Diane Corriette's News Aggregator
My daily dose of tech, content creation, SEO and AI news from across the web, all in one place.
Backend News
Quarterly contributor outreach
Hi Django community, thank you all for continuing to contribute to Django. The Steering Council is reaching out to bring people's attention to a few areas. We have major features we'd like to test and review for 6.2, smaller changes that could use attention and then various New Feature ideas we'd like community input on. Major features These PRs are things we'd like to refine, test and get merged in. We're looking for people to test the features themselves and review the PRs. Please see our guidelines on reviewing PRs. CompositeField (multi-column subqueries) (this only needs testing, not review.) DEFAULT_PK_FIELD setting (e.g. UUID primary keys) Move models between apps Sage Abdullah has a great Django London talk on how to test your project against Django's main branch. Please note that you would need to change the branch to point to the PR’s specific branch. Other features These are other PRs that we thought would be cool to have included in 6.2. They are in various states of refinement. We're looking for people to test and review the PRs. They are smaller in nature, so it may be easier to get involved here. Adding QuerySet.executed_queries Partitioned cookies Support for the HTTP QUERY method Improve CSRF debug messaging behind proxies New Features This section is bringing attention to the New Features queue. Ideas are in various stages and require different types of input. With over 150 ideas so far, we'll try to provide direction for those who have limited time to participate. Ideas needing technical vetting [medium+ effort] These are ideas the community would like integrated, but we need contributor opinion on. The links are to proposals that could use vetting. Ability to customize model Meta and migration generation Implement modern CSRF protection Add timeout API for tasks Subresource integrity (SRI) Adding import maps to Django Ideas needing community input [low effort] We encourage people to review the entire New Feature queue and use the emoji reactions. Please use the 😕 emoji to register a "saw this, but have no opinion". This helps us understand what has been reviewed by the community. We have selected a few from the list that we'd like people to weigh in on: Better hooks to customize PasswordResetForm email sending Add PR help in Working with Git GitHub contribution documentation Service URL parsing in core (e.g. database and cache URLs) Standardise Task execution order Update AuthenticationMiddleware to delegate to Authentication Backends Support sending to Unicode email addresses via SMTP Thank you Django is built by the community and every bit helps move Django forward. We encourage everyone to feel empowered to participate. If you aren't sure where to start or have questions, ask on the Django Forum or in the Django Discord. We're happy to help you find your way in. - The Django Steering Council
Read more
Django security reporting update
We are no longer accepting new security reports for the Django project through HackerOne. Existing reports submitted through HackerOne will remain open and continue to be handled by the Django Security Team. If you discover a security issue in Django, please follow the reporting process described in the Django security policies. Security issues should be reported by emailing security@djangoproject.com
Read more
Django security releases issued: 6.1.2, 6.0.9, and 5.2.18
In accordance with our security release policy, the Django team is issuing releases for Django 6.1.2, Django 6.0.9, and Django 5.2.18. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant() django.utils.translation.get_supported_language_variant() was subject to a potential denial-of-service attack when processing many distinct, very long language codes. Language codes were used as keys in an in-memory cache before their length was limited, potentially consuming excessive process memory. To mitigate this vulnerability, language codes longer than 500 characters are now rejected or truncated before the cached lookup. This issue has severity "low" according to the Django security policy. Thanks to Gleb Lizunov for the report. CVE-2026-84429: Potential denial-of-service vulnerability in HTTP header parsing django.utils.http.parse_header_parameters() was subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as Accept or Content-Type, for instance via the content negotiation performed by HttpRequest.accepts(). The per-call length limit does not bound the combined size of repeated headers. The undocumented django.utils.http.parse_header_parameters() function now uses Python's email.message.Message for parsing. As a result, parsing of some malformed or unusual header values may differ, for example, RFC 2231 values with a missing encoding are now decoded. This issue has severity "moderate" according to the Django security policy. Thanks to Jisung Chae for the report. CVE-2026-87890: Potential request forgery via spatial lookup byte values Spatial lookups accepted raster values provided as bytes without requiring them to be explicitly wrapped in django.contrib.gis.gdal.GDALRaster. Although these values were opened through GDAL's in-memory virtual filesystem, they could contain a VRT document referencing an external raster source. This could cause GDAL to issue network requests as the Django process user while preparing the lookup. This issue could be exploited by applications that passed attacker-controlled bytes directly to a spatial lookup. It was overlooked in the fix for CVE-2026-15307. To mitigate this issue, raster values provided as bytes must now be wrapped in GDALRaster before being used in spatial lookups. Byte values representing valid hexadecimal geometries remain accepted. This is a backward incompatible change. As a reminder, all untrusted user input should be validated before use. This issue has severity "moderate" according to the Django security policy. Thanks to sicksec for the report. CVE-2026-87975: Privilege abuse in model formsets with editable primary keys Model formsets incorrectly allowed forged POST data to either delete instances outside the limiting queryset or create instances via edit-only formsets when the model's primary key could be set through the form, such as with: a OneToOneField (or parent link used as the primary key of an inline formset's model), or a natural or UUID primary key included in the form's fields. Models using the default BigAutoField primary key were not affected. This issue has severity "moderate" according to the Django security policy. Thanks to Seonggwon Yoon for the report. Followup to CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections The mitigation for CVE-2026-15830 could be bypassed by certain WKB geometries, allowing deeply nested geometries to reach GEOS. This update does not introduce a new CVE but strengthens the original fix. Thanks to blacknianthejdan, Kimi Security Team, and David Sarkisyan for the reports. Affected supported versions Django main Django 6.1 Django 6.0 Django 5.2 Resolution Patches to resolve the issue have been applied to Django's main, 6.1, 6.0, and 5.2 branches. The patches may be obtained from the following changesets. CVE-2026-77050: Potential denial-of-service vulnerability in get_supported_language_variant() On the main branch On the 6.1 branch On the 6.0 branch On the 5.2 branch CVE-2026-84429: Potential denial-of-service vulnerability in HTTP header parsing On the main branch On the 6.1 branch On the 6.0 branch On the 5.2 branch CVE-2026-87890: Potential request forgery via spatial lookup byte values On the main branch On the 6.1 branch On the 6.0 branch On the 5.2 branch CVE-2026-87975: Privilege abuse in model formsets with editable primary keys On the main branch On the 6.1 branch On the 6.0 branch On the 5.2 branch Followup to CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections On the main branch On the 6.1 branch On the 6.0 branch On the 5.2 branch The following releases have been issued Django 6.1.2 (tarball | checksums) Django 6.0.9 (tarball | checksums) Django 5.2.18 (tarball | checksums) The PGP key ID used for this release is Sarah Boyce: 3955B19851EA96EF General notes regarding security reporting As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance, nor via the Django Forum. Please see our security policies for further information.
Read more
Nominate Someone for the 2026 Malcolm Tredinnick Memorial Prize
Hello Everyone 👋 It is that time of year again when we recognize someone from our community in memory of our friend Malcolm. Malcolm was an early core contributor to Django and had a huge influence on the Django we know today. Besides being knowledgeable, he was also especially friendly to new users and contributors. He exemplified what it means to be an amazing Open Source contributor. We still miss him to this day. The prize Our prizes page summarizes it nicely: The Malcolm Tredinnick Memorial Prize is a monetary prize, awarded annually, to the person who best exemplifies the spirit of Malcolm’s work - someone who welcomes, supports, and nurtures newcomers; freely gives feedback and assistance to others, and helps to grow the community. The hope is that the recipient of the award will use the award stipend as a contribution to travel to a community event -- a DjangoCon, a PyCon, a sprint -- and continue in Malcolm’s footsteps. Please make your nominations using our form: 2026 Malcolm Tredinnick Memorial Prize nominations. Django Software Foundation board members, Django Fellows, and the Treasurer’s assistant are not eligible to receive the prize. You are still welcome to use the appreciation field below to recognize them, and we’ll make sure those messages are passed along. UPDATED: We will take nominations until Friday, October 16th, 2026, Anywhere on Earth, and will announce the results in late October. If you have any questions, please use our dedicated forum thread or contact the DSF Board.
Read more
DSF member of the month - Ken Whitesell
For September 2026, we welcome Ken Whitesell as our DSF member of the month! ⭐ Ken has long been part of the Django community, serving for many years as an helper in the Django forum and recipient of the Malcolm Tredinnick Memorial award. He has been a volunteer for DjangoCon US for over ten years. He is a DSF member since September 2017! You can learn more about Ken by visiting Ken's blog and his GitHub Profile. Let’s spend some time getting to know Ken better! Can you tell us a little about yourself? (hobbies, education, etc) Hi everyone! I've been retired for a little more than a year now. After 45 years working in software development, I'm now free to spend my time working on what interests me. (You could say that what used to be my hobby is now my profession.) I'm currently living in the mountains about 60 miles south-east of Pittsburgh. I mostly consider myself a boardgamer. Boardgaming has been a serious hobby for me for more than 50 years now, and has been one of the driving forces in my personal development as a programmer. Not in terms of programming or developing games, but doing analysis. I enjoy looking at the probabilities and patterns that may exist in particular games. To a lesser extent, I'm starting to develop an interest in using AI to create computer opponents. My education was primarily informal. I had a BASIC class in high school, along with a touch of Fortran and COBOL. College didn't go nearly as well - I withdrew about mid-way through my first semester. (I guess I would say that I really wasn't ready for it on a number of different levels.) About nine months later, I enlisted in the US Air Force. That's where my education really took off. I had a variety of experiences that exposed me to technologies that I wouldn't have otherwise been able to see. The training opportunities were amazing, and I'd like to think I took advantage of most of them. Beyond that, the rest of my education has been primarily self-directed. How did you start using Django? I was first exposed to Django at the first PyCon after it was released, but my job and other interests prevented me from looking at it in detail. It wasn't until 2014 when I took a job to help build a system using it that I got serious about learning it. What other framework do you know and if there is anything you would like to have in Django if you had magical powers? Oh my. We could split a lot of hair trying to define "framework" and "know". To some degree of knowledge I've worked with Drupal, WordPress, Joomla, CherryPy, Nevow, Spring, meteor.js, LifeRay, ASP.NET, and Zope. (There may be others that I've worked with but don't remember right off-hand.) Aside from my professional responsibilities, my pet project is something I've been trying to do for more than 20 years. I've looked at a large number of frameworks. Is there anything from those other frameworks I'd like to have? I've never honestly thought about it in those terms. Every other framework I've used has come up short in at least one area I consider critical - that's why I've looked at so many of them. I won't say that Django is perfect, but it is a perfect fit for me, how I look at the web, what I want to do, and how I want to approach those solutions. It's the closest match to how I think. I encounter a lot less friction when trying to get stuff done with Django than I ever had in any other framework. What projects are you working on now? My primary project is my boardgame-playing engine. I've got a handful of games that I enjoy playing, but are ignored by the "mass market" sites such as Boardgame Arena and Tabletop Simulator. I'm doing browser-based ports of them to support competitive play of those games. I also have a couple websites I maintain for my boardgaming community. Which Django libraries are your favorite (core or 3rd party)? First and most important to me is Channels. My boardgame site wouldn't exist if I didn't have a "Django-friendly" way of using websockets. Related to that, but not a Django library, would be HTMX. It provides the browser-side of the websocket connection in a way that works for me. Beyond that, I rely heavily upon Django Crispy Forms, Django Extensions, and Treebeard. What are the top three things in Django that you like? Top of the list is the basic fact that it's written in Python. Given the choice, I'll pick working in Python over any other language. Next is the ORM. I don't mind working with SQL, but I appreciate the layer that builds objects from the results. Last of the three would be forms, both their ability to render HTML and to validate input. You have been helping community members in the Django forum for many years and for some time in Django Discord. Thank you so much for your help. What made you start helping people in the first place and keep doing it? Community has always been important to me. When I went to my first DjangoCon in 2014, I knew I had a lot to learn. Fortunately, there were a number of Djangonauts willing to spend their time helping me get past a number of conceptual hurdles. At DjangoCon 2018 and 2019, Carlton Gibson gave talks titled "Your web framework needs you!" They were more than inspiring, they were reminders to me that as a member of this community, I had a responsibility to help keep it going. (In my case, that meant doing more than just working the registration desk.) I started looking for ways that I might be able to contribute. Also in 2019, Andrew Godwin announced that the Django Forum was launched. I had been reading the mailing lists, but I wasn't particularly thrilled with that as a medium for discussion. I was looking forward to the forum becoming an active venue. I wasn't active at first - I didn't have any specific questions needing to be asked and there weren't any questions posted where I felt confident enough to answer them. We all know what 2020 brought. In my case, it brought a lot of free time I wouldn't have otherwise had. In Feburary, I saw a question I felt comfortable answering. Then in March, I saw a couple more. I did my best to answer them. Since I wasn't getting corrected or told that my comments were unwelcome, I kept going. (Even after working with Django for 5 years at that point, I still wasn't all that comfortable with my understanding of a number of concepts.) Then during that summer when all my other plans had gone out the window, it became a major part of my day. I also began to realize that I was actually contributing to the Django Community and it felt good! I knew that I would never be able to really contribute code. But I also thought if I spent my time answering questions, then the people working on the code wouldn't feel the need to do that, and so indirectly I was helping move things forward by reducing at least one roadblock from their path. So that became my motivator. I doubt I'll ever submit a PR. But if I can do anything that helps the Fellows or the other significant developers move Django forward, I'm going to be quite happy with that. My activity on Discord is rather limited. For quick questions or open ongoing discussions I guess it's ok. But it would be my last choice of a platform to try and help someone with a detailed technical question. You are a Malcolm Tredinnick Memorial award recipient, could you tell us a bit more about this award and what does it mean to you? As far as the award itself, I think the Django docs say it best: The award will be ... awarded annually, to the person who best exemplifies the spirit of Malcolm’s work - someone who welcomes, supports and nurtures newcomers; freely gives feedback and assistance to others, and helps to grow the community. What does it mean to me? I see it primarily as validation and inspiration. It's validation that I think I am generally successful with what I'm trying to do. And it's inspiration for me to keep doing it. It's that little voice in me that says "Yes, what you're doing is worthwhile. You are helping people." As far as knowing him, no. I was not fortunate enough for that to be the case. Malcolm passed in 2013, before I started really using Django. However, it's almost certain that I "met" him at least once while working at the PyCon registration desk from 2005 - 2010. But about the only thing I would have said to him would have been "Hi! Welcome to PyCon! Your name please?" You are recently part of the security team, how have you seen Django security evolve through time? To be honest, I'm not sure I'd describe it as "evolving" as much as simply "growing". One of Django's strengths to me has always been its focus on creating a secure environment. As far as I can tell, the project has always worked toward the ideal of "Security by design". And, when vulnerabilities are exposed, they get fixed. So I don't see it so much as anything is changing - just that the amount of work is increasing. This is a process that has become more difficult through the years as Django continues to grow. The Django project has always been fortunate in that there have been some really amazingly astute people working to keep Django secure in the face of ever-increasing threats created by bad actors and AI. I'm just hoping to be able to help maintain that effort. You know and have used Django for long time, do you have any advice for new learners or any Django user/developer? For new people, my pet catch-phrase is "Don't fight the framework". Learn how Django does things, and adapt your mindset to match it. Do things the Django way. Don't try to make Django look or act like whatever framework you've used before. Once you really understand what's going on, if you want to make changes, fine. But ensure you understand the implications of those changes before making them. Also, never forget that Django is Python. Nothing will help you understand Django more than having a very strong foundational understanding of Python. What do you think of the evolution of Django through the years? I think the stability and consistency through the years has been absolutely amazing. I could probably pull out some of the code I wrote in 2014 for Django 1.4 and have it running today with almost no effort. Django has done a wonderful job of moving things forward without unnecessarily throwing things away from the past. This stability is one of the reasons why I appreciate Django as much as I do. After so much time in the Django community, what makes you stay? It's the community itself, primarily the DjangoCon community. (Yes, I know that the Django community is significantly larger than just those attending DjangoCon, but my interactions with the community primarily revolve around DjangoCon, the forum, and (now) Discord.) People come and people go. I miss some people that came to DjangoCons 10+ years ago, but I'm meeting new people every year - and that feeling doesn't change. There's something special about us, where everyone is open to share thoughts and ideas, and being friendly and helpful when doing so. I start looking forward to the next DjangoCon the day after the previous one ends. How do you envision the future of Django from your perspective? Technically, mostly stable with some gradual improvements. I don't see the possibility of any change being introduced that would make me want to make major changes to what I have running today. If something were to fundamentally change within Django that would break my existing system, I'd probably stay on 6.1 until I couldn't run it any more. Is there anything else you’d like to say? Thank you for inviting me to share my story! Thank you for doing the interview, Ken !
Read more
New Technical Governance Approved
Both the Steering Council and DSF Board have approved DEP 19, which implements our new technical governance. Thank you to everyone who read the document and participated in the process! This was the effort of two different DSF boards and dozens of community members. These changes were a revisitation of Django’s technical governance in which a simplification and reduction was made to make it more approachable to more people. The most exciting change (in my opinion), is the new Steering Council Eligibility criteria. We defined a set of wide range qualities that members of the Steering Council could possess that would be advantageous. The hope is that this helps community members realize they are qualified to be a Steering Council member and stand for election. The next steps are to update the documentation in the Django and djangoproject.com repositories with any necessary updates. After that the DEP will move to the final state and folder.
Read more
Proposed change to DSF voting membership
We're proposing a new voting membership status to help us track active members. If you've voted in a Board election in the last two years, you're active, and you count toward quorum. If you haven't, you're still a member, but you won't count toward quorum until you tell us you want to vote. Why make this change? Quorum today is measured against every member on the rolls, including members who no longer take part in elections. As membership grows, quorum becomes harder to reach and puts our elections' validity at risk. Defining a quorum around active members is standard practice for nonprofits. Counting the entire membership roll is the outlier. The Python Software Foundation takes a similar approach. Its voting members are asked to affirm that they intend to vote, and in June 2024 the PSF board approved waiving that affirmation for anyone who voted in the previous board election (board minutes). No one loses their membership under this change. You remain a member and stay listed on the website. Active status only affects how we count quorum. This keeps our rolls accurate and our elections valid. We don't want anyone excluded because they missed an email. We'll send reminders before each election and post on our blog and the forum, so everyone has plenty of notice. If you want to vote, contact us before the election opens, and we'll add you to the roll. We've proposed the corresponding bylaw change on GitHub, discussed this proposal on the Django Forum for a while, and talked it through in person at DjangoCon US. Next steps This is a call for public comment. Please share your feedback by October 7, 2026, either on the pull request or, if you're a DSF member, in the members-only Forum thread. The Board will review the comments, and if the community raises no major objections, the Board will vote on the change at our October 8th Board of Directors meeting.
Read more
Executive Director Search Extended to September 22
We are extending the search for the Django Software Foundation's first Executive Director. Applications now close at the end of Tuesday, September 22, 2026, anywhere on Earth (AoE). As long as it is still September 22 somewhere, your application counts. We are happy with the applications we received. We also knew several people had applications in progress, and it took a while for word about the role to reach everyone it should have. Giving people a little more time felt like the fairest option. If you were most of the way there, you have until Tuesday. If you have already applied, this does not slow anything down for you. We are reviewing applications as they come in, and we will reach out to candidates and schedule interviews on the same timeline we planned. The Executive Director will play a central role in helping the DSF grow its capacity and build a sustainable future for the Django project and its community. That includes leading fundraising and partnerships, supporting the Foundation's operations and programs, and working closely with the board, staff, volunteers, and the wider Django community. We are looking for an experienced nonprofit leader who is comfortable taking on a broad role and building things as they go. Fundraising is central to this job. We need someone who is at ease sitting down with companies, making the case for Django, and connecting what the DSF does to what those organizations care about. Much of the Foundation's future depends on growing those relationships and turning them into steady support. You don't need to be a Django or Python expert, and you don't need prior involvement in the Django community. Experience with open source or other community-driven organizations is welcome, but we are primarily looking for someone with strong fundraising instincts, plus leadership, communication, relationship-building, and organizational skills. Could that person be you? If you have been waiting for the right opportunity to step forward, we encourage you to review the role and submit your application. And if you know someone who would be a strong fit, please share this with them. A great candidate may be just one introduction away. See the full job description and application details. If you are ready to help shape the next chapter of the Django Software Foundation, we want to hear from you. Applications close on September 22, 2026, anywhere on Earth.
Read more
DjangoCon Europe 2027 is heading to Innsbruck, Austria! 🏔️⛷️🚠🇦🇹
We’re delighted to announce that DjangoCon Europe 2027 will take place in Innsbruck, Austria, from February 17–21, 2027! Photo by Nicole Baster on Unsplash Each year, DjangoCon Europe brings together people from across the Django community to learn, share ideas, contribute, and spend time together. In 2027, that community will come together in Innsbruck for five days of Django, Python, and community. DjangoCon Europe is organized by community volunteers and has long been one of the highlights of the Django community calendar. Developers, contributors, newcomers, and long-time community members from around the world come together to exchange knowledge, make new connections, and help shape the future of Django. Save the dates 📅 February 17–21, 2027 📍 Innsbruck, Austria And there’s even more good news: the Call for Proposals is open, and tickets are now on sale! Submit a proposal Have something you’d like to share with the Django community? The Call for Proposals is open. Whether you have a deep technical topic, a lesson you’ve learned from building with Django, an idea that could benefit the community, or something completely unexpected, we’d love to hear from you. Submit a proposal → Get your ticket Ready to join us in Innsbruck? Tickets for DjangoCon Europe 2027 are now on sale. Come spend five days learning, sharing, meeting fellow Djangonauts, and enjoying everything the Django community has to offer. Get your ticket → Volunteer at DjangoCon Europe DjangoCon Europe is a community-run conference, and volunteers play an important part in making it happen. If you’d like to help us make DjangoCon Europe 2027 a great experience for everyone, sign up to volunteer. Whether you’re a long-time member of the community or attending your first DjangoCon, we’d love to have you involved. Sign up to volunteer → Sponsor DjangoCon Europe Support the conference financially and gain visibility in the Django community. Learn more about sponsorship → Download the sponsorship brochure → Email the sponsorship team → There’s plenty more to come as we get closer to the conference. Keep an eye on the DjangoCon Europe 2027 website for the latest news and updates: Visit the DjangoCon Europe 2027 website → See you in Innsbruck in 2027! 🇦🇹
Read more
PyCharm & Django Fundraiser Extended to September 14
The second half of our annual JetBrains fundraiser has been extended through September 14, 2026. Thank you to JetBrains for the extra time. You still have time to renew your PyCharm license or give it a try. You get PyCharm at 30% off, and JetBrains donates 100% of your purchase or renewal to the DSF. This is one of the DSF's bigger fundraisers of the year, and we appreciate everyone who takes a look. The Executive Director search also closes on September 14, and we are curious to see who reaches out. JetBrains has been a steady sponsor for years, and it was great to see the chatter around the Django Developers Survey 2026 results we released with them last month. The full report is on the JetBrains site. If you are shopping for an IDE, AI-focused or not, they have a solid product. If you would like to help with our fundraising goals, we would love to hear from you or your company. The board is happy to talk with individuals too, if you have ideas. Whatever you can do to support us, we appreciate it. Ways to help Renew or start a PyCharm license through the fundraiser before September 14. Have your company sponsor the DSF directly. Donate on our website or give through GitHub Sponsors. Reach out to the board if you want to donate, sponsor, or volunteer, or if you have fundraising ideas.
Read more