Django Fellow Report - Sarah - 2026

[sarahboyce]

Week ending 2026-04-05 (Week 14)

Hello hello I am back from maternity leave but working part-time for now
I am currently working from Turkey . Discord is not easily accessed in Turkey so I will be less responsive on that platform than I used to be.

My Fellow report for 2025 can be found here: Django Fellow Report - Sarah - 2025

Triaged

• #37016 (Avoid propagating invalid arguments from When() to Q() on dictionary expansion) – Django (accepted)
• #37017 (alogout() doesn't clear request.user) – Django (accepted)
• #37018 (Generated migrations should use tuples instead of lists) – Django (wontfix)
• #37019 (Make sync login() and logout() set request.auser if present) – Django (accepted)
• #37020 (Adjust release instructions to stop editing *.po files fetched from Transifex) – Django (accepted)
• #37022 (manage.py runserver fails with "nodename nor servname provided" when run using an rfc6761 hostname) – Django (worksforme)

Reviewed

• Fixed #37017 -- Fixed setting or clearing of request.user after alogin()/alogout(). by jacobtylerwalls · Pull Request #21045 · django/django · GitHub
• Fixed #27150 — Fixed boolean evaluation of base File objects without a name. by VIZZARD-X · Pull Request #20327 · django/django · GitHub
• Fixed #36542 -- Hid sensitive POST parameters in debug mode. by kanin-kearpimy · Pull Request #20959 · django/django · GitHub

Other/Misc

• Updated status and notification level of GitHub, Forum, and Slack
• Added my opinion to discussion on whether to re-triage old accepted new feature tickets: Old tickets that could be needsnewfeatureprocess - #5 by blighj
• Added my opinion on Design feedback: Truncating the related objects list in Admin delete confirmation (Ticket #10919) - #4 by sarahboyce
• Setup opera in order to access Discord while in Turkey
• Added to the discussion on migrating Transifex to Weblate: Improving the process of incorporating translations to Django - #17 by sarahboyce
• Updated myself on current status of GSoC

[sarahboyce]

Week ending 2026-04-12 (Week 15)

Triaged

• #37023 (Make XML serializer put each ManyToManyField object on its own line) – Django (accepted)
• #37025 (RemoteUserMiddleware.header does not correspond to request.META in the async path) – Django (accepted)
• #37026 (edit_only not implemented for formsets in GenericInlineModelAdmin) – Django (accepted)

Reviewed

• Fixed #13376: Added kwargs argument to messages API to allow extension of functionality to the Storage & Message class. by nanorepublica · Pull Request #18332 · django/django · GitHub
• https://github.com/django/djangoproject.com/pull/2458
• https://github.com/django/django/pull/19564
• Fixed #36621 -- Fixed arrow buttons position in admin filter_vertical widget. by Antoliny0919 · Pull Request #19940 · django/django · GitHub
• Fixed #33113 -- Documented usage and caveats of HTML5 date input in DateInput widget by Samriddha9619 · Pull Request #19902 · django/django · GitHub
• Fixed #36498 -- Changed inline admin button text to use "Add" instead of "Add another" by DaniFornons · Pull Request #20084 · django/django · GitHub
• https://github.com/django/dsf-working-groups/pull/56
• Allowed creation of site-wide banners via the admin interface. by nessita · Pull Request #2586 · django/djangoproject.com · GitHub
• Moved Django 4.2 to unsupported versions table. by jacobtylerwalls · Pull Request #2591 · django/djangoproject.com · GitHub

Authored

• Clarified "Add another question" as the plus icon button. by sarahboyce · Pull Request #21066 · django/django · GitHub

Other/Misc

• Did initial screening of GSoC applicants based of Django contributing history
• Engaged in 3 security reports
• Investigated labeling security discussions to track status
• Weekly fellow sync
• Meeting with Board Liaison
• Reviewed security meeting notes from missed meetings
• Emailed to DSF board around reaching out to Weblate as a potential in-kind sponsor
• Was trained on the new CNA processes

[sarahboyce]

Week ending 2026-04-19 (Week 16)

Aiming for Fixed #12090 -- Show admin actions on the edit pages too by mgaligniana · Pull Request #16012 · django/django · GitHub to be merged as part of 6.1 and so starting to push minor changes.

Triaged

• #37032 (Clarify that django.template.context_processors.csrf is enabled by default in ref docs) – Django (invalid, later accepted)
• #37033 (Psycopg2 has different semantics than psycopg3 and should not be deprecated) – Django (invalid)
• #37031 (Improve writing migrations guide to adding unique fields on existing table) – Django (accepted)
• #37039 (Outdated QuerySet.iterator() documentation) – Django (accepted)
• #37040 (pylibmc and pymemcache suggested for Memcached cempletely outdated) – Django (wontfix)
• #37042 (alogin() does not invalidate _acached_user, causing stale AnonymousUser after async login) – Django (duplicate)

Reviewed

• Fixed #37025 -- Doc'd that RemoteUserMiddleware.header does not correspond to request.META under ASGI. by jacobtylerwalls · Pull Request #21079 · django/django · GitHub
• Ref #36912 - Added benchmarks for Q.create() by amakarudze · Pull Request #98 · django/django-asv · GitHub
• Fixed #27150 -- Made base File objects truthy by default. by VIZZARD-X · Pull Request #20327 · django/django · GitHub
• Fixed #37029 -- Corrected placement of </div> in change_list.html's pagination block. by timgraham · Pull Request #21099 · django/django · GitHub
• Allowed creation of site-wide banners via the admin interface. by nessita · Pull Request #2586 · django/djangoproject.com · GitHub
• Ref #36912 - Added benchmarks for Q.create() by amakarudze · Pull Request #98 · django/django-asv · GitHub
• Fixed #37007 -- Added "Voice" section to writing style docs. by jacobtylerwalls · Pull Request #21012 · django/django · GitHub
• Fixed #12090 -- Show admin actions on the edit pages too by mgaligniana · Pull Request #16012 · django/django · GitHub

Other/Misc

• Completed required setup in order to reserve, update, publish CVEs
• Reviewed GSoC applications
• Weekly sync
• Engaged in 2 security issues

[sarahboyce]

Week ending 2026-04-26 (Week 17)

Was my last week in Turkey with the in-laws , I am now back in Germany
Djangonaut Space also concluded. I was a Navigator to some fantastic Djangonauts and our captian Mar also did some wonderful PR reviews and was a great support to the Djangonauts

Triaged

• https://code.djangoproject.com/ticket/34122 (reopened)

Reviewed

• Refs #373, #34122 -- Removed warning that ForeignObject is an internal tool. by felixxm · Pull Request #21114 · django/django · GitHub
• https://github.com/django/django/pull/21041
• Fixed #12090 -- Show admin actions on the edit pages too by mgaligniana · Pull Request #16012 · django/django · GitHub
• Add draft of security team charter. by tim-schilling · Pull Request #56 · django/dsf-working-groups · GitHub

Authored

• #37053 (Add validate=True to base64.b64decode() calls) – Django
• Fixed #37053 -- Added validate=True to base64.b64decode() calls. by sarahboyce · Pull Request #21145 · django/django · GitHub
• Refs #12090 -- Documented parameters for contrib.admin.decorators.action(). by sarahboyce · Pull Request #21150 · django/django · GitHub

Other/Misc

• Engaged in 2 security reports
• Engaged in Django Admin actions configurable as buttons in the change view's object tools · Issue #146 · django/new-features · GitHub
• Engaged in Should Django have review teams e.g. for the ORM - #18 by sarahboyce

[sarahboyce]

Week ending 2026-05-03 (Week 18)

My priority of the week has been prepping for an upcoming release and closing out a final few PRs before the 6.1 feature freeze

Triaged

• #37065 (@method_decorator can't be used on async view at class-level with name="dispatch") – Django (accepted)
• #37070 (Add .clear_messages() method to django.contrib.messages) – Django (accepted)
• #36022 (Name the main command django) – Django (accepted)

Reviewed

• Adopt Annual Release Cycle (DEP 20) by carltongibson · Pull Request #109 · django/deps · GitHub
• Fixed #36901 -- Centralized and cleaned_up mitigations against timing attacks targeting user enumeration by anjaniacatus · Pull Request #21041 · django/django · GitHub
• Fixed #36912 -- Added connector validation to Q.create(). by amakarudze · Pull Request #21022 · django/django · GitHub
• Match CI black version to git hooks by ulgens · Pull Request #288 · django/code.djangoproject.com · GitHub
• Fixed #12090 -- Show admin actions on the edit pages too by mgaligniana · Pull Request #16012 · django/django · GitHub
• Add missing text in footer link for andrevv by laymonage · Pull Request #296 · django/code.djangoproject.com · GitHub

Authored

• Fixed #37025 -- Deprecated async support in RemoteUserMiddleware and PersistentRemoteUserMiddleware in favor of separate async only middleware classes. by sarahboyce · Pull Request #21189 · django/django · GitHub
• Fixed #37053 -- Added validate=True to base64.b64decode() calls. by sarahboyce · Pull Request #21145 · django/django · GitHub
• Refs #35303 -- Improved use of async methods in RemoteUserMiddleware. by sarahboyce · Pull Request #21203 · django/django · GitHub

Other/Misc

• Prepared branches for May security release
• Sent prenotification email and announcement
• Weekly fellow sync meeting
• Added Raffaella to Triage and Review Team

[sarahboyce]

Week ending 2026-05-10 (Week 19)

Did my first Django release in months

Triaged

• https://code.djangoproject.com/ticket/37079 (accepted)

Reviewed

• Fixed #37079 -- Fixed specialization of header lookups in RemoteUserMiddleware. by jacobtylerwalls · Pull Request #21208 · django/django · GitHub
• Fixed #36300 -- Restored the semantic where RemoteUserMiddleware.header corresponds to request.META under ASGI. by jacobtylerwalls · Pull Request #21209 · django/django · GitHub
• Rebase meeting minutes pr2221 by jcjudkins · Pull Request #2384 · django/djangoproject.com · GitHub
• Enable codecov by ulgens · Pull Request #2325 · django/djangoproject.com · GitHub
• Enforced test coverage via CI by tobiasmcnulty · Pull Request #2201 · django/djangoproject.com · GitHub
• Add Django template linguist instruction by codingjoe · Pull Request #2542 · django/djangoproject.com · GitHub
• Add djade linter for Django templates (Fixes #2372) by aNsHuL5217 · Pull Request #2382 · django/djangoproject.com · GitHub
• Set cooldown in dependabot by p-r-a-v-i-n · Pull Request #2434 · django/djangoproject.com · GitHub

Authored

• Fixed #37053 -- Added validate=True to base64.b64decode() calls. by sarahboyce · Pull Request #21145 · django/django · GitHub
• Added playwright tests. by sarahboyce · Pull Request #2444 · django/djangoproject.com · GitHub
• [checklists] Minor improvements following recent security release by sarahboyce · Pull Request #2612 · django/djangoproject.com · GitHub
• Extend playwright E2E tests to run on multiple browsers (chromium and firefox) · Issue #2613 · django/djangoproject.com · GitHub
• Fixed docs warning/errors for duplicate target name and multiple toctrees. by sarahboyce · Pull Request #21234 · django/django · GitHub

Other/Misc

• Add Mike Edmunds to Triage and Review Team
• Steering Council meeting
• Fellow line manager meeting
• Published security releases 6.0.5 and 5.2.14
• Engaged in one security report
• Django website WG meeting

[sarahboyce]

Week ending 2026-05-17 (Week 20)

Been staying with my mum this week

Triaged

• #37094 (Javascript alert for Save button references renamed "Go" button) – Django (accepted)
• #37081 (loaddata fails when a directory in the fixture path contains a dot) – Django (accepted)
• #37089 (ignore_warnings() handles message arg differently from other test helpers) – Django (accepted)
• #37100 (Prevent header injection through malformed response reason phrase) – Django (accepted)
• #37101 (Vary header cache key collision from missing delimiter) – Django (accepted)
• #37099 (Add :dep: directive to Sphinx documentation) – Django (someday/maybe)

Reviewed

• https://github.com/django/django/pull/16012
• Fixed #37094 -- Replaced "Go" with "Run" in list_editable alert message. by jacobtylerwalls · Pull Request #21271 · django/django · GitHub
• https://github.com/django/dsf-working-groups/pull/56
• Fixed #1724 -- Renamed "patch" to "pull request" by bmispelon · Pull Request #1729 · django/djangoproject.com · GitHub
• #2154 Lazy-loading for images in blog content by greg-ware · Pull Request #2304 · django/djangoproject.com · GitHub
• [checklists] Add discovery field by jacobtylerwalls · Pull Request #2622 · django/djangoproject.com · GitHub

Authored

• Pinned selenium version to "<4.44.0" due to change in get_attribute("class") behavior. by sarahboyce · Pull Request #21282 · django/django · GitHub
• Bootstrapped Django 6.2. by sarahboyce · Pull Request #21283 · django/django · GitHub
• Added tests for theme toggle button. by sarahboyce · Pull Request #2623 · django/djangoproject.com · GitHub

Other/Misc

• Engaged in 4 security reports
• Fellows weekly sync meeting
• Read into SensitiveTicketsPlugin – Trac Hacks - Plugins Macros etc.
• Scheduled a meeting with Weblate

[sarahboyce]

Week ending 2026-05-24 (Week 21)

As we had the feature freeze focused on a few feature PRs I had prioritized for 6.1

Triaged

• #37104 (Naive timestamps used in migrations should reference the same timezone) – Django (accepted)
• #37103 (HttpRequest.body raises ValueError for malformed CONTENT_LENGTH) – Django (accepted)
• #37106 (pylibmc install fails from tests requirements on Python 3.12+ without libmemcached installed) – Django (accepted)
• #37109 (Suppress KeyboardInterrupt traceback in dbshell) – Django (accepted)
• #11379 (MAX_ENTRIES of cache backend should not be required) – Django (reopened)
• #37112 (Allow setting `MAX_ENTRIES` in `OPTIONS` of cache backend to `None`) – Django (duplicate)
• https://code.djangoproject.com/ticket/37110 (accepted)
• #37113 (Don't let cache backends swallow explicit errors in cache arguments) – Django (needsnewfeatureprocess)
• https://code.djangoproject.com/ticket/37108 (accepted)
• #37107 (Request META key `REMOTE_ADDR` not set anywhere in wsgi applications) – Django (invalid)

Reviewed

• Fixed #37103 -- Made HttpRequest.body tolerate malformed CONTENT_LENGTH. by Lier0102 · Pull Request #21300 · django/django · GitHub
• Fixed #25656 -- Removed link from recent actions when user has no perms. by artirix1927 · Pull Request #21169 · django/django · GitHub
• Fixed #37108 -- Made DjangoJSONEncoder consistently omit .000 microseconds by SnippyCodes · Pull Request #21340 · django/django · GitHub
• https://github.com/django/dsf-working-groups/pull/56

Authored

• #37105 (Admin change form actions should only allow applying to object from the change form) – Django
• Fixed #37105 -- Disallowed admin change form actions against objects that are not the change form object. by sarahboyce · Pull Request #21306 · django/django · GitHub
• Added advancing deprecations to preparing for next release instructions. by sarahboyce · Pull Request #21342 · django/django · GitHub

Other/Misc

• Engaged in 6 security reports
• Meeting with Weblate
• Sent a summary of the security reports of the week
• GSoC meeting with mentee
• Pushed updates to security team charter PR

[sarahboyce]

Week ending 2026-05-31 (Week 22)

I was at PyCon Italia this week which was fantastic, highly recommend going if you get the chance

Triaged

• #36658 (Invalid numeric literal in an {% if %} tag is treated as a variable) – Django (accepted)

Reviewed

• Bumped versions in pre-commit, npm, and GitHub Actions configurations. by jacobtylerwalls · Pull Request #21345 · django/django · GitHub
• Fixed #37108 -- Made DjangoJSONEncoder consistently omit .000 microseconds by SnippyCodes · Pull Request #21340 · django/django · GitHub
• [checklists] Fixed CVE description to include product name and render inline code in HTML. by nessita · Pull Request #2632 · django/djangoproject.com · GitHub
• Fixed #37103 -- Made HttpRequest.body handle malformed CONTENT_LENGTH. by Lier0102 · Pull Request #21300 · django/django · GitHub
• [checklists] Expose "discovery" in SecurityIssue admin fields. by nessita · Pull Request #2641 · django/djangoproject.com · GitHub

Other/Misc

• Engaged in 4 security reports
• Weekly sync

[sarahboyce]

Week ending 2026-07-12 (Week 28)

I’m back after a month off doing childcare

Triaged

• #37205 (Replace assertIsInstance HttpResponse test assertions as do not fail if result is a subclass) – Django (accepted)
• #37204 (Building the epub version of the docs results in an invalid epub with errors on pages with console directives) – Django (accepted)
• #37206 (Drop tasks' is_module_level_function in favor of the established deconstructable paradigm) – Django (requested more info)
• #37126 (Make Task and TaskResult comparable) – Django (needsnewfeatureprocess)
• #37213 (`ForeignKeyRawIdWidget` renders labels for related objects outside the form field's queryset) – Django (accepted)

Reviewed

• Fixed #37204 -- Rendered console directives as plain code in epub docs builds. by nessita · Pull Request #21582 · django/django · GitHub
• Fixed #37122 -- Updated JSONField has_changed method to check for disabled status. by FrickWu · Pull Request #21411 · django/django · GitHub
• Fixed #37158 -- Reordered the contribution checklist sections. by VIZZARD-X · Pull Request #21455 · django/django · GitHub
• Fixed #37172 -- Linked to upload handlers section in FILE_UPLOAD_* settings see for details. by LincolnPuzey · Pull Request #21499 · django/django · GitHub
• Fixed #17631 -- Handled fields and files with the same name in encode_multipart(). by anurag629 · Pull Request #20931 · django/django · GitHub
• Fixed #36621 -- Fixed arrow buttons position in admin filter_vertical widget. by Antoliny0919 · Pull Request #19940 · django/django · GitHub
• https://github.com/django/django/pull/18651
• Updated docs-related model fixtures for 6.1 release. by jacobtylerwalls · Pull Request #2642 · django/djangoproject.com · GitHub
• Fixed #37154 -- Switched from Selenium to Playwright for integration testing. by varunkasyap · Pull Request #21596 · django/django · GitHub
• Fixed #37180 -- Fixed admin SelectBox height tests to verify available/chosen box heights. by varunkasyap · Pull Request #21580 · django/django · GitHub
• Fixed #37149 -- Made CSP violation checks in selenium tests browser-independent. by VIZZARD-X · Pull Request #21538 · django/django · GitHub
• Fixed #37182 -- Corrected property typo in skip link to content test. by varunkasyap · Pull Request #21528 · django/django · GitHub
• Fixed #37181 -- Corrected assertion in SeleniumTests.test_pagination. by varunkasyap · Pull Request #21527 · django/django · GitHub

Authored

• Bumped versions in Github actions configuration. by sarahboyce · Pull Request #21609 · django/django · GitHub
• [Proposal] Decouple the code.djangoproject.com UI from djangoproject.com · Issue #303 · django/code.djangoproject.com · GitHub

Other/Misc

• Updated the wiki start page Django
• Steering Council meeting
• GSoC midterm evaluation
• Weekly fellow sync
• Sent security report weekly summary email to security team
• Meeting with Board Liaison
• Engaged in 1 security report
• Security monthly meeting
• GSOC mentor meeting

[sarahboyce]

Week ending 2026-07-19 (Week 29)

It was my birthday this week and apparently I share my birthday with the lovely Tim Schilling

Reviewed

• Fixed #37199 -- Fixed typo in bulk_update code example in docs/ref/models/querysets.txt. by twm · Pull Request #21593 · django/django · GitHub
• Fixed #29303 -- Avoided mutating original view in non_atomic_requests(). by sinachaichi · Pull Request #21254 · django/django · GitHub
• Fixed #37154 -- Switched from Selenium to Playwright for integration testing. by varunkasyap · Pull Request #21596 · django/django · GitHub
• Fixed #36629 -- Added missing “Choose all” and “Remove all” buttons in admin m2m filter_vertical widget. by nileshpahari · Pull Request #20396 · django/django · GitHub
• Fixed #19227 -- Reorganized CBV method flowcharts into tree structure. by harshgautam5678 · Pull Request #20593 · django/django · GitHub
• Fixed #2714 -- Made the Django Core Developers page discoverable. by sir-sigurd · Pull Request #2715 · django/djangoproject.com · GitHub
• Remove obsolete CSS targeting the Opera browser by adamzap · Pull Request #2668 · django/djangoproject.com · GitHub
• Break code block lines on any character by adamzap · Pull Request #2708 · django/djangoproject.com · GitHub

Authored

• Added GitHub action to test against Django main. by sarahboyce · Pull Request #2713 · django/djangoproject.com · GitHub
• Resolved ModelAdmin.list_select_related deprecation warning. by sarahboyce · Pull Request #2716 · django/djangoproject.com · GitHub
• Added an external login to djangoproject.com. by sarahboyce · Pull Request #305 · django/code.djangoproject.com · GitHub

Other/Misc

• Created a google group for GSOC WG
• Tested whether the following issue could be resolved: Add a test (or a github action) to catch static files issues early · Issue #1831 · django/djangoproject.com · GitHub
• Engaged in 5 django security issues
• Engaged in 1 djangoproject.com security issue
• Created [Feature]: Optional value in LocatorAssertions to_have_attribute and not_to_have_attribute · Issue #3133 · microsoft/playwright-python · GitHub
• Weekly fellow sync
• Django ops meeting
• DjangoCon keynote blog post preparation
• GSOC mentee catch up
• Engaged in https://forum.djangoproject.com/t/revive-or-retire-the-django-core-developer-status/45509/4