Who contributed to Django on May 23, 2026?

3 developers shipped this update, including varunkasyap, nessita, and jacobtylerwalls.

What were the notable Django updates?

Fixed #37100 -- Prevented control characters in HttpResponse reason_phrase, Fixed #37117 -- Used ModelAdmin.get_queryset() for change form actions, and Fixed #37117 -- Used ModelAdmin.get_queryset() for change form actions.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO TIGHTENS SECURITY ON HTTP HEADERS AND ADMIN QUERYSETS

By RepoJournal · Filed 06:00 UTC on May 23, 2026 · About Django

3 people shipped this

varunkasyap @varunkasyap 1 cited

nessita @nessita 1 cited

jacobtylerwalls @jacobtylerwalls 1 cited

Django patched control character injection in HttpResponse headers and fixed a critical inconsistency where admin change forms ignored custom queryset filtering.

The security fix [1] blocks control characters in HttpResponse reason_phrase attributes, preventing header injection attacks that could slip malicious content past validators. This closes a gap that existed because the reason_phrase setter had no validation, making it a clear exploit vector. On the admin side, a consistency fix [2] resolves ticket #37117 by making change form actions respect ModelAdmin.get_queryset() the same way the change list does [3]. Before this patch, admins with custom queryset logic (annotations, stricter filtering, custom managers) would see different data in the change form than in the list, creating silent data integrity issues. The djangoproject.com release checklist was also prepped for the next alpha cycle [4] with branch protection rule automation and ReadTheDocs corrections [5] [6], setting the pipeline for smoother future releases.

Action items

→ Review admin change forms for custom get_queryset() logic and test against this patch django/django [plan]
→ Audit any code setting HttpResponse reason_phrase with user input django/django [immediate]
→ Watch djangoproject.com release checklist changes for alpha branch workflow updates django/djangoproject.com [monitor]

References

[1] Fixed #37100 -- Prevented control characters in HttpResponse reason_phrase. ↗ django/django
[2] Fixed #37117 -- Used ModelAdmin.get_queryset() for change form actions. ↗ django/django
[3] Fixed #37117 -- Used ModelAdmin.get_queryset() for change form actions. django/django
[4] [checklists] Removed stable branch prefix from feature freeze man page update. django/djangoproject.com
[5] [checklists] Fixed typo in ReadTheDocs search step. django/djangoproject.com
[6] [checklists] Updates after 6.1 alpha ↗ django/djangoproject.com

Quick answers

What shipped in Django on May 23, 2026?: Django patched control character injection in HttpResponse headers and fixed a critical inconsistency where admin change forms ignored custom queryset filtering. In total, 9 commits and 3 pull requests landed.
Who contributed to Django on May 23, 2026?: 3 developers shipped this update, including varunkasyap, nessita, and jacobtylerwalls.
What were the notable Django updates?: Fixed #37100 -- Prevented control characters in HttpResponse reason_phrase, Fixed #37117 -- Used ModelAdmin.get_queryset() for change form actions, and Fixed #37117 -- Used ModelAdmin.get_queryset() for change form actions.

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 1 day ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 2 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

@django 3 days ago

DJANGO KILLS SIGNUP BOT ATTACK WITH RECAPTCHA, DAPHNE GAINS WEBSOCKET CONTROL

The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development.

python 13 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.