Who contributed to Django on May 13, 2026?

1 developer shipped this update, including dependabot[bot].

What were the notable Django updates?

Fixed #37095 -- Checked maximum redirect lengths against percent-encoded URLs, Fixed #37096 -- Fixed test_invalid_choice_db_option on Python 3.14.5+, and Fixed #27825 -- Doc'd that setting model fields does not convert types.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO PATCHES REDIRECT LENGTH BUG AND PYTHON 3.14 TEST FAILURES

By RepoJournal · Filed 06:00 UTC on May 13, 2026 · About Django

1 person shipped this

dependabot[bot] @dependabot[bot] 2 cited

Django shipped fixes for a percent-encoded redirect length vulnerability and Python 3.14 compatibility issues that were breaking test suites.

The core fixes land in django/django this cycle: a critical redirect length check [1] now validates against percent-encoded URLs (catching bypass attempts that rely on encoding tricks), and a test compatibility fix [2] resolves failures on Python 3.14.5+ caused by upstream cpython changes. Documentation also got a clarification [3] on why setting model fields doesn't auto-convert types — a common source of subtle bugs. The redirect fix is the one to watch: it closes a security gap in how Django validates max_length on redirects, and teams relying on that validation should verify their implementations handle encoded URLs correctly. Over on djangoproject.com, dependency updates [4] [5] rolled through: requests 2.33.1 cleans up test artifacts from CVE work, and django-debug-toolbar 6.3.0 shipped new improvements. These are routine maintenance — no breaking changes.

Action items

→ Review redirect validation logic in your views if you use max_length checks django/django [plan]
→ Merge the Python 3.14 test fix before upgrading test infrastructure django/django [monitor]
→ Update requests and django-debug-toolbar in your requirements django/djangoproject.com [plan]

References

[1] Fixed #37095 -- Checked maximum redirect lengths against percent-encoded URLs. django/django
[2] Fixed #37096 -- Fixed test_invalid_choice_db_option on Python 3.14.5+. django/django
[3] Fixed #27825 -- Doc'd that setting model fields does not convert types. django/django
[4] Bump requests from 2.33.0 to 2.33.1 in /requirements ↗ django/djangoproject.com
[5] Bump django-debug-toolbar from 6.2.0 to 6.3.0 in /requirements ↗ django/djangoproject.com

Quick answers

What shipped in Django on May 13, 2026?: Django shipped fixes for a percent-encoded redirect length vulnerability and Python 3.14 compatibility issues that were breaking test suites. In total, 3 commits and 5 pull requests landed.
Who contributed to Django on May 13, 2026?: 1 developer shipped this update, including dependabot[bot].
What were the notable Django updates?: Fixed #37095 -- Checked maximum redirect lengths against percent-encoded URLs, Fixed #37096 -- Fixed test_invalid_choice_db_option on Python 3.14.5+, and Fixed #27825 -- Doc'd that setting model fields does not convert types.

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 1 day ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 2 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

@django 3 days ago

DJANGO KILLS SIGNUP BOT ATTACK WITH RECAPTCHA, DAPHNE GAINS WEBSOCKET CONTROL

The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development.

python 13 shipped 1-min read

Elsewhere on the wire

AI Agents about 10 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 10 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.