<p>Hello Everyone 👋 It is that time of year again when we recognize someone from our community in memory of our friend Malcolm.</p>

<p>Malcolm was an early core contributor to Django and had both a huge influence and impact on Django as we know it today. Besides being knowledgeable he was also especially friendly to new users and contributors. He exemplified what it means to be an amazing Open Source contributor. We still miss him to this day.</p>

<h2>The prize</h2>

<p>The <a href="https://www.djangoproject.com/foundation/prizes/">Django Software Foundation Prizes</a> page summarizes it nicely:</p>

<blockquote>The Malcolm Tredinnick Memorial Prize is a monetary prize, awarded annually, to the person who best exemplifies the spirit of Malcolm’s work - someone who welcomes, supports, and nurtures newcomers; freely gives feedback and assistance to others, and helps to grow the community. The hope is that the recipient of the award will use the award stipend as a contribution to travel to a community event -- a DjangoCon, a PyCon, a sprint -- and continue in Malcolm’s footsteps.</blockquote>

<p>Please make your nominations using our form: <a href="https://forms.gle/omLMemzRaDREreCAA">2024 Malcolm Tredinnick Memorial Prize</a>. Nominations are welcome from everyone.</p>

<p>We will take nominations until <strong>Monday, September 30th, 2024, <a href="https://www.timeanddate.com/time/zones/aoe">Anywhere on Earth</a></strong>, and will announce the winner(s) soon after the next DSF Board meeting in October. If you have any questions please reach out to the DSF Board at <a href="mailto:foundation@djangoproject.com">foundation@djangoproject.com</a>.</p>

<p><a href="https://forms.gle/omLMemzRaDREreCAA" class="cta">Submit a nomination</a></p>

Nominate a Djangonaut for the 2024 Malcolm Tredinnick Memorial Prize

<p>Nominations are open for the 2025 Django Software Foundation Board of Directors.</p>
<p>In 2023 we introduced a staggered term for directors. Of our 7 directors, there are 4 positions currently open, with each position serving for two years.</p>
<p>Decisions around the 2025 officer roles will be made during the meeting of the new board. You don’t need to specify which position you are nominating for.</p>
<p>As you know, the Board guides the direction of the marketing, governance and outreach activities of the Django community. We provide funding, resources, and guidance to Django events on a global level. Further we provide support to the Django community with an established Code of Conduct and make decisions and enforcement recommendations for violations. We work with our corporate and individual members to raise funds to help support our great community.</p>
<p>In order for our community to continue to grow and advance the Django Web framework, we need your help. The <a href="/foundation/#board">Board of Directors</a> consists of seven volunteers who are elected to two year terms. This is an excellent opportunity to help advance Django. We can’t do it without volunteers, such as yourself. Anyone including current Board members, DSF Members, or the public at large can apply to the Board. It is open to all.</p>
<p><a class="cta" href="https://docs.google.com/forms/d/e/1FAIpQLSd74XV9epjwk08y1H1Y5p8tnWTJvuG79maXffHoXx4lXY0dkQ/viewform?usp=sf_link">2025 DSF Board Nomination Form</a></p>
<p>If you are interested in helping to support the development of Django we’d enjoy receiving your application for the Board of Directors. Please fill out the <a href="https://docs.google.com/forms/d/e/1FAIpQLSd74XV9epjwk08y1H1Y5p8tnWTJvuG79maXffHoXx4lXY0dkQ/viewform?usp=sf_link">2025 DSF Board Nomination form</a> by October 25, 2024 <a href="https://www.timeanddate.com/time/zones/aoe">Anywhere on Earth</a> to be considered.</p>
<p>If you have any questions about applying, the work, or the process in general please don’t hesitate to reach out via email to <a href="mailto:foundation@djangoproject.com">foundation@djangoproject.com</a>.</p>
<p>Thank you for your time and we look forward to working with you in 2025.</p>
<p>The 2024 DSF Board of Directors.</p>

2025 DSF Board Nominations

<p>The Django team is happy to announce the release of Django 5.1.</p>
<p><a class="reference external" href="https://docs.djangoproject.com/en/5.1/releases/5.1/">The release notes</a>
showcase a kaleidoscope of improvements. A few highlights are:</p>
<ul class="simple">
<li>Easier guardrails for authentication: the new and shiny <a class="reference external" href="https://docs.djangoproject.com/en/5.1/ref/middleware/#django.contrib.auth.middleware.LoginRequiredMiddleware">LoginRequiredMiddleware</a>,
when added to <tt class="docutils literal">MIDDLEWARE</tt>, enforces authentication for all views by default.</li>
<li>A more inclusive framework: Django 5.1 includes several accessibility
enhancements, such as improved screen reader support in the admin
interface, more semantic HTML elements, and better association of help text
and labels with form fieldsets.</li>
<li>The second oldest ticket fixed in this release provides the <a class="reference external" href="https://docs.djangoproject.com/en/5.1/ref/templates/builtins/#std-templatetag-querystring">long awaited
querystring template tag</a>,
which greatly simplifies the handling of query strings when building URLs in
templates.</li>
</ul>
<p>(If you are curious about the oldest ticket fixed in this release, check out <a class="reference external" href="https://code.djangoproject.com/ticket/10743">Ticket #10743</a>.)</p>
<p>You can get Django 5.1 from <a class="reference external" href="https://www.djangoproject.com/download/">our downloads page</a> or from <a class="reference external" href="https://pypi.python.org/pypi/Django/5.1">the Python Package Index</a>. The PGP key ID used for this
release is Natalia Bidart: <a class="reference external" href="https://github.com/nessita.gpg">2EE82A8D9470983E</a>.</p>
<p>With the release of Django 5.1, Django 5.0 has reached the end of mainstream
support. The final minor bug fix release, <a class="reference external" href="https://docs.djangoproject.com/en/stable/releases/5.0.8/">5.0.8</a>, was issued yesterday.
Django 5.0 will receive security and data loss fixes until April 2025. All
users are encouraged to upgrade before then to continue receiving fixes for
security issues.</p>
<p>See the <a class="reference external" href="https://www.djangoproject.com/download/#supported-versions">downloads page</a> for a table of
supported versions and the future release schedule.</p>


Django 5.1 released

<p>In accordance with <a class="reference external" href="https://docs.djangoproject.com/en/dev/internals/security/">our security release policy</a>, the Django team
is issuing releases for
<a class="reference external" href="https://docs.djangoproject.com/en/dev/releases/5.0.8/">Django 5.0.8</a> and
<a class="reference external" href="https://docs.djangoproject.com/en/dev/releases/4.2.15/">Django 4.2.15</a>.
These releases address the security issues detailed below. We encourage all
users of Django to upgrade as soon as possible.</p>
<div class="section" id="s-cve-2024-41989-memory-exhaustion-in-django-utils-numberformat-floatformat">
<h3>CVE-2024-41989: Memory exhaustion in <tt class="docutils literal">django.utils.numberformat.floatformat()</tt></h3>
<p>The <tt class="docutils literal">floatformat</tt> template filter is subject to significant memory consumption
when given a string representation of a number in scientific notation with a
large exponent.</p>
<p>Thanks to Elias Myllymäki for the report.</p>
<p>This issue has severity &quot;moderate&quot; according to the Django security policy.</p>
</div>
<div class="section" id="s-cve-2024-41990-potential-denial-of-service-in-django-utils-html-urlize">
<h3>CVE-2024-41990: Potential denial-of-service in <tt class="docutils literal">django.utils.html.urlize()</tt></h3>
<p>The <tt class="docutils literal">urlize()</tt> and <tt class="docutils literal">urlizetrunc()</tt> template filters are subject to a potential
denial-of-service attack via very large inputs with a specific sequence of
characters.</p>
<p>Thanks to <a class="reference external" href="https://hackerone.com/mprogrammer">MProgrammer</a> for the report.</p>
<p>This issue has severity &quot;moderate&quot; according to the Django security policy.</p>
</div>
<div class="section" id="s-cve-2024-41991-potential-denial-of-service-vulnerability-in-django-utils-html-urlize-and-adminurlfieldwidget">
<h3>CVE-2024-41991: Potential denial-of-service vulnerability in <tt class="docutils literal">django.utils.html.urlize()</tt> and <tt class="docutils literal">AdminURLFieldWidget</tt></h3>
<p>The <tt class="docutils literal">urlize</tt> and <tt class="docutils literal">urlizetrunc</tt> template filters, and the <tt class="docutils literal">AdminURLFieldWidget</tt>
widget, are subject to a potential denial-of-service attack via certain inputs
with a very large number of Unicode characters.</p>
<p>Thanks to Seokchan Yoon for the report.</p>
<p>This issue has severity &quot;moderate&quot; according to the Django security policy.</p>
</div>
<div class="section" id="s-cve-2024-42005-potential-sql-injection-in-queryset-values-and-values-list">
<h3>CVE-2024-42005: Potential SQL injection in <tt class="docutils literal">QuerySet.values()</tt> and <tt class="docutils literal">values_list()</tt></h3>
<p><tt class="docutils literal">QuerySet.values()</tt> and <tt class="docutils literal">values_list()</tt> methods on models with a <tt class="docutils literal">JSONField</tt> are
subject to SQL injection in column aliases via a crafted JSON object key as a
passed <tt class="docutils literal">*arg</tt>.</p>
<p>Thanks to Eyal Gabay of EyalSec for the report.</p>
<p>This issue has severity &quot;high&quot; according to the Django security policy.</p>
</div>
<div class="section" id="s-affected-supported-versions">
<h3>Affected supported versions</h3>
<ul class="simple">
<li>Django main branch</li>
<li>Django 5.1 (currently at release candidate status)</li>
<li>Django 5.0</li>
<li>Django 4.2</li>
</ul>
</div>
<div class="section" id="s-resolution">
<h3>Resolution</h3>
<p>Patches to resolve the issue have been applied to Django's
main, 5.1, 5.0, and 4.2 branches.
The patches may be obtained from the following changesets.</p>
<div class="section" id="s-id1">
<h4>CVE-2024-41989: Memory exhaustion in <tt class="docutils literal">django.utils.numberformat.floatformat()</tt></h4>
<ul class="simple">
<li>On the <a class="reference external" href="https://github.com/django/django/commit/c19465ad87e33b6122c886b97a202ad54cd43672/">main branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/0504af64292071e1a9565193ea8265c60600f7d7/">5.1 branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/27900fe56f3d3cabb4aeb6ccb82f92bab29073a8/">5.0 branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/fc76660f589ac07e45e9cd34ccb8087aeb11904b/">4.2 branch</a></li>
</ul>
</div>
<div class="section" id="s-id2">
<h4>CVE-2024-41990: Potential denial-of-service in <tt class="docutils literal">django.utils.html.urlize()</tt></h4>
<ul class="simple">
<li>On the <a class="reference external" href="https://github.com/django/django/commit/ecf1f8fb900f94de08c945164633e9a28a2edadb/">main branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/0c1a8909164d8f2846322efb1143b72ad1616bd8/">5.1 branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/7b7b909579c8311c140c89b8a9431bf537febf93/">5.0 branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/d0a82e26a74940bf0c78204933c3bdd6a283eb88/">4.2 branch</a></li>
</ul>
</div>
<div class="section" id="s-id3">
<h4>CVE-2024-41991: Potential denial-of-service vulnerability in <tt class="docutils literal">django.utils.html.urlize()</tt> and <tt class="docutils literal">AdminURLFieldWidget</tt></h4>
<ul class="simple">
<li>On the <a class="reference external" href="https://github.com/django/django/commit/5f1757142febd95994caa1c0f64c1a0c161982c3/">main branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/bd807c0c25ab69361a4c08edcc1cf04d4652aa0a/">5.1 branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/523da8771bce321023f490f70d71a9e973ddc927/">5.0 branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/efea1ef7e2190e3f77ca0651b5458297bc0f6a9f/">4.2 branch</a></li>
</ul>
</div>
<div class="section" id="s-id4">
<h4>CVE-2024-42005: Potential SQL injection in <tt class="docutils literal">QuerySet.values()</tt> and <tt class="docutils literal">values_list()</tt></h4>
<ul class="simple">
<li>On the <a class="reference external" href="https://github.com/django/django/commit/c87bfaacf8fb84984243b5055dc70f97996cb115/">main branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/e2583fbc2ebffce11b4444a7cec6336513e81f8b/">5.1 branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/32ebcbf2e1fe3e5ba79a6554a167efce81f7422d/">5.0 branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/f4af67b9b41e0f4c117a8741da3abbd1c869ab28/">4.2 branch</a></li>
</ul>
</div>
</div>
<div class="section" id="s-the-following-releases-have-been-issued">
<h3>The following releases have been issued</h3>
<ul class="simple">
<li>Django 5.0.8 (<a class="reference external" href="https://www.djangoproject.com/m/releases/5.0/Django-5.0.8.tar.gz">download Django 5.0.8</a> |
<a class="reference external" href="https://www.djangoproject.com/m/pgp/Django-5.0.8.checksum.txt">5.0.8 checksums</a>)</li>
<li>Django 4.2.15 (<a class="reference external" href="https://www.djangoproject.com/m/releases/4.2/Django-4.2.15.tar.gz">download Django 4.2.15</a> |
<a class="reference external" href="https://www.djangoproject.com/m/pgp/Django-4.2.15.checksum.txt">4.2.15 checksums</a>)</li>
</ul>
<p>The PGP key ID used for this release is Sarah Boyce: <a class="reference external" href="https://github.com/sarahboyce.gpg">3955B19851EA96EF</a></p>
</div>
<div class="section" id="s-general-notes-regarding-security-reporting">
<h3>General notes regarding security reporting</h3>
<p>As always, we ask that potential security issues be reported via private email
to <tt class="docutils literal">security&#64;djangoproject.com</tt>, and not via Django's Trac instance, nor via
the Django Forum, nor via the django-developers list. Please see <a class="reference external" href="https://www.djangoproject.com/security/">our security
policies</a> for further information.</p>
</div>


Django security releases issued: 5.0.8 and 4.2.15

<p>We are looking for the next group of organizers to own and lead the 2026 DjangoCon Europe conference. Could your town - or your football stadium, circus tent, private island or city hall - host this wonderful community event?</p>
<p>DjangoCon Europe is a major pillar of the Django community, as people from across the world meet and share. This includes many qualities that make it a unique event - unconventional and conventional venues, creative happenings, a feast of talks and a dedication to inclusion and diversity.</p>
<p>Hosting a DjangoCon is an ambitious undertaking. It&#39;s hard work, but each year it has been successfully run by a team of community volunteers, not all of whom have had previous experience - more important is enthusiasm, organizational skills, the ability to plan and manage budgets, time and people - and plenty of time to invest in the project.</p>
<p>For 2026, we want to kickstart the organization much earlier than in previous years to allow more flexibility for the organizing team, and open up more opportunities for support from our <a href="https://github.com/django/dsf-working-groups/blob/main/active/dceu.md">DjangoCon Europe support working group</a>.</p>
<h2 id="step-1-submit-your-expression-of-interest">Step 1: Submit your expression of interest</h2>
<p>If you’re considering organizing DjangoCon Europe (🙌 great!), fill in our<a href="https://docs.google.com/forms/d/e/1FAIpQLSf_uFodt6nHghd7uCpQnaCVVT2Rcc2-53c7NTG59iGSFCcxYw/viewform"> DjangoCon Europe 2026 expression of interest form</a> with your contact details. No need to fill in all the information at this stage if you don’t have it all already, we’ll reach out and help you figure it out.</p>
<p><a class="cta" href="https://docs.google.com/forms/d/e/1FAIpQLSf_uFodt6nHghd7uCpQnaCVVT2Rcc2-53c7NTG59iGSFCcxYw/viewform">Express your interest in organizing</a></p>
<h2 id="step-2-we-re-here-to-help">Step 2: We’re here to help!</h2>
<p>We&#39;ve set up a<a href="https://github.com/django/dsf-working-groups/blob/main/active/dceu.md"> DjangoCon Europe support working group</a> of previous organizers that you can reach out to with questions about organizing and running a DjangoCon Europe.</p>
<p>The group will be in touch with everyone submitting the expression of interest form, or you can reach out to them directly: european-organizers-support@djangoproject.com</p>
<p>We&#39;d love to hear from you as soon as possible, so your proposal can be finalized and sent to the DSF board <strong>by October 6th 2024</strong>. The selected hosts will be publicly announced at <a href="https://2025.djangocon.eu/">DjangoCon Europe 2025</a> by the current organizers.</p>
<h2 id="step-3-submitting-the-proposal">Step 3: Submitting the proposal</h2>
<p>The more detailed and complete your final proposal is, the better. Basic details include:</p>
<ul>
<li>Organizing committee members: You won’t have a full team yet, probably, naming just some core team members is enough.</li>
<li>The legal entity that is intended to run the conference: Even if the entity does not exist yet, please share how you are planning to set it up.</li>
<li>Dates: See “What dates are possible in 2026?” below. We must avoid conflicts with major holidays, EuroPython, DjangoCon US, and PyCon US.</li>
<li>Venue(s), including size, number of possible attendees, pictures, accessibility concerns, catering, etc.</li>
<li>Transport links and accommodation: Can your venue be reached by international travelers?</li>
<li>Budgets and ticket prices: Talk to the DjangoCon Europe Support group to get help with this, including information on past event budgets.</li>
</ul>
<p>We also like to see:</p>
<ul>
<li>Timelines</li>
<li>Pictures</li>
<li>Plans for online participation, and other ways to make the event more inclusive and reduce its environmental footprint</li>
<li>Draft agreements with providers</li>
<li>Alternatives you have considered</li>
</ul>
<p>Have a look at our proposed (draft, feedback welcome) <a href="https://docs.google.com/document/d/1hegUjHc-ifEN9W9VI-8ekOZFHXkBOKY1FOeREgeD1JE/edit?usp=sharing">DjangoCon Europe 2026 Licensing Agreement</a> for the fine print on contractual requirements and involvement of the Django Software Foundation.</p>
<p>Submit your completed proposal by October 6th 2024 via our<a href="https://docs.google.com/forms/d/e/1FAIpQLSf_uFodt6nHghd7uCpQnaCVVT2Rcc2-53c7NTG59iGSFCcxYw/viewform?usp=sf_link"> DjangoCon Europe 2026 expression of interest form</a>, this time filling in as many fields as possible. We look forward to reviewing great proposals that continue the excellence the whole community associates with DjangoCon Europe.</p>
<h2 id="q-a">Q&amp;A</h2>
<h3 id="can-i-organize-a-conference-alone">Can I organize a conference alone?</h3>
<p>We strongly recommend that a team of people submit an application.</p>
<h3 id="i-we-don-t-have-a-legal-entity-yet-is-that-a-problem-">I/we don’t have a legal entity yet, is that a problem?</h3>
<p>Depending on your jurisdiction, this is usually not a problem. But please share your plans about the entity you will use or form in your application.</p>
<h3 id="do-i-we-need-experience-with-organizing-conferences">Do I/we need experience with organizing conferences?</h3>
<p>The support group is here to help you succeed. From experience, we know that many core groups of 2-3 people have been able to run a DjangoCon with guidance from previous organizers and help from volunteers.</p>
<h3 id="what-is-required-in-order-to-announce-an-event">What is required in order to announce an event?</h3>
<p>Ultimately, a contract with the venue confirming the dates is crucial, since announcing a conference makes people book calendars, holidays, buy transportation and accommodation etc. This, however, would only be relevant after the DSF board has concluded the application process. Naturally, the application itself cannot contain any guarantees, but it’s good to check concrete dates with your venues to ensure they are actually open and currently available, before suggesting these dates in the application.</p>
<h3 id="do-we-have-to-do-everything-ourselves">Do we have to do everything ourselves?</h3>
<p>No. You will definitely be offered lots of help by the community. Typically, conference organizers will divide responsibilities into different teams, making it possible for more volunteers to join. Local organizers are free to choose which areas they want to invite the community to help out with, and a call will go out through a blog post announcement on djangoproject.com and social media.</p>
<h3 id="what-kind-of-support-can-we-expect-from-the-django-software-foundation-">What kind of support can we expect from the Django Software Foundation?</h3>
<p>The DSF regularly provides grant funding to DjangoCon organizers, to the extent of $6,000 in recent editions. We also offer support via specific working groups:</p>
<ul>
<li>The dedicated<a href="https://github.com/django/dsf-working-groups/blob/main/active/dceu.md"> DjangoCon Europe support working group</a>.</li>
<li>The<a href="https://github.com/django/dsf-working-groups/blob/main/active/social-media.md"> social media working group</a> can help you promote the event.</li>
<li>The<a href="https://github.com/django/dsf-working-groups/blob/main/active/code-of-conduct.md"> Code of Conduct working group</a> works with all event organizers.</li>
</ul>
<p>In addition, a lot of<a href="https://www.djangoproject.com/foundation/individual-members/"> Individual Members</a> of the DSF regularly volunteer at community events. If your team aren’t Individual Members, we can reach out to them on your behalf to find volunteers.</p>
<h3 id="what-dates-are-possible-in-2026">What dates are possible in 2026?</h3>
<p>For 2026, DjangoCon Europe should happen between January 5th and April 27th, or June 4th and June 28th. This is to avoid the following community events’ provisional dates:</p>
<ul>
<li>PyCon US 2026: May 2026</li>
<li>EuroPython 2026: July 2026</li>
<li>DjangoCon US 2026: September - October 2026</li>
<li>DjangoCon Africa 2026: August - September 2026</li>
</ul>
<p>We also want to avoid the following holidays:</p>
<ul>
<li>New Year&#39;s Day: Wednesday 1st January 2026</li>
<li>Chinese New Year: Tuesday 17th February 2026</li>
<li>Eid Al-Fitr: Friday 20th March 2026</li>
<li>Passover: Wednesday 1st - Thursday 9th April 2026</li>
<li>Easter: Sunday 5th April 2026</li>
<li>Eid Al-Adha: Tuesday 26th - Friday 29th May 2026</li>
<li>Rosh Hashanah: Friday 11th - Sunday 13th September 2026</li>
<li>Yom Kippur: Sunday 20th - Monday 21st September 2026</li>
</ul>
<h3 id="what-cities-or-countries-are-possible-">What cities or countries are possible?</h3>
<p>Any city in Europe. This can be a city or country where DjangoCon Europe has happened in the past (Vigo, Edinburgh, Porto, Copenhagen, Heidelberg, Florence, Budapest, Cardiff, Toulon, Warsaw, Zurich, Amsterdam, Berlin), or a new locale.</p>
<h2 id="references">References</h2>
<h3 id="past-calls">Past calls</h3>
<ul>
<li><a href="https://www.djangoproject.com/weblog/2015/may/18/interested-organizing-djangocon-europe-2016/">Interested in organizing DjangoCon Europe 2016?</a></li>
<li><a href="https://www.djangoproject.com/weblog/2016/mar/04/host-djangocon-europe-2017/">Could you host DjangoCon Europe 2017?</a></li>
<li><a href="https://www.djangoproject.com/weblog/2018/may/10/djangocon-europe-2019-where-will-it-be/">DjangoCon Europe 2019 - where will it be?</a></li>
<li><a href="https://www.djangoproject.com/weblog/2022/feb/03/could-you-host-djangocon-europe-2023/">Could you host DjangoCon Europe 2023?</a></li>
<li><a href="https://www.djangoproject.com/weblog/2022/jun/12/last-chance-for-a-djangocon-europe-2023/">Last Chance for a DjangoCon Europe 2023</a></li>
</ul>

Could you host DjangoCon Europe 2026? Call for organizers

<p>In accordance with <a class="reference external" href="https://docs.djangoproject.com/en/dev/internals/security/">our security release policy</a>, the Django team
is issuing releases for
<a class="reference external" href="https://docs.djangoproject.com/en/dev/releases/5.1.1/">Django 5.1.1</a>,
<a class="reference external" href="https://docs.djangoproject.com/en/dev/releases/5.0.9/">Django 5.0.9</a>, and
<a class="reference external" href="https://docs.djangoproject.com/en/dev/releases/4.2.16/">Django 4.2.16</a>.
These releases address the security issues detailed below. We encourage all
users of Django to upgrade as soon as possible.</p>
<div class="section" id="s-cve-2024-45230-potential-denial-of-service-vulnerability-in-django-utils-html-urlize">
<h3>CVE-2024-45230: Potential denial-of-service vulnerability in <tt class="docutils literal">django.utils.html.urlize()</tt></h3>
<p><tt class="docutils literal">urlize</tt> and <tt class="docutils literal">urlizetrunc</tt> were subject to a potential
denial-of-service attack via very large inputs with a specific sequence of
characters.</p>
<p>Thanks to <a class="reference external" href="https://hackerone.com/mprogrammer">MProgrammer</a> for the report.</p>
<p>This issue has severity &quot;moderate&quot; according to the Django security policy.</p>
</div>
<div class="section" id="s-cve-2024-45231-potential-user-email-enumeration-via-response-status-on-password-reset">
<h3>CVE-2024-45231: Potential user email enumeration via response status on password reset</h3>
<p>Due to unhandled email sending failures, the
<tt class="docutils literal">django.contrib.auth.forms.PasswordResetForm</tt> class allowed remote
attackers to enumerate user emails by issuing password reset requests and
observing the outcomes.</p>
<p>To mitigate this risk, exceptions occurring during password reset email sending
are now handled and logged using the <tt class="docutils literal">django.contrib.auth</tt> logger.</p>
<p>Thanks to Thibaut Spriet for the report.</p>
<p>This issue has severity &quot;low&quot; according to the Django security policy.</p>
</div>
<div class="section" id="s-affected-supported-versions">
<h3>Affected supported versions</h3>
<ul class="simple">
<li>Django main branch</li>
<li>Django 5.1</li>
<li>Django 5.0</li>
<li>Django 4.2</li>
</ul>
</div>
<div class="section" id="s-resolution">
<h3>Resolution</h3>
<p>Patches to resolve the issue have been applied to Django's
main, 5.1, 5.0, and 4.2 branches.
The patches may be obtained from the following changesets.</p>
<div class="section" id="s-id1">
<h4>CVE-2024-45230: Potential denial-of-service vulnerability in django.utils.html.urlize()</h4>
<ul class="simple">
<li>On the <a class="reference external" href="https://github.com/django/django/commit/320dd27412e791e119d088281913d8f649617a13">main branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/022ab0a75c76ab2ea31dfcc5f2cf5501e378d397">5.1 branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/813de2672bd7361e9a453ab62cd6e52f96b6525b">5.0 branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/d147a8ebbdf28c17cafbbe2884f0bc57e2bf82e2">4.2 branch</a></li>
</ul>
</div>
<div class="section" id="s-id2">
<h4>CVE-2024-45231: Potential user email enumeration via response status on password reset</h4>
<ul class="simple">
<li>On the <a class="reference external" href="https://github.com/django/django/commit/8c35a0a903fd979e3262fe300ca084ffbfb300d6">main branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/3c733c78d6f8e50296d6e248968b6516c92a53ca">5.1 branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/96d84047715ea1715b4bd1594e46122b8a77b9e2">5.0 branch</a></li>
<li>On the <a class="reference external" href="https://github.com/django/django/commit/bf4888d317ba4506d091eeac6e8b4f1fcc731199">4.2 branch</a></li>
</ul>
</div>
</div>
<div class="section" id="s-the-following-releases-have-been-issued">
<h3>The following releases have been issued</h3>
<ul class="simple">
<li>Django 5.1.1 (<a class="reference external" href="https://www.djangoproject.com/m/releases/5.1/Django-5.1.1.tar.gz">download Django 5.1.1</a> |
<a class="reference external" href="https://www.djangoproject.com/m/pgp/Django-5.1.1.checksum.txt">5.1.1 checksums</a>)</li>
<li>Django 5.0.9 (<a class="reference external" href="https://www.djangoproject.com/m/releases/5.0/Django-5.0.9.tar.gz">download Django 5.0.9</a> |
<a class="reference external" href="https://www.djangoproject.com/m/pgp/Django-5.0.9.checksum.txt">5.0.9 checksums</a>)</li>
<li>Django 4.2.16 (<a class="reference external" href="https://www.djangoproject.com/m/releases/4.2/Django-4.2.16.tar.gz">download Django 4.2.16</a> |
<a class="reference external" href="https://www.djangoproject.com/m/pgp/Django-4.2.16.checksum.txt">4.2.16 checksums</a>)</li>
</ul>
<p>The PGP key ID used for this release is Natalia Bidart: <a class="reference external" href="https://github.com/nessita.gpg">2EE82A8D9470983E</a></p>
</div>
<div class="section" id="s-general-notes-regarding-security-reporting">
<h3>General notes regarding security reporting</h3>
<p>As always, we ask that potential security issues be reported via private email
to <tt class="docutils literal">security&#64;djangoproject.com</tt>, and not via Django's Trac instance, nor via
the Django Forum, nor via the django-developers list. Please see <a class="reference external" href="https://www.djangoproject.com/security/">our security
policies</a> for further information.</p>
</div>


Django security releases issued: 5.1.1, 5.0.9, and 4.2.16

<p>Django 5.1 release candidate 1 is the final opportunity for you to
try out <a class="reference external" href="https://docs.djangoproject.com/en/5.1/releases/5.1/">a kaleidoscope of improvements</a> before Django 5.1 is released.</p>
<p>The release candidate stage marks the string freeze and the call for
translators <a class="reference external" href="https://docs.djangoproject.com/en/dev/internals/contributing/localizing/#translations">to submit translations</a>.
Provided no major bugs are discovered that can't be solved in the next two
weeks, Django 5.1 will be released on or around August 7.
Any  delays will be communicated on the <a class="reference external" href="https://forum.djangoproject.com/t/django-5-1-release-status-and-next-steps/29261/4">on the Django forum</a>.</p>
<p>Please use this opportunity to help find and fix bugs (which should be reported
to <a class="reference external" href="https://code.djangoproject.com/newticket">the issue tracker</a>), you can
grab a copy of the release candidate package from <a class="reference external" href="https://www.djangoproject.com/download/">our downloads page</a> or on PyPI.</p>
<p>The PGP key ID used for this release is Natalia Bidart: <a class="reference external" href="https://github.com/nessita.gpg">2EE82A8D9470983E</a></p>


Django 5.1 release candidate 1 released

<p>The Django Software Foundation's biggest fundraising event of the year is here!</p>
<p><a class="cta" href="https://www.jetbrains.com/pycharm/promo/support-django/?utm_campaign=pycharm&utm_content=django-fundraiser-24&utm_medium=referral&utm_source=djangoproject.com">Get 30% off PyCharm, Support Django</a></p>
<p>Each year, our friends at JetBrains, the creators of PyCharm, run an incredible deal. You get a 30% discounted year of PyCharm, AND the DSF gets 100% of the money. Yes, 100%! It's making a donation and directly getting a great product in return! This is available for new users, and those who had used PyCharm in the past, stopped, and want to try again.</p>
<h2>The fundraiser</h2>
<p>The fundraiser started <a href="/2024/jun/06/pycharm-django-campaign-2024/">during DjangoCon Europe in June</a>, and is now back on from September 22nd to October 6th. Buy PyCharm and support Django!</p>
<p>In the past, JetBrains through the PyCharm fundraiser has provided approximately one quarter of the Django Software Foundation's budget!&nbsp;</p>
<p>Donations like this fundraiser allow the DSF to function. Our two wonderful Fellows, Natalia Bidart and Sarah Boyce keep Django running smoothly, picking up pieces that would otherwise not happen.</p>
<p>The other side of the DSF is our support for Django groups across the globe. We supported every DjangoCon, particularly with donating funding towards opportunity grants for more people to be able to attend these conferences. The DSF also supports smaller events around the world, including DjangoGirls events.</p>
<h2>PyCharm</h2>
<p>Finally, I want to tell you about PyCharm itself.</p>
<p>PyCharm is an integrated development environment (IDE) that helps professional Python web developers be more productive, be more confident, and write better code. It supports the full Python web workflow out of the box, including popular Python web frameworks, such as Django, frontend technologies, and databases.</p>
<p>Here are the main benefits of using PyCharm in your Django development:</p>
<ul>
<li>Django (including templates), Flask, FastAPI</li>
<li>Database management (Postgres, Redis)</li>
<li>JS, React, Node.js, TailwindCSS</li>
<li>Built-in HTTP Client and endpoint tools</li>
</ul>
<p>Get Django work done with PyCharm, a powerful IDE tailored for Django web development!</p>
<p>Consider this the easiest charitable donation you will ever make, when you get such a great product in return!</p>
<p><a class="cta" href="https://www.jetbrains.com/pycharm/promo/support-django/?utm_campaign=pycharm&utm_content=django-fundraiser-24&utm_medium=referral&utm_source=djangoproject.com">Get 30% off PyCharm, Support Django</a></p>
<h2>Other ways to donate</h2>
<p>If you would like to donate in another way, especially if you are already a PyCharm customer, here are other ways to donate to the DSF:</p>
<ul>
<li><a href="/fundraising/">On our website via credit card</a></li>
<li><a href="https://github.com/sponsors/django">Via GitHub Sponsors</a></li>
<li>For those able to make a larger donation, particularly corporate sponsors ($2000+), more information is here: <a href="https://www.djangoproject.com/foundation/corporate-membership/">Corporate membership</a></li>
</ul>

PyCharm &amp; Django Campaign 2024 - encore

<p><strong>DjangoCon US starts next week in Durham, NC on September 22nd!</strong></p>
<p>If you aren't able to join in person, please consider purchasing an online ticket: <a class="reference external" href="https://ti.to/defna/djangocon-us-2024">https://ti.to/defna/djangocon-us-2024</a></p>
<p>The conference is full of a variety of talks with excellent keynote speakers! It's shaping up to be an event you'll want to experience live.</p>
<p>If you'd like to learn more about DjangoCon US visit them at their <a class="reference external" href="https://2024.djangocon.us">website</a> or reach out to them at <a class="reference external" href="mailto:hello&#64;djangocon.us">hello&#64;djangocon.us</a>.</p>


Last call for DjangoCon US 2024 tickets!

<p>We are thrilled to announce that Djangonaut Space, a mentorship program, is <a class="reference external" href="https://forms.gle/nCiUXQjnDQo1K7D67">open for applicants for our next cohort</a>!</p>
<p>Djangonaut Space is holding a third session this year! This session will start on October 14th, 2024. We are accepting applications until September 14th, 2024. More details can be found in <a class="reference external" href="https://djangonaut.space/sessions/2024-session-3/">the website</a>.</p>
<p>Djangonaut Space is a free, 8-week group mentoring program where individuals will work self-paced in a semi-structured learning environment. It seeks to help members of the community who wish to level up their current Django code contributions and potentially take on leadership roles in Django in the future.</p>
<blockquote>
“I signed up for this program with the goal of starting my journey as a contributor, but I ended up gaining so much more. In this community, I found incredible people who not only guide you toward solutions but also encourage and celebrate every achievement along the way.” - Raffaella, Djangonaut</blockquote>
<p>If you have questions, they are holding an AMA session on Zoom next week. See their social media account for more details:</p>
<ul class="simple">
<li><a class="reference external" href="https://twitter.com/DjangonautSpace">Twitter/X</a></li>
<li><a class="reference external" href="https://indieweb.social/&#64;djangonaut">Mastodon</a></li>
</ul>
