Django community: RSS
This page, updated regularly, aggregates Django Software Foundation from the Django community.
-
DSF Membership Open Space at DjangoCon US
If you are at DjangoCon US this year, join us for 45 minutes to talk about the Django Software Foundation. What: Django Software Foundation Membership Open Space When: Wednesday, August 26th, 1:00 pm to 1:45 pm Where: Wolf Point Ballroom, voco Chicago Downtown Schedule: Talks: Wednesday, Aug 26 DSF Board Directors Jeff Triplett, Abigail Afi Gbadago, and Paolo Melchiorre will be there, along with Django Fellows, Steering Council members, and other DSF members. This is an open space, not a talk. Pull up a chair and bring your questions. What We Want to Talk About Fundraising and finances. We raised our 2026 goal to $500,000. We'll cover what it funds, most of it the Django Fellows, and how we are tracking against it. If your company depends on Django, or you know one that does, ask us about corporate membership and sponsorship. The Executive Director search. The DSF is hiring its first Executive Director, and applications are open through midnight Central Time on September 14, 2026. If you are thinking about applying, or know someone who should, ask us about the role. Membership. How individual membership works, how people become members, and what members do. Members vote in DSF elections, … -
DSF Office Hours
The DSF Board hosts open office hours every Wednesday at 6:00 PM UTC (check your local time). Anyone in the Django community is welcome to drop in. You do not need an agenda or an invitation. Video call details are on the DSF Office Hours page. We have been running these since October 2024, and right now we have two things we would especially like to talk with you about. Who shows up On any given Wednesday, you might find DSF Board members, Steering Council members, Django Fellows, working group members, and community members who are curious about joining a working group. There is no membership requirement. Anybody from the community can join, and often does. The Executive Director search We recently published a call for applicants for a Django Executive Director. If you are considering applying, or you are still deciding whether it is the right fit, come to office hours and ask us anything: what the job actually looks like, what we expect in the first year, how the search works. We would rather answer your questions directly than have you guess from a job posting. If this is the first you are hearing about the search, please … -
Django is moving to an annual release cycle
Django's Steering Council has accepted the Django Enhancement Proposal DEP 20 to move Django to an annual release cycle. From January 2028, Django will make one feature release a year, giving every feature release the LTS-level three years of support, and version numbers will carry the feature release year: Django 2028, then Django 2029, and so on. Better Python support Python releases annually, each October. Django's eight-month cycle hasn't fit that well: LTS releases carried a wide Python matrix, including versions long past their upstream end-of-life. Under the new cycle, each Django version supports the three latest Python versions at release, and picks up the new Python version during its first year. Django's support window ends in step with its oldest supported Python. Every release is an LTS Every feature release gets three years of support: one year of mainstream bugfixes, then two years of security and data-loss fixes. The "LTS" label is retired — every feature release now carries that same, unique commitment. No more LTS gap: no racing a deadline to jump two years of changes at once. Upgrade one year at a time, whenever suits you within the support window. Three versions are supported at any time, … -
Call for applicants for a Django Executive Director
The Django Software Foundation is announcing a call for an Executive Director. The Executive Director is the operational leader of the Django Software Foundation, a paid position reporting to the Board of Directors, responsible for setting the Foundation's strategic direction and turning it into action, while managing day-to-day operations. They serve as the main connector between the Board, staff, community, and sponsors. The Django Software Foundation (DSF) is a 501(c)(3) nonprofit that develops and maintains Django, a free and open-source web application framework. The Foundation exists to support the development of Django by sponsoring sprints, meetups, gatherings and community events; to promote the use of Django among the web development community; to protect the framework's intellectual property and long-term viability; and to advance the state of the art in web development. This is a new role for the Foundation. Django itself has been around since 2005, but the DSF wasn't founded until 2008, and the person who takes on this role will play a key part in maturing the Foundation's internal structure, helping ensure the DSF can properly support and sustain this important ecosystem going forward. The position is initially for a period of one year, renewable subject to an … -
Django 6.1 released
The Django team is happy to announce the release of Django 6.1. The release notes offer a harmonious mélange of new features and usability improvements. A few highlights are: Model field fetch modes for configuring on-demand fetching behavior Database-level delete options for ForeignKey.on_delete Dictionary-based email settings You can get Django 6.1 from our downloads page or from the Python Package Index. The PGP key ID used for this release is Jacob Walls: 131403F4D16D8DC7 With the release of Django 6.1, Django 6.0 has reached the end of mainstream support. The final minor bug fix release, 6.0.8, which was also a security release, was issued yesterday, Aug. 4, 2026. Django 6.0 will receive security and data loss fixes until April 2027. All users are encouraged to upgrade before then to continue receiving fixes for security issues. See the downloads page for a table of supported versions and the future release schedule. -
Django security releases issued: 6.0.8 and 5.2.17
In accordance with our security release policy, the Django team is issuing releases for Django 6.0.8 and Django 5.2.17. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-15307: Server-side file-write and request forgery via spatial lookups Spatial lookups allowed str and dict lookup values to be passed to GDALRaster when they represented rasters. Depending on the raster driver, this could write a file to disk (in some cases enabling remote code execution) or issue a network request as the Django process user. Because the admin changelist permits filtering via ModelAdmin.lookup_allowed(), the flaw was reachable by staff users with view permissions on any registered model containing a spatial field. The following types are now disallowed by spatial lookups: dict A str that is not a valid GEOSGeometry, e.g. a serialized dictionary This is a backward incompatible change. As a reminder, all untrusted user input should be validated before use. For that reason, assignments to model fields are unaffected and still accept these input types. For guidance on how to keep using these types in spatial lookups, on validating untrusted input, and on further security considerations, see the raster security … -
DSF member of the month - Katherine "Kati" Michel
For July 2026, we welcome Katherine "Kati" Michel as our DSF member of the month! ⭐ Kati is involved in the Django community for many years. She was a DEFNA Director for 8 years and DjangoCon US Website Chair and Co-Chair. She is a DSF member since December 2017! You can learn more about Kati by visiting Kati's website and her GitHub Profile. Let’s spend some time getting to know Kati better! Can you tell us a little about yourself? (hobbies, education, etc) In 2002, I was living in Lawrence, Kansas and working for government contracts supporting US Citizenship and Immigration Services and the US Department of Education. While working for USCIS, I spoke to tens of thousands of people from around the world, but hadn't seen much of the world myself. In 2009, I decided to move to England and earn a master's degree from Lancaster University Management School. During the program, I was fortunate to have an internship in the IT Change Management Department of Co-operative Financial Services/Britannia Building Society. It feels full circle that I am now a software engineer at JPMorganChase, working in Infrastructure Platforms, Databases Department. How did you start using Django? While living in … -
See You in Chicago in One Month!
In just one month, developers, maintainers, educators, and Django enthusiasts from around the world will gather in Chicago for DjangoCon US 2026. DjangoCon US is more than a conference, it's a place to learn from the community, share ideas, contribute to Django, and make connections that last long after the event ends. Whether you're attending your first DjangoCon US or you've been coming for years, we're excited to welcome you. Over five days, attendees will have the opportunity to: Learn from expert speakers and community members Participate in hands-on tutorials Collaborate during Django sprints Join Open Spaces and informal discussions Meet fellow Django developers from across the globe If you're planning to join us, tickets are still available, and there's still time to reserve your stay at the conference hotel. The hotel room block deadline is August 3, so be sure to book your room before then. Register today! August 24–28, 2026 Chicago, Illinois We can't wait to see you in Chicago! -
Django 6.1 release candidate 1 released
Django 6.1 release candidate 1 is now available. It represents the final opportunity for you to try out the version that offers a harmonious mélange of new features and usability improvements, before Django 6.1 final is released. The release candidate stage marks the string freeze and the call for translators to submit translations. Provided no major bugs are discovered that can't be solved in the next two weeks, Django 6.1 will be released on or around August 5. Any delays will be communicated on the Django forum. Please use this opportunity to help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the release candidate package from our downloads page or on PyPI. The PGP key ID used for this release is Jacob Walls: 131403F4D16D8DC7 -
Supporting the Triptych Project
The Django Steering Council — in its role as the DSF's arm for technical governance — has provided a Letter of Collaboration in support of a funding application by Carson Gross and Alex Petros to advance the Triptych Project: three proposals to make HTML itself more expressive, in every browser, by default. Here's why, and how you can help. HTML over the wire, and Django The last few years have seen a move back towards serving multipage applications, with server-rendered templates. The HTMX library has probably had the biggest impact in the Django space, but Unpoly, Turbo, and others are part of the same story: send HTML over the wire, let the browser do what browsers do, and skip the client-side application layer where you don't really need it. It's a simpler model of the web — and it's one that speaks to Django's heart. This isn't a movement Django has watched from the sidelines. Template partials, added in Django 6.0, were directly inspired by the patterns these libraries make natural. The Triptych Project The Triptych Project takes the core insights from HTMX (and the related libraries) and proposes them for the HTML standard itself. Three small additions: PUT, PATCH, … -
Explore the DjangoCon US 2026 Speaker Lineup and Reserve Your Spot
DjangoCon US 2026 is just around the corner, and now is the perfect time to start planning your conference experience. Our speaker lineup is now available, featuring talks from Django contributors, maintainers, educators, and community members covering everything from web development and APIs to deployment, security, testing, AI, and the future of the Django ecosystem. Whether you're attending your first DjangoCon US or returning to reconnect with friends and colleagues, you'll find opportunities to learn, share ideas, and meet people from across the global Django community. Beyond the talks, your conference registration includes access to tutorials, Open Spaces, community sprints, hallway conversations, and social events that make DjangoCon US a unique experience. If you haven't registered yet, there's still time to join us in Chicago, August 24–28. Register for DjangoCon US 2026: https://2026.djangocon.us Browse the speaker lineup: https://2026.djangocon.us/news/announcing-lineup/ We'll be sharing more updates in the coming weeks, including the full conference schedule, travel reminders, and everything you need to make the most of your time at DjangoCon US. We look forward to seeing you in Chicago this August! -
Last Call 2026 Django Developer Survey
Time is running out. This is the last call for the 2026 Django Developers Survey, which the Django Software Foundation is running in partnership with JetBrains. The survey closes on July 13, 2026. It is one of the best measures we have of how Django is used, and it helps guide future technical and community decisions. So far, over 3,100 people have responded, and we would love to push that number past 4,000. Every response helps us better understand the Django community. This year's survey was shaped by the Django Steering Council, the Django Fellows, the Django Software Foundation Board of Directors, and several community members. Your feedback helps us understand your needs, see how you use Django, and plan for future development and community needs. How you can help Once you’ve done the survey, take a moment to re-share on socials and with your communities. The more diverse the answers, the better the results for all of us. We appreciate everybody helping to get the word out. Please use the following links: Bluesky https://surveys.jetbrains.com/s3/bs-django-developers-survey-2026 Django Forum https://surveys.jetbrains.com/s3/df-django-developers-survey-2026 LinkedIn https://surveys.jetbrains.com/s3/li-django-developers-survey-2026 Mastodon https://surveys.jetbrains.com/s3/md-django-developers-survey-2026 Reddit https://surveys.jetbrains.com/s3/r-django-developers-survey-2026 X / Twitter https://surveys.jetbrains.com/s3/x-django-developers-survey-2026 For more details, read the original announcement on the Django blog. -
Django security releases issued: 6.0.7 and 5.2.16
In accordance with our security release policy, the Django team is issuing releases for Django 6.0.7 and Django 5.2.16. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-48588: Potential exposure of private data via cached Set-Cookie response django.middleware.cache.UpdateCacheMiddleware and django.views.decorators.cache.cache_page avoided caching responses that set a cookie while varying on Cookie only when the incoming request contained no cookies at all. When the request already carried an unrelated cookie (such as a language or theme preference cookie), the protection did not apply, allowing a response that sets a session or other sensitive cookie to be stored in Django's shared cache. This issue has severity "low" according to the Django security policy. Thanks to Chris Whyland for the report. CVE-2026-53877: Heap buffer over-read in GDALRaster When django.contrib.gis.gdal.GDALRaster was instantiated with a bytes object representing a raster file, the vsi_buffer property could over-read the allocated buffer by approximately 32 bytes. This could result in information disclosure of adjacent heap memory or, in rare cases, a segmentation fault. Only rasters stored in GDAL's virtual filesystem were affected. This issue has severity "low" according to the Django security policy. Thanks to Bence … -
Keeping Up with the Django Community
The Django community runs on volunteer effort spread across several different groups of people. Most of it is public, but it isn't always easy to find. Here are the public places to find it: Weekly DSF Office Hours (website) DSF Board updates (website, GitHub repo) Steering Council (forum thread, GitHub repo) Website Working Group (forum thread) Online Community Working Group (forum thread) Django Fellow Reports (Jacob, Natalia, Sarah) DSF Office Hours Most of these are places to read and follow along, but one invites you to show up in real time, the DSF Office Hours. From the website: These are weekly office hours to work on anything related to the DSF. At least one board member will try to attend each week. Office hours take place every Wednesday at 6:00 PM UTC. All you need to do is bring something DSF-related to work on. This is intentionally broad, as long as it's vaguely DSF-related you're welcome to come. It's not a general-purpose Django coding session (you're welcome to be writing code but it should be related the DSF, e.g. working on djangoproject.com or something). They are friendly and casual. People are welcome to bring topics and discussions for everyone to … -
DSF member of the month - Salim Nuru
For June 2026, we welcome Salim Nuru as our DSF member of the month! ⭐ Salim was a Djangonaut Space participant in the first session. He has been an organiser of the DjangoCon Africa conference. He is currently the chair of the DjangoCon US website. He a DSF member since October 2024. He is looking for new opportunities! You can learn more about Salim by visiting Salim's blog and his GitHub Profile. Let’s spend some time getting to know Salim better! Can you tell us a little about yourself (hobbies, education, etc)? I'm Salim, I’m from Addis, Ababa Ethiopia. I'm a software engineer by day and a security researcher by night. And for fun, I like chess, video games, and books. I already have an idea, but where does your nickname "theShinigami" come from? I LOVE anime, and the very first anime I watched was Death Note. There's this character called Ryuk, who is a "shinigami," and when I created my GitHub account, it was a time when I was really into anime (which I still am). That's why it stuck as my GitHub username. How did you start using Django? I started using Django during my college years. I … -
How the Django Software Foundation Became a CNA
Why the DSF pursued CNA status Django has a long history of responsible security practices: a dedicated, private security mailing list, clear advisory policies, and predictable security releases. Even so, we relied on external organizations to assign CVE IDs (Common Vulnerabilities and Exposures). This sometimes introduced administrative delays and extra coordination overhead. Becoming a CNA (CVE Numbering Authority) allows the DSF to: Assign CVEs ourselves for vulnerabilities in Django and selected community projects. Publish advisories more efficiently and in closer alignment with Django's established release workflow. Maintain strong independence in how Django handles security incidents. The initial exploration The process began with internal discussions within the DSF Board and Django Security Team. We evaluated: Whether our existing security process already met CNA expectations. Whether we had the organizational stability to take on long term responsibility for CVE assignment. The scope of projects we would cover. How to ensure we could meet the operational requirements without overloading volunteers and Django Fellows. After confirming that our policies were mature and that the administrative workload would be manageable, we initiated the CNA application with MITRE. Preparing the application MITRE requires that new CNAs document their security processes and demonstrate that they can meet … -
Django 6.1 beta 1 released
Django 6.1 beta 1 is now available. It represents the second stage in the 6.1 release cycle and is an opportunity to try out the changes coming in Django 6.1. Django 6.1 offers a harmonious mélange of new features and usability improvements, which you can read about in the in-development 6.1 release notes. Only bugs in new features and regressions from earlier Django versions will be fixed between now and the 6.1 final release. Translations will be updated following the "string freeze", which occurs when the release candidate is issued. The current release schedule calls for a release candidate in about a month, with the final release scheduled roughly two weeks later on August 5. Early and frequent testing from the community will help minimize the number of bugs in the release. Updates on the release schedule are available on the Django forum. As with all alpha and beta packages, this release is not for production use. However, if you'd like to try some of the new features or help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the beta package from our downloads page or on PyPI. The PGP … -
Announcing the Search for a DSF Executive Director
The Django Software Foundation is hiring its first Executive Director, and we have the Django community to thank for making it possible. Six Django web development agencies have jointly pledged $47,500 to help fund the Executive Director's first year: Caktus Group, Lincoln Loop, Six Feet Up, Cuttlesoft, OddBird, and Two Rock. This is the financial foundation we needed to move from "we should hire an ED someday" to "we are hiring an ED now." Why This Role Matters The DSF has grown significantly over the past several years. We fund multiple Django Fellows, distribute grants to events around the world, manage corporate and individual memberships, oversee working groups, and handle the legal and operational responsibilities of a 501(c)(3) nonprofit. For years, volunteer board members have carried this operational load alongside their regular jobs. That dedication has carried us far, but there are real limits to what a volunteer board can do. An Executive Director changes that. This person would handle day-to-day operations and administration, sponsorship development and partner relationships, community outreach and communications, coordination with the Django Fellows and working groups, and grant management and financial reporting. It is a paid position, part-time or full-time depending on the candidate, for … -
DSF 2026 Fundraising Goals
Django has grown far beyond a web framework. It powers businesses, nonprofits, startups, educational institutions, and critical infrastructure around the world. The Django Software Foundation exists to support that ecosystem, and none of that work is possible without funding. This year, the board set an ambitious new fundraising goal, and I want to be transparent about what we are aiming for and why it matters. Before talking about where we want to go, it's important to recognize that everything the DSF does today is possible because of the organizations and individuals who already support Django. Their contributions fund the work that keeps Django healthy, secure, and sustainable, and we are deeply grateful for that support. Our 2026 Goal: $500,000 This year, we are raising our annual fundraising goal from $300,000 to $500,000. That is a meaningful increase, and it reflects where the foundation needs to be. Our current monthly recurring donations are around $9,000 per month. To reach $500,000 annually, we need to grow that to approximately $15,000 per month. Reaching this goal will require both new supporters and increased support from existing donors. Doing so will help us maintain the programs the community relies on while creating room for … -
Django security releases issued: 6.0.6 and 5.2.15
In accordance with our security release policy, the Django team is issuing releases for Django 6.0.6 and Django 5.2.15. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-6873: Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie get_signed_cookie() derived the signing salt by concatenating the cookie name (key) and salt arguments. When distinct name and salt pairs produced the same concatenation, cookies could be accepted in a context different from the one where they were signed. Cookies are now signed with an unambiguous salt derivation. For backwards compatibility, cookies signed by older Django versions are accepted until Django 7.0. This issue has severity "low" according to the Django security policy. Thanks to Peng Zhou for the report. CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend When using EMAIL_USE_TLS, a failed STARTTLS handshake could leave a partially-initialized connection that would subsequently be reused for sending email without encryption. This can occur with fail_silently=True, as used by send_mail() and BrokenLinkEmailsMiddleware, among others. Connections configured with EMAIL_USE_SSL are not affected. This issue has severity "low" according to the Django security policy. Thanks to Kasper Dupont for the report. CVE-2026-8404: Potential … -
Django 6.1 alpha 1 released
Django 6.1 alpha 1 is now available. It represents the first stage in the 6.1 release cycle and is an opportunity to try out the changes coming in Django 6.1. Django 6.1 offers a harmonious mélange of new features and usability improvements, which you can read about in the in-development 6.1 release notes. This alpha milestone marks the feature freeze. The current release schedule calls for a beta release in about a month and a release candidate roughly a month after that. We'll only be able to keep this schedule with early and frequent testing from the community. Updates on the release schedule are available on the Django forum. As with all alpha and beta packages, this release is not for production use. However, if you'd like to take some of the new features for a spin, or help find and fix bugs (which should be reported to the issue tracker), you can grab a copy of the alpha package from our downloads page or on PyPI. The PGP key ID used for this release is Jacob Walls: 131403F4D16D8DC7 -
2026 Django Developers Survey
The Django Software Foundation is once again partnering with JetBrains to run the 2026 Django Developers Survey 🌈 It’s an important metric of Django usage and is immensely helpful to guide future technical and community decisions. After the survey closes, we will publish the aggregated results. JetBrains will also randomly select 10 winners (from those who complete the survey in full with meaningful answers) who will each receive a $100 Amazon voucher or the equivalent in local currency. Summary Help shape the future of Django by taking the 2026 Django Developers Survey and sharing it with your communities so we can better understand how Django is being used around the world. How you can help Once you’ve done the survey, take a moment to re-share on socials and with your communities. The more diverse the answers, the better the results for all of us. Please use the following links: Bluesky https://surveys.jetbrains.com/s3/bs-django-developers-survey-2026 Django Forum https://surveys.jetbrains.com/s3/df-django-developers-survey-2026 LinkedIn https://surveys.jetbrains.com/s3/li-django-developers-survey-2026 Mastodon https://surveys.jetbrains.com/s3/md-django-developers-survey-2026 Reddit https://surveys.jetbrains.com/s3/r-django-developers-survey-2026 X / Twitter https://surveys.jetbrains.com/s3/x-django-developers-survey-2026 -
DSF member of the month - Bhuvnesh Sharma
For May 2026, we welcome Bhuvnesh Sharma as our DSF member of the month! ⭐ Bhuvnesh is a Django contributor since 2022 and a Google Summer of Code (GSoC) participant in 2023 for Django. He is now a mentor and an admin organizer for GSoC for the Django organization. He is the founder of Django Events Foundation India (DEFI) and DjangoDay India conference. He has been a DSF member since July 2023. He is looking for new opportunities! You can learn more about Bhuvnesh by visiting Bhuvnesh's website and his GitHub Profile. Let’s spend some time getting to know Bhuvnesh better! Can you tell us a little about yourself (hobbies, education, etc) I’m Bhuvnesh (aka DevilsAutumn), a software developer from India. I graduated in 2024 from GL Bajaj Institute of technology and management, and most of my work has been around Python, Django and building backend systems. My journey with Django started when I started contributing to Django core in 2022. I usually like working on things where there is an actual product involved, not just writing few APIs and closing the task. I like thinking about how the whole thing will work: models, permissions, background jobs, deployment, users, edge … -
Announcing the Google Summer of Code 2026 contributors for Django
The Django Software Foundation is happy to share the contributors selected for Google Summer of Code 2026. This year, we received over 200 proposals from contributors across the world. The level of detail and thought in these proposals made the selection process both exciting and challenging. Accepted Projects We’re pleased to announce the following projects: Implementing an experimental API framework for Django core Contributor: Praful Gulani Mentor: Andrew Miller This project explores an approach to introducing experimental APIs in Django by modernizing DEP 2 and defining an opt-in model. Add support for table-valued expressions in the ORM Contributor: p-r-a-v-i-n Mentors: Bhuvnesh Sharma, Jacob Walls This project develops a way to join against table-valued expressions such as Subquery() or PostgreSQL functions like generate_series() within the ORM. Unified dark mode and UI consistency for Django’s issue tracker Contributor: Keha Chandrakar Mentors: Saptak S, Sarah A This project adds dark mode support to Django’s issue tracker and brings it closer in visual consistency to the main Django website. Switch to Playwright tests for integration testing Contributor: Varun Kasyap Pentamaraju Mentor: Sarah Boyce This project focuses on improving Django’s browser integration testing by transitioning from Selenium to Playwright. Each of these projects focuses on … -
Django security releases issued: 6.0.5 and 5.2.14
In accordance with our security release policy, the Django team is issuing releases for Django 6.0.5 and Django 5.2.14. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible. CVE-2026-5766: Potential denial-of-service vulnerability in ASGI requests via file upload limit bypass ASGI requests with a missing or understated Content-Length header could bypass the FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE. This issue has severity "low" according to the Django security policy. This issue was originally highlighted by Kyle Agronick in Trac. Thanks to Jacob Walls for following up and reporting it. CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST Response headers did not vary on cookies if a session was not modified, but SESSION_SAVE_EVERY_REQUEST was True. A remote attacker could steal a user's session after that user visits a cached public page. This issue has severity "low" according to the Django security policy. CVE-2026-6907: Potential exposure of private data due to incorrect handling of Vary: * in UpdateCacheMiddleware Previously, django.middleware.cache.UpdateCacheMiddleware would erroneously cache …
