Who contributed to Django on July 18, 2026?

5 developers shipped this update, including harveybellini, jacobtylerwalls, Carlton Gibson, Natalia, and Sergey Fedoseev.

What were the notable Django updates?

Fixed unauthenticated cross-donor card update in fundraising app, Fixed #35875 -- Added dark mode support to technical 404 and 500 error views, and Added step to install gettext in Github Actions workflows.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO TIGHTENS SECURITY ON FUNDRAISING, SHIPS DARK MODE FOR ERROR PAGES

By RepoJournal · Filed 06:55 UTC on July 18, 2026 · About Django

5 people shipped this

harveybellini @harveybellini 1 cited

jacobtylerwalls @jacobtylerwalls 1 cited

Carlton Gibson @carltongibson 1 cited

Natalia @nessita 1 cited

Sergey Fedoseev @sir-sigurd 1 cited

The Django project fixed a critical authentication bypass in its fundraising app that allowed unauthenticated donors to update other users' payment methods.

The djangoproject.com team patched an unprotected endpoint in the fundraising app [1] where the `update_card()` function accepted a bare donation ID from POST requests with zero authorization checks. An attacker could update any donor's card by guessing or scraping donation IDs. The fix now requires the donor's hero token and scopes the lookup through the authenticated user's donation set, matching patterns already used correctly elsewhere in the codebase. Meanwhile, Django core shipped dark mode support for technical 404 and 500 error pages [2], completing work on ticket #35875 with CSS overrides for the prefers-color-scheme media query. The team also added gettext installation to GitHub Actions workflows [3] to prevent skipped i18n extraction tests. On the documentation front, Django added GeneratedField examples to the PostgreSQL search reference [4] and made the Django Core Developers page discoverable by adding sitemap entries and a route name [5].

Action items

→ Review and apply the fundraising app security patch immediately if you run Django's donation system django/djangoproject.com [immediate]
→ Update your development environment to include gettext for consistent i18n testing django/django [plan]
→ Monitor the dark mode implementation across error pages in your own Django deployments django/django [monitor]

References

[1] Fixed unauthenticated cross-donor card update in fundraising app. django/djangoproject.com
[2] Fixed #35875 -- Added dark mode support to technical 404 and 500 error views. ↗ django/django
[3] Added step to install gettext in Github Actions workflows. ↗ django/django
[4] Fixed #37219 -- Added GeneratedField example to PostgreSQL search reference. django/django
[5] Fixed #2714 -- Made the Django Core Developers page discoverable. (#2715) django/djangoproject.com

Quick answers

What shipped in Django on July 18, 2026?: The Django project fixed a critical authentication bypass in its fundraising app that allowed unauthenticated donors to update other users' payment methods. In total, 9 commits and 10 pull requests landed.
Who contributed to Django on July 18, 2026?: 5 developers shipped this update, including harveybellini, jacobtylerwalls, Carlton Gibson, Natalia, and Sergey Fedoseev.
What were the notable Django updates?: Fixed unauthenticated cross-donor card update in fundraising app, Fixed #35875 -- Added dark mode support to technical 404 and 500 error views, and Added step to install gettext in Github Actions workflows.

ALL QUIET ACROSS THE STACK

Django's benchmark suite logged routine performance metrics overnight with no breaking changes or security advisories in play.

python 1 shipped 1-min read

@django 3 days ago

DJANGO ADMIN PERMISSION CHECKS NOW CONSISTENT ACROSS ALL VIEWS

Django fixed a permission inconsistency in admin views that could have exposed data to staff users lacking proper access.

python 15 shipped 1-min read

@django 4 days ago

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

python 16 shipped 2-min read

@django 5 days ago

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

Elsewhere on the wire

AI Agents about 21 hours ago

CLINE SHIPS FIVE CRITICAL AGENT FIXES AFTER END-TO-END TESTING BLITZ

Saoudrizwan just landed a cascade of fixes that prevent the agent loop from running wild, stop file reads from resolving to the wrong directory, and plug the compaction pipeline.

ai-agents 16 shipped 2-min read

Local LLMs about 21 hours ago

LLAMA.CPP SHIPS MINIMAX-M3 SPARSE ATTENTION, VLLM UNLOCKS HETEROGENEOUS PREFILL-DECODE

The inference stack gets a new model architecture and a fundamental shift in how prefill and decode can run on different hardware configurations.

+10

llms 125 shipped 1-min read

@CachyOS about 21 hours ago

GLIBC 2.43 REBUILD SHIPS, INSTALLER JUMPS TO C++26

CachyOS pushed glibc 2.43 through the pipeline while the CLI installer upgraded its C++ standard to C++26, signaling a major refresh across core infrastructure.

infra 97 shipped 1-min read

Elixir & Phoenix about 21 hours ago

ECTO FIXES SUBQUERY PLANNING IN JOINS, ELIXIR PATCHES IEX PARSING

Ecto's query planner now handles subqueries correctly in interpolated join filters, while Elixir fixes a syntax error that broke 'not in' as a continuation operator in IEx.