Django Fellow Report - Natalia - 2026

[nessita]

Week ending 2026-05-24 (Week 21)

This week was mostly about returning from PyCon , which was quite exhausting. I arrived back on Wednesday, fairly drained (and very hungry ), so I worked during Thu and Fri catching up on a large backlog of email notifications and syncing with the other Fellows.

Triaged

• #37105 (Admin change form actions should only allow applying to object from the change form) – Django - Admin change form actions should only allow applying to object from the change form (accepted)
• #37111 (Add a sprints quickstart guide for contributors) – Django - Add a sprints quickstart guide for contributors (accepted)

Reviewed

• Pre-edits for 6.1a1. by jacobtylerwalls · Pull Request #21336 · django/django · GitHub - Pre-edits for 6.1a1.
• [checklists] Updates after 6.1 alpha by jacobtylerwalls · Pull Request #2631 · django/djangoproject.com · GitHub - [checklists] Updates after 6.1 alpha

Authored

• #37117 (Admin: Change form actions should use ModelAdmin.get_queryset(request)) – Django - Admin: Change form actions should use ModelAdmin.get_queryset(request)
• Fixed #37117 -- Used ModelAdmin.get_queryset() for change form actions. by nessita · Pull Request #21344 · django/django · GitHub - Fixed #37117 – Used ModelAdmin.get_queryset() for change form actions.

Security

• Triaged reports,
• Reviewed 5 PRs in preparation for security prenotifications next week.

Other/Misc

• Weekly Fellows meeting.
• Engaged in Proposal: Make file upload permissions respect umask - #10 by nessita.

[nessita]

Week ending 2026-05-31 (Week 22)

My primary focus this week was polishing the upcoming security release . I spent time going deeper into areas I am less familiar with to ensure everything was in good shape for release. As release manager, this included reviewing and completing release notes , preparing backports for all three supported stable branches , and crafting the corresponding CVE metadata so records are ready ahead of disclosure (this is part of our CNA responsibilities).

Reviewed

• [5.2.x] Added executor_class attribute to migrate command for customization. by moaddib666 · Pull Request #21358 · django/django · GitHub - [5.2.x] Added executor_class attribute to migrate command for customization.
• Updated links to severity levels in release notes. by jacobtylerwalls · Pull Request #21371 · django/django · GitHub - Updated links to severity levels in release notes.
• Fixed #37111 -- Added sprints quickstart docs page. by tim-schilling · Pull Request #21338 · django/django · GitHub - Fixed #37111 – Added sprints quickstart docs page.

Authored

• [checklists] Fixed CVE description to include product name and render inline code in HTML. by nessita · Pull Request #2632 · django/djangoproject.com · GitHub - [checklists] Fixed CVE description to include product name and render inline code in HTML.
• Refs #35870, Refs #35514 -- Fixed a couple of issues for deprecation notices in 6.1 docs. by nessita · Pull Request #21362 · django/django · GitHub - Refs #35870, Refs #35514 – Fixed a couple of issues for deprecation notices in 6.1 docs.
• Improved release script by adding git tag commit hash and extra tests. by nessita · Pull Request #21363 · django/django · GitHub - Improved release script by adding git tag commit hash and extra tests.
• Refs #35514 -- Improved docs for MAILERS setting and mailers migration guide. by nessita · Pull Request #21373 · django/django · GitHub - Refs #35514 – Improved docs for MAILERS setting and mailers migration guide.
• [checklists] Expose "discovery" in SecurityIssue admin fields. by nessita · Pull Request #2641 · django/djangoproject.com · GitHub -[checklists] Expose “discovery” in SecurityIssue admin fields.
• [checklists] Remove severity duplication in security release checklist by nessita · Pull Request #2644 · django/djangoproject.com · GitHub - [checklists] Remove severity duplication in security release checklist

Security

• Prepared private security PRs (targeting main and the three supported stable branches) for the five security patches.
• Sent security release pre-notification announcement.

Other/Misc

• Weekly Fellows meeting.
• Attended DSF Office Hours.
• Monthly Online Communities call.

[nessita]

Week ending 2026-06-07 (Week 23)

This week was quite intense, with most of the focus on getting the security release out the door . Issuing the release for the 5 CVEs took a fair amount of coordination and attention to detail, and definitely consumed a good chunk of brain power .

Alongside that, there were a number of meetings throughout the week, so overall it was a mix of high-focus release work and keeping in sync with the different groups . Bonus: the final DEP 0018 for MAILERS was approved, moved to the accepted folder, and merged .

Triaged

• #37141 (sendtestemail needs a way to specify the MAILERS configuration) – Django - sendtestemail needs a way to specify the MAILERS configuration (accepted)
• #37138 (Outdated docs CSS in local and preview builds) – Django - Outdated docs CSS in local and preview builds (accepted)
• #37137 (Replace raw SQL suggestion in TIME_ZONE docs) – Django - Replace raw SQL suggestion in TIME_ZONE docs (accepted)

Reviewed

• Made PR quality check require tickets for new contributors. by jacobtylerwalls · Pull Request #21302 · django/django · GitHub - Made PR quality check require tickets for new contributors.
• [6.1.x] Updated source translation catalogs. by jacobtylerwalls · Pull Request #21337 · django/django · GitHub - [6.1.x] Updated source translation catalogs.
• [6.0.x] Updated translations from Transifex. by jacobtylerwalls · Pull Request #21404 · django/django · GitHub - [6.0.x] Updated translations from Transifex.
• Refs CVE-2026-6873 -- Defaulted SIGNED_COOKIE_LEGACY_SALT_FALLBACK transitional setting to False. by jacobtylerwalls · Pull Request #21413 · django/django · GitHub - Refs CVE-2026-6873 – Defaulted SIGNED_COOKIE_LEGACY_SALT_FALLBACK transitional setting to False.

Security

• Polished security patches in preparation for security release.
• Issued security release for 5 CVEs
  • Django security releases issued: 6.0.6 and 5.2.15
• Prepared and published CVE metadata for publishing CVE records for daphne:
  • CVE-2026-44545: Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
  • CVE-2026-44546: Header injection via WebSocket upgrade parser differential allows ASGI scope header spoofing
• Prepared and published CVE metadata for publishing CVE records for Django:
  • CVE-2026-6873: Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie
  • CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend
  • CVE-2026-8404: Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware
  • CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware
  • CVE-2026-48587: Potential exposure of private data via whitespace padding in Vary header
• Triaged new security reports.

Other/Misc

• Monthly Steering Council meeting.
• Biweekly meeting with Fellows and Board Liaison (Jeff Triplett).
• Biweekly meeting with Fellows and Line Manager (Andrew Godwin).
• Weekly Fellows meeting.

[nessita]

Week ending 2026-06-14 (Week 24)

This week had a bit of a reset feel to it . After the previous stretch of PyCon US, security prep, and the security release itself , I spent time going through pending and snoozed items , trying to close loops and get things back to a more manageable state.

We also reviewed and triaged a batch of security reports that were shared by a major AI company, following conversations I had at PyCon US about the growing volume of LLM-generated security submissions and the challenges they create for OSS projects (Django in particular). The reports were generated using an advanced security-focused model against the Django codebase. We evaluated each finding, confirming and addressing valid issues where appropriate and mapping others to existing tickets and prior reports. Overall, Django is in good shape , as the results largely overlapped with known reports, validated our current triage approach, and reinforced confidence in our security stance .

Triaged

• #37150 (Version added/changed text, console tabs missing from RTD preview builds, dirhtml builds, etc.) – Django - Version added/changed text, console tabs missing from RTD preview builds, dirhtml builds, etc. (accepted)
• #37155 (Allow templatetag `querystring` to start from an empty state) – Django - Allow templatetag querystring to start from an empty state (needsnewfeatureprocess)
• #37157 (Document how sphinx-autobuild can be used for nicer, faster, and better doc writing process) – Django - Document how sphinx-autobuild can be used for nicer, faster, and better doc writing process (accepted)
• #37160 (Make admin views consistently raise PermissionDenied (403) when lacking model permissions) – Django - Make admin views consistently raise PermissionDenied (403) when lacking model permissions (accepted)
• #37159 (Implement reproducible artifact builds) – Django - Implement reproducible artifact builds (accepted)
• #37156 (Change async Redis methods implementation to use Redis async primitives) – Django - Change async Redis methods implementation to use Redis async primitives (needsnewfeatureprocess)
• #37161 (Implement a system check for no default MAILERS configuration) – Django - Implement a system check for deprecated mail settings (accepted)
• #37163 (Optimize `@user_passes_test`) – Django - Optimize @user_passes_test (accepted)

Reviewed

• Run tests in postgis container by smithdc1 · Pull Request #20746 · django/django · GitHub - Run tests in postgis container
• Made check-commit-suffix job check only relevant commits. by jacobtylerwalls · Pull Request #21408 · django/django · GitHub - Made check-commit-suffix job check only relevant commits.
• Fixed #37141 -- Added --using option to sendtestemail command. by NagaKartheekReddy · Pull Request #21419 · django/django · GitHub - Fixed #37141 – Added --using option to sendtestemail command.
• https://github.com/django/django/pull/21421 - Doc’d security standards in howto-release-django.txt.
• Fixed #37150 -- Made djangodocs Sphinx extension work with any html builder. by medmunds · Pull Request #21440 · django/django · GitHub - Fixed #37150 – Made djangodocs Sphinx extension work with any html builder.
• Refs #37150 -- Synced docs/make.bat with Makefile. by medmunds · Pull Request #21446 · django/django · GitHub - Refs #37150 – Synced docs/make.bat with Makefile.
• Fixed #37157 -- Documented sphinx-autobuild for documentation live-reloading by SnippyCodes · Pull Request #21456 · django/django · GitHub - Fixed #37157 – Documented sphinx-autobuild for documentation live-reloading
• Updated link to release roadmap. by jacobtylerwalls · Pull Request #2656 · django/djangoproject.com · GitHub - Updated link to release roadmap.
• [checklists] Added PyPI token revocation to checklist. by jacobtylerwalls · Pull Request #2648 · django/djangoproject.com · GitHub - [checklists] Added PyPI token revocation to checklist.

Authored

• Refs CVE-2026-48587 -- Added helper to properly split header values. by nessita · Pull Request #21438 · django/django · GitHub - Refs CVE-2026-48587 – Added helper to properly split header values.
• #37152 (EmailMessage should block `bcc` in `extra_headers` and docs should not suggest `bcc` is a header) – Django - EmailMessage should block bcc in extra_headers and docs should not suggest bcc is a header

Security

• Triaged multiple security reports, including a batch of 11 reports (shared with prior approval) by a single source. In roughly equal proportions, the outcomes were:
  • a small number of actionable security fixes (some already known and in progress),
  • duplicates of existing public tickets,
  • correctness concerns rather than security issues, and
  • new issues that did not meet the bar for a security vulnerability, for which we created public tickets.
• Work on a patch for a new confirmed vulnerability.

Other/Misc

• Weekly Fellows meeting.
• Monthly Ops Team meeting.
• Monthly Security Team meeting.
• Prepared and sent invoice for May hours.

[nessita]

Week ending 2026-06-21 (Week 25)

Lots of preparation for the upcoming 6.1 βeta, with the goal of stabilizing recent changes and ensuring overall readiness . I also spent time digging into Django’s async behavior, reviewing recent changes and following through on related optimizations and documentation updates . I also looked more closely at packaging and reproducibility, especially around artifact builds, to improve our consistency in the release process .

Triaged

• https://code.djangoproject.com/ticket/37170 - No-argument form of @sensitive_post_parameters() doesn’t cleanse request.POST (accepted)
• https://code.djangoproject.com/ticket/37174 - Template fragment cache key collision for vary_on values containing “:” (accepted)
• https://code.djangoproject.com/ticket/37176 - Action should be importable from django.contrib.admin. (accepted)

Reviewed

• https://github.com/django/django/pull/21456 - Fixed #37157 – Doc’d sphinx-autobuild for documentation auto-reloading.
• https://github.com/django/django/pull/21469 - Fixed typo in Configuring email docs.
• https://github.com/django/django/pull/21418 - Refs #28586 – Doc’d writing a custom fetch mode.
• https://github.com/django/django/pull/21460 - Fixed #37163 – Optimized @user_passes_test async checking.
• https://github.com/django/django/pull/21459 - Refs #36532 – Optimized CSP decorator async checking.
• https://github.com/django/django/pull/21489 - Fixed #37159 – Implemented reproducible artifact builds.
• https://github.com/django/django/pull/21448 - Fixed #37152 – Raised ValueError for Bcc in EmailMessage headers.
• https://github.com/django/django/pull/21465 - Fixed #37165 – Updated Async Support topic doc.
• https://github.com/django/djangoproject.com/pull/2665 - Handle corporate member SVG logos

Authored

• https://github.com/django/django/pull/21493 - Refs #37142 – Removed docs for django.utils.warnings.django_file_prefixes().
• https://github.com/django/django/pull/21506 - Refs #36560, CVE-2026-35193 – Recognized qualified cache-control directives.
• https://github.com/django/django/pull/21511 - Fixed #37160 – Made admin views raise PermissionDenied consistently.
• https://github.com/django/djangoproject.com/pull/2666 - Fixed #2647 – Reduced billboard banner height on small screens.

Security

• Triaged new reports.
• Polished patches after round of reviews for confirmed vulnerabilities.

Other/Misc

• Weekly Fellows meeting.
• Biweekly meeting with Fellows and Line Manager (Andrew Godwin).
• Code research and options analysis for https://code.djangoproject.com/ticket/37161 - Implement a system check for no default MAILERS configuration.
• Packaging tools research for https://code.djangoproject.com/ticket/37159 - Implement reproducible artifact builds.

[nessita]

Week ending 2026-06-28 (Week 26)

This week had a bit of a rush-high “everything coming together at once” feel, with the 6.1 beta going out last Wed and preparation for the upcoming security release, with prenotification emails and patches going out tomorrow . Most of the effort went into landing as many bugfixes as possible for the βeta, and polishing patches for confirmed security vulnerabilities, which meant careful reviews, backports, double-checking details, and aligning on CVE scoring and metadata .

Triaged

• #37175 (Add database backend methods to get hardcoded or nonexistent primary key values for tests) – Django - Add database backend methods to get hardcoded or nonexistent primary key values for tests (accepted)
• #37185 (Update the deployment checklist docs to mention environment variables and secrets management) – Django - Update settings documentation topic with environment variable (wontfix)

Reviewed

• Fixed #37161 -- Added system check for default MAILERS configuration. by BaderEddineBenhirt · Pull Request #21478 · django/django · GitHub - Fixed #37161 – Added system check for default MAILERS configuration.
• Fixed #37170 -- Applied the no-argument form of sensitive_post_parameters to MultiValueDict. by jacobtylerwalls · Pull Request #21510 · django/django · GitHub - Fixed #37170 – Applied the no-argument form of sensitive_post_parameters to MultiValueDict.
• Fixed #37101, #37174 -- Used netstring delimiter to prevent collisions in cache keys. by jacobtylerwalls · Pull Request #21516 · django/django · GitHub - Fixed #37101, #37174 – Used netstring delimiter to prevent collisions in cache keys.
• Refs #36983 -- Skipped GC specific tests when GIL disabled. by carltongibson · Pull Request #21521 · django/django · GitHub - Refs #36983 – Skipped GC specific tests when GIL disabled.
• Refs #32785 -- Fixed Sphinx reference in release note. by jacobtylerwalls · Pull Request #21526 · django/django · GitHub - Refs #32785 – Fixed line wrapping in release note.
• Fixed #37166 -- Added system check for non-production EmailBackend. by medmunds · Pull Request #21530 · django/django · GitHub - Fixed #37166 – Added system check for non-production EmailBackend.
• Fixed #37183 -- Prevented writing unserializable attributes in syndication entries. by jacobtylerwalls · Pull Request #21531 · django/django · GitHub - Fixed #37183 – Prevented writing unserializable attributes in syndication entries.
• Refs #35870 -- Mentioned transitional setting in BLANK_CHOICE_DASH release note. by jacobtylerwalls · Pull Request #21539 · django/django · GitHub - Refs #35870 – Mentioned transitional setting in BLANK_CHOICE_DASH release note.
• Fixed #37184 -- Allowed non-UTF-8 bytes passwords in the PBKDF2 and MD5 password hashers. by jacobtylerwalls · Pull Request #21552 · django/django · GitHub - Fixed #37184 – Allowed non-UTF-8 bytes passwords in the PBKDF2 and MD5 password hashers.
• Clarified "plaintext" vs. "plain-text" in password hashers docs. by medmunds · Pull Request #21548 · django/django · GitHub - Clarified “plaintext” vs. “plain-text” in password hashers docs.

Authored

• Fixed a pair of issues in the do_django_release.py script. by nessita · Pull Request #21543 · django/django · GitHub - Fixed a pair of issues in the do_django_release.py script.

Security

• Triaged new reports.
• Review one security patch and review CVE metadata for 3 confirmed vulnerabilities.
• Invested some time together with Jacob to discuss how to use/score the CVSS 3.1 and 4.0 vectors.

Other/Misc

• Weekly Fellows meeting.
• Attended DSF Office Hours.
• Met with Oracle regarding the Test Pilot Program.

[nessita]

Week ending 2026-07-05 (Week 27)

Intense week! I was mostly covering solo this week , so it was a mix of keeping everything moving and diving deep where needed. A big chunk of time went into tracking down and fixing a docs build regression for the website (thanks Carlton for spotting it and Tobias for the help debugging), which uncovered a subtle mismatch between how Django (core) builds docs and how the website consumes them. Alongside that, I spent time on a few deeper investigations that had been lingering (snoozed over and over in my inbox ), finally unblocking design questions and follow-ups that needed proper attention. On the security side , I handled prenotifications and a wave of incoming reports, closing out a number of invalid ones and keeping things tidy.

Overall, a very hands-on week balancing throughput with some worthwhile deep dives that should pay off going forward .

Triaged

• #37185 (Update the deployment checklist docs to mention environment variables and secrets management) – Django - Update the deployment checklist docs to mention environment variables and secrets management (re-triaged from wontfix to accepted)
• #37194 (Update Choice widget documentation to reflect current class hierarchy) – Django - Update Choice widget documentation to reflect current class hierarchy (accepted)
• #37196 (Document SimpleTestCase.async_client_class) – Django - Document SimpleTestCase.async_client_class (accepted)

Reviewed

• Fixed docs warning/errors for duplicate target name and multiple toctrees. by sarahboyce · Pull Request #21234 · django/django · GitHub - Fixed docs warning/errors for duplicate target name and multiple toctrees.
• Fixed #34753 -- Updated documentation on email safety. by medmunds · Pull Request #21467 · django/django · GitHub - Fixed #34753 – Updated documentation on email safety.
• Fixed #37162 -- Updated ContactForm docs example to use safe practices. by medmunds · Pull Request #21522 · django/django · GitHub - Fixed #37162 – Updated ContactForm docs example to use safe practices.
• Updated howto-release-django.txt with reminder to bump asgiref. by jacobtylerwalls · Pull Request #21542 · django/django · GitHub - Updated howto-release-django.txt with reminder to bump asgiref.
• Fixed #37093 -- Edited pull request instructions and error messages. by StephanieAG · Pull Request #21565 · django/django · GitHub - Fixed #37093 – Edited pull request instructions and error messages.
• Renamed tests/migrations/test_base.py to tests/migrations/base.py. by timgraham · Pull Request #21566 · django/django · GitHub - Renamed tests/migrations/test_base.py to base.py.

Authored

• #37204 (Building the epub version of the docs results in an invalid epub with errors on pages with console directives) – Django - Building the epub version of the docs results in an invalid epub with errors on pages with console directives
• Fixed #37204 -- Rendered console directives as plain code in epub docs builds. by nessita · Pull Request #21582 · django/django · GitHub - Fixed #37204 – Rendered console directives as plain code in epub docs builds.
• Fixed #36809 -- Allowed customizing EmailValidator errors per address part. by nessita · Pull Request #21568 · django/django · GitHub - Fixed #36809 – Allowed customizing EmailValidator errors per address part.
• Disambiguated duplicate "Example" hyperlink targets in howto-release-django.txt. by nessita · Pull Request #21572 · django/django · GitHub - Disambiguated duplicate “Example” hyperlink targets in howto-release-django.txt.
• Deep dive on debugging why docs were not fully built and updates in the website:
  • Fixed #2685 -- Switched update_docs management command to use html builder by nessita · Pull Request #2686 · django/djangoproject.com · GitHub - Fixed #2685 – Switched update_docs management command to use html builder
  • Refs #2685 -- Isolated per-release docs via a separate process to avoid Sphinx module caching. by nessita · Pull Request #2688 · django/djangoproject.com · GitHub - Refs #2685 – Isolated per-release docs via a separate process to avoid Sphinx module caching.
  • Refs #2685 -- Fixed build_doc_release subprocess call failing under "-m django". by nessita · Pull Request #2690 · django/djangoproject.com · GitHub - Refs #2685 – Fixed build_doc_release subprocess call failing under “-m django”.
• Avoid `shell=True` string-formatted subprocess call in update_docs · Issue #2691 · django/djangoproject.com · GitHub - Avoid shell=True string-formatted subprocess call in update_docs

Security

• Prepared and sent security release pre-notifications, and posted public reduced announcement.
• Triaged many security reports and closed a handful of invalid ones.

Other/Misc

• Read: Do excellent vulnerability reports | daniel.haxx.se
• Engaged in Implementing a Formal Experimental API for Django - #23 by nessita.
• Deep dive on Ticket #36809 Allow EmailValidator to customize error messages depending on the part that failed validation to answer design questions from 5 months ago
• Deep dive on Ticket #37138 Outdated docs CSS in local and preview builds to follow up PR and forum post.
  • Fixed #37138 -- Replaced the custom docs HTML theme with Furo. by nessita · Pull Request #53 · nessita/django · GitHub - Fixed #37138 – Replaced the custom docs HTML theme with Furo.

[nessita]

Week ending 2026-07-12 (Week 28)

A welcome break after the recent rush , with time to unblock smaller issues and tighten processes. We now have a “grab bag” approach to typo fixes , and I explored integration options between our tools to reduce manual work, especially around security workflows . It was meeting heavy, but a steady stint overall, with a focus on consistency and improvements that add up .

Triaged

• #37207 (Add a backend setting to enforce HTML response for technical 500 errors) – Django - Add a backend setting to enforce HTML response for technical 500 errors (wontfix)
• #37210 (Failed deletes in cached_db session backend should log, just like failed writes) – Django - Failed deletes in cached_db session backend should log, just like failed writes (accepted)
• #37212 (djangodocs Sphinx extension incompatible with other themes) – Django - djangodocs Sphinx extension incompatible with other themes (accepted)
• #37209 (`UserAttributeSimilarityValidator` uses unordered string comparison) – Django - `UserAttributeSimilarityValidator` uses unordered string comparison (re-triaged to wontfix)

Reviewed

• Fixed flatpages synopsis in docs. by medmunds · Pull Request #21588 · django/django · GitHub - Fixed flatpages synopsis in docs.
• Grab bag of typo fixes. by jacobtylerwalls · Pull Request #21595 · django/django · GitHub - Grab bag of typo fixes.
  • We are going to try a new approach for handling typo fixes: instead of processing each PR, we’re going to gather fixes into a single PR and merge once in a while, at most before the release candidate of the next feature release.
  • Fixed typo and versionadded locations in email docs. by medmunds · Pull Request #21592 · django/django · GitHub - Fixed typo and versionadded locations in email docs.
  • Fixed typos in comments and docstrings. by parkhojeong · Pull Request #21320 · django/django · GitHub - Fixed typos in comments and docstrings.
  • Fixed grammatical errors and typos in the 'submitting patches' documentation by bistasulove · Pull Request #21561 · django/django · GitHub - Fixed grammatical errors and typos in the ‘submitting patches’ documentation
• Fixed concurrency in labels.yml GitHub Action. by jacobtylerwalls · Pull Request #21601 · django/django · GitHub - Fixed concurrency in labels.yml GitHub Action.
• Fixed #37209 -- Updated `UserAttributeSimilarityValidator` to use ordered comparison. by terencehonles · Pull Request #21598 · django/django · GitHub - Fixed #37209 – Updated UserAttributeSimilarityValidator to use ordered comparison.
• https://github.com/django/dsf-working-groups/pull/56 - Add security team charter.
• [checklists] Include links to patches in CVE JSON by jacobtylerwalls · Pull Request #2703 · django/djangoproject.com · GitHub - [checklists] Include links to patches in CVE JSON

Authored

• #37213 (`ForeignKeyRawIdWidget` renders labels for related objects outside the form field's queryset) – Django - `ForeignKeyRawIdWidget` renders labels for related objects outside the form field’s queryset

Security

• Engaged in multiple reports and prepared a patch for one confirmed vulnerability.
• Investigated automations between HackerOne and GitHub,

Other/Misc

• Weekly Fellows meeting.
• Monthly Steering Council meeting.
• Monthly Security Team meeting.
• Monthly CoC WG meeting.
• Biweekly meeting with Fellows and Board Liaison (Jeff Triplett).

[nessita]

Week ending 2026-07-19 (Week 29)

Back to security-heavy work this week . I focused on developing two fixes for confirmed vulnerabilities, and did involved reviews for other two from Jacob. There were some interesting back-and-forth to get details right , and since I am the designated releaser for the next August release, I also started prepping for the prenotifications and building CVE metadata . To find some joy, I kept iterating on the improvements for EmailValidator .

Triaged

• #37216 (Add Oracle step to geodjango CI workflow) – Django - Add Oracle step to geodjango CI workflow (accepted)

Reviewed

• [checklists] Add step to bump asgiref by jacobtylerwalls · Pull Request #2704 · django/djangoproject.com · GitHub - [checklists] Add step to bump asgiref
• Added MAILERS to core settings topical index. by medmunds · Pull Request #21618 · django/django · GitHub - Added MAILERS to core settings topical index.
• Added step to install gettext in Github Actions workflows. by jacobtylerwalls · Pull Request #21628 · django/django · GitHub - Added step to install gettext in Github Actions workflows.
• Fixed subject/verb agreement in DecimalValidator messages. by medmunds · Pull Request #21632 · django/django · GitHub - Fixed subject/verb agreement in DecimalValidator messages.

Authored

• [checklists] A couple of fixes. by nessita · Pull Request #2717 · django/djangoproject.com · GitHub - [checklists] A couple of fixes.
• Processed and incorporated feedback from @medmunds in Fixed #36809 -- Allowed customizing EmailValidator errors per address part. by nessita · Pull Request #21568 · django/django · GitHub - Fixed #36809 – Allowed customizing EmailValidator errors per address part.
• Incorporated a few more typos and grammar fixes to Grab bag of typo fixes. by jacobtylerwalls · Pull Request #21595 · django/django · GitHub.
• Fixed unauthenticated cross-donor card update in fundraising app. · django/djangoproject.com@7a19ab3 · GitHub - Fixed unauthenticated cross-donor card update in fundraising app.

Security

• Triaged new reports.
• Worked on two security patches and did deep dives to review another few.
• Started working on CVE metadata and prenotifications for confirmed vulnerabilities.

Other/Misc

• Weekly Fellows meeting.
• Monthly Ops Team meeting.
• Read In search of a new contribution model from @carltongibson .
• Deployed djangoproject.com.
• Oracle Test Pilot onboarding meeting.

[nessita]

Week ending 2026-07-26 (Week 30)

Focus this week was on the djangoproject.com email incident and security work . I worked with Ops to diagnose and resolve the outage, addressing the source of abuse in the account registration flow. In parallel, I continued security reviews (including GeoDjango) and handled incoming reports . Overall brain ended up quite fried .

Triaged

• #37223 (Signing's JSONSerializer uses latin-1, causing silent mojibake with UTF-8-emitting serializers) – Django - Signing’s JSONSerializer uses latin-1, causing silent mojibake with UTF-8-emitting serializers (needsnewfeatureprocess)
• #37224 (Migration questioner complains about missing defaults for fields in unmanaged models) – Django - Migration questioner complains about missing defaults for fields in unmanaged models (accepted)
• #37225 (Prevent file_move_safe() from overwriting a concurrently created destination.) – Django - Prevent file_move_safe() from overwriting a concurrently created destination. (accepted)
• #37226 (Spatial fields should re-raise errors as ValidationError during model validation) – Django - Spatial fields should re-raise errors as ValidationError during model validation (accepted)
• #37229 (The Readme is "disorganized") – Django - The Readme is “disorganized” (worksforme)

Reviewed

• Grab bag of typo fixes. by jacobtylerwalls · Pull Request #21595 · django/django · GitHub - Grab bag of typo fixes.
  • Pushed more typo fixes and merged since we were getting dupes PRs for the same fixes.
• Fixed #37217 -- Made version references in contributing tutorial dynamic-version. by SnippyCodes · Pull Request #21640 · django/django · GitHub - Fixed #37217 – Made version references in contributing tutorial dynamic-version.
• Fixed #37223 -- Switched signing's JSONSerializer from latin-1 to UTF-8. by pauloxnet · Pull Request #21651 · django/django · GitHub - Fixed #37223 – Switched signing’s JSONSerializer from latin-1 to UTF-8.
• [6.1.x] Updated source translation catalogs. by jacobtylerwalls · Pull Request #21658 · django/django · GitHub - [6.1.x] Updated source translation catalogs.
• Fixed typo in documentation configuration comment by dhruvatr · Pull Request #21661 · django/django · GitHub - Fixed typo in documentation configuration comment
• https://github.com/django/deps/pull/109 - Adopt Annual Release Cycle (DEP 20)
• Added `delete_unactivated_users` management command. by tobiasmcnulty · Pull Request #2729 · django/djangoproject.com · GitHub - Added delete_unactivated_users management command.

Authored

• Fixed #37160 -- Made admin views raise PermissionDenied consistently. by nessita · Pull Request #21511 · django/django · GitHub - Fixed #37160 – Made admin views raise PermissionDenied consistently.
  • Refresh from main, cleanup, and merge after review.
• Added a reCAPTCHA to the account registration form. by nessita · Pull Request #2728 · django/djangoproject.com · GitHub - Added a reCAPTCHA to the account registration form.

Security

• Involved review of geodjango fixes, including a meeting with Jacob about this to go over details.
• Engaged in other reports.

Other/Misc

• Weekly Fellows meeting.
• Incident-response meeting with the Ops team to debug and fix an issue with email sending on djangoproject.com.
  • Account registration form was being abused by bots/spam/etc damaging our email sending reputation.
  • Email sending capabilities were paused (see details Reduce invalid account registrations and restore Amazon SES sending · Issue #2730 · django/djangoproject.com · GitHub).

[nessita]

Week ending 2026-08-02 (Week 31)

This week I prioritized time-sensitive security work , including finalizing patches, preparing and validating backports, and sending pre-notifications ahead of the release. Alongside that, I focused on Tim’s “Sprint quickstart” PR and attended meetings . Otherwise, I spent time preparing my DjangoCon US talk (it is coming together well, even if I am a bit wary of expectations around my htmx expertise ).

Triaged

• #37217 (Contributing tutorial shows the django next version but it's hardcoded and could use some automated updating) – Django - Contributing tutorial shows the django next version but it’s hardcoded and could use some automated updating (re-purposed and re-accepted)

Reviewed

• https://github.com/django/django/pull/21338 - Fixed #37111 – Added sprints quickstart docs page.
• Bumped minimum setuptools version to 83. by jacobtylerwalls · Pull Request #21691 · django/django · GitHub - Bumped minimum setuptools version to 83.
• Refs #36735 -- Added DatabaseFeatures.supports_uuid4_function_in_default feature flag. by jacobtylerwalls · Pull Request #21663 · django/django · GitHub - Refs #36735 – Bumped minimum version for UUID functions to Oracle 23.26.2.
• Refs #28586 -- Renamed RAISE fetch mode to FETCH_RAISE. by jacobtylerwalls · Pull Request #21696 · django/django · GitHub - Refs #28586 – Renamed RAISE fetch mode to FETCH_RAISE.

Authored

• Allowed the full Python test matrix to run on GitHub Actions. by nessita · Pull Request #21692 · django/django · GitHub - Allowed the full Python test matrix to run on GitHub Actions.

Security

• Prepared and sent security release pre-notifications, and posted public reduced announcement.

Other/Misc

• Weekly Fellows meeting.
• Biweekly meeting with Fellows and Line Manager (Andrew Godwin).
• Monthly Online Communities WG meeting.
• Engaged in new features issues.

[nessita]

Week ending 2026-08-09 (Week 32)

This week bulk was the security release . Then, I assisted Jacob with the Django 6.1 final release which included spending some time on translation updates and fixes, which turned into a bit of a spiral .

Triaged

• https://code.djangoproject.com/ticket/37249 - Race condition can undo logout with cache/file session backends (accepted)
• https://code.djangoproject.com/ticket/37247 - Consider grouping the constants exported by django.db.models under enums (needsnewfeatureprocess)

Reviewed

• https://github.com/django/django/pull/21418 - Refs #28586 – Doc’d writing a custom fetch mode.
• Added missing lang override in translation fetching helper for Serbian (Latin script). by jacobtylerwalls · Pull Request #21735 · django/django · GitHub - Added missing lang override in translation fetching helper for Serbian (Latin script).
• [6.1.x] Updated translations from Transifex. by jacobtylerwalls · Pull Request #21733 · django/django · GitHub - [6.1.x] Updated translations from Transifex.
• [6.1.x] Refs #32753 -- Fetched corrected Serbian (Latin script) strings. by jacobtylerwalls · Pull Request #21741 · django/django · GitHub -[6.1.x] Refs #32753 – Fetched corrected Serbian (Latin script) strings.
• Updated default ticket version to 6.1. by jacobtylerwalls · Pull Request #306 · django/code.djangoproject.com · GitHub - Updated default ticket version to 6.1.

Authored

• https://code.djangoproject.com/ticket/37247 - Consider grouping the constants exported by django.db.models under enums
• [checklists] CVE record generator: support multiple credits entries per role · Issue #2749 · django/djangoproject.com · GitHub - [checklists] CVE record generator: support multiple credits entries per role

Security

• Triaged (and closed) new security reports.
• Issued security release for 6.0.8 and 5.2.17
  • Django security releases issued: 6.0.8 and 5.2.17 | Weblog | Django

Other/Misc

• Monthly Steering Council meeting.
• Weekly Fellows meeting.