Who contributed to Django on August 5, 2026?

2 developers shipped this update, including Natalia and Jacob Walls.

What were the notable Django updates?

Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before rendering admin links, Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial lookups, and Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry collections.

@django

Python's batteries-included web framework

github ↗

Pick a date

Topics: Python Full archive →

The Wire · Showcase

DJANGO PATCHES FOUR CRITICAL VULNERABILITIES IN ADMIN AND SPATIAL QUERIES

By RepoJournal · Filed 06:55 UTC on August 5, 2026 · About Django

2 people shipped this

Natalia @nessita 3 cited

Jacob Walls @jacobtylerwalls 2 cited

Django shipped fixes for four CVEs overnight, including a stored XSS in admin URL rendering that could compromise staff accounts and three denial-of-service vectors in geolocation and language handling.

The most dangerous fix addresses CVE-2026-15920, where the admin renders URLField values as clickable links without validating them first [1]. A stored malicious URL could execute script in a staff member's authenticated session when clicked on changelists or read-only forms. Three additional CVEs landed in the same batch: CVE-2026-15307 blocks raster strings and dicts in spatial lookups that could trigger disk writes or network fetches through the GDALRaster constructor [2], CVE-2026-15830 mitigates DoS via nested geometry collections by adding max_geom_collections argument to limit either depth or total count before reaching GEOS [3], and CVE-2026-15337 rejects language codes longer than 500 characters before cache lookup to prevent memory exhaustion [4]. All four have been added to Django's security archive [5]. This is the security batch you patch immediately: URL validation in admin is table-stakes, and the spatial/internationalization DoS vectors hit production deployments using GIS or multi-language features.

Action items

→ Patch Django immediately for CVE-2026-15920 (admin XSS) django/django [immediate]
→ Apply CVE-2026-15307, CVE-2026-15830, CVE-2026-15337 fixes if you use GeoDjango or i18n django/django [immediate]
→ Review admin URLField rendering in your codebase for similar patterns django/django [plan]

References

[1] Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before rendering admin links. django/django
[2] Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial lookups. django/django
[3] Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry collections. django/django
[4] Fixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language(). django/django
[5] Added CVE-2026-15307, CVE-2026-15337, CVE-2026-15830, and CVE-2026-15920 to security archive. django/django

Quick answers

What shipped in Django on August 5, 2026?: Django shipped fixes for four CVEs overnight, including a stored XSS in admin URL rendering that could compromise staff accounts and three denial-of-service vectors in geolocation and language handling. In total, 8 commits and 2 pull requests landed.
Who contributed to Django on August 5, 2026?: 2 developers shipped this update, including Natalia and Jacob Walls.
What were the notable Django updates?: Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before rendering admin links, Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial lookups, and Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry collections.

DJANGO 6.1 LANDS. CHANNELS AND DOCS READY.

Django 6.1 is officially released, and the entire ecosystem has already cut over: Channels pinned the stable dependency, the ticket tracker flipped to 6.1 as default, and the download page went live.

python 19 shipped

@django Aug 4

DJANGO ADDS FREE-THREADED PYTHON 3.14T TO POSTGIS CI

Django is validating free-threaded Python 3.14t against GIS tests, signaling serious commitment to the no-GIL future.

python 14 shipped

@django Aug 3

DJANGO FIXES NULL TIME FIELD HANDLING IN GEOSPATIAL MAPPING

LayerMapping now correctly reads null time fields after a follow-up alignment with OFTDate and OFTDateTime value properties.

python 3 shipped

@django Aug 2

DJANGO-LOCALFLAVOR 5.1 SHIPS WITH VATIN VALIDATOR FIX

Django-localflavor bumped to 5.1 [ref:4], capping a release cycle that fixed a typo in the VATINValidator that could have caused validation edge cases.

python 4 shipped

Elsewhere on the wire

AI Agents Aug 6

LANGCHAIN HARDENS ANTHROPIC TOOL CALLING AND GIT CREDENTIALS AS OPENHANDS SHIPS 1.10.0

LangChain fixed a critical credential leak in evaluation runs while Anthropic tool schemas get proper fallback handling, as three major agent frameworks push releases across the ecosystem.

ai-agents 54 shipped

Local LLMs Aug 6

OLLAMA FIXES KV CACHE CORRUPTION, LLAMA.CPP HARDENS FILE SEARCH, VLLM KILLS MOE LEGACY CODE

Ollama patched a critical cache corruption bug that corrupts lazy snapshots during multi-request prefills, while llama.cpp hardened Windows junction traversal and vLLM removed 14 hardcoded MoE shards across quantization methods.