summaryrefslogtreecommitdiff
path: root/docs/internals
AgeCommit message (Collapse)Author
2026-04-28Fixed #35738 -- Deprecated double-dot variable lookups.David Smith
2026-04-22Fixed #35870 -- Made blank choice label in forms more accessible.Annabelle Wiegart
Added new constant django.db.models.fields.BLANK_CHOICE_LABEL for an accessible and translatable blank choice label in forms. Deprecated django.db.models.fields.BLANK_CHOICE_DASH constant. Added the immediately deprecated transitional setting USE_BLANK_CHOICE_DASH. Co-Authored-By: Marijke Luttekes <mail@marijkeluttekes.dev>
2026-04-19Fixed #35007 -- Replaced ESLint with Biome for JavaScript linting and ↵Tom Carrick
formatting.
2026-04-19Updated release procedure with new CVE workflows.Jacob Walls
Now that the DSF is a CVE Numbering Authority (CNA), we manage our own CVE assignments.
2026-04-18Fixed #37028 -- Added BitAnd(), BitOr(), and BitXor() aggregates.Mariusz Felisiak
2026-04-17Clarified that reporters shouldn't set their own tickets as "Accepted".Jonathan Biemond
2026-04-10Fixed #37020 -- Removed guidance to edit fetched .po files by hand.Jacob Walls
Altering the .po files by hand was causing incorrect line numbers and plural forms. Since our fetching procedure does not recompile any hand-edited .po files to .mo files for production use, just accept Transifex's plural forms as a source of truth. https://forum.djangoproject.com/t/discourage-releasers-from-editing-po-files-by-hand/44441
2026-04-10Refs #37020 -- Corrected example command to update translation catalogs.Jacob Walls
Passing the --domain flag again just overwrites the prior value.
2026-04-02Added section for respecting maintainer time to the security policy.Natalia
This follows a post from Seth Larson (Security Developer-in-Residence at the PSF): https://sethmlarson.dev/respecting-maintainer-time-should-be-in-security-policies
2026-04-02Fixed #36862 -- Doc'd the need for a proxy when deploying ↵Jacob Walls
RemoteUserMiddleware under ASGI. We have a flood of nuisance security reports describing ASGI deployments using RemoteUserMiddleware without a fronting proxy, which is not realistic.
2026-03-31Fixed #36799 -- Added a how-to guide for testing pre-releases.VIZZARD-X
Thanks Sarah Boyce for the idea and Tim McCurrach for the review. Co-authored-by: Timothy McCurrach <tim.mccurrach@gmail.com> Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2026-03-20Made it clear that unreviewed tickets shouldn't be claimed or started.Jake Howard
2026-03-19Refs #36795 -- Deprecated SQLCompiler.quote_name_unless_alias().Simon Charette
It has been superseded with .quote_name(), which ensures aliases are always quoted.
2026-03-16Combined scripts confirm_release.sh and test_new_version.sh into ↵Natalia
verify_release.sh. This reuses the same download for both artifacts and checks both GPG signature and minimal correctness in the same script. Docs and script do_django_release.py were updated.
2026-03-15Fixed typo in docs/internals/contributing/accessibility.txt.dcsid
2026-03-12Fixed #36727 -- Deprecated Field.get_placeholder in favor of ↵Simon Charette
get_placeholder_sql. The lack of ability of the get_placeholder call chain to return SQL and parameters separated so they can be mogrified by the backend at execution time forced implementations to dangerously interpolate potentially user controlled values. The get_placeholder_sql name was chosen due to its proximity to the previous method, but other options such as Field.as_sql were considered but ultimately rejected due to its different input signature compared to Expression.as_sql that might have lead to confusion. There is a lot of overlap between what Field.get_db_prep_value and get_placeholder_sql do but folding the latter in the former would require changing its return signature to return expression which is a way more invasive change than what is proposed here. Given we always call get_db_prep_value it might still be an avenue worth exploring in the future to offer a publicly documented interface to allow field to take an active part in the compilation chain. Thanks Jacob for the review.
2026-03-12Discouraged automated AI reviews of pull requests.Natalia
Some contributors have been requesting Copilot reviews on pull requests submitted to the Django repository. These automated reviews add noise to the PR history, making it harder to follow the discussion, and Django does not incorporate them into its review process. This change discourages the practice by: - Adding a `copilot-instructions.md` file instructing Copilot to decline review requests in this repository. - Adding a checklist item to the PR template asking contributors not to request automated AI reviews for their PR. - Documenting the policy in the contributing guidelines.
2026-03-06Extended committing code docs to add detailed instructions for backports.Natalia
Thanks to Jacob Walls for the original idea and the review.
2026-03-06Extended checks and docs for proper commit message format and edition.Jacob Walls
Thanks to Tim Schilling for the review. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2026-02-26Adjusted default DoS severity level in Security Policy.Natalia
2026-02-10Clarified optional nature of Contributor License Agreement.Jacob Walls
It's not clear that CLAs are needed to ensure contributors are assenting to our license (the "inbound=outbound" agreement), but we can keep them around for contributors who would like to (or are required by their employer) to submit one, without investing additional resources in checking every single contribution. See https://forum.djangoproject.com/t/cla-vs-dco-for-django-contributors/42399 and recent board minutes.
2026-01-30Added documentation on reviewing patches.Tim Schilling
Original inspiration drawn from Sarah Boyce's talk: "Django needs you! (to do code review)"
2026-01-29Made explicit that aspell is a requirement to run spell checks on docs.Natalia
2026-01-29Fixed docs spelling errors accumulated over time.Natalia
The `docs` GitHub action does not install `aspell` so the seplling checks are always passing in CI. After installing it, the following errors are reported: WARNING: internals/security.txt:50: : Spell check: runnable: Include a runnable proof of concept. WARNING: ref/contrib/postgres/search.txt:292: : Spell check: lexeme: an untrusted source. The content of each lexeme is escaped so that any. WARNING: ref/contrib/postgres/search.txt:295: : Spell check: lexemes: You can combine lexemes with other lexemes using the . WARNING: ref/contrib/postgres/search.txt:295: : Spell check: lexemes: You can combine lexemes with other lexemes using the . WARNING: ref/contrib/postgres/search.txt:314: : Spell check: Lexeme: Lexeme objects also support term weighting and prefixes:. WARNING: ref/models/database-functions.txt:1897: : Spell check: ai: 23ai/26ai (23.9) or later.. WARNING: ref/models/database-functions.txt:1897: : Spell check: ai: 23ai/26ai (23.9) or later.. WARNING: ref/models/expressions.txt:439: : Spell check: positionally: can be supplied positionally or only by keyword. For. WARNING: ref/models/fields.txt:1339: : Spell check: ai: PostgreSQL < 18 only supports persisted columns. Oracle < 23ai/26ai (23.7). WARNING: ref/models/fields.txt:1339: : Spell check: ai: PostgreSQL < 18 only supports persisted columns. Oracle < 23ai/26ai (23.7). WARNING: ref/models/fields.txt:1344: : Spell check: ai: s was added on Oracle 23ai/26ai. WARNING: ref/models/fields.txt:1344: : Spell check: ai: s was added on Oracle 23ai/26ai. WARNING: releases/4.2.21.txt:24: : Spell check: unclosed: exception if it encounters an unusually large number of unclosed opening tags.. WARNING: releases/5.1.9.txt:24: : Spell check: unclosed: exception if it encounters an unusually large number of unclosed opening tags.. WARNING: releases/5.2.1.txt:24: : Spell check: unclosed: exception if it encounters an unusually large number of unclosed opening tags.. WARNING: releases/6.1.txt:244: : Spell check: mistyped: suggestions for mistyped subcommand names and argument choices.. WARNING: releases/6.1.txt:281: : Spell check: ai: Oracle 23ai/26ai (23.7+).. WARNING: releases/6.1.txt:281: : Spell check: ai: Oracle 23ai/26ai (23.7+).. WARNING: releases/6.1.txt:343: : Spell check: durations: durations expressed in weeks (. WARNING: Found 19 misspelled words build finished with problems, 20 warnings (with warnings treated as errors). This branch adds some of the words to the allowlist, but for others I chose to rephrase the text in a more approachable manner.
2026-01-28Doc'd the minimum version of bash for releasing Django.Jacob Walls
2026-01-19Fixed unbalanced parentheses in docs.Clifford Gama
2026-01-15Fixed #36856 -- Mentioned needsnewfeatureprocess resolution in contributor docs.Amar Ahmed Deina
Co-authored-by: James Bligh <blighj@users.noreply.github.com>
2026-01-14Bumped linter versions in requirements files and tox.ini.Jacob Walls
Follow-up to 64ac4385c75b12a4065055b3d8d60bd5e0e61f04.
2026-01-09Refs #35381 -- Added missing deprecation note for using None as RHS of ↵Clifford Gama
JSONExact.
2026-01-08Added guidance on AI-assisted code submission to contributing docs.Natalia
2025-12-22Fixed #36305 -- Added documentation indentation guidelines to contributing docs.ankan0503
2025-12-11Fixed #36789 -- Added missing PDF file for ↵Pravin Kamble
docs/internals/_images/contribution_process.svg. The PDF is needed to build the PDF version of the whole docs.
2025-12-08Fixed #36778 -- Extended advice to sanitize input before using in query ↵Jacob Walls
expressions. Thanks Clifford Gama and Simon Charette for reviews.
2025-12-07Refs #36620 -- Added contributor documentation for code coverage reports.saurabh
This was included in the original reverted patch: a89183e63844a937aacd3ddb73c4952ef869d2cc Follow-up to 26b0e2bb92caf2d16cabe455792350f20d6f42ca.
2025-11-26Included usage of new scripts in docs/internals/howto-release-django.txt.Natalia
2025-11-25Reverted "Fixed #36620 -- Added coverage workflow to summarize coverage in ↵Natalia
pull requests." This reverts commit a89183e63844a937aacd3ddb73c4952ef869d2cc.
2025-11-22Removed outdated build guidance in release docs.Jacob Walls
Follow-up to 4686541691dbe986f58ac87630c3b7a04db4ff93.
2025-11-21Fixed #36620 -- Added coverage workflow to summarize coverage in pull requests.saurabh
Part of GSoC 2025. Thanks Lily for mentorship, and Sarah Boyce and Jacob Walls for reviews.
2025-11-21Added GitHub Actions linter (zizmor).Jacob Walls
At the direction of the Security Team. Thanks Markus Holtermann, Jake Howard, and Natalia Bidart for reviews.
2025-11-04Updated ticket triage process diagram and contributing docs.ontowhee
2025-10-19Refs #36005 -- Bumped minimum supported versions of docutils to 0.22.Mariusz Felisiak
2025-10-16Bumped minimum isort version to 7.0.0.Jacob Walls
Added ignores relating to https://github.com/PyCQA/isort/issues/2352.
2025-10-14Removed pre-release wheel-only advice in ↵Jacob Walls
docs/internals/howto-release-django.txt. The practice since 2.2a1 (2019) has been to upload source distributions as well.
2025-10-14Removed mention of setuptools in ↵Jacob Walls
docs/internals/contributing/writing-code/unit-tests.txt.
2025-10-13Cautioned against multi-level relative imports in coding style docs.lyova24
2025-10-13Added notes about automatic roadmap generation for next version in ↵Natalia
docs/internals/howto-release-django.txt.
2025-09-30Fixed #36614 -- Deprecated QuerySet.values_list(flat=True) without a field.Adam Johnson
Thanks to Jacob Walls and Simon Charette for their input. co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2025-09-18Clarified feature freeze and alpha release steps in ↵Natalia
docs/internals/howto-release-django.txt.
2025-09-17Added backticks to email addresses in docs.Mariusz Felisiak
2025-09-17Advanced deprecation warnings for Django 6.1.Jacob Walls
generated by cgit v1.3 (git 2.53.0) at 2026-06-30 23:15:36 +0000