Django Fellow Report - Jacob - 2026

Week ending 2026-01-04 (Week 01)

Put in a half-week focusing on clearing 6.0 release blockers before taking a long weekend to ring in the New Year :bell:.

Misc
engaged in security reports

Week ending 2026-01-11 (Week 02)

Released 5.2.10 and 6.0.1 this week. Now it’s time to shift focus to priorities for 6.1, which is about halfway to feature freeze.

Reviewed
Fixed #29257 -- Caught DatabaseError when attempting to close a possibly already-closed cursor. by VIZZARD-X · Pull Request #20321 · django/django · GitHub
Fixed #36841 -- Made multipart parser class pluggable on HttpRequest. by FarhanAliRaza · Pull Request #20498 · django/django · GitHub
Fixed #36844 -- Clarified need for reusable apps to set default_auto_field in packaging tutorial and AppConfig docs. by aadeina · Pull Request #20503 · django/django · GitHub
Extended the GitHub pull request template to require AI assistance disclosure. by nessita · Pull Request #19594 · django/django · GitHub
Fixed #36852 -- Ignored index_type case in ExclusionConstraint.__eq__(). by hakib · Pull Request #20510 · django/django · GitHub
Fixed #13883 -- Added optgroups for SelectBox in Admin (updated). by seanhelvey · Pull Request #18934 · django/django · GitHub
Fixed #36804 -- Fixed admin system check crash for missing models. by parth-paradkar · Pull Request #20416 · django/django · GitHub
Fixed #36750 -- Ensure deterministic DB-level ordering of natural-key M2M relations in serializers. by VIZZARD-X · Pull Request #20308 · django/django · GitHub
Fixed #36189 -- Deprecated use_returning_into option for Oracle backend. by ybjeon01 · Pull Request #19930 · django/django · GitHub
Fixed #36815 -- Optimized insertion of db_default fields in bulk_create(). by YashRaj1506 · Pull Request #20493 · django/django · GitHub
Fixed #36853 -- Fixed technical 500 and 404 email CSS support. by sipa-echo-zaoa · Pull Request #20511 · django/django · GitHub
Refs #35875 -- Added dark mode support in additional views. by emmebravo · Pull Request #18801 · django/django · GitHub
Fixed #36639 -- Added CI step to run makemigrations --check against t... by Skyiesac · Pull Request #20466 · django/django · GitHub
Fixed #36857 -- Added QuerySet.totally_ordered property. by VIZZARD-X · Pull Request #20518 · django/django · GitHub
Misc
Monthly steering council meeting
Weekly Fellows sync
Released 6.0.1
Attended DSF office hours
Engaged in security reports
1 Like

Week ending 2026-01-18 (Week 03)

Took a day off to visit with family. Resuscitated some paused work on improving the reliability of Django’s test skips mechanism.

Reviewed
Fixed #36804 -- Fixed admin system check crash for missing models. by parth-paradkar · Pull Request #20416 · django/django · GitHub
Fixed #36858 -- Optimized `Field._get_default()` for `db_default` case. by adamchainz · Pull Request #20526 · django/django · GitHub
Fixed #36639 -- Added CI step to run makemigrations --check against t... by Skyiesac · Pull Request #20466 · django/django · GitHub
Fixed #36821 -- Treated empty strings as NULL for iexact lookups on Oracle. by JaeHyuckSa · Pull Request #20460 · django/django · GitHub
Fixed #36801 -- Avoided unnecessary calculation in construct_change_message(). by adamchainz · Pull Request #20524 · django/django · GitHub
Fixed #35442 -- Prevented N+1 queries in RelatedManager with only(). by Samriddha9619 · Pull Request #20495 · django/django · GitHub
Fixed #36856 -- Mentioned needsnewfeatureprocess resolution in contributor docs. by aadeina · Pull Request #20535 · django/django · GitHub
Fixed #36855, Refs #27222 -- Mentioned multiple invocations of Field.pre_save() in 6.0 release notes. by kundan223 · Pull Request #20534 · django/django · GitHub
Fixed #36189 -- Deprecated use_returning_into option for Oracle backend. by ybjeon01 · Pull Request #19930 · django/django · GitHub
Fixed #34699 -- Added warning about using Trunc functions in filters by coolbootscoder · Pull Request #18660 · django/django · GitHub
Fixed #36822 -- Added parameter limit for PostgreSQL with server-side binding. by JaeHyuckSa · Pull Request #20461 · django/django · GitHub
Fixed #36352 -- Improved error message for fields excluded by prior values()/values_list() calls. by JaeHyuckSa · Pull Request #19478 · django/django · GitHub
Fixed #36030 -- Fixed precision loss in division of Decimal literals on SQLite. by VIZZARD-X · Pull Request #20309 · django/django · GitHub
Refs #36382 -- Updated GDAL tests for Memory driver deprecation in GDAL 3.11 by smithdc1 · Pull Request #20515 · django/django · GitHub
Misc
Monthly board liaison checkin
Montly ops meeting
Fellows sync
Fellows line manager checkin
Website deployment training
1 Like

Week ending 2026-01-25 (Week 04)

Engaged in a fair number of security reports this week. Release date and number of issues for 6.0.2 to be finalized and publicized tomorrow.

Misc
engaged in (many!) security reports
Fellows sync
2 Likes

Week ending 2026-02-01 (Week 05)

This was a week of steady progress making incremental improvements to the ORM and the admin, primarily.

Reviewed
Fixed #36850 -- Prevented admin filter sidebar from wrapping below the changelist. by nileshpahari · Pull Request #20528 · django/django · GitHub
Fixed #36776 -- Clarified dev server runs in WSGI mode. by jafarkhan83 · Pull Request #20589 · django/django · GitHub
Filtered inactive releases in get_latest_micro_release(). by nessita · Pull Request #2482 · django/djangoproject.com · GitHub
Fixed #36874 -- Optimized CSRF token generation a bit. by tim-lansen · Pull Request #20566 · django/django · GitHub
Fixed #36878 -- Unified data type for *_together options in ModelState. by MarkusH · Pull Request #20574 · django/django · GitHub
Fixed #36857 -- Added QuerySet.totally_ordered property. by VIZZARD-X · Pull Request #20518 · django/django · GitHub
Fixed #36644 -- Add deprecation warning for order_by() without arguments used with first()/last(). by nileshpahari · Pull Request #20458 · django/django · GitHub
Fixed #36865 -- Removed casting from exact lookups in admin searches. by mlissner · Pull Request #20538 · django/django · GitHub
Fixed #36233 -- Avoided quantizing integers stored in DecimalField on SQLite. by Samriddha9619 · Pull Request #20346 · django/django · GitHub
Fixed #36795 -- Enforced quoting of all database object names. by charettes · Pull Request #20587 · django/django · GitHub
Fixed spell checks in GH docs workflow. by nessita · Pull Request #20610 · django/django · GitHub
Fixed #35943 -- Replaced event listener unload with visibilitychange. by petervanderdoes · Pull Request #20611 · django/django · GitHub
Fixed #36841 -- Made multipart parser class pluggable on HttpRequest. by FarhanAliRaza · Pull Request #20498 · django/django · GitHub
Fixed #27574 -- Added support for ST_Distance_Sphere function on MySQL. by Skyiesac · Pull Request #20581 · django/django · GitHub
Added documentation on reviewing patches. by tim-schilling · Pull Request #20599 · django/django · GitHub
Fixed #36885 -- Wrap long admin filter labels in sidebar. by harshgautam5678 · Pull Request #20600 · django/django · GitHub
Fixed #36893 -- Serialized elidable kwarg for RunSQL and RunPython operations. by SnippyCodes · Pull Request #20614 · django/django · GitHub
Fixed #36857 -- Added QuerySet.totally_ordered property. by VIZZARD-X · Pull Request #20518 · django/django · GitHub
Fixed #36468 -- Fixed failure to close popup when adding a related object in the admin. by maqnius · Pull Request #19923 · django/django · GitHub
Fixed #36879 -- Updated lib-name for redis cache by ar3ph · Pull Request #20580 · django/django · GitHub
Misc
Engaged in security reports
Fellows sync
Sent prenotifications and created metadata for security releases
Collaborated with DSF board assistant in DSF Office Hours to compile links for prospective sponsors
Drafted blog post about increased volume of security reports
2 Likes

Week ending 2026-02-08 (Week 06)

Reviewed
Fixed #36795 -- Enforced quoting of all database object names. by charettes · Pull Request #20587 · django/django · GitHub
Fixed #36879 -- Identified Django client in Redis client metadata. by ar3ph · Pull Request #20580 · django/django · GitHub
Fixed #36893 -- Serialized elidable kwarg for RunSQL and RunPython operations. by SnippyCodes · Pull Request #20614 · django/django · GitHub
Fixed #36898 -- Documented SessionBase.is_empty(). by jafarkhan83 · Pull Request #20630 · django/django · GitHub
https://github.com/django/django/pull/20518
Fixed selenium tests in Firefox. by pbratkowski · Pull Request #17562 · django/django · GitHub
Fixed #27489 -- Renamed permissions upon model renaming in migrations. by artirix1927 · Pull Request #20539 · django/django · GitHub
Added DatabaseFeatures.supports_inspectdb. by timgraham · Pull Request #20455 · django/django · GitHub
Refs #33579 -- Added extra tests for NotUpdated exception. by ngnpope · Pull Request #20636 · django/django · GitHub
Fixed #36644 -- Enabled empty order_by() to avoid pk ordering by first()/last(). by nileshpahari · Pull Request #20458 · django/django · GitHub
Fixed #34352 -- Unified terms in Signals docs. by Hossamfc9 · Pull Request #20634 · django/django · GitHub
Fixed #27574 -- Added support for ST_Distance_Sphere function on MySQL. by Skyiesac · Pull Request #20581 · django/django · GitHub
Fixed #26739 -- Made reverse RemoveField handle non-nullable columns. by priyapahwa · Pull Request #20482 · django/django · GitHub
Fixed #36903 -- Inspect signature with deferred annotations by 93578237 · Pull Request #20646 · django/django · GitHub
Refs #36036 -- Added m dimension to GEOSCoordSeq. by smithdc1 · Pull Request #20338 · django/django · GitHub
Fixed #36509 -- Missing aria label on input fields in tables. by jafarkhan83 · Pull Request #20596 · django/django · GitHub
Fixed #36246 -- Caught `GDALException` in `BaseGeometryWidget.deserialize`. by JaeHyuckSa · Pull Request #19256 · django/django · GitHub
Docs: clarify backend operators for text lookups by mohitvkumar-dev · Pull Request #20649 · django/django · GitHub
Misc
Engaged in security reports
Fellows sync
Issued security releases
Monthly steering council meeting
4 Likes

Week ending 2026-02-15 (Week 07)

Reviewed
Fixed #36885 -- Wrap long admin filter labels in sidebar by harshgautam5678 · Pull Request #20622 · django/django · GitHub
Fixed #36903 -- Fixed further NameErrors when inspecting functions with deferred annotations. by 93578237 · Pull Request #20646 · django/django · GitHub
Fixed #36890 -- Supported StringAgg(distinct=True) on SQLite with the default delimiter. by varunkasyap · Pull Request #20628 · django/django · GitHub
Fixed #36892 -- Fixed lazy object serialization bug in migration writer. by matthewarmand · Pull Request #20664 · django/django · GitHub
Modified tests to format PKs with %s rather than %d. by timgraham · Pull Request #20660 · django/django · GitHub
Added missing test skips observed on MongoDB. by timgraham · Pull Request #20659 · django/django · GitHub
Fixed #36293 -- Added zfile.flush to reduce time and added docs by FarhanAliRaza · Pull Request #20401 · django/django · GitHub
https://github.com/django/django/pull/20672
https://github.com/django/django/pull/19105
https://github.com/django/django/pull/20518
Extended tests for QuerySet.union() in tests/queries/test_qs_combinators.py. by timgraham · Pull Request #20662 · django/django · GitHub
Fixed #36914 -- Updated background color for select options in TabularInline. by Antoliny0919 · Pull Request #20665 · django/django · GitHub
Fixed #36513 -- Improved text contrast for admin M2M multi-select widget. by nileshpahari · Pull Request #20404 · django/django · GitHub
Fixed #36921 -- Fixed KeyError when adding inline instances of models not registered with admin. by seanhelvey · Pull Request #20679 · django/django · GitHub
Fixed #31908 -- Added parallel testing support to Oracle backend. by WalkingDevFlag · Pull Request #20492 · django/django · GitHub
Fixed #36670 -- Fixed incorrect background color of the selector chooser in the admin filter_vertical widget. by Antoliny0919 · Pull Request #19971 · django/django · GitHub
Fixed #36839 - Prevent silent failure when renaming ContentType by Moksha25-tech · Pull Request #20491 · django/django · GitHub
https://github.com/django/django/pull/19713
Optimized SQLite `DatabaseOperations.check_expression_support()`. by adamchainz · Pull Request #20670 · django/django · GitHub
Fixed #36667 -- Added guidance on helping PRs get reviewed faster. by JyothsnaMS · Pull Request #20680 · django/django · GitHub
Fixed #36839 -- Warned when model renames encounter conflicts from stale ContentTypes. by AbhimanyuGit2507 · Pull Request #20696 · django/django · GitHub
Misc
Fellows sync
Engaged in security reports
Monthly board liaison checkin
Monthly line manager checkin
Monthly ops office hours

Week ending 2026-02-22 (Week 08)

Short week with a US holiday and some travel to visit family.

Misc
Engaged in security reports
Fellows sync
3 Likes

Week ending 2026-03-01 (Week 09)

Two cool features landed this week: @Antoliny0919’s more standard vertical layout for inputs and labels in admin forms, and Artyom Kotovskiy’s work to make RenameModel migration operations update permission names as well.

Triaged
#36944 (Truncator's docstring states that `MAX_LENGTH_HTML` is enforced but is not, also `truncatechars_html` and `truncatewords_html` docs should be corrected) – Django accepted
#36946 (Running tests on SQLite with --parallel (using spawn) does not respect DATABASES["TEST"]["NAME"]) – Django accepted
#36926 (Admin list_display does not use boolean icons when traversing relations) – Django accepted
#36359 (id_for_label undefined for AdminReadonlyField) – Django duplicate
#36925 (InlineModelAdmin docs do not mention view_on_site as a shared feature with ModelAdmin) – Django accepted
#36930 (Using a custom ModelChoices (not IntegerChoices or TextChoices) member as the default value of a model field doesn't select the default value in form's select) – Django accepted
#36932 (Admin renders label after widget for non-model form fields when using FilteredSelectMultiple) – Django needsinfo
https://code.djangoproject.com/ticket/36943 accepted
#36940 (Improve ASGI script prefix path_info handling) – Django accepted
https://code.djangoproject.com/ticket/36915 invalid
#36955 (Add strict template variable support with global and per-variable configuration) – Django needsnewfeatureprocess
https://code.djangoproject.com/ticket/36953 accepted
#36942 (SimpleTestCase._remove_databases_failures() is not idempotent and crashes on complex MRO.) – Django needsinfo
https://code.djangoproject.com/ticket/36956 accepted
#36959 (Model bases isn't updated when changing parent classes) – Django duplicate
#36958 (Have test client reload logging when logging setting changed) – Django accepted
Reviewed
Deleted leaking loop iter vars in `smartif.py`. by sobolevn · Pull Request #20760 · django/django · GitHub
Fixed #36931 -- Handled LookupError in multipart parser for invalid RFC 2231 encoding by sammiee5311 · Pull Request #20714 · django/django · GitHub
https://github.com/django/django/pull/20308
https://github.com/django/django/pull/19713
Refs #36652, #36936 -- Improved path manipulation in a migration test launching a subprocess. by pmppk · Pull Request #20728 · django/django · GitHub
Fixed #36944 -- Removed MAX_LENGTH_HTML and related 5M chars limit references from HTML truncation docs. by nessita · Pull Request #20766 · django/django · GitHub
Fixed #36948 -- Fixed breadcrumb text overlap at small widths. by aadeina · Pull Request #20764 · django/django · GitHub
Fixed #36926 -- Made admin use boolean icons for related BooleanFields in list_display by Huwaiza · Pull Request #20718 · django/django · GitHub
Fixed #36359 -- Added id_for_label to AdminReadonlyField. by prachisingh342006 · Pull Request #20743 · django/django · GitHub
Fixed #36951 -- Removed empty exc_info from log_task_finished signal handler. by knifecake · Pull Request #20722 · django/django · GitHub
Fixed #36848 -- Updated defaults.bad_request view documentation by LincolnPuzey · Pull Request #20615 · django/django · GitHub
Fixed #36940 -- Improved ASGI script prefix path_info handling. by KhadyotTakale · Pull Request #20749 · django/django · GitHub
Fixed #36946 -- Respected test database name when running tests in parallel on SQLite. by laymonage · Pull Request #20768 · django/django · GitHub
Fixed #36936 -- Adjusted tests to set PYTHON_COLORS environment variable. by pmppk · Pull Request #20771 · django/django · GitHub
Adjusted default DoS severity level in Security Policy. by nessita · Pull Request #20778 · django/django · GitHub
Fixed #20775 -- Clarify that SQL equivalents for text lookups are backend dependent by Australia19-11-2023 · Pull Request #20705 · django/django · GitHub
Fixed #22079 -- Added tests for empty iterable stripping in RequestFactory. by anurag629 · Pull Request #20776 · django/django · GitHub
Fixed #27489 -- Renamed permissions upon model renaming in migrations. by artirix1927 · Pull Request #20539 · django/django · GitHub
Refs #23919 -- Used yield from in Paginator. by Pierre-Sassoulas · Pull Request #20029 · django/django · GitHub
https://github.com/django/django/pull/20300
Fixed #36914 -- Updated background color for select options in TabularInline. by Antoliny0919 · Pull Request #20665 · django/django · GitHub
Misc
Engaged in security reports
Fellows sync
1 Like

Week ending 2026-03-08 (Week 10)

Was out sick for part of the week, but even so I fit in a small sprint on static files! That included merging @blighj’s fix for a decade-old (documented!) bug in collectstatic, and reviewing @codingjoe’s proposal to support CSP nonces in Media assets.

Reviewed
Refs #35381 -- Moved JSONNull to django.db.models.expressions. by cliffordgama · Pull Request #20807 · django/django · GitHub
Aligned docs checks between GitHub Actions and local development. by nessita · Pull Request #20785 · django/django · GitHub
Fixed #35943 -- Replaced unload event listener with pagehide. by aadeina · Pull Request #20805 · django/django · GitHub
Fixed #20775 -- Clarified that SQL for text lookups varies per database. by Australia19-11-2023 · Pull Request #20705 · django/django · GitHub
Fixed #36923 -- Added tests for non-hierarchical URI schemes in URLField.to_python(). by nessita · Pull Request #20823 · django/django · GitHub
Fixed #21080 -- Use a lexer for url substitutions in ManifestStaticFilesStorage. by blighj · Pull Request #19561 · django/django · GitHub
Fixed #36391 -- Doc'd RawSQL usage on “Performing raw SQL queries” page. by aadeina · Pull Request #20470 · django/django · GitHub
Fixed #36816 -- Allowed **kwargs in @task decorator to support custom Task subclasses by nileshpahari · Pull Request #20456 · django/django · GitHub
Fixed #36364 -- Fixed migrations crash when altering ForeignObject to/from a concrete field. by JaeHyuckSa · Pull Request #20551 · django/django · GitHub
Fixed #36926 -- Made admin use boolean icons for related BooleanFields in list_display by Huwaiza · Pull Request #20718 · django/django · GitHub
Fixed #36600 -- Clarified dispatch_uid usage for signal receivers. by aadeina · Pull Request #20467 · django/django · GitHub
Fixed #21080 -- Ignored urls inside comments during collectstatic. by blighj · Pull Request #20828 · django/django · GitHub
Fixed #36729 -- Pre-compiled all regular expressions. by RealOrangeOne · Pull Request #20096 · django/django · GitHub
Fixed #36293 -- Avoided buffering streaming responses in GZipMiddleware. by FarhanAliRaza · Pull Request #20401 · django/django · GitHub
Fixed #36784 -- Added CSP nonce to media assets by codingjoe · Pull Request #20763 · django/django · GitHub
Fixed #36968 -- Improved error message when collectstatic can't find a referenced file. by blighj · Pull Request #20852 · django/django · GitHub
Provided script for preparing commit messages and updated relevant docs (two commits). by nessita · Pull Request #20854 · django/django · GitHub
Fixed #36940 -- Improved ASGI script prefix path_info handling. by KhadyotTakale · Pull Request #20749 · django/django · GitHub
Misc
Engaged in security reports
Fellows sync
Monthly steering council meeting
3 Likes

Week ending 2026-03-15 (Week 11)

Got up to speed this week on how Django manages its translation strings. Many thanks to @claudep and @nessita for providing feedback on my proposals for process tweaks!

Another week with notable effort toward engaging in security reports.

Reviewed
Fixed #36391 -- Doc'd RawSQL usage in docs/topics/db/sql.txt. by aadeina · Pull Request #20470 · django/django · GitHub
Fixed #36976 -- Made admin action counter a live region for… by davitacols · Pull Request #20856 · django/django · GitHub
Fixed #36943 -- Preserved original URLconf exception in autoreloader. by varunkasyap · Pull Request #20877 · django/django · GitHub
Fixed #36972 -- Added keyboard feedback to createsuperuser and changepassword commands. by ketansahugit · Pull Request #20876 · django/django · GitHub
Fixed #10449 -- Added test verifying mark_safe() prevents double-esca… by abhishekmane1911 · Pull Request #20871 · django/django · GitHub
Combined scripts confirm_release.sh and test_new_version.sh into verify_release.sh. by nessita · Pull Request #20882 · django/django · GitHub
Fixed #36885 -- Fixed long verbose names in admin filter sidebar breaking layout by musmannn · Pull Request #20891 · django/django · GitHub
Refs #36735 -- Adjusted UUID7 assertions for timezone shifts. by felixxm · Pull Request #20890 · django/django · GitHub
https://github.com/django/django/pull/20300
Fixed #36966 -- Fixed ValueError when `query_params` and `follow` are used on test client. by marcgibbons · Pull Request #20831 · django/django · GitHub
Encapsulated loop logic to avoid leaking module-level variables. by emmanuel-ferdman · Pull Request #20782 · django/django · GitHub
Fixed #36906 -- Added JSONField guard for as_oracle by kanin-kearpimy · Pull Request #20864 · django/django · GitHub
https://github.com/django/django/pull/20685
Fixed #35870 -- Made blank choice label in forms more accessible. by annalauraw · Pull Request #20848 · django/django · GitHub
Fixed #36927 -- Optimized Field.deconstruct(). by adamchainz · Pull Request #20699 · django/django · GitHub
Misc
Fellows retro
Fellows weekly sync
Monthly board liason checkin
Biweekly line manager checkin
Engaged in security reports
1 Like

Week ending 2026-03-22 (Week 12)

Easy to miss in the release notes (as we only described the user-facing changes for edge cases), but last week we landed (with great joy :tada:) @charettes’ defense-in-depth measure for the ORM that ensures user-provided aliases are always quoted.

In addition to the below, another steady week advancing pending security reports.

Reviewed
Fixed #36894 -- Added TypeError for conflicting arguments in mail APIs. by prafulgulani · Pull Request #20685 · django/django · GitHub
Fixed #36949 -- Ensured <select> elements rendered inside fieldsets have an associated label. by bhuvnesh-nama · Pull Request #20933 · django/django · GitHub
Fixed #36926 -- Made admin use boolean icons for related BooleanFields in list_display by Huwaiza · Pull Request #20718 · django/django · GitHub
https://github.com/django/django/pull/20903
Fixed #36939 -- Avoided weakref.finalize in Signal.connect(). by vastus · Pull Request #20754 · django/django · GitHub
Fixed `#15759` - Excluded formset fields by per-object permissions by artirix1927 · Pull Request #19743 · django/django · GitHub
https://github.com/django/django/pull/20587
https://github.com/django/django/pull/18805
Fixed #36799 -- Added a how-to guide for testing pre-releases. by VIZZARD-X · Pull Request #20938 · django/django · GitHub
Fixed #36938 -- Removed unnecessary ORDER BY from UNION components in subqueries on Oracle. by HarishBonu0 · Pull Request #20850 · django/django · GitHub
Fixed #20562 -- Document how to use Django ORM with multiprocessing. by Australia19-11-2023 · Pull Request #20886 · django/django · GitHub
https://github.com/django/django/pull/20792
Fixed #36904 -- Clarified how to hide form field labels in docs. by aadeina · Pull Request #20654 · django/django · GitHub
Refs #36863 -- Described caveats for async usage. by Arfey · Pull Request #20949 · django/django · GitHub
Fixed #36960 -- Enabled the use of psycopg 3's optimized timestamp loader. by akx · Pull Request #20911 · django/django · GitHub
Misc
Engaged in security reports
Fellows weekly sync
4 Likes

Week ending 2026-03-29 (Week 13)

This week we advanced some design discussions around extending CSP support into the admin and into Form.Media. Otherwise, investigations into security reports and preparations for an upcoming release dominated the week.

Reviewed
Fixed #36364 -- Fixed migrations crash when altering ForeignObject to/from a concrete field. by JaeHyuckSa · Pull Request #20551 · django/django · GitHub
Fixed #36999 -- Simplify migration explanation by removing Ruby on Rails comparison by VinayDattarao · Pull Request #20974 · django/django · GitHub
Fixed #10919 -- Added ModelAdmin option to truncate delete confirmation object list. by rodbv · Pull Request #20903 · django/django · GitHub
Fixed #27734 -- Add helpful error message for invalid parallel test worker index. by AaravBot · Pull Request #20971 · django/django · GitHub
Fixed #36976 -- Made admin action counter a live region for screen readers. by davitacols · Pull Request #20856 · django/django · GitHub
Fixed #36913 -- Optimized MultipleChoiceField.validate(). by anjaniacatus · Pull Request #20960 · django/django · GitHub
Refs #36494 -- Prevented crash in JSONField numeric lookups with expressions. by VIZZARD-X · Pull Request #20702 · django/django · GitHub
Refs #36913 -- Maintained error message determinism in MultipleChoiceField.validate(). by anjaniacatus · Pull Request #20998 · django/django · GitHub
Fixed #36507 -- Documented prefetch_related behavior in union. by camuthig · Pull Request #19929 · django/django · GitHub
Fixed #29762 -- Document how database routers are used for related-object access. by VIZZARD-X · Pull Request #20310 · django/django · GitHub
Refs #36526 -- Fixed bulk_update() batching example in docs. by verigak · Pull Request #20946 · django/django · GitHub
Fix #36991 - Prevent LookUp error crash in parse_header_parameters() for invalid RFC 2231 names and sends a correct HTTP 400 code instead of HTTP 500 by DineshThumma9 · Pull Request #20962 · django/django · GitHub
Misc
Engaged in security reports
Fellows weekly sync
Board liaison chat
2 Likes

Week ending 2026-04-05 (Week 14)

In addition to advancing work on pending security issues, this week I reviewed some improvements around accessibility and performance.

Reviewed
Fixed #20024 -- Fixed handling of __in lookups with None in exclude(). by Eddy-123 · Pull Request #20027 · django/django · GitHub
Fixed #24800 -- Added logging for applied and unapplied migrations. by forwardyoung · Pull Request #20064 · django/django · GitHub
Fixed #27825 -- Document that model instances may not cast field values to the same type returned by the database. by AaravBot · Pull Request #20885 · django/django · GitHub
Fixed #35870 -- Made blank choice label in forms more accessible. by annalauraw · Pull Request #20848 · django/django · GitHub
Fixed #37004 -- Used QuerySet.totally_ordered in BaseModelFormSet.get_queryset() for stable ordering. by rodbv · Pull Request #21036 · django/django · GitHub
Run tests in postgis container by smithdc1 · Pull Request #20746 · django/django · GitHub
Added section for respecting maintainer time to the security policy. by nessita · Pull Request #21033 · django/django · GitHub
https://github.com/django/django/pull/20938
fixing issue #36813 by MehrazRumman · Pull Request #20439 · django/django · GitHub
Fixed #36553 -- Improved semantic structure of admin widgets. by Antoliny0919 · Pull Request #19735 · django/django · GitHub
Fixed #36973 -- Made fields.E348 detect accessor and manager name clashes for relationships across different models. by cliffordgama · Pull Request #20889 · django/django · GitHub
Fixed #37016 -- Avoided propagating invalid arguments from When() to Q(). by varunkasyap · Pull Request #21046 · django/django · GitHub
Fixed #36949 -- Improved RelatedFieldWidgetWrapper <labels>. by smithdc1 · Pull Request #21035 · django/django · GitHub
Fixed #36459 -- Added Aria labels to the buttons inside the AdminDate Widget. by Skyiesac · Pull Request #20913 · django/django · GitHub
Refs #35440 -- Optimized `parse_header_parameters` for common cases. by p-r-a-v-i-n · Pull Request #20532 · django/django · GitHub
Refs #36949 -- Removed hardcoded pks in modeladmin tests. by timgraham · Pull Request #21050 · django/django · GitHub
Authored
Refs #36770 -- Guarded against an endless wait in LiveServerThread.terminate(). by jacobtylerwalls · Pull Request #21029 · django/django · GitHub
Refs #36926 -- Added release note for boolean icons for related fields in list_display. by jacobtylerwalls · Pull Request #21030 · django/django · GitHub
[5.2.x] Bumped black to 26.3.1. by jacobtylerwalls · Pull Request #21032 · django/django · GitHub
#37013 (Omitting tzinfo argument to Trunc & Extract with USE_TZ = True and TIME_ZONE != UTC creates ambiguity for migrations) – Django
#37014 (SQLite emulation of db_default involving Extract/Trunc might unexpectedly apply overridden timezone for inserted values) – Django
Checklists: Sorting by CVE number is alphabetical, not numeric · Issue #2577 · django/djangoproject.com · GitHub
Fixed #36862 -- Doc'd the need for a proxy when deploying RemoteUserMiddleware under ASGI. by jacobtylerwalls · Pull Request #21043 · django/django · GitHub
Fixed #37017 -- Fixed setting or clearing of request.user after alogin()/alogout(). by jacobtylerwalls · Pull Request #21045 · django/django · GitHub
Refs #36862 -- Reiterated security note on both variants of RemoteUserMiddleware. by jacobtylerwalls · Pull Request #21047 · django/django · GitHub
#37019 (Make sync login() and logout() set request.auser if present) – Django
#37020 (Adjust release instructions to stop editing *.po files fetched from Transifex) – Django
Fixed #37020 -- Removed guidance to edit fetched .po files by hand. by jacobtylerwalls · Pull Request #21048 · django/django · GitHub
Misc
Engaged in security reports
Fellows weekly sync
Sent prenotifications for April security release
Sent a last-six-months rundown memo to Sarah
Added members to T&R team
2 Likes

Week ending 2026-04-12 (Week 15)

Sending off last week’s report before heading to DjangoCon Europe! Hope to see some of you there!

Reviewed
Fixed #37021 -- Added user_perm_str helper property to the Permission model. by Mariatta · Pull Request #21051 · django/django · GitHub
Fixed #37009 -- Fixed filter action icon alignment in admin changelist. by yeongbin05 · Pull Request #21013 · django/django · GitHub
Fixed #37023 -- Made XML serializer put each ManyToManyField object on its own line. by timgraham · Pull Request #21056 · django/django · GitHub
Fixed #36816 -- Allowed **kwargs in @task decorator to support custom Task subclasses by nileshpahari · Pull Request #20456 · django/django · GitHub
Fixed #31317 -- Avoided crash in CreateModel with unique_together and AlterUniqueTogether. by David-Wobrock · Pull Request #20929 · django/django · GitHub
Fixed #36458 -- Fixed focus within the admin widget popup for calendar and clock. by Skyiesac · Pull Request #21042 · django/django · GitHub
Fixed #37013 -- Omitted tzinfo argument to Trunc & Extract with USE_TZ = True and TIME_ZONE != UTC creates ambiguity for migrations by Huwaiza · Pull Request #21064 · django/django · GitHub
Fixed two issues in release helper scripts/verify_release.sh. by nessita · Pull Request #21068 · django/django · GitHub
Removed superfluous request.user assignment in RemoteUserMiddleware. by jaap3 · Pull Request #18310 · django/django · GitHub
[checklists] Set of 3 independent fixes, see commits. by nessita · Pull Request #2584 · django/djangoproject.com · GitHub
Fixed `#15759` - Excluded formset fields by per-object permissions by artirix1927 · Pull Request #19743 · django/django · GitHub
Added automated quality checks for PRs as a GitHub Actions workflow. by nessita · Pull Request #21077 · django/django · GitHub
Fixed #36953 -- Refactored mail tests. by medmunds · Pull Request #20948 · django/django · GitHub
Fixed #35738 -- Deprecated double-dot variable lookups. by smithdc1 · Pull Request #19534 · django/django · GitHub
Misc
Issued security releases
Engaged in security reports
Fellows weekly sync
Fellows security sync
Monthly steering council meeting
Monthly board liaison meeting
2 Likes

Week ending 2026-04-19 (Week 16)

What a thrill to be in Athens for DjangoCon Europe last week! Conversations around a range of topics (security, AI, static typing, background tasks, performance, the admin) reassured me that–no matter Django’s reputation for moving cautiously–as a community, we’re focusing on the right questions.

I managed to cross a few more things off the list while there:

Misc
Attended DjangoCon Europe talks and hallway track
Prepared and gave backup talk on Django 6.1’s model field fetch modes
Mentored contributors at sprints
Engaged in security reports
3 Likes

Week ending 2026-04-26 (Week 17)

A four day week after returning from DjangoCon yielded some wins like merging @annalauraw’s work on improved blank choice labels in forms and @rodbv’s work on truncating huge deletion confirmation pages in the admin.

Reviewed
Fixed #36458 -- Fixed focus within the admin widget popup for calendar and clock. by Skyiesac · Pull Request #21042 · django/django · GitHub
Fixed #36459 -- Added Aria labels to the buttons inside the AdminDate Widget. by Skyiesac · Pull Request #20913 · django/django · GitHub
https://github.com/django/django/pull/20903
https://github.com/django/django/pull/20959
Fixed #36912 -- Added connector validation to Q.create(). by amakarudze · Pull Request #21022 · django/django · GitHub
https://github.com/django/django/pull/21041
https://github.com/django/django/pull/20848
Fixed #35943 -- Replaced unload event listener with pagehide. by aadeina · Pull Request #20805 · django/django · GitHub
Fixed `#15759` - Excluded formset fields by per-object permissions by artirix1927 · Pull Request #19743 · django/django · GitHub
https://github.com/django/django/pull/20730
Fixed #37057 -- Adjusted UniqueConstraint handling of UNKNOWN condition. by charettes · Pull Request #21152 · django/django · GitHub
Fixed #36991 -- Raised BadRequest for invalid encodings in Content-Type headers. by DineshThumma9 · Pull Request #20962 · django/django · GitHub
Fixed #34699 -- Added warning about using Trunc functions in filters by coolbootscoder · Pull Request #18660 · django/django · GitHub
Fixed #36984 -- Limited the objects displayed in inline formset error messages. by esperonus-karolis · Pull Request #20945 · django/django · GitHub
Refs #32915 -- easier to understand traceback from _gcd_import by allen-munsch · Pull Request #16189 · django/django · GitHub
Add draft of security team charter. by tim-schilling · Pull Request #56 · django/dsf-working-groups · GitHub
Fixed #36355 -- Included applied cross-app migrations in sqlmigrate state. by JaeHyuckSa · Pull Request #20463 · django/django · GitHub
Misc
Fellows sync
Engaged in security reports
1 Like

Week ending 2026-05-03 (Week 18)

A week spent closing as many open review loops as possible before the upcoming feature freeze!

Reviewed
Refs #15759 -- Fixed ModelAdmin.list_editable form submission for non-editable instances. by artirix1927 · Pull Request #21179 · django/django · GitHub
https://github.com/django/django/pull/20336
#35738 (Deprecate double-dot variable lookups) – Django
Adopt Annual Release Cycle (DEP 20) by carltongibson · Pull Request #109 · django/deps · GitHub
Fixed #36459 -- Added Aria labels to the buttons inside the AdminDate Widget. by Skyiesac · Pull Request #20913 · django/django · GitHub
[checklists] A pair of fixes. by nessita · Pull Request #2606 · django/djangoproject.com · GitHub
Fixed #36990 -- Bumped OpenLayers to 10.9.0 for OSMWidget. by VIZZARD-X · Pull Request #21111 · django/django · GitHub
Fixed #35951 -- Updated timezone diff note on time inputs in admin panel. by vkaracic · Pull Request #20385 · django/django · GitHub
Refs CVE-2026-25674 -- Clarified role of umask in upload permissions. by shaib · Pull Request #21183 · django/django · GitHub
Fixed #36825, #36784 -- Add CSP support for explicit script and link tags and Media asset classes. by nessita · Pull Request #21010 · django/django · GitHub
Fixed #36458 -- Fixed focus within the admin widget popup for calendar and clock. by Skyiesac · Pull Request #21042 · django/django · GitHub
Fixed #37067 - Add trailing separator to django_file_prefixes(). by Fashad-Ahmed · Pull Request #21187 · django/django · GitHub
Fixed #16429 -- Extracted set_choices() method from FilePathField init by TildaDares · Pull Request #21023 · django/django · GitHub
Fixed #27825 -- Documented that model instantiation does not coerce field values. by 1wos · Pull Request #21174 · django/django · GitHub
Refs #35738 -- Improved release note for '..' template deprecation. by adamchainz · Pull Request #21192 · django/django · GitHub
Refs #35303 -- Improved use of async methods in RemoteUserMiddleware. by sarahboyce · Pull Request #21203 · django/django · GitHub
Fixed #37053 -- Added validate=True to base64.b64decode() calls. by sarahboyce · Pull Request #21145 · django/django · GitHub
https://github.com/django/django/pull/20730
Fixed #37025 -- Deprecated async support in RemoteUserMiddleware and PersistentRemoteUserMiddleware in favor of separate async only middleware classes. by sarahboyce · Pull Request #21189 · django/django · GitHub
Fixed #37075 -- Allowed overriding the PostgreSQL pool's "check" callable. by raonitimo · Pull Request #21198 · django/django · GitHub
Fixed #36767 -- Allowed max redirect URL length to be set on HttpResponseRedirect. by varunkasyap · Pull Request #20273 · django/django · GitHub
Misc
Fellows sync
Engaged in security reports
3 Likes

Week ending 2026-05-10 (Week 19)

Some delightful follow-ups trickled out of reviews this week: deprecating the no-argument form of select_related() uncovered a bug in the admin, and finalizing the design of how Media objects should render CSP nonces generated a request for clarification about caching in the MDN docs.

Reviewed
Removed hardcoded pks in annotations and delete_regress tests. by timgraham · Pull Request #21224 · django/django · GitHub
Fixed #37078 -- Deprecated SHA-1 default for salted_hmac() and base64_hmac() algorithm by dennybiasiolli · Pull Request #21199 · django/django · GitHub
Fixed #37080 -- Use generic deprecation warnings in runtests. by Wenzeltelger · Pull Request #21216 · django/django · GitHub
https://github.com/django/django/pull/21042
Fixed #37039 -- Removed outdated note from QuerySet.iterator() docs. by MANAS225 · Pull Request #21120 · django/django · GitHub
https://github.com/django/django/pull/21010
Fixed #37074 -- Synced admin calendar today highlight with server time. by SnippyCodes · Pull Request #21206 · django/django · GitHub
Fixed #36784 -- Added csp_nonce_attr template tag for CSP nonce inclusion. by nessita · Pull Request #21235 · django/django · GitHub
Fixed #33685 -- Supported PostgreSQL service names in tests. by p-r-a-v-i-n · Pull Request #20715 · django/django · GitHub
Fixed #37060 -- Propagated AlterField through attname-based to_field … by sipa-echo-zaoa · Pull Request #21156 · django/django · GitHub
https://github.com/django/django/pull/21230
[checklists] Minor improvements following recent security release by sarahboyce · Pull Request #2612 · django/djangoproject.com · GitHub
Fixed #37085 -- Added support for object-based form media stylesheet assets. by nessita · Pull Request #21239 · django/django · GitHub
https://github.com/django/django/pull/16012
Fixed #36813 -- Raised ValueError at field init for invalid max_length/max_digits. by MehrazRumman · Pull Request #20439 · django/django · GitHub
Fixed #36938 -- Removed unnecessary ordering from compound queries. by dcsid · Pull Request #21102 · django/django · GitHub
Fixed #36593 -- Deprecated QuerySet.select_related() with no arguments. by adamchainz · Pull Request #19822 · django/django · GitHub
Misc
Fellows sync
Engaged in security reports
Monthly steering council meeting
Monthly line manager meeting
Monthly board liaison checkin
1 Like