What were the notable Django updates?

Refs CVE-2026-6873 -- Moved deprecation note for SIGNED_COOKIE_LEGACY_SALT_FALLBACK, Refs #34118 -- Removed further asgiref coroutine detection shims in tests, and Refs #36593 -- Added missing deprecation note for select_related() with no arguments.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO PATCHES COOKIE SECURITY FLAW, CLEANS UP DEPRECATION DEBT

By RepoJournal · Filed 06:00 UTC on June 18, 2026 · About Django

Django moved fast on CVE-2026-6873, shifting the deprecation timeline for SIGNED_COOKIE_LEGACY_SALT_FALLBACK as the framework tightens its security posture.

The cookie vulnerability fix [1] lands alongside a broader cleanup of deprecation warnings that have been cluttering the codebase. Django removed asgiref coroutine detection shims from tests [2], a follow-up to earlier refactoring that modernizes how the framework handles async operations. Three additional deprecation notices hit the wire in quick succession: select_related() called without arguments [3] now properly warns developers before it becomes an error, the safe parameter in JSONResponse [4] got its missing deprecation banner, and a smaller but useful fix made Action directly importable from django.contrib.admin [5], reducing boilerplate imports across admin customizations. This is standard Django housekeeping, but the cookie security move signals the team is tightening controls on legacy fallbacks.

Action items

→ Review your use of select_related() and JSONResponse.safe parameter - deprecation warnings are now active django/django [plan]
→ Update admin code to import Action directly from django.contrib.admin instead of submodules django/django [monitor]
→ Audit SIGNED_COOKIE_LEGACY_SALT_FALLBACK usage ahead of removal timeline shift django/django [plan]

References

[1] Refs CVE-2026-6873 -- Moved deprecation note for SIGNED_COOKIE_LEGACY_SALT_FALLBACK. django/django
[2] Refs #34118 -- Removed further asgiref coroutine detection shims in tests. django/django
[3] Refs #36593 -- Added missing deprecation note for select_related() with no arguments. django/django
[4] Refs #36905 -- Added missing deprecation note for safe parameter of JSONResponse. django/django
[5] Fixed #37176 -- Made Action importable from django.contrib.admin. django/django

Quick answers

What shipped in Django on June 18, 2026?: Django moved fast on CVE-2026-6873, shifting the deprecation timeline for SIGNED_COOKIE_LEGACY_SALT_FALLBACK as the framework tightens its security posture. In total, 6 commits and 4 pull requests landed.
What were the notable Django updates?: Refs CVE-2026-6873 -- Moved deprecation note for SIGNED_COOKIE_LEGACY_SALT_FALLBACK, Refs #34118 -- Removed further asgiref coroutine detection shims in tests, and Refs #36593 -- Added missing deprecation note for select_related() with no arguments.

ALL QUIET ACROSS THE STACK

Django's benchmark suite logged routine performance metrics overnight with no breaking changes or security advisories in play.

python 1 shipped 1-min read

@django 3 days ago

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 4 days ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 5 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.