Planet Python
Last update: August 08, 2026 09:48 PM UTC
August 08, 2026
Ed Crewe
From Routing Checks to Trajectory Testing: Evaluating an Agentic Chatbot
August 06, 2026
Django Weblog
Call for applicants for a Django Executive Director
The Django Software Foundation is announcing a call for an Executive Director. The Executive Director is the operational leader of the Django Software Foundation, a paid position reporting to the Board of Directors, responsible for setting the Foundation's strategic direction and turning it into action, while managing day-to-day operations. They serve as the main connector between the Board, staff, community, and sponsors.
The Django Software Foundation (DSF) is a 501(c)(3) nonprofit that develops and maintains Django, a free and open-source web application framework. The Foundation exists to support the development of Django by sponsoring sprints, meetups, gatherings and community events; to promote the use of Django among the web development community; to protect the framework's intellectual property and long-term viability; and to advance the state of the art in web development.
This is a new role for the Foundation. Django itself has been around since 2005, but the DSF wasn't founded until 2008, and the person who takes on this role will play a key part in maturing the Foundation's internal structure, helping ensure the DSF can properly support and sustain this important ecosystem going forward. The position is initially for a period of one year, renewable subject to an annual performance evaluation. Depending on the candidate, the role may be part-time or full-time.
Beyond running the Foundation, the Executive Director is a representative of the DSF itself. They embody Django's welcoming culture and help the community sustain the framework's home. The Executive Director is often called upon to represent the Foundation publicly, including at Django conferences and events, and to grow awareness of the DSF as an organization, distinct from the framework it supports.
Responsibilities
Executive Director duties include (but are not limited to):
- Fundraising: leading sponsorship development, corporate and individual membership growth, and partner relationships, including support for the jump from our current 300K USD annual fundraising goal to 500K USD. At the current funding level (around 300K per year), a full-time Executive Director isn't yet sustainable. We'd like to fix that, and we want you to lead that change.
- Admin and operations management: day-to-day operations and administration of the DSF, financial reporting, grant management, and the general running of the organization. Over time, helping grow the DSF into a more mature organization by establishing the operational foundations that support the nonprofit's growth.
- Managing the DSF Assistant and Fellows: overseeing the DSF Assistant and the Django Fellows program, the paid maintainers funded by the DSF.
- Marketing and outreach: community outreach and communications, representing the DSF publicly (for example, conference representation), and growing awareness of the Foundation as distinct from the framework.
- Legal, trademark, and follow-ups: overseeing international trademark policy enforcement, creating, signing, and renewing contracts, handling legal correspondence, and the unglamorous administrative follow-through that keeps a 501(c)(3) compliant. First-hand legal knowledge isn't required here; you'll work with counsel.
- Working group check-ins: regular coordination with the DSF working groups, the volunteer committees handling events, AI, accessibility, fundraising, and more.
- Working with our Django events and conferences like our DjangoCons.
Requirements
An Executive Director is responsible for fundraising, operations, communications, and community coordination. This is a broad remit, and it isn't our expectation that you come into the job an expert in every part of it. We hope you'll have solid experience in a few of these areas, particularly the ones most central to the role (fundraising and partnership development, nonprofit operations, and stakeholder communication). A willingness to learn and a demonstrated history of doing so are more important than comprehensive knowledge.
The areas you can expect to work across include (and are not limited to):
- Fundraising, sponsorship, and partnership development
- Nonprofit operations, financial reporting, and grant management
- Contracts, trademark, and 501(c)(3) compliance (in coordination with counsel)
- Public representation, marketing, and communications
- Coordinating staff, volunteers, and working groups
- Technical knowledge is not required, but is a nice-to-have:
- Knowledge of, or familiarity with, the Django and Python community
- Familiarity with open source licenses and communities
And required professional skills such as:
- Conflict resolution
- Time management and prioritization expertise
- Ability to focus in short periods of time and do substantial context switches
- Self-awareness to recognize their own limits and reach out for help
- Relationship-building and coordination with the Board, staff, working groups, sponsors, and external parties
- Tenacity, patience, compassion and empathy are essential
Therefore, a Django Executive Director requires the skills and judgment of an experienced nonprofit leader who is comfortable with fundraising, operations, and coordination with community stakeholders. Open-source experience and familiarity with the Django or Python community in particular are a big plus.
Being part of the Django community isn't a prerequisite for this position. We'll consider applications from anyone with a proven history of nonprofit leadership or comparable experience in an open-source or mission-driven community, but this is a remote position based in the United States, and unfortunately we are not able to offer visa sponsorship for this role.
The DSF is an equal opportunity employer. We welcome applicants of every background and don't discriminate on the basis of race, color, religion, gender, gender identity or expression, sexual orientation, national origin, disability, age, or veteran status.
How to apply
If you're interested in applying for the position, please submit your application via hiring@djangoproject.com. Your application should include:
- A cover letter (optional)
- A resume or CV
- A brief vision statement (500 to 1000 words) addressing your understanding of the Foundation's current position, the key opportunities and challenges you see for the Foundation, and your approach to the role
References may be requested during the interview process.
The compensation for this role is a base salary of $90,000 to $120,000, plus a bonus of up to $60,000 tied to our progress toward the $500,000 fundraising goal, which we'll tier as we work toward it. Depending on the candidate, the DSF will consider a part-time position and adjust the salary accordingly.
Applicants will be evaluated based on the following criteria:
- Relevant nonprofit leadership and operational experience
- Track record in fundraising and partnership development
- Understanding of the position and of the DSF's current stage
- Clarity, formality, and precision of communications
- Familiarity with open source and/or the Django and Python community
- Strength of reference(s)
Applications will be open until midnight Central Time, September 14, 2026, with the expectation that the successful candidate will start around November 1, 2026 (to be confirmed).
Reference: Announcing the Search for a DSF Executive Director (Django Project blog, June 17, 2026).
Hynek Schlawack
Production-ready Python Docker Containers with uv
Starting with 0.3.0, Astral’s uv brought many great features, including support for cross-platform lock files uv.lock. Together with subsequent fixes, it has become Python’s finest workflow tool for my (non-scientific) use cases. Here’s how I build production-ready containers, as fast as possible.
August 05, 2026
Django Weblog
Django 6.1 released
The Django team is happy to announce the release of Django 6.1.
The release notes offer a harmonious mélange of new features and usability improvements. A few highlights are:
-
Model field fetch modes for configuring on-demand fetching behavior
-
Database-level delete options for
ForeignKey.on_delete -
Dictionary-based email settings
You can get Django 6.1 from our downloads page or from the Python Package Index.
The PGP key ID used for this release is Jacob Walls: 131403F4D16D8DC7
With the release of Django 6.1, Django 6.0 has reached the end of mainstream support. The final minor bug fix release, 6.0.8, which was also a security release, was issued yesterday, Aug. 4, 2026. Django 6.0 will receive security and data loss fixes until April 2027. All users are encouraged to upgrade before then to continue receiving fixes for security issues.
See the downloads page for a table of supported versions and the future release schedule.
Tryton News
Security Release for issue #14947
Cédric Krier has discovered that Tryton does not prevent weasyprint to access local files when rendering HTML report to PDF.
Impact
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Confidentiality: High
- Integrity: None
- Availability: None
Workaround
There is no workaround.
Resolution
All affected users should upgrade trytond to the latest version.
Affected versions per series:
trytond:- 8.0: <= 8.0.7
- 7.8: <= 7.8.13
- 7.0: <= 7.0.54
Not affected versions per series:
trytond:- 8.0: >= 8.0.8
- 7.8: >= 7.8.14
- 7.0: >= 7.0.55
Some custom reports may fail after the upgrade because they are using local files. Such reports must be updated to use only files via public HTTP.
Reference
Concerns?
Any security concerns should be reported on the bug-tracker at https://bugs.tryton.org/ with the confidential checkbox checked.
1 post - 1 participant
Python GUIs
Handling Image Drag and Drop from Web Browsers in PyQt6 — Why toLocalFile() returns an empty string and how to handle remote image drops correctly
When dragging and dropping images from a web browser into a PyQt6 rich text editor, toLocalFile() sometimes returns a blank string. It works for some images (like Google image search results) but fails for others (like images embedded directly on a webpage). Why does this happen, and how can I handle it?
Core Dispatch
Core Dispatch #9
Welcome back to Core Dispatch! This edition covers July 18 through August 5, 2026. Python 3.15.0 release candidate 1 landed on August 4, followed by Python 3.14.7 and 3.13.15 on August 5. With the first release candidate here, 3.15 is firmly in the home stretch. Two new PEPs joined the queue this f
Python Insider
Python 3.14.7 and 3.13.15 are now available!
A pair of bug fix releases await your upgrade.
August 04, 2026
Marc-André Lemburg
Pymmich – an AI-first OSS project 🐍✨
A couple of months ago, I decided to switch to Immich, the photo management software, for storing and managing photos.
I had used Nextcloud Memories before that, but found the Immich app more intuitive and easier to use.
What was missing, was a good way to quickly upload albums from
PyCoder’s Weekly
Issue #746: Free-Threaded NumPy, __all__, PyTorch, and More (2026-08-04)
Programiz
Python Lists
In this tutorial, we will learn about Python lists (creating lists, changing list items, removing items, and other list operations) with the help of examples.
Python Slicing
Django Weblog
Django security releases issued: 6.0.8 and 5.2.17
In accordance with our security release policy, the Django team is issuing releases for Django 6.0.8 and Django 5.2.17. These releases address the security issues detailed below. We encourage all users of Django to upgrade as soon as possible.
CVE-2026-15307: Server-side file-write and request forgery via spatial lookups
Spatial lookups allowed str and dict lookup values to be passed to
GDALRaster when they represented rasters. Depending on the raster driver, this could
write a file to disk (in some cases enabling remote code execution) or issue a
network request as the Django process user. Because the admin changelist
permits filtering via ModelAdmin.lookup_allowed(), the flaw was reachable by
staff users with view permissions on any registered model containing a spatial
field.
The following types are now disallowed by spatial lookups:
dict- A
strthat is not a validGEOSGeometry, e.g. a serialized dictionary
This is a backward incompatible change. As a reminder, all untrusted user input should be validated before use. For that reason, assignments to model fields are unaffected and still accept these input types.
For guidance on how to keep using these types in spatial lookups, on validating untrusted input, and on further security considerations, see the raster security considerations documentation.
This issue has severity "high" according to the Django security policy.
Thanks to Bence Nagy, localhost-detect, and kimchunbok_ for the report.
CVE-2026-15337: Potential denial-of-service vulnerability in check_for_language()
django.utils.translation.check_for_language() was subject to a potential denial-of-service attack when checking many distinct, very long language codes. Each code was used as a key in an in-memory cache, consuming process memory.
The language value reaches this function through the django.views.i18n.set_language() view (not active by default) from POST data. Since request data is limited by DATA_UPLOAD_MAX_MEMORY_SIZE and the cache is configured to store a maximum number of entries, the memory that could be consumed was bounded.
To mitigate this vulnerability, language codes longer than 500 characters are now rejected before the cached lookup.
This issue has severity "low" according to the Django security policy.
Thanks to Jaeyoung Jang for the report.
CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections
GEOSGeometry was subject to a potential denial-of-service attack when
provided deeply nested GEOMETRYCOLLECTION objects, leading to a segmentation
fault in GEOS. A maximum depth of 198 GEOMETRYCOLLECTIONs is now enforced for
the well-known text (WKT) format, and a maximum number of 198
GEOMETRYCOLLECTIONs in total (breadth and depth) is enforced for well-known
binary (WKB).
Lookups against spatial fields and the GeometryField form field were also
affected.
The limit can be customized through the new max_geom_collections argument,
available on GEOSGeometry, the form field, and the model field. The limit is
not applied to GeoJSON inputs, as they were parsed by GDAL and are not affected.
This issue has severity "moderate" according to the Django security policy.
Thanks to Andrew MacPherson and kimchunbok_ for the report.
CVE-2026-15920: Potential cross-site scripting via URLField values in the admin
The admin renders URLField values as clickable links on changelist views and read-only fields. The link was generated without validating the value as a safe URL, so a stored value using a potentially dangerous scheme was rendered as a link.
URLField values shown via display_for_field are now validated using URLValidator before a link is rendered, and displayed as plain text if validation is failed.
This issue has severity "moderate" according to the Django security policy.
Thanks to Egor Saltykov (misop00p / ansjdnakjdnajkd) for the report.
Affected supported versions
- Django main
- Django 6.1 (currently at release candidate status)
- Django 6.0
- Django 5.2
Resolution
Patches to resolve the issue have been applied to Django's main, 6.1 (currently at release candidate status), 6.0, and 5.2 branches. The patches may be obtained from the following changesets.
CVE-2026-15307: Server-side file-write and request forgery via spatial lookups
- On the main branch
- On the 6.1 branch
- On the 6.0 branch
- On the 5.2 branch
CVE-2026-15337: Potential denial-of-service vulnerability in check_for_language()
- On the main branch
- On the 6.1 branch
- On the 6.0 branch
- On the 5.2 branch
CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections
- On the main branch
- On the 6.1 branch
- On the 6.0 branch
- On the 5.2 branch
CVE-2026-15920: Potential cross-site scripting via URLField values in the admin
- On the main branch
- On the 6.1 branch
- On the 6.0 branch
- On the 5.2 branch
The following releases have been issued
The PGP key ID used for this release is Natalia Bidart: 2EE82A8D9470983E
General notes regarding security reporting
As always, we ask that potential security issues be reported via private email
to security@djangoproject.com, and not via Django's Trac instance, nor via
the Django Forum. Please see
our security policies for further
information.
Python Insider
Python 3.15.0 candidate 1 is here!
Get those wheels rolling!
August 03, 2026
Tryton News
Tryton News August 2026
This month the community focused on the trytond core. The XML data import grows a new way to find existing records, the database schema shrinks oversized character columns automatically, and the test suite for function fields and button methods gets more coverage. On the user-facing side, the accounting menus are tidied up, and the DPD shipping carrier moves to the latest API. All of this builds on our last LTS release 8.0.
For an in depth overview of the Tryton issues please take a look at our issue tracker or see the issues and merge requests filtered by label.
Changes for the User
Accounting, Invoicing and Payments
When a user un-reconciles a line that was created by the receivable rule, Tryton now raises a warning, similar to the warning it already shows for payables. This avoids accidentally leaving too much money in the target account.
The accounting menus are simplified. The “open journal” entry now opens the journal and period form directly instead of going through a wizard. The “close” prefix is dropped from the processing menu-entries, the reconcile wizard becomes the first one, and the redundant “account” prefix is removed from the moves menu entry.
Stock, Production and Shipments
The DPD shipping carrier integration now uses Shipment Service 4.5, the latest version of the DPD API.
New Documentation
The documentation for creating account moves from a template now links the accounting menu-entry in the client, so the workflow is easier to find.
New Releases
We released bug fixes for the currently maintained long term support series 8.0, 7.8, and 7.0.
Changes for Implementers and Developers
When all rows of a char field fit in a smaller column, the database schema is now shrunk automatically. This keeps the database compact without any manual intervention.
The XML data import now supports a search attribute on the <record> tag. When the record with the given id does not exist, Tryton uses this domain to find an existing record before creating a new one. This makes it possible to import data using natural unique keys like the language code.
The test suite for button methods now runs each method as a subtest, so a failure in one method does not prevent the remaining button methods from being tested.
The test suite for column-based function fields is now added to the tests of fields methods.
Initial draft powered by Minimax-M3. Curated and finalized by human hands.
1 post - 1 participant
August 02, 2026
Mike C. Fletcher
OMI Audio extension for glTF
Another OMI-based extension, this time for positional audio mixing. Again, Claude-coded, using the OMI/KHR audio extensions for glTF as the base model and then implementing the actual mixing using Numpy. Supports mp3, wav, opus and flac inputs and stereo (headset) outputs. Up on github as omi_audio and on PyPI as omi_audio as well.
This is loosely the same model as Web Audio's Panner Node. The only significant difference from the KHR extension is that we also support VRML97 style double-ellipse emitter. The package delegates file retrieval to the application, and doesn't include any special effects or the like.
Talk Python to Me
#557: Security of everything at PyCon 2026
Security has always been the vegetables of software. Everyone agrees it matters, and somehow it never quite makes it onto the plate. At PyCon US this year, that changed. For the first time ever, security got its own dedicated, day-long track, one of just two at the whole conference, sitting right next to AI. And the room was packed to the back wall. On this episode, I'm joined by the three people at the center of it. Seth Larson, Security Developer in Residence at the Python Software Foundation and, very recently, a CPython core developer. Juanita Gomez, a PhD researcher at UC Santa Cruz in open source security, who co-chaired the track. And Mike Fiedler, PyPI's Safety and Security Engineer, one of the very few people paid full-time to keep the packages you install safe. We use the arc of the track's talks to take the temperature of Python security right now: supply chain attacks, dependency cooldowns, zero trust, SBOMs, and the push to bring Rust into CPython. And why not one of us thinks security is anywhere close to solved. Turns out that's the good news. It's why the room was full.
Python⇒Speed
Faster floating point math with Rust’s new API
August 01, 2026
Seth Michael Larson
Let’s Play “htmx 4: the game”
July 31, 2026
Programiz
Python Booleans and Boolean Expressions
Caktus Consulting Group
Chicago Like a Local: Things to Do During DjangoCon US 2026 (Part 1)
DjangoCon US 2026 is coming back to Chicago from August 23–28, and we at Caktus couldn’t be more thrilled, not only to be returning as a Silver Sponsor, but also because I (Keanya) have the privilege of chairing the conference once again!
Jaime Buelta
Python Automation Cookbook 3rd edition: now with AI recipes.
Exciting news! The third edition of the Python Automation Cookbook is out, featuring a vibrant new cover and over 100 pages of fresh AI content. Aimed at Python enthusiasts of all levels, it retains classic recipes while introducing innovative ways to incorporate AI in code. A fantastic addition to any developer's library!
Python Software Foundation
Get Ready: Python Packaging Council Nominations Opening Soon!
Seth Michael Larson
Extracting “Ocarina of Time: Master Quest” ROM from the Legend of Zelda: Wind Waker bonus disc