Who contributed to Django on July 25, 2026?

4 developers shipped this update, including nessita, jacobtylerwalls, Mike Edmunds, and dependabot.

What were the notable Django updates?

Fixed #37160 -- Made admin views raise PermissionDenied consistently, Fixed #37160 -- Made admin views raise PermissionDenied consistently, and Removed outdated Python 2 references from contributing docs.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

By RepoJournal · Filed 06:55 UTC on July 25, 2026 · About Django

4 people shipped this

dependabot @dependabot 4 cited

nessita @nessita 3 cited

jacobtylerwalls @jacobtylerwalls 1 cited

Mike Edmunds @medmunds 1 cited

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

The admin interface now enforces uniform permission checks across all views [1]. Previously, view_on_site and history views could be accessed by staff without the required view or change permissions, while changeform and autocomplete views properly blocked access. This fix ensures that an HTTP 403 response is returned consistently when a user lacks the necessary permissions [2]. Beyond security, Django's docs got a housekeeping pass: outdated Python 2 references were stripped from contributing guidelines [3], email documentation typos were corrected with proper versionadded annotations [4], and a grab bag of accumulated typos across the codebase is staged for merge [5]. Over on djangoproject.com, the team bumped four Docker GitHub Actions in quick succession: docker/metadata-action, docker/login-action, docker/build-push-action, and docker/setup-compose-action, all preserving esbuild bundle names for consistency [6] [7] [8] [9].

Action items

→ Review your Django admin integration if staff users access sensitive models; test permission enforcement on view_on_site and history endpoints django/django [plan]
→ Update djangoproject.com Docker Actions dependencies on your next deployment cycle django/djangoproject.com [monitor]

References

[1] Fixed #37160 -- Made admin views raise PermissionDenied consistently. ↗ django/django
[2] Fixed #37160 -- Made admin views raise PermissionDenied consistently. django/django
[3] Removed outdated Python 2 references from contributing docs. django/django
[4] Fixed typo and versionadded locations in email docs. django/django
[5] Grab bag of typo fixes. ↗ django/django
[6] Bump docker/metadata-action from 6.1.0 to 6.2.0 ↗ django/djangoproject.com
[7] Bump docker/login-action from 4.2.0 to 4.4.0 ↗ django/djangoproject.com
[8] Bump docker/build-push-action from 7.2.0 to 7.3.0 ↗ django/djangoproject.com
[9] Bump docker/setup-compose-action from 2.2.0 to 2.3.0 ↗ django/djangoproject.com

Quick answers

What shipped in Django on July 25, 2026?: Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access. In total, 8 commits and 7 pull requests landed.
Who contributed to Django on July 25, 2026?: 4 developers shipped this update, including nessita, jacobtylerwalls, Mike Edmunds, and dependabot.
What were the notable Django updates?: Fixed #37160 -- Made admin views raise PermissionDenied consistently, Fixed #37160 -- Made admin views raise PermissionDenied consistently, and Removed outdated Python 2 references from contributing docs.

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 2 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

@django 3 days ago

DJANGO KILLS SIGNUP BOT ATTACK WITH RECAPTCHA, DAPHNE GAINS WEBSOCKET CONTROL

The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development.

python 13 shipped 1-min read

@django 4 days ago

DJANGO 6.0.7 PATCHES CRITICAL DOM SANITIZATION VULNERABILITY

Django shipped 6.0.7 overnight with a fix for CVE-2026-53878 that prevents newlines from bypassing DOM sanitization, and the djangoproject.com site is already running it.

python 11 shipped 1-min read

Elsewhere on the wire

AI Agents about 5 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 5 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.