22 Sep 2026
Django community aggregator: Community blog posts
DjangoCon Chicago 2026 Highlights
DjangoCon US returned to Chicago in 2026, bringing together members of the Django community for a week of learning, connection, and collaboration. I caught up with a few members of the Caktus team to hear about their favorite talks and takeaways from this year's conference.
22 Sep 2026 7:00pm GMT
Generalization as discipline
General code comes out better than code cut to fit one job, and its authors are the first to benefit. When we cannot afford all of it, the way down runs against instinct: work out the ideal shape first, then cut what today does not need, and keep a plan for putting it back.

22 Sep 2026 10:00am GMT
21 Sep 2026
Django community aggregator: Community blog posts
First Aid Kits: Bleeding Control & Tourniquets
Should you put a tourniquet in your first aid kit? Maybe, but you should know some things before you do:
-
Training is more important than any piece of gear. Most bleeds can be stopped with direct pressure and/or proper wound packing - and both can be done with your hands and any old piece of fabric you have lying around. If you don't know what "direct pressure" or "wound packing" means, or if you want to practice, take a course! A Stop The Bleed course is an excellent investment, and will go into all forms of bleeding control (including how to properly apply a tourniquet.) Most basic first aid courses will also cover bleeding control to some extent, though wilderness-oriented courses (for example, Wilderness First Aid) will typically go into more depth.
(These are US-oriented suggestions; readers from other areas, I'd love for you to get in touch and let me know the equivalents in your country.)
-
Once you do take that training, you'll learn that the most important supplies for bleeding control are gloves, a stretchy bandage and plenty of gauze. Get those first, then think about other supplies.
-
You probably don't need a tourniquet in your first aid kit. Major bleeds that require tourniquets and aren't immediately fatal - are rare outside of some specific circumstances (see below). Most people will never encounter one of these circumstances. While there's nothing wrong with having one (if you're trained to use it), they're expensive and don't last forever. If you've got disposable income, and the training, sure, go ahead; but for most people, your money is better spent on something else. (Narcan, for example: you've got a much higher chance of saving a life with Narcan than with a tourniquet.)
-
You probably do need a tourniquet if you:
- work with highly dangerous power tools (e.g. table saws, chainsaws),
- use firearms (e.g. target shooting, hunting) or are likely to be shot (e.g. military), or
- ride a motorcycle.
This isn't an exhaustive list; you may be able to think of other situations. The common factor is exposing yourself to a risk of sudden massive hemorrhage. If you're in one of those situations, you should have a tourniquet and know how to use it.
-
If you do decide to have a tourniquet, you need to know how to use it. They're not intuitive to use, especially if you're stressed, and putting one on yourself can be tricky. Most people, without training, don't make the tourniquet nearly tight enough - they need to be shockingly tight.
Take a course, and buy a trainer tourniquet to practice. You don't want to practice with your real tourniquet, because they're single use. Tightening them correctly can weaken the strap to the point that they may not work a second time; hence the need for the trainer. (This is another reason why I say that tourniquets are expensive.) Practice applying a tourniquet to yourself and to someone else, and crank it down correctly. It should cut off circulation (that's the point), and will hurt. Practicing like this is safe as long as you don't leave the tourniquet tightened for longer than a few minutes.
-
Buy a windlass-style tourniquet- that's the kind with a velcro band and tightening stick. Other styles (like the stretchy strap you might see when you get blood drawn for lab work) don't work as well, and improvised tourniquets (e.g. a belt or climbing rope or whatever) don't work at all. Get it from a reputable source: places like Amazon often sell fakes that'll break under proper tension. They should be expensive (around $40 each).
The gold standard are C-A-T tourniquets; I get mine from North American Rescue.
-
An alternative to a tourniquet that's nearly as effective and easier to use is an Israeli Bandage. They're much cheaper (typically less than $10 each), and are easy to apply (but still practice). They're great, you should have one in your FAK even if you also have a tourniquet.
-
Some people put clotting agents or bandages (e.g. QuikClot) in their bleeding control kits. Opinion on these is split: they do work, but they leave gunk in the wound that your ER doc is going to need to cut out. This'll prolong recovery and cause worse cosmetic outcomes. They also can't stop the big bleeds that you'd need wound packing or a tourniquet to stop. Many ER doctors and nurses I've talked to don't like clotting agents, and recommend against them; but on the other hand, several remote/austere medicine practitioners I've spoken to make compelling cases for them. So: think about the tradeoffs.
-
Tourniquets expire - the nylon weakens over time, to the point that tightening an old tourniquet might break it. So that tourniquet your friend kept when he left the army should go in the trash, and you need to check your kit yearly-ish and replace any past their expiration date.
So what do I do?
I have tourniquets in two places:
- In my shop. I have a table saw in there, and several other things that spin sharp metal at high speed.
- In a small first aid pouch that I wear on my belt when I'm using my chainsaw.
Both of those bleeding control kits also have an Israeli bandage, vetwrap, and gauze. I probably ought to have gloves but I don't; the person doing the bleeding is going to be me or a loved one, and I can't be bothered to keep replacing them as they get all gross and sticky from the heat.
None of my other first aid kits have tourniquets. My backcountry kits don't need them; I'm not going to encounter a situation in the wilderness that requires a tourniquet. (I would add one if I went on a hunting trip.)
There's an argument to be made that I should carry one in the kit in my car - because I have emergency medical training, I'd want to stop and help if I witnessed a traffic accident, and those are situations where perhaps a tourniquet could make a difference. However, I'm concerned that the heat of the car will degrade the tourniquet faster than I'd expect, and so if I did apply it, it could fail. And I'm confident enough in my ability to control bleeding with pressure until EMS arrives.
Was this helpful? I've been thinking about writing a longer series about first aid kits (how I think about building them, and what goes in mine), of which this could become a part. If that's something you'd like to read, get in touch.
21 Sep 2026 5:00am GMT
19 Sep 2026
Django community aggregator: Community blog posts
Python: join my optimization workshop in Lisbon, 10th October
I'm running a workshop in Lisbon next month, and you're invited!
It's a small, in-person, hands-on session on optimizing Python code, with a Django flavour. Here are the details:
- What: Python optimization workshop
- When: Saturday 10th October 2026, 10:00-13:00
- Where: Martinhal Lisbon Oriente, Parque das Naรงรตes, Lisbon.
- Cost: Free, but places are limited and registration is required
- Size: Up to 10 people
- Led by: Myself, Adam Johnson
- Organised by: Mafalda Marques
What we'll do
In my experience, Python projects often have some easy performance improvements waiting to be found, from client projects to large open source projects like Django itself. This workshop is designed to teach you how to find the hot spots worth optimizing, using these three tools in a loop:
- Capture a profile with
cProfile, Python's built-in profiler. - Drill into it with profiling-explorer, to find where the time actually goes.
- Prove your change worked with tprof, which measures just the functions you care about and can compare before against after.
I'll teach the loop end-to-end on a real example. Then we'll spend most of the morning using it for real, and you can pick your target:
-
Django itself.
I'll bring a small collection of potential optimization targets in the Django codebase. You can try out the loop optimizing them, figure out if there are safe and worthwhile optimizations to be made, and potentially make a pull request to Django itself. I'll help shepherd the promising ones towards being merged after the workshop.
-
Another project.
If you'd rather point the tools at something else, like another open source project or a work codebase, feel free. We can still work together to find some gems.
We'll try working in pairs, and at points we can chat as a group to compare notes on what we've found.
There's a break in the middle, with coffee, tea, and pastries provided.
Who it's for
Intermediate and experienced Python developers. Django experience is helpful, especially if you want to work on Django itself, but it isn't required. The tools and the loop are plain Python, and the "your own project" track works with any codebase.
You don't need to have profiled anything before.
What to bring
A laptop, with Git and a recent Python version installed. I'll send setup instructions to everyone who registers, a week or so beforehand. It only takes a few minutes, but please do it before you arrive, so we can spend the time on the interesting parts.
This is a workshop, not a talk, so we'll be talking and coding together throughout the session.
Register
There are only ten places in order to keep the session manageable, so please stick to your registration.
19 Sep 2026 4:00am GMT
18 Sep 2026
Django community aggregator: Community blog posts
Issue 355: DjangoCon Europe 2027 in Innsbruck and Django Probe
News
Executive Director Search Extended to September 22
You don't need to be a Django or Python expert, or already part of the community, to apply for the DSF's first Executive Director role. Applications now close September 22, anywhere on Earth.
DjangoCon Europe 2027 is heading to Innsbruck, Austria! ๐๏ธโท๏ธ๐ ๐ฆ๐น
Tickets are on sale and the Call for Proposals is open for five days of Django, Python, and community in Innsbruck, February 17 to 21, 2027.
Django Software Foundation
DSF Board monthly meeting, Sept 10, 2026
The board approved DEP 0019, discussed next steps in their Executive Director search, committed to funding Djangonaut Space for the next three years, later launched a new corporate sponsorship page, and more.
Python Software Foundation
Announcing the 2026 PSF Board Election Results!
Elaine Wong, Laรญs Carvalho, Ee Durbin, and Georgi Ker take the four open board seats out of 670 ballots cast, as Cheuk Ting Ho, Chris Neugebauer, and Denny Perez finish their terms.
Announcing the 2026 Python Packaging Council Election Results!
The first Python Packaging Council is seated: Brett Cannon and Pradyun Gedam on two-year terms, Donald Stufft, Henry Schreiner, and Ralf Gommers on one-year terms, so roughly half the council turns over each year.
Announcing the PSF Strategic Plan 2026
Feedback on the June draft reshaped the PSF's five-year plan, which now adds security baseline and vulnerability management objectives, folds translation into accessibility, and clarifies how companies can fund specific work.
Updates to Django
Today, "Updates to Django" is presented by Raffaella from Djangonaut Space! ๐
Last week we had 9 pull requests merged into Django by 8 different contributors - including 3 first-time contributors! Congratulations to Loรฏc LEFEVRE, Paul K. Gerke and Rickey Shideler for having their first commits merged into Django - welcome on board!
- Support for GEOS 3.10 is removed for Django 6.2
- Fixed a data loss issue in Django 4.0 where
network rasterswere deleted by GeoDjango when closed.
Thanks to the persistence of the contributors, a great deal of work has been done on the dajngo-admin yes-icons to make it rectangular, which helps people with dichromatic viewing deficiencies.
Kudos for the great work updating the tutorial and cleaning up a section to help newcomers focus on the essentials.
Django Fellow Reports
Django Fellow Report - Natalia
A quieter week, with a mix of security work, reviews, and follow-ups from ongoing work. I spent a good chunk of time on a security report that needed a second triage, including a detailed review of the proposed patch ๐.
I also wrapped up more of the follow-through from DEP 20 by adapting the release checklists to the new release calendar, and resumed a PR to make EmailValidator more flexible.
And, in particularly happy news ๐ฅณ, we welcomed two new members to the Ops Team and two to the Security Team ๐. I'm thrilled to see both teams growing!
Django Fellow Report - Sarah
This week was quite admin heavy but all positive things! The usual tickets triaged, reviewed, and authored, as well as four security issues, and lots of meetings.
Django Fellow Report - Jacob
An early report for about a day at my desk before heading out for some vacation. Multiple tickets reviewed and authored, along with security/ops/steering council/Fellows meetings.
Sponsored
Simple APM dashboards for Python. Set up in just 5 minutes
Drowning in data? Honeybadger gives you Just Enough APMโข without enterprise bloat or cost.
Our dev-friendly APM dashboards expose metrics and trends across your apps and infrastructure, so you can find and fix Python issues before users notice!
Articles
Django: introducing django-mcpz, for making MCP servers
Because the new MCP version is stateless, a server is just a Django view: route path("mcp", server), decorate functions that take an HttpRequest, and msgspec validates arguments against schemas generated from your type annotations. No ASGI or Channels needed.
Share how you use Django with Django Probe
Tim Schilling wants decisions about what Django adds or deprecates to rest on more than gut feel, so django-probe counts which Django classes, methods, and functions your codebase actually uses and submits the tally. Sign up at djangoprobe.org, then scan and submit.
The Ultimate Question of Architecture, the Universe and Everything
Four projects, one lesson: make being wrong cheap.
Django Management Command for Bulk Import
A walkthrough of writing a custom Django management command to bulk import data.
Django: serve the change password well-known URL
One RedirectView at /.well-known/change-password lets password managers send users straight to your change password page, and Django's default 404s already pass the spec's check for servers that answer 200 to everything.
The PyLadiesCon Portal Was Spammed: 2,249 Fake Accounts. Four Months Before Anyone Noticed
A bot signed up 2,249 accounts on a Django volunteer portal to borrow its sending reputation for email bombing, and at 30 a day nobody noticed until fake accounts were 91% of the database. The fixes: django-simple-captcha, per-IP hourly rate limits, and a scheduled purge of unverified accounts.
Creating Web Widgets Using the Document Picture-in-Picture API
Picture-in-picture isn't just for video: this API floats any HTML in an always-on-top window, and the display-mode: picture-in-picture media query keeps your CSS from breaking once a component leaves the page. Desktop Chrome and Firefox only for now.
Django Forum
Add Plausible Tracking to DjangoProject.com?
Plausible tracking is now live on djangoproject.com and docs.djangoproject.com. This was a long-running discussion over the past 2 years. Thank you to everyone who participated.
Events
Django on the Med - Sept 23rd to 25th
The second Django on the Med development sprints are taking place next week in beautiful Pescara, Italy.
Django Day Copenhagen 2026 - October 2nd
Djangonauts from in and around Denmark are meeting up for the 6th edition of Django Day Copenhagen, to be held on October 2nd. It will be a full day of talks, either to be experienced online -or- at our venue.
Sponsored
Automatic translations on every pull request
New strings in your .po files, translated on-brand before they merge. Localhero runs as a GitHub Action, with a review page where the whole team can tweak the copy. No export, no re-import, no sync step to forget. Rails YAML and JSON too.
Django Job Board
The DSF's search for its first Executive Director, now open through September 22, leads this week's board, alongside a new Django role at The Developer Society, machine learning work at Provision, and a backend seat at The Cruise Brothers.
โญ Executive Director at Django Software Foundation
๐ Django Developer at The Developer Society
Machine Learning Engineer (Hybrid) at Provision
Django Developer at The Cruise Brothers
Projects
codingjoe/django-letter
Write an email once as a Django template, and django-letter sends it as HTML with inlined CSS plus a plain-text alternative derived from the same markup.
adamchainz/django-mcpz
The package behind the article above, for building MCP servers inside a regular Django project.
18 Sep 2026 3:00pm GMT
17 Sep 2026
Django community aggregator: Community blog posts
September Python Leiden meetup summaries
Two summaries from the September 2026 https://pythonleiden.nl/.
Maintaining Python packages to attract free and open source software contributors - Steve Piercy
Steve is in the Netherlands for next week's Plone conference in Maastricht (NL). He's been involved in open source software for over two decades.
What are contributors? Contributors to open source software? Why do you do it? Learning (I myself got a good programming education out of contributing to Zope/Plone while still at the university). You might want to give back. You might like the community, you like to belong to the community. Finding your tribe. Perhaps build a resume or CV. Help other people.
Why not? Negative online reactions. You want to really make money out of it. AI slop. You might not have time. Too busy. Life happens. You might enjoy walking your dog or doing gardening more. Or perhaps you just don't know how! Or you don't feel experienced enough (imposter syndrome). Perhaps you don't think your English is good enough (he advocates just using Google Translate).
(He asked how many people had already contributed to open source: about half the room raised their hands.)
There are actually lots of ways to contribute. It is not all code! Read this page for some examples. You can report security vulnerabilities or issues. You can comment on issues and help getting them forward. Review pull requests. Extend the documentation. You can join discussions in forums or on Matrix. Write a blog post on a project. And... you can financially sponsor a project.
(He again asked who had contributed: now most hands went up!)
Where to start? Start with what you use and what you find interesting. This helps staying involved and getting into the community more and more. He himself liked web applications and especially forms: making sure they're intuitive and safe and well-validated. And he liked documentation, so some of his first contributions were documentation fixes for open source projects.
Recently, he volunteered to take over maintainership of an open source project (a sphinx extension). There were lots of open pull requests and he asked the owners to look at it again and perhaps tweak it a bit and... everybody responded and a few weeks later he could make a new release with lots of fixes.
What is a maintainer? Well, basically maintainers are contributors who make releases. But ideally you also have to "tend your garden" and try to get your small community to thrive. One thing to keep in mind: you have to put your ego aside. If it is open source, it is really owned by your users, not by you. What do you have to do? Show up when someone has a question. Document your project (how to contribute, how to report bugs and security issues, etc.).
He especially mentioned https://djangonaut.space , that's a great initiative to help people get involved with contributing. Same with https://djangogirls.org/ .
As a maintainer, you might also have to look for funding. There are options like "github sponsors". But also NLnet (from the Netherlands) and the German sovereign tech agency that sponsor lots of projects.
A best practice of good maintainers is to have good tooling. Automatic tests + coverage. Build documentation. Formatting checks. zest.releaser for good releases.
The most important part of being a maintainer: how do you treat people.
There's one big problem: AI. There are just too many pull requests and too many issues. You can never get through them if your project is reasonably project. Dealing with it is hard. Several projects made the choice to disallow AI contributions. Also read https://leidendeclaration.ai/ , for the same problems are entering math and science, too.
But on the other hand... in the icalendar project that he helps maintain, they got a new contributor that made his first contribution based on AI. He liked that: the person got enough confidence through AI. They now have an AI guideline in their contributor guide now.
There's are automated tools on github that can help you check pull requests and identify slop-generating accounts, for instance. A tip when confronted with suspected AI work: ask vague, clarifying questions. Just ask for a bit of clarification in a vague way: AIs can't respond to vague questions, but humans can.
"Once men turned their thinking over to machines in the hope that this would set them free. But that only permitted other men with machines to enslave them." - Frank Herbert, Dune. Funny that he could write that 50 years ago.
Something mentioned in the discussion: people are now bidding on real github accounts in order to let AI bots use accounts that appear real...
Watch out with AI. One of the links he shared: https://pivot-to-ai.com/2026/09/08/students-who-dont-use-ai-are-ahead-on-every-measure/ . And, look at the kids: it was bad enough with social media, but AI is much worse. And freelancers are getting buried with soulless AI slop cleanup: artists get to clean up AI-generated images, for instance.
Choose wisely. A quote he wanted to give us to think about: teach the world you want.
Monitoring my washing machine - Michiel Beijen
Michiel has a 2021 Samsung washing machine that plays Die Forelle by Schubert when it is finished washing... But the washing machine sits in the garage so he can't hear the sound. It is a smart machine, so there's an iphone app for that! "SmartThings". But the list of data it wants to collect about you is horrendeous. And the app is almost 1GB! No...
There's also "home assistant", written in python. There's even a SmartThings API connection. But... from October 2026 onwards you need a $5/month samsung subscription!?!
There's also "Matter". They call it vendor neutral, standards compliant. Samsung supports it. But only for connecting Matter devices to SmartThings, not the other way around.
Next try: put a small camera in front of the washing machine's display, add a bit of OCR text recognition to detect the remaining time from the image and add an http interface to it. An old webcam couldn't provide a good camera. A raspberry Pi Camera 3 did the trick. (He later thought it would perhaps have been better to pick some old smartphone.)
He showed some graphs detailing how the washing machine estimates the time it will finish, including the adjustments it made halfway (adjusting for load or so).
Another approach that a colleague of him took: use a monitoring plug that measures the electricity used. Once the electricity usage drops off, the wash is finished.
17 Sep 2026 4:00am GMT
16 Sep 2026
Django community aggregator: Community blog posts
Django: serve the change password well-known URL
When a password manager detects that a user's password has been leaked or reused, it can prompt them to change it, but the password change URL varies by site. The web's answer to such discovery problems is the reserved /.well-known/ URL namespace (RFC 8615), home to machine-readable files and endpoints like security.txt. A Well-Known URL for Changing Passwords is the web specification that uses this namespace to fix password page discovery. It reserves the URL path /.well-known/change-password to redirect to your actual change password page, wherever that lives.
Password managers that use this URL include Apple's iCloud Keychain (in Safari since 2019), Google Password Manager (since Chrome 86, 2020), and 1Password. web.dev has an excellent article explaining the specification and showing the Google Password Manager feature in action.
In this post, we'll look at implementing the change password URL in a Django project.
Add the redirect
The specification asks that /.well-known/change-password redirect to your change password page with a temporary redirect status code, for which you can use Django's RedirectView. The pattern_name argument looks up the target URL by name, so the redirect stays correct even if you move the page.
So, to add a redirect, plop this path in your root URLconf:
from django.urls import path
from django.views.generic import RedirectView
urlpatterns = [
# ...
path(
".well-known/change-password",
RedirectView.as_view(pattern_name="password_change"),
),
# ...
]
Note the path has no trailing slash, per the specification and counter to Django's default pattern. There's also no need for a name= argument, since nothing on your site should link to the URL.
password_change is the URL name provided by django.contrib.auth.urls, which serves Django's built-in PasswordChangeView. This assumes your URLconf includes those URLs, conventionally mounted at accounts/:
path("accounts/", include("django.contrib.auth.urls")),
If you serve your change password page some other way, swap in the appropriate URL name for pattern_name, such as account_change_password if you use django-allauth. Django doesn't check pattern_name until a request arrives, so a wrong name here fails only when the URL is visited, hence the test below.
Check with runserver and visit http://localhost:8000/.well-known/change-password - you should land on your change password page (or the login page redirecting you there with ?next).
Password managers only ever visit the URL on your live site (with HTTPS), so after deploying, repeat the check on your production domain.
For an end-to-end check, Chrome's password checkup tool (under Settings โ Passwords) shows a "Change password" button for compromised entries, which should open your page directly once the redirect is deployed. To make the button appear without waiting for a real breach, temporarily change your saved password for the site to a deliberately weak one, like password123, which Chrome flags in the check.
Public users only
By the way, this feature is for public users and their password change pages, not admins. So don't use this feature to redirect to your Django admin's password change view, or any other private page. That would advertise those URLs to the world, undoing the common hardening of hosting Django's admin at a non-default path.
Check the resource that should not exist
There's a second URL to be aware of, a check for whether your server is broken. Some misconfigured servers respond with 200 to every request, serving an error page instead of using a proper 404 status code. On such a server, a client fetching /.well-known/change-password can't tell whether it found a real change password page or an error page.
The specification solves this with a second reserved path, gloriously named:
/.well-known/resource-that-should-not-exist-whose-status-code-should-not-be-200
Clients may request this URL to detect broken servers. If it responds with a 200, the server's status codes are deemed meaningless, so the client ignores the change password URL and falls back to something cruder, like opening your homepage.
Django responds with a 404 for unmatched URLs, so your site should pass this check, with nothing to implement. But a catch-all URL pattern could break it, such as one serving pages from a CMS, or a single-page application fallback that serves index.html with a 200 for any path. So it's worth covering with a test, included below.
Add tests
As ever, it's best to include tests to guard against accidental breakage, such as removal of the URL. Here's a test case covering both URLs:
from http import HTTPStatus
from django.test import SimpleTestCase
from django.urls import resolve
class ChangePasswordWellKnownTests(SimpleTestCase):
"""
Test the well-known URLs for changing passwords, per:
https://adamj.eu/tech/2026/09/16/django-change-password-url/
"""
def test_change_password(self):
response = self.client.get("/.well-known/change-password")
self.assertRedirects(
response,
"/accounts/password_change/",
fetch_redirect_response=False,
)
resolve(response["Location"]) # Check it's a real URL
def test_resource_that_should_not_exist(self):
response = self.client.get(
"/.well-known/resource-that-should-not-exist-whose-status-code-should-not-be-200"
)
self.assertEqual(response.status_code, HTTPStatus.NOT_FOUND)
Notes:
- Neither view uses the database, so the test case uses
SimpleTestCase, which blocks database access and runs a little faster. assertRedirectschecks both the status code, 302 by default, and the target URL.- The target URL is hardcoded, matching where the auth URLs were mounted earlier. If yours live elsewhere, adjust it. Hardcoding, rather than using
reverse(), makes the test check what clients see, rather than using any internal details of your system. - Passing
fetch_redirect_response=Falsestops the test client from following the redirect. Without it,assertRedirectswould fetch the change password page and fail, because when logged out that page responds with a second redirect, to the login page. resolve()raisesResolver404if the target URL doesn't map to a view. Calling it makes up for the skipped fetch above, checking that the redirect points at a real page rather than a typo.
Check your form's autocomplete attributes
The web.dev article also recommends annotating your change password form fields with autocomplete attributes, so password managers can fill in the current password and suggest a generated replacement:
autocomplete="current-password"on the current password fieldautocomplete="new-password"on the new password field(s)
If you use Django's built-in PasswordChangeForm, it's done for you, as the widgets there have included these attributes since Django 3.0.
But if you've built a custom form, it's worth checking that its fields carry the right attributes. You can set them through the attrs argument of each field's widget, for example:
from django import forms
class ChangePasswordForm(forms.Form):
current_password = forms.CharField(
widget=forms.PasswordInput(attrs={"autocomplete": "current-password"}),
)
new_password = forms.CharField(
widget=forms.PasswordInput(attrs={"autocomplete": "new-password"}),
)
...
If you're customizing Django's flow, prefer subclassing PasswordChangeForm, which carries those attributes already.
Fin
So there we go, a nice little standard to make your user's security a little easier. Add one URL entry and password managers can shepherd your users away from compromised passwords.
May your data never leak and your users passwords always be strong,
-Adam
16 Sep 2026 4:00am GMT
15 Sep 2026
Django community aggregator: Community blog posts
Duff's device, part 2: copying within an array
Duff's device in JavaScript raced hand-written loops that copy one array into another. A reader asked the follow-up: how do they compare with Array#copyWithin, the built-in that copies a range inside a single array? That is a different workload, so it needs its own measurement. The short answer: on every Node and Deno we can install today, the built-in runs 47 to 84 times slower than the loop.

15 Sep 2026 10:00am GMT
Django: introducing django-mcpz, for making MCP servers
I made another package! Say hello to django-mcpz, for building Model Context Protocol (MCP) servers in your Django project.
The package tagline is easy peasy MCP servers in Django.
MCP, the place to be?
MCP specifies a way for LLMs to interact with external data sources. MCP servers can expose a set of tools, which are essentially functions that an LLM can call on behalf of a user. So, for example, a user can ask "where's my pizza at?" and the LLM can call one or more tools on your pizza shop server to navigate your data and return the answer. Users can ask questions in natural language, and LLMs can interpret messy data in your system to return a clean, hopefully-correct answer.
MCP is date-versioned, and the latest version, 2026-07-28, made the protocol much simpler by making it stateless, like ye olde HTTP APIs. There's no longer an initialization handshake, no session ID, and no streaming event stream. Each request is a plain HTTP POST with a JSON body that gets one JSON response, like any other HTTP API.
This new version is way easier to deploy for a typical synchronous, WSGI Django project. The previous default transport required the server to hold open streaming responses (server-sent events) and track sessions, which would entail a separate ASGI deployment using Channels. Now, you can make an MCP server within a single synchronous Django view and keep it inside your normal WSGI deployment, no extra infrastructure required.
One of my clients wants to deploy an MCP server for their app, and so I took it upon myself to take advantage of this new MCP version and build a ground-up implementation, rather than use the existing ASGI-based packages. The goal was to make it "easy peasy" to build an MCP server in your Django project, and so I named it django-mcpz ("pz" read in the American way is "pea-zee", as in "easy peasy") (or maybe I should stick to calling it "pea-zed"?).
django-mcpz targets the latest MCP version, 2026-07-28, with its stateless-by-default transport, but it still works with last year's 2025 versions too, which also had a stateless mode. Client support seems widespread, and anyway, this is an ecosystem that moves fast.
The basics
Here's the example from the README, a server for a shop with one tool that counts orders:
from typing import Literal
import msgspec
from django_mcpz.server import MCPServer
from django_mcpz.bearer_tokens.auth import token_auth
from example.models import Order
server = MCPServer(
name="shop",
version="1.0.0",
instructions="Query the shop's order database.",
auth=token_auth,
)
class CountOrdersParams(msgspec.Struct):
status: Literal["pending", "shipped", "cancelled"] | None = None
class CountOrdersResult(msgspec.Struct):
count: int
@server.tool(
description="Count Order rows, optionally filtered by status.",
read_only=True,
)
def count_orders(request, params: CountOrdersParams) -> CountOrdersResult:
qs = Order.objects.all()
if params.status is not None:
qs = qs.filter(status=params.status)
return CountOrdersResult(count=qs.count())
Some notes:
MCPServerrepresents one server and its registry of tools. It works a bit like Django'sadmin.site: you create one, register things on it, and route it like a plain old view function. Theinstructionsare natural-language guidance for the LLM on how to use the server.- The
authargument is required, since an MCP server exposes your application's internals to network callers. More on that below. server.tool()registers a plain function as a tool. The function receives theHttpRequestfirst, then its parameters, and Django's request/response cycle applies as usual, so it can use the ORM,request.user, and anything else a view can.- Parameters and results are declared as msgspec
Structclasses. django-mcpz generates the tool's JSON Schemas from the type annotations, and validates each call's arguments before the tool runs. Mistyped or unknown arguments are rejected with in-band errors that the calling LLM can read and correct from. msgspec also handles all the JSON serialization and deserialization, via my recently-released django-msgspec, so it's fast. read_only=Truesets one of the specification's tool annotations, hints for client user interfaces about what a tool does. For example, an UI might not prompt for confirmation before calling a read-only tool, but it will for a write tool.
The server is its own view function, so you route it directly in your urls.py:
from django.urls import path
from example.mcp import server
urlpatterns = [
path("mcp", server),
]
And that's all! Deploy as normal, and your MCP server is live at /mcp.
My editor, Zed, has MCP support. I hooked it up to a test project running the above server code and had this brief conversation with an LLM:
## User
count the number of orders in my shop
## Assistant
<thinking>
This "shop" order counting tool has nothing to do with the actual blog project, so it looks like an unrelated test scenario. I'll just go ahead and use the tool as requested.
</thinking>
**Tool Call: Run MCP tool `count_orders`**
Status: Completed
{"count":42}
## Assistant
Your shop has **42 orders** in total.
The LLM detected the "shop" as unrelated to my blog and guessed it was just a test. Well played.
Everything else talking MCP should "just work" too, including Claude Code and Codex.
Authentication
Every server needs an auth callable, which runs before the request body is touched. It receives the request and returns None to allow it, or an HttpResponse to reject it. There's a public callable for servers protected some other way, or that are genuinely public, and you can write your own for, say, an authenticating reverse proxy. But the two common cases are covered by optional apps within django-mcpz.
Developer tools, like Claude Code, Codex, and Cursor, accept a pasted credential in their configuration. For them, there's the django_mcpz.bearer_tokens app, which provides per-client bearer tokens, each acting as a user, and revocable one at a time. Add it to INSTALLED_APPS, run migrate, and pass its token_auth callable to your server, as in the example above. Then create tokens with a management command, which prints the token value once:
$ python manage.py mcpz bearer-tokens create "Claude Code" --user alice
...
โฆor in the admin. Only a hash of each token is stored, like Django does for passwords, so a leaked database dump does not reveal usable credentials.
Hosted assistants, like Claude.ai and ChatGPT, offer no way to enter a header when adding a server. They connect through OAuth: the user clicks "connect", logs in to your site, approves access, and the assistant receives tokens to call your server with. For these assistants, there's the django_mcpz.oauth app, an authorization server built into your project, implementing the MCP authorization specification and the OAuth standards it draws on. Add the app, include its URLs, and pass its oauth_auth callable to your server:
from django.urls import include, path
from example.mcp import server
urlpatterns = [
path("mcp", server),
path("oauth/", include("django_mcpz.oauth.urls")),
path("", include("django_mcpz.oauth.wellknown")),
]
The app reads everything it needs from your URLconf and each request, so there's nothing else to configure. It ships with a consent page, rendered from templates you can override to match your site, and admin pages for managing clients and tokens. To serve both kinds of client from one server, combine the two callables in a few lines, as covered in the docs.
MCPizza
The django-mcpz repository contains an example project that serves a local MCP server for a pizza place called MCPizza (not to be confused with McPizza). It has tools to check today's date, search the menu, place an order, chart today's orders as an image, and link to the menu web page.
The example is intended to show a use case that allows an LLM to make decisions based on freeform text in a database. Each pizza has structured fields the server enforces, such as price and the dates a special runs between, as well as freeform notes that an LLM can act on, such as "Vegan cheese available on request".
Here's an example from the README, using Claude Code to query the server, calling the current_date and search_menu tools:
$ claude --mcp-config mcp.json --strict-mcp-config --allowedTools "mcp__mcpizza__*" \
-p "What vegetarian pizzas could I order tomorrow for under \$12? I'd prefer vegan if they can do it."
For tomorrow (2026-09-04), the vegetarian options under $12 are:
- **Null Pointer** - $6 - plain base, vegan by default (no cheese/toppings)
- **Garlic Bread (Technically a Pizza)** - $5.50 - vegetarian; GF base available, but not noted as vegan-adaptable
- **Margherita of Theseus** - $9.50 - vegetarian, **vegan cheese available on request**
- **The Off-By-One** (mushrooms, olives, red onion) - $10.50 - vegetarian, **vegan cheese available on request**
Since you'd prefer vegan: **Margherita of Theseus** or **The Off-By-One** both work with vegan cheese swapped in, and **Null Pointer** is vegan as-is (though it's just a plain base). Want me to place an order for one of these?
The README also covers querying it with the llm CLI and the official MCP Python SDK. Give it a whirl and inspect the code to learn more!
Future workings
django-mcpz implements MCP Tools (callable functions), since that's what most Django projects need. There are other parts of the protocol that it might gain, depending on demand:
- Elicitations - server-generated questions for users to answer, that can guide your tool to the right data.
- Prompts - text templates to guide LLMs in using your server for particular tasks.
- Resources - API-like data access, for LLMs to query your server's data directly, rather than through tools.
There's no plan at current for django-mcpz to implement streaming events or async support, since the goal for the package is a simpler implementation that fits the typical Django deployment.
Fin
Please try out django-mcpz today and let me know how it goes.
May your MCP be as EZ as 123,
-Adam
15 Sep 2026 4:00am GMT
11 Sep 2026
Django community aggregator: Community blog posts
Issue 354: DjangoCon US Recaps and the Myth of the Well-Structured Project
News
PyCharm & Django Fundraiser Extended to September 14
The second half of our annual JetBrains fundraiser has been extended through September 14, 2026. Thank you to JetBrains for the extra time. You still have time to renew your PyCharm license or give it a try.
Call for volunteers: Fundraising Working Group
The Django Software Foundation is looking for people to join the Fundraising Working Group. This is a particularly interesting time to get involved.
Django Software Foundation
Django Steering Council Meetings - 2026
Notes from the September 7 meeting: packaging related tools as extras, experimental features, usage telemetry, and Fellows pinging the CompositeField and content type parsing DEPs.
Python Software Foundation
Incident Report: File Hosting Errors
Two weeks of intermittent 502s and 503s on files.pythonhosted.org came from a Fastly canary that left one cache node half rolled back, which then exposed three latent bugs in PyPI's own config. The takeaway for the rest of us: turn on dependency caching in CI, which setup-python leaves off by default.
Wagtail CMS News
Prototyping a new CLI for Wagtail
Thibaud Colas is prototyping wagtail-cli, a terminal interface over the v3 API for browsing and publishing pages, managing media, and scaffolding projects, partly so AI agents can reach the CMS without driving a browser. Try it with uv tool install wagtail-cli.
Updates to Django
Today, "Updates to Django" is presented by Raffaella from Djangonaut Space! ๐
Last week we had 15 pull requests merged into Django by 12 different contributors - including 2 first-time contributors! Congratulations to Vimal Sahani and Dave Gaeddert for having their first commits merged into Django - welcome on board!
News in Django 6.1:
- Fixed a regression that caused
__inlookups on annotations to erroneously return empty querysets and__rangelookups to crash when passed an iterator (#37311). - Fixed a regression where custom querysets used with
Prefetchfor forward foreign key or reverse one-to-one relationships were not routed using the parent queryset's database (#37300). - Fixed a regression where an admin changelist search crashed when a
search_fieldsentry used an__exactlookup on a field withchoices, and where any search term matched all rows with aTruevalue when an__exactlookup was used on a BooleanField (#37263).
News in Django 6.2:
- Omitting the
tzinfoargument ofExtractandTruncdatabase functions in migrations whenUSE_TZisTrueis deprecated. Passtzinfoexplicitly to avoid inconsistent behavior ifTIME_ZONEchanges. - Unsaved instances with a composite primary key or a
db_defaultprimary key no longer compare equal to other instances.
Django Fellow Reports
Django Fellow Report - Jacob
An early report for about a day at my desk before heading out for some vacation. Six tickets reviewed, two authored, and the usual misc.
Django Fellow Report - Sarah
Seven tickets reviewed and another seven authored. Fellows sync, engaging with security issues, and website working group meeting.
Django Fellow Report - Natalia
Post-DjangoCon US week (including the emotional low ๐ that comes with it), with most of my time going into two things: first, iterating on a security report until we could confirm the issue, followed by developing a solution for it. I also continued the calendar versioning work around DEP 20 ๐ , including both the Django implementation and the release process updates. And, after iterating on a PR tutorial since Vigo, I finally got to see it through.
Sponsored
Your task ran before the transaction committed.
django-ox is a production worker for Django Tasks that runs on the database you already have: no Celery, no Redis, no broker to babysit. Enqueue is a plain INSERT, so a task commits or rolls back with the data it belongs to. Django 5.2 LTS and 6.x, free, BSD-3. 
Articles
Soft-deprecating re.match()
After 30 years of tripping people up by anchoring at the start of a string but not the end, re.match() is soft-deprecated in Python 3.15 in favor of the clearer re.prefixmatch().
1001 Django apps - The myth of a well-structured Django project
Ronny Vedrilla makes a thoughtful case for fewer Django apps: treating them as database namespaces rather than folders, starting with one domain plus a few "satellite" apps, and using import-linter to enforce the boundaries so they don't just become decoration.
Nifty Django Feature: Q() Objects
Assigning Q() objects to named variables makes filter logic readable and reusable, and passing several into one .filter() call avoids the extra joins you get from chaining.
DjangoCon US Recaps
I Think That Feeling is Called Hope - Rachell Calhoun
Rachell Calhoun's DjangoCon US recap comes from inside the machinery: a third year chairing volunteers alongside Monica Oyugi, the first time all five Djangonaut Space founders stood in the same room, and open spaces on contributing to Django and on music. It ends on the case for volunteering, which she calls the fastest way she knows to stop feeling like a stranger at a conference.
TSBT73: Pumpkin Spice Bytes - Velda Kiara
Velda Kiara's update on DjangoCon US and related tech discoveries.
The Community Behind Django: My First DjangoCon US Recap and Highlights - Seyram Theresa
Theresa's very in-depth recap of DjangoCon US, from talks and keynotes to lightning talks, hallway convos, Chicago adventures, and more.
DjangoCon US 2026 | Chicago - Jon Gould
Recruiter Jon Gould's fourth DjangoCon, from the sponsor side of the table. His favorite parts were the unscheduled ones, like Aman Singh's early morning walks to the Bean.
Your City Is a Spatial Database and Nobody Told You - Jason Judkins
Jason Judkins's recap of a specific talk at DjangoCon US the other week, by Drishti Jain, highlighting how important shapes and GeoDjango are in the real world.
Django Job Board
Two construction-AI roles at Provision and a backend seat on the platform that runs a family-owned cruise agency.
๐ Machine Learning Engineer (Hybrid) at Provision
Django Developer at The Cruise Brothers
Full Stack Software Engineer (Hybrid) at Provision
Projects
gettranslatebot/translatebot-django
Translates .po files and model fields with an LLM, but only the new and changed strings, using a TRANSLATING.md glossary in your repo to keep terminology consistent between runs. Placeholders and HTML tags survive intact.
lincolnloop/django-absurd
Plugs Absurd, a Postgres-native workflow engine, into Django's Tasks framework so background tasks and durable workflows run on the database connection you already have. Needs Django 6.0+ and psycopg 3.
11 Sep 2026 3:00pm GMT
09 Sep 2026
Django community aggregator: Community blog posts
Weeknotes (2026 week 37)
Weeknotes (2026 week 37)
Tonight the temperature will drop to 10ยฐC. I like it when it's hot, but now I really enjoy the slightly cooler temperatures in Europe. The last post was written in the middle of the heat wave. Yesterday we still had temperatures of over 30ยฐC, which is a lot for September. But it will be the new normal. Next year probably won't be cooler.
Releases from the last four weeks
Lots of activity!
django-authlib
django-authlib 0.19 hardens the OAuth2 implementation a bit against replay attacks, provides utilities for removing password logins from the Django administration interface, and removes some of the confusion around role-based permissions. Upgrading is recommended.
django-content-editor
django-content-editor 9.0.2 fixes a bug in the function which allows cloning plugins from other regions. The bug was most visible when using something like django-json-schema-editor's plugins which are only proxy models. Their type was lost because I was using _base_manager, which didn't do the downcasting properly. (Sorry for the word salad.)
django-tree-queries
django-tree-queries 0.26.1 now uses annotations instead of .extra() to add the tree_path and tree_depth fields. This is great because the ORM knows these fields properly and we can now use e.g. .filter(tree_depth=1) instead of .extra(where=["..."]).
This change was mainly motivated by the renewed interest in deprecating .extra() at some unknown future point in time.
django-debug-toolbar
django-debug-toolbar 8.0 ships a new design! I again didn't contribute a lot, but I'm very proud that we were able to ship this as a team.
feincms3
feincms3 6.0.2 ships new utilities and, most importantly, fixes crashes when passing %00 to the root middleware. Using null bytes when comparing text field values on PostgreSQL leads to crashes. These are mostly an annoyance without data exposure, but definitely worth fixing.
The reason for the major version bump is that we finally dropped support for Django 3.2. That's the only breaking change, so upgrading should be easy for everyone.
django-js-asset
django-js-asset 4.1 fixes issues around lazy CSP nonce handling as well as the same issue Django itself had around rendering HTML-safe strings.
django-prose-editor
django-prose-editor 0.27.2 adds a default menu item for the code block extension and updates ProseMirror and Tiptap. It also adapts to the changed CSS of the Django 6.1 administration interface.
django-json-schema-editor
django-json-schema-editor 0.14.1 includes a fix for saving JSON schema fields when the schema doesn't contain any properties, plus fixes for the Django 6.1 admin CSS.
django-admin-ordering
django-admin-ordering 0.21 now activates orderables properly when the same model was orderable both in the change list and in the change form. I developed the fix for this in early 2025 but never released it. It's what happens.
feincms3-cookiecontrol
feincms3-cookiecontrol 1.7.2 includes bugfixes for edge cases while bringing down the byte count for the cookie banner and media embedding script from 3961 (in 1.7.1) to 3909 bytes.
feincms3-data
feincms3-data 0.11.1 brings fixes for handling unique fields when the same unique value is removed and then re-added with a different primary key.
django-translated-fields
django-translated-fields 0.14 contains no relevant code changes to the module itself at all. It was just time to release a new version more than two years after the last release to show that the project is still active and update the Trove classifiers.
09 Sep 2026 5:00pm GMT
08 Sep 2026
Django community aggregator: Community blog posts
Coding tactics: the series
Over the summer I published a series on coding tactics: the everyday craft of ifs, loops, and the reasoning behind them. Eight posts, one thesis, best read in order. This is the map.

08 Sep 2026 10:00am GMT
04 Sep 2026
Django community aggregator: Community blog posts
Issue 353: DjangoCon US Recaps Galore!
News
Django Developers Survey 2026 results
The fifth annual survey run with JetBrains is out, with the full report, infographics, and a companion writeup titled "The State of Django 2026: Boring is so back."
Help test Python 3.15!
Python release manager Hugo van Kemende kindly requests you add 3.15 and allow-prereleases: true to your GitHub Actions matrix and publish wheels before the October 1 release.
Releases
Django bugfix release issued: 6.1.1
Twelve fixes, nearly all of them 6.1 regressions: admin changelist search crashes, ModelAdmin.list_display traversing multiple relations, __in returning empty querysets, and DecimalField without precision on SQLite.
Python 3.15.0 candidate 2 is here!
The last planned release candidate, carrying 144 bugfixes from 76 contributors since rc1, ahead of the October 1 final.
Django Software Foundation
DEP 0019: Technical Governance for Django
Now accepted, DEP 19 supersedes DEP 10 and DEP 12 as Django's single technical governance document, and trades hard eligibility rules for eight qualitative traits that Steering Council candidates should show three or more of. The five-member council keeps binding authority over technical decisions, with elections triggered by the final feature release of a major release series, a drop below three elected members, or a council vote.
DSF member of the month - Benjamin Balder Bach
The django-money maintainer and Django Day Copenhagen organizer on closing the distance between developers and the people who use what they build.
Djangonaut Space News
Djangonaut Space - Session 7 Accepting Applications
Applications for the eight-week mentorship program close September 6 Anywhere on Earth, with the session starting October 12.
Python Software Foundation
The 2026 PSF Board Election is Open!
Eligible members can approve up to 17 candidates for four open seats, and ballots cannot be changed once cast, so read the nominee statements before voting closes September 15 at 2:00 pm UTC.
Inaugural Python Packaging Council Election: Voting is now open!
The first Packaging Council election is open to members who affirmed their intent to vote, and closes at the same September 15 deadline.
Metadata requests no longer tracked in PyPI download counts
PyPI now counts only .whl, .tar.gz, and .zip requests, so BigQuery data breaks permanently at 2026-08-24: about 39% of urllib3's earlier counts turned out to be metadata and other non-distribution files.
Wagtail CMS News
Our DjangoConUS 2026 photo album ๐ท
Meagen Voss shares photos from Chicago rather than a talk recap, including her first main-stage talk on Wagtail's approach to AI.
Updates to Django
Today, "Updates to Django" is presented by Raffaella from Djangonaut Space! ๐
Last week we had 5 pull requests merged into Django by 5 different contributors - including 2 first-time contributors! Congratulations to Iaroslav and Tyler Russin for having their first commits merged into Django - welcome on board!
News in Django 6.1:
- As default model ordering is now applied to combined querysets,
union(),difference(), andintersection()raiseDatabaseErrorwhen a field inOptions.orderingisn't selected byvalues()orvalues_list(). Callorder_by()without arguments before combining to clear the default ordering.
- Fixed a bug where
DecimalFieldwithoutmax_digitsanddecimal_placescaused a crash when retrieving values on SQLite (#37275).
- Fixed a regression that caused a crash when iterating a
QuerySetof a model overridingModel.from_db()without the newfetch_modekeyword argument. Such overrides now work again, but are deprecated and should be updated to acceptfetch_mode(#37259).
Playwright is replacing Selenium for integration tests ๐
Django Fellow Reports
Django Fellow Report - Jacob
I had a rejuvenating week attending, presenting at, and sprinting during DjangoCon US. I'm still relatively new to this community, so I'm still allowed to be impressed with everyone's gracious and welcoming attitudes. A smattering of things falling under the usual categories this week.
Django Fellow Report - Sarah
Was in Chicago (๐ฌ๏ธ ๐๏ธ ๐ญ ๐บ๐ธ) for DjangoCon US ๐. It was a fantastic conference and a lovely city. Delivered a keynote which went "good enough" and my baby boy managed with the jetlag reasonably well ๐. Came away from the conference with a few ideas and energy from engaging with our community
Django Fellow Report - Natalia
A week of holidays ๐๏ธ ๐ก ๐ฆ followed by a week of DjangoCon US! ๐ โ๏ธ ๐ฅ ๐ค
Sponsored

Until September 10, receive 30% off all new or renewal licenses, with 100% of the proceeds going directly to the Django Software Foundation.
Articles
Why We Started Building on the Django 6.1 Alpha
Divio started building on Django 6.1 at the first alpha, months before the August release. Here's why they picked the pre-release and what they found while testing it every day.
A Dolly Parton Developer
Following Rikki Endsley's "Willie Nelson developer," Trey Hunner makes the case for Dolly Parton as the model: know your rights (she refused to hand over publishing on "I Will Always Love You" when Elvis's team demanded half), exit with grace (she paid Porter Wagoner $1 million to leave his show and kept the friendship), and write the next one. She recorded close to 1,000 songs and wrote thousands more, which is a better target than being a rockstar.
Store lists in a single Django column without joins?
After a decade of development, version 1.0.0 of django-select-multiple-field is here, bringing full support for modern Python and Django versions to store multiple choices in a single database column without extra join tables.
Make Your Django Application Editable
The CMS doesn't need to own your data to make it editable.
htmx and Django LiveView, side by side
Seven worked cases showing where stateless htmx requests and LiveView's persistent WebSocket diverge, with the conclusion that they are complementary rather than interchangeable.
Nifty Django Feature: Use Index for Custom Migration Operations
Override create_sql() and remove_sql() on a models.Index subclass and arbitrary table-level SQL rides along in Meta.indexes, managed by migrations for free.
Django and deployments
A proposed manage.py deploy namespace of lower-level commands that start by printing their expected inputs and outputs, leaving the actual automation to packages and plugins.
Agents All the Way Down
The annotated script of Josh Thomas's DjangoCon US talk on how AI coding agents changed the way he writes Django, written to land for skeptics and true believers alike.
Postgres 19: How Our Advice Has Changed Since...
JIT is off by default, LZ4 replaces pglz for TOAST, and async I/O means the old "an index always beats a parallel sequential scan" assumption is worth re-testing.
"Premature" optimization
The full Knuth quote licenses optimizing the critical 3%, and dropping "small" from "small efficiencies" turned it into a blanket excuse to skip the design work that is cheapest to do up front.
DjangoCon US Recaps
Yes, a standalone category since so many posts on it this week!
DjangoCon US 2026 Recap - Jonathan Peacher
Jonathan Peacher's notes on attending the conference this year in Chicago, highlighting various talks and projects.
My Time at DjangoCon US 2026 - Jason Judkins
Jason Judkins transcribed the talks so he could go back over them, and this recap is the trailer for a longer per-talk series. He picks out a theme running through Paolo Melchiorre's UUID history, Drishti Jain's GeoDjango talk, and Abigail Gbadago's polyglot persistence talk: push the work down a layer, because the database usually knows how to do it better than you do. AI turned up in nearly every talk, with almost nobody uncritical about it.
DjangoCon US 2026 Recap - Tim Schilling
Tim Schilling's fifth DjangoCon, spent chairing sprints with Kudzayi Bamhare, working on Django Simple Deploy with Colin Copeland, and meeting Djangonaut Space members in person for the first time.
My DjangoCon US 2026 - Paolo Melchiorre
Paolo Melchiorre on giving "The Django UUID Story," staffing the DSF booth, and fielding questions at the DSF members open space.
DjangoCon US 2026 - Dwayne McDaniel
Dwayne McDaniel's recap runs talk by talk: Karen Tracey on Django 6's background tasks, CSP support, and template partials, Natalia Bidart on keeping templates the source of truth with HTMX, and Elizabeth Christensen on UUIDv7, graph queries, and OAuth 2.0 in PostgreSQL 18 and 19. His through line is that frameworks, databases, and browsers keep absorbing work that used to need extra layers, with Kasey Kelly's 16,000-line AI-generated frontend file as the cautionary case.
Events
Django On the Med
September 23, 2026 in Pescara, Italy ๐ฎ๐น.
Django Day Copenhagen 2026
October 2, 2026 in Copenhagen ๐ฉ๐ฐ.
Django Job Board
Two new listings this week, plus the DSF still looking for its first Executive Director.
Machine Learning Engineer (Hybrid) at Provision ๐
Django Developer at The Cruise Brothers ๐
Full Stack Software Engineer (Hybrid) at Provision
Executive Director at Django Software Foundation
AI-Assisted Software Engineer, Web Applications at Logical Media Group
Projects
django-danceschool/django-danceschool
Django CMS project with comprehensive features for running a partnered social dance school.
p-r-a-v-i-n/django-fast-multipart
An experimental Rust-backed multipart parser that plugs into Django's parser extension point, so upload handlers, request limits, request.POST, and request.FILES all keep working as they do now. Requires CPython 3.12 or later and Django 6.1, with prebuilt wheels for Linux, macOS, and Windows.
04 Sep 2026 3:00pm GMT
02 Sep 2026
Django community aggregator: Community blog posts
Django and deployments
I have been pondering the wider deployment space in Django for a while and from various angles. This includes my released package django-prodserver but also wondering if the DSF could provide hosting as a small scale commercial operation or what via alternatives I could offer in hosting for Django specifically. Then also I have considered what the wider API in Django could be for deployments.
These thoughts come at a good time, Will Vincent has done two talks on deploying python projects this year and I think his talks would serve as a great theoretical starting point to ensure we cover 90% of what is required. Then after DjangoCon US last week, Paolo made toot suggesting it's time for a deploy command. That toot triggered two things, first a memory of the chats I had in Athens this year and DjangoCon Europe and that I had been meaning to write about this topic for a while.
First let's consider the high level conceptual stages when deploying a project:
- Prepare the overall environment - signing up for an account, creating a project or just booting up a VPS
- Prepare Django and it's settings - these are changes made to the project repository
- Get the Django project from source control to the environment
- Do the first time setup - ideally this would be idempotent.
- Start the production process
- Doing a second deployment - because code always changes and then repeat step 5.
From this list, I think a single managed.py deploy might be too much magical to begin with, but I do think it's possible eventually. I'm thinking it's more likely deploy to be a command that stitches together several lower level commands and each of those commands correspond to a step in the above list. So we could have something like:
manage.py init_deploy_envmanage.py productionizemanage.py deploy_project --firstmanage.py initialize --productionmanage.py prodserver webandmanage.py workermanage.py deploy_project
A couple of very important points, first those names are simply examples for this post to communicate the idea and perhaps it would be best to have them all within a namespace of deploy, so manage.py deploy productionize etc.
Second and most importantly, I am very aware of the numerous possible combinations that exist when it comes to how a project can be deployed today and I am very much NOT suggesting Django support any of them. What I am suggesting is that we focus on the common API inside Django and we have packages and plugins like Eric has with django-simple-deploy. My approach here would be create an API that explicitly does nothing but simply prints expected inputs and outputs from each step. We can then start to automate the parts worth automating in a package, which may get us to a single deploy command.
Let me know your thoughts! As the maintainer of django-prodserver I have a vested interest in this space! :D
PS It's worth noting that there have been years of packages that have done similar things and we should use as reference, django-production is one such package or dj-lite for sqlite configuration in production.
02 Sep 2026 5:00am GMT
01 Sep 2026
Django community aggregator: Community blog posts
"Premature" optimization
"Premature optimization is the root of all evil" - our field's favorite half-sentence, quoted far more often than the sentence it was cut from. Usually it serves as permission: build it fast, profile later, fix a thing or two, done. Let's put the sentence back together and ask what it licenses: when is optimization premature, and when is "premature" the excuse?

01 Sep 2026 10:00am GMT
28 Aug 2026
Django community aggregator: Community blog posts
Issue 352: PyCharm & Django Fall Fundraiser
News
PyCharm & Django Fall Fundraiser

Buy or renew an annual PyCharm Professional license through the campaign link and you get 30% off while JetBrains donates a matching amount to the DSF, which is working to close the gap between the roughly $300,000 it raises each year and the $500,000 that would make a full-time Executive Director sustainable. The campaign runs through September 10, 2026, so buy or renew before then. A renewal adds 12 months to your existing subscription.
Django Software Foundation
DEP 0020: Annual Release Cycle
Django moves to one feature release each January under YYYY.N calendar versioning, starting with 2028.0 in place of what would have been 7.0. Every release now gets a year of mainstream support and two years of security fixes, which retires the LTS label.
The Block and Tackle of Django's Code of Conduct Working Group
The machinery behind Django's move to Contributor Covenant 3.0: a 30-day public comment period enforced by a GitHub workflow, CODEOWNERS gating changes to the CoC text, and an automated decision changelog. The working group is releasing its case-tracking templates under CC BY 3.0 for other projects to adopt.
Python Software Foundation
RISC-V is now officially supported by CPython!
CPython now supports RISC-V at tier 3, the entry level for new platforms, which means the open instruction set architecture gets ongoing testing on real hardware through buildbots donated by the RISE Project. Stan Ulbrych led the work with Ludovic Henry, Furkan Onder, and Emma Smith, backed by a Sovereign Tech Agency fellowship.
Wagtail CMS News
Wagtail 8.0
A read-and-write v3 REST API, custom base page models, a global permission policy registry, and formalized Django 6.1 support. Two smaller wins: StreamField block IDs are now available as template context variables, and AVIF and WebP images are no longer converted to PNG by default.
Wagtail security releases: 7.0.9, 7.3.4, and 7.4.3
7.0.9, 7.3.4, and 7.4.3 carry the same five fixes as 8.0: permission handling in the Pages, Documents, Images, and translation APIs, document identification by SHA1, and snippet copying. Upgrade to the patch release matching your version.
Streamlining content ops with LLMs: Wagtail user guide
Google Summer of Code contributor Raghad Dahi rebuilt the user guide site, retiring a versioning scheme that made editors duplicate the whole site per release in favor of blocks readers can filter by version. For translations, an evaluation suite scored LLM providers on cost and quality before settling on DeepSeek V4 Flash, now covering 52 languages plus right-to-left support.
CMS with AI, not AI CMS: Wagtail 8.0's new API
The thinking behind that API: rather than bolting AI buttons onto the admin, Wagtail exposes 50+ admin operations with OpenAPI docs and Markdown rich text, drivable from curl, a script, or an MCP implementation. Worked examples include fixing SEO descriptions with an LLM and a generic content importer in about 100 lines.
Django Fellow Reports
Django Fellow Report - Jacob
Jacob Tyler Walls filed an early report before heading to DjangoCon US, with his usual prolificacy triaging three tickets, reviewing nine, and authoring seven. In addition, engaged with regular security reports and provided 1-1 mentoring to his GSoC mentee, Pravin.
Editors Note
All 3 Fellows are at DjangoCon US this week, so no formal report from Sarah or Natalia. All 3 also gave excellent talks that we will link to when the videos are available later this year.
Articles
Fuzzy String Matching in Django and PostgreSQL
Four ways to match misspelled and variant names, with the trade-offs spelled out. It expands on the author's DjangoCon US 2026 talk on search-as-you-type across 54 million names.
Modern Django Deployments in 2026: My DjangoCon US 2026 Conference Talk
The slides and notes from Will Vincent's recent talk on deployments.
Nifty Django Feature: Third-Party Packages
A helpful overview of Django's third-party package ecosystem, where to look, and how to apply it in your Django projects.
When Python is Too Slow
An opinionated guide on where to turn when Python feels too slow in your application (the answer isn't always switch to Rust).
The Move to Python 3 Begins!
CCP is moving EVE Online's 2.4 million lines of Python off Stackless Python 2.7, in place since 2010, with the first changes deployed on August 25. Stage one leans on automated tools to make the code compile under both versions: 95.9% of roughly 20,000 files already do, leaving about 3,300 blocking lines (1,500 print statements, 800 long literals like 123L, 600 old-style except clauses) and another 20,000 lines that compile but behave differently and need a human to look at each one.
Core Dispatch #10
A roundup of CPython development from August 5 to 27: Python 3.12.14, 3.11.16, and 3.10.21 shipped on the 12th, 3.15.0 release candidate 2 is due September 1, and six PEPs moved, including PEP 805 on safe parallel execution and PEP 833 reaching Final for the simple repository API. Most of the discussion energy went to the competing module export proposals in PEPs 842, 843, and 844.
Events
DjangoCon Europe 2027 in Austria!
Five days of Django, Python, and community in Innsbruck, Austria, February 17-21, 2027.
DjangoCon US 2027 in Riverside, California
Join us for five days of inspiration, education, and networking at the Riverside Convention Center in beautiful Riverside, California, September 13-17, 2027.
Call for Organizers: DjangoCon US 2027
That Riverside conference needs people to run it, and more than 15 committees are recruiting, from program and sponsorship to Code of Conduct, A/V, website, and sprints. Leadership roles carry the heaviest load, with weekly check-ins and monthly board reports, but most positions do not require previous organizing experience: email hello@djangocon.us to volunteer.
Django Forum
Public thanks to our 3 Fellows
A short forum thread appreciating Django's Fellows.
Podcasts
Django Chat #205: Django Developers Survey 2026
A special summer episode on the just-released 2026 Django Developers Survey, working through what it says about Django 6.1, HTMX, async, AI, deployment, testing, and Python tooling.
Django Job Board
Two foundation roles anchor the board this week, with the DSF hiring its first Executive Director and the PSF looking for a Security Developer, alongside two full stack engineering openings.
Full Stack Software Engineer (Hybrid) at Provision
Executive Director at Django Software Foundation
AI-Assisted Software Engineer, Web Applications at Logical Media Group
Security Developer at Python Software Foundation
Projects
15r10nk/matchify
Converts eligible if/elif/else chains into Python 3.10+ match statements, preserving runtime behavior and source formatting, including isinstance checks that become class patterns with attributes.
matiasb/django-tasks-fennel
A Django Tasks backend which uses Celery as its underlying queue. Mentioned as part of the author's talk at DjangoCon US this week: Teach Django Tasks to speak Celery: Building a Celery backend for Django Tasks.
28 Aug 2026 3:00pm GMT

