RepoJournal
Django @django
126 wires and counting

$ follow Django

Keep up with Django in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-09
stories 22
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

DJANGO 5.2.13 PATCHES CRITICAL UPLOAD VULNERABILITY

By RepoJournal · Filed · About Django · Composed from the cited sources · methodology

dependabot[bot] jacobtylerwalls nessita aNsHuL5217 CodeVishal-17 SnippyCodes
6 people shipped this
dependabot[bot] @dependabot[bot] 1 cited jacobtylerwalls @jacobtylerwalls 1 cited nessita @nessita 1 cited aNsHuL5217 @aNsHuL5217 1 cited CodeVishal-17 @CodeVishal-17 1 cited SnippyCodes @SnippyCodes 1 cited

Django shipped an emergency security update that enforces upload size limits on request bodies—a gap that could let attackers bypass your DATA_UPLOAD_MAX_MEMORY_SIZE protections.

Code.djangoproject.com just landed Django 5.2.13 [1], which includes CVE-2026-33034, a fix that closes a dangerous hole where request body data wasn't subject to the memory upload ceiling you thought was enforcing. This is the kind of patch that feels minor until you realize someone's been uploading 500MB payloads to your endpoint. Meanwhile, the core Django repo is preparing for Python 3.15 compatibility [2], having adopted the new annotation_format parameter in getfullargspec() just before the feature freeze—good news if you're running bleeding-edge Python. On the feature front, Django landed dictionary-based EMAIL_PROVIDERS [3], decoupling backend tests from settings [4] and fixing a subtle but annoying bug where admin calendar widgets highlighted the wrong date based on timezone mismatches [7]. Djangoproject.com integrated the djade linter [5] for consistent template formatting and rewired the /about redirect [6] to point at /foundation instead of 404ing.

Action items

References

  1. [1] Bump django from 5.2.9 to 5.2.13 ↗ django/code.djangoproject.com
  2. [2] Refs #36712, #36664 -- Used annotation_format parameter of getfullargspec() on Python 3.15. ↗ django/django
  3. [3] Isolated commits from PR #21231 -- Fixed #35514 -- Implemented dictionary-based EMAIL_PROVIDERS. ↗ django/django
  4. [4] Refs #35514 -- Decoupled settings from functional EmailBackend tests. ↗ django/django
  5. [5] Add djade linter for Django templates (Fixes #2372) ↗ django/djangoproject.com
  6. [6] Redirect /about to /foundation ↗ django/djangoproject.com
  7. [7] Fixed #37074 -- Synced admin calendar today highlight with server time. ↗ django/django

$ ls django/reviews/ # the step-back reads

the week in review Django drops PostgreSQL 15 and PostGIS 3.2 the month in review Django 6.1, four CVEs, and a parallel-test fix that kills flaky runs
Topics: Python Full archive → Weekly reviews →

Quick answers

What shipped in Django on May 9, 2026?
Django shipped an emergency security update that enforces upload size limits on request bodies—a gap that could let attackers bypass your DATA_UPLOAD_MAX_MEMORY_SIZE protections. In total, 11 commits and 11 pull requests landed.
Who contributed to Django on May 9, 2026?
6 developers shipped this update, including dependabot[bot], jacobtylerwalls, nessita, aNsHuL5217, CodeVishal-17, and SnippyCodes.
What were the notable Django updates?
Bump django from 5.2.9 to 5.2.13, Refs #36712, #36664 -- Used annotation_format parameter of getfullargspec() on Python 3.15, and Isolated commits from PR #21231 -- Fixed #35514 -- Implemented dictionary-based EMAIL_PROVIDERS.
♥

$ log @django --recent

Django drops PostgreSQL 15 and PostGIS 3.2, patches an admin date_hierarchy 500 7 shipped GenericIPAddressField accepts ipaddress objects, djangoproject.com tests go multi-browser 27 shipped GeneratedField null check reverted, sponsorship pages rebuilt 17 shipped Django ASV adds ubuntu-latest results, DSF publishes August and September minutes 2 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.