Python Weekly — July 13, 2026: Django Patches, EuroPython Opens in Kraków, and the JIT's Ticking Clock

A busy week for the Python world, anchored by a fresh round of Django security patches and the start of EuroPython 2026 in Kraków. Here's what mattered over roughly the past seven days.

Django ships security releases 6.0.7 and 5.2.16

On July 7 the Django team issued security releases 6.0.7 and 5.2.16, fixing three issues and urging all users to upgrade promptly. The patches cover a cache-middleware bug where a response setting a session cookie could be cached when the request already carried an unrelated cookie, a GDALRaster buffer over-read that could disclose adjacent heap memory or crash, and a DomainNameValidator that accepted newlines and opened the door to header injection. If you run Django in production, this is the update to apply first. source

EuroPython 2026 opens in Kraków for its 25th anniversary

Europe's largest Python gathering runs July 13–19 at the ICE Kraków Congress Centre, celebrating 25 years of EuroPython and expecting 1,500+ attendees. The schedule follows the familiar shape — tutorials to start, three days of main-conference talks, and sprints to close — with keynotes from Guido van Rossum, Pablo Galindo Salgado, and Łukasz Langa, plus around 90 talks. Most sessions are recorded, so you can catch up from your desk. source

The Language Summit convenes July 14

Tucked into EuroPython's opening days, the invitation-only Language Summit brings CPython and alternative-implementation maintainers together to hash out direction. This year's reported agenda covers Rust integration, garbage-collection improvements, buffer-protocol modernization, and free-threading concurrency primitives — a good preview of the arguments that will shape the next couple of releases. source

Python 3.15 heads into the final stretch

With the 3.15 feature set frozen, the release is now in stabilization. Beta 4 is due July 18, the release-candidate phase opens August 4, and the final release is expected this fall. Notable features already locked in include PEP 798 (unpacking with * and ** inside comprehensions) and PEP 800 (the @typing.disjoint_base decorator). Running your test suite against the beta now is the single most useful thing you can do for a solid final release. source

CPython's JIT is on a six-month clock

The story hanging over the release calendar: the Steering Council has given CPython's experimental JIT compiler roughly six months to produce a standards-track PEP — covering long-term maintainers, a security review, tooling support, and runtime guarantees — or the JIT code comes back out of main. Today's JIT delivers about an 8–13% geometric-mean speedup depending on platform, well short of its ~20% target and further still from PyPy's lead. It's a healthy forcing function for a project that shipped experimentally back in 3.13. source

PSF sets its 2026 election dates — with a first for packaging

The Python Software Foundation has scheduled its 2026 board election: nominations open July 28, voting runs September 1–15. This year the vote runs alongside the first-ever election for the new Packaging Council. If you're a PSF voting member, mark the dates — and the draft strategic plan the board circulated is worth a read for its candid focus on financial sustainability. source

That's the week — patch your Django, and enjoy the talks from Kraków. See you next week.