Django 6.1, four CVEs, and a parallel-test fix that kills flaky runs

Django 6.1 landed mid-month, and the security and stability work around it mattered more than the new features. The release included fixes for four critical vulnerabilities in the admin and spatial queries: CVE-2026-15920 makes display_for_field() validate URLs before rendering admin links, and CVE-2026-15307 blocks raster strings and dicts in spatial lookups [1][2]. The security team also gained a formal charter, and a new fundraising tier launched at $200K [3]. If you run the admin or GIS queries, upgrade before your next deploy; the CVEs are fixed in 6.1 and the patches are the kind you don't want to sit on.

One commit changed how parallel tests behave: workers now reuse database clones left by exited workers, which directly targets the intermittent failures that plagued CI. The old headless approach left every worker to clone from the source database; now "made parallel test workers reuse database clones of exited workers" [4] means you stop paying the clone cost and the flake source is gone. This is the kind of fix that quietly makes everyone's Monday morning less stressful.

The GIS desk had three focused fixes: LayerMapping now reads null time fields correctly [5], RasterField can alter spatial indexes [6], and GPX parsing preserves milliseconds [7]. None of these are headline-grabbing, but they close gaps that bit people on real datasets. Separately, a subtle behavioral fix: db_default no longer unintentionally falls back to the Python default [8], which means default values now behave as written in the database layer.

The project's infrastructure side got meaningfully leaner. djangoproject.com cut a N+1 query from 45 to 1 , standardized on uv, and adopted ruff . The benchmark suite added ubuntu-latest results [9], giving developers a second reference platform to compare against. None of these change Django itself, but they smooth the daily contributor experience and keep the site snappy.

Release hygiene got attention too: the download page moved to calendar versioning [10], and the docs now discourage including ticket numbers in tests [11]. For a project that prides itself on documentation, this tightening is a quiet win.