Who contributed to Django on July 18, 2026?

5 developers shipped this update, including harveybellini, jacobtylerwalls, Carlton Gibson, Natalia, and Sergey Fedoseev.

What were the notable Django updates?

Fixed unauthenticated cross-donor card update in fundraising app, Fixed #35875 -- Added dark mode support to technical 404 and 500 error views, and Added step to install gettext in Github Actions workflows.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO TIGHTENS SECURITY ON FUNDRAISING, SHIPS DARK MODE FOR ERROR PAGES

By RepoJournal · Filed 06:55 UTC on July 18, 2026 · About Django

5 people shipped this

harveybellini @harveybellini 1 cited

jacobtylerwalls @jacobtylerwalls 1 cited

Carlton Gibson @carltongibson 1 cited

Natalia @nessita 1 cited

Sergey Fedoseev @sir-sigurd 1 cited

The Django project fixed a critical authentication bypass in its fundraising app that allowed unauthenticated donors to update other users' payment methods.

The djangoproject.com team patched an unprotected endpoint in the fundraising app [1] where the `update_card()` function accepted a bare donation ID from POST requests with zero authorization checks. An attacker could update any donor's card by guessing or scraping donation IDs. The fix now requires the donor's hero token and scopes the lookup through the authenticated user's donation set, matching patterns already used correctly elsewhere in the codebase. Meanwhile, Django core shipped dark mode support for technical 404 and 500 error pages [2], completing work on ticket #35875 with CSS overrides for the prefers-color-scheme media query. The team also added gettext installation to GitHub Actions workflows [3] to prevent skipped i18n extraction tests. On the documentation front, Django added GeneratedField examples to the PostgreSQL search reference [4] and made the Django Core Developers page discoverable by adding sitemap entries and a route name [5].

Action items

→ Review and apply the fundraising app security patch immediately if you run Django's donation system django/djangoproject.com [immediate]
→ Update your development environment to include gettext for consistent i18n testing django/django [plan]
→ Monitor the dark mode implementation across error pages in your own Django deployments django/django [monitor]

References

[1] Fixed unauthenticated cross-donor card update in fundraising app. django/djangoproject.com
[2] Fixed #35875 -- Added dark mode support to technical 404 and 500 error views. ↗ django/django
[3] Added step to install gettext in Github Actions workflows. ↗ django/django
[4] Fixed #37219 -- Added GeneratedField example to PostgreSQL search reference. django/django
[5] Fixed #2714 -- Made the Django Core Developers page discoverable. (#2715) django/djangoproject.com

Quick answers

What shipped in Django on July 18, 2026?: The Django project fixed a critical authentication bypass in its fundraising app that allowed unauthenticated donors to update other users' payment methods. In total, 9 commits and 10 pull requests landed.
Who contributed to Django on July 18, 2026?: 5 developers shipped this update, including harveybellini, jacobtylerwalls, Carlton Gibson, Natalia, and Sergey Fedoseev.
What were the notable Django updates?: Fixed unauthenticated cross-donor card update in fundraising app, Fixed #35875 -- Added dark mode support to technical 404 and 500 error views, and Added step to install gettext in Github Actions workflows.

DJANGO TIGHTENS ERROR MESSAGES FOR FIRST-TIME CONTRIBUTORS WHILE FIXING IMPORT HANDLING

Django is making its pull request workflow less intimidating by rewording error messages and clarifying contributor instructions, while simultaneously fixing a regression where management commands swallowed critical ImportErrors.

python 13 shipped 1-min read

@django 2 days ago

DJANGO COMMITS TO FREE-THREADING, LAUNCHES GSOC WORKING GROUP

Django is running full CI on free-threaded Python 3.13t and 3.14t, betting hard on CPython's future while the community formalizes Google Summer of Code efforts.

python 13 shipped 1-min read

@django 3 days ago

ASGIREF 3.12 SHIPS WITH SYNCTOASYNC FIXES AND SECURITY DOCS OVERHAUL

Asgiref 3.12 landed overnight with critical fixes to SyncToAsync internals, while Django's security docs got a major XSS refresh that makes it harder for developers to ship vulnerable code.

python 20 shipped 1-min read

@django 4 days ago

DJANGO CLEANS UP DEPRECATION WARNINGS, MOVES MIDDLEWAREMIXIN

Django fixed a critical issue where deprecation warnings pointed to the wrong code, while quietly relocating MiddlewareMixin to its proper home.

python 14 shipped 1-min read

— or follow the whole beat:

Elsewhere on the wire

@cachyos about 6 hours ago

PACKAGE UPDATES ROLL ACROSS AUR DERIVED AND PROTON CACHYOS

Claude Desktop jumped to 1.22209.0, Zen Browser patched to 1.21.8b, and documentation fixes landed across the stack overnight.

infra 43 shipped 1-min read

Elixir & Phoenix about 6 hours ago

ELIXIR CUTS EXPONENTIAL GROWTH IN BDD INTERSECTIONS, PHOENIX LIVE VIEW SKIPS CLONES ON STABLE LISTS

The compiler just got smarter about preventing exponential blowup in type intersection logic, while Phoenix Live View stops wastefully copying keyed comprehensions that aren't moving.

elixir 16 shipped 1-min read

@dotnet about 6 hours ago

ASPNETCORE TIGHTENS AUTHORIZATION METADATA EVERYWHERE, BLAZOR DEBUGGING EXITS

Authorization policies now work consistently across all routing paths, not just endpoint middleware, while Blazor templates drop their deprecated WebAssembly debugging hook.

dotnet 58 shipped 2-min read

@spring-projects about 6 hours ago

SPRING FRAMEWORK TIGHTENS RESOURCE SECURITY, NEO4J FIXES CONVERSION LOGIC

Spring Framework reinstated critical resource location validation checks that prevent unauthorized static resource resolution in sensitive directories.

java 4 shipped 1-min read