RepoJournal
Django @django
126 wires and counting

$ follow Django

Keep up with Django in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-21
stories 11
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

DJANGO 6.0.7 PATCHES CRITICAL DOM SANITIZATION VULNERABILITY

By RepoJournal · Filed · About Django · Composed from the cited sources · methodology

dependabot Jacob Walls cliffordgama sarahboyce
4 people shipped this
dependabot @dependabot 4 cited Jacob Walls @jacobtylerwalls 2 cited cliffordgama @cliffordgama 1 cited sarahboyce @sarahboyce 1 cited

Django shipped 6.0.7 overnight with a fix for CVE-2026-53878 that prevents newlines from bypassing DOM sanitization, and the djangoproject.com site is already running it.

The security patch [1] landed in the 6.0.x branch and is now in production on djangoproject.com, meaning this one moves fast. The vulnerability was in DOM handling where newline characters could slip through sanitization checks, creating potential injection vectors. On the core Django side, the PostGIS schema editor got fixed [2] after a report exposed missing index options in spatial index creation, a precision fix that matters for anyone using geodata heavily. Test infrastructure improvements landed across two fronts: facet filter tests [3] [4] that were failing sporadically because UserAdmin wasn't being registered in the default admin site, which meant ordering assertions could fail randomly. Documentation also tightened up around cache_page behavior [5], clarifying that it caches responses before response middleware runs, which prevents a whole class of silent caching bugs. The djangoproject.com dependencies rolled forward [6] [7] [8] with django-money 3.6.1, coverage 7.15.1, and Playwright 1.61.0 to keep the test and build infrastructure current.

Action items

References

  1. [1] Bump django from 6.0.6 to 6.0.7 in /requirements ↗ django/djangoproject.com
  2. [2] Fixed #36694 -- Restored missing index options in PostGISSchemaEditor._create_spatial_index_sql(). ↗ django/django
  3. [3] Refs #32539 -- Fixed flaky facet filter tests. ↗ django/django
  4. [4] Refs #32539 -- Fixed flaky facet filter tests. ↗ django/django
  5. [5] Refs #15855 -- Documented that cache_page caches responses before response middleware runs. ↗ django/django
  6. [6] Bump django-money from 3.6.0 to 3.6.1 in /requirements ↗ django/djangoproject.com
  7. [7] Bump coverage from 7.14.3 to 7.15.1 in /requirements ↗ django/djangoproject.com
  8. [8] Bump playwright from 1.60.0 to 1.61.0 in /requirements ↗ django/djangoproject.com

$ ls django/reviews/ # the step-back reads

the week in review Django drops PostgreSQL 15 and PostGIS 3.2 the month in review Django 6.1, four CVEs, and a parallel-test fix that kills flaky runs
Topics: Python Full archive → Weekly reviews →

Quick answers

What shipped in Django on July 21, 2026?
Django shipped 6.0.7 overnight with a fix for CVE-2026-53878 that prevents newlines from bypassing DOM sanitization, and the djangoproject.com site is already running it. In total, 4 commits and 7 pull requests landed.
Who contributed to Django on July 21, 2026?
4 developers shipped this update, including cliffordgama, Jacob Walls, sarahboyce, and dependabot.
What were the notable Django updates?
Bump django from 6.0.6 to 6.0.7 in /requirements, Fixed #36694 -- Restored missing index options in PostGISSchemaEditor._create_spatial_index_sql(), and Refs #32539 -- Fixed flaky facet filter tests.
♥

$ log @django --recent

Django drops PostgreSQL 15 and PostGIS 3.2, patches an admin date_hierarchy 500 7 shipped GenericIPAddressField accepts ipaddress objects, djangoproject.com tests go multi-browser 27 shipped GeneratedField null check reverted, sponsorship pages rebuilt 17 shipped Django ASV adds ubuntu-latest results, DSF publishes August and September minutes 2 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks

$ ls showcases/

Rails Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic OpenAI

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.