RepoJournal
Django @django
126 wires and counting

$ follow Django

Keep up with Django in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-18
stories 19
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

DJANGO TIGHTENS SECURITY ON FUNDRAISING, SHIPS DARK MODE FOR ERROR PAGES

By RepoJournal · Filed · About Django · Composed from the cited sources · methodology

harveybellini jacobtylerwalls Carlton Gibson Natalia Sergey Fedoseev
5 people shipped this
harveybellini @harveybellini 1 cited jacobtylerwalls @jacobtylerwalls 1 cited Carlton Gibson @carltongibson 1 cited Natalia @nessita 1 cited Sergey Fedoseev @sir-sigurd 1 cited

The Django project fixed a critical authentication bypass in its fundraising app that allowed unauthenticated donors to update other users' payment methods.

The djangoproject.com team patched an unprotected endpoint in the fundraising app [1] where the `update_card()` function accepted a bare donation ID from POST requests with zero authorization checks. An attacker could update any donor's card by guessing or scraping donation IDs. The fix now requires the donor's hero token and scopes the lookup through the authenticated user's donation set, matching patterns already used correctly elsewhere in the codebase. Meanwhile, Django core shipped dark mode support for technical 404 and 500 error pages [2], completing work on ticket #35875 with CSS overrides for the prefers-color-scheme media query. The team also added gettext installation to GitHub Actions workflows [3] to prevent skipped i18n extraction tests. On the documentation front, Django added GeneratedField examples to the PostgreSQL search reference [4] and made the Django Core Developers page discoverable by adding sitemap entries and a route name [5].

Action items

References

  1. [1] Fixed unauthenticated cross-donor card update in fundraising app. ↗ django/djangoproject.com
  2. [2] Fixed #35875 -- Added dark mode support to technical 404 and 500 error views. ↗ django/django
  3. [3] Added step to install gettext in Github Actions workflows. ↗ django/django
  4. [4] Fixed #37219 -- Added GeneratedField example to PostgreSQL search reference. ↗ django/django
  5. [5] Fixed #2714 -- Made the Django Core Developers page discoverable. (#2715) ↗ django/djangoproject.com

$ ls django/reviews/ # the step-back reads

the week in review Django drops PostgreSQL 15 and PostGIS 3.2 the month in review Django 6.1, four CVEs, and a parallel-test fix that kills flaky runs
Topics: Python Full archive → Weekly reviews →

Quick answers

What shipped in Django on July 18, 2026?
The Django project fixed a critical authentication bypass in its fundraising app that allowed unauthenticated donors to update other users' payment methods. In total, 9 commits and 10 pull requests landed.
Who contributed to Django on July 18, 2026?
5 developers shipped this update, including harveybellini, jacobtylerwalls, Carlton Gibson, Natalia, and Sergey Fedoseev.
What were the notable Django updates?
Fixed unauthenticated cross-donor card update in fundraising app, Fixed #35875 -- Added dark mode support to technical 404 and 500 error views, and Added step to install gettext in Github Actions workflows.
♥

$ log @django --recent

Django drops PostgreSQL 15 and PostGIS 3.2, patches an admin date_hierarchy 500 7 shipped GenericIPAddressField accepts ipaddress objects, djangoproject.com tests go multi-browser 27 shipped GeneratedField null check reverted, sponsorship pages rebuilt 17 shipped Django ASV adds ubuntu-latest results, DSF publishes August and September minutes 2 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.