BlueSoybean.com - Free RSS-Based News Reader

close

The Django weblog

Latest news about Django, the Python web framework.


Source: https://www.djangoproject.com/rss/weblog/

Articles

Django Code of Conduct Transparency Report 2025 | Weblog | Django

Posted by Dan Ryan on Dec. 11, 2025

via The Django weblog
Share  
Tags  

Online Community Working Group GitHub repo and project

The Online Community Working Group has introduced a new GitHub repository designed to manage and track ideas, suggestions, and improvements across Django's various online community platforms.

Introducing the Online Community Working Group Repository

Primarily inspired by the rollout of the repository, the Online Community Working Group has launched that works in conjunction with the to provide a mechanism to gather feedback, suggestions, and ideas from across the online community and track their progression. The primary aim is to help better align Django's presence across multiple online platforms by providing:
  1. Centralisation: A community-platform-agnostic place to collect feedback, suggestions, and ideas from members of any of Django's online communities.
  2. Visibility: With a variety of platforms in use across the community, some of which require an account before their content can even be read, discussions can happen in what effectively amount to private silos. This centralised repository allows all suggestions and ideas to be viewed by everybody, regardless of their community platform of choice.
  3. Consistency: A suggestion for one platform can often be a good idea for another. Issues and ideas raised centrally can be assessed against all platforms to better align Django's online community experience.

How to use the Online Community Working Group Repo

If you have an idea or a suggestion for any of Django's online community platforms (such as the , , or elsewhere), the process starts by in the new repository. You'll be asked to summarise the idea, and answer a couple of short questions regarding which platform it applies to and the rationale behind your idea. The suggestion will be visible on the public board, and people will be able to react to the idea with emoji responses as a quick measure of support, or provide longer-form answers as comments on the issue. The Online Community Working Group will review, triage, and respond to all suggestions, before deciding whether or how they can be implemented across the community.

Existing Online Communities

Note that we're not asking that you stop using any mechanisms in place within the particular community you're a part of currently—the Discord channel is not going away, for example. However, we may ask that a suggestion or idea flagged within a particular platform be raised via this new GitHub repo instead, in order increase its visibility, apply it to multiple communities, or simply better track its resolution.

Conclusion

The Online Community Working Group was relatively recently set up, with the aim of improving the experience for members of all Django's communities online. This new repository takes a first step in that direction. Check out the repository at on GitHub to learn more and start helping shape Django's truly excellent community presence online.

via The Django weblog
Share  
Tags  

Django 6.0 released

The Django team is happy to announce the release of Django 6.0. assembles a mosaic of modern tools and thoughtful design. A few highlights are:
  • Template Partials: modularize templates using small, named fragments for cleaner, more maintainable code. (GSoC project by , mentored by )
  • Background Tasks: run code outside the HTTP request-response cycle with a built-in, flexible task framework. ()
  • Content Security Policy (CSP): easily configure and enforce browser-level security policies to protect against content injection. ()
  • Modernized Email API: compose and send emails with Python's EmailMessage class for a cleaner, Unicode-friendly interface. ()
You can get Django 6.0 from or from . The PGP key ID used for this release is Natalia Bidart: With the release of Django 6.0, Django 5.2 has reached the end of mainstream support. The final minor bug fix release, , was issued yesterday. Django 5.2 will receive security and data loss fixes until April 2028. All users are encouraged to upgrade before then to continue receiving fixes for security issues. Django 5.1 has reached the end of extended support. The final security release, , was issued on Dec. 2, 2025. All Django 5.1 users are encouraged to to a supported Django version. See the for a table of supported versions and the future release schedule.

via The Django weblog
Share  
Tags  

Django security releases issued: 5.2.9, 5.1.15, and 4.2.27

In accordance with , the Django team is issuing releases for , , and . These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL

FilteredRelation was subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.annotate() or QuerySet.alias() on PostgreSQL. Thanks to Stackered for the report. This issue has severity "high" according to the Django security policy.

CVE-2025-64460: Potential denial-of-service vulnerability in XML serializer text extraction

Algorithmic complexity in django.core.serializers.xml_serializer.getInnerText() allowed a remote attacker to cause a potential denial-of-service triggering CPU and memory exhaustion via specially crafted XML input submitted to a service that invokes XML Deserializer. The vulnerability resulted from repeated string concatenation while recursively collecting text nodes, which produced superlinear computation resulting in service degradation or outage. Thanks to Seokchan Yoon () for the report. This issue has severity "moderate" according to the Django security policy.

Affected supported versions

  • Django main
  • Django 6.0 (currently at release candidate status)
  • Django 5.2
  • Django 5.1
  • Django 4.2

Resolution

Patches to resolve the issue have been applied to Django's main, 6.0 (currently at release candidate status), 5.2, 5.1, and 4.2 branches. The patches may be obtained from the following changesets.

CVE-2025-13372: Potential SQL injection in FilteredRelation column aliases on PostgreSQL

  • On the
  • On the
  • On the
  • On the
  • On the

CVE-2025-64460: Potential denial-of-service vulnerability in XML serializer text extraction

  • On the
  • On the
  • On the
  • On the
  • On the

The following releases have been issued

  • Django 5.2.9 ( | )
  • Django 5.1.15 ( | )
  • Django 4.2.27 ( | )
The PGP key ID used for this release is Natalia Bidart:

General notes regarding security reporting

As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance, nor via the Django Forum. Please see for further information.

via The Django weblog
Share  
Tags  

2026 DSF Board Election Results

The 2026 DSF Board Election has closed, and the following candidates have been elected:
  • Jacob Kaplan-Moss
  • Priya Pahwa
  • Ryan Cheley
They will all serve two years for their term.

2026 Board

Directors - Abigail Gbadago, Jeff Triplett, Paolo Melchiorre, Tom Carrick - are continuing with one year left to serve on the board. Therefore, the combined 2026 DSF Board of Directors are:
  • Abigail Gbadago
  • Jacob Kaplan-Moss*
  • Jeff Triplett
  • Paolo Melchiorre
  • Priya Pahwa*
  • Ryan Cheley*
  • Tom Carrick
* Elected to a two year term 2026 DSF Board: Abigail Gbadago, Jacob Kaplan-Moss, Jeff Triplett, Paolo Melchiorre, Priya Pahwa, Ryan Cheley, Tom Carrick Congratulations to our winners, and a huge thank you to our departing board members Sarah Abderemane and Thibaud Colas. Thank you again to everyone who nominated themselves. Even if you were not successful, you gave our community the chance to make their voices heard in who they wanted to represent them.

via The Django weblog
Share  
Tags