RepoJournal
Django

@django

Python's batteries-included web framework

What actually shipped in Django, written up every day — commits, pull requests, releases, and security advisories.

One email a day. Unsubscribe in one click.

Pick a date

  1. Sat 13 jun
  2. Sun 14 jun
  3. Mon 15 jun
  4. Tue 16 jun
  5. Wed 17 jun
  6. Thu 18 jun
  7. Fri 19 jun
  8. Sat 27 jun
  9. Sun 28 jun
  10. Mon 29 jun
  11. Tue 30 jun
  12. Wed 1 jul
  13. Thu 2 jul
  14. Fri 3 jul
  15. Sat 4 jul
  16. Sun 5 jul
  17. Tue 7 jul
  18. Wed 8 jul
  19. Thu 9 jul
  20. Fri 10 jul
  21. Sat 11 jul
  22. Mon 13 jul
  23. Tue 14 jul
  24. Wed 15 jul
  25. Thu 16 jul
  26. Fri 17 jul
  27. Sat 18 jul
  28. Sun 19 jul
  29. Mon 20 jul
  30. Today 21 jul
Topics: Python Full archive →

The Wire · Showcase

DJANGO 6.0.7 PATCHES CRITICAL DOM SANITIZATION VULNERABILITY

By RepoJournal · Filed · About Django

dependabot Jacob Walls cliffordgama sarahboyce
4 people shipped this
dependabot @dependabot 4 cited Jacob Walls @jacobtylerwalls 2 cited cliffordgama @cliffordgama 1 cited sarahboyce @sarahboyce 1 cited

Django shipped 6.0.7 overnight with a fix for CVE-2026-53878 that prevents newlines from bypassing DOM sanitization, and the djangoproject.com site is already running it.

The security patch [1] landed in the 6.0.x branch and is now in production on djangoproject.com, meaning this one moves fast. The vulnerability was in DOM handling where newline characters could slip through sanitization checks, creating potential injection vectors. On the core Django side, the PostGIS schema editor got fixed [2] after a report exposed missing index options in spatial index creation, a precision fix that matters for anyone using geodata heavily. Test infrastructure improvements landed across two fronts: facet filter tests [3] [4] that were failing sporadically because UserAdmin wasn't being registered in the default admin site, which meant ordering assertions could fail randomly. Documentation also tightened up around cache_page behavior [5], clarifying that it caches responses before response middleware runs, which prevents a whole class of silent caching bugs. The djangoproject.com dependencies rolled forward [6] [7] [8] with django-money 3.6.1, coverage 7.15.1, and Playwright 1.61.0 to keep the test and build infrastructure current.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] Bump django from 6.0.6 to 6.0.7 in /requirements ↗ django/djangoproject.com
  2. [2] Fixed #36694 -- Restored missing index options in PostGISSchemaEditor._create_spatial_index_sql(). ↗ django/django
  3. [3] Refs #32539 -- Fixed flaky facet filter tests. django/django
  4. [4] Refs #32539 -- Fixed flaky facet filter tests. ↗ django/django
  5. [5] Refs #15855 -- Documented that cache_page caches responses before response middleware runs. ↗ django/django
  6. [6] Bump django-money from 3.6.0 to 3.6.1 in /requirements ↗ django/djangoproject.com
  7. [7] Bump coverage from 7.14.3 to 7.15.1 in /requirements ↗ django/djangoproject.com
  8. [8] Bump playwright from 1.60.0 to 1.61.0 in /requirements ↗ django/djangoproject.com

Quick answers

What shipped in Django on July 21, 2026?
Django shipped 6.0.7 overnight with a fix for CVE-2026-53878 that prevents newlines from bypassing DOM sanitization, and the djangoproject.com site is already running it. In total, 4 commits and 7 pull requests landed.
Who contributed to Django on July 21, 2026?
4 developers shipped this update, including cliffordgama, Jacob Walls, sarahboyce, and dependabot.
What were the notable Django updates?
Bump django from 6.0.6 to 6.0.7 in /requirements, Fixed #36694 -- Restored missing index options in PostGISSchemaEditor._create_spatial_index_sql(), and Refs #32539 -- Fixed flaky facet filter tests.

More from @django

Django @django

DJANGO MAINTENANCE CYCLE QUIETLY ADVANCING

Performance benchmarks are being tracked and leadership is documenting decisions, but nothing here demands your immediate attention.

Priya Pahwa
python 2 shipped 1-min read
Django @django

ASGIREF PURGES ARCHIVED NGINX UNIT, FIXES BROKEN DEPENDENCY LINKS

Django's ASGIREF is cleaning house, removing the archived and unmaintained NGINX Unit while fixing outdated documentation links that have been steering developers to broken URLs.

rhoboro
python 5 shipped 1-min read
Django @django

DJANGO TIGHTENS SECURITY ON FUNDRAISING, SHIPS DARK MODE FOR ERROR PAGES

The Django project fixed a critical authentication bypass in its fundraising app that allowed unauthenticated donors to update other users' payment methods.

harveybellini jacobtylerwalls Carlton Gibson Natalia +1
python 19 shipped 1-min read
Django @django

DJANGO TIGHTENS ERROR MESSAGES FOR FIRST-TIME CONTRIBUTORS WHILE FIXING IMPORT HANDLING

Django is making its pull request workflow less intimidating by rewording error messages and clarifying contributor instructions, while simultaneously fixing a regression where management commands swallowed critical ImportErrors.

StephanieAG jacobtylerwalls Ben Cail Adam Zapletal +1
python 13 shipped 1-min read

Daily updates, in your inbox

Follow Django

What actually shipped in Django, written up every day — commits, pull requests, releases, and security advisories.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

CachyOS @cachyos

NORWAY MIRROR DOWN, KERNEL STACK SHIPS MAINTENANCE RELEASES

CachyOS infrastructure is reporting a downed Norway mirror while the kernel and toolchain stacks push routine version bumps across the board.

Piotr Gorski Matias miwakasa ptr1337 +2
infra 55 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ECTO GAINS FRAGMENT COLUMN NAMING, PHOENIX PLUGS GET SMARTER

Ecto's new with_columns/2 lets you assign names to SQL fragments, while Phoenix now handles module plugs with options in pipe_through declarations.

José Valim AlexGx preciz Flo0807 +3
elixir 14 shipped 1-min read
Mobile platforms Mobile platforms

KOTLIN RIPS OUT INTERPRETER GUTS, FLUTTER PATCHES RENDERING PIPELINE

Kotlin is systematically removing its IR interpreter in a multi-commit cleanup that signals a major shift in how the compiler handles intermediate representation, while Flutter ships critical Vulkan safety fixes and expands autofill support.

Mohellebi Abdessalem jason-simmons Valentin Vignal jameskrupnik +7
mobile 115 shipped 2-min read
.NET @dotnet

MAUI 11 PREVIEW 6 SHIPS WITH 190 COMMITS, MACIOS FIXES GENERATOR FLAKINESS

.NET MAUI 11.0.0-preview.6 landed with significant platform improvements while dotnet/macios tackles a critical test parallelization bug that was silently dropping thread-safety calls from generated code.

kubaflo Shane Neuville rolfbjarne VincentBu +6
dotnet 59 shipped 2-min read
Want every project, not just this one?