30 Oct 2026

feedDjango community aggregator: Community blog posts

Issue 361: DjangoCon Europe and DjangoCon US 2026 Videos Are Out

News

Python 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18 are out

A second round of expedited security releases, five days after the last: the ssl module now blocks the compromised eMudhra intermediate CA keys outright, so pip is protected even before you upgrade it. They also fix a tarfile.tar_filter bypass using links that replace the destination and reject negative-version cookies in http.cookiejar.

Announcing PSF Community Service Award Recipients!

Five new Community Service Awards go to Abhijeet Mote, Elena Williams, Hugo van Kemenade, Kevin Horn, and Sarah Abderemane. Two are familiar Django names: Elena organized the second Django Girls event ever held and now sits on Django's Code of Conduct committee, and Sarah co-founded Djangonaut Space, maintains djangoproject.com, and served as DSF Vice President in 2025.

Django Software Foundation

Natalia Bidart - Planned short-term leave

After more than three years as a Django Fellow, Natalia is taking November through January off to rest and recover, with the other Fellows and Django's teams and working groups covering in the meantime. She returns in February, ready to serve as release manager for Django 2028.

Python Software Foundation

Higher limits for organization projects

Projects owned by a PyPI organization now get 200 MB per file and 20 GB per project, double the personal limits, with nothing to turn on. Move a project out of the organization and it drops back, though any increase support already granted stays in place.

PyPI now limits versions to 128 characters

New uploads need a normalized version of 128 characters or less. Only 2 of PyPI's roughly 9.9 million releases are that long, existing releases are untouched, and pip and uv need no changes.

Wagtail CMS News

A Wagtail demo in your browser

Thibaud Colas's bakerydemo-webassembly runs Django, Wagtail, and the whole demo site in your browser with Pyodide, saving data to IndexedDB so nothing leaves your device. Log in at /admin/ with admin / changeme: it's a sandbox for learning and demos, not production.

Wagtail and the eMudhra CA key compromise

Wagtail makes outbound HTTPS calls through requests, which trusts certifi's bundled certificates rather than your operating system's, so an OS update alone won't stop it trusting eMudhra. Jake Howard covers what to upgrade, and if you deploy in containers, a rebuild picks up the patched base images.

Updates to Django

Today, "Updates to Django" is presented by Hwayoung from Djangonaut Space! 🚀

Last week we had 21 pull requests merged into Django by 13 different contributors - including 4 first-time contributors! Congratulations to gerry132, Helmi Lakhder, Aman Kumar Jain and Sanskar Kharya for having their first commits merged into Django - welcome on board!

News in Django:

Django Fellow Reports

Django Fellow Report - Jacob

Jacob spent much of the week on security patches but still merged initial support for the HTTP QUERY method and approved Sarah's final tweaks to multiline template tags. He also marked a FETCH_PEERS bug that can overwrite deferred-field changes as a release blocker.

Django Fellow Report - Sarah

Sarah added a pull request limit for new contributors, part of her proposed Trac changes to curb irresponsible AI-led contributions, and added a "Low" severity to Trac. She also authored fixes for CSP nonces on streaming responses and overly broad permissions in file_move_safe(), and engaged in six security issues.

Django Fellow Report - Natalia

Wrapping up before her break, Natalia landed the first stage of the docs' console tab accessibility improvements and the 6.1 release note for RedirectURLMixin. She also fixed makemessages with non-ASCII filenames on Windows, escaped database errors logged by Q.check(), and patched a confirmed low-severity security issue.

Sponsored

Django for Beginners, 6th Edition

The sixth edition is out now, available in digital and paperback formats. It features two new chapters, completely updated for Django 6.1+, and more. Read the first four chapters for free to try it out.

Articles

Django as a simple static site builder

Radiac wires nanodjango, django-nanopages, and django-distill into a Django-native answer to Jekyll: app.pages("/", path="pages") maps Markdown and HTML files onto URLs with frontmatter for titles and templates, and distill renders the lot to static output. A PEP 723 block means uv run website.py needs no install first.

How I decide which Python and Django versions I want to support

Matthias Kestenholz keeps projects and dev machines on the newest Python, but supports old versions in libraries for as long as it's cheap, since people on managed hosting can't always upgrade. He drops a version only to trim CI time or to use a new feature, which currently puts most of his packages at Python 3.10+ and Django 3.2 or 4.2+.

What Our Djangonauts Shipped on Django Packages

A long-overdue tour of what three Djangonaut Space contributors, Farhan Ali Raza, Felipe de Morais, and Victoria Cruces, built in summer 2024: one-click htmx favorites you can share on your profile, a Most Liked Packages page, OpenSearch so you can search from the address bar, and documentation links pulled from PyPI. Every one of their PRs is listed at the end.

Why use open source at all with AI?

Tim Schilling had AI build a clunky but free teleprompter in six prompts, which made him ask why anyone needs open source now. His answer: quality comes from deliberating over decisions and edge cases, which AI can't do for you, and open source lets you inherit years of that deliberation for free.

Python's experimental JIT to be removed

The Steering Council gave the JIT team six months to get a standards-track PEP accepted or see the JIT removed from CPython's main branch. After the council asked for more on platform parity, user-visible behavior changes, and security, the authors withdrew PEP 836 on October 19, so the JIT is likely to come out early in the 3.16 cycle.

CSS-Tricks has a new owner!

Four years after DigitalOcean bought it from Chris Coyier, CSS-Tricks is independent again under longtime editor Geoff Graham, who is making it his full-time job. Expect one or two articles most weeks, a beginner HTML/CSS course, memberships, the return of the newsletter, and a reopened guest writing form.

Events

Django Day São Paulo 2027

São Paulo's first event dedicated entirely to Django is coming in the first half of 2027. Over the next few weeks the organizers will announce the official date and venue, open the call for speakers, and start ticket sales, so follow them on Mastodon for updates.

Podcasts

Talk Python #567: Personal AI Agents for Pythonistas

Our own Jeff Triplett joins Michael Kennedy to talk about Hermes, the self-hosted Python agent you program by talking to it, which runs 24/7 on a box at home and wakes every 15 minutes to handle chores like morning briefings. Jeff runs his on a spare Mac Mini and a few Orange Pi boards, and it now talks to Django News, DjangoTV, and the Django Job Board over MCP.

Real Python Podcast #316: The Future of Python Security

Seth Larson, the PSF's Security Developer in Residence, explains how PEP 811 formalized the Python Security Response Team's reporting and triage, and how LLMs are driving up the volume of vulnerability reports. He also covers trusted publishing on PyPI, SBOMs under PEP 770, and practical advice for locking down your CI/CD.

Videos

DjangoCon Europe 2026

The talks from Athens are now on DjangoTV, including both keynotes, auto-prefetching with Django 6.1's field fetch modes, partitioning very large tables with PostgreSQL, shipping Django as a desktop app, and a community conversation on Django and AI.

DjangoCon US 2026

The Chicago videos are out too: Karen Tracey's keynote on Django 6, Natalia Bidart on HTMX without betraying your Django views, the Django/FastAPI debate, search-as-you-type across 54 million names, and Will Vincent on modern Django deployments, plus hallway interviews with the community.

Django Job Board

Two new roles at webbyfox consultancy lead the board this week, alongside the PSF's CPython Developer in Residence opening and senior Python seats at Camden Kelly Staffing and Manychat in Barcelona.

Senior Python Engineer at webbyfox consultancy 🆕

AI Engineer at webbyfox consultancy 🆕

CPython Developer in Residence at Python Software Foundation

Senior Software Engineer (Python, React & AI) at Camden Kelly Staffing

Senior Python Engineer (Barcelona-based / Relocation support to Barcelona) at Manychat

Projects

Static Site Generators

The Django Packages grid for turning a Django site into flat HTML you can host on a CDN or GitHub Pages with no Django process running. django-distill leads on stars, django-bakery on forks, and django-freeze saw the most recent release, with django-nanopages the newest arrival at beta.

makinacorpus/django-leaflet

Use Leaflet in your Django projects

Sponsor Django News

Reach 4,300+ Django developers every Friday. See sponsorship details and rates.

30 Oct 2026 3:00pm GMT

23 Oct 2026

feedDjango community aggregator: Community blog posts

Issue 360: Python and Wagtail Security Releases

News

Python 3.15.1, 3.14.9 and 3.13.17 are now available

Expedited security releases on October 21, carrying pip 26.2.2 and certifi 2026.10.19 to drop the compromised eMudhra CA. 3.13 is the odd one out: it had just entered security-only mode, where pip is not normally updated, so the team cut fresh installers anyway. 3.15.1 is also 3.15's first maintenance release, with roughly 330 fixes from 117 contributors.

Information for Python users regarding the eMudhra / emSign CA certificate security incident

The emSign root was pulled from CA bundles after eMudhra's intermediate keys turned out to be insecure, leaving older clients open to man-in-the-middle attacks against PyPI and python.org. Upgrade now: certifi 2026.10.19, pip 26.2.2, uv 0.13.4, sigstore 4.5.1, in every virtualenv and container image. pip is the one that matters most, since it always trusts its vendored bundle and distrusting the CA at the OS level will not help.

Eight Bits of Trust: eMudhra's CA Keys Cracked in Milliseconds

The technical story behind the advisory, and it is remarkable: each P-384 private key was 47 zero bytes followed by one non-zero byte, so Scott Helme recovered all eight in under a second on a laptop by trying 255 candidates. eMudhra blames a key ceremony script that generated a second weak keypair, picked up for the CSR because the names looked alike.

Wagtail CMS News

Wagtail 8.0.1, 7.4.4, and 7.0.10 security releases

All three landed on October 20 with the same four fixes: an authorization bypass across collections via privacy settings, formula injection in XLSX exports, mishandled ancestor restrictions in the Pages admin API, and stored XSS through third-party HTML editors. 8.0.1 adds a fifth, access restrictions on the API v3 pages endpoint, plus a batch of API v3 write fixes. Also out: 7.4.4 and 7.0.10.

Wagtail 8.1 RC1

The release candidate adds Python 3.15 support and drops 3.10. API v3 gains write support for TypedTableBlock and nested inline relations, an ImageRenditionField, and workflow operations for pages and snippets. Redirects are now auto-created only when a live page moves or is renamed; set WAGTAILREDIRECTS_AUTO_CREATE = 'always' to get the old behavior back.

Django Software Foundation

Quarterly contributor outreach

Tim Schilling posts the Steering Council's list of what needs hands for 6.2: testing CompositeField, plus review on a DEFAULT_PK_FIELD setting, moving models between apps, partitioned cookies, and HTTP QUERY support. A second list covers ideas needing technical vetting, including a task timeout API and import maps.

Django Steering Council Meeting, October 19

This week's agenda: the quarterly outreach message, the Sovereign Tech Agency Resilience Fund, the VectorField DEP, Memcached clients, Jazzband updates, and suggestions for the new Triage and Review Team.

Updates to Django

Last week we had 15 pull requests merged into Django by 10 different contributors - including 3 first-time contributors! Congratulations to Sanskar Kharya, Aman Kumar Jain and Helmi Lakhder for having their first commits merged into Django - welcome on board!

New in Django 6.2:

New in Django 6.1:

Sponsored

Django for Beginners, 6th Edition

The sixth edition was published this week, available in digital and paperback formats. It features two new chapters, completely updated for Django 6.1+, and more. Read the first four chapters for free to try it out.

Django Fellow Reports

Django Fellow Report - Jacob

Chasing a forum thread led Jacob Tyler Walls to merge a fix that reduces the cost of building many-to-many related managers. He also spotted the last tweaks needed for multiline template tags, drafted a security fix, and triaged a JSONField RecursionError on deeply nested input.

Django Fellow Report - Natalia

Natalia Bidart kept the djangodocs Sphinx cleanup and the DEP 20 release checklists moving, including CVE records that can name the first affected release per branch. The Triage and Review Team held its first meeting, and the Security and Triage teams both gained members.

Django Fellow Report - Sarah

A short week around coughs and colds, but Sarah Boyce landed CSP nonces in headers for streaming responses, corrected verbatim-block tokenization, and enforced integer expiry times for file-based sessions. She also added Lilian Tran to the security team and Shai Berger as a triager.

Python Software Foundation

Announcing Python Software Foundation Fellow Members for Q3 2026

Aldo Caneo, Donghee Na, Paul Moore, and Takayuki Shimizukawa join the Fellow roster, recognized together for maintaining libraries, writing educational material, organizing events, and mentoring. Q4 nominations close November 20, 2026; email psf-fellow at python.org with the nominee's accomplishments.

Checking email reputation, and allowing Outlook again

PyPI blocked outlook.com and hotmail.com outright in June 2024 after a bulk malware campaign, which caught legitimate users too. A donated reputation service from UserCheck now judges addresses individually, so both domains are allowed again; in its first month it rejected 62 disposable domains and 120+ throwaway addresses.

Wikis: Relaunched!

The Python, PSF, and Jython wikis went read-only in February after AI scrapers overwhelmed hosts partly still running Python 2. They are back as static sites on GitHub Pages, edited by pull request against psf/wiki, with write access going first to the old wikis' known stewards.

Articles

Django's Brightest Timeline

Tim Schilling argues Django's feature process has quietly come together: new-feature ideas live in a GitHub repo where emoji reactions act as votes, proposals get asked to prove themselves as third-party packages first, and Django Probe plus Praful Gulani's experimental-features GSoC work could decide what lands on usage data instead of advocacy.

Django: check version support with norwegianblue

Hugo van Kemenade's eol command pulls endoflife.date into a color-coded table, so eol django shows release, support, and end-of-life dates at a glance (6.1, 6.0, and 5.2 supported, 6.0 security-only). uv tool install norwegianblue, and it speaks Markdown, reStructuredText, and JSON for docs and scripts.

Your workers open a new Postgres connection for every task

Django's default CONN_MAX_AGE = 0 means every task a worker picks up opens its own Postgres connection, about 5ms, longer than claiming and running the task on a warm one. Set it to 600 or use a connection pool before you benchmark anything. The numbers come from django-ox's own vendor.

Automating Django deployments with Deployer

Stein Ove Helset replaces his SSH-and-run-the-commands routine with Deployer, a PHP tool that is happy to run manage.py: dep deploy builds a fresh release with its own virtualenv, runs checks, migrations, and collectstatic, then flips a current symlink and restarts Gunicorn. Shared .env and media survive between releases, and rolling back is one command.

How I decide which Python and Django versions I want to support

Matthias Kestenholz splits the question by context: projects track the current stable release or a pre-release, while the more foundational a library is, the further back it should reach. He drops versions to prune CI cost or to use something new, and lands on Python 3.10+ with Django 3.2 or 4.2+ for most packages.

Events

IndyPy: Django & FastAPI: What's Next?

Tuesday, November 24 at 7pm ET, hybrid from E-gineering in Indianapolis or over Zoom. Tim Schilling covers what's new in contributing to Django, and Calvin Hendryx-Parker argues batteries-included against speed in the Django/FastAPI debate. Register on Meetup for the in-person seat or the Zoom link.

Podcasts

Django Chat #208: Django in Space with Loes Crama

Loes Crama is a software engineer at cosine Measurement Systems, contributing to ESA's NewAthena mission. We discuss her lifelong interest in space and how her work combines software engineering, data engineering, and data science.

Videos

Django in Space with Loes Crama

Loes Crama is a software engineer at cosine Measurement Systems working on ESA's NewAthena mission, the subject of her DjangoCon Europe talk on how Django helps build the largest X-ray observatory yet. This Django Chat episode covers how she arrived at a job that combines software engineering, data engineering, and data science.

Sponsored

Reach 4,300+ Engaged Django Developers

Sponsor this newsletter to reach an active community of Python and Django developers.

Django Job Board

The PSF is hiring its next CPython Developer in Residence, alongside two senior Python roles, one AI-leaning in the US and one in Barcelona with relocation support.

CPython Developer in Residence at Python Software Foundation 🆕

Senior Software Engineer - Python, React & AI at Camden Kelly Staffing 🆕

Senior Python Engineer (Barcelona-based / Relocation support to Barcelona) at Manychat 🆕

Projects

django-ses/django-ses

A Django email backend for Amazon's Simple Email Service.

ivelum/djangoql

Advanced search language for Django admin.

Sponsor Django News

Reach 4,300+ Django developers every Friday. See sponsorship details and rates.

23 Oct 2026 3:00pm GMT

21 Oct 2026

feedDjango community aggregator: Community blog posts

How I decide which Python and Django versions I want to support

How I decide which Python and Django versions I want to support

A recent post on Mastodon got me thinking about what my philosophy for dropping support for old versions of Python and Django is. Here's the post:

🚨 Important Announcement 🚨

Going forward all my packages will only "officially" support maintained #Python versions. Meaning since October only 3.14 and now 3.15.

This has no effect on Django version support.

CVEs will be backported to older 🐍 releases.

- @codingjoe

I tend to support versions long past their End of Life date. I jokingly said that I should spend time upgrading old websites instead of spending time writing a rationale why not. I don't want to argue for my position, but maybe this post will serve as the place to point people towards when the question arises again in the future.

The short answer: it depends on whether I'm working on a project, on my own machine or on a library.

Projects

When working on projects I'm always updating to the current stable version or even the bleeding edge. I want the projects to be as future-proof as possible and I also want to give early feedback when stuff breaks.

As long as the server software allows it, I'm just going to use uv to install the newest Python version that all the packages I'm using support (or at least ship binary wheels for), because I enjoy not compiling software when deploying too damn much.

Developer workstations

When it comes to developer workstations I don't really have the patience for outdated software. I don't see a reason why developer tooling can't be up to date. This came up recently in the django-debug-toolbar issue tracker. I'm totally fine with requiring an up-to-date version of Python for our pre-commit hooks, for example.

Libraries

The more foundational and widely used a library (potentially) is, the more important it is to me that it supports basically everything which is reasonable.

I'm still using my libraries in older projects myself, so they have to work there. I want to use them in all environments, at least when I'm not paying a big price in terms of language features.

Other people may be stuck on older versions too. People can upgrade their software, but there may be situations (for example in managed hosting environments) where people cannot freely update the underlying managed server software. That isn't necessarily a problem security-wise as long as there are other measures in place protecting those services.

When people use my libraries, I might get additional eyes on the code, and possibly even contributions.

Supporting a large range of Django versions, for example 3.2 (reached EOL on 2024-04-01) up to the current main development branch, can be surprisingly easy when you do not reach too much into Django's internals or depend on features added only recently.

That said, when do I actually drop support for an old version of Python or Django? Generally speaking, I have two reasons:

🌳 Keeping CI time down 🌳

I like pruning the CI matrix so as to not spend too much compute and energy. The exceptions are packages such as django-debug-toolbar and django-tree-queries: they are widely used and have to work on a wide range of Python and Django versions and database engines, so the additional CI runs are worth it.

When I remove a version from the CI matrix I mostly raise the minimum version in the package metadata as well. I almost never use upper bounds for version ranges, but lower bounds I definitely do use.

Using new features, either because I want them or because I need them

Sometimes, I just really want to merge dictionaries using the nice a | b syntax. If this reasoning sounds whimsical to you, it is, but only partially. Programming cannot just be a job, everybody needs to have fun sometimes.

Sometimes, I really need some API or behavior Django has only introduced recently, such as the way bound fields work in forms. For example, form validation didn't go through bound fields before 4.0.

What that means right now

Most of my packages currently require Python 3.10 or newer and Django 3.2 or 4.2 or newer. Some of the less actively developed ones still go back as far as Python 3.8, simply because I haven't had a reason to touch them. Python and Django support are linked: Django 4.2 supports Python 3.8 to 3.12 while Django 6.0 requires Python 3.12, so the oldest Django version I support pretty much decides the oldest Python version worth testing.

What is the downside?

Supporting old versions makes it easier for people to put off upgrading. Some people just don't want to upgrade at all, and my libraries continuing to work on old versions certainly doesn't push them to do it. When they suddenly have to because all hell breaks loose (because of security problems or something like that) it's so much harder: they have a long way to go until they reach supported versions. That said, in my experience that's not a big problem with Django at all. On the other hand, when the projects still use npm packages from 2015… oh my.

The code is also less clean than it could be. Supporting old versions means compatibility shims, and it means not using some of the nicer features newer versions offer.

In the end, both approaches are reasonable, and both have their costs. You should do what brings you more joy.

21 Oct 2026 5:00pm GMT