Recent Entries

Tech (100)

The Django weblog (100)

Admin

Feed

Unread

Home

Latest news about Django, the Python web framework.

From The Django weblog at 2024-04-03 14:52:43

Django bugfix release issued: 5.0.4

Today we've issued the 5.0.4 bugfix release.

The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E.

From The Django weblog at 2024-03-22 16:54:02

Welcome our new Fellow - Sarah Boyce

The DSF Board and Fellows Committee are pleased to introduce Sarah Boyce as our new Django Fellow. Sarah will be joining Natalia Bidart who is continuing her excellent tenure as a Fellow.

Sarah is a senior developer and developer advocate with 5 years of experience developing with Django under her belt. She graduated with a first class honours degree in Mathematics from the University of Bath, and transitioned in software development in her first job out of school.

Sarah first worked as a client project focused developer, where she gained experience directly dealing with requests from clients as well as managing our own internal ticketing system for feature/bug reports. A stint as a backend developer using Django and DRF provided a grounding in working on long term challenges on a single project. Most recently Sarah has been a developer advocate focused on creating content on and about Django and Django development.

For the past several years, Sarah has been a very active member of the Django community. She has a history of producing well researched and written patches for Django, as well as on a number of highly used third party packages. Sarah is a member of the Django Review and Triage team, helping others to get their patches over the line and into Django. She also finds time to participate in and create content for Django meetups, conferences, and the Django News newsletter.

Sarah is also a Co-Founder and Co-Organiser of Djangonaut Space, the mentorship program developing future contributors to Django and other Django related packages. Djangonaut Space was awarded the 2023 Malcolm Tredinnick Memorial Prize.

Please join me in welcoming and wishing Sarah well as the new Fellow.

Thank you to all of the applicants to the Fellowship. We hope that we will be able to expand the Fellowship program in the future, and knowing that there are more excellent candidates gives us confidence in working towards that goal.

Finally our deepest thanks and gratitude goes to Mariusz Felisiak. Mariusz is stepping down from the Fellowship after 5 years of dedicated service in order to focus on other areas of the Django and wider world. We wish you well Mariusz.

From The Django weblog at 2024-03-04 08:55:55

Django security releases issued: 5.0.3, 4.2.11, and 3.2.25

In accordance with our security release policy, the Django team is issuing Django 5.0.3, Django 4.2.11, and Django 3.2.25. These releases addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()

django.utils.text.Truncator.words() method (with html=True) and truncatewords_html template filter were subject to a potential regular expression denial-of-service attack using a suitably crafted string (follow up to CVE-2019-14232 and CVE-2023-43665).

Thanks Seokchan Yoon for the report.

This issue has severity "moderate" according to the Django security policy.

Affected supported versions

  • Django 5.0
  • Django 4.2
  • Django 3.2

Resolution

Patches to resolve the issue have been applied to the 5.0, 4.2, and 3.2 release branches. The patches may be obtained from the following changesets:

The following releases have been issued:

The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

General notes regarding security reporting

As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

From The Django weblog at 2024-02-11 04:25:18

Django accessibility in 2023 and beyond

Happy birthday, Django accessibility team! 🌈

The team has been up and running for three years, and is now looking for new members. With a lot happening in this space, we thought we were overdue for an update on what we’re up to.

Django accessibility in 2023

We’re very happy with the work done to date. There have been a lot of efforts to improve the accessibility of core Django features such as forms, and of the administrative interface. Beyond Django core, there has also been progress on djangoproject.com, Django packages, and community awareness via talks and events.

Django core

We made a lot of improvements this year. Django forms saw big fixes, which shipped in Django 5.0:

With forms being such a core feature of Django, reused across countless websites, those changes will lead to accessibility improvements across big parts of the web.

The admin interface also saw a lot of fixes and improvements:

Some of those improvements will reflect for everyone, and some will only be beneficial for users of specific assistive technologies, such as Contrast themes in Windows:

Django admin interface in high contrast mode, black theme
→ Screenshot of the admin interface in a “Change redirect” form, in Windows high contrast mode with the “Black” theme.

Can you spot the five issues in this screenshot? Though Contrast Themes isn’t well known, it’s a built-in feature of Windows which is essential for people with low vision. There is a lot of room for improvement to better support it in Django.

We’ve also made a lot of progress on documenting accessibility considerations, though there is still work to be done there:

And finally tooling improvements such as running accessibility checks in the CI pipeline is still a big topic for us, with in-progress efforts to add checks in Selenium tests and standalone with Pa11y.

Django website

In 2023, the website saw its first ever accessibility audit with a focus on the homepage, as well as a good number of accessibility improvements. Those are all very welcome iterative steps in the context of user research on the usability of the website, led by 20tab.

Thank you to our website contributors Sarah Abderemane, Thibaud Colas, ontowhee, Sanyam Khurana, Hana Burtin, Paolo Melchiorre, and Tom Carrick ❀.

Accessibility in our community

We’re elated to see accessibility being such a prominent topic in our community. In 2023, there were a lot of accessibility talks at Django events. There were accessibility contributors at the sprints for DjangoCon Europe, and DjangoCon US. The #accessibility channel on the Django Discord was also very active, and we got a new Accessibility forum category.

There were a lot of accessibility-focused talks at Django events:

Our very own accessibility team member Sarah Abderemane was also featured on Django Chat: Accessibility - Sarah Abderemane 🎉, while Tom and Thibaud signed up for Djangonaut Space’s first session as navigators.

Behind the scenes, the accessibility team also started maintaining a backlog of django accessibility improvement, and also publish their accessibility team meeting notes on the forum.

Django accessibility in numbers

This year, we were able to produce statistics on the accessibility of Django projects, thanks to reports from the HTTP Archive. There is clear room for improvement, with Django websites generally scoring lower than sites built with other technologies:

Median accessibility score of websites by framework, cwvtech.report, December 2023
→ Median Lighthouse website accessibility score of websites by framework. Source: HTTP Archive cwvtech.report, December 2023. Next.js: 85/100, Rails: 83, “All”: 82.5, Django: 80.5, ASP.NET: 79, Laravel: 78.5.

There is also clear data to establish exactly which accessibility issues are common on Django websites:

Difference in Lighthouse audit success rate for sites built with Django vs average site
→ Difference in Lighthouse audit success rate for sites built with Django vs. average site, HTTP Archive 2023-04-01 data, Django vs. “All”. We see 8 metrics where Django does worse than average, and 8 where it does better.

We see those numbers as a good challenge for the Django community to explore ways in which the framework could be improved. There is clear room for improvement, and we have a lot of ideas on how to go about it.

Accessibility plans for 2024

There are a lot of ways in which the accessibility of Django could be improved in 2024. Here are a few ideas that have been discussed so far, where our accessibility team is looking for help:

  • Django ecosystem accessibility audits: Testing Trac or the Forum; or popular Django packages.
  • An official Django demo site: django-admin-demo with even more features.
  • Stylesheets linting: To catch and fix common issues such as small font sizes or poor focus states.
  • Accessibility in docs: A possible big docs overhaul as a Google Season of Docs project.
  • New, accessible admin components: Addressing big gaps in the admin interface.
  • User testing: Working directly with users of assistive technologies.
  • An official Django accessibility statement: On the website, loud and clear.

New members

With this roadmap of improvements in mind, our accessibility team is looking for six new members in 2024. If this sounds like the type of valuable, high-purpose work you want to contribute to – reach out on the Django Discord in #accessibility, or on the forum.

Thank you

Thank you to everyone who took part in making Django more accessible in 2023 and early 2024. You rock!

Django heart
You?
Come say hi on the forum

From The Django weblog at 2024-02-06 14:55:00

Django security releases issued: 5.0.2, 4.2.10, and 3.2.24

In accordance with our security release policy, the Django team is issuing Django 5.0.2, Django 4.2.10, and Django 3.2.24. These releases address the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

CVE-2024-24680: Potential denial-of-service in intcomma template filter

The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings.

Affected supported versions

  • Django main branch
  • Django 5.0
  • Django 4.2
  • Django 3.2

Resolution

Patches to resolve the issue have been applied to Django's main branch and the 5.0, 4.2, and 3.2 stable branches. The patches may be obtained from the following changesets:

The following releases have been issued:

The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E

General notes regarding security reporting

As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance, nor via the Django Forum, nor via the django-developers list. Please see our security policies for further information.

From The Django weblog at 2024-01-19 19:18:18

DSF calls for applicants for a Django Fellow

After five years as part of the Django Fellowship program, Mariusz Felisiak has let us know that he will be stepping down as a Django Fellow in March 2024 to explore other things. Mariusz has made an extraordinary impact as a Django Fellow and has been a critical part of the Django community.

The Django Software Foundation and the wider Django community are grateful for his service and assistance.

The Fellowship program was started in 2014 as a way to dedicate high-quality and consistent resources to the maintenance of Django. As Django has matured, the DSF has been able to fundraise and earmark funds for this vital role. As a result, the DSF currently supports two Fellows - Mariusz Felisiak and Natalia Bidart. With the departure of Mariusz, the Django Software Foundation is announcing a call for Django Fellow applications. The new Fellow will work alongside Natalia.

The position of Fellow is focused on maintenance and community support - the work that benefits most from constant, guaranteed attention rather than volunteer-only efforts. In particular, the duties include:

  • Answering contributor questions on Forum and the django-developers mailing list
  • Helping new Django contributors land patches and learn our philosophy
  • Monitoring the security@djangoproject.com email alias and ensuring security issues are acknowledged and responded to promptly
  • Fixing release blockers and helping to ensure timely releases
  • Fixing severe bugs and helping to backport fixes to these and security issues
  • Reviewing and merging pull requests
  • Triaging tickets on Trac

Being a Django contributor isn't a prerequisite for this position — we can help get you up to speed. We'll consider applications from anyone with a proven history of working with either the Django community or another similar open-source community. Geographical location isn't important either - we have several methods of remote communication and coordination that we can use depending on the timezone difference to the supervising members of Django.

If you're interested in applying for the position, please email us at fellowship-committee@djangoproject.com describing why you would be a good fit along with details of your relevant experience and community involvement. Also, please include your preferred hourly rate and when you'd like to start working. Lastly, please include at least one recommendation.

Applicants will be evaluated based on the following criteria:

  • Details of Django and/or other open-source contributions
  • Details of community support in general
  • Understanding of the position
  • Clarity, formality, and precision of communications
  • Strength of recommendation(s)

Applications will be open until 1200 AoE, February 16, 2024, with the expectation that the successful candidate will be notified no later than March 1, 2024.

From The Django weblog at 2024-01-15 16:14:41

DjangoCon Europe 2025 Call for Proposals

DjangoCon Europe 2024 will be held June 5th-9th in Vigo, Spain but we're already looking ahead to the 2025 conference. Could your town - or your football stadium, circus tent, private island or city hall - host this wonderful community event?

Hosting a DjangoCon is an ambitious undertaking. It's hard work, but each year it has been successfully run by a team of community volunteers, not all of whom have had previous experience - more important is enthusiasm, organizational skills, the ability to plan and manage budgets, time and people - and plenty of time to invest in the project.

How to apply

We've set up a working group of previous DjangoCon Europe organizers that you can reach out to with questions about organizing and running a DjangoCon Europe. european-organizers-support@djangoproject.com. There will also be an informational session set up towards the end of January or early February for interested organizers. Please email the working group to express interest in participating.

In order to give people the chance to go to many different conferences DjangoCon Europe should be held between January 5 and April 15 2025. Please read the licensing agreement the selected organizers will need to sign for the specific requirements around hosting a DjangoCon Europe

If you're interested, we'd love to hear from you. This year we are going to do rolling reviews of applications, in order to hopefully give more time and certainty to the selected proposal to start planning. The board will begin evaluating proposals on February 20th. The selection will be made at any time between February 20th and May 31st. The DSF Board will communicate when a selection has been made and the application process is complete. IF you are interested in organizing it is in your best interest to get a good proposal in early.

Following the established tradition, the selected hosts will be publicly announced at this year's DjangoCon Europe by the current organizers.

The more detailed and complete your proposal, the better. Things you should consider, and that we'd like to know about, are:

  • dates Ideally between early January and mid April 2025
  • numbers of attendees
  • venue(s)
  • accommodation
  • transport links
  • budgets and ticket prices
  • committee members

We'd like to see:

  • timelines
  • pictures
  • prices
  • draft agreements with providers
  • alternatives you have considered

Email you proposals to djangocon-europe-2025-proposals@djangoproject.com. We look forward to reviewing great proposals that continue the excellence the whole community associates with DjangoCon Europe.

From The Django weblog at 2024-01-10 12:00:00

DSF membership now recognizes a much broader range of contributions to Django

Recently, the DSF made some changes to our bylaws to change the definition of DSF Membership. You can read the legalese of the new language in the meeting minutes for the October 12 board meeting, but here’s the short version: previously, individual membership required contribution of intellectual property (e.g. code or documentation) we’ve changed it so that individual membership now recognizes broader contributions to the DSF’s mission. That still includes code and docs, but now also includes many more activities: organizing a Django event, serving on a Working Group, maintaining a third-party app, moderating Django community spaces, and much more. (Corporate membership hasn’t changed; this just applies to individual membership.)

The DSF’s mission, as described in our bylaws, is: 

The Foundation's purposes shall include, but not be limited to, developing and promoting the Django framework for free and open public use among the worldwide web development community, protecting the framework's long-term viability, and advancing the state of the art in web development.

Membership, then, recognizes material contributions to that mission. This is deliberately broad and inclusive: we want to allow as broad a definition of “contribution” as possible – including, critically, contributions to the community as well as code contributions. But we do want those contributions to be “material”: we want to recognize substantial or sustained contributions, not one-offs or “drive-by” contributions.

Because this definition of “material” is somewhat deliberately vague, we’ve prepared an FAQ that outlines several examples of things we believe do and do not qualify someone for membership. Ultimately, though, if you’re not sure: please apply anyway! We generally try to err on the side of saying “yes”.

To join the DSF under these new, more inclusive rules, fill out the application form here. The Board approves new members at its monthly meeting, so you can expect to hear back within about a month.

From The Django weblog at 2024-01-08 21:03:51

DSF Board 2024 Elections – New board members 👋

Following our 2024 DSF Board Election Results , here are quick introductions from our two new board members, Sarah Abderemane and Thibaud Colas, elected for a two-year term for 2024-2025.

Sarah and Thibaud
Collage: Sarah on the left, smiling, in the Versailles Hall of Mirrors. Thibaud on the right, in a field, looking in the distance with a boy on his shoulders.

Sarah Abderemane

Sarah Abderemane, also known as sabderemane, is a software developer in France. She currently works at Kraken Tech, part of the Octopus Energy group, contributing to solutions to climate change. She works mainly on the backend, but also likes to work on the frontend in her spare time.

She organizes the Django Paris meetup and is an active member of the Django community: she is one of the organizers of the Djangonaut Space program, a member of the Django Accessibility team and maintainer of djangoproject.com.

Outside of open source and work, she is passionate about dance, likes customizing things like mechanical keyboards, and loves to travel to discover new cultures.

Social media and blog:

Thibaud Colas

Thibaud Colas (pronounced /tee-bo/) is a developer based in the UK, working for Torchbox on the Wagtail open source CMS as part of the core team. For Wagtail, Thibaud also contributes to efforts around accessibility, developer relations, as well as participation to programs like Outreachy and Google Summer of Code.

For Django, Thibaud has been involved with organizing and volunteering at events like Django Girls and DjangoCon Europe. More recently, he helped start the accessibility team, and has joined the Djangonaut Space program as a navigator.

Outside of work, Thibaud spends most of his time with two little tornadoes that are 5 and 2 years old. He also enjoys watching sumo and baking macarons. To learn more about Thibaud, check out his personal website thib.me , @thibaud_colas on Twitter/X, @thibaudcolas@fosstodon.org on Mastodon.

Both Sarah and Thibaud are active on the Django Forum, come say hi in their introduction thread!

From The Django weblog at 2024-01-04 16:52:55

Unlock Early Savings: Early Bird Tickets for DjangoCon Europe 2024 Now Available!

You can take advantage of our Early Bird ticket sale for DjangoCon Europe 2024. By purchasing your tickets early, you not only guarantee your attendance at one of the most exciting Django events but also enjoy significant savings.

Buy tickets on the conference website

Why Go Early?

You can secure your tickets at a special Early Bird rate, providing exceptional value for your conference experience.

Also, your early commitment goes a long way in supporting the success of DjangoCon Europe 2024. It helps us plan better and ensure a seamless event.

Act now and secure your Early Bird tickets before the sale closes on April 31st. Don't miss out on the chance to save and be a part of this exciting event.

We can't wait to welcome you to DjangoCon Europe 2024!

From The Django weblog at 2024-01-02 09:03:47

Django bugfix releases issued: 4.2.9 and 5.0.1

Today we've issued 5.0.1 and 4.2.9 bugfix releases.

The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

From The Django weblog at 2024-01-01 18:00:00

DjangoCon Europe 2024 CFP Now Open

It's a new year. What better way to start it than submitting your talk or workshop for DjangoCon Europe 2024, in beautiful Vigo, Spain?

The Call for Proposals (CFP) is open now, and will be until midnight on February 29th. That's two whole months, but you don't have to leave it to the last minute:

DjangoCon Europe 2024, Vigo CFP

We're looking for a range of talks on technical and non-technical topics. We're looking for talks accessible to skill all levels, and we're looking for submissions from new and seasoned speakers.

If you're asking, can I do this? The answer is yes. If you've got a topic that interest you, then it interests us.

If you've got half an idea, or aren't sure in any way, and want to chat, you can jump on the DjangoCon Europe Slack, and find us there.

Don't be shy, we want to hear from you!

DjangoCon Europe 2024, Vigo CFP

We'll see you in Vigo!

From The Django weblog at 2023-12-08 16:56:00

2023 Malcolm Tredinnick Memorial Prize awarded to Djangonaut Space

The Django Software Foundation Board is pleased to announce that the 2023 Malcolm Tredinnick Memorial Prize has been awarded to Djangonaut Space.

Djangonaut Space, run by organizers Dawn Wages, Rachell Calhoun, Sarah Abderemane, Sarah Boyce, and Tim Schilling, is a mentoring initiative dedicated to expanding contributions and diversifying contributors within the Django community. Drawing on their extensive experience as mentors and contributors, they've cultivated an inclusive universe for newcomers, emphasizing group learning, sustainability, leadership development and generous use of space puns. 🌌

Thanks to the fantastic support from a team of volunteer mentors, the program had a stellar pilot session, propelling 🎉 nine 🎉 pull requests (PRs) to Django and launching 🎊 five 🎊 new contributors into the Django community. đŸ„ł Given the community's enthusiastic interest and demand, the program is well-positioned to evolve and expand at warp speed, welcoming even more Djangonauts on future missions. 🚀

Each year we receive many nominations, and it is always hard to pick the winner. This year, as always, we received many nominations for the Malcolm Tredinnick Memorial Price with some being nominated multiple times. Some have been nominated in multiple years. If your nominee didn’t make it this year, you can always nominate them again next year.

Malcolm would be very proud of the legacy he has fostered in our community!

Congratulations Djangonaut Space on the well-deserved honor!

From The Django weblog at 2023-12-04 11:17:54

Django 5.0 released

The Django team is happy to announce the release of Django 5.0.

The release notes cover a deluge of exciting new features in detail, but a few highlights are:

You can get Django 5.0 from our downloads page or from the Python Package Index. The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E.

With the release of Django 5.0, Django 4.2 has reached the end of mainstream support. The final minor bug fix release, 4.2.8, was issued today. Django 4.2 is an LTS release and will receive security and data loss fixes until April 2026. All users are encouraged to upgrade before then to continue receiving fixes for security issues.

Django 4.1 has reached the end of extended support. The final security release (4.1.13) was issued on November 1st. All Django 4.1 users are encouraged to upgrade to Django 4.2 or later.

See the downloads page for a table of supported versions and the future release schedule.

From The Django weblog at 2023-12-04 08:33:59

Django bugfix release: 4.2.8

Today we've issued the 4.2.8 bugfix release.

The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

From The Django weblog at 2023-11-29 22:10:49

2024 DSF Board Election Results

The 2024 DSF Board Election has closed, and the following candidates have been elected:

  • Jacob Kaplan-Moss
  • Sarah Abderemane
  • Thibaud Colas

They will all serve two years for their term.

From the 2023 DSF board announcement, Chaim, Katie, KĂĄtia, and Çağıl are continuing directors. They will have one year left to serve on their time.

Therefore, the combined 2024 DSF Board of Directors are:

  • Chaim Kirby
  • Katie McLaughlin
  • KĂĄtia Yoshime Nakamura
  • Çağıl UluƟahin Sonmez
  • Jacob Kaplan-Moss*
  • Sarah Abderemane*
  • Thibaud Colas*

* Elected to a two (2) year term

Congratulations to our winners and a huge thank you to our departing board members Aaron Bassett and Pete Baumgartner.

Thank you again to everyone who nominated themselves. Even if you were not successful, you gave the community the chance to make their voices heard in who they wanted to represent them.

From The Django weblog at 2023-11-20 11:50:53

Django 5.0 release candidate 1 released

Django 5.0 release candidate 1 is the final opportunity for you to try out a deluge of exciting new features before Django 5.0 is released.

The release candidate stage marks the string freeze and the call for translators to submit translations. Provided no major bugs are discovered that can't be solved in the next two weeks, Django 5.0 final release is planned for December 4. Any potential delays will be communicated on the Django forum.

Please use this opportunity to help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the release candidate package from our downloads page or on PyPI.

The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E.

From The Django weblog at 2023-11-13 12:32:36

2024 DSF Board Candidates

Thank you to the twelve individuals who have chosen to stand for election. This page contains their submitted candidate statements. Our deepest gratitude goes to our departing board member, Aaron Bassett, for your contributions and commitment to the Django community. Those eligible to vote in this election will receive information on how to vote shortly. Please check for an email with the subject line "2024 DSF Board Voting".

Chris Achinga Mombasa, Kenya

My Software development career was highly influenced by developer communities. Participating in tech meet-ups and events, notably DjangoCon Africa, has not only expanded my technical skills but also shaped my approach to both personal and professional growth. This experience has motivated me to seek a position on the Django Software Foundation Board, especially after the talks from Anna Makarudze on Navigating the Open-Source World as a Minority, that highlighted the challenges of organising events that benefits African communities As an advocate for African and minority communities within the tech ecosystem, I aspire to bring a unique and necessary perspective to the DSF Board. My commitment to volunteering and giving back to the community aligns perfectly with the ethos of the Django community. My experiences have taught me the value of dedicated community organizers who selflessly share resources and knowledge, fostering an environment where developers at all levels can thrive.

Joining the DSF Board would enable me to champion the interests of young and emerging developers globally, particularly from underrepresented regions. I aim to ensure that everyone, regardless of their background, has equitable access to the opportunities that Django, both as a community and a web development framework, can offer.

In my role with a Non-Governmental Organization aiding youth groups along the Kenyan Coast(Swahilipot Hub Foundation), I've garnered experience in community engagement and utilizing technology for social good. This experience has been instrumental in creating Django-based platforms that empower community self-management. My presence on the DSF Board would not only represent these communities but also allow me to serve as a mentor and technical advisor.

I am eager to contribute my insights and leadership to the DSF Board. With your support, I hope to make a meaningful impact, fostering an inclusive and dynamic environment where every developer can achieve their full potential.

David Vaz Porto, Portugal

Software developer for over 20 years, fell in love with django almost at the beginning of his journey 2007, version 0.96. He loves Django and Python so much he has been bringing developers to the community since then, ended up starting his consultancy firm around these technologies.

During DjangoCon Europe 2019 at Copenhagen he decided to take the next step helping the community, proposing to organize DjangoCon Europe 2020 in Portugal. He got more than he bargained for, ending up co-organising the first virtual-only DjangoCon Europe, repeating in 2021, and finally a hybrid DjangoCon Europe in 2022. His effort, together with the team around him, was rewarded with success, the 2022 edition had record breaking attendees with 500+ in person and 200+ online. To keep things going he is also co-organising DjangoCon Europe in 2024 in Spain Vigo, hoping to bring the Spanish community closer.

David is also contributing to the Portuguese Python Community, starting in 2022 the very first PyCon Portugal. His drive is to bring The Portuguese community forward, with a different city every year to increase the reach of the conference. The first edition was in Porto, leveraging on DjangoCon Europe 2022, this year it was in Coimbra, with participants from over 25 countries, and we are already preparing the next edition.

David is enthusiastic, committed and pragmatic. Throughout his personal and professional journey, he has always had a positive impact in every process he puts his mind on, influencing, building and empowering the people around him. He hopes to put his experience to good use in Django Software Foundation.

Jacob Kaplan-Moss Oregon

I was one of the original maintainers of Django, and was the original founder and first President of the DSF. I re-joined the DSF board and have served for the last year. Outside of Django, I'm a security consultant at Latacora, and have previously ran engineering and security teams at 18F and Heroku.

When I ran for the board last year, I wrote:

> I'd be coming back to the DSF with a bunch of experience in executive leadership and more experience working with nonprofits. I think I can apply those skills, along with my general knowledge of the Django community, to push things forward. What that means, specifically, isn't entirely clear yet. I'd plan to spend the first months of my board term asking a bunch of questions and listening.

I did that asking-questions-and-listening, and what needs doing at the DSF became clear. I'd most succinctly articulate it as: "new blood".

The Django community is super-vibrant and new people are joining the community all the time, but it's very hard for people to "level up" and move to any sort of leadership position at the DSF or among the core team. We just don't have very many opportunities for people to have an impact, and we don't have good "onramps" to that work.

So, this term, I (with the rest of the board) started building some of these opportunities onramps! The recently-announced working group and membership changes are the start of this, and if re-elected I'd want to continue working in this direction. It's now easier for people to join the DSF, and easier for them to spin up working groups to do impactful work. But now we need to start defining these groups, funding them, and continuing this growth.

Jay Miller United States

The Django community often serves as a great example for many aspects of the broader Python community. Our community shines when many of us get involved. To make this happen, we need to encourage greater community involvement.

My goals for the next two years, if elected, are to increase the amount of information we share with the community while reducing the time it takes to disseminate that information to the community.

I intend to utilize the existing channels in the Django and the larger Python community. We will also establish new official communication channels for the foundation. These channels will be managed by a Communications Working Group.

The second effort is to extend our reach to a global and diverse audience. We understand that our impact can extend far beyond our current scope by expanding working groups. Therefore, I would work to create and support working groups that currently lack direct representation in the DSF. I would also advocate for decisions that directly impact these areas to be developed and executed by those individual groups with DSF support.

I hope that you will support me in this vision, which aims to increase the visibility and support of the DSF to the farthest reaches of the community.

Mahmoud Nassee Cairo/Egypt

I really like helping people and also helping this awesome community to grow. I don't have much to say 🙂.. But I really like volunteering work it helps me to make something that I could be proud of and also make some new friends!

Ngazetungue Muheue Namibia

I'm Ngazetungue Muheue, a dedicated software developer, community advocate, and a member of the Django Software Foundation (DSF). I'm also the founder of the Python and Django Community in Namibia. Despite facing unique challenges as a member of underprivileged communities and living with a disability, I've played a significant role in expanding Django by establishing and contributing to various Django and Python communities in Africa and Namibia.

Recognizing the importance of open-source communities and user-friendly technology, I've worked closely with students and underprivileged individuals to bridge the tech gap by involving them in Django user groups, teaching Django, and fostering their participation in the global tech community. As a visionary leader, I've cultivated a culture of collaboration, inclusivity, and continuous learning within the African tech ecosystem. My contributions include organizing the inaugural DjangoCon Africa in 2023 and actively participating in organizing and volunteering at DjangoCon Europe in 2023 and 2022, advancing the growth of the Django ecosystem. I've also spoken at various PyCon events worldwide, showcasing my commitment to fostering the global Django and Python community.

As a board member of the Django Software Foundation, my primary goal is to expand Django communities worldwide, connect underprivileged community members with the DSF, and enhance the inclusivity of the Django community. This involves translating Django documentation for non-English speakers, increasing project grants, integrating people with disabilities into the community, and creating internship opportunities for a more diverse and empowered Django community.

Joining the DSF board will enable me to inspire and support nations in engaging young and underprivileged individuals in tech-related activities while safeguarding the interests and mission of our community and the DSF. More links: https://twitter.com/muheuenga https://2023.djangocon.africa/team https://twitter.com/djangonamibia https://na.pycon.org/ https://pynam.org/django/

Paolo Melchiorre Pescara, Italy

Ciao, I'm Paolo and I live in Italy.

I've been a contributor to the Django project for years, and a member of the DSF. I attended my first DjangoCon Europe in 2017 and have since presented many Django talks at conferences around the world. I've participated as a coach in DjangoGirls workshops several times, and I organized one in my hometown. I've always been a Python developer, I helped the PyCon Italia organization for a few years and I recently founded the Python Pescara meetup.

As a member of the DSF board of directors, I would like to bring a different point of view to the foundation, as a southern European citizen, inhabitant of the Mediterranean area, non-native English speaker, and a small company employee.

Some initiatives I would like to carry forward are:

  • organize active user sprints to focus on specific Django features
  • continue the work of renovating the Django project website
  • create synergies with the Python community and its web sub-communities
  • simplify Django documentation and help its translations
  • support creators of Django content (e.g. books, articles, podcasts, videos, ...)

    • Peter Baumgartner Colorado, USA

    I'm a current DSF board member and acting Treasurer.

    I've been a part of the Django community for over 15 years. I'm an open-source contributor, a regular speaker at DjangoCon US, and the co-author of High Performance Django. In 2007, I founded Lincoln Loop, a web agency that leverages Django extensively in its work. Lincoln Loop has financially sponsored the DSF and DjangoCon for many years, and I'm looking for other ways to give back to a community that has given us so much.

    At Lincoln Loop, I have to wear many hats and deeply understand the financial ramifications of our decisions as a company. I believe the experience of running a business will be directly applicable to a position on the DSF board, and I look forward to applying that experience if elected.

    Sarah Abderemane Paris, France

    I'm an active DSF member and I've been contributing to this amazing community via multiple ways:

  • Django contributor and Accessibility Team Member
  • Maintainer of djangoproject.com
  • Organizer of Djangonaut Space
  • Organizer of Django Paris Meetup
  • Organizer of DjangoCon Europe 2023

    I have seen many aspects of the community through all those experiences. As a relatively new member, I can bring a fresh perspective to the community and help foster a renewed sense of togetherness. I have a strong connection with Djangonaut Space mentoring program and the community. I'm well positioned to serve as an intermediary, facilitating communication regarding initiatives and ideas between the board and the community.

    I would like to increase fundraising by improving communication and making improvements to make each sponsor special by highlighting sponsors not only on the website but also on social networks. Relying on my experiences with various Django projects, I will push forward ideas to further develop our community, specifically helping existing and new contributors.

    With the community's support, I will set up a working group for mentorship and push accessibility in the framework. I am passionate about these topics as they show that Django is a framework for everyone by everyone.

    I see myself as a representative of Django's diversity and would like to emphasize and expand the richness of it even more. Being part of the board would inspire people to get involved and be part of the community. They could add their stone to the building of this wonderful community.

    • Thibaud Colas Europe

    To me, Django feels like it's in maintenance mode, a decade behind in areas like front-end development and serverless. To stay relevant compared to projects with tens of millions in venture capital, we need a more vibrant, more diverse community. We can build one together by making the right programs happen, like Djangonaut Space and Outreachy.

    The DSF also needs to evolve with the times. In the age of ChatGPT, copyright and trademarks are very dated concerns. We need a foundation that can help its community navigate modern societal challenges: social equity issues affecting our users; accessibility issues plaguing the Django web; climate change and Django's carbon footprint.

    I can help. Let's grow Django's contributors 10x, and have the Django universe lead by example in community-driven open source.

    Tom Carrick Amsterdam, Netherlands

    I've been using Django since 2008. A lot has changed since then, but one constant has been my wish to see Django continuously improve.

    I'm active in the community in many ways. I've been a regular code contributor since 2016. I founded the accessibility team, and also started the official Discord server. So I've dedicated quite some time to Django already, but I have room for more, with even more impact.

    I would like to help grow the next generation of Django contributors, from more diverse backgrounds. From running DjangoCon sprint tables over the years, and getting involved with Djangonaut Space, it's clear to me that the new contributor experience has substantial room for improvement.

    I also want to expand Django's fundraising efforts. It's becoming difficult to add important new features. We need more funding to hire more Fellows, and expand their remit to work on bigger features.

    The new working groups are a much needed initiative, and I'd love to help develop all these ideas to their fullest potential.

    Velda Kiara Nairobi, Kenya

    As a passionate software developer and technical writer deeply rooted in the open-source community, I am honored to be running for the DSF board. My experience in contributing to open-source projects, coupled with my leadership background in the Open Source Community Africa Nairobi, has ignited my desire to enhance the participation and contributions of communities from diverse backgrounds. My involvement in open-source initiatives has made me appreciate the power of collaboration and the impact of collective efforts. I have witnessed firsthand how open-source communities foster innovation and inclusivity, enabling individuals from all over the world to share their knowledge and expertise.

    Driven by my belief of open source impact, I aspire to elevate the DSF board's decision-making process by incorporating the unique perspectives and insights of communities from diverse backgrounds. My experience working with developer communities has equipped me with the skills and empathy necessary to understand and address the specific needs of these underrepresented groups. As a leader, I prioritize decision-making that aligns with the needs and aspirations of the community. I believe in fostering an environment where everyone feels empowered to participate, contribute, and lead. My commitment to inclusivity extends beyond the color of one's skin; I envision a DSF community that embraces and celebrates the diversity of thought, experience, and background.

    My passion for Django and my role as an advocate for the framework extend beyond personal preference. I recognize the immense value of Django to the developer community and am eager to contribute further through the DSF board. I believe that my involvement will allow me to add value to the Django community, supporting its growth and ensuring that it remains a thriving hub for developers worldwide. My journey in the open-source community began with a fascination for the framework. However, over time, I have come to realize that the true beauty of open-source lies in the community that surrounds it. I am committed to giving back to this community, not just as a developer or technical writer, but also as a leader and advocate for diversity and inclusion.

    I humbly ask for your vote to join the DSF board and contribute my skills, experience, and passion to the continued growth and success of the Django community. Together, we can create a more inclusive and vibrant open-source ecosystem that empowers individuals from all backgrounds to innovate, collaborate, and make a lasting impact on the world.

    From The Django weblog at 2023-11-01 05:35:26

    Django security releases issued: 4.2.7, 4.1.13, and 3.2.23

    In accordance with our security release policy, the Django team is issuing Django 4.2.7, Django 4.1.13, and Django 3.2.23. These releases addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2023-46695: Potential denial of service vulnerability in UsernameField on Windows

    The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField was subject to a potential denial of service attack via certain inputs with a very large number of Unicode characters.

    In order to avoid the vulnerability, invalid values longer than UsernameField.max_length are no longer normalized, since they cannot pass validation anyway.

    Thanks MProgrammer for the report.

    This issue has severity "moderate" according to the Django security policy.

    Affected supported versions

    • Django main branch
    • Django 5.0 (currently at beta status)
    • Django 4.2
    • Django 4.1
    • Django 3.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and the 5.0, 4.2, 4.1, and 3.2 release branches. The patches may be obtained from the following changesets:

    The following releases have been issued:

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2023-10-23 16:21:03

    Django 5.0 beta 1 released

    Django 5.0 beta 1 is now available. It represents the second stage in the 5.0 release cycle and is an opportunity for you to try out the changes coming in Django 5.0.

    Django 5.0 brings a deluge of exciting new features which you can read about in `the in-development 5.0 release notes`__.

    Only bugs in new features and regressions from earlier versions of Django will be fixed between now and the 5.0 final release. Translations will be updated following the "string freeze", which occurs when the release candidate is issued. The current release schedule calls for a release candidate in a month from now, and a final release to follow about two weeks after that, scheduled for December 4th. Early and frequent testing from the community will help minimize the number of bugs in the release. Updates on the release schedule are available on the Django forum.

    As with all alpha and beta packages, this is not for production use. But if you'd like to take some of the new features for a spin, or to help find and fix bugs (which should be reported to `the issue tracker`__), you can grab a copy of the beta package from `our downloads page`__ or on PyPI.

    The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E.

    Docutils System Messages

    System Message: ERROR/3 (<string>); backlinks: 1, 2, 3

    Anonymous hyperlink mismatch: 3 references but 4 targets. See "backrefs" attribute for IDs.

    From The Django weblog at 2023-10-19 14:00:00

    Djangonaut Space now accepting applications for our next contributor mentorship cohort

    We are thrilled to announce that Django has a mentorship program, and that we're open for applicants for our next cohort!

    Djangonaut Space is an organization working to onboard and develop open source code contributors to Django and beyond. People sustain the framework and its ecosystem. By inviting more people to participate in this community, and giving them the resources and support to succeed, we aim to develop the future leaders of Django.

    Our journey began with our pilot “Djangonaut Space Contributor Program” which ran from July to October 2023 with 6 Djangonauts focussing on contributions to Django core.

    In this time our Djangonauts progressed 9 tickets and closed out 4 of them before the 5.0 feature freeze! There were 25 weekly catch ups, 16 one to ones, 154 pull request review comments and 2 presentations from our Django Fellows! Not to mention, 100% of Djangonauts reported that they felt more comfortable engaging in the Django community after the program.

    “What I like with Djangonaut Space, we have the feeling of being part of the community, especially by meeting the folks I’ve seen working on Django” - Tushar, Djangonaut

    We have also received a grant from the Django Software Foundation! We will use these funds to invest in our Djangonauts and in tools for the program. From all the organizers of Djangonaut Space, thank you so much for your generosity and support.

    If you also wish to support this program financially, please reach out to our organiser team: contact@djangonaut.space.

    So how does the program work?

    Djangonauts are assigned a “Navigator” who guides them on their contributing journey. A Navigator coaches a small group of 3-4 Djangonauts and attends weekly check-ins with them to discuss any challenges they might be facing. Djangonauts also have extra support in the form of a “Captain”. Our Captains organize one to one sessions with Djangonauts to provide extra pastoral support and encouragement. They bring the warmth of the Django community to the program.

    As our pilot program was a great success, we are happy to announce that we are accepting applications for our next program, starting January 15th 2024 for a duration of 8 weeks.

    How to apply

    Please apply here: https://forms.gle/oYVX4mJ27oy7o87f8

    If you are interested in supporting our program by being a Navigator or a Captain, please reach out via this form: https://forms.gle/SnJdw9iEEL4ujQ4L9

    There are many valuable ways to contribute to Django. If working on the framework is something you dream of doing, we want to help you succeed.

    Important links

    From The Django weblog at 2023-10-18 14:46:10

    Nominations for 2023 Malcolm Tredinnick Memorial Prize

    Hello Everyone!

    It is that time of year again when we recognize someone from our community in memory of our friend Malcolm.

    Malcolm was an early core contributor to Django and had both a huge influence and impact on Django as we know it today. Besides being knowledgeable he was also especially friendly to new users and contributors. He exemplified what it means to be an amazing Open Source contributor. We still miss him to this day.

    The DSF Prize page summarizes the prize nicely:

    The Malcolm Tredinnick Memorial Prize is a monetary prize, awarded annually, to the person who best exemplifies the spirit of Malcolm’s work - someone who welcomes, supports, and nurtures newcomers; freely gives feedback and assistance to others, and helps to grow the community. The hope is that the recipient of the award will use the award stipend as a contribution to travel to a community event -- a DjangoCon, a PyCon, a sprint -- and continue in Malcolm’s footsteps.

    We will take nominations until Wednesday, November 8th, 2023, AoE, and will announce the winner soon after the next DSF Board meeting in December. Please make your nominations using this google form. If you have any questions please reach out to the DSF Board at foundation@djangoproject.com.

    From The Django weblog at 2023-10-14 15:19:25

    Announcing DjangoCon Europe 2024 in Vigo, Spain!

    We're thrilled to announce the much-anticipated return of DjangoCon Europe, set to take place in the vibrant city of Vigo, Spain, in 2024!

    DjangoCon Europe has been a cornerstone of the Django community, bringing together developers and enthusiasts from all over Europe and beyond to celebrate and advance the Django web framework.

    Save the Dates

    Mark your calendars for DjangoCon Europe 2024, which will be held from June 5th to 11th. The conference will host a balanced mix of insightful talks, hands-on workshops, and ample opportunities for networking and socializing with fellow Django enthusiasts.

    Explore Vigo

    Nestled on the stunning Galician coastline, Vigo is a city with a rich cultural heritage, breathtaking landscapes, and a burgeoning tech scene. Known for its fresh seafood, historical sites, and lively atmosphere, Vigo is the perfect backdrop for DjangoCon Europe 2024. Whether you're a seasoned Django developer or just starting your journey with web development, Vigo's unique charm and welcoming community will make your conference experience even more memorable.

    Call for Proposals

    DjangoCon Europe wouldn't be the same without the insightful and diverse talks contributed by our community. We encourage you to consider submitting a proposal to share your knowledge, experiences, and insights with the Django community. Keep an eye out for the Call for Proposals (CFP) announcement. This is your chance to contribute to the conference program and help make DjangoCon Europe 2024 exceptional.

    Get Involved

    DjangoCon Europe is a community-driven event, and we rely on the active participation and support of our community members. Here are a few ways you can get involved:

    • Attend: Join us in Vigo for a week of learning, networking, and fun.
    • Speak: Share your expertise by submitting a talk proposal when the CFP opens.
    • Sponsor: Support the conference financially and gain visibility in the Django community (email us at sponsors@djangocon.eu)
    • Volunteer: Help us make the conference run smoothly by volunteering your time and skills (https://forms.gle/DJvG59m5b6bqNQmJ9)

    Stay tuned for updates on registration, sponsorship opportunities, and more by following DjangoCon Europe on Twitter and LinkedIn.

    Stay Informed

    To stay up-to-date with the latest DjangoCon Europe 2024 news, visit our website and follow us on Twitter & LinkedIn. We will be sharing details about the schedule, speakers, and more in the coming months, so make sure you're on the list!

    We can't wait to see you in Vigo, Spain, for DjangoCon Europe 2024. Get ready for a week of learning, networking, and celebrating all things Django. It's going to be an unforgettable event, and we look forward to sharing this experience with you. Thank you for being a part of our amazing Django community!

    Stay tuned for more updates, and we'll see you in Vigo!

    The DjangoCon Europe 2024 Organizing Team

    From The Django weblog at 2023-10-14 04:51:41

    2024 DSF Board Nominations

    Nominations are open for the 2024 Django Software Foundation Board of Directors.

    In 2023 we introduced a staggered term for directors, which means at this time there are three positions currently open, with each position serving for two years.

    As you know, the Board guides the direction of the marketing, governance and outreach activities of the Django community. We provide funding, resources, and guidance to Django events on a global level. Further we provide support to the Django community with an established Code of Conduct and make decisions and enforcement recommendations for violations. We work closely with our corporate and individual members to raise funds to help support our great community.

    In order for our community to continue to grow and advance the Django Web framework, we need your help. The Board of Directors consists of volunteers who are elected to one year terms. This is an excellent opportunity to help advance Django. We can’t do it without volunteers, such as yourself. Anyone including current Board members, DSF Members, or the public at large can apply to the Board. It is open to all.

    If you are interested in helping to support the development of Django we’d enjoy receiving your application for the Board of Directors. Please fill out the application form by October 31, 2023 AoE to be considered. If it is still October 31, 2023 somewhere in the world, applications will remain open.

    If you have any questions about applying, the work, or the process in general please don’t hesitate to reach out via email to foundation@djangoproject.com and one of us will get back with you shortly.

    Thank you for your time and we look forward to working with you in 2024.

    The 2023 DSF Board of Directors.

    2024 DSF Board Nomination Form

    From The Django weblog at 2023-10-13 15:10:45

    Announcing DSF Working Groups

    Today we’re announcing some changes to how the DSF gets work done. We want to make it easier for people to contribute meaningfully to the DSF’s mission. Previously, you more or less needed to be a board member to help; now, anyone can join — or form — a working group to further the DSF’s mission.

    Our intent is, over time, to move the majority of the day-to-day business of the DSF from the Board down to individual working groups. This’ll accomplish two things: it’ll make it much easier for folks to get involved and help the DSF, and it’ll reduce the current bottleneck where the Board needs to be involved in every decision.

    We're tracking all the details — current working groups, info on how to form new ones — in this Github repository. We currently have the following working groups:

    • Code of Conduct: handles reports of violations of Django’s Code of Conduct.
    • DjangoCon Europe Support: supports the DC.EU organizers.
    • Fellowship: manages the operation of the Django Fellowship program.
    • Fundraising: coordinates fundraising efforts, particularly around corporate and major donations.

    Most of these groups are currently seeking volunteers! See each group’s charter doc linked above for instructions on how to volunteer.

    Our next steps are going to be spinning up some new working groups under this structure. We’re planning on three new working groups:

    • Event Grants, that’ll oversee our financial support for events.
    • Social Media, a working group to step up our presence on social media (including this blog).

    If you’d want to join any of these soon-to-be-created groups, contact the board and express your interest.

    And if you’ve got ideas for Working Groups not mentioned above, you should propose your own! The best first step there would be to contact the board to get the conversation started.

    From The Django weblog at 2023-10-04 12:44:04

    Django security releases issued: 4.2.6, 4.1.12, and 3.2.22

    In accordance with our security release policy, the Django team is issuing Django 4.2.6, Django 4.1.12, and Django 3.2.22. These releases addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2023-43665: Denial-of-service possibility in django.utils.text.Truncator

    Following the fix for CVE-2019-14232, the regular expressions used in the implementation of django.utils.text.Truncator’s chars() and words() methods (with html=True) were revised and improved. However, these regular expressions still exhibited linear backtracking complexity, so when given a very long, potentially malformed HTML input, the evaluation would still be slow, leading to a potential denial of service vulnerability.

    The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus also vulnerable.

    The input processed by Truncator, when operating in HTML mode, has been limited to the first five million characters in order to avoid potential performance and memory issues.

    Thanks Wenchao Li of Alibaba Group for the report.

    This issue has severity "moderate" according to the Django security policy.

    Affected supported versions

    • Django main branch
    • Django 5.0 (currently at pre-release alpha status)
    • Django 4.2
    • Django 4.1
    • Django 3.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and the 5.0, 4.2, 4.1, and 3.2 release branches. The patches may be obtained from the following changesets:

    The following releases have been issued:

    The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2023-09-18 21:00:00

    Django 5.0 alpha 1 released

    Django 5.0 alpha 1 is now available. It represents the first stage in the 5.0 release cycle and is an opportunity for you to try out the changes coming in Django 5.0.

    Django 5.0 brings a deluge of exciting new features which you can read about in the in-development 5.0 release notes.

    This alpha milestone marks the feature freeze. The current release schedule calls for a beta release in about a month and a release candidate about a month from then. We'll only be able to keep this schedule if we get early and often testing from the community. Updates on the release schedule are available on the Django forum.

    As with all alpha and beta packages, this is not for production use. But if you'd like to take some of the new features for a spin, or to help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the alpha package from our downloads page or on PyPI.

    The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E.

    From The Django weblog at 2023-09-06 16:45:00

    Last call for DjangoCon US Hotel Reservations

    DjangoCon US 2023 is just about here!

    While the conference isn’t until Oct 16-20, we’re sharing this now because discounted hotel rooms are filling up fast and will go away entirely on September 15th.

    If you can’t make it in person this year, we also have online tickets: https://ti.to/defna/djangocon-us-2023.

    All talks will be available online via the LoudSwarm platform, so you won’t miss any action. We have eleven exclusive talks for our online attendees, so you get more content. Online tickets are a great and affordable way to access the treasure trove of knowledge being shared without making a larger time or financial commitment.

    Tutorials are virtual on October 8th

    This year’s conference will have the tutorials the week before the conference. There wasn’t space at the venue to hold them in-person. You can find the full schedule on our website: https://2023.djangocon.us/tutorials/. This year, we are excited to have tutorials ranging from mastering test driven development to supercharging your Django development environment with VS Code and dev containers.

    The In-person DjangoCon US Experience

    On Monday, October 16th, we kick off with the main conference schedule packed full of talks. Again, that full schedule is live so that you can start planning which room you will be in during the event: https://2023.djangocon.us/talks/

    Two particular talks we’re excited about are Natalia Bidart’s talk “Inside Out: My Journey of Understanding Inclusion” and Thibaud Colas’ talk “Django’s accessibility track record”.

    After two days of talks, on Wednesday the 18th, we will have a full day’s worth of deep-dive sessions, ending with a career development panel. Finally, on Thursday and Friday, we will be hosting two full days of sprints where anyone can get involved making contributions to the Django ecosystem: https://2023.djangocon.us/sprints/. Note that sprints are included in the main ticket prices, but we do ask that you register ahead of time, so we know how many folks will be coming to each day’s session: https://ti.to/defna/djangocon-us-2023

    Beyond The Talks and Sprints

    There is so much happening at DjangoCon US beyond the main conference agenda. We will have board game sessions, impromptu meetups, breakout sessions for those interested in various topics, and so much more! All of the things that are traditionally very difficult to do online, we plan to facilitate in-person so that attendees get the most out of their conference experience.

    Plus, you can explore Durham, North Carolina with the great people you meet here. We think you’ll find it a diverse, welcoming spot with lots to do within walking distance of the conference!

    We are incredibly excited to see everyone online and in person. We hope that you will join us at this year’s conference!

    From The Django weblog at 2023-09-05 23:51:43

    2023 Django Developers Survey

    The DSF is once again partnering with JetBrains to run the 2023 Django Developers Survey.

    Please take a moment to fill it out. The survey is an important metric of Django usage and helps guide future technical and community decisions.

    The survey will be open until October 1st, 2023 Anywhere on Earth (AoE). After the survey is over, the aggregated results will be published.

    JetBrains will randomly choose 10 winners (from those who complete the survey in its entirety), who will each receive a $100 Amazon Gift Card or a local equivalent. Full terms and conditions are available on the survey website.

    From The Django weblog at 2023-09-04 11:27:35

    Django security releases issued: 4.2.5, 4.1.11, and 3.2.21

    In accordance with our security release policy, the Django team is issuing Django 4.2.5, Django 4.1.11, and Django 3.2.21. These releases addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2023-41164: Potential denial of service vulnerability in django.utils.encoding.uri_to_iri()

    django.utils.encoding.uri_to_iri() was subject to potential denial of service attack via certain inputs with a very large number of Unicode characters.

    Thanks MProgrammer for the report.

    This issue has severity "moderate" according to the Django security policy.

    Affected supported versions

    • Django main branch
    • Django 4.2
    • Django 4.1
    • Django 3.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and the 4.2, 4.1, and 3.2 release branches. The patches may be obtained from the following changesets:

    The following releases have been issued:

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2023-08-01 17:50:35

    Django bugfix release: 4.2.4

    Today we've issued the 4.2.4 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E.

    From The Django weblog at 2023-07-04 02:43:33

    PyCharm & DSF Campaign 2023

    The Django Software Foundation’s biggest fundraising event of the year is here!

    https://www.jetbrains.com/pycharm/promo/support-django/

    Each year, our friends at JetBrains, the creators of PyCharm, run an incredible deal. You get a 30% discounted year of PyCharm, AND the DSF gets 100% of the proceeds. Plus, get one free month of access to JetBrains Academy, which has courses like Intro to Django, SQL, Git, and more!

    The fundraiser runs from July 3rd-July 23rd! Buy PyCharm and support Django!

    Donations like this fundraiser allow the DSF to function. Our two wonderful Fellows, Mariusz Felisiak and Natalia Bidart keep Django running smoothly. In 2022, our Fellows (Carlton Gibson and Mariusz) were instrumental in:

    • Releasing 25 Django versions, including 4.1 and the preparation for 4.2
    • Maintaining security: 10 CVEs were identified and patched in a timely manner
    • Triaging hundreds of new issues
    • Managing and supporting the community through mailing lists and forums

    In the past, JetBrains through the PyCharm fundraiser has provided approximately one quarter of the Django Software Foundation’s budget! Remember, get your discounted year of PyCharm now, and the DSF will receive 100% of proceeds!

    The other side of the DSF is our support for Django groups across the globe. We have supported each of the DjangoCons held across the globe, particularly with donating funding towards opportunity grants for more people to be able to attend these conferences. The DSF also supports smaller events around the world, including DjangoGirls events.

    2023 is off to a great start where we hope to do more with your help!

    Finally, I want to tell you about PyCharm itself.

    PyCharm is an integrated development environment (IDE) that helps professional Python web developers be more productive, be more confident, and write better code. It supports the full Python web workflow out of the box, including popular Python web frameworks, such as Django, frontend technologies, and databases.

    Here are the main benefits of using PyCharm in your Django development:

    • The built-in Django run/debug configuration type makes it easy to configure and start the Django server.
    • Syntax and error highlighting, code completion, navigation between views and templates, ability to debug templates visually by inserting a breakpoint right in the editor.
    • Special coding assistance within standard files: urls.py and settings.py: files, folders, view methods, regex injection and highlighting. Utilize intentions to let PyCharm create views and templates from usage.
    • Autocompletion for static resource names in templates, special interactive task window for manage.py with project-driven autocomplete, Jinja and Mako templates in Django, code intentions such as convert function view to/from class-based view, template inspections to warn for mistakes, i18n helpers, live templates for Django, model diagrams, and more.

    Get Django work done with PyCharm, a powerful IDE tailored for Django web development!

    Consider this the easiest charitable donation you will ever make, when you get such a great product in return!

    If you would like to donate in another way, especially if you are already a PyCharm customer, here are other ways to donate to the DSF:

    On our website via credit card: https://www.djangoproject.com/fundraising/

    Via GitHub sponsors: https://github.com/sponsors/django

    For those able to make a larger donation, particularly corporate sponsors, more information: https://www.djangoproject.com/foundation/corporate-membership/ and application: https://www.djangoproject.com/foundation/corporate-membership/join/

    Thank you,

    Catherine Holmes

    DSF Assistant

    From The Django weblog at 2023-07-03 08:57:52

    Django security releases issued: 4.2.3, 4.1.10, and 3.2.20

    In accordance with our security release policy, the Django team is issuing Django 4.2.3, Django 4.1.10, and Django 3.2.20. These releases addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2023-36053: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator

    EmailValidator and URLValidator were subject to potential regular expression denial of service attack via a very large number of domain name labels of emails and URLs.

    Thanks Seokchan Yoon for reports.

    This issue has severity "moderate" according to the Django security policy.

    Affected supported versions

    • Django main branch
    • Django 4.2
    • Django 4.1
    • Django 3.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and the 4.2, 4.1, and 3.2 release branches. The patches may be obtained from the following changesets:

    The following releases have been issued:

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2023-06-05 15:25:00

    Django bugfix release: 4.2.2

    Today we've issued the 4.2.2 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E.

    From The Django weblog at 2023-05-16 07:52:43

    Django 5.x Steering Council Election Results

    The Steering Council for the Django 5.x release cycle will be:

    • Simon Charette
    • Andrew Godwin
    • Adam Johnson
    • James Bennett

    Congratulations to the new council, and a special thank you for the departing members Thomas Forbes and Florian Apolloner.

    Thank you to everyone who participated in the nominations and voting.

    Voting breakdown:

    • 268 eligible voters
    • 74 votes received

    There were not enough candidates to fill the positions available, so all candidates were successful.

    Full voting breakdown available on RankedVote.co.

    From The Django weblog at 2023-05-16 01:18:18

    May 2023 Grants

    I wanted to share today some of the great things that DSF donations go towards. This month was a particularly big month in grant approval, so I wanted to highlight some of those, and with it, some of the exciting things happening in the Django community.

    $6,000 to DjangoCon Africa

    The first DjangoCon Africa was scheduled to take place in 2020. However, with the global health situation as it was, 2023 is now the inaugural DjangoCon Africa, and the DSF is excited to be part of that. This grant is to help DjangoCon Africa get started, and to fund smaller grants help attendees attend DjangoCon Africa. DjangoCon Africa will be November 6-11. https://2023.djangocon.africa/

    $6,000 to DjangoCon US

    This year, DjangoCon US is a hybrid conference, taking place in Durham, NC, and online. This was a great success last year, making the conference more accessible than ever, and there has been special focus this year on enhancing both conference experiences. 100% of the DSF’s donation for DjangoCon US will go to Opportunity Grants, to help people who would be unable to afford the conference, travel, or lodging, to attend the conference. DjangoCon US will take place October 16-20, and a special online tutorials day will happen the week before the conference, on October 8th. Tutorial tickets are separate from conference tickets. https://2023.djangocon.us/

    While we are talking about DjangoCons, I didn’t want to go without talking about DjangoCon Europe and DjangoCon Australia, even though grants for these were approved in previous months.

    DjangoCon Europe is coming up soon! May 29th- June 2 in Edinburgh! https://2023.djangocon.eu/ Tickets are on sale now!

    DjangoCon Australia is a one day track that runs alongside PyCon US. It will be August 18, and PyCon AU will continue August 19-22. The CFP is open now: https://2023.djangocon.com.au/

    $1,000 Other

    The DSF also vets and approves smaller grants for Django groups all over the world. This month, $1000 in other grants was given out.

    $10,000 to DjangoGirls

    Finally, I wanted to highlight the DSF’s work with DjangoGirls. DjangoGirls is an organization that provides the reference materials and other resources to empower local groups around the world to host workshops, with a focus on teaching women Python and Django. The DSF supports the organization as a whole, as well as directly sponsoring local groups.

    If you are in a position to support these efforts, please consider donating to the DSF. None of this can happen without community support.

    For individual and smaller company donations, donate here: https://www.djangoproject.com/fundraising/

    If you wish, your name and a link of your choice can appear on our website for one year. Donations can be one-time, monthly, quarterly, or yearly.

    You can also donate through GitHub: https://github.com/sponsors/django

    For companies able to make a larger commitment ($2000+), please look at corporate membership: https://www.djangoproject.com/foundation/corporate-membership/ and consider making an application: https://www.djangoproject.com/foundation/corporate-membership/join/

    Thank you,

    Catherine Holmes

    DSF Assistant

    From The Django weblog at 2023-05-10 07:00:00

    Announcing DjangoCon Africa 2023

    The African Django community is excited to announce the first DjangoCon Africa event, taking place this year in Zanzibar, Tanzania, from 6th - 11th November 2023. The first event since the global pandemic postponed our planning in 2020. We are thrilled to convene, support one another and give back to the African Python web community now that travel and health safety guidelines have normalized.

    DjangoCon Africa 2023 will be held at the State University of Zanzibar where we have three meeting rooms, one auditorium, 15 minutes away from food and activities, and convenient access to students, professionals, and international travelers.

    About DjangoCon Africa

    DjangoCon Africa will include 3 days of single-track talks, 2 days of workshops and sprints, and one day of touring for international visitors.

    The event will also include a Django Girls workshop to be held the weekend before DjangoCon Africa. To make the conference as inclusive as possible, the event will offer financial aid to members of under-represented communities in software to ensure they can also attend.

    The CFP, which is open to all, will also be announced as soon as the month of June.

    Sponsorship

    The success of DjangoCon Africa lies hugely in the sponsorship of organizations and individuals within the Python/Django community. We are appealing to organizations and individuals to help us make DjangoCon Africa possible by sponsoring the event.

    If you are interested in sponsoring DjangoCon Africa 2023, please contact the team at sponsors@djangocon.africa.

    From The Django weblog at 2023-05-03 13:59:02

    Django security releases issued: 4.2.1, 4.1.9, and 3.2.19

    In accordance with our security release policy, the Django team is issuing Django 4.2.1, Django 4.1.9, and Django 3.2.19. These releases addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2023-31047: Potential bypass of validation when uploading multiple files using one form field

    Uploading multiple files using one form field has never been supported by forms.FileField or forms.ImageField as only the last uploaded file was validated. Unfortunately, Uploading multiple files topic suggested otherwise.

    In order to avoid the vulnerability, ClearableFileInput and FileInput` form widgets now raise ValueError when the multiple HTML attribute is set on them. To prevent the exception and keep the old behavior, set allow_multiple_selected to True.

    For more details on using the new attribute and handling of multiple files through a single field, see Uploading multiple files.

    Thanks Moataz Al-Sharida and nawaik for reports.

    This issue has severity "low" according to the Django security policy.

    Affected supported versions

    • Django main branch
    • Django 4.2
    • Django 4.1
    • Django 3.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and the 4.2, 4.1, and 3.2 release branches. The patches may be obtained from the following changesets:

    The following releases have been issued:

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2023-04-23 04:16:49

    Django 5.x Steering Council Candidate Registration

    With the completion of the Django 4.x major release cycle and in accordance with DEP-0010 and DEP-0012, it is now time to collect candidates for the Django Steering Council.

    Steering council candidates must demonstrate:

    • A history of substantive contributions to Django or the Django ecosystem. This history must begin at least 18 months prior to the individual's candidacy for the Steering Council, and include substantive contributions in at least two of these bullet points:
      • Code contributions on Django projects or major third-party packages in the Django ecosystem
      • Reviewing pull requests and/or triaging Django project tickets
      • Documentation, tutorials or blog posts
      • Discussions about Django on the django-developers mailing list or the Django Forum
      • Running Django-related events or user groups
    • A history of engagement with the direction and future of Django. This does not need to be recent, but candidates who have not engaged in the past three years must still demonstrate an understanding of Django's changes and direction within those three years.

    To register your candidacy, we require you to enter your name, email, and a bio/evidence of qualifications. The candidacy form has optional fields for your GitHub, Twitter, and website which can be useful for evaluating your qualifications.

    Your email address will only be used by the DSF to contact you related to the election and process and will not be shared publicly.

    Registration for Candidates will end on April 30th, 2023 AoE.

    Please register using this form.

    If you have questions about the election please contact foundation@djangoproject.com.

    Please note: A previous version of this post used the term "Technical Board" with the candidacy requirements in DEP-0010. It has since been updated to reflect the requirements in DEP-0012, which updates DEP-0010. Additional time has been added to the candidacy nomination window to compensate.

    From The Django weblog at 2023-04-22 22:49:17

    Django 5.x Technical Board Candidate Registration

    With the completion of the Django 4.x major release cycle and in accordance with DEP-0010, it is now time to collect candidates for the Django Technical Board.

    Technical board candidates must demonstrate:

    • A history of technical contributions to Django or the Django ecosystem. This history MUST begin at least 18 months prior to the individual's candidacy for the Technical Board.
    • A history of participation in Django's development outside of contributions merged to the https://github.com/django/django/ repository. This may include, but is not restricted to:
      • Participation in discussions on the django-developers mailing list or Django Forum.
      • Reviewing and offering feedback on pull requests in the Django source-code repository
      • Assisting in triage and management of the Django bug tracker.
    • A history of recent engagement with the direction and development of Django. Such engagement MUST have occurred within a period of no more than two years prior to the individual's candidacy for the Technical Board.

    To register your candidacy, we require you to enter your name, email, and a bio/evidence of qualifications. The candidacy form has optional fields for your GitHub, Twitter, and website which can be useful for evaluating your qualifications.

    Your email address will only be used by the DSF to contact you related to the election and process and will not be shared publicly.

    Registration for Candidates will end on April 28th, 2023 AoE.

    Please register using this form.

    If you have questions about the election please contact foundation@djangoproject.com.

    From The Django weblog at 2023-04-16 03:17:02

    Announcement of 5.x Technical Board Election Registration

    The release of Django 4.2 represents the final feature release of a major release series of Django. Per DEP-0010 this release triggers the election for the Technical board for the Django 5.x release cycle.

    All individual DSF members are automatically registered electors.

    If you are not a DSF member and would like to apply to vote you need to register here.

    The process of electing a new Technical Board will be:

    • Registration of Electors is now open, and will close Friday April 21, 2023 AoE.
    • Registration of Candidates will then be open for one week ending Friday April 28th, 2023 AoE
    • On May 5th, 2023 all registered and approved electors will receive an email to the email address they are registered with along with a unique code to be used when voting.
    • Voting will be open for one week, until May 12th, 2023 AoE.
    • The results of the election will be announced when voting is finished.

    All times are Anywhere on Earth (AoE), or UTC-12:00.

    If you have any questions about the election please contact foundation@djangoproject.com.

    Katie McLaughlin,

    Secretary, Django Software Foundation

    From The Django weblog at 2023-04-05 07:11:42

    Django bugfix release: 4.1.8

    Today we've issued the 4.1.8 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    From The Django weblog at 2023-04-03 09:59:42

    Django 4.2 released

    The Django team is happy to announce the release of Django 4.2.

    This version has been designated as a long-term support (LTS) release, which means that security and data loss fixes will be applied for at least the next three years. It will also receive fixes for crashing bugs, major functionality bugs in newly-introduced features, and regressions from older versions of Django for the next eight months until December 2023.

    The release notes cover the farrago of new features in detail, but a few highlights are:

    You can get Django 4.2 from our downloads page or from the Python Package Index. The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    With the release of Django 4.2, Django 4.1 has reached the end of mainstream support. The final minor bug fix release, 4.1.7, was issued on February 14, 2023. Django 4.1 will receive security and data loss fixes until December 2023. All users are encouraged to upgrade before then to continue receiving fixes for security issues.

    Django 4.0 has reached the end of extended support. All Django 4.0 users are encouraged to upgrade to Django 4.1 or later.

    See the downloads page for a table of supported versions and the future release schedule.

    From The Django weblog at 2023-03-31 14:26:30

    Welcome our new Fellow - Natalia Bidart

    The DSF Board and Fellows Committee are pleased to introduce Natalia Bidart as our new Django Fellow. Natalia will be joining Mariusz Felisiak who is continuing his long and excellent tenure as a Fellow.

    Natalia is a Python expert with almost 15 years of experience working with Django. She graduated from the National University of Cordoba, Argentina, with a degree in Computer Science in 2007, and began her professional career in 2005 working for a Python startup before joining Canonical in 2009.

    During her time at Canonical, Natalia spent over a decade as a senior engineer in the Online Services team, where she helped develop and maintain various backend web services, including the Ubuntu One File Sync service. Later on, she was promoted to tech lead and architect of the Snap Store.

    Natalia has been an active participant in the Python community, attending various Python related conferences over the years. She has given talks on a variety of topics, including building robust software, with a focus on software development best practices and testing. Additionally, Natalia is committed to promoting diversity and inclusion in the tech industry and is always looking for ways to contribute to this effort. She is passionate about open source and believes that well-written code, documentation, and tests are essential to a project's success.

    You can find Natalia on Github as nessita and on Mastodon at @nessita@fosstodon.org.

    Thank you to all of the applicants to the Fellowship. We hope that we will be able to expand the Fellowship program in the future, and knowing that there are more excellent candidates gives us confidence in working towards that goal.

    Finally our deepest thanks and gratitude goes to Carlton Gibson. Carlton is stepping down from the Fellowship after 5 years of dedicated service in order to focus on other areas of the Django world. We wish you well Carlton.

    From The Django weblog at 2023-03-20 20:21:46

    Want to host DjangoCon Europe 2024?

    DjangoCon Europe 2023 will be held May 29th-June 2nd in Edinburgh, Scotland, but we're already looking ahead to next year's conference. Could your town - or your football stadium, circus tent, private island or city hall - host this wonderful community event?

    Hosting a DjangoCon is an ambitious undertaking. It's hard work, but each year it has been successfully run by a team of community volunteers, not all of whom have had previous experience - more important is enthusiasm, organisational skills, the ability to plan and manage budgets, time and people - and plenty of time to invest in the project.

    You'll find plenty of support on offer from previous DjangoCon organisers, so you won't be on your own.

    How to apply

    If you're interested, we'd love to hear from you. Following the established tradition, the selected hosts will be announced at this year's DjangoCon by last year's organiser but must fall more than one month from DjangoCon US and PyCon US, and EuroPython in the same calendar year. In order to make the announcement at DjangoCon Europe we will need to receive your proposal by May 10.

    The more detailed and complete your proposal, the better. Things you should consider, and that we'd like to know about, are:

    • dates Ideally between mid May and mid June 2024
    • numbers of attendees
    • venue(s)
    • accommodation
    • transport links
    • budgets and ticket prices
    • committee members

    We'd like to see:

    • timelines
    • pictures
    • prices
    • draft agreements with providers
    • alternatives you have considered

    Email you proposals to djangocon-europe-2024-proposals at djangoproject dot com. They will all help show that your plans are serious and thorough and that you have the organisational capacity to make it a success.

    We will be hosting a virtual informational session for those that are interested or may be interested in organising a DjangoCon. Please complete indicate your interest here.

    If you have any questions or concerns about organising a DjangoCon you can Just drop us a line.

    From The Django weblog at 2023-03-20 07:33:07

    Django 4.2 release candidate 1 released

    Django 4.2 release candidate 1 is the final opportunity for you to try out the farrago of new features before Django 4.2 is released.

    The release candidate stage marks the string freeze and the call for translators to submit translations. Provided no major bugs are discovered that can't be solved in the next two weeks, Django 4.2 will be released on or around April 3. Any delays will be communicated on the Django forum.

    Please use this opportunity to help find and fix bugs (which should be reported to the issue tracker). You can grab a copy of the package from our downloads page or on PyPI.

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    From The Django weblog at 2023-03-09 16:52:15

    PyCharm & DSF Campaign 2023 Results

    We are excited to share the results of the annual Django Developers Survey which was conducted this year in collaboration with JetBrains. Almost 5,000 Django users from 248 countries took the survey which covered a broad list of topics including Django usage, operating systems, libraries, tools, and many other insights.

    View the results of the 2022 Django Developers Survey.

    If you have feedback on the findings and how to improve the survey in future years please share on the official Django Forum.

    Thank you to everyone who participated!

    From The Django weblog at 2023-02-20 08:50:01

    Django 4.2 beta 1 released

    Django 4.2 beta 1 is now available. It represents the second stage in the 4.2 release cycle and is an opportunity for you to try out the changes coming in Django 4.2.

    Django 4.2 has a farrago of new features which you can read about in the in-development 4.2 release notes.

    Only bugs in new features and regressions from earlier versions of Django will be fixed between now and 4.2 final (also, translations will be updated following the "string freeze" when the release candidate is issued). The current release schedule calls for a release candidate in a month from now with the final release to follow about two weeks after that around April 3. Early and often testing from the community will help minimize the number of bugs in the release. Updates on the release schedule schedule are available on the Django forum.

    As with all alpha and beta packages, this is not for production use. But if you'd like to take some of the new features for a spin, or to help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the beta package from our downloads page or on PyPI.

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    From The Django weblog at 2023-02-14 08:35:55

    Django security releases issued: 4.1.7, 4.0.10, and 3.2.18

    In accordance with our security release policy, the Django team is issuing Django 4.1.7, Django 4.0.10, and Django 3.2.18. These releases addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2023-24580: Potential denial-of-service vulnerability in file uploads

    Passing certain inputs to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

    The number of files parts parsed is now limited via the new DATA_UPLOAD_MAX_NUMBER_FILES setting.

    Thanks to Jakob Ackermann for the report.

    This issue has severity "moderate" according to the Django security policy.

    Affected supported versions

    • Django main branch
    • Django 4.2 (currently at pre-release alpha status)
    • Django 4.1
    • Django 4.0
    • Django 3.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and the 4.2, 4.1, 4.0, and 3.2 release branches. The patches may be obtained from the following changesets:

    The following releases have been issued:

    The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2023-02-07 18:00:00

    DSF calls for applicants for a Django Fellow

    After five years as part of the Django Fellowship program, Carlton Gibson has decided to step down as a Django Fellow this spring to explore other things. Carlton has made an extraordinary impact as a Django Fellow. The Django Software Foundation is grateful for his service and assistance.

    The Fellowship program was started in 2014 as a way to dedicate high-quality and consistent resources to the maintenance of Django. As Django has matured, the DSF has been able to fundraise and earmark funds for this vital role. As a result, the DSF currently supports two Fellows - Carlton and Mariusz Felisiak. With the departure of Carlton, the Django Software Foundation is announcing a call for Django Fellow applications. The new Fellow will work alongside Mariusz.

    The position of Fellow is focused on maintenance and community support - the work that benefits most from constant, guaranteed attention rather than volunteer-only efforts. In particular, the duties include:

    • Answering contributor questions on Forum and the django-developers mailing list
    • Helping new Django contributors land patches and learn our philosophy
    • Monitoring the security@djangoproject.com email email alias and ensuring security issues are acknowledged and responded to promptly
    • Fixing release blockers and helping to ensure timely releases
    • Fixing severe bugs and helping to backport fixes to these and security issues
    • Reviewing and merging pull requests
    • Triaging tickets on Trac

    Being a Django contributor isn't a prerequisite for this position — we can help get you up to speed. We'll consider applications from anyone with a proven history of working with either the Django community or another similar open-source community. Geographical location isn't important either - we have several methods of remote communication and coordination that we can use depending on the timezone difference to the supervising members of Django.

    If you're interested in applying for the position, please email us describing why you would be a good fit along with details of your relevant experience and community involvement. Also, please include the amount of time each week you'd like to dedicate to the position (a minimum of 20 hours a week), your preferred hourly rate, and when you'd like to start working. Lastly, please include at least one recommendation.

    Applicants will be evaluated based on the following criteria:

    • Details of Django and/or other open-source contributions
    • Details of community support in general
    • Understanding of the position
    • Clarity, formality and precision of communications
    • Strength of recommendation(s)

    Applications will be open until 1200 AoE, February 28, 2023, with the expectation that the successful candidate will be notified around March 15, 2023.

    From The Django weblog at 2023-02-01 09:56:36

    Django security releases issued: 4.1.6, 4.0.9, and 3.2.17

    In accordance with our security release policy, the Django team is issuing Django 4.1.6, Django 4.0.9, and Django 3.2.17. These releases addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2023-23969: Potential denial-of-service via Accept-Language headers

    The parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if large header values are sent.

    In order to avoid this vulnerability, the Accept-Language header is now parsed up to a maximum length.

    Thanks to Nick Pope for the report and patch.

    This issue has severity "moderate" according to the Django security policy.

    Affected supported versions

    • Django main branch
    • Django 4.2 (currently at pre-release alpha status)
    • Django 4.1
    • Django 4.0
    • Django 3.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and the 4.2, 4.1, 4.0, and 3.2 release branches. The patches may be obtained from the following changesets:

    The following releases have been issued:

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2023-01-17 09:54:33

    Django 4.2 alpha 1 released

    Django 4.2 alpha 1 is now available. It represents the first stage in the 4.2 release cycle and is an opportunity for you to try out the changes coming in Django 4.2.

    Django 4.2 has a farrago of new features which you can read about in the in-development 4.2 release notes.

    This alpha milestone marks the feature freeze. The current release schedule calls for a beta release in about a month and a release candidate about a month from then. We'll only be able to keep this schedule if we get early and often testing from the community. Updates on the release schedule are available on the Django forum.

    As with all alpha and beta packages, this is not for production use. But if you'd like to take some of the new features for a spin, or to help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the alpha package from our downloads page or on PyPI.

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    From The Django weblog at 2023-01-02 07:37:17

    Django bugfix release: 4.1.5

    Today we've issued the 4.1.5 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    From The Django weblog at 2022-12-06 15:12:23

    DjangoCon US and Europe 2022 Talks Available Online

    The organizers of DjangoCon US and DjangoCon Europe spend a tremendous amount of energy both hosting the conferences and putting all the talks online after. The complete playlists of talks from each conference are now available on YouTube:

    From The Django weblog at 2022-12-06 09:32:11

    Django bugfix release: 4.1.4

    Today we've issued the 4.1.4 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00.

    From The Django weblog at 2022-11-29 13:19:07

    2023 DSF Board Election Results

    The 2023 Board is transitional to our new staggered 2 year term board membership model.
    Here are the results of this year's election as selected by ranked choice voting:

    1. Chaim Kirby*
    2. Jacob Kaplan-Moss
    3. Katie McLaughlin*
    4. Aaron Bassett
    5. KĂĄtia Yoshime Nakamura*
    6. Peter Baumgartner
    7. Cagil Ulusahin Sonmez*
    * Elected to a two (2) year term

    Congratulations to our winners and a huge thank you to our departing board members Anna Makarudze, Mfon Eti-mfon, William Vincent, and Ćœan Anderle. You all set the bar very high for the next board.

    Also a special thank you to the 30 candidates we had this year. The DSF simply isn't possible without the help of all of our volunteers.

    From The Django weblog at 2022-11-25 16:00:00

    2022 Malcolm Tredinnick Memorial Prize awarded to Paolo Melchiorre

    The Django Software Foundation Board is pleased to announce that the 2022 Malcolm Tredinnick Memorial Prize has been awarded to Paolo Melchiorre.

    Paolo Melchiorre has been a member of the Python community since 2006, also of the Django community since 2012, and a DSF Member since 2020. Over the last 5 years, Paolo has presented nearly 40 Django talks at various DjangoCon, PyCon, and community conferences both online and in person. He also has been an active contributor to the djangoproject.com website since 2017.

    Paolo is an organizer and coach of Django Girls workshops, an active member of the Italian Django community, and a translator of the Django documentation into Italian. He also writes about Open Source; articles and guides related to Django and Python on his personal blog; attends and organizes sprints on Django, and has been actively involved in answering Django questions on StackOverflow since 2015. He is a volunteer at Python and Django conferences and co-organizer of PyCon Italy.

    Sarah Abderemane, who nominated Paolo had this to say about Paolo:

    In my opinion, Paolo has done an incredible amount of work and deserves to be recognized. He is a reviewer and contributor for djangoproject.com and is also present in the Python community. He speaks at many conferences, sharing his knowledge and also volunteering to help the organizers. I had the chance to meet him at DjangoCon Europe, he is a friendly and welcoming member of the community.

    Other nominations for this year included:

    • Carlton Gibson
    • Catherine Holmes
    • CodenameTim (Discord handle)
    • Ed Rivas
    • Eduardo Zepeda
    • Florian Braun
    • Kojo Idrissa
    • Jorge Gimeno
    • Nikita Sobolev
    • Will Vincent

    Each year we receive many nominations, and it is always hard to pick the winner. This year, as always, we received many nominations for the Malcolm Tredinnick Memorial Price with some being nominated twice. Some people have been nominated in multiple years, including this year’s winner, so if your nominee didn’t make it this year, you can always nominate them again next year.

    Malcolm would be very proud of the legacy he has fostered in our community!

    Congratulations Paolo on the well-deserved honor!

    From The Django weblog at 2022-11-16 02:36:01

    2023 DSF Board Candidates

    Thank you to the thirty individuals who have chosen to stand for election. Our deepest gratitude goes to our departing board members for your contributions and commitment to the Django community.

    • Anna Makarudze
    • Mfon Eti-mfon
    • William Vincent
    • Ćœan Anderle
    DSF members please take the time to review the candidates so that you can make an informed vote. Clicking on a candidates name will expand their candidate statement.
    Daniel Andrlik King of Prussia, PA, USA
    Secretary

    I’m passionate about Django as a web framework, though my professional experience has been primarily in management roles. In addition, I’ve previously served on the board of directors for for non-profit transportation agencies for disabled individuals. As a result I both have experience with the internal processes of running a non-profit entity and also am passionate about outreach to historically disadvantaged individuals.

    Aaron Bassett Florida, USA
    President, Vice President

    It appears this year that several members of the board will be stepping down. It saddens me to see them go as I have really enjoyed serving with them over the years. The work they have done, mostly behind the scenes, has been vital to the ongoing success of Django and the community as a whole. I cannot thank them enough.

    I am also excited at the potential for new people to join the board. I can't wait to see what fresh ideas and initiatives they bring.

    As a previous VP and long serving member of the board I have a lot of experience and knowledge that I believe would be valuable to these new members. I am nominating myself so that I can provide some continuity and context to the board during this time of transition.

    Peter Baumgartner Colorado, USA
    President, Vice President, Treasurer

    I've been a part of the Django community for over 15 years. I'm an open-source contributor, a regular speaker at DjangoCon US, and the co-author of High Performance Django.
    In 2007, I founded Lincoln Loop, a web agency that leverages Django extensively in its work. Lincoln Loop has financially sponsored the DSF and DjangoCon for many years, and I'm looking for other ways to give back to a community that has given us so much.

    At Lincoln Loop, I have to wear many hats and deeply understand the financial ramifications of our decisions as a company. I believe the experience of running a business will be directly applicable to a position on the DSF board, and I look forward to applying that experience if elected.

    Vicent Coll Borreda Spain, Alicante
    President, Vice President, Treasurer, Secretary

    I consider myself a very fun person who generates a good teamwork environment knowing when a smile is needed and when concentration and seriousness are needed, at the same time I always try to help my colleagues to be more proactive while learning. quickly from people better than me. Also, above all, I consider myself a problem solver.

    Ryan Cheley California, United States
    Treasurer, Secretary

    As a member of the Django Software Foundation Board may goals are to:

    1. Ensure that applications developed using Django can be easily deployed by advocating for "production settings" as part of the "batteries included" aspect of Django
    2. Make it easier to contribute to Django

    I have been using Django since 2018 and have contributed a couple of documentation updates to DjangoProject.com.
    Additionally, I have made several contributions to DjangoPackages.org.

    I attended my first DjangoCon US in October of 2022 and I was inspired by the inclusive and welcoming people I encountered. I would love to become more involved and find more ways to give back to this amazing community.
    Ryan

    Gajendra Deshpande India
    Vice President

    Hello Everyone,
    I am Gajendra Deshpande, and I am using Python since 2013 for academic research and development activities. I develop prototypes and applications in Natural Language Processing, Machine Learning, Cyber Security, and Web applications using Python and its ecosystem. I am working as a faculty of Computer Science and run a start-up in cyber security. I am an active member of the PyCon India community and served as program committee lead for PyCon India 2021. I have presented approximately 80 talks, 20 Workshops, and 15 posters across the globe at prestigious conferences like DjangoCon US, DjangoCon EU, DjangoCongress Japan, PyData Global, PyCon APAC, PyCon AU, EuroPython, SciPy India, SciPy USA, PyCon USA, JuliaCon, FOSDEM, and several other Python and FOSS conferences. I have helped Python and FOSS Conferences by reviewing the talk and tutorial proposals, mentoring first-time speakers, participating in the discussions, and organizing the events. I am passionate about community work and would love to continue contributing to the Django community. I believe that as a member of the DSF board I can contribute to the community more effectively.

    Goals as a DSF board member (2023)
    1. Start regional Django communities (especially in Asia and other regions) to spread awareness about Django. Introduce more people to the Django community and facilitate them to become contributors to the community in various capacities such as Speakers, Volunteers, and core Django developers.

    2. Work as a facilitator to start more regional Django conferences (e.g., DjangoCon Asia) and City level chapters in the Global South. I started the BelPy conference in 2021 which is a regional conference in Belagavi, India. I have Initiated the organization of Django conference and grow it to DjangoCon in Asia region like DjangoCon US and DjangoCon EU. The Django Conference is in the planning stage and will be organized in the last week of March or the first week of April 2023. Our university has agreed to host the same at no cost.

    3. Work with industries to develop Python/Django courses and enable the adoption of industry-aligned Python/Django courses in universities and colleges. These courses can be offered as a part of the curriculum wherever possible or as add-on courses. The goal is to make more people employable in a short time using the “Train-to-Deploy” approach. The courses shall be made available free of cost to the Python/Django community and especially for those who are suffering from economic hardships.

    4. Work with start-ups for adoption of Django in product development thereby encourage them to contribute towards and Python/Django community and DSF.
    5. Create awareness among people regarding the activities of DSF, Python/Django conferences, Projects, and grants. Motivate and mentor people from diverse backgrounds to apply for grants and projects.

    6. Work with present DSF board members and actively contribute to the Django community especially in Global South to increase inclusivity and diversity.

    For more information about me kindly visit https://gcdeshpande.github.io/

    Thank you everyone for stopping by and going through my nomination. I ask for your vote, and I look forward to earning your trust to serve the Python community.

    Stay Safe. Take Care.

    Best Regards

    Gajendra Deshpande

    Thomas Dignan Edinburgh Scotland UK
    President, Vice President

    Hello,
    I am interested in running for the President or Vice President position of the Django DSF Board.

    I am currently managing director of Tracesense (Tracesense.com) and our main technology uses the Django Framework.

    Without the Django Framework we would not have such a great product to offer to our customers.

    Previously to running Tracesense I have senior management experience in the manufacturing industry from a variety of roles including IT Manager, Production Manager, H&S Manager etc.

    When i discovered Django i fell in love with coding & want to see it continue to develop and be used into the future.

    I can commit to minimum of the required time stated although when required I can commit more of my time.

    Thanks
    Tom

    Mohamed Amine Fouzai Tunisia
    President

    comunity improvment in tunisia ,developing new ideas and enhance django ecosystems

    Jon Gould United Kingdom

    I have a long term involvement within the Django community in the UK. I first learned about Django in 2008 and have been involved in the community since. Rather than being a coder or technical, I am a recruiter. For the last 14 years, I have worked with companies and developers that use Django. I have hosted, run and attended Django meetups and conferences throughout this time. If elected to the board I have a lot of experience I can offer from a non-technical perspective to draw upon. I have a different way of thinking and a perspective from the outside.

    I would be particularly interested in working on fundraising projects and increasing external understanding of what the DSF does and needs support with. I see this as working with sponsors/donors on behalf of the DSF to help raise awareness beyond the "logo on the website". This is not necessarily about increasing the direct ROI for sponsors but appealing to the bigger organisations who use Django to encourage donations and tech support. I believe that everyone working with Django should contribute in whatever way they can to help improve Django for everyone. As an example, I have pledged to give 5% of my company's annual profits to the DSF.

    Away from fundraising, I can see that participation in the DSF can be promoted further within the wider Django community. With over a million users of Django globally there is a missed opportunity to bring more people together to support the DSF and guarantee its future. Tech companies now routinely employ people specifically to work in DevRel/DevAdvocacy roles for their products. I don't think that employing someone via the DSF to do this is viable but there must be some members already who would be passionate enough to volunteer to do this on our behalf. I would also be interested in contributing in this area as a board member.

    I owe the success in my career to the Django community and see now as the perfect time to give back. I am in the early stages of building my own business and flexible with my time, allowing me to concentrate on projects that are important to me both personally and professionally. Being on the board of the DSF would be an honour and a privilege and I would work as hard on this as I would my own business.

    To add some context, over the years, I have helped over 250 Django developers secure roles and I have been involved and helped with the following groups/events.

    DJUGL - (Django User Group London) co-organised, organised, sponsored and hosted consistently from 2010-2019
    London Django Meetup - Regular attendee, promote through socials
    Django.Social - meetup group that I started earlier this year to bring people together regularly without the organising that a meetup takes. Simple, free and engaging meetups. Currently groups set up in London, Berlin, New York and Porto
    DjangoDay Copenhagen 2022 - supporter and speaker (lightning talk)
    DjangoCon Europe 2022 - Sponsor, attendee, Lightning talk and helped organise and run the conference party
    London Python Meetup - Currently on the team of organisers, working to find sponsors, venues and speakers. Event re-launched this year.
    Reading Python Dojo - Host and Sponsor, I previously helped the Reading Python Dojo (2 years) by providing a venue and the refreshments.

    Kel Hanna Durham, NC

    I am a perpetual learner committed to improving workplace culture through the lens of human-centered organizational design. I connect dots. I set the table for decision-making. I help people build meaningful partnerships that expand cooperative collaboration and inspire creative action. I help humans get work done.
    https://nervous-scallop-431.notion.site/The-Tesseract-s-Guide-for-Attempting-Tessellations-c7f9a9107593452a9e1cd8877eda448a

    Irfan Harun Ahmedabad, India
    Secretary

    Django had been my bread and butter. Lives of people around me has been uplifted since I started working on Django. It only makes sense to give back to community in terms of knowledge, experience and\n\n time.

    Jacob Kaplan-Moss Oregon

    Hi, I'm Jacob. I was one of the original maintainers of Django, and was the original founder and first President of the DSF. But I haven't been directly involved in Django for years: I haven't contributed code in like a decade, and I haven't been involved in the DSF since steeping down as President in 2010-ish. I'm feeling ready to get involved again, and I think joining the DSF board is a way I can be most helpful. I'd be coming back to the DSF with a bunch of experience in executive leadership and more experience working with nonprofits. I think I can apply those skills, along with my general knowledge of the Django community, to push things forward.
    What that means, specifically, isn't entirely clear yet. I'd plan to spend the first months of my board term asking a bunch of questions and listening. I'd want to talk to our membership, our sponsors, members of the development community, etc., about what the DSF is doing well, what we could be doing better, and where we need to grow. Then I'd, you know, work on those things

    I have some hypotheses already: I think we could be better-supporting DjangoCons in the US and especially EU; I think we could be expanding our sponsorship base substantially; I think we could be supporting the Django Fellows in more ways; I think we could be expanding where and how we spend our funds to move the framework forward. But these are all hypoethesis; I'd want to validate that these are indeed useful lines of work before diving in.

    Sanyam Khurana New Delhi, India
    President, Vice President, Treasurer, Secretary

    I've been a CPython bug-triager, contributor to Django and maintainer of djangoproject.com

    I was part of core-organizing team for PyCon India from 2016 - 2018, where I helped with logistics, venue selection, registration desk, website updates, etc. I've also volunteered and spoken at DjangoCon AU 2018, DjangoCon US 2018 and DjangoCon US 2022.

    I've been an individual DSF member since 2018. I'd like to work with DSF board. My idea is to provide mentorship opportunities to people who are willing to contribute to Django. I strongly feel that there are contributors out there, but many of them do not feel they have the skill-set to contribute to an open source project. Contributing to a very mature framework like Django is very intimidating and overwhelming for people who are looking to make their first-contribution. I think DSF board can provide mentorship programme to help people getting onboarded to the project and a safe space where their questions can be answered.

    I owe all my learnings to the community because what I've learned has always because of contributing to open source projects and I think being part of the board would be great learning experience for me, and hopefully I can help Django to move forward and give back to the community which is so supportive. In the first year, I would ideally like to be in a supportive role to understand the process from the people who are more experienced.

    Chaim Kirby Maryland, USA
    President

    It has been a privilege to serve on the DSF board for the last two years. I am running for another term because I still have goals that I want to realize for myself and the DSF.
    Over the last two years serving a year as Secretary and another as Vice President I have worked to be a proactive member of the board. I take pride in having created the membership survey that recently circulated, so as to hopefully provide the next board steps towards a roadmap on how better to serve and integrate the DSF membership. I believe my most lasting contribution of the last two years will be the new staggered two year board terms that I proposed and drafted. It should act as a guarantee of continuation of institutional knowledge

    But there is so much more work to be done. If re-elected I would want to focus on three areas that I think are crucial for the long term health of the DSF and Django community.

    First, I want to explore and implement a shift of the Board from a position of bureaucratic oversight to one of mission, vision, and governance. Everything the board and DSF does should be evaluated in the light of our state mission to Support and Promote the development and use of Django; to Protect the Intellectual Property and long term-viability of Django; and to Advance the state of the art in Web development. We have been especially lax in the Promote aspect of our charter.

    Second, I hope to expand the ranks of our membership. Not just for the sake of a bigger number, but because the DSF membership is our most dedicated individuals and the DSF’s first line of support for furthering our goals. Asking the same dedicated individuals for support will result in burn out and an empty bench when we are looking to a new generation of leaders and assistance in our mission.

    Third, engage the growing membership with the work of mission, vision, and governance. Having more people able and comfortable contributing to the DSF and Django community is out best bulwark against falling into obscurity or irrelevance.

    My experiences to this point gives me the skill and confidence to believe that I am the right person to help the DSF achieve all of these things, and more. I know it takes more work than the hour long monthly board meeting, effort that I have and will continue to give. As an engineer of over 20 years I can contribute to the technical aspects a growing DSF will require. As a trained attorney I can support and informally advise the board on topics that touch legal areas. And as a current member of the Board I can provide institutional knowledge, continuity, and insight to the next board.

    I hope that I have served you well my last two terms on the board, and I hope you believe that I deserve your vote for another term. Thank you

    Marcelo Elizeche LandĂł Paraguay

    For this nomination I will like to cover a few things: My motivation, my background and what from my point of view will be good for improving Django the community.

    Motivation
    If I have to be honest before assisting to DjangoConUS I have never thought about the Django Community apart from the Python community. That changed for me when I saw this great community that supports their members but also tries to make any newcomer (as I was) as welcomed as a longtime member.
    A few Django Community members suggested that I should run as a board member and I thought that could be interesting to help the community in any capacity. Also not many people know about and how wonderful this community is and I'd like that to be known worldwide and I think I can help with that :)

    I feel awkward nominating myself [0,1] as a Board Member for the Django Software Foundation, so I asked some friends from the Python community in Paraguay to help me write about myself for my background, so here we go:

    Background:
    I’m the co-founder and organizer of the Paraguayan Python community. In 2015 I co-organized the first PyDay in Paraguay, which was a rotund success [2] (seriously, see those pictures!), and started the community's momentum.

    Since then, I have organized dozens of community events all over the country [3], as well as workshops [4]. My efforts have not only consolidated the community, but also turned it into the most successful and active community to date in Paraguay [5], with over a thousand members (no small feat for a small country).

    Besides these efforts, I helped popularize Django as a tool for social activism. I’m the creator of AyudaPy [6], a platform that enabled thousands of Paraguayans to help each other during the worst of the COVID-19 pandemic [7,8,9] and I gave a talk about this project at DjangoConUS 2022. I’m also the creator of ListaHu [9](also made with Django), a platform that helps people protect their privacy and assets from extortionists and scammers using crowdsourcing [11]. I’m also the co-creator of AireLibre [12], a community-managed network of air quality sensors.

    Improving Django:

    * I think one of the main issues with Django adoption is the learning curve, there's so many different external tutorials for but the official tutorial is kinda of basic. I would like help to create a few other django tutorials from what I learnt in the first one so Django is not intimidating for newcomers.

    * Another thing that could make the Django experience better is at least suggesting a few deploy strategies so newcomers can have a full picture of what it means to successfully deploy a Django Application in production.

    * After you manage to use and understand one of Django's issues that sometimes is difficult is to get a Job using Django, one thing that could help is create a new Job Posting board with “better” data as: compensation, salary range and required level.

    * From the top of my head I would think that the Spanish documentation is great(and it is) but probably we’re not sure how great it is for other languages, for that I would love to add to the Django Developer Survey this kind of data: Preferred or used Language, locale, and how good the documentation is in the native language of the developer. Knowing what to fix and where to ask for help is the first step for improving.

    I think that the current path of this community is the right one and I would be so honored if I have the chance to contribute to this community as a board member.

    Refs:
    0. marce@melizeche.com
    1. https://melizeche.com
    2. https://elblogdehumitos.com/posts/pydayasuncion-un-exito-arrollador/
    3. https://www.meetup.com/Python-Paraguay/events/past/
    4. https://twitter.com/melizeche/status/1114298187395883008
    5. https://t.me/pythonparaguay
    6. https://ayudapy.org
    7.https://cienciasdelsur.com/2020/04/14/covid-19-web-permite-conseguir-alimentos-y-medicamentos-a-miles-de-paraguayos/
    8. https://www.youtube.com/watch?v=XK-tqP57tS8
    9. https://www.youtube.com/watch?v=8msEDu9lCxU
    10. https://listahu.org
    11. https://us.pycon.org/2018/schedule/presentation/234/
    12. https://airelib.re

    Mariana Bedran Lesche Recife, Brasil
    Secretary

    I've been part of the Python community in Brazil since 2008 when I started to attend the coding dojo sessions in Rio that year. Programming was a hobby for me for a long time until I decided I didn't want to work as a teacher anymore and looked at coding as an alternative to my career. After changing professions I got more involved with the Python community and got the chance to attend more conferences as my income grew. I've given talks in local, national and intenatinal events and I have been a volunteer in some events. I worked as an instructor in a Django Girls tutorial, I helped organize a regional Python conference in Brazil (Python Nordeste 2019), I was part of the Django Con Europe 2021 content selection group and this year I've been part of the work group responsible for the financial aid for the Python Brasil conference. I've only started in this area because of the time and effort other people dedicated to this community, so I think it's only fair that I give some of that back by keeping this community moving.

    In the last few years we've seen great changes in the Brazilian Python community. We have more people from underrepresented groups each year in our local and national conferences and groups. I'd like to bring some of that experience to help the Django community to reach more people.

    Oscar Martin Cortez Martinez Nicaragua/Colombia
    Vice President, Secretary

    I've been thinking a lot about this, and when I look back in my time I see the Django version 1.3 with the cherry views package and how much my life and the Django ecosystem has changed since that moment until today. I own more to Django, than what I can offer to itself, but then I think this opportunity will be a good moment for me to return something to the Django project and the community.

    Coming from a country under development has taught me from the first hand what people needs in order to succeed in their career, and how harder is to start and achieve something. If I have the opportunity to join the DSF I'll work harder to improve the relation between Latin America communities and the DSF, help make the DjangoCon more accesible to under represented groups with initiative such as DjangoCharlas, and as well produce more localized content to enhance the skills of newcomers developers.

    Nyasha Matongo Zimbabwe
    Secretary

    I'm a Django enthusiast. I love volunteering for django coding classes and teaching students around the continent on the benefits of Django.

    Katie McLaughlin Melbourne, Australia

    I have previously served on the DSF (and PSF), and would like to offer my service to help continue to not only keep the lights on, but also help enable those from the community who wish to enact change in how the DSF does things.
    I am a previous DjangoCon keynote, speaker, organiser and volunteer across EU, US, and AU.

    Bias disclaimer: I am a developer advocate for Google Cloud, working with Python, Django, and Serverless. My unsuccessful nomination to the board will not preclude me from continuing my advocacy. Depending how voting is run, do not vote for me if you feel other under-representative voices should be heard. I have served time on the DSF, others should get the chance above me.

    Paolo Melchiorre Italy
    Vice President

    I’ve been a Django developer for more than 10 years, in which I’ve contributed in various areas: documentation, code, website (in particular full-text search) and Italian translation. I’ve presented a lot of Django talks in meetups and conferences, including DjangoCon. I’ve organized and participated in many sprints on Django. I’ve written many articles on Django and I’m a promoter of Django online. I participated as a coach in DjangoGirls workshops and I’m organizing one in my city.

    Each of these activities has made me grow as a developer, community member and human being and I think serving on the DSF board can be a way to give back to the Django community what I have received.

    As a member of the DSF board I’d like to bring a different point of view, close to newcomers, who live and work in small realities and who do not speak English as their first language or do not speak it at all. I’d like to work to remove some language and cultural barriers that still remain for some members of the community. I’d like to give a boost to the development of great new features with the organization of Sprint dedicated to Django code. I’d like to increase collaboration with the Python community and create synergies with other sub-communities to make Django grow again on the web.

    KĂĄtia Yoshime Nakamura Berlin, Germany

    I would like to be reelected to continue contributing with the DSF Board. I've been part of the DSF Board since 2020 and the last 3 years brought us many challenges. I want to bring more ideas to continue supporting our community - bringing more diversity and inclusiveness. Besides that, I'd like to help establishing a long term plan for the Django Conferences (specifically in Europe but hopefully beyond that) as the the DjangoCon liaison.

    Renato Oliveira Recife, Brazil

    I've been part of the Python community since 2010. Helped organize dozens of local group meetings and one edition of Python Brasil (Brazilian PyCon) in 2014 while serving on the Associação Python Brasil (Brazilian PSF) board. I owe most of my professional achievements to the Python and Django community, and I'd like to give back to the community. Also, something I'd like to see is more Django Conferences around the world. It is a privilege to travel abroad, so I'd like to help foment conferences in other continents so more people can experience what just a few of us can.

    Carewen Owen Edmonton, Canada (moving to the UK early 2023)

    During my time with using the Django web development framework, I have encountered many examples of the best of the Open Source spirit. I have received help from other more experienced Django developers in learning how to unlock the potential of this outstanding framework. With this in mind, I am motivated to put my name forward to serve on the DSF Board.

    I would like to highlight my experience as both a Volunteer Instructor and Trainer with the Board Development Program (Alberta, Canada): https://www.alberta.ca/board-development-program.aspx. More specifically, I have experience in educating Not For Profit Boards in governance best practices in evolving from good to great, and have served on a number of Boards.
    In contemplating whether or not to put my name forward, I engaged in a brief assessment of the DSF based on externally available information and email exchanges with the current DSF Board. Through this I learned of plans to lay out a "path from a wholly volunteer-run organization to something more formal with actual paid staff." I can think of no better time for the quality of DSF's governance to be given attention than this; for such a path can only benefit from the evolution of the DSF's Board governance practices.

    It is often the reality that Board members are asked to do much with little. Great Not For Profit governance is the unsung hero of many a meaningful endeavour. However, with this self-nomination I am not only offering a high-level plan for consideration and discussion, but I am also putting my name forward to do the legwork to help organize and make this happen.
    However, evolving, improving, Board governance is not a solitary endeavour. The reality is, even though I will happily do much of the legwork there will be a need for others to collaborate, and for the Board as a whole to receive recommendations and ratify what is to be done. And yet, I have confidence that good people always find a way to make great things happen.

    To help with understanding what I am proposing I am including a draft high-level plan for what I propose is required. Should the DSF Membership vote for me to become a Board member I will be proposing the following:

    1) Create a Terms of Reference (ToR) policy for committee formation and reporting. ToRs provide clarity for:
    - The type of committee (Standing/Sub-committee/Ad hoc) and its general purpose
    - Committee composition and meeting schedule
    - Committee resource allocation
    - Specific committee objectives, including reporting target dates
    - Committee evaluation process
    - And finally, key duties and responsibilities (authority/reporting)

    2) The DSF Board strike a "Governance Evolution and Maturation" Committee (GEM):
    - The first committee to utilize the newly formed ToR Policy would be the GEM Committee
    - GEM would be given the authority to, Investigate and report on the current DSF Governance structure, and to take action as ratified by the DSF Board
    - As a DSF Board member I would be willing to chair this committee.
    - I recommend a total of 3-5 volunteers for this committee with experience in Board governance best-practices, organizational development, and/or change management

    3) Implement the first-year GEM plan. While it is very early to offer more than a high-level plan, and I have barely scratched the surface through preliminary analysis, I offer the following to support discussion:
    - Review existing DSF bylaws

    - Draft a DSF Policy framework:
    - - For those conversant with such matters I would pull upon my past experience with Alberta's Board Development Program's framework. This framework has the following sections:
    - - - Purpose: Who the DSF is and what it intends to do (Purpose/Vision/Mission)
    - - - Board Self-Governance: How the Board governs and assesses itself
    - - - Progress: How things get done, operations, budgeting, people
    - - - Identity: How the Board communicates with the membership/community and advocates for its Purpose, Vision and Mission
    - - This activity would pull together various existing policies into a central organized body, and identify new policies to be brought forward to the Board

    - Identify information management requirements and evaluate existing information management within the DSF for the purpose of bylaw and policy availability:
    - - Not only does documentation need to be accounted for, but also management of this information needs to be reviewed
    - - If there is an existing DSF Committee engaged in such activity I would recommend collaboration between the two committees (no need to re-invent the wheel or blur GEM's mandate)

    - Provide internal consulting to other DSF Committees in drafting and presenting their ToR to the DSF Board

    I would anticipate that the first year could see great progress. While the above list may seem complex, I also bring experience and resources to train those who have interest in volunteering with the GEM Committee as necessary.
    I believe that the DSF currently has a good foundation for its future evolution. My proposal is that we now engage in an effort to take it from good to great!
    Thank you for your consideration.

    Vishvajit Pathak Pune, India
    President, Vice President, Treasurer, Secretary

    I have been using python for all my professional life( >10y). My startup marsdevs.com runs on python so it's time for me give it back to the community.

    Kuldeep Pisda Raipur, CG, India
    Treasurer, Secretary

    I have been a django develoepr for the past several years, and am a fan of the Django in general. I have been an advocate of open source softwares, and would love to be a part of the journey of the Django framework. If selected I would love to spend some time focusing on the promotion, growth and development of the Django Developers across the globe.

    Ed Rivas El Salvador

    Django means a lot to me. It single handedly got me into programing in general and Python specifically over a decade ago, and it stands in my mind as THE model of what a healthy open source community looks like.

    I've been a DSF member for a while, but after the latest djangocon US and careful consideration I believe it's time for me to take a more active role in the advancement of Django and its community around the world. I'm not interested in a particular seat on the board but would love to help realize new initiatives such as a mentorship program, new sponsorship opportunities, and a renewed focus on the Spanish speaking community

    Cagil Ulusahin Sonmez London/UK, formerly Istanbul/Turkey
    President, Vice President

    I have started using Django since its early days (~2008) and have been building Django/Python apps since.

    Between 2015-2018, I have co-organised more than 10 DjangoGirls events in Istanbul and other cities in Turkey. I learned a lot being part of the DjangoGirls community. For this reason, I am trying to give back to the community. That is also one of the reasons why I started co-organising the London Django Meetup since 2018. Also I'm happy to be part of the organiser team of the first-ever PyCon Turkey too. PyCon Turkey happened with the help of the Django community supporting the idea in the DjangoCon Europe 2019.

    I regularly attend DjangoCons and different Python conferences and volunteer as much as I can. Attending conferences was a privilege I got after moving to the UK. I want to share that privilege with those communities who cannot attend the events, mostly due to financial reasons. Thus, I am also very interested in supporting the funding of open-source projects and looking forward to supporting DSF as a board member and working on grants, reports, and improving the corporate sponsor experience/relations.
    Another topic is diversity. I think the best way I can help increase diversity is by being more present as an underrepresented gender and member of a minority group.
    We need to make sure we have more role models from underrepresented groups. I believe that is the key to increase the diversity within our communities. So one of my motivations for joining the board is to work on diversity and inclusion within the community. The support of DSF and PSF plays a crucial role for many local communities and the individuals within those groups. (I experienced that firsthand as one of the members of the local Turkish Django community.)

    I believe our Django (and Python) community is very special. We are better when we are working together, sharing, and supporting each other. I am hoping we can make every individual member of the community feel included.

    Arsalan Wahidi Afghanistan
    Treasurer, Secretary

    I am welling to work abroad.

    Carina C. Zona Europe

    The extent of warmth, generosity, and inclusiveness in Django community stands out among open source communities. Django Software Foundation is at its best when it serves as a champion for the good ideas percolating up from this global community's members and connects budding organizers with transformative resources such as information, referrals, funding, mentorship, partnerships, and moral support. My goal is to work on strengthening DSF's capacity to provide seed resources sustainably.

    This would be my first year on DSF's board, so my initial agenda is to build on momentum developed by the previous board, while helping DSF solidify its role as a stable source of assistance for grassroots Django communities around the world. What I would bring to that: (a) commitment to upholding the spirit of Django's welcoming culture, and (b) decades of experience in supporting and promoting open source community development, diversity and inclusion, nonprofit fundraising, and empathetic leadership. This is work that I am passionate about anyway, and here it is opportunity to pay forward the kindness this community has always shown me.

    Cory Zue Cape Town, South Africa
    Vice President, Treasurer, Secretary

    I'm applying to the board because I saw a tweet that I thought perfectly applied to me.[1] Django has been invaluable in my career and I would love the opportunity to give back to the project with my time and skills.
    While I've never contributed to the Django codebase, I have been involved with Django and the community for more than 10 years. I was CTO for 11 years of the technology startup and social enterprise, Dimagi[2]. While at Dimagi, I ran the team that built what is (to my knowledge) the biggest open-source Django application in the world[3], as measured by code contributions. I currently earn a living working for myself building my own software products with Django[4], or for the Django ecosystem[5]. It would not be an exaggeration to say that I currently rely on Django for the overwhelming share of my income and success.

    What would I bring to the board? Hopefully quite a lot.

    First and foremost, I’m an avid Django user. I understand what it’s like to build web applications with Django as well as anyone. This means I know who the Django stakeholders are, which makes it easier for me to reach, understand and communicate with them.

    I also know how to work with people. While leading a team of 30+ people I learned how to work with different personalities, build consensus, and make difficult collaborative decisions. My experience stewarding a large open-source product means that I understand how to build and nurture communities of developers. More recently I’ve focused more on writing (including creating educational content for Django developers[6][7]), which should help with any DSF communications that need to go out.
    And I understand the non-technical aspects of organizations. My work as an executive at a 200-person company, as well as running my own small businesses, have exposed me to many other aspects relevant to the DSF, including finances, fundraising, marketing, and governance.

    Finally, because I currently work for myself and have a good amount of independence, I'm confident I will be able to make the time to invest in the DSF however I can be useful. I control my own time, so when I commit that time to support this board, I know I’ll be able to deliver on this commitment. I’ve been actively looking this past year for ways to use my time to “give back” to my communities - and serving the Django software community would be a great way for me to do so.

    To some extent my personal success is tied to the success of Django, which makes me strongly incentivized to do what I can to ensure the continued success of Django. I’d be happy to do that in whatever capacity the DSF thinks would be useful.

    Thanks for your consideration. :)

    [1]: https://twitter.com/jacobian/status/1583162695309631488
    [2]: https://www.dimagi.com/
    [3]: https://github.com/dimagi/commcare-hq
    [4]: https://www.placecard.me/
    [5]: https://www.saaspegasus.com/
    [6]: https://www.saaspegasus.com/guides/
    [7]: https://www.youtube.com/watch?v=bz33cFQIC9Q

    From The Django weblog at 2022-11-01 06:16:11

    Django bugfix release: 4.1.3

    Today we've issued the 4.1.3 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    From The Django weblog at 2022-10-24 15:08:45

    What does the DSF Board Actually Do?

    Nominations are open for the 2023 Django Software Foundation Board, the non-profit behind Django. There are 7 DSF Board Members. Anyone in the community can nominate themself and the final vote is made by the DSF Individual Members. There is a strong desire for the Board to represent Django’s global reach.

    What follows is a descriptive list of what the Board currently does, not necessarily what it should be doing going forward. Being on the Board means continually redefining its role and how best to serve the broader Django community.

    At the moment, the minimum commitment is a monthly one-hour meeting. Beyond that each Board member has individual areas they focus on that may require additional hours. At present, there are 4 Officer roles:

    • The President chairs meetings
    • The Vice President oversees discussion of new DSF Individual Member nominations
    • The Secretary prepares the monthly meeting agenda, posts the public minutes on the DjangoProject.com site, and manages Board elections
    • The Treasurer works with DSF Assistant Catherine Holmes to compile a monthly report on financials, coordinate with corporate sponsors, and file annual returns

    The other three members on the Board informally have roles such as DjangoCon liaison, enforcing Django’s trademark, managing Code of Conduct violations if they arise, and so on.

    There are several ongoing projects that the Board currently handles including:

    At present the DSF annual budget is ~$200,000 and the majority goes to the Django Fellowship Program which funds Carlton Gibson three days a week and Mariusz Felisiak five days a week. There is also hourly funding for Catherine Holmes who is the DSF Assistant and helps with accounting and sponsorships. The rest of the budget goes towards sponsoring DjangoCons, DjangoGirls events, and related conferences; to the Ops team who manages the infrastructure of the DjangoProject.com sites; and a minimal amount to file required legal and financial forms to maintain the DSF’s 501(c)(3) non-profit status.

    It is worth emphasizing that although this is what the Board currently does it is not set in stone. The Board is meant to reflect the global Django community and adapt as needed. If you’d like to have a direct impact on Django’s future please consider nominating yourself.

    Several members of the current 7-member Board are planning to step down this year. Officer roles are decided upon during the first meeting and it is not uncommon for them to switch around even among returning members based on individual preferences.

    If you have additional questions, you can contact the current Board or reach out to individual Board members directly.

    From The Django weblog at 2022-10-17 00:02:31

    2023 DSF Board Nominations

    It is that time of year again to think about next year’s Django Software Foundation’s Board of Directors!

    As you know, the Board guides the direction of the marketing, governance and outreach activities of the Django community. We provide funding, resources, and guidance to Django events on a global level. Further we provide support to the Django community with an established Code of Conduct and make decisions and enforcement recommendations for violations. We work closely with our corporate and individual members to raise funds to help support our great community.

    In order for our community to continue to grow and advance the Django Web framework, we need your help. The Board of Directors consists of volunteers who are elected to one year terms. This is an excellent opportunity to help advance Django. We can’t do it without volunteers, such as yourself. Anyone including current Board members, DSF Members, or the public at large can apply to the Board. It is open to all. There are sure to be new members of the board as some board members are choosing not to run again. Half of the new board will also be elected to a 2 year term under our new staggered term election format.

    If you are interested in helping to support the development of Django we’d enjoy receiving your application for the Board of Directors. Please fill out the application form by Friday, November 4th, 2022 to be considered. If it is still the 22nd of November somewhere in the world, applications will remain open.

    If you have any questions about applying, the work, or the process in general please don’t hesitate to reach out via email to foundation@djangoproject.com and one of us will get back with you shortly.

    Thank you for your time and we look forward to working with you in 2022.

    The 2022 DSF Board of Directors.

    2023 DSF Board Nomination Form

    From The Django weblog at 2022-10-14 06:16:40

    Nominations for 2022 Malcolm Tredinnick Memorial Prize

    Hello Everyone!

    It is that time of year again when we recognize someone from our community in memory of our friend Malcolm.

    Malcolm was an early core contributor to Django and had both a huge influence and impact on Django as we know it today. Besides being knowledgeable he was also especially friendly to new users and contributors. He exemplified what it means to be an amazing Open Source contributor. We still miss him to this day.

    The DSF Prize page summarizes the prize nicely:

    The Malcolm Tredinnick Memorial Prize is a monetary prize, awarded annually, to the person who best exemplifies the spirit of Malcolm’s work - someone who welcomes, supports, and nurtures newcomers; freely gives feedback and assistance to others, and helps to grow the community. The hope is that the recipient of the award will use the award stipend as a contribution to travel to a community event -- a DjangoCon, a PyCon, a sprint -- and continue in Malcolm’s footsteps.

    We will take nominations until Thursday, October 30th, 2022, AoE, and will announce the winner soon after the next DSF Board meeting in December. Please make your nominations using this google form. If you have any questions please reach out to the DSF Board at foundation@djangoproject.com.

    From The Django weblog at 2022-10-05 15:26:29

    Last call for DjangoCon US tickets

    DjangoCon US 2022 is less than two weeks away!

    Join us online or in person in San Diego.

    As the DjangoCon US 2022 kick-off date rapidly approaches (October 16th), we wanted to take the opportunity to put out a final call for in-person ticket registrations and showcase what folks can expect at this year’s conference. IN PERSON ticket sales end Friday, October 7th.

    If you can’t make it in person this year, we also have online tickets: https://ti.to/defna/djangocon-us-2022.

    All talks will be available online via the LoudSwarm platform, so you won’t miss any action. We have eleven exclusive talks for our online attendees, so you get more content. Online tickets are a great and affordable way to access the treasure trove of knowledge being shared without making a larger time or financial commitment.

    The In-person DjangoCon US Experience

    This year’s conference kicks off with tutorials on Sunday, October 16th. You can find the full schedule on our website: https://2022.djangocon.us/tutorials/. This year, we are excited to have tutorials ranging from making the most of the Django Admin interface to internationalization and localization with Wagtail.

    Following a full day of tutorials, on Monday the 17th, we kick off with the main conference schedule packed full of talks. Again, that full schedule is live so that you can start planning which room you will be in during the event: https://2022.djangocon.us/talks/

    After two days of talks, on Wednesday the 19th, we will have a full day’s worth of deep-dive sessions, starting with a keynote on State of the Object-Relational Mapping (ORM) by Simon Charette. Finally, on Thursday and Friday, we will be hosting two full days of sprints where anyone can get their hands dirty making contributions to the Django ecosystem: https://2022.djangocon.us/sprints/. Note that sprints are included in the main ticket prices, but we do ask that you register ahead of time, so we know how many folks will be coming to each day’s session: https://ti.to/defna/djangocon-us-2022.

    Beyond The Talks and Sprints

    There is so much happening at DjangoCon US beyond the main conference agenda. We will have board game sessions, impromptu meetups, breakout sessions for those interested in various topics, and so much more! All of the things that are traditionally very difficult to do online, we plan to facilitate in-person so that attendees get the most out of their conference experience.

    We are incredibly excited to see everyone online and in person. If you haven’t picked up a ticket yet, the deadline is coming up soon in the next week. We hope that you will join us at this year’s conference!

    From The Django weblog at 2022-10-04 08:59:57

    Django security releases issued: 4.1.2, 4.0.8, and 3.2.16

    In accordance with our security release policy, the Django team is issuing Django 4.1.2, Django 4.0.8, and Django 3.2.16. These releases addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2022-41323: Potential denial-of-service vulnerability in internationalized URLs

    Internationalized URLs were subject to potential denial of service attack via the locale parameter. This is now escaped to avoid this possibility.

    This issue has medium severity, according to the Django security policy.

    Thanks to Benjamin Balder Bach for the report.

    Affected supported versions

    • Django main branch
    • Django 4.1
    • Django 4.0
    • Django 3.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and the 4.1, 4.0, and 3.2 release branches. The patches may be obtained from the following changesets:

    The following releases have been issued:

    The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2022-09-21 14:49:50

    2022 Django Developers Survey

    Please take a moment to fill it out the 2022 Django Developers Survey. We are once again partnering with JetBrains and it is available in 10 different languages.

    The survey is an important metric of Django usage and helps guide future technical and community decisions. One recent example is past surveys demonstrated how popular Redis is and built-in caching support was added in Django 4.0 as a direct result of that feedback.

    After the survey is over, the aggregated results and anonymized raw data will be published.

    From The Django weblog at 2022-09-05 06:03:40

    Django bugfix release: 4.1.1

    Today we've issued the 4.1.1 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    From The Django weblog at 2022-08-03 09:58:20

    Django 4.1 released

    The Django team is happy to announce the release of Django 4.1.

    The release notes cover the profusion of new features in detail, but a few highlights are:

    You can get Django 4.1 from our downloads page or from the Python Package Index. The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00.

    With the release of Django 4.1, Django 4.0 has reached the end of mainstream support. The final minor bug fix release, 4.0.7, was issued today. Django 4.0 will receive security and data loss fixes until April 2023. All users are encouraged to upgrade before then to continue receiving fixes for security issues.

    See the downloads page for a table of supported versions and the future release schedule.

    From The Django weblog at 2022-08-03 08:45:57

    Django security releases issued: 4.0.7 and 3.2.15

    In accordance with our security release policy, the Django team is issuing Django 4.0.7, and Django 3.2.15. These releases addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2022-36359: Potential reflected file download vulnerability in FileResponse

    An application may have been vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename was derived from user-supplied input. The filename is now escaped to avoid this possibility.

    This issue has high severity, according to the Django security policy.

    Thanks to Motoyasu Saburi for the report.

    Affected supported versions

    • Django main branch
    • Django 4.1 (which will be released in a separate blog post later today)
    • Django 4.0
    • Django 3.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and the 4.1, 4.0, and 3.2 release branches. The patches may be obtained from the following changesets:

    The following releases have been issued:

    The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2022-07-19 10:08:29

    Django 4.1 release candidate 1 released

    Django 4.1 release candidate 1 is the final opportunity for you to try out the profusion of new features before Django 4.1 is released.

    The release candidate stage marks the string freeze and the call for translators to submit translations. Provided no major bugs are discovered that can't be solved in the next two weeks, Django 4.1 will be released on or around August 3. Any delays will be communicated on the django-developers mailing list thread.

    Please use this opportunity to help find and fix bugs (which should be reported to the issue tracker). You can grab a copy of the package from our downloads page or on PyPI.

    The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00.

    From The Django weblog at 2022-07-04 08:58:13

    Django security releases issued: 4.0.6 and 3.2.14

    In accordance with our security release policy, the Django team is issuing Django 4.0.6 and Django 3.2.14. These release addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2022-34265: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments

    Trunc() and Extract() database functions were subject to SQL injection if untrusted data was used as a kind/lookup_name value.

    Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

    This security release mitigates the issue, but we have identified improvements to the Database API methods related to date extract and truncate that would be beneficial to add to Django 4.1 before it's final release. This will impact 3rd party database backends using Django 4.1 release candidate 1 or newer, until they are able to update to the API changes. We apologize for the inconvenience.

    Thanks Takuto Yoshikai (Aeye Security Lab) for the report.

    This issue has severity "high" according to the Django security policy.

    Affected supported versions

    • Django main branch
    • Django 4.1 (currently at beta status)
    • Django 4.0
    • Django 3.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and to the 4.1, 4.0, and 3.2 release branches. The patches may be obtained from the following changesets:

    The following releases have been issued:

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2022-06-24 22:50:09

    PyCharm & DSF Campaign 2022 Results

    The sixth annual JetBrains PyCharm promotion in June netted the Django Software Foundation $25,000 this year.

    This amount represents over 10% of the DSF's overall budget, which goes directly into funding the continued development and support of Django via the Django Fellowship program and Django conferences worldwide.

    Django Software Foundation

    The Django Software Foundation is the non-profit foundation that supports the development of the Django Web framework. It funds the Django Fellowship program, which currently supports two Fellows who triage tickets, review/merge patches from the community, and work on infrastructure. The introduction of this program starting in 2015 has gone a long way towards ensuring a consistent major release cycle and the fixing/blocking of severe bugs. DSF also funds development sprints, community events like DjangoCons, and related conferences and workshops globally.

    Fundraising is still ongoing and you can donate directly at djangoproject.com/fundraising.

    From The Django weblog at 2022-06-21 10:30:20

    Django 4.1 beta 1 released

    Django 4.1 beta 1 is now available. It represents the second stage in the 4.1 release cycle and is an opportunity for you to try out the changes coming in Django 4.1.

    Django 4.1 has an profusion of new features which you can read about in the in-development 4.1 release notes.

    Only bugs in new features and regressions from earlier versions of Django will be fixed between now and 4.1 final (also, translations will be updated following the "string freeze" when the release candidate is issued). The current release schedule calls for a release candidate in a month from now with the final release to follow about two weeks after that around August 3. Early and often testing from the community will help minimize the number of bugs in the release. Updates on the release schedule schedule are available on the django-developers mailing list.

    As with all alpha and beta packages, this is not for production use. But if you'd like to take some of the new features for a spin, or to help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the beta package from our downloads page or on PyPI.

    The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00.

    From The Django weblog at 2022-06-12 21:39:16

    Last Chance for a DjangoCon Europe 2023

    TL:DR - There will not be a DjangoCon Europe 2023 if the DSF board does not receive viable proposals for one by August 10 End of Day AoE. There is not sufficient time after that for an organizing group to plan a DjangoCon to happen in the traditional and calendar blocked window of April-June.

    Hosting a DjangoCon is an ambitious undertaking. It's hard work, but each year it has been successfully run by a team of community volunteers, not all of whom have had previous experience - more important is enthusiasm, organizational skills, the ability to plan and manage budgets, time and people - and plenty of time to invest in the project.

    You'll find plenty of support on offer from previous DjangoCon organizers, so you won't be on your own.

    How to apply

    If you're interested, we'd love to hear from you. The Porto organizers will also love the opportunity to continue tradition announce the next DjangoCon Europe during their DjangoCon

    This reference helps with the logistics of putting together a DjangoCon

    The more detailed and complete your proposal, the better. Things you should consider, and that we'd like to know about, are:

    • dates
    • numbers of attendees
    • venue(s)
    • accommodation
    • transport links
    • budgets and ticket prices
    • committee members

    We'd like to see:

    • timelines
    • pictures
    • prices
    • draft agreements with providers
    • alternatives you have considered

    They will all help show that your plans are serious and thorough and that you have the organizational capacity to make it a success.

    Just drop us a line.

    From The Django weblog at 2022-06-01 16:30:31

    PyCharm & DSF Campaign 2022

    For the sixth year in a row, Django is partnering with JetBrains PyCharm on the following promotion: 30% off the purchase of any new individual PyCharm Pro licenses with the full proceeds benefitting the Django Software Foundation. The promotion will last 19 days from June 1, 2022 to June 20, 2021.

    “The Django and PyCharm partnership has become one of the major fundraising activities of the Django Software Foundation for several years now. We look forward to it each year, and we hope this year will be as great as it always is, or even better. On behalf of the Django Software Foundation and Django community, I would like to express our deepest gratitude to JetBrains for their generosity and support.” - Anna Makarudze, DSF President

    From The Django weblog at 2022-06-01 13:28:49

    Django bugfix release: 4.0.5

    Today we've issued the 4.0.5 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00

    From The Django weblog at 2022-05-23 12:00:00

    The Call for Proposals for DjangoCon US 2022 Is Now Open!

    The DjangoCon 2022 organizers are excited to announce that the first in-person DjangoCon since 2019 is now open for talk submissions: call for proposals! The deadline for submissions is June 10th, 2022 AoE. As long as it’s still June 10th anywhere on earth, you can submit your proposal.

    We invite you to submit your proposal no matter your background or experience level with Django. Proposals can be from a wide range of topics; non-Django and community topics are welcome. You can look at our talk schedule from last year for reference.

    We fancy first-timers! If you haven’t spoken at a conference or given a tutorial before, this is your invitation to do so. Don’t let the idea that you’re not famous or an expert stop you from submitting. It certainly won’t stop us from selecting your talk or tutorial and it won’t stop the audience from enjoying it!

    Plus there are perks! Presenters get free admission to DjangoCon US! Grants to assist with your travel and lodging expenses are available as well. Fill out the Opportunity Grant form by June 10th, 2022. Decision notifications will be sent by July 8, 2022.

    For more information on talk and tutorial formats, please check out our speaker information page.

    We want everyone attending DjangoCon US to feel safe, welcome, and included. To that end, we have a Code of Conduct for all speakers and attendees.

    If you have questions feel free to contact us.

    We look forward to your proposals!

    From The Django weblog at 2022-05-18 06:58:39

    Django 4.1 alpha 1 released

    Django 4.1 alpha 1 is now available. It represents the first stage in the 4.1 release cycle and is an opportunity for you to try out the changes coming in Django 4.1.

    Django 4.1 has an profusion of new features which you can read about in the in-development 4.1 release notes.

    This alpha milestone marks the feature freeze. The current release schedule calls for a beta release in about a month and a release candidate about a month from then. We'll only be able to keep this schedule if we get early and often testing from the community. Updates on the release schedule are available on the django-developers mailing list.

    As with all alpha and beta packages, this is not for production use. But if you'd like to take some of the new features for a spin, or to help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the alpha package from our downloads page or on PyPI.

    The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00.

    From The Django weblog at 2022-04-11 08:55:44

    Django security releases issued: 4.0.4, 3.2.13, and 2.2.28

    In accordance with our security release policy, the Django team is issuing Django 4.0.4, Django 3.2.13, and Django 2.2.28. These release addresses the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

    Django 2.2 has reached the end of extended support. The final security release (2.2.28) was issued today. All Django 2.2 users are encouraged to upgrade to Django 3.2 or later.

    CVE-2022-28346: Potential SQL injection in QuerySet.annotate(), aggregate(), and extra()

    QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods.

    Thanks Splunk team: Preston Elder, Jacob Davis, Jacob Moore, Matt Hanson, David Briggs, and a security researcher: Danylo Dmytriiev (DDV_UA) for the report.

    This issue has severity "high" according to the Django security policy.

    CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options) on PostgreSQL

    QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument.

    This issue has severity "high" according to the Django security policy.

    Affected supported versions

    • Django main branch
    • Django 4.0
    • Django 3.2
    • Django 2.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and to the 4.0, 3.2, and 2.2 release branches. The patches may be obtained from the following changesets.

    CVE-2022-28346:

    CVE-2022-28347:

    The following releases have been issued:

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2022-03-01 08:48:51

    Django bugfix release: 4.0.3

    Today we've issued the 4.0.3 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00.

    From The Django weblog at 2022-02-10 06:39:11

    Join DEFNA! Board Member Recruitment

    Django Events Foundation North America (DEFNA) is looking for another board member. We have an eight-member board; last year one of our board members stepped down. We are looking for a new board member, interested in growing the DjangoCon US community.

    Board membership takes, on average, about five hours per month performing the following functions:

    • Attend the monthly board meeting
    • Participate in the grant applications review process
    • Use DEFNA’s social media channels to communicate about DEFNA
    • Come up with new and clever ways for DEFNA to fulfill our mission

    If you’d like to be considered for the board, drop us a note at hello@defna.org, and let us know:

    • What interests you about being on the board
    • Your current/prior community involvement (it’s okay if you’re new—we need everyone to participate!)
    • Any particular interests you have (grants committee, corporate filings, corporate treasurer, etc.)
    • Any ideas you have for expanding DEFNA’s reach in the OSS community
    • Anything else you’d like us to know about you as a potential board member

    Please email your information to us by February 21st at 6:00 PM Pacific Time. We’ll contact you if we need more details. We’ll make our decision and reply to everyone by end-of-day March 4th.

    Read more about DEFNA’s board members.

    From The Django weblog at 2022-02-03 06:00:00

    Could you host DjangoCon Europe 2023?

    DjangoCon Europe 2022 will be held from the 21st - 25th September in Porto, Portugal, hopefully, but we're already looking ahead to next year's conference. Could your town - or your football stadium, circus tent, private island, or city hall - host this wonderful community event?

    Under the usual circumstances, the DjangoCon Europe licensee picks the date of the conference but the event must fall more than one month from DjangoCon US and PyCon US, and EuroPython in the same calendar year. Also, at the end of DjangoCon Europe, the next hosts for DjangoCon Europe would be announced and a call for proposals for volunteers to organise DjangoCon Europe in 2 years would be made.

    However, the pandemic has disturbed this tradition for the past three years resulting in the Porto team organizing DjangoCon Europe for the third time in a row. We have also had to offer exceptional permission for DjangoCon Europe to take place less than one month away from DjangoCon US due to challenges we faced in 2021 with finding new hosts for the conference.

    We are hoping to find organizers for DjangoCon Europe by April 2022 so that we can keep in line with the tradition of DjangoCon Europe taking place between April and July and announcing the next DjangoCon Europe at DjangoCon Europe 2022 in Porto.

    Hosting a DjangoCon is an ambitious undertaking. It's hard work, but each year it has been successfully run by a team of community volunteers, not all of whom have had previous experience - more important is enthusiasm, organisational skills, the ability to plan and manage budgets, time and people - and plenty of time to invest in the project.

    You'll find plenty of support on offer from previous DjangoCon organisers, so you won't be on your own.

    How to apply

    If you're interested, we'd love to hear from you. Following the established tradition, the selected hosts will be announced at this year's DjangoCon by last year's organiser but must fall more than one month from DjangoCon US and PyCon US, and EuroPython in the same calendar year, so we'll need to receive your proposal before then.

    The more detailed and complete your proposal, the better. Things you should consider, and that we'd like to know about, are:

    • dates
    • numbers of attendees
    • venue(s)
    • accommodation
    • transport links
    • budgets and ticket prices
    • committee members

    We'd like to see:

    • timelines
    • pictures
    • prices
    • draft agreements with providers
    • alternatives you have considered

    They will all help show that your plans are serious and thorough and that you have the organisational capacity to make it a success.

    Just drop us a line.

    From The Django weblog at 2022-02-01 07:57:03

    Django security releases issued: 4.0.2, 3.2.12, and 2.2.27

    In accordance with our security release policy, the Django team is issuing Django 4.0.2, Django 3.2.12, and Django 2.2.27. These release addresses the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2022-22818: Possible XSS via {% debug %} template tag

    The {% debug %} template tag didn't properly encode the current context, posing an XSS attack vector.

    In order to avoid this vulnerability, {% debug %} no longer outputs an information when the DEBUG setting is False, and it ensures all context variables are correctly escaped when the DEBUG setting is True.

    Thanks Keryn Knight for the report.

    This issue has severity "medium" according to the Django security policy.

    CVE-2022-23833: Denial-of-service possibility in file uploads

    Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

    Thanks Alan Ryan for the report.

    This issue has severity "medium" according to the Django security policy.

    Affected supported versions

    • Django main branch
    • Django 4.0
    • Django 3.2
    • Django 2.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and to the 4.0, 3.2, and 2.2 release branches. The patches may be obtained from the following changesets.

    CVE-2022-22818:

    CVE-2022-23833:

    The following releases have been issued:

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2022-01-21 06:00:00

    Announcing DjangoCon Europe 2022

    We are happy to announce DjangoCon Europe 2022 will take place in Porto, Portugal đŸ‡”đŸ‡č hopefully! Let us explain, and believe us that there is a lot to explain.

    DjangoCon Europe is hosted annually by an independent volunteer team. This volunteer team submits a proposal to DSF, which will then select the most suitable one from all the proposals. We knew from the start it would be daunting for a new team to submit for 2022, in these uncertain times. So, we pledged our availability to host another DjangoCon, but only if there was no other team submitting a proposal.

    Do not get us wrong, we love the idea of welcoming you all in our city and country, we have been trying for the last two years, but we felt we should give other teams the chance, so we have not submitted an official proposal, just a backup plan, most of all we didn’t want to spend a year without a DjangoCon Europe.

    Being here means no other team was available, understandingly so. Our main advantage is: having organised the previous two editions we are able to quickly set up keeping up the momentum.

    We will try for the third time to host an in-person event, but a safe one. This means it will be hybrid from the start, both for speakers and participants. We want to give freedom of choice as well as being prepared for unforeseeable issues, which seem to be the new normal. Please keep in mind this might change in a heartbeat and we might end up with yet another online-only event, but let us hope for a bit more.

    On another note, you might have noticed the unusual dates for DjangoCon Europe, which usually takes place during the first half of the year. DSF tried to find a new team to host, but due to the lack of viable proposals eventually contacted us in mid-November. Finding a suitable date on such short notice, avoiding other events, and booking a venue left us with little to no choices. To this end, we would like to thank both DEFNA and DSF for the exceptional permission as it will be unusually close to DjangoCon US.

    So, DjangoCon Europe 2022 is back again and it’s going to be 5 full days of talks, tutorials and sprints - from September 21 to 25:

    • Conference talks: September 21-23 (Wednesday-Friday)
    • Sprints: September 24-25 (Saturday and Sunday)

    In the near future, we will have more info about the conference, which we will publish on the website. This will include more details about the tickets, talks, workshops, grants, code of conduct, etc. For now, here is a summary of that info.

    Grants

    As with past years, there will be a travel grants program to assist people with financial difficulties, people who are under-represented or from marginalised groups - allowing access to an event that otherwise would be very difficult position for them to attend;

    Sponsors

    If you're interested in sponsoring the event, please get in touch at sponsors@djangocon.eu.

    Talk proposals

    You can already start to prepare your talk, and for that, we recommend that you watch the talk “How To Get On This Stage (And What To Do When You Get There)” by Mark Smith. If you think you have something great to talk about – start to prepare your talk! If you are unsure, talk it over with somebody, or go to Slack to find previous speakers and participants to discuss your idea with. When in doubt, submit your talk!

    Volunteers

    As you can imagine there is a lot to do, but it's very much worth it – DjangoCon Europe is an extremely friendly, open, inclusive, and informative (for beginners and advanced users alike) conference. Join us regardless of your prior experience: this is also an opportunity to learn! In other words, you don't have to be an expert to join. Below are the teams and their activities/responsibilities that we seek help with:

    • Communications: Press, community relations, announcements, social media, attendee tools, volunteer coordination
    • Support and hospitality: Helpdesk, attendee support contact, visa help, travel management, chat support for attendees, on-site volunteer organization, speaker support;
    • Financial aid and diversity advocate: Setup, grant selection, aid organization, accessibility considerations, outreach on-site;
    • Sponsors: Outreach to companies, organizing their logistics at the event and other types of visibility;
    • Program: Committee work, talk selection, scheduling, session chairs, sprint/open space/keynote/lightning talks session organization (we will open the CFP soon!);
    • Code of Conduct: Drafting documents, handling of requests and issues.

    You can apply through this form here.

    Your location before and during the event is not significant, since it will be hosted in a hybrid format. We can do all things that need to be done in Porto ourselves. The only important thing is that you have the energy and free time to help organize a wonderful DjangoCon Europe. The official language of all these prior activities will be English, as well as the conference itself.

    --

    We expect new challenges but pledge our hearts and minds to do the best DjangoCon Europe we can, never giving up under these strenuous conditions. Please consider volunteering and join us, we need you!

    We hope we'll see you all at DjangoCon Europe 2022, and don't forget to follow us @djangoconeurope on Twitter, and also join our dedicated Slack channel.


    Hoping for the best,

    The DjangoCon Europe 2022 Organisers

    From The Django weblog at 2022-01-04 10:00:54

    Django security releases issued: 4.0.1, 3.2.11, and 2.2.26

    In accordance with our security release policy, the Django team is issuing Django 4.0.1, Django 3.2.11, and Django 2.2.26. These release addresses the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2021-45115: Denial-of-service possibility in UserAttributeSimilarityValidator

    UserAttributeSimilarityValidator incurred significant overhead evaluating submitted password that were artificially large in relative to the comparison values. On the assumption that access to user registration was unrestricted this provided a potential vector for a denial-of-service attack.

    In order to mitigate this issue, relatively long values are now ignored by UserAttributeSimilarityValidator.

    This issue has severity "medium" according to the Django security policy.

    CVE-2021-45116: Potential information disclosure in dictsort template filter

    Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure or unintended method calls, if passed a suitably crafted key.

    In order to avoid this possibility, dictsort now works with a restricted resolution logic, that will not call methods, nor allow indexing on dictionaries.

    As a reminder, all untrusted user input should be validated before use.

    This issue has severity "low" according to the Django security policy.

    CVE-2021-45452: Potential directory-traversal via Storage.save()

    Storage.save() allowed directory-traversal if directly passed suitably crafted file names.

    This issue has severity "low" according to the Django security policy.

    Affected supported versions

    • Django main branch
    • Django 4.0
    • Django 3.2
    • Django 2.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and to the 4.0, 3.2, and 2.2 release branches. The patches may be obtained from the following changesets.

    CVE-2021-45115:

    CVE-2021-45116:

    CVE-2021-45452:

    The following releases have been issued:

    The PGP key ID used for these releases is Carlton Gibson: E17DF5C82B4F9D00.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2022-01-03 18:15:10

    Django Developers Survey 2021 Results

    We are excited to share the results of the annual Django Developers Survey which was conducted this year in collaboration with JetBrains. More than 7,000 Django users from almost 140 countries took the survey which covered a broad list of topics including Django usage, operating systems, libraries, tools, and many other insights.

    View the results of the 2021 Django Developers Survey.

    If you have feedback on the findings and how to improve the survey in future years please share on the official Django Forum or Twitter and other social media mentioning @djangoproject and @jetbrains along with the #djangosurvey hashtag.

    Thank you to everyone who participated!

    From The Django weblog at 2021-12-17 14:36:30

    2021 Malcolm Tredinnick Memorial Prize awarded to Adam Johnson

    The Board of the Django Software Foundation is pleased to announce that the 2021 Malcolm Tredinnick Memorial Prize has been awarded to Adam Johnson.

    Adam Johnson is a member of the Django Technical Board and a longtime member of the security team. He has contributed a huge amount of code to Django itself and maintains multiple Django third-party packages. He is a co-organizer of The London Django Meetup and regularly gives talks at Django and Python conferences. He has also written a book on Django testing and his personal blog has a lot of content educating people on Python and Django best practices. He is actively helpful on Twitter and the Django mailing lists.

    Jeff Triplet, one of the six people who nominated Adam had this to say about Adam:

    I think Adam Johnson has done an incredible amount of work and deserves recognition. Between his numerous Django-focused OSS work, his work on Django itself, being on the Technical Board, his weekly blogging efforts, organizing the London Django meetups, speaking at conferences, and being a friendly and welcoming community member with his online persona. I have never formally met Adam, but he seems like a genuinely nice person too.

    Other nominations for this year included:

    • Andrew Godwin
    • Anna Makarudze
    • Carlton Gibson
    • Dawn Wages
    • Frank Wiles
    • Haris Khan
    • Mowa Ijasanmi
    • Paolo Melchiorre
    • Simon Drabble

    Each year we receive many nominations, and it is always hard to pick the winner. This year we received the highest number of nominations ever received for the Malcolm Tredinnick Memorial Price with some being nominated twice, and the highest being six times. Some people have been nominated in multiple years, so if your nominee didn’t make it this year, you can always nominate them again next year.

    Malcolm would be very proud of the legacy he has fostered in our community!

    From The Django weblog at 2021-12-08 14:23:55

    2022 DSF Board Election Results

    Here are the results of this year's election in order of most votes:

    1. Anna Makarudze
    2. William Vincent
    3. Aaron Bassett
    4. KĂĄtia Nakamura
    5. Chaim Kirby
    6. Mfon Eti-mfon
    7. Ćœan Anderle

    Congratulations to our winners. Our board meeting next week will close out 2021 business, ratify the election, and get down to the work of forging the future of the DSF.

    Special thanks to all of the candidates we had this year. It is great to see a robust desire to participate in furthering the work of the DSF. The DSF simply isn't possible without the help of all of our volunteers.

    From The Django weblog at 2021-12-07 09:26:10

    Django 4.0 released

    The Django team is happy to announce the release of Django 4.0.

    The release notes cover the abundance of new features in detail, but a few highlights are:

    You can get Django 4.0 from our downloads page or from the Python Package Index. The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    With the release of Django 4.0, Django 3.2 has reached the end of mainstream support. The final minor bug fix release, 3.2.10, was issued today. Django 3.2 is an LTS release and will receive security and data loss fixes until April 2024. All users are encouraged to upgrade before then to continue receiving fixes for security issues.

    Django 3.1 has reached the end of extended support. The final security release (3.1.14) was issued today. All Django 3.1 users are encouraged to upgrade to Django 3.2 or later.

    See the downloads page for a table of supported versions and the future release schedule.

    From The Django weblog at 2021-12-07 07:35:47

    Django security releases issued: 3.2.10, 3.1.14, and 2.2.25

    In accordance with our security release policy, the Django team is issuing Django 3.2.10, Django 3.1.14, and Django 2.2.25. These release addresses the security issue detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2021-44420: Potential bypass of an upstream access control based on URL paths

    HTTP requests for URLs with trailing newlines could bypass an upstream access control based on URL paths.

    This issue has low severity, according to the Django security policy.

    Thanks to Sjoerd Job Postmus and TengMA(@te3t123) for the report.

    Affected supported versions

    • Django main branch
    • Django 4.0 (which will be released in a separate blog post later today)
    • Django 3.2
    • Django 3.1
    • Django 2.2

    Resolution

    Patches to resolve the issue have been applied to Django's main branch and the 4.0, 3.2, 3.1, and 2.2 release branches. The patches may be obtained from the following changesets:

    The following releases have been issued:

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.

    From The Django weblog at 2021-11-22 06:39:46

    Django 4.0 release candidate 1 released

    Django 4.0 release candidate 1 is the final opportunity for you to try out the abundance of new features before Django 4.0 is released.

    The release candidate stage marks the string freeze and the call for translators to submit translations. Provided no major bugs are discovered that can't be solved in the next two weeks, Django 4.0 will be released on or around December 6. Any delays will be communicated on the django-developers mailing list thread.

    Please use this opportunity to help find and fix bugs (which should be reported to the issue tracker). You can grab a copy of the package from our downloads page or on PyPI.

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    From The Django weblog at 2021-11-16 06:00:30

    2022 DSF Board Nominations

    It is that time again to begin to elect next year’s Django Software Foundation’s Board of Directors!

    As you know, the Board guides the direction of the marketing, governance, and outreach activities of the Django community. We provide funding, resources, and guidance to Django events on a global level. Further we provide support to the Django community with an established Code of Conduct and make decisions and enforcement recommendations for violations. We work closely with our corporate and individual members to raise funds to help support our great community.

    In order for our community to continue to grow and advance the Django Web framework, we need your help. The Board of Directors consists of volunteers who are elected to one-year terms. This is an excellent opportunity to help advance Django. We can’t do it without volunteers, such as yourself. For the most part, the time commitment is a few hours per month. Anyone including current Board members, DSF Members, or the public at large can apply to the Board. It is open to all who wish to participate.

    If you are interested in helping to support the development of Django we’d enjoy receiving your application for the Board of Directors. Please fill out the application form by November 30th, 2021 AoE to be considered. Once we have our candidates we will open a week-long voting period.

    If you have any questions about applying, the work, or the process in general please don’t hesitate to reach out via email to foundation@djangoproject.com and one of us will get back to you shortly.

    Thank you for your time and we look forward to working with you in 2022.

    The 2021 DSF Board of Directors

    Application Form.

    From The Django weblog at 2021-11-12 06:00:30

    Nominations for 2021 Malcolm Tredinnick Memorial Prize

    Hello Everyone!

    It is that time of year again when we recognize someone from our community in memory of our friend Malcolm.

    Malcolm was an early core contributor to Django and had both a huge influence and impact on Django as we know it today. Besides being knowledgeable he was also especially friendly to new users and contributors. He exemplified what it means to be an amazing Open Source contributor. We still miss him to this day.

    The DSF Prize page summarizes the prize nicely:

    The Malcolm Tredinnick Memorial Prize is a monetary prize, awarded annually, to the person who best exemplifies the spirit of Malcolm’s work - someone who welcomes, supports and nurtures newcomers; freely gives feedback and assistance to others, and helps to grow the community. The hope is that the recipient of the award will use the award stipend as a contribution to travel to a community event -- a DjangoCon, a PyCon, a sprint -- and continue in Malcolm’s footsteps.

    We will take nominations until Thursday, November 26th, 2021 AoE and will announce the winner soon after the next DSF Board meeting in December.

    Please make your nominations using this google form.

    If you have any questions please reach out to the DSF Board at foundation@djangoproject.com.

    From The Django weblog at 2021-11-01 09:28:25

    Django bugfix release: 3.2.9

    Today we've issued the 3.2.9 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    From The Django weblog at 2021-10-25 10:14:33

    Django 4.0 beta 1 released

    Django 4.0 beta 1 is now available. It represents the second stage in the 4.0 release cycle and is an opportunity for you to try out the changes coming in Django 4.0.

    Django 4.0 has an abundance of new features which you can read about in the in-development 4.0 release notes.

    Only bugs in new features and regressions from earlier versions of Django will be fixed between now and 4.0 final (also, translations will be updated following the "string freeze" when the release candidate is issued). The current release schedule calls for a release candidate in a month from now with the final release to follow about two weeks after that around December 6. Early and often testing from the community will help minimize the number of bugs in the release. Updates on the release schedule schedule are available on the django-developers mailing list.

    As with all alpha and beta packages, this is not for production use. But if you'd like to take some of the new features for a spin, or to help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the beta package from our downloads page or on PyPI.

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    From The Django weblog at 2021-10-05 08:54:58

    Django bugfix release: 3.2.8

    Today we've issued the 3.2.8 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00

    From The Django weblog at 2021-09-21 20:10:46

    Django 4.0 alpha 1 released

    Django 4.0 alpha 1 is now available. It represents the first stage in the 4.0 release cycle and is an opportunity for you to try out the changes coming in Django 4.0.

    Django 4.0 has a abundance of new features which you can read about in the in-development 4.0 release notes.

    This alpha milestone marks the feature freeze. The current release schedule calls for a beta release in about a month and a release candidate about a month from then. We'll only be able to keep this schedule if we get early and often testing from the community. Updates on the release schedule are available on the django-developers mailing list.

    As with all alpha and beta packages, this is not for production use. But if you'd like to take some of the new features for a spin, or to help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the alpha package from our downloads page or on PyPI.

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    From The Django weblog at 2021-09-01 06:54:22

    Django bugfix release: 3.2.7

    Today we've issued the 3.2.7 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    From The Django weblog at 2021-08-04 13:49:12

    2021 Django Developers Survey

    The 2021 Django Developers Survey is now live. Please take a moment to fill it out. The survey sheds light on how different developers use Django and the related tools and technologies. After the survey is over, the aggregated results and anonymized raw data will be published.

    From The Django weblog at 2021-08-01 07:31:58

    Django bugfix release: 3.2.6

    Today we've issued the 3.2.6 bugfix release.

    The release package and checksums are available from our downloads page, as well as from the Python Package Index. The PGP key ID used for this release is Carlton Gibson: E17DF5C82B4F9D00

    From The Django weblog at 2021-07-01 07:42:04

    Django security releases issued: 3.2.5 and 3.1.13

    In accordance with our security release policy, the Django team is issuing Django 3.2.5 and Django 3.1.13. These releases address the security issue with severity "high" detailed below. We encourage all users of Django to upgrade as soon as possible.

    CVE-2021-35042: Potential SQL injection via unsanitized QuerySet.order_by() input

    Unsanitized user input passed to QuerySet.order_by() could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted.

    As a mitigation the strict column reference validation was restored for the duration of the deprecation period. This regression appeared in 3.1 as a side effect of fixing #31426.

    The issue is not present in the main branch as the deprecated path has been removed.

    Thanks to Joel Saunders for the report.

    Affected supported versions

    • Django 3.2
    • Django 3.1

    Resolution

    Patches to resolve the issue have been applied to Django's 3.2 and 3.1 release branches. The patches may be obtained from the following changesets:

    The following releases have been issued:

    The PGP key ID used for this release is Mariusz Felisiak: 2EF56372BA48CD1B.

    General notes regarding security reporting

    As always, we ask that potential security issues be reported via private email to security@djangoproject.com, and not via Django's Trac instance or the django-developers list. Please see our security policies for further information.