Who contributed to Django on May 8, 2026?

4 developers shipped this update, including MiladZarour, sipa-echo-zaoa, nessita, and sarahboyce.

What were the notable Django updates?

Fixed #37084 -- Added CSP nonce context processor system check, Fixed #37060 -- Propagated AlterField through attname-based to_field …, and Fixed #37085 -- Added support for object-based form media stylesheet assets.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO TIGHTENS CSP SECURITY CHECKS AND FIXES MIGRATION EDGE CASES

By RepoJournal · Filed 06:00 UTC on May 8, 2026 · About Django

4 people shipped this

MiladZarour @MiladZarour 1 cited

sipa-echo-zaoa @sipa-echo-zaoa 1 cited

nessita @nessita 1 cited

sarahboyce @sarahboyce 1 cited

Django added automatic system checks to catch misconfigured Content Security Policy middleware, while patching a critical migration bug that broke AlterField propagation through relation chains.

The framework shipped a new security system check [1] that warns developers when ContentSecurityPolicyMiddleware is enabled with CSP nonce support but the required context processor isn't configured—a footgun that would silently break template rendering in production. Alongside that, the ORM landed a fix [2] for AlterField migrations that failed to propagate type changes when relations used `to_field` with attribute name aliases instead of explicit field names, a subtle trap for complex model inheritance. Form media handling got smarter [3] with support for object-based stylesheet assets, letting you define media dependencies without string manipulation. On the security desk, a system check for deploy-time validation [4] was moved out of the deploy checks list after being misclassified. The docs team cleaned up security release checklists [5] with better code formatting for future disclosure posts [6], and added validation to the CVE year field [7] to ensure consistency with sorting. If you're using CSP nonces or complex migration chains, these fixes matter. If you're shipping form media objects soon, this is your green light.

Action items

→ Review ContentSecurityPolicyMiddleware setup for csp context processor configuration django/django [plan]
→ Test any migrations with AlterField on transitive relations using to_field django/django [plan]
→ Update form media definitions to use object-based assets if applicable django/django [monitor]

References

[1] Fixed #37084 -- Added CSP nonce context processor system check. ↗ django/django
[2] Fixed #37060 -- Propagated AlterField through attname-based to_field … ↗ django/django
[3] Fixed #37085 -- Added support for object-based form media stylesheet assets. ↗ django/django
[4] Refs #15727 -- Moved security.E026 out of list of deploy=True checks. django/django
[5] [checklists] Minor improvements following recent security release ↗ django/djangoproject.com
[6] [checklists] Minor corrections to security checklist bullets. django/djangoproject.com
[7] [checklists] Added RegexValidator to cve_year_number to ensure created issues are compatible with cve_sort_key. django/djangoproject.com

Quick answers

What shipped in Django on May 8, 2026?: Django added automatic system checks to catch misconfigured Content Security Policy middleware, while patching a critical migration bug that broke AlterField propagation through relation chains. In total, 8 commits and 5 pull requests landed.
Who contributed to Django on May 8, 2026?: 4 developers shipped this update, including MiladZarour, sipa-echo-zaoa, nessita, and sarahboyce.
What were the notable Django updates?: Fixed #37084 -- Added CSP nonce context processor system check, Fixed #37060 -- Propagated AlterField through attname-based to_field …, and Fixed #37085 -- Added support for object-based form media stylesheet assets.

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 1 day ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 2 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

@django 3 days ago

DJANGO KILLS SIGNUP BOT ATTACK WITH RECAPTCHA, DAPHNE GAINS WEBSOCKET CONTROL

The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development.

python 13 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.