RepoJournal
Django @django
160 wires and counting

$ follow Django

Keep up with Django in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-06
stories 8
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

DJANGO PATCHES THREE CRITICAL CACHE AND UPLOAD VULNERABILITIES

By RepoJournal · Filed · About Django · Composed from the cited sources · methodology

Django shipped fixes overnight for three security flaws affecting cache headers, session handling, and ASGI file uploads that could let attackers bypass critical safety limits.

Three CVEs hit the archive simultaneously [1], each addressing a distinct attack surface. CVE-2026-6907 [2] fixes a cache poisoning vulnerability where requests with wildcard Vary headers were being cached when they shouldn't be — a bypass that could serve stale data to the wrong users. CVE-2026-35192 [3] ensures the Vary header is actually sent when SESSION_SAVE_EVERY_REQUEST=True, preventing session fixation attacks in certain configurations. The most dangerous is CVE-2026-5766 [4], which exploits ASGI deployments specifically: attackers could declare a small Content-Length header while uploading massive files, bypassing DATA_UPLOAD_MAX_MEMORY_SIZE entirely and crashing your workers. The ASGI vulnerability is critical if you're running Django on async servers — the fix enforces memory limits regardless of what the client claims to be sending.

$ ls django/reviews/ # the step-back reads

the week in review CVE records can scope regressions per branch the month in review Django drops PostgreSQL 15 and PostGIS 3.2
Full archive → Weekly reviews →

Quick answers

What shipped in Django on May 6, 2026?
Django shipped fixes overnight for three security flaws affecting cache headers, session handling, and ASGI file uploads that could let attackers bypass critical safety limits. In total, 7 commits and 1 pull requests landed.
What were the notable Django updates?
Added CVE-2026-5766, CVE-2026-35192, and CVE-2026-6907 to security archive, Fixed CVE-2026-6907 -- Prevented caching of requests when Vary header contains an asterisk, and Fixed CVE-2026-35192 -- Ensured Vary header is sent when setting session cookie with SESSION_SAVE_EVERY_REQUEST=True.
♥

$ log @django --recent

Ubuntu-latest results land in the Django benchmark suite 1 shipped cached_property deprecation lands, asgiref 3.13.0 ships 13 shipped ThreadSensitiveContext gains nesting, Q.check() escapes logged DB errors 22 shipped Windows CI gets gettext, djangosnippets drops a dead dependency 8 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training GSM8K scoring parses answers as exact decimals AI Red Teaming PyRIT closes a judge-spoofing hole, promptfoo accepts Langfuse v6

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.