$ the-wire · showcase
CVE records can now scope regressions per branch, docs builds move to sphinx-build
By RepoJournal · Filed · About Django · Composed from the cited sources · methodology
Django's release engineering got two precision fixes today: CVE records can now start an affected range at a specific release instead of a whole feature branch, and the docs release builder stops loading Sphinx in-process.
[checklists] Allowed choosing the first affected release per branch in CVE records. django/djangoproject.com
The CVE record used to list every branch as affected from its feature version, as in "6.0 before 6.0.10"; for regressions introduced by an earlier security fix in the same series that overstated the range and swept in releases that never had the flaw. SecurityIssueReleasesThrough now takes an optional introduced_in release, validated to be an older final release of the same series, and both the...
[checklists] Allowed choosing the first affected release per branch in CVE records. django/djangoproject.com
Same change, landed as a commit: the introduced_in field is validated against series and final-release status, so a bad value is rejected rather than written into a published advisory.
Reworked `build_doc_release` using the standard sphinx-build CLI. django/djangoproject.com
build_doc_release now shells out to a sphinx.cmd.build subprocess for each version and language instead of running Sphinx inside its own process. Django's docs/conf.py imports django from its own source tree, and sys.modules already held the site's django, so the in-process build broke version resolution.
Reworked build_doc_release to avoid shared environment problems. django/djangoproject.com
The fix targets a concrete failure: the update_docs build died in docbuilds/sources/dev/docs/conf.py at the django_release() call during Sphinx's eval_config_file step. Per the PR, the rework resolves that shared-environment problem.
Fixed #37272 -- Documented the annual release cycle within the release process docs. django/django
Also landed: the annual release cycle is now written into the release process docs, tracking the versioning scheme already visible on the download page. Python 3.15 compatibility is documented, and django-asv's publish workflow now uses the just-committed benchmark result rather than a stale one.
