Django
DJANGO SHORES UP PYTHON 3.15 COMPATIBILITY AS SMTP TESTS GET OVERHAULED
Django is prepping for Python 3.15 by fixing email backend tests that relied on outdated CPython behavior around non-ASCII addresses.
read --wire →
$ tail -f topics/python.log
Python news, every morning.
Daily updates from across the Python ecosystem - Django, FastAPI, PyTorch, Hugging Face, and the data-and-AI stack.
34 updates across 5 projects this week.
Your week in Python, every Monday.
One calm review of what shipped across Python - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top Python projects - refine anytime. · Read a sample issue →
Recent wires
Django
DJANGO'S EMAIL BACKEND GETS THE CACHES TREATMENT
Django is shipping dictionary-based MAILERS configuration, unifying how you manage email backends across your stack just like databases and caches.
read --wire →
JAX REWIRES GPU MEMORY TRANSFORMS; GENAI SDK SHIPS SPEECH TRANSLATION
JAX's Mosaic GPU stack landed three major commits reshaping how shared memory transforms propagate through tensor operations, while the GenAI SDK reaches v2.2.0 with live speech translation and Agent Platform MCP support.
read --wire →
Django
DJANGO PATCHES REDIRECT LENGTH BUG AND PYTHON 3.14 TEST FAILURES
Django shipped fixes for a percent-encoded redirect length vulnerability and Python 3.14 compatibility issues that were breaking test suites.
read --wire →
JAX OVERHAULS GPU BUILD SYSTEM; GENAI SHIPS BLOCKING FUNCTION CALLS
JAX fixed critical Bzlmod build failures across Windows, CUDA, and ROCm while python-genai v2.1.0 lands server-side tool deltas and video response parameters.
read --wire →
Django
DJANGO DEPRECATES SELECT_RELATED() WITH NO ARGUMENTS
Django is removing the footgun of calling `select_related()` without arguments, forcing developers to be explicit about which relations they want to optimize.
read --wire →
JAX HARDENS DESERIALIZATION TRUST MODEL AFTER SECURITY ADVISORY
JAX is documenting a critical trust boundary in its export deserialization path after identifying potential security risks in untrusted blob handling.
read --wire →
Django
DJANGO 6.0.5 SHIPS WITH CACHE HEADER FIX
Django 6.0.5 is live and patches CVE-2026-6907, a cache poisoning vulnerability in the Vary header handling that could expose sensitive data across requests.
read --wire →
JAX ROLLS BACK PALLAS TRITON CHANGES, ADDS CONFIG GUARDRAILS
JAX is partially reverting a Pallas Triton PTX compilation change while shipping new configuration controls to prevent auto-pvary insertion from breaking downstream code.
read --wire →
Django
DJANGO BENCHMARKS NOW TRACKING UBUNTU LATEST
Django's performance monitoring just got wider coverage—the ASV benchmark suite now includes Ubuntu latest results, giving you real hardware data across more environments.
read --wire →
JAX SHIPS MULTI-GPU COLLECTIVE KERNELS AND MOSAIC GPU OPTIMIZATION WAVE
JAX's Pallas GPU kernel interpreter now simulates multiple GPUs with shard_map, while Mosaic GPU generates optimized PTX conversions that cut instruction bloat by half [ref:4] [ref:3].
read --wire →
Django
DJANGO 5.2.13 PATCHES CRITICAL UPLOAD VULNERABILITY
Django shipped an emergency security update that enforces upload size limits on request bodies—a gap that could let attackers bypass your DATA_UPLOAD_MAX_MEMORY_SIZE protections.
read --wire →
PYTHON-GENAI HITS 2.0 WITH BREAKING INTERACTIONS OVERHAUL
The Gemini API SDK shipped a major version bump that rewires how interaction events work—but leaves GenerateContent untouched, so most production code survives the jump.
read --wire →
Django
DJANGO TIGHTENS CSP SECURITY CHECKS AND FIXES MIGRATION EDGE CASES
Django added automatic system checks to catch misconfigured Content Security Policy middleware, while patching a critical migration bug that broke AlterField propagation through relation chains.
read --wire →
GOOGLE CLOUD DROPS PYTHON 3.8 AND 3.9 ACROSS THE STACK
Three critical libraries—sqlalchemy-bigquery, google-crc32c, and google-cloud-dns—are cutting off Python 3.8 and 3.9 support simultaneously, forcing a coordinated migration for any production workload still on those versions.
read --wire →
Django
DJANGO SHIPS CSP NONCE TAG AND FIXES ASGI AUTHENTICATION REGRESSION
Django merged three security and authentication fixes overnight that close gaps in ASGI middleware behavior and add a critical content security policy helper.
read --wire →
GOOGLE DROPS PYTHON 3.9 ACROSS THE STACK WHILE JAX HARDENS CI
Google-auth, testutils, runtimeconfig, and bigquery-magics are all moving to Python 3.10 as minimum, signaling a coordinated platform shift across cloud libraries.
read --wire →
Django
DJANGO PATCHES THREE CRITICAL CACHE AND UPLOAD VULNERABILITIES
Django shipped fixes overnight for three security flaws affecting cache headers, session handling, and ASGI file uploads that could let attackers bypass critical safety limits.
read --wire →
JAX TIGHTENS GPU COMPILATION PIPELINE WHILE GENAI CLIENT GAINS FILE SEARCH
JAX is consolidating its GPU optimization path by removing experimental flags and shipping dynamic ref selection for data movement, while the Python GenAI client reaches v1.75.0 with multimodal file search support.
read --wire →
Django
DJANGO TIGHTENS REDIRECT LIMITS AND CRYPTO DEFAULTS
Django now lets you override hardcoded redirect URL length caps, while quietly deprecating SHA-1 as the default hash algorithm ahead of a breaking change in 7.0.
read --wire →