Who contributed to Django on June 30, 2026?

2 developers shipped this update, including dependabot[bot] and timgraham.

What were the notable Django updates?

Bump codecov/codecov-action from 6.0.1 to 7.0.0, Bump actions/checkout from 6.0.3 to 7.0.0, and Bump sentry-sdk from 2.60.0 to 2.63.0 in /requirements.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGOPROJECT.COM TIGHTENS CI PIPELINE WITH MAJOR DEPENDENCY UPGRADES

By RepoJournal · Filed 06:00 UTC on June 30, 2026 · About Django

2 people shipped this

dependabot[bot] @dependabot[bot] 4 cited

timgraham @timgraham 1 cited

The Django web properties team shipped a coordinated security and stability push overnight, upgrading codecov, GitHub Actions, and error tracking in a single wave.

The djangoproject.com site moved codecov/codecov-action from 6.0.1 to 7.0.0 [1], marking a migration away from a compromised keybase account to a fresh security ops account. Actions/checkout jumped to 7.0.0 [2] with new fork PR protections that block untrusted code checkout on pull_request_target events, a critical security hardening for any workflow that accepts external contributions. Sentry SDK bumped to 2.63.0 [3], fixing a double-wrapping bug in FastAPI handlers that could have masked errors in production. Prek, the pre-commit language manager, advanced to 0.4.5 [4] with full coverage across R, Conda, Perl, and coursier ecosystems. Meanwhile, core Django itself cleaned house [5], renaming tests/migrations/test_base.py to base.py to match naming conventions used elsewhere in the test suite and eliminate a confusing misnomer. None of these are breaking changes for downstream teams, but the codecov and actions/checkout upgrades should be pulled into any workflow that mirrors djangoproject.com's CI setup.

Action items

→ Pull codecov/codecov-action 7.0.0 into your CI if you use keybase-backed signing django/djangoproject.com [plan]
→ Review your workflow_run and pull_request_target triggers for fork PR exposure after actions/checkout 7.0.0 upgrade django/djangoproject.com [plan]
→ Monitor Sentry error fingerprinting if you run FastAPI with Sentry SDK 2.60.x django/djangoproject.com [monitor]

References

[1] Bump codecov/codecov-action from 6.0.1 to 7.0.0 ↗ django/djangoproject.com
[2] Bump actions/checkout from 6.0.3 to 7.0.0 ↗ django/djangoproject.com
[3] Bump sentry-sdk from 2.60.0 to 2.63.0 in /requirements ↗ django/djangoproject.com
[4] Bump prek from 0.3.8 to 0.4.5 in /requirements ↗ django/djangoproject.com
[5] Renamed tests/migrations/test_base.py to tests/migrations/base.py. ↗ django/django

Quick answers

What shipped in Django on June 30, 2026?: The Django web properties team shipped a coordinated security and stability push overnight, upgrading codecov, GitHub Actions, and error tracking in a single wave. In total, 2 commits and 5 pull requests landed.
Who contributed to Django on June 30, 2026?: 2 developers shipped this update, including dependabot[bot] and timgraham.
What were the notable Django updates?: Bump codecov/codecov-action from 6.0.1 to 7.0.0, Bump actions/checkout from 6.0.3 to 7.0.0, and Bump sentry-sdk from 2.60.0 to 2.63.0 in /requirements.

ALL QUIET ACROSS THE STACK

Django's benchmark suite logged routine performance metrics overnight with no breaking changes or security advisories in play.

python 1 shipped 1-min read

@django 3 days ago

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 4 days ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 5 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.