Django: Python 3.15 Adjustments and Fail-Closed Security
Django merged fixes for Python 3.15 directory handling and Windows message extraction, alongside hardening for content security policy and database error logging. The pattern is adapting to platform changes while defaulting to stricter, safer behavior.
Duration: PT2M48S
Episode overview
This episode is a short developer briefing from Django.
It explains recent repository work in plain language.
- Show: Django
- Published: 2026-10-23T13:08:13Z
- Audio duration: PT2M48S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Hello, it's Friday, October 23rd, 2026, and this is your Django briefing.
The lead pattern this week is platform adaptation meeting fail-closed security: code that now behaves differently because of Python 3.15, and code that now fails more safely when inputs are missing or untrusted.
First, Python 3.15. In PR 22095, Django aligned its safe directory creation helper with the standard library, which in 3.15 added a parent mode argument. That's the upstream resolution to the issue behind Django's vendored fix for CVE-2026-25674. The practical impact: storage and file-based cache directories that…
Second, tighter boundaries. PR 22179 fixes content security policy handling when a directive's only source is a nonce that is never used. Previously the empty directive was omitted, so browsers fell back to a less restrictive default, for example scripts falling back to default source. The policy builder now emits…
Other notable items: a GIS test fix for MySQL 9.5, which added a coordinate system attribute to GeoJSON output, a correction to the native name for Punjabi, and triage docs defining low ticket severity. Still open are template lexer fixes for comment tags without spaces, a crash…
What…
Nearby episodes from Django
- Template Parsing and Query Routing Fixes
- Weekly Recap - Python 3.15 Alignment and CSP Hardening
- Background Email Delivery and Contributor Docs
- Cached Property Deprecation and Docs Accessibility
- Test Stability Fixes and 6.1 Upgrade Note
- Security Hardening and Silent Data Fixes
- New Contributor PR Limits and Quiet Header Fixes
- HTTP Correctness and Query Safety