The second half of our annual JetBrains fundraiser has been extended through September 14, 2026. Thank you to JetBrains for the extra time. You still have time to renew your PyCharm license or give it a try. You get PyCharm at 30% off, and JetBrains donates 100% of your purchase or renewal to the DSF. This is one of the DSF's bigger fundraisers of the year, and we appreciate everyone who takes a look.

The Executive Director search also closes on September 14, and we are curious to see who reaches out.

JetBrains has been a steady sponsor for years, and it was great to see the chatter around the Django Developers Survey 2026 results we released with them last month. The full report is on the JetBrains site. If you are shopping for an IDE, AI-focused or not, they have a solid product.

If you would like to help with our fundraising goals, we would love to hear from you or your company. The board is happy to talk with individuals too, if you have ideas. Whatever you can do to support us, we appreciate it.

Ways to help

• Renew or start a PyCharm license through the fundraiser before September 14.
• Have your company sponsor the DSF directly.
• Donate on our website or give through GitHub Sponsors.
• Reach out to the board if you want to donate, sponsor, or volunteer, or if you have fundraising ideas.

10 Sep 2026 11:00am GMT

Quick, without looking it up, what does re.match() do? Which of these return a match?

import re
re.match("pi", "pi")
re.match("pi", "pie")
re.match("pi", "api")
re.match("pi", "magpie")

How does it compare to re.search() and re.fullmatch()?

Whilst you're (quickly) thinking about it, let's introduce soft deprecation.

Soft deprecation #

Python's backwards compatibility policy (PEP 387) introduced soft deprecation in 2023:

A soft deprecation can be used when using an API which should no longer be used to write new code, but it remains safe to continue using it in existing code. The API remains documented and tested, but will not be developed further (no enhancement).

A soft deprecation does not imply future removal of the API, nor does it issue a warning. It's a docs-only recommendation to not use an API, ideally with a suggested replacement.

It's a completely separate decision whether, if ever, to turn a soft deprecation into a regular "hard" deprecation (where removal may follow); soft deprecations don't "graduate" into regular deprecations or removals.

re.match() #

Now the answer:

>>> import re
>>> re.match("pi", "pi") # ✅ Matches
<re.Match object; span=(0, 2), match='pi'>
>>> re.match("pi", "pie") # ✅ Matches
<re.Match object; span=(0, 2), match='pi'>
>>> re.match("pi", "api") # ❌ No match
>>> re.match("pi", "magpie") # ❌ No match
>>>

So re.match() only matches at the beginning of a string! This can be surprising: why is the start of the string special?

re.search() #

If you don't want to anchor at the start, and want to match anywhere in the string, use re.search():

>>> import re
>>> re.search("pi", "pi") # ✅ Matches
<re.Match object; span=(0, 2), match='pi'>
>>> re.search("pi", "pie") # ✅ Matches
<re.Match object; span=(0, 2), match='pi'>
>>> re.search("pi", "api") # ✅ Matches
<re.Match object; span=(1, 3), match='pi'>
>>> re.search("pi", "magpie") # ✅ Matches
<re.Match object; span=(3, 5), match='pi'>
>>>

re.fullmatch() #

If you want to anchor both the start and the end, and check the entire string matches, use re.fullmatch():

>>> import re
>>> re.fullmatch("pi", "pi") # ✅ Matches
<re.Match object; span=(0, 2), match='pi'>
>>> re.fullmatch("pi", "api") # ❌ No match
>>> re.fullmatch("pi", "pie") # ❌ No match
>>> re.fullmatch("pi", "magpie") # ❌ No match
>>>

Introducing re.prefixmatch() #

Because of the surprising half-anchored behaviour, we've introduced a new alias for re.match() in Python 3.15, named re.prefixmatch():

Quoting from the Zen Of Python (python3 -m this): "Explicit is better than implicit". Anyone reading the name prefixmatch() is likely to understand the intended semantics. When reading match() there remains a seed of doubt about the intended behavior to anyone not already familiar with this old Python gotcha.

Soft-deprecating re.match() #

And with a more explicit replacement, we've soft-deprecated re.match() in Python 3.15:

We do not plan to remove the older match() name, as it has been used in code for over 30 years. It has been soft deprecated: code supporting older versions of Python should continue to use match(), while new code should prefer prefixmatch().

Use re.prefixmatch() if you only really meant to use the half-anchor; otherwise use re.search() or re.fullmatch().

Comparison #

The functions without special characters are generally a bit faster.

Lint #

You can avoid re.match() in your project with Ruff:

# pyproject.toml
[tool.ruff]
lint.extend-select = [
 "TID251", # flake8-tidy-imports: banned-api
]
lint.flake8-tidy-imports.banned-api."re.match".msg = "Use re.fullmatch() or re.search() instead"

Or run:

ruff check . --isolated --select TID251 \
 --config 'lint.flake8-tidy-imports.banned-api."re.match".msg = "use re.fullmatch() or re.search() instead"'

See also #

• Seth Larson: Use "\A…\z", not "^…$" with Python regular expressions

Header photo: Double-exposure bike and pedestrian stencils (CC BY-NC-SA 2.0 Hugo van Kemenade).

10 Sep 2026 8:08am GMT

Hi all Pythonistas! 👋

EuroPython 2026 took over the ICE Congress Centre in Kraków from 13 - 19 July and it wouldn't have been possible without all of our attendees, speakers, volunteers, and sponsors. You allowed us to showcase the Python community at its best once again, and the conference truly belongs to all of you 💚

We are now one month on, and we've just finished tying up the loose ends over here at EuroPython HQ. In this newsletter, let us look back at some of the highlights of the conference, from Guido van Rossum to gelato.

P.S. Yes, we've got the videos!

🙏 Thank You

Thank you to all of you who attended EuroPython 2026 and dedicated a week of your life to Python. We're endlessly grateful to be host to some of the best technical presentations on the planet, which makes it all the more meaningful when people say what they remember is the community 💚

A very special thank you to:

• all of our speakers, tutorial and sprint leads, without whom there would be no EuroPython
• our team of more than fifty volunteer organisers, most of whom worked for months ahead of the conference
• on-site volunteers, who kept the conference running smoothly and took care of all of us
• our sponsors, without whom the conference would simply not be possible

Many thanks to the whole EuroPython 2026 Team

Finally, thank you to our faultlessly helpful onsite volunteers - those with the yellow T-shirts - for taking ownership of the conference during the week, and being the cheerful face of EuroPython, and taking care of us all in Kraków.

👉 The EuroPython 2026 Credits Reel: https://ep2026.europython.eu/thank-you

🎥 Talk Recordings & Photos

The video recordings from all of our tracks are already up on our YouTube channel, so you can catch the sessions you missed, or send that session to a friend.

Recording of the core.py podcast on the main stage: Pablo Galindo Salgado, Guido van Rossum, and Łukasz Langa

👉 EuroPython 2026 on YouTube: https://www.youtube.com/watch?v=9ZuZfG8_jH8&list=PLd3Y9yzyC5Uo

👉 Conference photos on Flickr: https://www.flickr.com/photos/europython/collections/72157725522022865/

📊 Some interesting facts about this edition

EuroPython 2025 brought the community together in Kraków for another packed week, and the numbers tell a lovely story: a genuinely international crowd, heavily weighted towards experienced Pythonistas, with a healthy remote contingent tuning in from further afield. Here are the figures that stood out to us:

• 1,386 tickets in total - 1,263 onsite and 123 remote
• Attendees came from across the globe, with Poland (236), Great Britain (169) and Germany (154) leading the way
• 70.7% of attendees rated themselves as advanced or expert Python users
• Out of those who answered the question, 23% identified themselves as women, 1% as other, and 76% as men
• Core Python was the most popular topic (66.8%), followed by Web Development (51.0%) and Data Science & ML (49.4%)

Additionally, the Code of Conduct team provided the transparency report: https://www.europython-society.org/europython-2026-code-of-conduct-transparency-report/

🏆 Community Service Recognition

EuroPython Society Fellows

We&aposre delighted to announce two new EuroPython Society Fellows: Cristián Maureira-Fredes and Piotr Gnus, in addition to Martin Borus who was recognized recently. The Fellow Grant is the Society&aposs way of honouring members of the EPS and the EuroPython Workgroups whose contributions have significantly shaped our mission, the conference and the organisation itself.

Fellows are nominated by EPS members, confirmed by the Board, and receive lifetime free attendance at EuroPython alongside a permanent listing on our Fellows page. Our heartfelt thanks to all three for everything they&aposve given to this community.

👉 Find out more about EPS Fellowship: https://www.europython-society.org/europython-society-fellow-grant/

Python Software Foundation Community Service Award

For the first time ever, a Python Software Foundation (PSF) Community Service Award was handed over on the EuroPython stage. Rodrigo Girão Serrão was nominated last year, but the award was presented during the closing ceremony in Kraków.

The award recognises work that "significantly improves the Foundation&aposs fulfillment of its mission and benefits the broader Python community." Plenty of CSA recipients are based in Europe, so we hope this was the first of many.

👉 Read about the award: https://www.python.org/community/awards/psf-awards/#introduction

🎂 EuroPython's 25th Birthday

Since its very first edition back in 2002, EuroPython has grown into the longest-running community Python conference in Europe. Over the years it has travelled across the continent, hosted by volunteers in city after city, bringing together thousands of Pythonistas to learn, share, and build the community we know today.

We looked for some of the people who have been with the conference the longest:

Jacob HallénMarc-André Lemburg and David Allan

🍨 The Sprints Had a Gelato Truck

Genuinely. The Free Software Foundation Europe joined us for the sprints, and one of their volunteers, Luca Bonissi, drove his home-made ice cream up from Milano - along with the freezer and all the equipment needed to serve it to everyone sprinting. Reusable cups, fruit flavours reportedly around 70% fruit, and a queue that said everything.

Luca Bonissi serving gelato at EuroPython 2026 Sprints

This is the kind of thing that only happens when a community shows up for each other.

Thank you, Luca, and the Free Software Foundation Europe 🍨

🧠 How Well Do You Really Know Python?

One of the surprise hits of the week was Rodrigo Girão Serrão's 15-minute Kahoot quiz in the main hall, covering the conference, the community and the language itself. It was hard: the top 8 players only managed 5 out of 10, and 9th place got 4.

The best moment? Rodrigo asked exactly how many commits Guido had made over the lifetime of Python. It was worth double points. Nobody got it right. Three questions later he asked the same thing again - and this time 20-25% of the room got it.

All the questions and answers are written up now, so you can find out how you&aposd have done. Participants rated the quiz at the very top of the sessions they attended, so yes - it&aposs coming back next year.

👉 Test yourself on Rodrigo's quiz: https://mathspp.com/blog/python-quiz-europython-2026-edition

🎨 Made by You

We were sent some wonderful artwork from the week - including Michaela Dušková&aposs sketch of the core.py panel (three cats on stage, which feels about right) and Ava Katushka&aposs illustration of the PyLadies crew. Shared with permission, and both very much loved by the team.

Michaela Dušková&aposs sketch of the core.py panelAva Katushka&aposs illustration of the PyLadies crew

👬 Community Partnerships

🌷 PyCon NL

PyCon NL has grown from a small meetup in 2019 to a thriving community and conference. After hosting the first official edition in 2024, they return in 2026 with the newly founded PyNetherlands Foundation and a conference fully organised by the Python Community in the Netherlands.

PyConNL is creating a program for every kind of Pythonista, whether you're just starting out, exploring the world of data, or building with DevOps and architecture.

👉 Get your ticket: https://www.pycon-nl.org/

☀️ PyCon España

PyConES 2026 already has its programme and tickets are available. Don&apost miss the chance to be part of the most important Python conference in Spain in one of the most beautiful cities in the world.

👉 Don&apost have your ticket yet? Now is the time! 👉 https://pretix.eu/python-spain/pycones-2026/

🏖️ Django on the Med

Django on the Med is a free three-day Django sprint on the Mediterranean coast, bringing together seasoned contributors and first-timers to shape Django&aposs 6.x roadmap and get the work done. Mornings are for sprinting, the rest of the day for the coast. The second edition runs 23rd-25th September 2026 in Pescara, Italy

👉 Find more details at https://djangomed.eu/

💚 Thank You to Our Sponsors

EuroPython simply does not happen without our sponsors. Enormous thanks to our Platinum sponsors - Manychat, Microsoft and Vercel - and to every other sponsor who backed the conference this year.

Manychat builds AI-powered chat automation for 1M+ creators and brands at real production scale.

Open Source enables Microsoft products and services to bring choice, technology and community to our customers.

Vercel provies Agentic Infrastructure for every app and agent. They are the creators of AI SDK, Next.js, Turborepo, and v0.

👋 Stay Connected

Follow us on social media and subscribe to our newsletter for all the updates:

👉 Sign up for the newsletter: https://blog.europython.eu/portal/signup

• LinkedIn: https://www.linkedin.com/company/europython/
• X/Twitter: https://x.com/europython
• Mastodon: https://fosstodon.org/@europython
• Bluesky: https://bsky.app/profile/europython.eu
• Instagram: https://www.instagram.com/europython/
• YouTube: https://www.youtube.com/@EuroPythonConference

We hope that you&aposll enjoy relieving your favorite EuroPython 2026 moments as autumn approaches. Until next time! 🐍💚

Cheers,

The EuroPython Team

10 Sep 2026 6:43am GMT

Weeknotes (2026 week 37)

Tonight the temperature will drop to 10°C. I like it when it's hot, but now I really enjoy the slightly cooler temperatures in Europe. The last post was written in the middle of the heat wave. Yesterday we still had temperatures of over 30°C, which is a lot for September. But it will be the new normal. Next year probably won't be cooler.

Releases from the last four weeks

Lots of activity!

django-authlib

django-authlib 0.19 hardens the OAuth2 implementation a bit against replay attacks, provides utilities for removing password logins from the Django administration interface, and removes some of the confusion around role-based permissions. Upgrading is recommended.

django-content-editor

django-content-editor 9.0.2 fixes a bug in the function which allows cloning plugins from other regions. The bug was most visible when using something like django-json-schema-editor's plugins which are only proxy models. Their type was lost because I was using _base_manager, which didn't do the downcasting properly. (Sorry for the word salad.)

django-tree-queries

django-tree-queries 0.26.1 now uses annotations instead of .extra() to add the tree_path and tree_depth fields. This is great because the ORM knows these fields properly and we can now use e.g. .filter(tree_depth=1) instead of .extra(where=["..."]).

This change was mainly motivated by the renewed interest in deprecating .extra() at some unknown future point in time.

django-debug-toolbar

django-debug-toolbar 8.0 ships a new design! I again didn't contribute a lot, but I'm very proud that we were able to ship this as a team.

feincms3

feincms3 6.0.2 ships new utilities and, most importantly, fixes crashes when passing %00 to the root middleware. Using null bytes when comparing text field values on PostgreSQL leads to crashes. These are mostly an annoyance without data exposure, but definitely worth fixing.

The reason for the major version bump is that we finally dropped support for Django 3.2. That's the only breaking change, so upgrading should be easy for everyone.

django-js-asset

django-js-asset 4.1 fixes issues around lazy CSP nonce handling as well as the same issue Django itself had around rendering HTML-safe strings.

django-prose-editor

django-prose-editor 0.27.2 adds a default menu item for the code block extension and updates ProseMirror and Tiptap. It also adapts to the changed CSS of the Django 6.1 administration interface.

django-json-schema-editor

django-json-schema-editor 0.14.1 includes a fix for saving JSON schema fields when the schema doesn't contain any properties, plus fixes for the Django 6.1 admin CSS.

django-admin-ordering

django-admin-ordering 0.21 now activates orderables properly when the same model was orderable both in the change list and in the change form. I developed the fix for this in early 2025 but never released it. It's what happens.

feincms3-cookiecontrol

feincms3-cookiecontrol 1.7.2 includes bugfixes for edge cases while bringing down the byte count for the cookie banner and media embedding script from 3961 (in 1.7.1) to 3909 bytes.

feincms3-data

feincms3-data 0.11.1 brings fixes for handling unique fields when the same unique value is removed and then re-added with a different primary key.

django-translated-fields

django-translated-fields 0.14 contains no relevant code changes to the module itself at all. It was just time to release a new version more than two years after the last release to show that the project is still active and update the Trove classifiers.

09 Sep 2026 5:00pm GMT

Over the summer I published a series on coding tactics: the everyday craft of ifs, loops, and the reasoning behind them. Eight posts, one thesis, best read in order. This is the map.

08 Sep 2026 10:00am GMT

I get asked this rhetorical question a lot, in various forms:

Sure, datacenters might use a lot of energy, but you don't have to use a hosted frontier model to do software development. What if I just run a local open-weights model to do some coding, with an open-source coding agent? Video games also use my GPU. Is local model development any worse than playing a video game?

So I want to write down my comprehensive answer to this: Yes, using an LLM to write some code is worse than playing a video game, for a few reasons.

Video Games Are Interactive, LLMs Are Batch Jobs

Video games use compute to respond to human input. You are using your GPU while you are looking at a screen, displaying an image. When you are done playing, you shut off the game, and your computer goes back to idle. It's much less energy. By contrast, agentic loops with evals (the only kind of "AI" that is meaningfully any good at coding) are running hot, for days. To use the most recent example of such a thing, a very rough first sketch of an implementation of a Windows graphics API backend to help port a paint program to other platforms, it took 3 weeks of Claude time, "day and night". Do you play a lot of video games for 500 hours to make it past the tutorial level, while also using other computers for other things, as well as the rest of your carbon footprint?

Video Games Need Development, LLMs Need Training

Video games use compute to respond to human input during development, too. Your game has to be made, but your LLM has to be trained. LLMs use a historically extreme amount of power, probably using more than the entire Internet, but it's kind of hard to say. Still, it seems a reasonable estimate to within several orders of magnitude that even over a multi-year project with hundreds of developers, the power used to develop an individual video game is nowhere close to training even a small LLM.

This is true even for local models. OpenAI has openly claimed that DeepSeek "stole its intellectual property", and I have heard grumblings that none of the open-weights generalist models could realistically exist without the massive lift that the frontier labs are doing with their training, in various other ways too. Secrecy throughout the industry makes this kind of impossible to understand rigorously, but it seems fair to say that you are partially culpable for all that famously energy-intensive frontier lab training if you're using a local model.

And They Keep Needing Training

You also can't dismiss this as a sunk cost, because in order to stay current with industry developments, models need to be updated with new information from the rest of the world, which means that you need to keep training them. Beyond the energy for your own use, if you want a real-life agentic workflow that actually does useful stuff, practically speaking you would still need to update your local models over and over again, at least once every few months, which means you would be incentivizing continued energy consumption by whoever was doing that training for you, including the energy cost of scraping.

Let's Be Real Here, You Aren't Actually Using A Local Model

This question is a hypothetical thought experiment. Despite synthetic benchmarks that keep showing there isn't much difference between open weight and frontier models, nobody's actually using local models for much of anything beyond sharing those talking points. Depending on which benchmark you're looking at, maybe it's good enough or maybe it's worse.

As an inveterate AI hater, all these systems seem pretty bad to me, but it seems that people who find them useful tend to subjectively believe the frontier models are worth the premium, and that's what they're actually using. Once you have accepted that it is OK to use LLMs for coding at all, it seems like a very quick slippery slope on down to "we'll go ahead and use the frontier models for now anyway, but we could be ethically better in the future by switching to an open weights one, that option is always available".

There's A Reason We Have Data Centers

Devolving power usage to local LLMs might be good to make users responsible for their costs and decrease the impacts to communities that are physically next to huge concentrations of power utilization, not to mention generation. However, there's a reason that it makes sense for the providers to build these giant facilities: economies of scale reduce total power consumption, they don't increase it. If you do all the same stuff with a local model that they have to do in hosted environments, it will probably take more power, even though you will be incentivized to do different stuff. This incentive to "do different stuff" is why although local models can hypothetically hold their own against the frontier labs for some tasks, when people or businesses take their inference costs in-house they often find that it's too painful and move back to hosted LLMs.

There Are Problems Other Than Power

These are subjects for a different post, but you have to consider a lot of other externalities: AI psychosis, de-skilling, comprehension debt, cultivating a dependency, introducing security defects, limiting your design space based on what LLMs can understand, context rot, wasting time on invalid solutions, introducing unpredictability into your workflows. You still have to consider the total cost benefit ratio.

To Sum Up

Local LLMs might alleviate some of the harms from using the hosted frontier providers. There are fewer privacy concerns, you can measure your power utilization and be more directly responsible for it, you can build interfaces with affordances that are less oriented towards addiction and dependency than the major frontier labs' harnesses.

But they're not automatically "the same as playing a video game" just because they can use the same GPU.

Acknowledgments

Thank you to my patrons who are supporting my writing on this blog. If you like what you've read here and you'd like to read more of it, or you'd like to support my various open-source endeavors, you can support my work as a sponsor!

06 Sep 2026 10:57pm GMT

News

Django Developers Survey 2026 results

The fifth annual survey run with JetBrains is out, with the full report, infographics, and a companion writeup titled "The State of Django 2026: Boring is so back."

Help test Python 3.15!

Python release manager Hugo van Kemende kindly requests you add 3.15 and allow-prereleases: true to your GitHub Actions matrix and publish wheels before the October 1 release.

Releases

Django bugfix release issued: 6.1.1

Twelve fixes, nearly all of them 6.1 regressions: admin changelist search crashes, ModelAdmin.list_display traversing multiple relations, __in returning empty querysets, and DecimalField without precision on SQLite.

Python 3.15.0 candidate 2 is here!

The last planned release candidate, carrying 144 bugfixes from 76 contributors since rc1, ahead of the October 1 final.

Django Software Foundation

DEP 0019: Technical Governance for Django

Now accepted, DEP 19 supersedes DEP 10 and DEP 12 as Django's single technical governance document, and trades hard eligibility rules for eight qualitative traits that Steering Council candidates should show three or more of. The five-member council keeps binding authority over technical decisions, with elections triggered by the final feature release of a major release series, a drop below three elected members, or a council vote.

DSF member of the month - Benjamin Balder Bach

The django-money maintainer and Django Day Copenhagen organizer on closing the distance between developers and the people who use what they build.

Djangonaut Space News

Djangonaut Space - Session 7 Accepting Applications

Applications for the eight-week mentorship program close September 6 Anywhere on Earth, with the session starting October 12.

Python Software Foundation

The 2026 PSF Board Election is Open!

Eligible members can approve up to 17 candidates for four open seats, and ballots cannot be changed once cast, so read the nominee statements before voting closes September 15 at 2:00 pm UTC.

Inaugural Python Packaging Council Election: Voting is now open!

The first Packaging Council election is open to members who affirmed their intent to vote, and closes at the same September 15 deadline.

Metadata requests no longer tracked in PyPI download counts

PyPI now counts only .whl, .tar.gz, and .zip requests, so BigQuery data breaks permanently at 2026-08-24: about 39% of urllib3's earlier counts turned out to be metadata and other non-distribution files.

Wagtail CMS News

Our DjangoConUS 2026 photo album 📷

Meagen Voss shares photos from Chicago rather than a talk recap, including her first main-stage talk on Wagtail's approach to AI.

Updates to Django

Today, "Updates to Django" is presented by Raffaella from Djangonaut Space! 🚀

Last week we had 5 pull requests merged into Django by 5 different contributors - including 2 first-time contributors! Congratulations to Iaroslav and Tyler Russin for having their first commits merged into Django - welcome on board!

News in Django 6.1:

• As default model ordering is now applied to combined querysets, union(), difference(), and intersection() raise DatabaseError when a field in Options.ordering isn't selected by values() or values_list(). Call order_by() without arguments before combining to clear the default ordering.

• Fixed a bug where DecimalField without max_digits and decimal_places caused a crash when retrieving values on SQLite (#37275).

• Fixed a regression that caused a crash when iterating a QuerySet of a model overriding Model.from_db() without the new fetch_mode keyword argument. Such overrides now work again, but are deprecated and should be updated to accept fetch_mode (#37259).

Playwright is replacing Selenium for integration tests 🎉

Django Fellow Reports

Django Fellow Report - Jacob

I had a rejuvenating week attending, presenting at, and sprinting during DjangoCon US. I'm still relatively new to this community, so I'm still allowed to be impressed with everyone's gracious and welcoming attitudes. A smattering of things falling under the usual categories this week.

Django Fellow Report - Sarah

Was in Chicago (🌬️ 🏙️ 🌭 🇺🇸) for DjangoCon US 🎉. It was a fantastic conference and a lovely city. Delivered a keynote which went "good enough" and my baby boy managed with the jetlag reasonably well 😀. Came away from the conference with a few ideas and energy from engaging with our community

Django Fellow Report - Natalia

A week of holidays 🏖️ 👡 🍦 followed by a week of DjangoCon US! 🚆 ☀️ 👥 🎤

Sponsored

Until September 10, receive 30% off all new or renewal licenses, with 100% of the proceeds going directly to the Django Software Foundation.

Articles

Why We Started Building on the Django 6.1 Alpha

Divio started building on Django 6.1 at the first alpha, months before the August release. Here's why they picked the pre-release and what they found while testing it every day.

A Dolly Parton Developer

Following Rikki Endsley's "Willie Nelson developer," Trey Hunner makes the case for Dolly Parton as the model: know your rights (she refused to hand over publishing on "I Will Always Love You" when Elvis's team demanded half), exit with grace (she paid Porter Wagoner $1 million to leave his show and kept the friendship), and write the next one. She recorded close to 1,000 songs and wrote thousands more, which is a better target than being a rockstar.

Store lists in a single Django column without joins?

After a decade of development, version 1.0.0 of django-select-multiple-field is here, bringing full support for modern Python and Django versions to store multiple choices in a single database column without extra join tables.

Make Your Django Application Editable

The CMS doesn't need to own your data to make it editable.

htmx and Django LiveView, side by side

Seven worked cases showing where stateless htmx requests and LiveView's persistent WebSocket diverge, with the conclusion that they are complementary rather than interchangeable.

Nifty Django Feature: Use Index for Custom Migration Operations

Override create_sql() and remove_sql() on a models.Index subclass and arbitrary table-level SQL rides along in Meta.indexes, managed by migrations for free.

Django and deployments

A proposed manage.py deploy namespace of lower-level commands that start by printing their expected inputs and outputs, leaving the actual automation to packages and plugins.

Agents All the Way Down

The annotated script of Josh Thomas's DjangoCon US talk on how AI coding agents changed the way he writes Django, written to land for skeptics and true believers alike.

Postgres 19: How Our Advice Has Changed Since...

JIT is off by default, LZ4 replaces pglz for TOAST, and async I/O means the old "an index always beats a parallel sequential scan" assumption is worth re-testing.

"Premature" optimization

The full Knuth quote licenses optimizing the critical 3%, and dropping "small" from "small efficiencies" turned it into a blanket excuse to skip the design work that is cheapest to do up front.

DjangoCon US Recaps

Yes, a standalone category since so many posts on it this week!

DjangoCon US 2026 Recap - Jonathan Peacher

Jonathan Peacher's notes on attending the conference this year in Chicago, highlighting various talks and projects.

My Time at DjangoCon US 2026 - Jason Judkins

Jason Judkins transcribed the talks so he could go back over them, and this recap is the trailer for a longer per-talk series. He picks out a theme running through Paolo Melchiorre's UUID history, Drishti Jain's GeoDjango talk, and Abigail Gbadago's polyglot persistence talk: push the work down a layer, because the database usually knows how to do it better than you do. AI turned up in nearly every talk, with almost nobody uncritical about it.

DjangoCon US 2026 Recap - Tim Schilling

Tim Schilling's fifth DjangoCon, spent chairing sprints with Kudzayi Bamhare, working on Django Simple Deploy with Colin Copeland, and meeting Djangonaut Space members in person for the first time.

My DjangoCon US 2026 - Paolo Melchiorre

Paolo Melchiorre on giving "The Django UUID Story," staffing the DSF booth, and fielding questions at the DSF members open space.

DjangoCon US 2026 - Dwayne McDaniel

Dwayne McDaniel's recap runs talk by talk: Karen Tracey on Django 6's background tasks, CSP support, and template partials, Natalia Bidart on keeping templates the source of truth with HTMX, and Elizabeth Christensen on UUIDv7, graph queries, and OAuth 2.0 in PostgreSQL 18 and 19. His through line is that frameworks, databases, and browsers keep absorbing work that used to need extra layers, with Kasey Kelly's 16,000-line AI-generated frontend file as the cautionary case.

Events

Django On the Med

September 23, 2026 in Pescara, Italy 🇮🇹.

Django Day Copenhagen 2026

October 2, 2026 in Copenhagen 🇩🇰.

Django Job Board

Two new listings this week, plus the DSF still looking for its first Executive Director.

Machine Learning Engineer (Hybrid) at Provision 🆕

Django Developer at The Cruise Brothers 🆕

Full Stack Software Engineer (Hybrid) at Provision

Executive Director at Django Software Foundation

AI-Assisted Software Engineer, Web Applications at Logical Media Group

Projects

django-danceschool/django-danceschool

Django CMS project with comprehensive features for running a partnered social dance school.

p-r-a-v-i-n/django-fast-multipart

An experimental Rust-backed multipart parser that plugs into Django's parser extension point, so upload handlers, request limits, request.POST, and request.FILES all keep working as they do now. Requires CPython 3.12 or later and Django 6.1, with prebuilt wheels for Linux, macOS, and Windows.

04 Sep 2026 3:00pm GMT

Starting with 0.3.0, Astral's uv brought many great features, including support for cross-platform lock files uv.lock. Together with subsequent fixes, it has become Python's finest workflow tool for my (non-scientific) use cases. Here's how I build production-ready containers, as fast as possible.

06 Aug 2026 12:00am GMT

As I have discussed in previous posts, "AIs" can make mistakes. In fact, they do make mistakes, and their mistake-making patterns are such that where and how they will make mistakes is both uncertain and constantly changing.

Thus, in any scenario where you want to attempt to make "productive" use of "AI", you must have a system in place for checking every result. Not checking some results; checking every result. If each result might have a consequence for you (and if it didn't have a consequence, why bother automating it?) and you cannot predict in advance which kinds of results will need verification, then verification is always required.

The verification often ends up being just as expensive as doing the work in the first place, which means that if you want your usage of "AI" to be personally profitable, you have to find someone else to externalize the cost of verification onto. This person becomes your adversary, and, if you are successful, your "AI's" victim.

The Ladder-Climber And Their Reverse-Centaur Rungs

One way that this constellation of facts can straightforwardly assemble themselves into a dystopian nightmare is the phenomenon, described by Cory Doctorow, of the reverse centaur. This is when your employer non-consensually turns you into the verification system. The "AI" does the fun part of initially performing the work, and then you do the boring part where you check if the robot is right and clean up its messes, even if everyone already knows that it would, in aggregate, be cheaper for you to do the work in the first place.

Reverse centaurs can be made from any automation, not only "AI" automation. I think that there is a reason that this term happens to have emerged in the "age of AI", though, and not with earlier automation technologies (even those which were considerably more viscerally horrific). That reason is: the wrongness of "AI" output is not merely a technical feature that must be compensated for, it is a generalized externality.

As I mentioned above, if you are responsible for the entirety of the work, both extruding the "AI" output and checking it, it's usually cheaper to have humans do the entirety of the work to begin with. When humans do the writing directly, we can check as we go, and thus verification doesn't need to be as comprehensive.

When "AI" coding advocates say "code review is the bottleneck", what they are observing is that the LLM is still rolling the dice for each PR, and a human is still necessary to verify that each of those rolls is a winner. But calling this process "code review" is a bit of a misnomer; it's not really "code review" in the traditional sense, it's human understanding.

Before the advent of "AI", the human understanding was implicit in the process of writing the code in the first place¹, and the code review was a way of diffusing and extending that understanding. Now that the code can be authored with no initial understanding taking place, that cost has not gone away, it has moved.

Human understanding was always the bottleneck.

However, this is taking a collaborative view of a software project, where satisfying the needs and solving the problems of your customers are the goals. We can see that "AI" is a bad tool to satisfy those goals, because all it's doing is converting the first half of the work, that of understanding the code as you write it, to understanding the agent's output as you read it.

What if, instead, we were to take the view that every software company is a Hobbesian nightmare, red in tooth and claw? In this view, the only goal of a software project is for the individual developers to make their promo cycles and get their bonuses. Given that there is only a certain amount of money to go around, this is a zero-sum game where each programmer wants to look more productive than their colleagues.

Pretty much every organization finds it easy to reward "productivity" as expressed by lines of code emitted, but the benefits of doing thorough and thoughtful design, analysis, and code review very difficult to reward. In this world, an LLM is an invaluable tool for the sociopathic ladder-climber, particularly if your legacy organization is still structuring their workflows as if the person prompting the bot is "writing" the code, and then they get to foist off the act of "reviewing" the code onto someone else.

Here, the prompter effectively externalizes the cost of the LLM's failures but internalizes any benefits. The prompter will vibe-code a big feature, so large that the assigned reviewer can't possibly comprehend it all effectively. When this happens, the reviewer will, eventually, be pressured to approve it, even if they can try to spot a few problems along the way. The reviewer has their own work to get back to, after all, the obligation to review the prompter's (read: the bot's) code is a drain on their time that they are not going to get rewarded for.

If this feature is a big success, the prompter gets a promotion. If it causes a big issue, well, the reviewer must not have been careful enough.

This is why LLMs are "good for coding", and also why their biggest promoters keep having outages.

The Generative Gish Galloper

Coding is the biggest "success story" of this type of adversarial communication, but it is by far not the only instance of such a thing. LLMs create a new form of leverage that can turn Brandolini's law from a linear advantage into an exponential one. If you are engaged in a political debate where you want to overwhelm the other side in nonsense, an LLM can generate bullshit faster than it is physically possible for a human being to type, let alone respond thoughtfully. There is an asymmetry to the utility of this weapon as well: only one side of the political spectrum wants to flood the zone and destroy trust in institutions and the concept of truth. There's a good reason that the fascists love it.

Straightforward Spam and Fraud

This is kind of obvious, but LLMs can generate lightly-customized, plausible-looking text much more quickly than any human being. This facilitates their use in fraud, spam, and scams. In a spamming or fraudulent interaction, once again, the costs are externalized onto the victim: the recipient of a spam message has to do all the work of "checking" the LLM's output. Spammers already expect very low hit rates from boilerplate, and if the LLM can increase those percentages from 1% to 5% the technology will pay for itself; they don't need anything like reliable accuracy.

Customer "Support"

If you have any kind of commercial relationship with a company, I probably don't even need to mention this: customer "support" bots are a misery. Everybody knows it at this point. But customer support is usually conceptualized by businesses as an adversarial interaction, because it is a cost center. They maintain internal metrics on time-to-resolution and try to optimize them. Implicitly, this creates a dynamic where the goal of the customer service agent's job is not to solve your problem, but to emit noise that will cause you to think your problem is resolved, or to give up, as fast as possible. Unsurprisingly, LLMs can emit this noise faster than humans can, getting those customers off the phone. But those customers will remember those interactions, and the story outside the TTR metrics is horrible.

Similarly to the situation in software development, LLMs can look very good on paper for customer support, but mostly what they are doing is illuminating the problems with the industry's existing metrics, by turning "winning the metrics battle against the customer" into a more obvious and immediate defeat for the company's long term reputation.

"Education"

In 2026 it is sadly a fact of life that students cheat all the time using "AI", and that this cheating is very successful, in that the teachers find it very hard to detect.

LLMs are great for cheating on schoolwork because the student is externalizing the work of the checking onto the teachers, who are often starting at a disadvantage to begin with, at least in the US.

My view is that this is happening because of a divergence in the way that students vs. teachers (or, more accurately, "the broader educational system") view grading.

When a student is asked to write an essay, the teachers see the effort as both intrinsically worthwhile for the student, as well as useful as a pedagogical tool to evaluate and react to the student's progress. The student, by contrast, sees a stumbling block designed to knock them off the path to success and into a permanent underclass. It is no wonder that the student sees "AI" as useful to their own goals and has no compunction about deploying it.

There is a bitter irony that the ability to understand the inherent value of actually writing the essay on their own is the sort of thing that students can really only learn by writing a bunch of essays. There's no way that I can think of which makes the benefit legible as long as a shortcut is available.

The net effect here is a downward spiral, where the already-wobbling educational system is sustaining an attack that it doesn't have the resources to recover from. The individual students' attacks against their teachers and their schools' grading systems might appear to momentarily succeed, but they will win the battle and lose the war.

Spamming "For Good"?

Usually when we talk about someone unilaterally choosing to enter into an adversarial relationship, that's an "attack" and for good reasons we have a negative impression of the attacker. However, I would be remiss if I did not point out that there are some cases where the relationship was already adversarial; just because you're the attacker doesn't mean that you are evil.

For example we might imagine use-cases like automatically filing appeals for prior authorizations against health insurance. It's relatively well-known at this point that the main way for-profit insurers maintain their margins is by denying claims right up to the line of the policies themselves being fraud, so using a spamming tool to fight them might be entirely justifiable² in that case.

Similarly, using an LLM could be justified in a fight against a company refusing to honor a warranty. One could imagine using an LLM to immediately generate replies and escalations.

However, even in imagined cases like these, the underlying problem is that the insurers and the vendors already have a tremendous amount of structural power, so it is more likely that they will have the advantage in deploying a communications weapon like an LLM, as well as enacting policies to simply ignore any LLM-based communication that you might submit. Worse, if these strategies were to become widespread, they might provide an excuse to reject any communications by feeding them into an unreliable "LLM detector" and issuing an automated "computer says no" even to hand-written correspondence.

It is also worth stressing that these cases are imagined, as compared to the very real coworker-abuse, spam, scam, fraud, and disinformation campaigns being waged in real life today.

Therefore, while legitimate uses might exist, it's hard to imagine that there's anywhere they would be genuinely valuable and sustainable. In the best case "AI" will provide a temporary advantage for underdogs that will provoke an arms race which the resource-advantaged adversaries will win in the long run, in the worst case the arms race itself will cement permanent structural change that will make things worse.

"Search" By Stealing

Most of the adversarial utility of "AI" is on the "write" side, since write-amplification is more obviously aggressive than reading. But the "read" side of LLMs - summarization and question-answering - can be a form of attack as well.

To begin with, the act of reading itself is currently enormously destructive, but that's arguably not a fundamental aspect of this technology. They could set reasonable rate-limits and respect things like robots.txt, as search engines have for decades now. They could also refrain from committing criminal levels of copyright infringement. But, today, using "AI" tools does suborn this sort of out-of-control crawling.

More insidiously, consider the scenario described in this YouTube video. The LTT Bros decided to try Linux again, and in the course of so doing, they had problems. When trying to solve these problems, they were faced with a choice: they could consult Reddit, or they could ask an LLM. Asking an LLM would "gaslight the heck out of" them, but they still found it preferable, because they would at least get an answer without getting yelled at.

Initially this sounds great. But it also means that you want to extract knowledge from a community, while mechanically eliding any values or norms that the community may want to impart as part of offering that knowledge. As someone who spent many years in a community tech support role, this is worrying. Many requests for support are people asking how to do things that will momentarily solve a superficial problem but create a long-term reliability problem or even an immediate security risk, that the question-asker doesn't want to hear about. Consider the question "I'm tired of entering my password so much, how do I make it so my laptop unlocks automatically". An obsequious chatbot will helpfully tell you how to do this without pushback.

But, this is also a sort of ethically murky area. The Linux community is somewhat famously, for many years now, a toxic cesspool of general hostility, misogyny, etc. It is certainly a good thing that people can get access to this knowledge without subjecting themselves to abuse. But it also means that the people with the power and the privilege to change the community for the better can just quietly withdraw, rather than fixing the problems. It also means that the positive elements of culture cannot be transmitted, and people will have no opportunity to learn about unknown unknowns.

In this case, the "adversarial" communication is with society. The thing that using an LLM for search lets you do is withdraw from society and avoid forming any personal connections. There are some personal connections which are painful and annoying, and so that can feel like a momentary balm. But the need to make connections in general is, like, the concept of society itself.

Who Am I Hurting?

LLMs are good at adversarial communication. They are so good at it, relative to their other benefits, that they will tend to make communications adversarial if you are not remaining vigilant about the possibility that it might do so. My request to you, dear reader, if you are going to use such tools, is to always ask yourself, "who might I be hurting, if I use an LLM for this?"

If you're using an "AI", who is its adversary? If you haven't given it one yet, who might the "AI" turn into an adversary? Who might you overwhelm with an asymmetric amount of output, or, if you're receiving information and not sending it, who are you taking that information from without consulting?

Figure out the answers to these questions and conduct yourself accordingly; the answer might be "yourself".

Acknowledgments

Thank you to my patrons who are supporting my writing on this blog. If you like what you've read here and you'd like to read more of it, or you'd like to support my various open-source endeavors, you can support my work as a sponsor!

23 Jun 2026 8:06pm GMT