Who contributed to Django on May 28, 2026?

3 developers shipped this update, including nessita, jacobtylerwalls, and vishy0.

What were the notable Django updates?

Fixed #36905 -- Deprecated the safe parameter of JSONResponse, Improved release script by adding git tag commit hash and extra tests, and Updated links to severity levels in release notes.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO DROPS UNSAFE JSON RESPONSE PARAMETER

By RepoJournal · Filed 06:00 UTC on May 28, 2026 · About Django

3 people shipped this

nessita @nessita 2 cited

jacobtylerwalls @jacobtylerwalls 1 cited

vishy0 @vishy0 1 cited

Django is deprecating the safe parameter in JSONResponse, finally closing a vulnerability that JavaScript frameworks eliminated years ago.

The safe parameter, a quirk of pre-ES5 JavaScript that allowed JSON injection attacks, is being removed [1]. Every peer framework has already dropped this check. This is a straightforward deprecation path for anyone still passing safe=False to JSONResponse. In related infrastructure work, the release script got hardened with git tag commit hashes and expanded test coverage [2], so future releases will be even more bulletproof. The security docs also got a cleanup pass to link directly to severity level definitions instead of burying context in the disclosure process [3]. On the async auth front, login() and logout() now properly update request.auser when it exists on the request object [4], completing a follow-up that started with earlier async authentication work. Documentation also got a minor fix removing outdated language about unlimited results in QuerySet.get() [5]. The djangoproject.com admin gained better security issue tracking with discovery field exposure and UTC time rendering for checklists [6] [7] [8].

Action items

→ Review code using JSONResponse with safe parameter - plan deprecation removal django/django [plan]
→ Test async login/logout flows to confirm request.auser updates correctly django/django [monitor]
→ Run security issue audits against updated admin checklist tools django/djangoproject.com [monitor]

References

[1] Fixed #36905 -- Deprecated the safe parameter of JSONResponse. django/django
[2] Improved release script by adding git tag commit hash and extra tests. ↗ django/django
[3] Updated links to severity levels in release notes. ↗ django/django
[4] Fixed #37019 -- Updated login() and logout() to set request.auser. ↗ django/django
[5] Fixed #35596 -- Removed mention of unlimited results from QuerySet.get(). django/django
[6] [checklists] Expose "discovery" in SecurityIssue admin fields. ↗ django/djangoproject.com
[7] [checklists] Render checklists title using UTC time. django/djangoproject.com
[8] [checklists] Expose "discovery" in SecurityIssue admin fields. django/djangoproject.com

Quick answers

What shipped in Django on May 28, 2026?: Django is deprecating the safe parameter in JSONResponse, finally closing a vulnerability that JavaScript frameworks eliminated years ago. In total, 11 commits and 7 pull requests landed.
Who contributed to Django on May 28, 2026?: 3 developers shipped this update, including nessita, jacobtylerwalls, and vishy0.
What were the notable Django updates?: Fixed #36905 -- Deprecated the safe parameter of JSONResponse, Improved release script by adding git tag commit hash and extra tests, and Updated links to severity levels in release notes.

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 1 day ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 2 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

@django 3 days ago

DJANGO KILLS SIGNUP BOT ATTACK WITH RECAPTCHA, DAPHNE GAINS WEBSOCKET CONTROL

The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development.

python 13 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.