RepoJournal
Django

@django

Python's batteries-included web framework

What actually shipped in Django, written up every day — commits, pull requests, releases, and security advisories.

One email a day. Unsubscribe in one click.

Pick a date

  1. Sun 14 jun
  2. Mon 15 jun
  3. Tue 16 jun
  4. Wed 17 jun
  5. Thu 18 jun
  6. Fri 19 jun
  7. Sat 27 jun
  8. Sun 28 jun
  9. Mon 29 jun
  10. Tue 30 jun
  11. Wed 1 jul
  12. Thu 2 jul
  13. Fri 3 jul
  14. Sat 4 jul
  15. Sun 5 jul
  16. Tue 7 jul
  17. Wed 8 jul
  18. Thu 9 jul
  19. Fri 10 jul
  20. Sat 11 jul
  21. Mon 13 jul
  22. Tue 14 jul
  23. Wed 15 jul
  24. Thu 16 jul
  25. Fri 17 jul
  26. Sat 18 jul
  27. Sun 19 jul
  28. Mon 20 jul
  29. Tue 21 jul
  30. Today 22 jul
Topics: Python Full archive →

The Wire · Showcase

DJANGO KILLS SIGNUP BOT ATTACK WITH RECAPTCHA, DAPHNE GAINS WEBSOCKET CONTROL

By RepoJournal · Filed · About Django

dependabot nessita Dmytro Berezovskyi pre-commit-ci VIZZARD-X Phinart98 pre-commit-ci[bot]
8 people shipped this
dependabot @dependabot 2 cited nessita @nessita 1 cited Dmytro Berezovskyi @corvis 1 cited pre-commit-ci @pre-commit-ci 1 cited VIZZARD-X @VIZZARD-X 1 cited Phinart98 @Phinart98 1 cited pre-commit-ci[bot] @pre-commit-ci[bot] Carlton Gibson @carltongibson

The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development.

Djangoproject.com added ReCAPTCHA V3 to its self-serve registration form [1], the only public endpoint that wasn't protected. Bots were hammering it directly into activation emails to fake addresses, generating hard bounces that degraded the site's email sending reputation. The fix mirrors the same protection already in place on the contact and fundraising forms. Over on Daphne [2], you can now configure websocket-max-message-size and websocket-max-frame-size via CLI argument or Django setting when running the dev server, which closes the loop on applications that needed tighter control over incoming WebSocket traffic. Django core shipped documentation fixes for CSRF context processor clarity [6] and improved SVG icon contrast in the default debug page [7], addressing accessibility issues in High Contrast mode. Build infrastructure got minor bumps across the board: djangoproject.com updated actions/setup-python to 6.3.0 [3], Channels jumped to v7 [4], and pre-commit linting tools advanced across Daphne [5].

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] Added a reCAPTCHA to the account registration form. ↗ django/djangoproject.com
  2. [2] Add ability to configure websocket message size when running as django dev server ↗ django/daphne
  3. [3] Bump actions/setup-python from 6 to 6.3.0 ↗ django/djangoproject.com
  4. [4] Bump actions/setup-python from 6 to 7 ↗ django/channels
  5. [5] [pre-commit.ci] pre-commit autoupdate ↗ django/daphne
  6. [6] Fixed #37032 -- Documented that the CSRF context processor is always enabled in its reference documentation. ↗ django/django
  7. [7] Fixed #36229 -- Improved SVG icon color contrast in django/views/templates/default_urlconf.html. ↗ django/django

Quick answers

What shipped in Django on July 22, 2026?
The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development. In total, 6 commits and 7 pull requests landed.
Who contributed to Django on July 22, 2026?
8 developers shipped this update, including nessita, dependabot, Dmytro Berezovskyi, pre-commit-ci[bot], pre-commit-ci, Carlton Gibson, VIZZARD-X, and Phinart98.
What were the notable Django updates?
Added a reCAPTCHA to the account registration form, Add ability to configure websocket message size when running as django dev server, and Bump actions/setup-python from 6 to 6.3.0.

More from @django

Django @django

DJANGO 6.0.7 PATCHES CRITICAL DOM SANITIZATION VULNERABILITY

Django shipped 6.0.7 overnight with a fix for CVE-2026-53878 that prevents newlines from bypassing DOM sanitization, and the djangoproject.com site is already running it.

cliffordgama Jacob Walls sarahboyce dependabot
python 11 shipped 1-min read
Django @django

DJANGO MAINTENANCE CYCLE QUIETLY ADVANCING

Performance benchmarks are being tracked and leadership is documenting decisions, but nothing here demands your immediate attention.

Priya Pahwa
python 2 shipped 1-min read
Django @django

ASGIREF PURGES ARCHIVED NGINX UNIT, FIXES BROKEN DEPENDENCY LINKS

Django's ASGIREF is cleaning house, removing the archived and unmaintained NGINX Unit while fixing outdated documentation links that have been steering developers to broken URLs.

rhoboro
python 5 shipped 1-min read
Django @django

DJANGO TIGHTENS SECURITY ON FUNDRAISING, SHIPS DARK MODE FOR ERROR PAGES

The Django project fixed a critical authentication bypass in its fundraising app that allowed unauthenticated donors to update other users' payment methods.

harveybellini jacobtylerwalls Carlton Gibson Natalia +1
python 19 shipped 1-min read

Daily updates, in your inbox

Follow Django

What actually shipped in Django, written up every day — commits, pull requests, releases, and security advisories.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

CachyOS @cachyos

PROTON 11.0 SHIPS WITH LOW-LATENCY VKD3D, MIRROR NETWORK EXPANDS

Proton 11.0 lands experimental low-latency graphics support while CachyOS adds a Hungary mirror to its distribution tier.

Turi Balázs cantosun99 github-actions github-actions[bot] +1
infra 45 shipped 1-min read
Elixir & Phoenix Elixir & Phoenix

ELIXIR TOOLING FIXES LAND AHEAD OF SYSTEM COMPATIBILITY PUSH

The compiler stops misinterpreting profile flags, string reversal handles invalid UTF8 correctly, and Ecto gains fragment column selection in a wave of fixes that shores up core library reliability.

Alexander Gubarev Frank Hunleth greg-rychlewski
elixir 11 shipped 1-min read
.NET @dotnet

COMPLEX NUMBERS NOW IEEE 754 COMPLIANT, SKILLS EVALS GO VALLY-ONLY, UNSAFE EVOLVES

Complex<T> just shipped conformance to C23 Annex G special values, dotnet/skills completed its migration to the Vally eval harness, and the language is tightening unsafe semantics ahead of C# 13.

tannergooding matouskozak EgorBo AbhitejJohn +7
dotnet 141 shipped 2-min read
Spring @spring-projects

SPRING BOOT TIGHTENS NULLABILITY CHECKS, FRAMEWORK CLEANS HOUSE

Spring Boot merged improvements to Nullaway 0.13.8 that correctly handle Map#remove nullability, while Spring Framework shipped targeted fixes for logging clarity and documentation.

Stéphane Nicoll Manu Sridharan filiphr Tran Ngoc Nhan +2
java 17 shipped 1-min read
Want every project, not just this one?