--- title: Django 6.1 lands with four CVEs patched, Python 3.15 RC1... description: Django 6.1 is out with field fetch modes, database-level deletes, and dictionary email settings — and the same day brought security releases 6.0.8 and 5.2.17... canonical: https://daily.dev/posts/django-6-1-lands-with-four-cves-patched-python-3-15-rc1-ships-with-lazy-imports-j5dvbrgvv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Django 6.1 lands with four CVEs patched, Python 3.15 RC1 ships with lazy imports | daily.dev og:description: Django 6.1 is out with field fetch modes, database-level deletes, and dictionary email settings — and the same day brought security releases 6.0.8 and 5.2.17... og:url: https://daily.dev/posts/django-6-1-lands-with-four-cves-patched-python-3-15-rc1-ships-with-lazy-imports-j5dvbrgvv og:image: https://api.daily.dev/og/posts/J5dVbrgVV.png og:image:alt: Django 6.1 lands with four CVEs patched, Python 3.15 RC1 ships with lazy imports og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Django 6.1 lands with four CVEs patched, Python 3.15 RC1 ships with lazy imports **[Python Digest](https://daily.dev/sources/python_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary Django 6.1 is out with field fetch modes, database-level deletes, and dictionary email settings — and the same day brought security releases 6.0.8 and 5.2.17 patching four CVEs including a high-severity spatial lookup flaw that could enable remote code execution. Python 3.15 RC1 is available for testing, bringing lazy imports, frozen dicts, a new sampling profiler, and an 8-13% JIT improvement depending on architecture. Astral's tooling suite crossed 785 million monthly installs with uv alone hitting 500 million in July. Supply chain risk remains real: a wave of attacks targeting AI-adjacent Python packages rose 73% in 2026, with LiteLLM and PyTorch Lightning both compromised earlier this year. ## Content **TLDR:** Django 6.1 is out with field fetch modes, database-level deletes, and dictionary email settings — and the same day brought security releases 6.0.8 and 5.2.17 patching four CVEs including a high-severity spatial lookup flaw that could enable remote code execution. Python 3.15 RC1 is available for testing, bringing lazy imports, frozen dicts, a new sampling profiler, and an 8-13% JIT improvement depending on architecture. Astral's tooling suite crossed 785 million monthly installs with uv alone hitting 500 million in July. Supply chain risk remains real: a wave of attacks targeting AI-adjacent Python packages rose 73% in 2026, with LiteLLM and PyTorch Lightning both compromised earlier this year. --- ## Django 6.1 released alongside four-CVE security patch Django 6.1 adds field-level fetch modes for controlling lazy loading, ForeignKey.on_delete now supports database-level cascade behavior, and email settings move to a cleaner dict-based structure. The same day, 6.0.8 and 5.2.17 patched CVE-2026-15307 (high severity — spatial lookups accepting unsafe str/dict values, potential RCE), CVE-2026-15920 (stored XSS via URLField in admin), and two DoS issues. If you haven't applied the security releases yet, do that first. Django 6.0 moves to security-only support through April 2027. The DSF is also hiring its first Executive Director at $90k-$120k base plus up to $60k performance bonus, with applications open until September 14. [Read more](https://daily.dev/feed-by-ids?id=KNygpdkyw&id=KC7V4FqDS&id=IQal93rkG) ## Python 3.15 RC1 available, final release October 1 Python 3.15 RC1 is out with no further ABI changes before the final release. The headline features are PEP 810 lazy imports for faster startup, a new frozendict built-in, a dedicated profiling package with the Tachyon statistical sampler, and a JIT showing 8-9% gains on x86-64 Linux and 12-13% on AArch64 macOS. Free-threaded builds get a stable ABI. Third-party maintainers should be publishing 3.15 wheels now — RC2 is September 1, final is October 1. Maintenance releases 3.14.7 and 3.13.15 also shipped this week. [Read more](https://daily.dev/feed-by-ids?id=fUsKZUfEb&id=iCAWFYWDn&id=w1Smn0fJj&id=TQyckgMqm) ## Python package supply chain attacks up 73% in 2026, AI packages the primary target Malicious open-source packages rose 73% in 2026 according to ReversingLabs, with AI-adjacent libraries the highest-value targets. LiteLLM (95M monthly downloads) was compromised in March via versions 1.82.7 and 1.82.8, embedding a .pth file that silently harvested AWS, GCP, Azure tokens, SSH keys, and cloud credentials — the poisoned packages were live for roughly three hours. PyTorch Lightning 2.6.2 and 2.6.3 were similarly hit in late April. The slopsquatting vector (attackers registering hallucinated package names from AI coding assistants) is also active. Three concrete controls: pin to exact versions with checksum verification, audit post-install hooks and .pth files with Socket or Sonatype, and rotate cloud credentials immediately after any suspected exposure window. [Read more](https://daily.dev/posts/cAQCR90iF) ## LLM 0.32 ships reasoning traces, server-side tools, and a redesigned logging system Simon Willison's LLM CLI and Python library hit 0.32 with visible reasoning traces sent to stderr, server-side tool support for OpenAI CodeInterpreter and WebSearch plus Anthropic's WebSearch, WebFetch, CodeExecution, and AnthropicMCP, and a content-addressable SQLite logging system modeled on Git. The Python API gains a messages=[] parameter for passing full conversation history directly, and a new llm-chat-completions-server plugin exposes LLM as an OpenAI-compatible server. The release also positions LLM as a lightweight agent framework — tool chains can pause for human approval and resume from stored history. [Read more](https://daily.dev/feed-by-ids?id=9YcxWoqVp&id=hDtyAyZku) --- ## Also notable - **uv 0.12.2 adds vulnerability audit command, Ruff 0.16 expands from 59 to 413 default rules:** uv 0.12.2 ships a built-in vulnerability audit command, and Ruff 0.16 dramatically widens its default rule set from 59 to 413 rules, now catching blind excepts, mutable default arguments, and forgotten breakpoints — worth reviewing your existing codebase before upgrading. [Read more](https://daily.dev/feed-by-ids?id=iCAWFYWDn&id=0MEuY9IfL) - **tprof 1.3.0 cuts profiler overhead ~3x, non-target functions now run at full speed:** tprof 1.3.0 replaces Python data structures with per-thread C structures, disables sys.monitoring callbacks for non-target code entirely, and uses PyTime_PerfCounterRaw() on Python 3.13+, reducing target function overhead roughly 3x, dropping memory use 4x, and making report generation ~100x faster. [Read more](https://daily.dev/posts/Z5Sx5ALaI) - **django-msgspec drops in as a faster JSON backend for Django and DRF:** django-msgspec wraps msgspec (a C-based JSON library) as drop-in replacements for JsonResponse, DRF renderer/parser, session serializer, and dumpdata/loaddata — most activatable via settings alone — with the author choosing msgspec over orjson due to orjson's 64-bit integer limits, lack of free-threading wheels, and closed issue tracker. [Read more](https://daily.dev/posts/CIBe2whmZ) - **Flask-Admin FileAdmin has a high-severity directory traversal via startswith() path check:** Flask-Admin's FileAdmin uses Python's startswith() to validate filesystem paths, which fails when sibling directories share a common prefix (e.g., /data/uploads and /data/uploads_secret), allowing all FileAdmin operations to escape the configured root — check your deployments if you use FileAdmin. [Read more](https://daily.dev/posts/W8WoKsYPC) - **Coverage 7.13 natively ships subprocess coverage tracking, making coverage-enable-subprocess obsolete:** Coverage 7.13 includes a built-in .pth file for subprocess coverage, so the third-party coverage-enable-subprocess library is no longer needed — though subprocesses starting outside the working directory still require explicit source and data_file settings in .coveragerc. [Read more](https://daily.dev/posts/ZdOZ23Un7) ## Similar posts on daily.dev - [Issue 340: Django security releases 6.0.6 and 5.2.15](https://daily.dev/posts/issue-340-django-security-releases-6-0-6-and-5-2-15-0r7w6h8w1) · Django News · 0 upvotes · 0 comments - [Django Security Fixes, Python Releases, and New Tools](https://daily.dev/posts/django-security-fixes-python-releases-and-new-tools-xiycsmntw) · Django News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#django](https://daily.dev/tags/django) [View this post on daily.dev](https://daily.dev/posts/django-6-1-lands-with-four-cves-patched-python-3-15-rc1-ships-with-lazy-imports-j5dvbrgvv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/django-6-1-lands-with-four-cves-patched-python-3-15-rc1-ships-with-lazy-imports-j5dvbrgvv","headline":"Django 6.1 lands with four CVEs patched, Python 3.15 RC1 ships with lazy imports","text":"Django 6.1 is out with field fetch modes, database-level deletes, and dictionary email settings — and the same day brought security releases 6.0.8 and 5.2.17 patching four CVEs including a high-severity spatial lookup flaw that could enable remote code execution. Python 3.15 RC1 is available for testing, bringing lazy imports, frozen dicts, a new sampling profiler, and an 8-13% JIT improvement depending on architecture. Astral's tooling suite crossed 785 million monthly installs with uv alone hitting 500 million in July. Supply chain risk remains real: a wave of attacks targeting AI-adjacent Python packages rose 73% in 2026, with LiteLLM and PyTorch Lightning both compromised earlier this year.","url":"https://daily.dev/posts/django-6-1-lands-with-four-cves-patched-python-3-15-rc1-ships-with-lazy-imports-j5dvbrgvv","datePublished":"2026-08-10T04:19:25.551Z","dateModified":"2026-09-13T21:08:08.824Z","author":{"@type":"Organization","name":"Python Digest","logo":"https://media.daily.dev/image/upload/s--_8Rk7XLS--/f_auto,q_auto/v1776326905/logos/python_digest","url":"https://daily.dev/sources/python_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/python_digest","name":"Python Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Python Digest","item":"https://daily.dev/sources/python_digest"},{"@type":"ListItem","position":3,"name":"Django 6.1 lands with four CVEs patched, Python 3.15 RC1 ships with lazy imports"}]} ```