I guess everyone reading this probably also reads the djangoproject.com weblog, but in case not, here is my retrospective for 2016: https://www.djangoproject.com/weblog/2016/dec/28/fellowship-2016-retrospective/.
Triaged
-------
https://code.djangoproject.com/ticket/27635 - django.utils.crypto should use secrets on Python 3.6+ (accepted)
https://code.djangoproject.com/ticket/27637 - timeuntil, timesince breaks in leap year edge case (accepted)
https://code.djangoproject.com/ticket/27641 - Document limitations of the Locmem cache backend (accepted)
https://code.djangoproject.com/ticket/27644 - Document FileSystemStorage.get_created_time() limitation on Unix (accepted)
https://code.djangoproject.com/ticket/27650 - ForeignKey.validate asks db_for_read for the parent's database, not the target field's database (duplicate)
https://code.djangoproject.com/ticket/27665 - More than one instance of Chrome locks up LiveServerTestCase (duplicate)
https://code.djangoproject.com/ticket/27657 - Getting crash when using the runserver command on Windows 10 in PowerShell following update to Python 3.6 (needsinfo)
Authored
----------
https://github.com/django/django/pull/7749 - Fixed #27648 -- Deprecated (iLmsu) regex groups in url() patterns.
https://github.com/django/django/pull/7750 - Fixed #24994 -- Documented the expected type of settings.SECRET_KEY.
https://github.com/django/django/pull/7752 - Fixed #27649 -- Bumped required cx_Oracle to 5.2.
https://github.com/django/django/pull/7773 - [WIP] Bootstrapped Django 2.0.
Reviewed/committed
------------------
https://github.com/django/django/pull/7744 - Fixed #27637 -- Fixed timesince, timeuntil in leap year edge case.
https://github.com/django/django/pull/7746 - Fixed #27640 -- Fixed HttpResponse's __repr__() without a 'Content-Type' header.
https://github.com/django/django/pull/6498 - Fixed #15667 -- Added template-based widget rendering.
https://github.com/django/django/pull/7751 - Fixed #27370 -- Prevented Select widget from using 'required' with a non-empty first value.
https://github.com/django/django/pull/7754 - Fixed #27628 -- Fixed unarchiving a file without permission data.
https://github.com/django/django/pull/7737 - Fixed #27631 -- Prevented execution of unsupported transactional DDL statements.
https://github.com/django/django/pull/7760 - Fixed #27622 -- Allowed test client to accept vendor tree JSON content types.
https://github.com/django/django/pull/6294 - Fixed #25415 -- Made DiscoverRunner run system checks.
https://github.com/django/django/pull/7495 - Fixed #2856 -- Replaced some 404s with messages in admin.
https://github.com/django/django/pull/7711 - Fixed #26478 -- Made {% for %} reject invalid unpacking vars with quotes or vertical bars.
https://github.com/django/django/pull/7762 - Fixed #27652 -- Doc'd that intcomma works with floats.
https://github.com/django/django/pull/7532 - Fixed #27458 -- Fixed invalid sequence/index names when using "USER"."TABLE" db_table on Oracle.