Django community: RSS
This page, updated regularly, aggregates Community blog posts from the Django community.
-
django-content-editor now supports cloning of content
django-content-editor now supports cloning of content What is the content editor? Django’s builtin admin application provides a really good and usable administration interface for creating and updating content. django-content-editor extends Django’s inlines mechanism with an interface and tools for managing and rendering heterogenous collections of content as are often necessary for content management systems. We are using django-content-editor in basically all projects, as a part of feincms3. The content editor is used not only for building page content, but also for blog entries, for building multi-step intelligent form wizards, for learning units and even to digitize teaching materials for schools, including static and interactive content. The great thing about it is that it enables us to edit complex content inside Django’s administration interface without trying to replace it with a completely separate interface, as some other more well-known Django-based CMS want to do. Cloning content The complexity of managed content has grown a bit, especially since we introduced support for nesting sections. Teaching materials are often available in several learning levels, with only minor differences between them. Unfortunately, the differences aren’t purely additive: It’s not the case that higher levels just have more materials available. Otherwise, we’d probably have used … -
How to migrate from pip-tools to uv
At Caktus, many of our projects use pip-tools for dependency management. Following Tobias’ post How to Migrate your Python & Django Projects to uv, we were looking to migrate other projects to uv, but the path seemed less clear with existing pip-tools setups. Our requirements are often spread across multiple files, like this: -
Built with Django Newsletter - 2025 Week 34
Hey, Happy Friday! Why are you getting this: *You signed up to receive this newsletter on Built with Django. I promised to send you the latest projects and jobs on the site as well as any other interesting Django content I encountered during the month. If you don't want to receive this newsletter, feel free to unsubscribe anytime. News and Updates Apologies for not sending updates in a while. I'm working on partially automatic this process so that I'm more reliable. Because I left the newsletter hanging, something weird happened. We got 5k+ subscribers in just couple of months. Needless to say, 99% of them are fake. I'm going to send this issue to all and see who opens it. For the people who don't open for 3 issues I will just unsub manually. I decided to remove the Django updated part. Too much extra work for now. Hopefully you are ok with that. If not, let me know. Sponsors This issue is sponsored by CodeRabbit an AI Code Reviewer that provides context-aware feedback, refactoring suggestions and highlights code security issues. In plain terms, you finally get a senior level developer reviewing your code! The best news is that it … -
Menu improvements in django-prose-editor
Menu improvements in django-prose-editor I have repeatedly mentioned the django-prose-editor project in my weeknotes but I haven’t written a proper post about it since rebuilding it on top of Tiptap at the end of 2024. Much has happened in the meantime. A lot of work went into the menu system (as alluded to in the title of this post), but by no means does that cover all the work. As always, the CHANGELOG is the authoritative source. 0.11 introduced HTML sanitization which only allows HTML tags and attributes which can be added through the editor interface. Previously, we used nh3 to clean up HTML and protect against XSS, but now we can be much more strict and use a restrictive allowlist. We also switched to using ES modules and importmaps in the browser. Last but not least 0.11 also introduced end-to-end testing using Playwright. The main feature in 0.12 was the switch to Tiptap 3.0 which fixed problems with shared extension storage when using several prose editors on the same page. In 0.13 we switched from esbuild to rslib. Esbuild’s configuration is nicer to look at, but rslib is built on the very powerful rspack which I’m using everywhere. In … -
Django News - State of Python 2025 Results - Aug 22nd 2025
News State of Python 2025 Is Out! Explore the key trends and actionable ideas from the latest Python Developers Survey, which was conducted jointly by the Python Software Foundation and JetBrains PyCharm and includes insights from over 30,000 developers. jetbrains.com PyPI now serves project status markers in API responses PyPI now exposes standardized project status markers through its HTML and JSON index APIs, enabling package installers to programmatically signal dependency status and manage installations. pypi.org Preventing Domain Resurrection Attacks PyPI now checks for expired domains to prevent domain resurrection attacks, a type of supply-chain attack where someone buys an expired domain and uses it to take an account through password resets. pypi.org Updates to Django Today "Updates to Django" is presented by Velda Kiara from Django Events Foundation North America (DEFNA)! 🚀 Last week we had 15 pull requests merged into Django by 10 different contributors - including a first-time contributor! Congratulations to Rohit for having their first commits merged into Django - welcome on board! Django Core Updates ✨ Fix to Subquery.resolve_expression() output field handling which corrects how Django determines the output_field in subqueries. This adjustment restores consistent and predictable query behavior. Template partials arrive in DTL adds two … -
Configurable UI in Software
Another short one today, that is a pattern I have noticed in a couple pieces of software I use, notably Todoist, Slack & Vivaldi. All three of these allow a user to configure the menu options to some degree. Slack has the option to customise the navigation options shown within a particular workspace to optimise the experience for a user. Todoist takes this a step further in the mobile app to allow a user to sort the menu items. Browsers have always had a great experience of customisation, but Vivaldi takes this to an awesome extreme by allowing a user to customise each and every possible context menu, giving true flexability to their users. Personally I have never considered the power of this and wonder if there are any efficient implementation of this for Django without creating a huge amount of complexity. The naive default solution would likely involve a model and a context processor and/or a middleware, it might be something I add in my next project, if we feel it would be beneficial to our users. -
Django News - A New Django Fellow - Aug 15th 2025
News Jacob Tyler Walls is Our New Fellow Jacob Tyler Walls joins the Django Fellowship, bringing Django contributions, Triage and Review experience, ORM expertise, and GIS and open source maintenance skills. djangoproject.com Python 3.14.0rc2 and 3.13.7 are go! Python 3.14 release candidates provide performance enhancements, new language features, and ABI stability, urging Django maintainers to prepare for compatibility testing. blogspot.com Announcing the PSF Board Candidates for 2025! There are four board seats open for this year's PSF election. The timeline, voting details, and candidates are included in the post. blogspot.com Announcing Python Software Foundation Fellow Members for Q2 2025! 🎉 PSF announces Q2 2025 Fellows, recognizing new contributors who lead projects, maintain libraries, organize events, and mentor to grow the Python community globally. blogspot.com Django Software Foundation DSF member of the month - Jake Howard Jake Howard, DSF member and Django contributor, leads DEP 14 and develops Django tasks, advancing native background workers and task infrastructure for Django. djangoproject.com Building better APIs: from Django to client libraries with OpenAPI Combine Django REST Framework with drf-spectacular to generate OpenAPI specs and use openapi-generator plus CI to produce and maintain automated client libraries. djangoproject.com Django’s accessibility contributing guide The Django accessibility team … -
Detecting Code Vulnerabilities Using Python with AI and LLMs
Let’s take a look at how easy detecting vulnerabilities in code can be using the latest and greatest technologies, including scale challenges and costs. -
Standards for third-party packages
I am starting to feel like I have written about this too much as this point, but anyway, third-party packages again! Recently I have been wondering about why third-party packages exist within the Django ecosystem. Broadly there is a few categories Establishing some new functionality that doesn't exist in core (APIs, Feature flags, Payments, etc) Extending an existing API with a new backend (databases, caches etc) Utilities to help with development (perhaps this is a subset of the first point) Packages demonstrating functionality that would be desirable with in Django core. Now one huge benefit to third-party packages is that it allows for choice, be it in the tools and dependencies used, the design and scope of the code. This is both for the package creator/maintainer and the user of said package. However I want to focus in on the last usage above and question whether choice is a good thing for this type of package. If we were to build a package with the goal of it perhaps one day being merged into Django, would it not benefit our future selves and others if the overall design of the package matched Django conventions and standards whereever possible? For example, … -
Why Open Source Makes Sense For Your Business Web Projects
What Is Open Source? Open source software is publicly available code that anyone can use, modify, and improve. It’s the foundation of much of the modern internet and it’s trusted by global enterprises, startups, nonprofits, and government agencies alike. -
🔗 This World of Ours (James Mickens)
I was reminded of this classic paper in the threat modeling literature canon. Hilarious and also insightful — worth a read if you haven’t seen it before. -
Happy 20th Birthday Django!
This Tuesday (tomorrow!), August 12th, we’re teaming up with TriPython to host an informal Django Birthday event at Boxyard RTP in Durham. -
Combining Django signals with in-memory LRU cache
It's easy to combine functools.lru_cache with Django signals to get a good memoization pattern on Django ORM queries. -
Django News - Django 5.2.5 Released - Aug 8th 2025
News Django bugfix release issued: 5.2.5 Django 5.2.5 provides essential bug fixes to boost application stability and performance, ensuring smooth deployments and improved developer experience. djangoproject.com django-rest-framework release v3.16.1 DRF v3.16.1 fixes unique_together and source field bugs, removes legacy Python support, and enhances translations, documentation, and internal testing with Django 5.2 compatibility. github.com Python Insider: Python 3.13.6 is now available Python 3.13.6 incorporates extensive bug fixes, build improvements, and documentation updates that enhance overall performance and reliability essential for Django applications. blogspot.com Join the Mission: Session 5 Applications Open! 🎉 Djangonaut Space opens applications for Session 5, an eight-week group mentorship guiding contributors to make sustained contributions to Django core and related projects. Applications open August 10th, 2025. djangonaut.space Preventing ZIP parser confusion attacks on Python package installers PyPI will reject malformed or ambiguous wheel ZIPs and begin enforcing RECORD consistency to prevent ZIP parser confusion attacks across Python installers. pypi.org Django Software Foundation DSF member of the month - Jake Howard Jake Howard, DSF member and Django contributor, details his DEP 14 background workers, community involvement, and focus on enhancing Django security and performance. djangoproject.com Updates to Django Today 'Updates to Django' is presented by Velda Kiara from Django … -
Two Scenario Threat Modeling
A trap that many people fall into when trying to threat modeling or risk planning is a fear of being incomplete that leads them to not even try. People think, “there are so many possible things that could go wrong, so many potential risks. It’s going to be such a huge effort to enumerate all possible scenarios, and I don’t have time, so I guess I can’t do threat modeling.” That is, threat modeling seems so big, so hairy, that people believe it’s too complex to tackle. This just isn’t true! Some planning is always better than no planning. In fact, you can get a surprising amount of value out of a very simple and fast technique: imagine a couple of scenarios – just two! – and game out what you could do to mitigate them. I’ll cover a bit of background first, but if you just want to get to the exercise, skip ahead to that section. Scenario-based threat modeling What do I mean by “scenario”? There are a variety of techniques for doing threat modeling: systems-oriented (diagram a system and consider threats at each node in the system); data-oriented (map all the data in your system and consider … -
Documentation that is never wrong
The iommi docs are more correct than most projects because we take a different approach to documentation: part of the test suite is the documentation. Let’s look at an example: def test_grouped_fields(): # language=rst """ .. _group-fields: How do I group fields? ~~~~~~~~~~~~~~~~~~~~~~ .. uses Field.group Use the `group` field: """ form = Form( auto__model=Album, fields__year__group='metadata', fields__artist__group='metadata', ) # @test show_output(form) # @end This ends up as this documentation: This is a normal test that runs with the normal test suite, with some additional markup: The triple quoted strings that are declared with # language=rst are included in the docs. Code is by default included in the documentation You can exclude code with # @test/# @end for checks you don’t want to include in the docs show_output renders some HTML output into a file that is then shown inline in the finished docs The .. uses command is used to mark what features this test uses so the examples are automatically linked from the reference API docs With this infrastructure in place, some fixes or features can be implemented with all the required tests written as the documentation with no additional tests. This radically incentivises writing docs compared to duplicating … -
A beginner check for makemigrations
Could our tools be smarter (even without AI) and helpful to prevent footgun usage? Today I'm taking aim at the Django makemigrations command. I feel fortunate to have been introduced to South and Django migrations at the beginning of my career so the logic of the migration files and the workflow makes sense in my head (or if I was confused I was corrected very early on by colleagues). However I wonder what other tech stack's do in regard to keeping keeping code and schema's in sync. I question this as every so often I run into newcomer's to Django not commiting migration files to source control and running makemigrations in every environment, which if you didn't know is a very bad idea that will lead to numerous issues as the project progresses. This led me to the following question: Could we prevent this happening in the first place, or place a burden on those knowing the risks when taking them? My immediate answer to this is spit out a warning if someone tries to run makemigrations when the DEBUG setting is False. To me this should be the minimum to add to the command. Using the DEBUG setting is … -
Comfort Scores: A risk mitigation tool for pre-trip briefings
Here’s a tool I find useful at pre-trip briefings that can help the group assess its ability to tackle some tricky objective. It’s especially good for groups with mixed skill levels where people aren’t necessarily familiar with everyone else’s skill set. I’ve used this in contexts like group kayak trips, group canyoneering trips, ambitious adventure runs, and so forth. You do need a small baseline of trust and psychological safety with the group since it requires being a little bit vulnerable about your comfort level. So it’s probably best in situations with shared context, e.g. kayak or climbing clubs; or among groups with similar training backgrounds, e.g. a group of guides with similar certifications It works like this: everyone individually thinks about the trip and the group’s objectives, and states their comfort with the trip as planned, giving a score of 1, 2, or 3. 3 means: “I’m super comfortable. This is well within my skill – so much so that I’lll be able to help others.” At a “3”, you’re not just getting through the day; you’ve got spare mental and physical capacity to help out others. This might be a Class IV boater on a Class III river … -
Announcing django-generic-notifications 1.0.0
Back in 2011, I started a small Django package called django-generic-notifications. It was built for a project I was working on at the time, got seven releases over a few months… and then it more or less died. Once I moved on from that original project, there wasn’t much reason to keep maintaining the library. It never gained a big user base, no pull requests or issues came in, and eventually I archived the repository. Fast forward to a few weeks ago, and I found myself needing a good, flexible notification system for a new Django project. I checked out a few third-party options, but none of them quite fit what I had in mind. I wasn’t super eager to revive django-generic-notifications — it was very old, still using South for migrations (yes, that old) — but in the end, I decided to bring it back to life. Or rather, to start fresh. So here it is: version 1.0.0 of django-generic-notifications. A complete rewrite, with the same core architecture but a modern, cleaned-up implementation. It’s more flexible, more powerful, and a lot more useful. What is django-generic-notifications? At its core, this package helps you send notifications to your users through … -
Solving bots registration problem by “reinventing the wheel”
<![CDATA[ Solving bots registration problem by “reinventing the wheel” Ever since I launched ImpressKit in 2021 I had issues with spammy bot registrations. Usually at least a few times a month these would be like twenty new user accounts that were obviously bots. I figured that it just a cost of having product with registration but over the years I got more and more annoyed. It messed up my stats dashboard, I was sending emails to weird addresses and I think I even got complaint from someone saying the did not register after receiving a login confirmation email. Some months ago I finally had enough and decided to try to tackle this. I did not want to use 3rd party captcha because these are annoying and it is another part that I would need to monitor and possibly update… But what should I use? After some thinking I arrived at solution that seemed both simple and like it could work. I added required “questionnaire” to the register form asking the prospective user what the project is about. I made sure the correct answer wasn’t the first radio button. When incorrect option is selected, then the form just redirects to new … -
Django News - Django and AI - Aug 1st 2025
News Djangonaut Session 5 - Officer and Organizer Interest A form to gauge returning officer and session organizer interest for the next session! google.com PyPI Users Email Phishing Attack - The Python Package Index Blog Phishing emails exploit PyPI package metadata by directing users to fake login pages that mimic PyPI, prompting developers to verify URLs and update passwords. pypi.org Djangonaut Space is looking for contributors to be mentors Posted by Djangonaut Space session organizers on July 31, 2025 djangoproject.com Updates to Django Today 'Updates to Django' is presented by Pradhvan from the Djangonaut Space! 🚀 Last week we had 16 pull requests merged into Django by 11 different contributors including 3 first-time contributors! Congratulations to Anthony Sottile, Mohamed Amine Mahmoud and Take Weiland for having their first commits merged into Django, welcome on board! 🎉 This week's Django highlights 🌟 Migrated django.core.mail to Python's current email API, replacing legacy email handling with modern implementation. Added hints support for PostgreSQL contrib operations, enabling database routers to make informed decisions in multi-database migration scenarios. Introduced accessibility guidelines and established accessibility standards that conform with the Web Content Accessibility Guidelines (WCAG) standards and along with best practices from Authoring Tool Accessibility Guidelines … -
Python and AI workflow with LangGraph
In this stream, I worked on a personal AI workflow that I’m building using LangGraph. I discussed human-in-the-loop and how to bring a person into the workflow process. -
Django: write a custom URL path converter to match given strings
Here’s a little tip based on some work that I did recently. The project has a URL pattern where the first part of the URL matches the current role the user is viewing the site as. Let’s say the roles are “chef”, “gourmand”, and “foodie”—example URLs might look like this: /chef/dashboard/ /gourmand/dashboard/ /foodie/dashboard/ /chef/dish/1/ /gourmand/dish/1/ /foodie/dish/1/ Most views can be accessed under all roles, with restrictions applied within the view code where appropriate. To match the role parts of the URL, you could define each URL pattern individually: from django.urls import path from example import views urlpatterns = [ path("chef/dashboard/", views.dashboard), path("gourmand/dashboard/", views.dashboard), path("foodie/dashboard/", views.dashboard), path("chef/dish/<int:id>/", views.dish), # ... ] However, that gets tiresome quickly and doesn’t really scale to larger numbers of roles or views. Also, it slows down URL resolution, as Django has to check each pattern in turn. Some scalable alternatives would be: Using Django’s str path converter, as in: path("<str:role>/dashboard/", views.dashboard) However, this matches arbitrary strings, requiring extra validation in the view and care to avoid capturing other URLs. Reaching for re_path() to define the URL as a regular expression, like: re_path(r"^(chef|gourmand|foodie)/dashboard/$", views.dashboard) But regular expression syntax is more complicated, especially for matching parameters. Rather than … -
Django: split ModelAdmin.get_queryset() by view
Within Django’s popular admin site, you can override ModelAdmin.get_queryset() to customize the queryset used by the admin views. It’s often used for performance optimizations, such as adding a select_related() call to batch-fetch related objects: from django.contrib import admin from example.models import Book @admin.register(Book) class BookAdmin(admin.ModelAdmin): def get_queryset(self, request): return super().get_queryset(request).select_related("author") However, one thing this approach lacks is granularity—the queryset returned by get_queryset() is used for all admin views, such as the change list, change form, and any custom views that you might add. That can mean that adding an optimization in get_queryset() for one view can impose a performance cost on other views that don’t need it. For example, the above select_related() call might optimize showing author details shown on the change list view, but other pages that don’t show the author will still incur the cost of the join. There isn’t an easy way to customize the queryset for individual views without overriding a lot of their code. However, the queryset() method is passed the current request object as context, which allows you to differentiate between views based on request.resolver_match. I think the most robust way to check the current admin view from there is with the __name__ attribute … -
Our tools are still not designed for the AI future
First a disclaimer on this one: I am making the assumption that the AI trend is here to stay in some form and an economic crash/bubble doesn't make the usage of them untenable, also I have yet experiment with every tool out there! With that said, a brief personal history of my usage of LLM's and the current wave of AI. I tried out ChatGPT when it was first released and was fairly impressed by the results, but the cruical missing step for me was the lack of browser integration, searching Google was still much quicker from a new tab page and the results from ChatGPT felt isolated, there was too much friction in my workflow for it be usable. I tried out a different product (I forget the name), which allowed me to search from a new tab page and I got AI results and normal search results in one go. This was better, but it still didn't stick, and so I kept experimenting with the tools on an ad-hoc basis, solving small challenges, but it not being a daily driver. In this I experimented with local LLMs and Zed's AI integration. This changed earlier this year where I …
