RepoJournal
Django @django
160 wires and counting

$ follow Django

Keep up with Django in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-13
stories 8
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

DJANGO PATCHES REDIRECT LENGTH BUG AND PYTHON 3.14 TEST FAILURES

By RepoJournal · Filed · About Django · Composed from the cited sources · methodology

dependabot[bot]
1 person shipped this
dependabot[bot] @dependabot[bot] 2 cited

Django shipped fixes for a percent-encoded redirect length vulnerability and Python 3.14 compatibility issues that were breaking test suites.

The core fixes land in django/django this cycle: a critical redirect length check [1] now validates against percent-encoded URLs (catching bypass attempts that rely on encoding tricks), and a test compatibility fix [2] resolves failures on Python 3.14.5+ caused by upstream cpython changes. Documentation also got a clarification [3] on why setting model fields doesn't auto-convert types — a common source of subtle bugs. The redirect fix is the one to watch: it closes a security gap in how Django validates max_length on redirects, and teams relying on that validation should verify their implementations handle encoded URLs correctly. Over on djangoproject.com, dependency updates [4] [5] rolled through: requests 2.33.1 cleans up test artifacts from CVE work, and django-debug-toolbar 6.3.0 shipped new improvements. These are routine maintenance — no breaking changes.

$ ls django/reviews/ # the step-back reads

the week in review CVE records can scope regressions per branch the month in review Django drops PostgreSQL 15 and PostGIS 3.2
Full archive → Weekly reviews →

Quick answers

What shipped in Django on May 13, 2026?
Django shipped fixes for a percent-encoded redirect length vulnerability and Python 3.14 compatibility issues that were breaking test suites. In total, 3 commits and 5 pull requests landed.
Who contributed to Django on May 13, 2026?
1 developer shipped this update, including dependabot[bot].
What were the notable Django updates?
Fixed #37095 -- Checked maximum redirect lengths against percent-encoded URLs, Fixed #37096 -- Fixed test_invalid_choice_db_option on Python 3.14.5+, and Fixed #27825 -- Doc'd that setting model fields does not convert types.
♥

$ log @django --recent

Ubuntu-latest results land in the Django benchmark suite 1 shipped cached_property deprecation lands, asgiref 3.13.0 ships 13 shipped ThreadSensitiveContext gains nesting, Q.check() escapes logged DB errors 22 shipped Windows CI gets gettext, djangosnippets drops a dead dependency 8 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training GSM8K scoring parses answers as exact decimals AI Red Teaming PyRIT closes a judge-spoofing hole, promptfoo accepts Langfuse v6

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.