Who contributed to Django on May 7, 2026?

3 developers shipped this update, including nessita, jacobtylerwalls, and medmunds.

What were the notable Django updates?

Fixed #36784 -- Added csp_nonce_attr template tag for CSP nonce inclusion, Fixed #36300 -- Restored the semantic where RemoteUserMiddleware.header corresponds to request.META under ASGI, and Fixed #36300 -- Restored the semantic where RemoteUserMiddleware.header corresponds to request.META under ASGI.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO SHIPS CSP NONCE TAG AND FIXES ASGI AUTHENTICATION REGRESSION

By RepoJournal · Filed 06:00 UTC on May 7, 2026 · About Django

3 people shipped this

nessita @nessita 1 cited

jacobtylerwalls @jacobtylerwalls 1 cited

medmunds @medmunds 1 cited

Django merged three security and authentication fixes overnight that close gaps in ASGI middleware behavior and add a critical content security policy helper.

The headliner is a new `{% csp_nonce_attr %}` template tag [1] that handles CSP nonce injection explicitly — a cleaner pattern than the old workarounds for securing inline scripts and stylesheets. This ships alongside two authentication fixes that matter more than they first appear: Django 5.2 introduced a regression where RemoteUserMiddleware behaved differently under ASGI than WSGI [2] [3], forcing proxy operators to rewrite headers in incompatible ways. That's fixed now. The team also clarified the security posture of RemoteUserMiddleware itself , tightening documentation around header spoofing risks. A fourth commit [4] stages test infrastructure for incoming email provider integrations, suggesting a larger feature is landing in the next cycle. All four are cherry-picks or targeted fixes — no breaking changes, all backport candidates.

Action items

→ Review RemoteUserMiddleware configuration if running ASGI in production — verify header names match documented format django/django [plan]
→ Adopt {% csp_nonce_attr %} in templates using inline scripts — removes need for manual context injection django/django [monitor]
→ Watch djangoproject.com for playwright test suite rollout — regression tests are failing as expected django/djangoproject.com [monitor]

References

[1] Fixed #36784 -- Added csp_nonce_attr template tag for CSP nonce inclusion. ↗ django/django
[2] Fixed #36300 -- Restored the semantic where RemoteUserMiddleware.header corresponds to request.META under ASGI. django/django
[3] Fixed #36300 -- Restored the semantic where RemoteUserMiddleware.header corresponds to request.META under ASGI. ↗ django/django
[4] Refs #35514 -- Prepared for email providers. ↗ django/django

Quick answers

What shipped in Django on May 7, 2026?: Django merged three security and authentication fixes overnight that close gaps in ASGI middleware behavior and add a critical content security policy helper. In total, 16 commits and 7 pull requests landed.
Who contributed to Django on May 7, 2026?: 3 developers shipped this update, including nessita, jacobtylerwalls, and medmunds.
What were the notable Django updates?: Fixed #36784 -- Added csp_nonce_attr template tag for CSP nonce inclusion, Fixed #36300 -- Restored the semantic where RemoteUserMiddleware.header corresponds to request.META under ASGI, and Fixed #36300 -- Restored the semantic where RemoteUserMiddleware.header corresponds to request.META under ASGI.

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 1 day ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 2 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

@django 3 days ago

DJANGO KILLS SIGNUP BOT ATTACK WITH RECAPTCHA, DAPHNE GAINS WEBSOCKET CONTROL

The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development.

python 13 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.