News

Python 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18 are out

A second round of expedited security releases, five days after the last: the ssl module now blocks the compromised eMudhra intermediate CA keys outright, so pip is protected even before you upgrade it. They also fix a tarfile.tar_filter bypass using links that replace the destination and reject negative-version cookies in http.cookiejar.

Announcing PSF Community Service Award Recipients!

Five new Community Service Awards go to Abhijeet Mote, Elena Williams, Hugo van Kemenade, Kevin Horn, and Sarah Abderemane. Two are familiar Django names: Elena organized the second Django Girls event ever held and now sits on Django's Code of Conduct committee, and Sarah co-founded Djangonaut Space, maintains djangoproject.com, and served as DSF Vice President in 2025.

Django Software Foundation

Natalia Bidart - Planned short-term leave

After more than three years as a Django Fellow, Natalia is taking November through January off to rest and recover, with the other Fellows and Django's teams and working groups covering in the meantime. She returns in February, ready to serve as release manager for Django 2028.

Python Software Foundation

Higher limits for organization projects

Projects owned by a PyPI organization now get 200 MB per file and 20 GB per project, double the personal limits, with nothing to turn on. Move a project out of the organization and it drops back, though any increase support already granted stays in place.

PyPI now limits versions to 128 characters

New uploads need a normalized version of 128 characters or less. Only 2 of PyPI's roughly 9.9 million releases are that long, existing releases are untouched, and pip and uv need no changes.

Wagtail CMS News

A Wagtail demo in your browser

Thibaud Colas's bakerydemo-webassembly runs Django, Wagtail, and the whole demo site in your browser with Pyodide, saving data to IndexedDB so nothing leaves your device. Log in at /admin/ with admin / changeme: it's a sandbox for learning and demos, not production.

Wagtail and the eMudhra CA key compromise

Wagtail makes outbound HTTPS calls through requests, which trusts certifi's bundled certificates rather than your operating system's, so an OS update alone won't stop it trusting eMudhra. Jake Howard covers what to upgrade, and if you deploy in containers, a rebuild picks up the patched base images.

Updates to Django

Today, "Updates to Django" is presented by Hwayoung from Djangonaut Space! 🚀

Last week we had 21 pull requests merged into Django by 13 different contributors - including 4 first-time contributors! Congratulations to gerry132, Helmi Lakhder, Aman Kumar Jain and Sanskar Kharya for having their first commits merged into Django - welcome on board!

News in Django:

• Django 6.1 now supports Python 3.15 (#36664).
• Fixed a bug in Django 6.2 where CSP directives containing only CSP.NONCE were omitted when the nonce was unused, potentially allowing a less restrictive fallback policy. These directives now emit 'none' instead (#37395).
• Improved accessibility of the Unix/Windows console tabs in Django’s documentation, adding keyboard navigation and improving support for high contrast mode and right-to-left languages (#35874).

Django Fellow Reports

Django Fellow Report - Jacob

Jacob spent much of the week on security patches but still merged initial support for the HTTP QUERY method and approved Sarah's final tweaks to multiline template tags. He also marked a FETCH_PEERS bug that can overwrite deferred-field changes as a release blocker.

Django Fellow Report - Sarah

Sarah added a pull request limit for new contributors, part of her proposed Trac changes to curb irresponsible AI-led contributions, and added a "Low" severity to Trac. She also authored fixes for CSP nonces on streaming responses and overly broad permissions in file_move_safe(), and engaged in six security issues.

Django Fellow Report - Natalia

Wrapping up before her break, Natalia landed the first stage of the docs' console tab accessibility improvements and the 6.1 release note for RedirectURLMixin. She also fixed makemessages with non-ASCII filenames on Windows, escaped database errors logged by Q.check(), and patched a confirmed low-severity security issue.

Sponsored

Django for Beginners, 6th Edition

The sixth edition is out now, available in digital and paperback formats. It features two new chapters, completely updated for Django 6.1+, and more. Read the first four chapters for free to try it out.

Articles

Django as a simple static site builder

Radiac wires nanodjango, django-nanopages, and django-distill into a Django-native answer to Jekyll: app.pages("/", path="pages") maps Markdown and HTML files onto URLs with frontmatter for titles and templates, and distill renders the lot to static output. A PEP 723 block means uv run website.py needs no install first.

How I decide which Python and Django versions I want to support

Matthias Kestenholz keeps projects and dev machines on the newest Python, but supports old versions in libraries for as long as it's cheap, since people on managed hosting can't always upgrade. He drops a version only to trim CI time or to use a new feature, which currently puts most of his packages at Python 3.10+ and Django 3.2 or 4.2+.

What Our Djangonauts Shipped on Django Packages

A long-overdue tour of what three Djangonaut Space contributors, Farhan Ali Raza, Felipe de Morais, and Victoria Cruces, built in summer 2024: one-click htmx favorites you can share on your profile, a Most Liked Packages page, OpenSearch so you can search from the address bar, and documentation links pulled from PyPI. Every one of their PRs is listed at the end.

Why use open source at all with AI?

Tim Schilling had AI build a clunky but free teleprompter in six prompts, which made him ask why anyone needs open source now. His answer: quality comes from deliberating over decisions and edge cases, which AI can't do for you, and open source lets you inherit years of that deliberation for free.

Python's experimental JIT to be removed

The Steering Council gave the JIT team six months to get a standards-track PEP accepted or see the JIT removed from CPython's main branch. After the council asked for more on platform parity, user-visible behavior changes, and security, the authors withdrew PEP 836 on October 19, so the JIT is likely to come out early in the 3.16 cycle.

CSS-Tricks has a new owner!

Four years after DigitalOcean bought it from Chris Coyier, CSS-Tricks is independent again under longtime editor Geoff Graham, who is making it his full-time job. Expect one or two articles most weeks, a beginner HTML/CSS course, memberships, the return of the newsletter, and a reopened guest writing form.

Events

Django Day São Paulo 2027

São Paulo's first event dedicated entirely to Django is coming in the first half of 2027. Over the next few weeks the organizers will announce the official date and venue, open the call for speakers, and start ticket sales, so follow them on Mastodon for updates.

Podcasts

Talk Python #567: Personal AI Agents for Pythonistas

Our own Jeff Triplett joins Michael Kennedy to talk about Hermes, the self-hosted Python agent you program by talking to it, which runs 24/7 on a box at home and wakes every 15 minutes to handle chores like morning briefings. Jeff runs his on a spare Mac Mini and a few Orange Pi boards, and it now talks to Django News, DjangoTV, and the Django Job Board over MCP.

Real Python Podcast #316: The Future of Python Security

Seth Larson, the PSF's Security Developer in Residence, explains how PEP 811 formalized the Python Security Response Team's reporting and triage, and how LLMs are driving up the volume of vulnerability reports. He also covers trusted publishing on PyPI, SBOMs under PEP 770, and practical advice for locking down your CI/CD.

Videos

DjangoCon Europe 2026

The talks from Athens are now on DjangoTV, including both keynotes, auto-prefetching with Django 6.1's field fetch modes, partitioning very large tables with PostgreSQL, shipping Django as a desktop app, and a community conversation on Django and AI.

DjangoCon US 2026

The Chicago videos are out too: Karen Tracey's keynote on Django 6, Natalia Bidart on HTMX without betraying your Django views, the Django/FastAPI debate, search-as-you-type across 54 million names, and Will Vincent on modern Django deployments, plus hallway interviews with the community.

Django Job Board

Two new roles at webbyfox consultancy lead the board this week, alongside the PSF's CPython Developer in Residence opening and senior Python seats at Camden Kelly Staffing and Manychat in Barcelona.

Senior Python Engineer at webbyfox consultancy 🆕

AI Engineer at webbyfox consultancy 🆕

CPython Developer in Residence at Python Software Foundation

Senior Software Engineer (Python, React & AI) at Camden Kelly Staffing

Senior Python Engineer (Barcelona-based / Relocation support to Barcelona) at Manychat

Projects

Static Site Generators

The Django Packages grid for turning a Django site into flat HTML you can host on a CDN or GitHub Pages with no Django process running. django-distill leads on stars, django-bakery on forks, and django-freeze saw the most recent release, with django-nanopages the newest arrival at beta.

makinacorpus/django-leaflet

Use Leaflet in your Django projects

Sponsor Django News

Reach 4,300+ Django developers every Friday. See sponsorship details and rates.