Django

Django’s security releases page is the most operationally important known-issues surface the project maintains: each entry names the CVE, the affected version range, the severity classification, and which release lines received the backport. Django’s security team issues coordinated disclosures, meaning the advisory and the fixed release ship simultaneously; the page is the cumulative record of every instance where that window opened, and reading it against your pinned version is the minimum check before holding a Django installation across a minor boundary.

The per-version release notes at docs.djangoproject.com/en/stable/releases/ carry the rest of the picture: deprecation timelines, backwards-incompatible changes, and the ORM and admin behaviour shifts that tend to surface as unexplained regressions once a deployment moves. Django marks its long-term support releases explicitly, and knowing which branches receive security backports versus which do not is a practical necessity for anyone running a version that the release notes have already started calling old.