RepoJournal
Django @django
170 wires and counting

$ follow Django

Keep up with Django in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-11-04
stories 21
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

Six CVEs patched in Django, including a GDAL SRS forgery fix

By RepoJournal · Filed · About Django · Composed from the cited sources · methodology

Jacob Walls Natalia Andrew James Gonzalez sarahboyce Jake Howard tim-schilling
6 people shipped this
Jacob Walls @jacobtylerwalls 2 cited Natalia @nessita 1 cited Andrew James Gonzalez @bruhdev1290 1 cited sarahboyce @sarahboyce 1 cited Jake Howard @RealOrangeOne tim-schilling @tim-schilling

Django landed four security fixes covering six archived CVEs, one of them a request-forgery path in spatial reference handling that sits on GDAL's default file and network resolution.

Fixed CVE-2026-114582 -- Blocked file and network access when setting SRS on GDAL 3.9+. django/django

by Jacob Walls

Anything instantiating SpatialReference, including vector and raster transform() methods and the srs/srid setters, could be fed untrusted strings that GDAL resolved as file or network references. On GDAL 3.9+ Django now calls OSRSetFromUserInputEx() to block that access; on lower GDAL versions the fix does not apply, and the commit tells users to compare inputs against an allow list.

Fixed CVE-2026-113733 -- Fixed password hash disclosure to "view only" admin users with custom user models. django/django

by Natalia

Since Django 6.0 the admin obfuscated a password hash only when the field's model was exactly AUTH_USER_MODEL, so other user models and models inheriting the password field from a concrete parent displayed the full hash to view-only users. If your project has a custom user model, that is the hole.

Fixed CVE-2026-113593 -- Differentiated empty and missing headers in response cache. django/django

by Andrew James Gonzalez

A missing header and an empty header now produce different response cache keys, as RFC 9111 requires. Previously the cache could conflate the two, serving a variant it had learned under the wrong key.

Added CVE-2026-108147, CVE-2026-111211, CVE-2026-111362, CVE-2026-113593, CVE-2026-113733, and CVE-2026-114582 to security archive. django/django

by Jacob Walls

The security archive gained entries for CVE-2026-108147, CVE-2026-111211, CVE-2026-111362, CVE-2026-113593, CVE-2026-113733 and CVE-2026-114582.

Enforced ticket assignment limits and triage restrictions. django/code.djangoproject.com

by sarahboyce

Trac now caps how many tickets a user can hold assigned and restricts triage stages, closing a pair of long-standing requests. And in the quieter corners: the security archive grew by six CVE entries, reporting now allows one vulnerability per email, djangoproject.com stopped escaping quoted terms like "superuser" into prenotification emails, and django-asv added ubuntu-latest results.

$ ls django/reviews/ # the step-back reads

the week in review Django adds HTTP QUERY method support the month in review Django ships five security fixes, including formsets
Full archive → Weekly reviews →

Quick answers

What shipped in Django on November 4, 2026?
Django landed four security fixes covering six archived CVEs, one of them a request-forgery path in spatial reference handling that sits on GDAL's default file and network resolution. In total, 16 commits and 5 pull requests landed.
Who contributed to Django on November 4, 2026?
6 developers shipped this update, including Jake Howard, Jacob Walls, Natalia, Andrew James Gonzalez, tim-schilling, and sarahboyce.
What were the notable Django updates?
Fixed CVE-2026-114582 -- Blocked file and network access when setting SRS on GDAL 3.9+, Fixed CVE-2026-113733 -- Fixed password hash disclosure to "view only" admin users with custom user models, and Fixed CVE-2026-113593 -- Differentiated empty and missing headers in response cache.
♥

$ log @django --recent

Deferred fields survive peer fetches, cookie deletion fixed 12 shipped django-asv adds ubuntu-latest benchmark results 1 shipped Dependabot config fixed, ubuntu-latest benchmarks landed 3 shipped Django's docs move to pydata-sphinx-theme, with deploys pre-staged 10 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training MILES wall-clock stops resume by default, retained generation state in learning examples Agent Security Judge prompts stop leaking to hooks-server logs

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.