Weeknotes 2021 Week 7

A full set of Django Security releases…

As well as the Django Development Dashboard, with its all important Unreviewed tickets, Release blockers, and Patches needing review queues, I have a kind of long-list of things I want to get done on the project.

Recent ones were sorting out this year’s application for GSoC, and resolve the new a11y team DEP.

Ongoing are the current Season of Docs project, and adjusting DEP10 to slightly increase the bus factor on Merger PRs. On this last, I’m taking a small mental break next week, but will hang around because I didn't manage to resolve the PR yet. That’s not a problem — I’m not actually doing anything, I’m just not looking at Trac for a week — but it is a Sigh. Why haven’t I got that done yet? 🤨

For Django 4.0, I have a few features on the list, to make sure they’re resolved. There’s ongoing work on djangoproject.com. Then there’s always a few other tickets, reviews and discussions for which are under way.

The point is, there’s plenty on the long-list. It kind of bubbles away. And recalling the Dashboard, with its all important queues, nothing moves particularly fast.

Take that T&R Team PR. It’s not actually much to pick it off, but it does need a space, a couple of hours maybe. Why hasn’t that happened yet? Well, look at the diary: that week it was the feature freeze, this other one it was some big issue to review, that one, a flood of new tickets. And so on. That’s just how it is working on the project, sustainably, for the long-run, with the time and energy available.

I always think about this when I see comments on tickets or PRs:

Any progress on this? Need it for my project now!

I always smile, but rarely reply.

No, there’s no progress. If there were, it would be on the ticket. There’s no progress because no-one has had time. You’re welcome to input if you need it resolved.

This is how it is in open source. It’s why things move slowly. It’s perfectly fine, it’s great even. We absolutely should set our expectations that this is the way. The other option is volunteer burnout, and that's no fun.

So, this week, quiet, mid-prerelease, I had a nice bit of work on djangoproject.com planned. Getting on with that Tuesday when we had a security report come in from Nick Pope (thank you, Nick!) on a security fix for a reasonably tasty cache poisoning issue to Python’s parse_qsl() of which we maintain a backport.

The long and short of that was that the work on djangoproject.com goes back on the list, and we had a full set of security releases on Friday. Do update!

… and the Django 3.2 beta.

What was on the list for this week, but got pushed a day by the security releases, was the Django 3.2 beta.

Please go grab this now, and give it a run against your project. If you’ve got CI, just add it. If you’ve got tests but not CI, can I suggest this as the perfect moment to learn tox? If you’ve not got tests, go add them, the Django docs have got you covered.

Have fun. 💃