Django: security advisories, deprecations and releases

Django security reporting update

Django no longer accepts new security reports via HackerOne; use security@djangoproject.com or the documented process instead.

Django security releases 6.1.2, 6.0.9, 5.2.18

Four moderate and low CVEs fixed in latest Django patch releases; upgrade immediately.

CVE-2026-77050 CVE-2026-84429 CVE-2026-87890 CVE-2026-87975

Django 6.0 reaches end of life on 2027-04-30

Django 6.0 reaches end of life on 2027-04-30, as listed by endoflife.date.

CompositeField PR for Django 6.2

New CompositeField feature enables multi-column subqueries and needs testing and review.

DEFAULT_PK_FIELD setting PR

New setting allows using UUID or other custom primary keys by default in Django 6.2.

Move models between apps PR

Feature to relocate models to different apps is ready for testing in Django 6.2.

Django 6.2 contributor outreach

Steering Council seeks contributors to test and review major features and smaller changes for the upcoming Django 6.2 release.

Proposed change to DSF voting membership

Django Software Foundation proposes a new active voting membership tier. Members who voted in the last two years count toward quorum; others remain members but must opt in to vote.

New Technical Governance Approved

Django's new technical governance model (DEP 19) has been approved by both the Steering Council and DSF Board, simplifying the structure to encourage broader participation.