Who contributed to Django on May 5, 2026?

2 developers shipped this update, including varunkasyap and Skyiesac.

What were the notable Django updates?

Fixed #36767 -- Allowed max redirect URL length to be set on HttpResponseRedirect, Fixed #37078 -- Deprecated SHA-1 default for salted_hmac() and base64_hmac() algorithm, and Fixed #36459 -- Added Aria labels to the buttons inside the AdminDate Widget.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO TIGHTENS REDIRECT LIMITS AND CRYPTO DEFAULTS

By RepoJournal · Filed 06:00 UTC on May 5, 2026 · About Django

2 people shipped this

varunkasyap @varunkasyap 1 cited

Skyiesac @Skyiesac 1 cited

Django now lets you override hardcoded redirect URL length caps, while quietly deprecating SHA-1 as the default hash algorithm ahead of a breaking change in 7.0.

The headline story: HttpResponseRedirect and the redirect() shortcut now accept an optional max_length parameter [1], finally giving you control over URL length validation instead of hitting a wall. This ships with a sensible default but lets you disable the limit entirely for edge cases that demand it. Separately, Django is deprecating SHA-1 as the default algorithm for salted_hmac() and base64_hmac() [2]—the shift to SHA-256 lands in 7.0, so any custom crypto code relying on implicit SHA-1 needs attention now. On the accessibility front, AdminDate Widget buttons now carry proper Aria labels [3], closing a long-standing a11y gap that affects screen reader users. The ecosystem page also corrected a routing error: django-impersonate was pointing to an unmaintained fork; the original repository is now the official link [4]. Documentation cleanup continued with outdated iterator() notes removed .

Action items

→ Audit code using salted_hmac() or base64_hmac() — add explicit algorithm='sha256' before Django 7.0 django/django [plan]
→ If you've hit redirect URL limits, test the new max_length parameter in your next sprint django/django [monitor]
→ Update any bookmarks or docs pointing to django-impersonate — use the maintained original repo django/djangoproject.com [plan]

References

[1] Fixed #36767 -- Allowed max redirect URL length to be set on HttpResponseRedirect. ↗ django/django
[2] Fixed #37078 -- Deprecated SHA-1 default for salted_hmac() and base64_hmac() algorithm. django/django
[3] Fixed #36459 -- Added Aria labels to the buttons inside the AdminDate Widget. ↗ django/django
[4] Link maintained version of django-impersonate django/djangoproject.com

Quick answers

What shipped in Django on May 5, 2026?: Django now lets you override hardcoded redirect URL length caps, while quietly deprecating SHA-1 as the default hash algorithm ahead of a breaking change in 7.0. In total, 10 commits and 9 pull requests landed.
Who contributed to Django on May 5, 2026?: 2 developers shipped this update, including varunkasyap and Skyiesac.
What were the notable Django updates?: Fixed #36767 -- Allowed max redirect URL length to be set on HttpResponseRedirect, Fixed #37078 -- Deprecated SHA-1 default for salted_hmac() and base64_hmac() algorithm, and Fixed #36459 -- Added Aria labels to the buttons inside the AdminDate Widget.

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 1 day ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 2 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

@django 3 days ago

DJANGO KILLS SIGNUP BOT ATTACK WITH RECAPTCHA, DAPHNE GAINS WEBSOCKET CONTROL

The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development.

python 13 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.