diff --git a/docs/features/django-fork.rst b/docs/features/django-fork.rst
index 6414176..ba8bad0 100644
--- a/docs/features/django-fork.rst
+++ b/docs/features/django-fork.rst
@@ -391,6 +391,64 @@ validate a rebase with no PR involved, or when no suitable PR run exists yet
    with ``sphinx -W`` (warnings as errors), so a docs fix that has landed on the
    base branch will keep failing on every stale PR until each one is rebased.
 
+Spotting upstream fixes released after the backend
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Rebasing a fork branch aligns it with upstream's *current* tip, which says
+nothing about whether the **released** backend contains those commits. A
+security fix backported to Django's ``stable/5.2.x`` the day after
+django-mongodb-backend 5.2.4 shipped is on the fork branch, in CI, and absent
+from every installed copy of the backend — and nothing in the sync output would
+have said so.
+
+So after a successful ``--all-branches`` (or ``--branch``) sync, ``dbx sync``
+compares each mapped branch's upstream target against the highest release tag of
+the same series in the group's ``release_repo`` and lists what upstream has that
+the release does not:
+
+.. code-block:: text
+
+   📋 Upstream commits since the latest django-mongodb-backend release:
+
+   🌿 mongodb-6.1.x → upstream/stable/6.1.x
+      django-mongodb-backend 6.1.0 (2026-08-17) … upstream tip
+      2 new commit(s):
+        [6.2 cycle] cabad83ed1 2026-08-18 [6.1.x] Fixed #37259 -- Restored support for old-signature Model.from_db() overrides.
+        [unannotated] 0db5e72fe6 2026-08-18 [6.1.x] Post-release version bump.
+
+   🌿 mongodb-5.2.x → upstream/stable/5.2.x
+      django-mongodb-backend 5.2.4 (2026-08-24) … upstream tip
+      ✅ nothing new upstream
+
+The release series comes from the branch name (``mongodb-5.2.x`` → the highest
+``5.2.<patch>`` tag), so no extra per-branch configuration is needed; a branch
+tracking an unreleased version (``mongodb-6.2.x`` → ``main``) reports that no
+tag exists yet. The comparison uses committer dates, so a commit is "new" when
+it landed on the stable branch after the release tag was cut.
+
+Each commit is labelled with the upstream **dev cycle** it was backported from.
+Django annotates every backport with ``Backport of <sha> from main.``, so the
+source commit's position on ``main`` — relative to the fork points of the
+``upstream/stable/X.Y.x`` branches — identifies the cycle it was written in.
+A ``[6.2 cycle]`` label on a ``stable/5.2.x`` commit is normal and simply means
+the fix was authored during 6.2 development and backported to 5.2; commits with
+no annotation (version bumps, per-branch release chores) are labelled
+``[unannotated]``.
+
+Configure the release repo per synced repo:
+
+.. code-block:: toml
+
+   [repo.groups.django.release_repo]
+   django = "django-mongodb-backend"
+
+The report is best-effort and never fails the sync: an unset ``release_repo``,
+an un-cloned release repo, or a git error is reported as a warning and skipped.
+It fetches tags in the release repo first so a stale clone does not over-report.
+Pass ``--no-backport-report`` to skip it, and note it also runs under
+``--dry-run`` (where it is the only thing that touches the network beyond the
+single upstream fetch).
+
 Adding a new release branch
 ----------------------------
 
diff --git a/docs/features/repo-management.rst b/docs/features/repo-management.rst
index d24e7e0..9a6f72a 100644
--- a/docs/features/repo-management.rst
+++ b/docs/features/repo-management.rst
@@ -160,6 +160,10 @@ After cloning with the fork workflow, you can easily sync your local repository
    # Sync all branches but skip re-running downstream CI
    dbx sync django --all-branches --no-ci
 
+   # Sync all branches but skip the report of upstream commits landed since the
+   # latest downstream release
+   dbx sync django --all-branches --no-backport-report
+
    # Preview what would be synced without making changes
    dbx sync mongo-python-driver --dry-run
 
@@ -279,6 +283,8 @@ Manage worktrees for any repo with ``dbx worktree``:
 **Notes:**
 
 - Requires an ``upstream`` remote; on clone this comes from the ``upstream`` config key
+- When a listed repo ends up without an ``upstream`` remote (cloned without ``--fork``, say),
+  ``dbx clone`` skips the worktree silently — pass ``--verbose`` to see the skip noted
 - Worktree directories are named ``<repo>-<label>``, where ``label`` defaults to the branch name with ``/`` replaced by ``-``
 - A branch can only be checked out in one worktree at a time; ``dbx worktree add`` reports git's refusal rather than moving it
 - ``dbx remove`` unregisters worktrees via ``git worktree remove`` and removes them before the clone they belong to
@@ -500,6 +506,7 @@ Per-group keys of note:
 - ``no_fork`` — list of repo names that skip the fork workflow even when ``--fork`` is active (useful for repos that are already organisation forks rather than personal forks, e.g. ``no_fork = ["django"]``)
 - ``upstream`` — upstream remote URLs added automatically on clone (see :ref:`config-driven-upstream`)
 - ``upstream_branch`` — upstream branch override for ``dbx sync`` (see :ref:`config-driven-upstream`)
+- ``release_repo`` — sibling repo whose release tags gate the synced fork; ``dbx sync --all-branches`` reports the upstream commits each mapped branch gained after that release (see :doc:`django-fork`)
 - ``sync_after_clone`` — list of repo names to automatically ``dbx sync`` immediately after cloning (see :ref:`sync-after-clone`)
 - ``upstream_worktree`` — list of repo names that get an upstream git worktree created on clone (see :ref:`upstream-worktrees`)
 - ``install_extras``, ``install_groups`` — default extras / dependency groups installed by ``dbx install``
diff --git a/src/dbx_python_cli/commands/sync.py b/src/dbx_python_cli/commands/sync.py
index 9d105c5..c39dab5 100644
--- a/src/dbx_python_cli/commands/sync.py
+++ b/src/dbx_python_cli/commands/sync.py
@@ -90,7 +90,14 @@ def _current_branch(repo_path):
 
 
 def _sync_all_branches(
-    repo_info, config, verbose, force, dry_run, no_ci=False, branch_filter=None
+    repo_info,
+    config,
+    verbose,
+    force,
+    dry_run,
+    no_ci=False,
+    branch_filter=None,
+    no_backport_report=False,
 ):
     """Sync branches in a repo's ``upstream_branch`` mapping.
 
@@ -188,6 +195,8 @@ def _sync_all_branches(
 
         summary = f"\n✨ Dry run complete! Checked {synced_count} branch(es)"
         typer.echo(summary)
+        if not no_backport_report:
+            _print_backport_report(repo_info, config, mapping, branches, verbose)
         return
 
     try:
@@ -267,6 +276,13 @@ def _sync_all_branches(
     if not no_ci and synced_branches:
         _rerun_downstream_ci(config, group, name, synced_branches, verbose)
 
+    # Rebasing the fork branches only aligns them with upstream's *current* tip;
+    # it says nothing about whether the released backend already contains those
+    # commits. Report that gap so a fix backported upstream after the last
+    # release (e.g. a 5.2.x security fix landing after backend 5.2.4) is noticed.
+    if not no_backport_report:
+        _print_backport_report(repo_info, config, mapping, branches, verbose)
+
 
 def _rerun_downstream_ci(config, group_name, repo_name, synced_branches, verbose=False):
     """Re-run downstream CI for the branches that synced, per the ci_rerun mapping.
@@ -658,6 +674,11 @@ def sync_callback(
         "--dry-run",
         help="Show what would be synced without making changes",
     ),
+    no_backport_report: bool = typer.Option(
+        False,
+        "--no-backport-report",
+        help="Skip the report of upstream commits landed since the latest downstream release (see release_repo config)",
+    ),
     no_ci: bool = typer.Option(
         False,
         "--no-ci",
@@ -679,6 +700,7 @@ def sync_callback(
         dbx sync <repo_name>                    # Sync a single repository
         dbx sync <repo_name> --all-branches     # Sync every branch in the repo's upstream_branch map
         dbx sync <repo_name> -B <branch>        # Sync only the named branch(es) from that map (repeatable)
+        dbx sync <repo_name> -b --no-backport-report  # Sync all branches, skip the release-gap report
         dbx sync -g <group>                     # Sync all repos in a group
         dbx sync -a                             # Sync all repos in all groups
         dbx sync -g <group> <repo_name>         # Sync specific repo in a group
@@ -810,6 +832,7 @@ def _enrich(repo_list):
                 dry_run,
                 no_ci,
                 branch_filter=branch or None,
+                no_backport_report=no_backport_report,
             )
             return
 
@@ -1420,3 +1443,260 @@ def _show_commit_comparison(
             f"❌ Failed to compare commits: {e.stderr if e.stderr else 'Unknown error'}",
             err=True,
         )
+
+
+def _git_out(path, args, check=True):
+    """Run a git command in ``path`` and return its stdout, stripped."""
+    return subprocess.run(
+        ["git", "-C", str(path), *args],
+        check=check,
+        capture_output=True,
+        text=True,
+    ).stdout.strip()
+
+
+def _branch_series(branch):
+    """Return the ``X.Y`` release series a fork branch tracks, or None.
+
+    ``mongodb-5.2.x`` → ``"5.2"``. Branches that do not follow the
+    ``<prefix>-<major>.<minor>.x`` convention have no derivable series.
+    """
+    import re
+
+    match = re.search(r"(\d+)\.(\d+)\.x$", branch)
+    return f"{match.group(1)}.{match.group(2)}" if match else None
+
+
+def _django_dev_version(path):
+    """Return the in-development version on ``upstream/main`` (e.g. ``"6.2"``).
+
+    Read from ``django/__init__.py`` so the report can name the cycle a commit
+    came from even before that cycle's stable branch is cut. Falls back to
+    ``"main"`` when the file or ref cannot be read.
+    """
+    import re
+
+    try:
+        content = _git_out(path, ["show", "upstream/main:django/__init__.py"])
+    except subprocess.CalledProcessError:
+        return "main"
+    match = re.search(r"VERSION\s*=\s*\(\s*(\d+)\s*,\s*(\d+)", content)
+    return f"{match.group(1)}.{match.group(2)}" if match else "main"
+
+
+def _upstream_cycles(path):
+    """Return ``(cycles, dev_label)`` describing upstream's release cycles.
+
+    ``cycles`` is a list of ``(version, label, forkpoint)`` ascending by version,
+    one per live ``upstream/stable/X.Y.x`` branch, where ``forkpoint`` is the
+    ``main`` commit that branch was cut from. A commit is part of the ``X.Y``
+    cycle when it is an ancestor of that branch's fork point but of no earlier
+    one, so the ascending order makes the first match the right answer.
+
+    ``dev_label`` is the cycle for commits newer than every fork point, i.e. the
+    version currently in development on ``main``.
+    """
+    import re
+
+    cycles = []
+    refs = _git_out(
+        path,
+        [
+            "for-each-ref",
+            "--format=%(refname:short)",
+            "refs/remotes/upstream/stable",
+        ],
+    )
+    for ref in refs.splitlines():
+        match = re.search(r"(\d+)\.(\d+)\.x$", ref.strip())
+        if not match:
+            continue
+        version = (int(match.group(1)), int(match.group(2)))
+        try:
+            forkpoint = _git_out(path, ["merge-base", "upstream/main", ref.strip()])
+        except subprocess.CalledProcessError:
+            continue
+        if forkpoint:
+            cycles.append((version, f"{version[0]}.{version[1]}", forkpoint))
+    cycles.sort(key=lambda c: c[0])
+    return cycles, _django_dev_version(path)
+
+
+def _classify_cycle(path, source_sha, cycles, dev_label, cache):
+    """Return the upstream dev cycle label a backport's source commit belongs to."""
+    if source_sha in cache:
+        return cache[source_sha]
+
+    label = dev_label
+    for _version, cycle_label, forkpoint in cycles:
+        result = subprocess.run(
+            [
+                "git",
+                "-C",
+                str(path),
+                "merge-base",
+                "--is-ancestor",
+                source_sha,
+                forkpoint,
+            ],
+            check=False,
+            capture_output=True,
+            text=True,
+        )
+        if result.returncode == 0:
+            label = cycle_label
+            break
+    cache[source_sha] = label
+    return label
+
+
+def _latest_release_tag(release_path, series):
+    """Return ``(tag, iso_date)`` for the highest ``<series>.<patch>`` tag, or None."""
+    import re
+
+    try:
+        tags = _git_out(release_path, ["tag", "-l", f"{series}.*"])
+    except subprocess.CalledProcessError:
+        return None
+
+    pattern = re.compile(rf"^{re.escape(series)}\.(\d+)$")
+    matched = [(int(m.group(1)), t) for t in tags.split() if (m := pattern.match(t))]
+    if not matched:
+        return None
+
+    tag = max(matched)[1]
+    try:
+        date = _git_out(release_path, ["log", "-1", "--format=%cI", tag])
+    except subprocess.CalledProcessError:
+        return None
+    return tag, date
+
+
+def _new_upstream_commits(path, upstream_ref, since_iso):
+    """Return ``(sha, short, date, subject, body)`` for commits on ``upstream_ref``
+    committed after ``since_iso``."""
+    log = _git_out(
+        path,
+        [
+            "log",
+            f"upstream/{upstream_ref}",
+            f"--since={since_iso}",
+            "--date=short",
+            "--format=\x01%H\x02%h\x02%cd\x02%s\x02%b",
+        ],
+    )
+    commits = []
+    for entry in log.split("\x01")[1:]:
+        parts = entry.split("\x02", 4)
+        if len(parts) == 5:
+            commits.append(tuple(p.strip() for p in parts))
+    return commits
+
+
+def _print_backport_report(repo_info, config, mapping, branches, verbose=False):
+    """Report upstream commits that landed after the matching downstream release.
+
+    For each synced fork branch, compare its upstream target against the highest
+    release tag of the same series in the group's ``release_repo`` and list the
+    commits upstream has that the release does not, each labelled with the
+    upstream dev cycle it was backported from. This is what catches, say, a
+    security fix backported to Django's ``stable/5.2.x`` after
+    django-mongodb-backend 5.2.4 shipped.
+
+    Best-effort: any missing configuration or git failure is reported as a
+    warning rather than failing the sync.
+    """
+    import re
+
+    from dbx_python_cli.utils.repo import find_repo_by_name, get_release_repo
+
+    path = repo_info["path"]
+    name = repo_info["name"]
+    group = repo_info.get("group", "")
+
+    release_name = get_release_repo(config, group, name)
+    if not release_name:
+        if verbose:
+            typer.echo(
+                f"[verbose] No release_repo configured for '{name}' — "
+                "skipping backport report"
+            )
+        return
+
+    base_dir = repo.get_base_dir(config)
+    release_info = find_repo_by_name(release_name, base_dir, config)
+    if not release_info:
+        typer.echo(
+            f"⚠️  Skipping backport report: release repo '{release_name}' not found "
+            f"locally (clone it or unset release_repo)",
+            err=True,
+        )
+        return
+
+    release_path = release_info["path"]
+    # Release tags may have been cut since this clone last fetched; a stale tag
+    # list would silently over-report commits as "new since the release".
+    try:
+        subprocess.run(
+            ["git", "-C", str(release_path), "fetch", "--tags", "--quiet"],
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+    except subprocess.CalledProcessError as e:
+        if verbose:
+            typer.echo(f"[verbose] Could not fetch tags for {release_name}: {e.stderr}")
+
+    try:
+        cycles, dev_label = _upstream_cycles(path)
+    except subprocess.CalledProcessError as e:
+        typer.echo(
+            f"⚠️  Skipping backport report: could not read upstream cycles "
+            f"({e.stderr.strip() if e.stderr else e})",
+            err=True,
+        )
+        return
+
+    typer.echo(f"\n📋 Upstream commits since the latest {release_name} release:\n")
+
+    cache = {}
+    backport_re = re.compile(r"[Bb]ackport of ([0-9a-f]{7,40}) from main")
+
+    for branch in branches:
+        upstream_ref = mapping[branch]
+        typer.echo(f"🌿 {branch} → upstream/{upstream_ref}")
+
+        series = _branch_series(branch)
+        if not series:
+            typer.echo(f"   ⚠️  Cannot derive a release series from '{branch}'")
+            continue
+
+        release = _latest_release_tag(release_path, series)
+        if not release:
+            typer.echo(f"   ⚠️  No {series}.* release tag in {release_name} yet")
+            continue
+
+        tag, since = release
+        try:
+            commits = _new_upstream_commits(path, upstream_ref, since)
+        except subprocess.CalledProcessError as e:
+            typer.echo(
+                f"   ⚠️  Could not read upstream/{upstream_ref} "
+                f"({e.stderr.strip() if e.stderr else e})",
+                err=True,
+            )
+            continue
+
+        typer.echo(f"   {release_name} {tag} ({since[:10]}) … upstream tip")
+        if not commits:
+            typer.echo("   ✅ nothing new upstream")
+            continue
+
+        typer.echo(f"   {len(commits)} new commit(s):")
+        for _sha, short, date, subject, body in commits:
+            match = backport_re.search(body)
+            if match:
+                label = f"{_classify_cycle(path, match.group(1), cycles, dev_label, cache)} cycle"
+            else:
+                label = "unannotated"
+            typer.echo(f"     [{label}] {short} {date} {subject}")
diff --git a/src/dbx_python_cli/config.toml b/src/dbx_python_cli/config.toml
index d5ac5d1..46560ef 100644
--- a/src/dbx_python_cli/config.toml
+++ b/src/dbx_python_cli/config.toml
@@ -210,6 +210,14 @@ django = ["-v", "2"]
 [repo.groups.django.preferred_branch]
 django = "mongodb-6.0.x"
 
+# Downstream repo (in this group) that is released from the synced fork. After
+# `dbx sync <repo> --all-branches`, each mapped fork branch is compared against the
+# matching release tag in this repo (mongodb-5.2.x -> the highest 5.2.* tag), and any
+# upstream commits that landed after that release are reported, labelled with the
+# upstream dev cycle they were backported from. Pass --no-backport-report to skip.
+[repo.groups.django.release_repo]
+django = "django-mongodb-backend"
+
 # Per-branch downstream CI to re-run after that branch rebases, but only when the
 # branch actually synced. Keyed by the synced repo, then by the fork branch; the
 # value maps each `owner/name` GitHub repo to a target that is either:
diff --git a/src/dbx_python_cli/utils/repo.py b/src/dbx_python_cli/utils/repo.py
index 48b172a..66a2244 100644
--- a/src/dbx_python_cli/utils/repo.py
+++ b/src/dbx_python_cli/utils/repo.py
@@ -1116,3 +1116,24 @@ def list_repos(base_dir, format_style="default", config=None):
                 else:
                     lines.append(f"{continuation}{repo_prefix} {repo_name}")
         return "\n".join(lines)
+
+
+def get_release_repo(config, group_name, repo_name):
+    """Return the downstream repo whose release tags gate ``repo_name``, or None.
+
+    Names the sibling repo in the same group that is *released* from the synced
+    fork, so ``dbx sync --all-branches`` can report which upstream commits landed
+    on each stable branch after the matching downstream release was cut (e.g.
+    Django's ``stable/5.2.x`` versus django-mongodb-backend 5.2.4).
+
+    Configure in ``[repo.groups.<group>.release_repo]``:
+
+    .. code-block:: toml
+
+        [repo.groups.django.release_repo]
+        django = "django-mongodb-backend"
+    """
+    groups = get_repo_groups(config)
+    if group_name not in groups:
+        return None
+    return groups[group_name].get("release_repo", {}).get(repo_name)
diff --git a/tests/test_sync_command.py b/tests/test_sync_command.py
index e1c09b8..af75add 100644
--- a/tests/test_sync_command.py
+++ b/tests/test_sync_command.py
@@ -101,3 +101,173 @@ def test_retry_evergreen_comments_on_open_pr(capsys):
         _retry_evergreen("o/r", 562, "mongodb-5.2.x", False, _gh_json)
     assert "evergreen retry" in run.call_args.args[0]
     assert "✓ commented 'evergreen retry'" in capsys.readouterr().out
+
+
+def test_branch_series_derives_release_series():
+    from dbx_python_cli.commands.sync import _branch_series
+
+    assert _branch_series("mongodb-5.2.x") == "5.2"
+    assert _branch_series("mongodb-6.0.x") == "6.0"
+    assert _branch_series("main") is None
+
+
+def _completed(cmd, stdout=""):
+    return subprocess.CompletedProcess(cmd, 0, stdout=stdout, stderr="")
+
+
+def test_latest_release_tag_picks_highest_patch_numerically():
+    """5.2.10 must beat 5.2.4 (lexical sorting would pick 5.2.4)."""
+    from dbx_python_cli.commands.sync import _latest_release_tag
+
+    def side_effect(cmd, **kwargs):
+        if "tag" in cmd:
+            return _completed(cmd, "5.2.0\n5.2.4\n5.2.10\n5.2.0b1\n")
+        return _completed(cmd, "2026-08-24T10:00:00-04:00")
+
+    with mock.patch(
+        "dbx_python_cli.commands.sync.subprocess.run", side_effect=side_effect
+    ):
+        assert _latest_release_tag("/repo", "5.2") == (
+            "5.2.10",
+            "2026-08-24T10:00:00-04:00",
+        )
+
+
+def test_latest_release_tag_none_when_series_unreleased():
+    from dbx_python_cli.commands.sync import _latest_release_tag
+
+    with mock.patch(
+        "dbx_python_cli.commands.sync.subprocess.run",
+        side_effect=lambda cmd, **kw: _completed(cmd, ""),
+    ):
+        assert _latest_release_tag("/repo", "6.2") is None
+
+
+def test_classify_cycle_picks_earliest_matching_forkpoint():
+    """A commit is in the X.Y cycle when it is an ancestor of stable/X.Y.x's fork
+    point but of no earlier one; anything past every fork point is in-development."""
+    from dbx_python_cli.commands.sync import _classify_cycle
+
+    cycles = [((6, 0), "6.0", "fp60"), ((6, 1), "6.1", "fp61")]
+    # "old" predates both fork points, "mid" only fp61, "new" neither.
+    ancestors = {("old", "fp60"), ("old", "fp61"), ("mid", "fp61")}
+
+    def side_effect(cmd, **kwargs):
+        sha, forkpoint = cmd[-2], cmd[-1]
+        code = 0 if (sha, forkpoint) in ancestors else 1
+        return subprocess.CompletedProcess(cmd, code, stdout="", stderr="")
+
+    with mock.patch(
+        "dbx_python_cli.commands.sync.subprocess.run", side_effect=side_effect
+    ):
+        cache = {}
+        assert _classify_cycle("/p", "old", cycles, "6.2", cache) == "6.0"
+        assert _classify_cycle("/p", "mid", cycles, "6.2", cache) == "6.1"
+        assert _classify_cycle("/p", "new", cycles, "6.2", cache) == "6.2"
+    # Cached results are reused without shelling out again.
+    with mock.patch("dbx_python_cli.commands.sync.subprocess.run") as run:
+        assert _classify_cycle("/p", "mid", cycles, "6.2", cache) == "6.1"
+        run.assert_not_called()
+
+
+def _report_git_stub(commits_by_ref, tags="5.2.4\n"):
+    """Stub git for _print_backport_report: cycles, tags, and per-ref commit logs."""
+
+    def side_effect(cmd, **kwargs):
+        if "for-each-ref" in cmd:
+            return _completed(cmd, "upstream/stable/5.2.x\nupstream/stable/6.0.x\n")
+        if "merge-base" in cmd and "--is-ancestor" in cmd:
+            # Source shas prefixed "abc" belong to an already-cut cycle.
+            code = 0 if cmd[-2].startswith("abc") else 1
+            return subprocess.CompletedProcess(cmd, code, stdout="", stderr="")
+        if "merge-base" in cmd:
+            return _completed(cmd, f"fp-{cmd[-1]}")
+        if "show" in cmd:
+            return _completed(cmd, "VERSION = (6, 2, 0, 'alpha', 0)")
+        if "tag" in cmd:
+            return _completed(cmd, tags)
+        if "log" in cmd and "-1" in cmd:
+            return _completed(cmd, "2026-08-24T10:00:00-04:00")
+        if "log" in cmd:
+            ref = next(a for a in cmd if a.startswith("upstream/"))
+            return _completed(cmd, commits_by_ref.get(ref, ""))
+        return _completed(cmd)
+
+    return side_effect
+
+
+def _run_report(side_effect, mapping, config=None):
+    from dbx_python_cli.commands import sync
+
+    repo_info = {"path": "/repos/django", "name": "django", "group": "django"}
+    with (
+        mock.patch(
+            "dbx_python_cli.utils.repo.get_release_repo",
+            return_value="django-mongodb-backend",
+        ),
+        mock.patch(
+            "dbx_python_cli.utils.repo.find_repo_by_name",
+            return_value={"path": "/repos/django-mongodb-backend"},
+        ),
+        mock.patch("dbx_python_cli.utils.repo.get_base_dir", return_value="/repos"),
+        mock.patch(
+            "dbx_python_cli.commands.sync.subprocess.run", side_effect=side_effect
+        ),
+    ):
+        sync._print_backport_report(
+            repo_info, config or {}, mapping, list(mapping.keys())
+        )
+
+
+def test_print_backport_report_lists_new_commits_with_cycle_labels(capsys):
+    commit = (
+        "\x01deadbeefcafe\x02deadbee\x022026-08-25\x02"
+        "[5.2.x] Fixed CVE-2026-1 -- Something.\x02"
+        "Backport of abc1234def from main."
+    )
+    unannotated = (
+        "\x01aaaabbbbcccc\x02aaaabbb\x022026-08-25\x02"
+        "[5.2.x] Post-release version bump.\x02"
+    )
+    _run_report(
+        _report_git_stub({"upstream/stable/5.2.x": commit + unannotated}),
+        {"mongodb-5.2.x": "stable/5.2.x"},
+    )
+    out = capsys.readouterr().out
+    assert "django-mongodb-backend 5.2.4 (2026-08-24)" in out
+    assert "2 new commit(s)" in out
+    assert "[5.2 cycle] deadbee 2026-08-25 [5.2.x] Fixed CVE-2026-1" in out
+    assert "[unannotated] aaaabbb" in out
+
+
+def test_print_backport_report_reports_clean_branch(capsys):
+    _run_report(_report_git_stub({}), {"mongodb-5.2.x": "stable/5.2.x"})
+    out = capsys.readouterr().out
+    assert "nothing new upstream" in out
+
+
+def test_print_backport_report_notes_unreleased_series(capsys):
+    _run_report(
+        _report_git_stub({}, tags=""),
+        {"mongodb-6.2.x": "main"},
+    )
+    assert (
+        "No 6.2.* release tag in django-mongodb-backend yet" in capsys.readouterr().out
+    )
+
+
+def test_print_backport_report_skips_without_release_repo(capsys):
+    from dbx_python_cli.commands import sync
+
+    with (
+        mock.patch("dbx_python_cli.utils.repo.get_release_repo", return_value=None),
+        mock.patch("dbx_python_cli.commands.sync.subprocess.run") as run,
+    ):
+        sync._print_backport_report(
+            {"path": "/p", "name": "django", "group": "django"},
+            {},
+            {"mongodb-5.2.x": "stable/5.2.x"},
+            ["mongodb-5.2.x"],
+        )
+    run.assert_not_called()
+    assert capsys.readouterr().out == ""