Who contributed to Django on July 24, 2026?

4 developers shipped this update, including Jacob Walls, carltongibson, M0nd0R, and Tim Schilling.

What were the notable Django updates?

Fixed #36027 -- Made error response rendering thread-sensitive, Fixed #37203 -- Used normalized field names in inspectdb composite primary keys, and Refs #36694 -- Skipped GIS test needing spatial index on Oracle.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO TIGHTENS THREADING FOR ASYNC ERROR HANDLING, GOVERNANCE FRAMEWORK SIMPLIFIED

By RepoJournal · Filed 06:55 UTC on July 24, 2026 · About Django

4 people shipped this

Jacob Walls @jacobtylerwalls 3 cited

carltongibson @carltongibson 1 cited

M0nd0R @M0nd0R 1 cited

Tim Schilling @tim-schilling 1 cited

Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock.

Carlton Gibson landed a fix that forces error response rendering onto request-specific connection threads instead of the event loop's default executor [1]. The change addresses a subtle but dangerous deadlock scenario: when database pooling is enabled or connections are permanently held open, exceptions dispatched to the wrong thread can exhaust the pool entirely. This is the kind of invisible failure that only surfaces under production load with async handlers and database-backed error pages.

On the ORM side, M0nd0R fixed inspectdb to use normalized field names in composite primary keys [2]. The tool was emitting column names from introspection before they were rewritten by normalize_col_name(), creating a mismatch between the generated model and the database schema. Jacob Walls also gated a GIS spatial index test on Oracle to prevent failures on databases that don't support it [3].

The governance desk shipped DEP 0019, a major consolidation of Django's technical governance structure [5]. This is a deliberate simplification: the stated goals were to make governance easier to enact, easier for others to understand, and more flexible with less procedure. This merges and streamlines the previous distributed governance model into a single source of truth. Meanwhile, the release checklists were updated to remove outdated advice about inspecting .po translation files [6].

Workflow permissions were also tightened across the benchmark suite [4], reflecting an organization-level security change requiring explicit write permissions on GitHub Actions workflows.

Action items

→ Review async error handling in your ASGI apps if using database pooling or persistent connections django/django [plan]
→ Regenerate inspectdb models if you have composite primary keys with unusual column names django/django [monitor]
→ Read DEP 0019 to understand the new governance structure django/deps [plan]

References

[1] Fixed #36027 -- Made error response rendering thread-sensitive. ↗ django/django
[2] Fixed #37203 -- Used normalized field names in inspectdb composite primary keys. ↗ django/django
[3] Refs #36694 -- Skipped GIS test needing spatial index on Oracle. ↗ django/django
[4] Add explicit permission to benchmark.yml ↗ django/django-asv
[5] DEP 0019 - Technical governance for the Django project ↗ django/deps
[6] [checklists] Remove advice to inspect *.po files (#2732) django/djangoproject.com

Quick answers

What shipped in Django on July 24, 2026?: Django patches a critical threading issue in async error response rendering that could cause database pool exhaustion and deadlock. In total, 10 commits and 6 pull requests landed.
Who contributed to Django on July 24, 2026?: 4 developers shipped this update, including Jacob Walls, carltongibson, M0nd0R, and Tim Schilling.
What were the notable Django updates?: Fixed #36027 -- Made error response rendering thread-sensitive, Fixed #37203 -- Used normalized field names in inspectdb composite primary keys, and Refs #36694 -- Skipped GIS test needing spatial index on Oracle.

DJANGO 6.1 SUPPORT DATES SET AS DOCUMENTATION CLEANUP CONTINUES

Django pins end-of-support windows for 6.1 while the core team documents shared features between ModelAdmin and InlineModelAdmin.

python 8 shipped 1-min read

@django 2 days ago

DJANGO KILLS SIGNUP BOT ATTACK WITH RECAPTCHA, DAPHNE GAINS WEBSOCKET CONTROL

The Django project site plugged its only unprotected registration form after automated signups tanked email reputation, while Daphne now lets you configure WebSocket message sizes in development.

python 13 shipped 1-min read

@django 3 days ago

DJANGO 6.0.7 PATCHES CRITICAL DOM SANITIZATION VULNERABILITY

Django shipped 6.0.7 overnight with a fix for CVE-2026-53878 that prevents newlines from bypassing DOM sanitization, and the djangoproject.com site is already running it.

python 11 shipped 1-min read

@django 4 days ago

DJANGO MAINTENANCE CYCLE QUIETLY ADVANCING

Performance benchmarks are being tracked and leadership is documenting decisions, but nothing here demands your immediate attention.

python 2 shipped 1-min read

Elsewhere on the wire

AI Agents about 1 hour ago

LANGCHAIN SHIPS COORDINATED PROVIDER UPDATES WITH LANGSMITH GATEWAY SUPPORT

All four core LangChain packages bumped to 1.5.1 overnight with unified LangSmith gateway routing and provider-specific fixes across OpenAI, Anthropic, and Fireworks.

ai-agents 62 shipped 1-min read

Local LLMs about 1 hour ago

LLAMA.CPP SHIPS FIVE RELEASES IN 24 HOURS, FIXES SPECULATIVE DECODING ACROSS THE STACK

The inference stack is consolidating around speculative decoding, and the bugs surfacing there are getting squashed across three major projects simultaneously.

llms 157 shipped 2-min read

@CachyOS about 1 hour ago

INSTALLER REFACTOR TAKES SHAPE, PACKAGE UPDATES ROLL STEADY

CachyOS is modernizing its CLI installer with a comprehensive typed partition system overhaul while maintaining smooth automation across the AUR-derived package repository.

infra 57 shipped 1-min read

Elixir & Phoenix about 1 hour ago

PHOENIX LIVE VIEW SEALS CRITICAL NODE NAME LEAK IN UPLOAD TOKENS

A reverted encryption fix exposes how Phoenix was leaking BEAM node identities through unencrypted upload tokens, and the core team is pivoting to a cleaner solution using term_to_binary.