stranger
So I'll go first. I'm Tim Schilling. I enjoy talking to people about software, Django and career development. I recently pivoted to specifically focus on helping others in their careers. If you could use some support, or just want to talk with me, set up a call with me!
Videos
From PyCon US, Mariatta outlines how PyLadies said no to spreadsheets and instead started building out its own conference infrastructure using Python and Django.
Django Job Board
Two new listings lead the board this week: a one-year Security Developer role at the Python Software Foundation covering CPython vulnerabilities and PyPI malware, plus senior full-stack work at Hive Collective, with Django roles at MyOme and Fusionbox still open.
Security Developer at Python Software Foundation 🆕
Senior Full Stack Engineer at Hive Collective 🆕
Senior Backend Engineer at MyOme
Python + TypeScript Engineers at Fusionbox
Projects
Spwig is a full-stack, self-hosted e-commerce platform on Django 5, now open source under AGPL-3.0. Server-rendered storefront, admin, REST API, POS, and page builder in a single modular monolith.