Who contributed to Django on June 27, 2026?

2 developers shipped this update, including jacobtylerwalls and medmunds.

What were the notable Django updates?

Fixed #37184 -- Allowed non-UTF-8 bytes passwords in the PBKDF2 and MD5 password hashers, Fixed #37184 -- Allowed non-UTF-8 bytes passwords in the PBKDF2 and MD5 password hashers, and Fixed #37191 -- Prevented ValueError in FileBasedCache.touch() for expired keys.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO PATCHES PASSWORD HASHER REGRESSION THAT BROKE NON-UTF8 INPUTS

By RepoJournal · Filed 06:00 UTC on June 27, 2026 · About Django

2 people shipped this

jacobtylerwalls @jacobtylerwalls 1 cited

medmunds @medmunds 1 cited

Django shipped a critical fix for a bug introduced in recent versions where PBKDF2 and MD5 password hashers reject valid passwords containing non-UTF-8 bytes, breaking authentication for legitimate use cases.

The regression stems from an unnecessary `force_str()` call in the PBKDF2 hasher that raised `UnicodeDecodeError` on perfectly valid password values [1]. The MD5 hasher had the same issue, fixed by removing the UTF-8 validity constraint and concatenating with `force_bytes()` instead [2]. If you're using either hasher with binary password data or non-ASCII input, this patch restores functionality that broke in 78fac1b0473. In related fixes, Django also prevented `FileBasedCache.touch()` from raising `ValueError` when called on expired keys [3], eliminating a silent crash when cache maintenance runs on stale entries. Documentation got a precision update distinguishing "plaintext" from "plain-text" in password hasher docs to clarify whether `make_password()` expects UTF-8 encoded text or raw password material [4].

Action items

→ If using PBKDF2 or MD5 hashers with non-UTF8 passwords, pull the latest Django patch immediately django/django [immediate]
→ Test FileBasedCache.touch() calls in your caching logic after upgrading django/django [plan]
→ Monitor for any authentication failures in production during this week's deployments django/django [monitor]

References

[1] Fixed #37184 -- Allowed non-UTF-8 bytes passwords in the PBKDF2 and MD5 password hashers. ↗ django/django
[2] Fixed #37184 -- Allowed non-UTF-8 bytes passwords in the PBKDF2 and MD5 password hashers. django/django
[3] Fixed #37191 -- Prevented ValueError in FileBasedCache.touch() for expired keys. django/django
[4] Clarified "plaintext" vs. "plain-text" in password hashers docs. ↗ django/django

Quick answers

What shipped in Django on June 27, 2026?: Django shipped a critical fix for a bug introduced in recent versions where PBKDF2 and MD5 password hashers reject valid passwords containing non-UTF-8 bytes, breaking authentication for legitimate use cases. In total, 5 commits and 4 pull requests landed.
Who contributed to Django on June 27, 2026?: 2 developers shipped this update, including jacobtylerwalls and medmunds.
What were the notable Django updates?: Fixed #37184 -- Allowed non-UTF-8 bytes passwords in the PBKDF2 and MD5 password hashers, Fixed #37184 -- Allowed non-UTF-8 bytes passwords in the PBKDF2 and MD5 password hashers, and Fixed #37191 -- Prevented ValueError in FileBasedCache.touch() for expired keys.

ALL QUIET ACROSS THE STACK

Django's benchmark suite logged routine performance metrics overnight with no breaking changes or security advisories in play.

python 1 shipped 1-min read

@django 3 days ago

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 4 days ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 5 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.