Python: security advisories, deprecations and releases

In a pickle: Why every pickle defense in machine learning is bypassed the same way

Six documented bypasses beat PyTorch weights_only, Keras safe_mode, and picklescan. See which ML formats are safe and what runtime detection catches.

Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 are out

Five expedited security releases to distrust the compromised eMudhra intermediate CA keys.

Python 3.15.1, 3.14.9 and 3.13.17 are out

Three certified security releases for Python 3.15, 3.14 and 3.13.

GitHub expands malware advisories to eight ecosystems via OpenSSF

GitHub integrated OpenSSF malicious-packages data into its Advisory Database, extending malware detection from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.

Django security reporting update

Django no longer accepts new security reports via HackerOne; use security@djangoproject.com or the documented process instead.

Django security releases 6.1.2, 6.0.9, 5.2.18

Four moderate and low CVEs fixed in latest Django patch releases; upgrade immediately.

CVE-2026-77050 CVE-2026-84429 CVE-2026-87890 CVE-2026-87975

Django 6.0 reaches end of life on 2027-04-30

Django 6.0 reaches end of life on 2027-04-30, as listed by endoflife.date.

Python 3.10 has reached end of life

Python 3.10 reached end of life on 2026-10-01, as listed by endoflife.date.

NumPy 2.2 reaches end of life on 2026-12-09

NumPy 2.2 reaches end of life on 2026-12-09, as listed by endoflife.date.

AWS Neuron 2.33 adds TorchNeuron and Neuron Observer

Neuron 2.33 brings native PyTorch support via TorchNeuron for Trainium, plus sub-second health monitoring with Neuron Observer.

AWS TorchNeuron public beta: native PyTorch on Trainium

AWS released TorchNeuron, an open-source PyTorch backend that lets you run PyTorch code on Trainium chips with .to('neuron') and torch.compile.

CompositeField PR for Django 6.2

New CompositeField feature enables multi-column subqueries and needs testing and review.

DEFAULT_PK_FIELD setting PR

New setting allows using UUID or other custom primary keys by default in Django 6.2.

Move models between apps PR

Feature to relocate models to different apps is ready for testing in Django 6.2.

Python 3.16.0 alpha 1 is now available

First developer preview of Python 3.16 released for testing.

Envoy v1.38.7 released with security and bug fixes

Envoy 1.38.7 updates wasmtime to fix CVE-2026-54786, resolves multiple race conditions in route configuration handling, and corrects Prometheus histogram bucket indexing.

CVE-2026-54786

Python 3.15 released

Python 3.15 was released on 2026-10-09.

Python 3.15.0 (final) is here!

Python 3.15.0 final release is now available for production use.

Python 3.15.0 candidate 3 is here!

Python 3.15.0 release candidate 3 has been published.

Python 3.10.22, 3.11.17, 3.12.15, 3.13.16 and 3.14.8 are now available!

Security updates across Python 3.10–3.14, the final maintenance release of 3.13, and a farewell to Python 3.10.

Agent Platform Workbench JupyterLab client-side logging to Cloud Logging

JupyterLab now forwards client-side errors, exceptions, promise rejections, and failed requests to Cloud Logging for debugging.

JupyterLab client logs now sent to Cloud Logging

Console errors, uncaught exceptions, unhandled promise rejections, and failed network requests are forwarded to the backend for easier debugging.

Django 6.2 contributor outreach

Steering Council seeks contributors to test and review major features and smaller changes for the upcoming Django 6.2 release.

Proposed change to DSF voting membership

Django Software Foundation proposes a new active voting membership tier. Members who voted in the last two years count toward quorum; others remain members but must opt in to vote.

New Technical Governance Approved

Django's new technical governance model (DEP 19) has been approved by both the Steering Council and DSF Board, simplifying the structure to encourage broader participation.

PEP 827: Type Manipulation (Python Language Summit 2026)

Michael J. Sullivan presents PEP 827, focusing on how Python should store type annotations as a core design decision.

macOS and Python (Python Language Summit 2026)

Ned Deily examines whether Python should continue shipping macOS installers at the 2026 Language Summit.

Lightning Talks (Python Language Summit 2026)

Lightning talks covered a one-time ABI break, safer interruptions, EktuPy, an AGENTS.md file for CPython, and a call to read PEP 836.

Garbage Collection: Generational? Incremental? Both! (Python Language Summit 2026)

Mark Shannon proposes a future garbage collection strategy for Python after the incremental GC was reverted in 3.14.

Python Language Summit 2026

15 talks on free-threading, Rust integration, garbage collection and type annotations held in Kraków.

Memory Buffer Protocol (Python Language Summit 2026)

Nathan Goldbaum proposes safe concurrent access through buffer leases and custom data types for the Python Buffer Protocol.

Free-Threaded Python Post-Era (Python Language Summit 2026)

Tobias Wrigstad, Fridtjof Stoldt, and Donghee Na propose a safe and performant high-level concurrency model for free-threaded Python.