What were the notable Django updates?

Added CVE-2026-48588, CVE-2026-53877, and CVE-2026-53878 to security archive, Fixed #17631 -- Handled fields and files with the same name in encode_multipart(), and Added stub release notes for 6.0.8.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO PATCHES THREE SECURITY VULNERABILITIES OVERNIGHT

By RepoJournal · Filed 06:00 UTC on July 8, 2026 · About Django

Django archived three CVEs in a single sweep [ref:1], signaling fixes are live across the release line.

The framework locked down CVE-2026-48588, CVE-2026-53877, and CVE-2026-53878 [1], though specific vulnerability details remain under embargo until patches deploy more broadly. More immediately: a long-standing bug in encode_multipart() that silently dropped form field values when files shared the same parameter name is now fixed [2]. This one stings. If your app processes forms with overlapping field and file names (think file uploads on a field called 'attachment'), you've been losing data without knowing it. The fix upgrades to data.lists() instead of data.items() to preserve all values per key. Django 6.0.8 stub release notes are live [3], suggesting a patch drop soon. The admin filter_vertical widget also got a positioning fix for its arrow buttons [4], a small quality-of-life improvement.

Action items

→ Review forms that upload files and fields with matching parameter names - you may be silently losing data django/django [immediate]
→ Watch for Django 6.0.8 release - patch likely within 48 hours given stub notes django/django [monitor]
→ Upgrade to latest patch branch once security fixes publish django/django [plan]

References

[1] Added CVE-2026-48588, CVE-2026-53877, and CVE-2026-53878 to security archive. django/django
[2] Fixed #17631 -- Handled fields and files with the same name in encode_multipart(). django/django
[3] Added stub release notes for 6.0.8. django/django
[4] Fixed #36621 -- Fixed arrow buttons position in admin filter_vertical widget. django/django

Quick answers

What shipped in Django on July 8, 2026?: Django archived three CVEs in a single sweep [ref:1], signaling fixes are live across the release line. In total, 7 commits and 3 pull requests landed.
What were the notable Django updates?: Added CVE-2026-48588, CVE-2026-53877, and CVE-2026-53878 to security archive, Fixed #17631 -- Handled fields and files with the same name in encode_multipart(), and Added stub release notes for 6.0.8.

ALL QUIET ACROSS THE STACK

Django's benchmark suite logged routine performance metrics overnight with no breaking changes or security advisories in play.

python 1 shipped 1-min read

@django 3 days ago

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 4 days ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 5 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.