BlueSoybean.com - Free RSS-Based News Reader

close

The Django weblog

Latest news about Django, the Python web framework.


Source: https://www.djangoproject.com/rss/weblog/

Articles

Django 6.0 released | Weblog | Django

Posted by Natalia Bidart on Dec. 3, 2025

via The Django weblog
Share  
Tags  

Django security releases issued: 5.2.9, 5.1.15, and 4.2.27

In accordance with , the Django team is issuing releases for , , and . These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL

FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Thanks to Stackered for the report. This issue has severity "high" according to the Django security policy.

CVE-2025-64460: Potential denial-of-service vulnerability in XML serializer text extraction

Algorithmic complexity in django.core.serializers.xml_serializer.getInnerText() allowed a remote attacker to cause a potential denial-of-service triggering CPU and memory exhaustion via specially crafted XML input submitted to a service that invokes XML Deserializer. The vulnerability resulted from repeated string concatenation while recursively collecting text nodes, which produced superlinear computation resulting in service degradation or outage. Thanks to Seokchan Yoon () for the report. This issue has severity "moderate" according to the Django security policy.

Affected supported versions

  • Django main
  • Django 6.0 (currently at release candidate status)
  • Django 5.2
  • Django 5.1
  • Django 4.2

Resolution

Patches to resolve the issue have been applied to Django's main, 6.0 (currently at release candidate status), 5.2, 5.1, and 4.2 branches. The patches may be obtained from the following changesets.

CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL

  • On the
  • On the
  • On the
  • On the
  • On the

CVE-2025-64460: Potential denial-of-service vulnerability in XML serializer text extraction

  • On the
  • On the
  • On the
  • On the
  • On the

The following releases have been issued

  • Django 5.2.9 ( | )
  • Django 5.1.15 ( | )
  • Django 4.2.27 ( | )
The PGP key ID used for this release is Natalia Bidart:

General notes regarding security reporting

As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance, nor via the Django Forum. Please see for further information.

via The Django weblog
Share  
Tags  

2026 DSF Board Election Results

The 2026 DSF Board Election has closed, and the following candidates have been elected:
  • Jacob Kaplan-Moss
  • Priya Pahwa
  • Ryan Cheley
They will all serve two years for their term.

2026 Board

Directors - Abigail Gbadago, Jeff Triplett, Paolo Melchiorre, Tom Carrick - are continuing with one year left to serve on the board. Therefore, the combined 2026 DSF Board of Directors are:
  • Abigail Gbadago
  • Jacob Kaplan-Moss*
  • Jeff Triplett
  • Paolo Melchiorre
  • Priya Pahwa*
  • Ryan Cheley*
  • Tom Carrick
* Elected to a two year term 2026 DSF Board: Abigail Gbadago, Jacob Kaplan-Moss, Jeff Triplett, Paolo Melchiorre, Priya Pahwa, Ryan Cheley, Tom Carrick Congratulations to our winners, and a huge thank you to our departing board members Sarah Abderemane and Thibaud Colas. Thank you again to everyone who nominated themselves. Even if you were not successful, you gave our community the chance to make their voices heard in who they wanted to represent them.

via The Django weblog
Share  
Tags  

DSF member of the month - Akio Ogasahara

For November 2025, we welcome Akio Ogasahara as our DSF member of the month! ⭐ Akio is a technical writer and systems engineer. He contributed to the Japanese translation for many years. He has been a DSF member since June 2025. You can learn more about Akio by visiting and . Let’s spend some time getting to know Akio better!

Can you tell us a little about yourself (hobbies, education, etc.)

I was born in 1986 in Rochester, Minnesota, to Japanese parents, and I’ve lived in Japan since I was one. I’ve been fascinated by machines for as long as I can remember. I hold a master’s degree in mechanical engineering. I’ve worked as a technical writer and a software PM, and I’m currently in QA at a Japanese manufacturer.

I'm curious, where does your nickname “libratech” come from?

I often used “Libra” as a handle because the symbol of Libra—a balanced scale—reflects a value I care deeply about: fairness in judgment. I combined that with “tech,” from “tech writer,” to create “libratech.”

How did you start using Django?

Over ten years ago, I joined a hands-on workshop using a Raspberry Pi to visualize sensor data, and we built the dashboard with Django. That was my first real experience.

What other framework do you know and if there is anything you would like to have in Django if you had magical powers?

I’ve used Flask and FastAPI. If I could wish for anything, I’d love “one-click” deployment that turns a Django project into an ultra-lightweight app running on Cloudflare Workers.

What projects are you working on now?

As a QA engineer, I’m building Pandas pipelines for quality-data cleansing and creating BI dashboards.

What are you learning about these days?

I’m studying for two Japanese certifications: the Database Specialist exam and the Quality Control Examination (QC Kentei).

Which Django libraries are your favorite (core or 3rd party)?

Django admin, without question. In real operations, websites aren’t run only by programmers—most teams eventually need CRM-like capabilities. Django admin maps beautifully to that practical reality.

What are the top three things in Django that you like?

  • Django admin
  • Strong security
  • DRY by design

You have contributed a lot on the Japanese documentation, what made you contribute to translate for the Japanese language in the first place?

I went through several joint surgeries and suddenly had a lot of time. I’d always wanted to contribute to open source, but I knew my coding skills weren’t my strongest asset. I did, however, have years of experience writing manuals—so translation felt like a meaningful way to help.

Do you have any advice for people who could be hesitant to contribute to translation of Django documentation?

Translation has fewer strict rules than code contributions, and you can start simply by creating a Transifex account. If a passage feels unclear, improve it! And if you have questions, the .

I know you have some interest in AI as a technical writer, do you have an idea on how Django could evolve with AI?

Today’s AI is excellent at working with existing code—spotting N+1 queries or refactoring SQL without changing behavior. But code written entirely by AI often has weak security. That’s why solid unit tests and Django’s strong security guardrails will remain essential: they let us harness AI’s creativity safely.

Django is celebrating its 20th anniversary, do you have a nice story to share?

The surgeries were tough, but they led me to documentation translation, which reconnected me with both English and Django. I’m grateful for that path.

What are your hobbies or what do you do when you’re not working?

Outside of computers, I enjoy playing drums in a band and watching musicals and stage plays! 🎵

Is there anything else you’d like to say?

If you ever visit Japan, of course sushi and ramen are great—but don’t miss the sweets and ice creams you can find at local supermarkets and convenience stores! They’re inexpensive, come in countless varieties, and I’m sure you’ll discover a new favorite!🍦
Thank you for doing the interview, Akio !

via The Django weblog
Share  
Tags  

Twenty years of Django releases

On November 16th 2005, Django co-creator Adrian Holovaty announced the first ever Django release, Django 0.90. Twenty years later, today here we are 🚀. Since we’re , here are a few release-related numbers that represent Django’s history:
  • 447 releases over 20 years. That’s about 22 per year on average. We’re at 38 so far for 2025. Fun fact: 33 of those releases predate PyPI, and were published via the Django website only!
  • 131 security vulnerabilities addressed in those Django releases. Our is a testament to our stellar track-record.
  • 262,203 releases of Django-related packages. is gigantic. There’s tens of releases of Django packages per day as of 2025. There were 52 just today. With the caveat this depends a lot on what you classify as a "Django" package.
This is what decades’ worth of a stable framework looks like. Expect more gradual improvements and bug fixes over the next twenty years’ worth of releases. And if you like this kind of data, check out the report by JetBrains, with lots of statistics on our ecosystem (and there’s a offer).

Support Django

If you or your employer counts on Django’s 20 years of stability, consider whether you can support the project via donations to our non-profit Django Software Foundation.
  • Check out how to
Once you’ve done it, post with #DjangoBirthday and tag us / / / so we can say thank you! 59% Of our US $300,000.00 goal for 2025, as of November 19th, 2025, we are at:
  • 58.7% funded
  • $176,098.60 donated

via The Django weblog
Share  
Tags