Who contributed to Django on May 9, 2026?

6 developers shipped this update, including dependabot[bot], jacobtylerwalls, nessita, aNsHuL5217, CodeVishal-17, and SnippyCodes.

What were the notable Django updates?

Bump django from 5.2.9 to 5.2.13, Refs #36712, #36664 -- Used annotation_format parameter of getfullargspec() on Python 3.15, and Isolated commits from PR #21231 -- Fixed #35514 -- Implemented dictionary-based EMAIL_PROVIDERS.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO 5.2.13 PATCHES CRITICAL UPLOAD VULNERABILITY

By RepoJournal · Filed 06:00 UTC on May 9, 2026 · About Django

6 people shipped this

dependabot[bot] @dependabot[bot] 1 cited

jacobtylerwalls @jacobtylerwalls 1 cited

nessita @nessita 1 cited

aNsHuL5217 @aNsHuL5217 1 cited

CodeVishal-17 @CodeVishal-17 1 cited

SnippyCodes @SnippyCodes 1 cited

Django shipped an emergency security update that enforces upload size limits on request bodies—a gap that could let attackers bypass your DATA_UPLOAD_MAX_MEMORY_SIZE protections.

Code.djangoproject.com just landed Django 5.2.13 [1], which includes CVE-2026-33034, a fix that closes a dangerous hole where request body data wasn't subject to the memory upload ceiling you thought was enforcing. This is the kind of patch that feels minor until you realize someone's been uploading 500MB payloads to your endpoint. Meanwhile, the core Django repo is preparing for Python 3.15 compatibility [2], having adopted the new annotation_format parameter in getfullargspec() just before the feature freeze—good news if you're running bleeding-edge Python. On the feature front, Django landed dictionary-based EMAIL_PROVIDERS [3], decoupling backend tests from settings [4] and fixing a subtle but annoying bug where admin calendar widgets highlighted the wrong date based on timezone mismatches [7]. Djangoproject.com integrated the djade linter [5] for consistent template formatting and rewired the /about redirect [6] to point at /foundation instead of 404ing.

Action items

→ Upgrade to Django 5.2.13 before next deploy—CVE-2026-33034 is a real exposure django/django [immediate]
→ Verify your DATA_UPLOAD_MAX_MEMORY_SIZE settings are in place and test with payloads near the limit django/django [plan]
→ If running Python 3.15, test the annotation_format compatibility changes in your test suite django/django [monitor]

References

[1] Bump django from 5.2.9 to 5.2.13 ↗ django/code.djangoproject.com
[2] Refs #36712, #36664 -- Used annotation_format parameter of getfullargspec() on Python 3.15. ↗ django/django
[3] Isolated commits from PR #21231 -- Fixed #35514 -- Implemented dictionary-based EMAIL_PROVIDERS. ↗ django/django
[4] Refs #35514 -- Decoupled settings from functional EmailBackend tests. django/django
[5] Add djade linter for Django templates (Fixes #2372) ↗ django/djangoproject.com
[6] Redirect /about to /foundation ↗ django/djangoproject.com
[7] Fixed #37074 -- Synced admin calendar today highlight with server time. ↗ django/django

Quick answers

What shipped in Django on May 9, 2026?: Django shipped an emergency security update that enforces upload size limits on request bodies—a gap that could let attackers bypass your DATA_UPLOAD_MAX_MEMORY_SIZE protections. In total, 11 commits and 11 pull requests landed.
Who contributed to Django on May 9, 2026?: 6 developers shipped this update, including dependabot[bot], jacobtylerwalls, nessita, aNsHuL5217, CodeVishal-17, and SnippyCodes.
What were the notable Django updates?: Bump django from 5.2.9 to 5.2.13, Refs #36712, #36664 -- Used annotation_format parameter of getfullargspec() on Python 3.15, and Isolated commits from PR #21231 -- Fixed #35514 -- Implemented dictionary-based EMAIL_PROVIDERS.

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 1 day ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 2 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

@django 3 days ago

DJANGO KILLS SIGNUP BOT ATTACK WITH RECAPTCHA, DAPHNE GAINS WEBSOCKET CONTROL

The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development.

python 13 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.