Who contributed to Django on July 1, 2026?

1 developer shipped this update, including medmunds.

What were the notable Django updates?

Fixed #37162 -- Updated ContactForm docs example to use safe practices, Fixed #37162 -- Updated ContactForm docs example to use safe practices, and Added stub release notes and release date for 6.0.7 and 5.2.16.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO DOCS PATCH FIXES EMAIL SECURITY ANTIPATTERN IN FORMS GUIDE

By RepoJournal · Filed 06:00 UTC on July 1, 2026 · About Django

1 person shipped this

medmunds @medmunds 1 cited

Django's ContactForm documentation example was teaching developers to do exactly what you shouldn't do with user email addresses, and it's finally fixed.

The Forms topic reference docs just got a critical update that removes a textbook security mistake [1]. The old example was using user-provided sender addresses directly as `from_email`, which creates an open door for email spoofing and spam campaigns. Django maintainers renamed the field to `contact_email`, restricted it to `reply_to` only, and identified all outgoing mail as coming from the actual application address instead [2]. They also axed the `cc_myself` checkbox that let forms send arbitrary copies to users, replacing it with an `urgent` field to demonstrate `BooleanField` without the spam liability. This is the kind of quiet documentation fix that prevents a thousand production incidents. Stub release notes are now live for Django 6.0.7 and 5.2.16, signaling patches are locked in and shipping soon [3].

Action items

→ Review your ContactForm implementations against the updated docs pattern django/django [plan]
→ Check if your forms are using user-provided addresses in from_email fields django/django [plan]

References

[1] Fixed #37162 -- Updated ContactForm docs example to use safe practices. ↗ django/django
[2] Fixed #37162 -- Updated ContactForm docs example to use safe practices. django/django
[3] Added stub release notes and release date for 6.0.7 and 5.2.16. django/django

Quick answers

What shipped in Django on July 1, 2026?: Django's ContactForm documentation example was teaching developers to do exactly what you shouldn't do with user email addresses, and it's finally fixed. In total, 3 commits and 1 pull requests landed.
Who contributed to Django on July 1, 2026?: 1 developer shipped this update, including medmunds.
What were the notable Django updates?: Fixed #37162 -- Updated ContactForm docs example to use safe practices, Fixed #37162 -- Updated ContactForm docs example to use safe practices, and Added stub release notes and release date for 6.0.7 and 5.2.16.

ALL QUIET ACROSS THE STACK

Django's benchmark suite logged routine performance metrics overnight with no breaking changes or security advisories in play.

python 1 shipped 1-min read

@django 3 days ago

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 4 days ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 5 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.