Django Fellow Report - Jacob - 2026

Week ending 2026-05-24 (Week 21)

Not much going on, “just” the 6.1 Feature Freeze / alpha release, a sprint at PyCon, and a kickoff meeting with Google Summer of Code participants & mentors.

Misc
Fellows sync
Engaged in security reports
GSoC kickoff meeting
Released 6.1 alpha
2 Likes

Week ending 2026-05-31 (Week 22)

After a Monday holiday in the US, I spent a week focusing on contributions from the prior week’s PyCon sprint.

Reviewed
Refs #35870, Refs #35514 -- Fixed a couple of issues for deprecation notices in 6.1 docs. by nessita · Pull Request #21362 · django/django · GitHub
Fixed #37116 -- Explained why a code is useful with a ValidationError. by jacobtylerwalls · Pull Request #21365 · django/django · GitHub
https://github.com/django/django/pull/21307
Improved release script by adding git tag commit hash and extra tests. by nessita · Pull Request #21363 · django/django · GitHub
Fixed #37019 -- Updated login() and logout() to set request.auser. by vishy0 · Pull Request #21060 · django/django · GitHub
Fixed #37065 -- Doc'd method_decorator usage on dispatch for async views by carltongibson · Pull Request #21292 · django/django · GitHub
Fixed #31317 -- Avoided crash in CreateModel with unique_together and AlterUniqueTogether. by David-Wobrock · Pull Request #20929 · django/django · GitHub
Fixed #35596 - Docs update related to deprecated warnings by CodeQuiver · Pull Request #21318 · django/django · GitHub
https://github.com/django/django/pull/19890
[checklists] Remove severity duplication in security release checklist by nessita · Pull Request #2644 · django/djangoproject.com · GitHub
Fixed #36864 -- Added support for module and submodule loading in import_string. by lboeman · Pull Request #21317 · django/django · GitHub
Fixed #36225 - Made implementation of natural_key optional on User Model Manager by babbitt · Pull Request #21328 · django/django · GitHub
https://github.com/django/django/pull/20583
https://github.com/django/django/pull/20602
Misc
Fellows sync
Engaged in security reports
1-1 with GSoC mentee (Pravin)
Reviewed metadata for June security releases
3 Likes

Week ending 2026-06-07 (Week 23)

A highlight this week was landing the listurls command modeled on django-extensions.

Misc
Fellows sync
Engaged in security reports
Monthly steering council
Monthly board liaison checkin
Line manager (Andrew Godwin) checkin
2 Likes

Week ending 2026-06-14 (Week 24)

In this four-day week (I headed out Friday for a college reunion), everything got a little bit better. First, check out @blighj’s estimate showing that collectstatic’s import statement detection reliability (needed to rewrite URLs) improves in Django 6.1 from 88% to 99%. Meanwhile @felixxm is stress-testing database defaults and landing fixes needed for using Django 6.1’s UUID4()/UUID7() functions. Finally, we made the test client more friendly for third-party permission packages like django-guardian and django-rules. @sage also spotted a breakage in DRF in the upcoming Django 6.1 beta, since Wagtail tests against Django’s main branch. I expect the fix to land before the beta is even out. Be like wagtail and test main!

Reviewed
Refs #16281 -- Fixed isolation of admin_views.ViewOnSiteTests. by jacobtylerwalls · Pull Request #21437 · django/django · GitHub
Fixed #37130 -- Skipped DB cache deletion when culling offset is zero. by vishy0 · Pull Request #21426 · django/django · GitHub
Fixed #37013 -- Omitted tzinfo argument to Trunc & Extract with USE_TZ = True and TIME_ZONE != UTC creates ambiguity for migrations by Huwaiza · Pull Request #21064 · django/django · GitHub
Fixed #37106 -- Clarified pylibmc workaround in unit test docs. by kikobarr · Pull Request #21436 · django/django · GitHub
Fixed #36900 -- Used safe_join() on downloaded template archive. by jacobtylerwalls · Pull Request #21439 · django/django · GitHub
Refs CVE-2026-48587 -- Added helper to properly split header values. by nessita · Pull Request #21438 · django/django · GitHub
Fixed #37147 -- Fixed rendering empty values for models with db_default on primary key. by felixxm · Pull Request #21427 · django/django · GitHub
Fixed #37142 -- Moved django_file_prefixes() to django.utils.warnings. by ZhengKangYang · Pull Request #21424 · django/django · GitHub
Fixed #36864 -- Added support for module and submodule loading in import_string. by lboeman · Pull Request #21317 · django/django · GitHub
https://github.com/django/django/pull/19890
Fixed #36104 -- Returned NotImplemented in Media.__add__ for non-Media RHS. by matthiask · Pull Request #19058 · django/django · GitHub
Fixed #33185 -- Fixed sqlmigrate crash for RenameModel with a self-referential foreign key. by dcsid · Pull Request #21372 · django/django · GitHub
Fixed #36837 -- Skipped backends not implementing (a)get_user() in (a)force_login(). by Natgho · Pull Request #21065 · django/django · GitHub
https://github.com/django/django/pull/20585
Fixed #36626 -- geodjango -- Preserved milliseconds when parsing GPX … by brunifrancesco · Pull Request #21310 · django/django · GitHub
Fixed #37102 -- Used **kwargs instead of *kwargs in CountsDict.init(). by SnippyCodes · Pull Request #21321 · django/django · GitHub
Fixed #37146 -- Improved new-user experience of README's Trac Link. by MaggieFero · Pull Request #21450 · django/django · GitHub
Fixed #36979 -- Made GenericInlineModelAdmin.get_formset() use get_exclude(). by MANAS225 · Pull Request #20883 · django/django · GitHub
Fixed #37143 -- Added missing chunk_size=None check to QuerySet.aiter… by ZhengKangYang · Pull Request #21425 · django/django · GitHub
https://github.com/django/django/pull/20942
Fixed #37129 -- Clarified database cache culling behavior in docs. by VIZZARD-X · Pull Request #21454 · django/django · GitHub
Misc
Fellows sync
Engaged in security reports
1-1 with GSoC mentee (Pravin)
Adjusted forum CSS
Monthly ops team office hours
Monthly security team meeting
7 Likes

Yes! Test main as @carltongibson as often said, too.

This is the way! :oncoming_fist::raising_hands::unicorn::partying_face:

1 Like

Week ending 2026-06-21 (Week 25)

Tended to a flurry of fixes before the non-release-blocker bugfix freeze for Django 6.1 in a few days. Also chipped away at some performance improvements for ASGI projects using sync middleware.

Reviewed
Fixed #37140 -- Documented NULL handling for __in subquery lookups. by joseanoxp · Pull Request #21492 · django/django · GitHub
Fixed #37143 -- Added missing chunk_size=None check to QuerySet.aiterator(). by ZhengKangYang · Pull Request #21425 · django/django · GitHub
Fixed #37169 -- RTL screenshot test failure caused by translated text. by Antoliny0919 · Pull Request #21479 · django/django · GitHub
Removed selenium<4.44.0 version pin. by sarahboyce · Pull Request #21490 · django/django · GitHub
Refs #37142 -- Removed docs for django.utils.warnings.django_file_prefixes(). by nessita · Pull Request #21493 · django/django · GitHub
Refs #32577 -- Added DEFAULT_PK_FIELD for implicit primary keys. by BaderEddineBenhirt · Pull Request #21400 · django/django · GitHub
Fixed #37176 -- Made Action importable from django.contrib.admin. by felixxm · Pull Request #21505 · django/django · GitHub
Fixed #37168 -- Made admin display database defaults as empty values. by felixxm · Pull Request #21495 · django/django · GitHub
Refs #36560, CVE-2026-35193 -- Recognized qualified cache-control directives. by nessita · Pull Request #21506 · django/django · GitHub
Refs #5929 -- Added a CompositeField expression to support multi-column subqueries. by p-r-a-v-i-n · Pull Request #21496 · django/django · GitHub
Added CI workflow to expand geospatial library version coverage. by smithdc1 · Pull Request #21457 · django/django · GitHub
Fixed #37164 -- Supported subclasses’ _get_lines() in jsonl Deserializer. by adamchainz · Pull Request #21461 · django/django · GitHub
Authored
#37170 (No-argument form of @sensitive_post_parameters() doesn't cleanse request.POST) – Django
#37174 (Template fragment cache key collision for vary_on values containing ":") – Django
Fundraising page returned 500 when it encountered .svg files for corporate logos · Issue #2664 · django/djangoproject.com · GitHub
Handle corporate member SVG logos by jacobtylerwalls · Pull Request #2665 · django/djangoproject.com · GitHub
Refs #37139 -- Renamed helper inside _is_pk_set(). by jacobtylerwalls · Pull Request #21507 · django/django · GitHub
Added or moved deprecation notes in docs/internals/deprecation.txt. by jacobtylerwalls · Pull Request #21508 · django/django · GitHub
Refs #34118 -- Removed further asgiref coroutine detection shims in tests. by jacobtylerwalls · Pull Request #21509 · django/django · GitHub
Fixed #37170 -- Applied the no-argument form of sensitive_post_parameters to MultiValueDict. by jacobtylerwalls · Pull Request #21510 · django/django · GitHub
Refs #35638 -- Added coverage for updating a model instance with a db_default. by jacobtylerwalls · Pull Request #21514 · django/django · GitHub
#37178 (Move MiddlewareMixin out of utils.deprecation) – Django
Fixed #37101, #37174 -- Used netstring delimiter to prevent collisions in cache keys. by jacobtylerwalls · Pull Request #21516 · django/django · GitHub
Refs #373 -- Updated FAQ page with partial composite primary key support. by jacobtylerwalls · Pull Request #21520 · django/django · GitHub
Fixed #37177 -- Reduced per-middleware context switching under ASGI. by jacobtylerwalls · Pull Request #21523 · django/django · GitHub
Misc
Fellows sync
Engaged in security reports
1-1 with GSoC mentee (Pravin)
Line manager (Andrew Godwin) chat
4 Likes

Week ending 2026-06-28 (Week 26)

Early report before heading out for a week of holiday.

Discussed
Discussed, drafted inquires about CVSS metric definitions
Misc
Fellows sync
Engaged in security reports
1-1 with GSoC mentee (Pravin)
Released 6.1 beta
Meeting with Oracle re: Test Pilot program
2 Likes

Week ending 2026-07-05 (Week 27)

On holiday

1 Like

Week ending 2026-07-12 (Week 28)

In addition to issuing security releases this week, almost all of my week was spent productively engaging in multiple security issues. (Sometimes one comes in that really deserves extra time.)

Beyond that, I put attention into the composite fields Google Summer of Code project and landed an improvement to import_string() to reliably handle modules.

Misc
Fellows sync
Engaged in security reports
Monthly steering council meeting
Monthly Security Team meeting
Board liaison checkin
1-1 with GSoC mentee (Pravin)
Issued security releases
2 Likes

Week ending 2026-07-19 (Week 29)

Another week largely focused on a couple of security reports that deserved sustained attention.

Reviewed
Fixed #37210 -- Logged cached_db session cache delete failures. by vismaytiwari · Pull Request #21606 · django/django · GitHub
Fixed #25243 -- Added inspectdb regression test for sqlite_master FK. by dcsid · Pull Request #20928 · django/django · GitHub
Fixed #37187, #37190 -- Pointed ModelAdmin warnings to the deprecated code. by medmunds · Pull Request #21553 · django/django · GitHub
Fixed #35875 -- Added dark mode support to technical 404 and 500 error views. by harveybellini · Pull Request #20568 · django/django · GitHub
Fixed #32915 -- Suppressed fewer ImportErrors in management commands. by jacobtylerwalls · Pull Request #21157 · django/django · GitHub
Fixed #37131 -- Improved XSS section in security documentation. by VIZZARD-X · Pull Request #21587 · django/django · GitHub
Refs #36983 -- Updated asgiref to v3.12 and enable free-threading tests in CI. by carltongibson · Pull Request #21623 · django/django · GitHub
Fixed #37136 -- Integrate Oracle Test Pilot into CI by loiclefevre · Pull Request #21597 · django/django · GitHub
Fixed #37219 -- Added GeneratedField example to PostgreSQL search ref… by carltongibson · Pull Request #21634 · django/django · GitHub
Fixed #37093 -- Edited pull request instructions and error messages. by StephanieAG · Pull Request #21565 · django/django · GitHub
https://github.com/django/django/pull/19890
[checklists] A couple of fixes. by nessita · Pull Request #2717 · django/djangoproject.com · GitHub
Misc
Fellows sync
Engaged in security reports
Monthly ops meeting
1-1 with GSoC mentee (Pravin)
Added James Bligh to Triage & Review Team
Oracle Test Pilot onboarding meeting
2 Likes

Week ending 2026-07-26 (Week 30)

Like last week, I focused almost all of my attention on improving our patches for the same two pending security reports. One reporter thanked us for our professional handling and brought a smile to my face when adding, “as I am sure you are getting completely slop cannoned all the way down.” :splatter:

More steady progress reviewing the GSoC work on expressions in SQL FROM clauses, too.

Misc
Fellows sync
Engaged in security reports
Released Django 6.1rc1
1-1 with GSoC mentee (Pravin)
3 Likes

Week ending 2026-08-02 (Week 31)

Highlights this week included clearing release blockers for 6.1 and making the parallel test runner more fault tolerant.

Authored
#37235 (--debug-sql prints SQLParseError instead of falling back to unformatted SQL) – Django
Bumped minimum setuptools version to 83. by jacobtylerwalls · Pull Request #21691 · django/django · GitHub
#37236 (Spatial indexes cannot be added, removed, or altered on RasterField) – Django
#37238 (save() falls back to python default even when DatabaseDefault instance is assigned) – Django
Fixed #37238 -- Fixed unintentional fallback to python default for a db_default. by jacobtylerwalls · Pull Request #21693 · django/django · GitHub
#37239 (Saving related objects with generated primary keys doesn't update assigned relations) – Django
Fixed #37239 -- Cleared stale db_default when pk comes from related object expression. by jacobtylerwalls · Pull Request #21694 · django/django · GitHub
Fixed PR number lookup in coverage comment workflow. by jacobtylerwalls · Pull Request #21695 · django/django · GitHub
Refs #28586 -- Renamed RAISE fetch mode to FETCH_RAISE. by jacobtylerwalls · Pull Request #21696 · django/django · GitHub
Refs #28586 -- Doc'd fetch_mode attribute on ModelState. by jacobtylerwalls · Pull Request #21697 · django/django · GitHub
https://forums.oracle.com/ords/apexds/post/23ai-sdo-geometry-converts-1-element-multipolygon-to-polygo-3474
Updated asgiref dependency in free-threaded requirements. by jacobtylerwalls · Pull Request #21704 · django/django · GitHub
Removed advice to include ticket numbers in tests. by jacobtylerwalls · Pull Request #21706 · django/django · GitHub
Added free-threaded Python 3.14t to PostGIS CI workflow. by jacobtylerwalls · Pull Request #21710 · django/django · GitHub
Fixed #36770 -- Fixed incomplete mocking in SQLiteInMemoryTestDbs. by jacobtylerwalls · Pull Request #21711 · django/django · GitHub
#37242 (LayerMapping doesn't handle missing times, just missing date and datetime) – Django
Fixed #37242 -- Fixed reading null time fields in LayerMapping. by jacobtylerwalls · Pull Request #21712 · django/django · GitHub
Misc
Fellows sync
Engaged in security reports
Fellows line manager (Andrew Godwin) chat
4 Likes

Week ending 2026-08-09 (Week 32)

Django 6.1 is out! Then, there was some terrific cross-pollination between the Google Summer of Code work on multi-column subqueries and an improvement for search performance on djangoproject.com where I was able to try it out.

Misc
Fellows sync
Engaged in security reports
Monthly steering council meeting
Released Django 6.1
3 Likes

Week ending 2026-08-16 (Week 33)

This week the main focus was sweeping up after the 6.1 release with some release blocker fixes. Other work around GIS, caching, and the GSoC project on multi-column subqueries continued apace :locomotive: .

Reviewed
Fixed #37263 -- Fixed changelist __exact search crashes and over-matching. by adamchainz · Pull Request #21754 · django/django · GitHub
Updated download page as per DEP-20. by sarahboyce · Pull Request #2733 · django/djangoproject.com · GitHub
Fixed #37264 -- Handled malformed _source_model values in admin popup add views. by adamchainz · Pull Request #21755 · django/django · GitHub
Refs #37159 -- Documented building release wheel reproducibly. by charlesroelli · Pull Request #21760 · django/django · GitHub
https://github.com/django/django/pull/21636
Fixed #37254 -- Added fields.E323 for models referenced by ManyToManyFields. by felixxm · Pull Request #21746 · django/django · GitHub
Fixed #37258 -- Fixed a crash when combining values() with Meta.ordering. by adamchainz · Pull Request #21748 · django/django · GitHub
Fixed #37262 -- Restored rendering of html-safe strings in form media. by adamchainz · Pull Request #21752 · django/django · GitHub
Fixed #37276 -- Fixed case bug for character 'Á' in urlify.js. by JensSpanier · Pull Request #21782 · django/django · GitHub
Fixed #37273 -- Allowed F() expression on the RHS of CompositePK lookups. by p-r-a-v-i-n · Pull Request #21773 · django/django · GitHub
Fixed #37154, #37149 -- Switched from Selenium to Playwright for integration testing. by varunkasyap · Pull Request #21596 · django/django · GitHub
Fixed #37260 -- Avoided DDL when altering only Python-level on_delete options. by adamchainz · Pull Request #21750 · django/django · GitHub
Authored
#37230 (ModelAdmin.list_display: AttributeError when a __ lookup path ends in a relation field (regression from #36926)) – Django
Fixed #37270, #24580 -- Fixed incorrect values for second-degree relations in ModelAdmin.list_display. by jacobtylerwalls · Pull Request #21759 · django/django · GitHub
Refs #28586 -- Updated Model.from_db() signature in docs. by jacobtylerwalls · Pull Request #21761 · django/django · GitHub
Migrate to MAILERS before Django 7 · Issue #2768 · django/djangoproject.com · GitHub
CSS for general index page flattens hierarchy · Issue #2769 · django/djangoproject.com · GitHub
#37274 (Transforms in order_by() not allowed after alias()) – Django
Fixed #37274 -- Allowed transforms in order_by() after alias(). by jacobtylerwalls · Pull Request #21775 · django/django · GitHub
Replace selenium with playwright · Issue #78 · django/django-docker-box · GitHub
Refs CVE-2026-15307 -- Used a more common lookup in raster lookup tests. by jacobtylerwalls · Pull Request #21783 · django/django · GitHub
#37278 (QuerySet.totally_ordered property doesn't fathom aliases of pure fields) – Django
Fixed #37278 -- Made QuerySet.totally_ordered understand aliases to pure Col/ColPairs. by jacobtylerwalls · Pull Request #21784 · django/django · GitHub
Fixed #37250 -- Allowed nesting GEOS GeometryCollection objects. by jacobtylerwalls · Pull Request #21785 · django/django · GitHub
#37280 (ContentSecurityPolicyMiddleware should set Cache-Control: Private if a nonce is rendered) – Django
Misc
Fellows sync
Engaged in security reports
Monthly ops meeting
Monthly security team meeting
Monthly board liaison checkin
2 Likes

Week ending 2026-08-23 (Week 34)

Early report before heading to DjangoCon US.

Misc
Fellows sync
Engaged in security reports
1-1 with GSoC mentee (Pravin)
1 Like

Week ending 2026-08-30 (Week 35)

I had a rejuvenating week attending, presenting at, and sprinting during DjangoCon US. I’m still relatively new to this community, so I’m still allowed to be impressed with everyone’s gracious and welcoming attitudes. A smattering of things falling under the usual categories include:

Misc
Fellows sync
Engaged in security reports
DjangoCon US: presented, paired with new contributors, attended open spaces, and much more!
4 Likes

Week ending 2026-09-06 (Week 36)

A cluster of fixes shipped in Django 6.1.1 this week. Outside of that, a week furiously closing open loops before more developer sprints later this month.

Reviewed
Fixed #37300 -- Fixed database routing for custom forward prefetch querysets. by yassinbahri · Pull Request #21834 · django/django · GitHub
Fixed #37222 -- Fixed QuerySet.distinct() crash on duplicated selections. by davegaeddert · Pull Request #21659 · django/django · GitHub
Fixed #37312, Refs #36605 -- Fixed annotation preservation and key selection in in_bulk(). by yassinbahri · Pull Request #21867 · django/django · GitHub
Clarified object-level permission checks in the admin. by sarahboyce · Pull Request #21865 · django/django · GitHub
Fixed #37309 -- Used _is_pk_set() in Model.__eq__ and the XML serializer. by dennybiasiolli · Pull Request #21861 · django/django · GitHub
Fixed #37291 -- Prevented TupleIn lookups from hanging on F() expressions. by yassinbahri · Pull Request #21806 · django/django · GitHub
Fixed #37044 -- Documented FileField access control. by arcabotai · Pull Request #21800 · django/django · GitHub
Fixed #30306 -- Added input_type to Textarea widget. by HosseineShams · Pull Request #21857 · django/django · GitHub
[checklists] Emitted one CVE credits entry per person. by nessita · Pull Request #2818 · django/djangoproject.com · GitHub
Fixed #36523 -- Added django.utils.module_loading.qualname helper. by VimalN2005 · Pull Request #21875 · django/django · GitHub
Refs #37293 -- Updated deprecation warnings for new release cycle (DEP 20) by carltongibson · Pull Request #21805 · django/django · GitHub
Fixed #37137 -- Suggested using Func() for time zone conversions in settings docs. by vishy0 · Pull Request #21488 · django/django · GitHub
Fixed #37313 -- Confirmed support for GEOS 3.15. by saikat709 · Pull Request #21879 · django/django · GitHub
Fixed #37271 -- Added calendar version support to django.utils.version. by nessita · Pull Request #21886 · django/django · GitHub
Bumped minimum version PostgreSQL version to 16. by tut-tuuut · Pull Request #75 · django/django-docker-box · GitHub
Fixed #37226 -- Raised ValidationError for invalid geometries during model validation. by nysh9 · Pull Request #21669 · django/django · GitHub
Fixed #37321 -- Documented BaseSpatialField.srid=-1 behavior. by yassinbahri · Pull Request #21889 · django/django · GitHub
Add further code owners to make djangoproject.com content/logic ownership explicit. by sarahboyce · Pull Request #2824 · django/djangoproject.com · GitHub
Authored
Fixed gunicorn links in security policy. by jacobtylerwalls · Pull Request #21860 · django/django · GitHub
#37314 (Tuple lookup sanity checks consume iterator rhs) – Django
#37316 (Functions need a way to mark themselves as volatile) – Django
[checklists] If the next feature release's EOM release is *this* bugfix release, don't create stub release notes · Issue #2819 · django/djangoproject.com · GitHub
Made time_asgi_handler() await a coroutine. by jacobtylerwalls · Pull Request #102 · django/django-asv · GitHub
Fixed #37289 -- Avoided deleting network rasters. by jacobtylerwalls · Pull Request #21881 · django/django · GitHub
Fixed test_asgeojson() on MySQL 9.5. by jacobtylerwalls · Pull Request #21887 · django/django · GitHub
#37320 (Add support for ST_Transform on MySQL) – Django
#37321 (Document the effect of setting BaseSpatialField.srid to -1) – Django
#37322 (Saving to SpatialField(srid=None) persists NULL instead of raising an error) – Django
Debian Trixie update broke parallel testing for MySQL · Issue #80 · django/django-docker-box · GitHub
#37324 (Cannot assign expressions to spatial fields) – Django
#37325 (Bump minimum version of oracledb to 4.0.2) – Django
Fixed #37325 -- Bumped minimum oracledb version to 4.0.2. by jacobtylerwalls · Pull Request #21898 · django/django · GitHub
Retrieved less document metadata during search. by jacobtylerwalls · Pull Request #2834 · django/djangoproject.com · GitHub
Fixed paginator orphans in search results. by jacobtylerwalls · Pull Request #2835 · django/djangoproject.com · GitHub
Misc
Fellows sync
Meeting with board liaison
Engaged in security reports
Meeting with Oracle re: Test Pilot, and configuration of a sandbox repository
Released Django 6.1.1
Fixed failing Jenkins triggers
1 Like