Who contributed to Django on July 15, 2026?

4 developers shipped this update, including VIZZARD-X, vismaytiwari, Jacob Walls, and carltongibson.

What were the notable Django updates?

Releasing 3.12.0, Releasing 3.12.1, and Restore previous SyncToAsync.__call__ internal code shape.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

ASGIREF 3.12 SHIPS WITH SYNCTOASYNC FIXES AND SECURITY DOCS OVERHAUL

By RepoJournal · Filed 06:55 UTC on July 15, 2026 · About Django

4 people shipped this

carltongibson @carltongibson 5 cited

Jacob Walls @jacobtylerwalls 4 cited

VIZZARD-X @VIZZARD-X 2 cited

vismaytiwari @vismaytiwari 2 cited

Asgiref 3.12 landed overnight with critical fixes to SyncToAsync internals, while Django's security docs got a major XSS refresh that makes it harder for developers to ship vulnerable code.

In brief

ASGIREF 3.12.0 is out. SyncToAsync internals got rewired to fix edge cases in the call path. If you're running sync code in async contexts, this one's worth the upgrade—fewer surprises under load.
Django's XSS security docs just got a serious pass. Clearer guidance on context-aware escaping and template filter risks. Reading docs before shipping templates? Now even harder to get wrong.
cached_db session backend now logs when cache deletes fail. Silent failures are gone. You'll actually know when your cache is flaking out instead of wondering why sessions feel stale.
ASGIREF decoupled mypy from its test suite. Faster test runs, cleaner dependency graph. Small win but the kind that compounds when you're iterating on async code.

Asgiref 3.12.0 and 3.12.1 are live [1][2], addressing a regression in SyncToAsync.__call__ that broke the internal code shape [3][4]. This fix matters because async-to-sync bridging is foundational to Django's async story, and the previous implementation had child partials in the wrong state. The release also separates mypy from the tests extra [5], reducing friction for projects that don't need type checking in CI.

On the Django side, the security documentation got a significant rewrite focused on the XSS section [6][7]. This isn't just cosmetics: clearer guidance on Cross Site Scripting directly prevents the mistakes that land in production. The cached_db session backend now logs cache delete failures instead of letting them propagate [8][9], matching the existing write-failure behavior and improving observability for session-heavy applications.

Release infrastructure moved forward too. The djangoproject.com release checklists now include a step to bump asgiref [10][11], closing the gap that led to version skew in prior releases. James Bligh joined the Triage & Review working group [12][13], bringing fresh capacity to the review queue.

Action items

→ Pin asgiref to 3.12.1 in your next Django deployment django/asgiref [plan]
→ Review the XSS section in Django's security docs with your team django/django [monitor]
→ Verify cached_db session logging is enabled in staging django/django [plan]

References

[1] Releasing 3.12.0 django/asgiref
[2] Releasing 3.12.1 django/asgiref
[3] Restore previous SyncToAsync.__call__ internal code shape. django/asgiref
[4] Restore previous SyncToAsync.__call__ internal code shape. ↗ django/asgiref
[5] Separate mypy from tests extra. django/asgiref
[6] Fixed #37131 -- Improved XSS section in security documentation. django/django
[7] Fixed #37131 -- Improved XSS section in security documentation. ↗ django/django
[8] Fixed #37210 -- Logged cached_db session cache delete failures. ↗ django/django
[9] Fixed #37210 -- Logged cached_db session cache delete failures. django/django
[10] [checklists] Add step to bump asgiref django/djangoproject.com
[11] [checklists] Add step to bump asgiref ↗ django/djangoproject.com
[12] Add James Bligh to Triage & Review WG members django/dsf-working-groups
[13] Add James Bligh to Triage & Review WG members ↗ django/dsf-working-groups

Quick answers

What shipped in Django on July 15, 2026?: Asgiref 3.12 landed overnight with critical fixes to SyncToAsync internals, while Django's security docs got a major XSS refresh that makes it harder for developers to ship vulnerable code. In total, 12 commits and 8 pull requests landed.
Who contributed to Django on July 15, 2026?: 4 developers shipped this update, including VIZZARD-X, vismaytiwari, Jacob Walls, and carltongibson.
What were the notable Django updates?: Releasing 3.12.0, Releasing 3.12.1, and Restore previous SyncToAsync.__call__ internal code shape.

DJANGO CLEANS UP DEPRECATION WARNINGS, MOVES MIDDLEWAREMIXIN

Django fixed a critical issue where deprecation warnings pointed to the wrong code, while quietly relocating MiddlewareMixin to its proper home.

python 14 shipped 1-min read

@django 2 days ago

ASGIREF PLUGS THREAD LEAK AHEAD OF PYTHON 3.14

Django's async foundation discovered and fixed a critical data leak in Local when running against free-threading builds, the same builds that will power Python 3.14.

python 15 shipped 1-min read

@django 4 days ago

DJANGO FIXES MODULE LOADING AND MIGRATION TRACKING IN MAJOR UTILITY OVERHAUL

Django's import_string utility now handles full module paths and submodules, closing a long-standing gap in the framework's import capabilities.

python 13 shipped 1-min read

@django 5 days ago

DJANGO COMMONS JOINS ECOSYSTEM, BRAZIL CNPJ VALIDATOR GOES ALPHANUMERIC

The Django community officially expanded its affiliated programs list while localflavor shipped a proactive validator update to support Brazil's new alphanumeric CNPJ format arriving in mid-2026.

python 16 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 6 hours ago

CACHYOS MIRRORS HOLDING STEADY, AUR PACKAGES ROLLING UPDATES

All China mirrors are responding normally while the AUR-derived package queue processes five consecutive version bumps across developer tools.

infra 44 shipped 1-min read

Elixir & Phoenix about 6 hours ago

ELIXIR FIXES ENUM SORTER BUG THAT BROKE CUSTOM COMPARATORS

Enum.min and Enum.max were silently returning wrong results when you passed a custom sorter on ranges, and the core team just caught it.

elixir 16 shipped 1-min read

@dotnet about 6 hours ago

MATH.ROUND BUG CORRUPTS 5% OF INPUTS. EVENTPIPE LOSES HEAP DATA. SQLCLIENT GOES ASYNC

Runtime shipped a critical fix for Math.Round that was silently mangling roughly 5% of all rounding operations across the BCL, while EventPipe's data loss is finally getting a blocking mode to save your GC dumps.

dotnet 78 shipped 1-min read

@spring-projects about 6 hours ago

SPRING BOOT FIXES LAZY INITIALIZATION TRAP THAT BREAKS JPA APPS

Spring Boot patched a critical dependency loop where JPA configuration was forcing early instantiation of every AsyncTaskExecutor bean in your app, even when background bootstrapping wasn't enabled.

java 33 shipped 1-min read