BlueSoybean.com - Free RSS-Based News Reader

close

The Django weblog

Latest news about Django, the Python web framework.


Source: https://www.djangoproject.com/rss/weblog/

Articles

Django security releases issued: 6.0.4, 5.2.13, and 4.2.30 | Weblog | Django

Posted by Jacob Walls on April 7, 2026
via The Django weblog
Share  
Tags  

Could you host DjangoCon Europe 2027? Call for organizers | Weblog | Django

Posted by DSF Event Support Working Group on April 7, 2026
via The Django weblog
Share  
Tags  

DSF member of the month - Theresa Seyram Agbenyegah

For March 2026, we welcome Theresa Seyram Agbenyegah as our DSF member of the month! ⭐ Theresa portrait, a pretty black woman with short hair. She is looking at the camera with a big smile. She wears a white t-shirt with written in green "Django Girls Koforidua". The background is blurry but really colorful with shades of green and orange. Theresa is a passionate community builder serving in the DSF Events Support Working Group. She has demonstrated strong leadership by taking on roles such as Local Organizer Commitee (LOC) Program Lead at PyCon Africa 2024 and Programs Chair for PyCon Ghana 2025. She also organized DjangoGirls events across multiple PyCons, including PyCon Ghana 2022 and PyCon Africa 2024. You can learn more about Theresa by visiting and . Let’s spend some time getting to know Theresa better!

Can you tell us a little about yourself (hobbies, education, etc)?

I’m Theresa Seyram Agbenyegah, mostly referred to in the community as Stancy; a backend engineer, social entrepreneur, and an open source advocate/contributor passionate about using technology for impact. My background is in technology, community management, and systems design. Over the years, I have grown into roles that combine engineering, leadership, and ecosystem building.

I know many folks call you Stancy, me included, why specifically this name?

So “Stancy” is my initials 😁, People think it is my nickname.

How did you start using Django?

I was introduced to Django through a Django Girls workshop, and oh i’m a Django girl. I loved how opinionated yet flexible it was. The “batteries-included” philosophy made backend architecture feel structured without being restrictive. The admin interface especially blew my mind early on; being able to scaffold powerful internal tools so quickly felt magical.

What other frameworks do you know, and if you had magical powers, what would you add to Django?

I have worked with Flask, FastAPI, and explored the Dart framework. Each has strengths, especially FastAPI in performance and modern async patterns. If I had magical powers, I would:
  • Make async patterns even more seamless across the ecosystem
  • Improve first class support for large scale distributed system
  • Provide even more built-in tooling for observability and performance profiling
But overall, Django’s maturity and ecosystem are hard to beat.

What projects are you working on now?

I’m not working on any big projects at the moment, I'm mostly working on client projects at work.

Which Django libraries are your favorite (core or 3rd party)?

Some of my favorites:
  • Django Rest Framework (it’s practically essential for modern APIs)
  • django-filter
  • django-allauth
  • Celery (for async task processing)
  • Django Debug Toolbar (for development clarity)
The ecosystem really makes Django powerful.

What are the top three things in Django that you like?

  1. The admin interface
  2. The ORM
  3. The strong community and documentation (FYI: it gives me a sense of belonging) Django feels stable, mature, and production-ready which builds developer confidence.

You have been in the organization of PyCon Africa and DjangoGirls that happen during this conference in 2024. That's great, do you have any advice for people who would like to join or create their own DjangoGirls event in their city?

Start small and start with intention. You don’t need a massive budget. What you need is:
  • A committed small team
  • Clear structure
  • Support from the global DjangoGirls organization, Django Software Foundation, and other communities.
  • A safe, welcoming environment
Most importantly, center the participants. The goal isn’t just teaching Django, it’s building confidence and introducing them to the Tech industry.

How did you become a leader of the PyLadies Ghana chapter?

My Leadership journey in the PyLadies Ghana community began with a simple step: attending a Django Girls workshop at Ho while I was in school. At the time, I was just curious and eager to learn more about programming. After the workshop, I was introduced to the PyLadies Ghana community and added to the group. That was my first real connection to a tech community. I started by simply showing up, participating in conversations, attending events, and learning from others in the community. Over time, I became more involved. I joined the PyLadies Ghana Tema Chapter, where I supported the community lead with organizing activities that are bootcamps, meetups,etc. Through that experience, I had the opportunity to contribute more actively. Because of my commitment and willingness to help, I was later asked to volunteer as a co-lead of PyLadies Ghana Tema Chapter. I accepted the opportunity and began working more closely with the Lead to organize events, support members, and grow the community. It was a period of learning, collaboration, and service. As I continued contributing and volunteering, more opportunities opened up. When there was a chance to volunteer with PyLadies Ghana programs and events, I stepped forward again and volunteered as PyLadies Ghana Programs and Events Lead. That experience eventually led to me becoming a lead. Looking back, my journey with PyLadies Ghana has been shaped by community, consistency, and volunteering. What started as attending a workshop grew into leadership and the chance to help create opportunities for others. It reminds me that sometimes all it takes is showing up, contributing where you can, and being willing to grow with the community.

You have been organizing a lot of events in Africa, especially in Ghana. How do you envision organizing an event? Would you like additional support?

For me, events are ecosystems, not just gatherings. Focus on:
  • Clear goals and impact
  • Accessibility
  • Diversity of voices
  • Strong logistics planning
  • Follow-up community building
Yes, more funding support, institutional partnerships for internships, and long-term sponsorship pipelines would significantly help African tech communities scale sustainably. International Women’s Day is a reminder that representation is not a trend, it's a necessity. We need more women building systems, shaping infrastructure, leading conversations, and owning technical spaces. And to every woman in tech: your presence is powerful. Keep building. Keep speaking. Keep leading. Keep mentoring and raising the next tech women.

What are your hobbies or what do you do when you’re not working?

When I’m not working, I’m usually reading books/articles, mentoring, watching movies or documentaries, cooking, reflecting, or exploring new ideas around technology and social impact. I also enjoy quiet strategy sessions with myself, thinking about how to build things that outlive me.

Is there anything else you’d like to say?

Technology is more than code, it's access, power, and possibility. I hope more people see themselves not just as users of technology, but as architects of it.
Thank you for doing the interview, Stancy !

via The Django weblog
Share  
Tags  

Django security releases issued: 6.0.3, 5.2.12, and 4.2.29

In accordance with , the Django team is issuing releases for , , and . These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows

The django.forms.URLField form field's to_python() method used urllib.parse.urlsplit() to determine whether to prepend a URL scheme to the submitted value. On Windows, urlsplit() performs NFKC normalization (unicodedata.normalize), which can be disproportionately slow for large inputs containing certain characters. URLField.to_python() now uses a simplified scheme detection, avoiding Unicode normalization entirely and deferring URL validation to the appropriate layers. As a result, while leading and trailing whitespace is still stripped by default, characters such as newlines, tabs, and other control characters within the value are no longer handled by URLField.to_python(). When using the default URLValidator, these values will continue to raise ValidationError during validation, but if you rely on custom validators, ensure they do not depend on the previous behavior of URLField.to_python(). This issue has severity "moderate" according to the Django Security Policy. Thanks to Seokchan Yoon for the report.

CVE-2026-25674: Potential incorrect permissions on newly created file system objects

Django's file-system storage and file-based cache backends used the process umask to control permissions when creating directories. In multi-threaded environments, one thread's temporary umask change can affect other threads' file and directory creation, resulting in file system objects being created with unintended permissions. Django now applies the requested permissions via os.chmod() after os.mkdir(), removing the dependency on the process-wide umask. This issue has severity "low" according to the Django Security Policy. Thanks to Tarek Nakkouch for the report.

Affected supported versions

  • Django main
  • Django 6.0
  • Django 5.2
  • Django 4.2

Resolution

Patches to resolve the issue have been applied to Django's main, 6.0, 5.2, and 4.2 branches. The patches may be obtained from the following changesets.

CVE-2026-25673: Potential denial-of-service vulnerability in URLField via Unicode normalization on Windows

  • On the
  • On the
  • On the
  • On the

CVE-2026-25674: Potential incorrect permissions on newly created file system objects

  • On the
  • On the
  • On the
  • On the

The following releases have been issued

  • Django 6.0.3 ( | )
  • Django 5.2.12 ( | )
  • Django 4.2.29 ( | )
The PGP key ID used for this release is Natalia Bidart:

General notes regarding security reporting

As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance, nor via the Django Forum. Please see for further information.

via The Django weblog
Share  
Tags  

Google Summer of Code 2026 with Django

When we learned that the Django Software Foundation has been accepted as a mentoring organization for Google Summer of Code 2026, it marked another steady milestone in a long-standing relationship. Django first participated in GSoC in 2006, and 2026 represents our 21st consecutive year in the program. Over two decades, GSoC has become a consistent pathway for contributors to engage more deeply with Django — not just through a summer project, but often through continued involvement that extends well beyond the official coding period. For many of you reading this, this might be your first exposure to how Django’s open source ecosystem works. So before we get into applications and expectations, let’s take a step back and understand the environment you’re stepping into.

Understanding the Django Ecosystem

The Django Software Foundation (DSF) is the non-profit organization that supports the long-term sustainability of Django. Django itself is developed entirely in the open. Feature discussions, architectural debates, bug reports, design proposals, and code reviews all happen publicly. That openness is intentional. It allows anyone, from anywhere in the world, to participate. But it also means decisions are rarely made quickly or casually. Changes are discussed carefully. Trade-offs are evaluated. Backwards compatibility is taken seriously. If you are new, it helps to understand the main spaces where this work happens:
  • The is where broader discussions take place — new feature ideas, design direction, and community conversations.
  • is the issue tracker, where bugs, feature requests, and patches are formally recorded and reviewed. If no one is working on an issue, you can assign it yourself and start working on it.
  • Code contributions happen through , where proposed changes are reviewed, tested, and discussed in detail before being merged.
  • New features are proposed and discussed in the . There is a that shows the state of each proposal.
For someone new, this ecosystem can feel overwhelming at first. Threads may reference decisions made years ago. Review comments can be detailed. Standards are high. That is precisely why GSoC matters to us. It provides a structured entry point into this culture, with mentorship and guidance along the way, helping contributors understand not just how to write code — but how Django evolves.

Why the Django Forum Is Central

Most GSoC journeys in Django begin on the — the community’s public space for technical discussions about features, design decisions, and improvements to Django. Introducing yourself there is not a formality; it is often your first real contribution. When you discuss a project idea publicly, you demonstrate how you think, how you respond to feedback, and how you handle technical trade-offs. Questions and challenges from mentors are not barriers — they are part of the collaborative design process. Proposals that grow through open discussion on the Forum are almost always stronger than those written in isolation.

What To Do

If you are planning to apply for GSoC 2026 with Django, here is what we strongly encourage: Start early. Do not wait until the application window opens. Begin discussions well in advance. Engage publicly. Introduce yourself on the . Participate in ongoing threads. Show consistent involvement rather than one-time activity. Demonstrate understanding(very important) Read related tickets and past discussions. Reference them in your proposal. Show that you understand the technical and philosophical context. Be realistic about scope. Ambitious ideas are welcome, but they must be grounded in technical feasibility within the GSoC timeframe. Show iteration. If your proposal evolves because of feedback, that is a positive signal. It shows adaptability and thoughtful engagement. What Not To Do Equally important are the expectations around what we will not consider. Do not submit a proposal without prior discussion. A proposal that appears for the first time in the application form, without any Forum engagement, will be at a disadvantage. Do not generate a proposal using AI and submit it as-is. If a proposal is clearly AI-generated, lacks discussion history, and shows no evidence of personal understanding, it will be rejected. We evaluate your reasoning process, not just the surface quality of the document. Do not copy previous proposals. Each year’s context is different. We expect original thinking and up-to-date understanding. Do not treat GSoC as a solo internship. Django development is collaborative. If you are uncomfortable discussing ideas publicly or receiving detailed feedback, this may not be the right fit. Do not submit empty or placeholder proposal documents. In previous years, we have received blank or near-empty submissions, which create unnecessary effort for volunteer reviewers. Such proposals will not be considered. Do not repeatedly tag or ping maintainers for reviews. Once you’ve submitted your proposal or patch, give reviewers time to respond. Maintainers are volunteers managing many responsibilities, and repeated tagging does not speed up the process. Patience and respectful follow-ups (after a reasonable interval) are appreciated.

On AI Usage

We recognize that AI tools are now part of many developers’ workflows. Using AI to explore documentation, clarify syntax, or organize thoughts is not inherently a problem. However, AI must not replace ownership. You should be able to clearly explain your architectural decisions, justify trade-offs, and respond thoughtfully when challenged. If you cannot defend your own proposal without external assistance, it signals a lack of readiness for this kind of work. The quality we look for is not perfect language — it is depth of understanding.

I’m a First-Time Contributor to Django — What Should I Do?

If this is your first time contributing to Django, start simple and start early. First, spend some time understanding how Django works as an open source project. Read a few recent discussions on the and browse to see the kinds of problems being discussed. Next, introduce yourself on the Forum. Share your background briefly and mention what areas interest you. You don’t need to have a perfect project idea on day one — curiosity and willingness to learn matter more. Then:
  • Read the official carefully.
  • Try setting up Django locally and run the test suite.
  • Look for small tickets on (including documentation or cleanup tasks) to understand the workflow.
  • Ask questions on the or in if something is unclear.
Most importantly, be patient with yourself. Django is a mature and widely used framework, and it takes time to understand its design principles and contribution standards. Strong contributors are not the ones who know everything at the start — they are the ones who show up consistently, engage thoughtfully, and improve through feedback.

To conclude

We are excited to welcome a new group of contributors into the Django ecosystem through Google Summer of Code 2026. We look forward to thoughtful ideas, constructive discussions, and a summer of meaningful collaboration — built not just on code, but on understanding and shared responsibility.

via The Django weblog
Share  
Tags