Changelog
### 3.1.1
```
* :bug:`548` Restore ``--non-interactive`` as a flag not expecting an
argument.
```
### 3.1.0
```
* :feature:`547` Add support for specifying ``--non-interactive`` as an
environment variable.
```
### 3.0.0
```
* :feature:`336` When a client certificate is indicated, all password
processing is disabled.
* :feature:`489` Add ``--non-interactive`` flag to abort upload rather than
interactively prompt if credentials are missing.
* :feature:`524` Twine now unconditionally requires the keyring library
and no longer supports uninstalling ``keyring`` as a means to disable
that functionality. Instead, use ``keyring --disable`` keyring functionality
if necessary.
* :feature:`518` Add Python 3.8 to classifiers.
* :bug:`332 major` More robust handling of server response in
``--skip-existing``
```
### 2.0.0
```
* :feature:`437` Twine now requires Python 3.6 or later. Use pip
9 or pin to "twine<2" to install twine on older Python versions.
* :bug:`491 major` Require requests 2.20 or later to avoid reported security
vulnerabilities in earlier releases.
```
Links
- PyPI: https://pypi.org/project/twine
- Changelog: https://pyup.io/changelogs/twine/
- Docs: https://twine.readthedocs.io/
Changelog
### 5.1
```
--------------------------
- The JSON report now includes counts of covered and missing branches. Thanks,
Salvatore Zagaria.
- On Python 3.8, try-finally-return reported wrong branch coverage with
decorated async functions (`issue 946`_). This is now fixed. Thanks, Kjell
Braden.
- The :meth:`~coverage.Coverage.get_option` and
:meth:`~coverage.Coverage.set_option` methods can now manipulate the
``[paths]`` configuration setting. Thanks to Bernát Gábor for the fix for
`issue 967`_.
.. _issue 946: https://github.com/nedbat/coveragepy/issues/946
.. _issue 967: https://github.com/nedbat/coveragepy/issues/967
.. _changes_504:
```
### 5.0.4
```
----------------------------
- If using the ``[run] relative_files`` setting, the XML report will use
relative files in the ``<source>`` elements indicating the location of source
code. Closes `issue 948`_.
- The textual summary report could report missing lines with negative line
numbers on PyPy3 7.1 (`issue 943`_). This is now fixed.
- Windows wheels for Python 3.8 were incorrectly built, but are now fixed.
(`issue 949`_)
- Updated Python 3.9 support to 3.9a4.
- HTML reports couldn't be sorted if localStorage wasn't available. This is now
fixed: sorting works even though the sorting setting isn't retained. (`issue
944`_ and `pull request 945`_). Thanks, Abdeali Kothari.
.. _issue 943: https://github.com/nedbat/coveragepy/issues/943
.. _issue 944: https://github.com/nedbat/coveragepy/issues/944
.. _pull request 945: https://github.com/nedbat/coveragepy/pull/945
.. _issue 948: https://github.com/nedbat/coveragepy/issues/948
.. _issue 949: https://github.com/nedbat/coveragepy/issues/949
.. _changes_503:
```
Links
- PyPI: https://pypi.org/project/coverage
- Changelog: https://pyup.io/changelogs/coverage/
- Repo: https://github.com/nedbat/coveragepy
Changelog
### 3.0.6
```
==========================
*May 4, 2020*
Django 3.0.6 fixes a bug in 3.0.5.
Bugfixes
========
* Fixed a regression in Django 3.0 that caused a crash when filtering a
``Subquery()`` annotation of a queryset containing a single related field
against a ``SimpleLazyObject`` (:ticket:`31420`).
==========================
```
### 3.0.5
```
==========================
*April 1, 2020*
Django 3.0.5 fixes several bugs in 3.0.4.
Bugfixes
========
* Added the ability to handle ``.po`` files containing different plural
equations for the same language (:ticket:`30439`).
* Fixed a regression in Django 3.0 where ``QuerySet.values()`` and
``values_list()`` crashed if a queryset contained an aggregation and
``Subquery()`` annotation that collides with a field name (:ticket:`31377`).
==========================
```
### 3.0.4
```
==========================
*March 4, 2020*
Django 3.0.4 fixes a security issue and several bugs in 3.0.3.
CVE-2020-9402: Potential SQL injection via ``tolerance`` parameter in GIS functions and aggregates on Oracle
============================================================================================================
GIS functions and aggregates on Oracle were subject to SQL injection,
using a suitably crafted ``tolerance``.
Bugfixes
========
* Fixed a data loss possibility when using caching from async code
(:ticket:`31253`).
* Fixed a regression in Django 3.0 that caused a file response using a
temporary file to be closed incorrectly (:ticket:`31240`).
* Fixed a data loss possibility in the
:meth:`~django.db.models.query.QuerySet.select_for_update`. When using
related fields or parent link fields with :ref:`multi-table-inheritance` in
the ``of`` argument, the corresponding models were not locked
(:ticket:`31246`).
* Fixed a regression in Django 3.0 that caused misplacing parameters in logged
SQL queries on Oracle (:ticket:`31271`).
* Fixed a regression in Django 3.0.3 that caused misplacing parameters of SQL
queries when subtracting ``DateField`` or ``DateTimeField`` expressions on
MySQL (:ticket:`31312`).
* Fixed a regression in Django 3.0 that didn't include subqueries spanning
multivalued relations in the ``GROUP BY`` clause (:ticket:`31150`).
==========================
```
### 3.0.3
```
==========================
*February 3, 2020*
Django 3.0.3 fixes a security issue and several bugs in 3.0.2.
CVE-2020-7471: Potential SQL injection via ``StringAgg(delimiter)``
===================================================================
:class:`~django.contrib.postgres.aggregates.StringAgg` aggregation function was
subject to SQL injection, using a suitably crafted ``delimiter``.
Bugfixes
========
* Fixed a regression in Django 3.0 that caused a crash when subtracting
``DateField``, ``DateTimeField``, or ``TimeField`` from a ``Subquery()``
annotation (:ticket:`31133`).
* Fixed a regression in Django 3.0 where ``QuerySet.values()`` and
``values_list()`` crashed if a queryset contained an aggregation and
``Exists()`` annotation (:ticket:`31136`).
* Relaxed the system check added in Django 3.0 to reallow use of a sublanguage
in the :setting:`LANGUAGE_CODE` setting, when a base language is available in
Django but the sublanguage is not (:ticket:`31141`).
* Added support for using enumeration types ``TextChoices``,
``IntegerChoices``, and ``Choices`` in templates (:ticket:`31154`).
* Fixed a system check to ensure the ``max_length`` attribute fits the longest
choice, when a named group contains only non-string values (:ticket:`31155`).
* Fixed a regression in Django 2.2 that caused a crash of
:class:`~django.contrib.postgres.aggregates.ArrayAgg` and
:class:`~django.contrib.postgres.aggregates.StringAgg` with ``filter``
argument when used in a ``Subquery`` (:ticket:`31097`).
* Fixed a regression in Django 2.2.7 that caused
:meth:`~django.db.models.Model.get_FOO_display` to work incorrectly when
overriding inherited choices (:ticket:`31124`).
* Fixed a regression in Django 3.0 that caused a crash of
``QuerySet.prefetch_related()`` for ``GenericForeignKey`` with a custom
``ContentType`` foreign key (:ticket:`31190`).
==========================
```
### 3.0.2
```
==========================
*January 2, 2020*
Django 3.0.2 fixes several bugs in 3.0.1.
Bugfixes
========
* Fixed a regression in Django 3.0 that didn't include columns referenced by a
``Subquery()`` in the ``GROUP BY`` clause (:ticket:`31094`).
* Fixed a regression in Django 3.0 where ``QuerySet.exists()`` crashed if a
queryset contained an aggregation over a ``Subquery()`` (:ticket:`31109`).
* Fixed a regression in Django 3.0 that caused a migration crash on PostgreSQL
10+ when adding a foreign key and changing data in the same migration
(:ticket:`31106`).
* Fixed a regression in Django 3.0 where loading fixtures crashed for models
defining a :attr:`~django.db.models.Field.default` for the primary key
(:ticket:`31071`).
==========================
```
### 3.0.1
```
==========================
*December 18, 2019*
Django 3.0.1 fixes a security issue and several bugs in 3.0.
CVE-2019-19844: Potential account hijack via password reset form
================================================================
By submitting a suitably crafted email address making use of Unicode
characters, that compared equal to an existing user email when lower-cased for
comparison, an attacker could be sent a password reset token for the matched
account.
In order to avoid this vulnerability, password reset requests now compare the
submitted email using the stricter, recommended algorithm for case-insensitive
comparison of two identifiers from `Unicode Technical Report 36, section
2.11.2(B)(2)`__. Upon a match, the email containing the reset token will be
sent to the email address on record rather than the submitted address.
.. __: https://www.unicode.org/reports/tr36/Recommendations_General
Bugfixes
========
* Fixed a regression in Django 3.0 by restoring the ability to use Django
inside Jupyter and other environments that force an async context, by adding
an option to disable :ref:`async-safety` mechanism with
:envvar:`DJANGO_ALLOW_ASYNC_UNSAFE` environment variable (:ticket:`31056`).
* Fixed a regression in Django 3.0 where ``RegexPattern``, used by
:func:`~django.urls.re_path`, returned positional arguments to be passed to
the view when all optional named groups were missing (:ticket:`31061`).
* Reallowed, following a regression in Django 3.0,
:class:`~django.db.models.expressions.Window` expressions to be used in
conditions outside of queryset filters, e.g. in
:class:`~django.db.models.expressions.When` conditions (:ticket:`31060`).
* Fixed a data loss possibility in
:class:`~django.contrib.postgres.forms.SplitArrayField`. When using with
``ArrayField(BooleanField())``, all values after the first ``True`` value
were marked as checked instead of preserving passed values (:ticket:`31073`).
========================
```
### 3.0
```
========================
*December 2, 2019*
Welcome to Django 3.0!
These release notes cover the :ref:`new features <whats-new-3.0>`, as well as
some :ref:`backwards incompatible changes <backwards-incompatible-3.0>` you'll
want to be aware of when upgrading from Django 2.2 or earlier. We've
:ref:`dropped some features<removed-features-3.0>` that have reached the end of
their deprecation cycle, and we've :ref:`begun the deprecation process for
some features <deprecated-features-3.0>`.
See the :doc:`/howto/upgrade-version` guide if you're updating an existing
project.
Python compatibility
====================
Django 3.0 supports Python 3.6, 3.7, and 3.8. We **highly recommend** and only
officially support the latest release of each series.
The Django 2.2.x series is the last to support Python 3.5.
Third-party library support for older version of Django
=======================================================
Following the release of Django 3.0, we suggest that third-party app authors
drop support for all versions of Django prior to 2.2. At that time, you should
be able to run your package's tests using ``python -Wd`` so that deprecation
warnings appear. After making the deprecation warning fixes, your app should be
compatible with Django 3.0.
.. _whats-new-3.0:
What's new in Django 3.0
========================
MariaDB support
---------------
Django now officially supports `MariaDB <https://mariadb.org/>`_ 10.1 and
higher. See :ref:`MariaDB notes <mariadb-notes>` for more details.
ASGI support
------------
Django 3.0 begins our journey to making Django fully async-capable by providing
support for running as an `ASGI <https://asgi.readthedocs.io/>`_ application.
This is in addition to our existing WSGI support. Django intends to support
both for the foreseeable future. Async features will only be available to
applications that run under ASGI, however.
At this stage async support only applies to the outer ASGI application.
Internally everything remains synchronous. Asynchronous middleware, views, etc.
are not yet supported. You can, however, use ASGI middleware around Django's
application, allowing you to combine Django with other ASGI frameworks.
There is no need to switch your applications over unless you want to start
experimenting with asynchronous code, but we have
:doc:`documentation on deploying with ASGI </howto/deployment/asgi/index>` if
you want to learn more.
Note that as a side-effect of this change, Django is now aware of asynchronous
event loops and will block you calling code marked as "async unsafe" - such as
ORM operations - from an asynchronous context. If you were using Django from
async code before, this may trigger if you were doing it incorrectly. If you
see a ``SynchronousOnlyOperation`` error, then closely examine your code and
move any database operations to be in a synchronous child thread.
Exclusion constraints on PostgreSQL
-----------------------------------
The new :class:`~django.contrib.postgres.constraints.ExclusionConstraint` class
enable adding exclusion constraints on PostgreSQL. Constraints are added to
models using the
:attr:`Meta.constraints <django.db.models.Options.constraints>` option.
Filter expressions
------------------
Expressions that output :class:`~django.db.models.BooleanField` may now be
used directly in ``QuerySet`` filters, without having to first annotate and
then filter against the annotation.
Enumerations for model field choices
------------------------------------
Custom enumeration types ``TextChoices``, ``IntegerChoices``, and ``Choices``
are now available as a way to define :attr:`.Field.choices`. ``TextChoices``
and ``IntegerChoices`` types are provided for text and integer fields. The
``Choices`` class allows defining a compatible enumeration for other concrete
data types. These custom enumeration types support human-readable labels that
can be translated and accessed via a property on the enumeration or its
members. See :ref:`Enumeration types <field-choices-enum-types>` for more
details and examples.
Minor features
--------------
:mod:`django.contrib.admin`
~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Added support for the ``admin_order_field`` attribute on properties in
:attr:`.ModelAdmin.list_display`.
* The new :meth:`ModelAdmin.get_inlines()
<django.contrib.admin.ModelAdmin.get_inlines>` method allows specifying the
inlines based on the request or model instance.
* Select2 library is upgraded from version 4.0.3 to 4.0.7.
* jQuery is upgraded from version 3.3.1 to 3.4.1.
:mod:`django.contrib.auth`
~~~~~~~~~~~~~~~~~~~~~~~~~~
* The new ``reset_url_token`` attribute in
:class:`~django.contrib.auth.views.PasswordResetConfirmView` allows
specifying a token parameter displayed as a component of password reset
URLs.
* Added :class:`~django.contrib.auth.backends.BaseBackend` class to ease
customization of authentication backends.
* Added :meth:`~django.contrib.auth.models.User.get_user_permissions()` method
to mirror the existing
:meth:`~django.contrib.auth.models.User.get_group_permissions()` method.
* Added HTML ``autocomplete`` attribute to widgets of username, email, and
password fields in :mod:`django.contrib.auth.forms` for better interaction
with browser password managers.
* :djadmin:`createsuperuser` now falls back to environment variables for
password and required fields, when a corresponding command line argument
isn't provided in non-interactive mode.
* :attr:`~django.contrib.auth.models.CustomUser.REQUIRED_FIELDS` now supports
:class:`~django.db.models.ManyToManyField`\s.
* The new :meth:`.UserManager.with_perm` method returns users that have the
specified permission.
* The default iteration count for the PBKDF2 password hasher is increased from
150,000 to 180,000.
:mod:`django.contrib.gis`
~~~~~~~~~~~~~~~~~~~~~~~~~
* Allowed MySQL spatial lookup functions to operate on real geometries.
Previous support was limited to bounding boxes.
* Added the :class:`~django.contrib.gis.db.models.functions.GeometryDistance`
function, supported on PostGIS.
* Added support for the ``furlong`` unit in
:class:`~django.contrib.gis.measure.Distance`.
* The :setting:`GEOIP_PATH` setting now supports :class:`pathlib.Path`.
* The :class:`~django.contrib.gis.geoip2.GeoIP2` class now accepts
:class:`pathlib.Path` ``path``.
:mod:`django.contrib.postgres`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* The new :class:`~django.contrib.postgres.fields.RangeOperators` helps to
avoid typos in SQL operators that can be used together with
:class:`~django.contrib.postgres.fields.RangeField`.
* The new :class:`~django.contrib.postgres.fields.RangeBoundary` expression
represents the range boundaries.
* The new :class:`~django.contrib.postgres.operations.AddIndexConcurrently`
and :class:`~django.contrib.postgres.operations.RemoveIndexConcurrently`
classes allow creating and dropping indexes ``CONCURRENTLY`` on PostgreSQL.
:mod:`django.contrib.sessions`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* The new
:meth:`~django.contrib.sessions.backends.base.SessionBase.get_session_cookie_age()`
method allows dynamically specifying the session cookie age.
:mod:`django.contrib.syndication`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Added the ``language`` class attribute to the
:class:`django.contrib.syndication.views.Feed` to customize a feed language.
The default value is :func:`~django.utils.translation.get_language()` instead
of :setting:`LANGUAGE_CODE`.
Cache
~~~~~
* :func:`~django.utils.cache.add_never_cache_headers` and
:func:`~django.views.decorators.cache.never_cache` now add the ``private``
directive to ``Cache-Control`` headers.
File Storage
~~~~~~~~~~~~
* The new :meth:`.Storage.get_alternative_name` method allows customizing the
algorithm for generating filenames if a file with the uploaded name already
exists.
Forms
~~~~~
* Formsets may control the widget used when ordering forms via
:attr:`~django.forms.formsets.BaseFormSet.can_order` by setting the
:attr:`~django.forms.formsets.BaseFormSet.ordering_widget` attribute or
overriding :attr:`~django.forms.formsets.BaseFormSet.get_ordering_widget()`.
Internationalization
~~~~~~~~~~~~~~~~~~~~
* Added the :setting:`LANGUAGE_COOKIE_HTTPONLY`,
:setting:`LANGUAGE_COOKIE_SAMESITE`, and :setting:`LANGUAGE_COOKIE_SECURE`
settings to set the ``HttpOnly``, ``SameSite``, and ``Secure`` flags on
language cookies. The default values of these settings preserve the previous
behavior.
* Added support and translations for the Uzbek language.
Logging
~~~~~~~
* The new ``reporter_class`` parameter of
:class:`~django.utils.log.AdminEmailHandler` allows providing an
``django.views.debug.ExceptionReporter`` subclass to customize the traceback
text sent to site :setting:`ADMINS` when :setting:`DEBUG` is ``False``.
Management Commands
~~~~~~~~~~~~~~~~~~~
* The new :option:`compilemessages --ignore` option allows ignoring specific
directories when searching for ``.po`` files to compile.
* :option:`showmigrations --list` now shows the applied datetimes when
``--verbosity`` is 2 and above.
* On PostgreSQL, :djadmin:`dbshell` now supports client-side TLS certificates.
* :djadmin:`inspectdb` now introspects :class:`~django.db.models.OneToOneField`
when a foreign key has a unique or primary key constraint.
* The new :option:`--skip-checks` option skips running system checks prior to
running the command.
* The :option:`startapp --template` and :option:`startproject --template`
options now support templates stored in XZ archives (``.tar.xz``, ``.txz``)
and LZMA archives (``.tar.lzma``, ``.tlz``).
Models
~~~~~~
* Added hash database functions :class:`~django.db.models.functions.MD5`,
:class:`~django.db.models.functions.SHA1`,
:class:`~django.db.models.functions.SHA224`,
:class:`~django.db.models.functions.SHA256`,
:class:`~django.db.models.functions.SHA384`, and
:class:`~django.db.models.functions.SHA512`.
* Added the :class:`~django.db.models.functions.Sign` database function.
* The new ``is_dst`` parameter of the
:class:`~django.db.models.functions.Trunc` database functions determines the
treatment of nonexistent and ambiguous datetimes.
* ``connection.queries`` now shows ``COPY … TO`` statements on PostgreSQL.
* :class:`~django.db.models.FilePathField` now accepts a callable for ``path``.
* Allowed symmetrical intermediate table for self-referential
:class:`~django.db.models.ManyToManyField`.
* The ``name`` attributes of :class:`~django.db.models.CheckConstraint`,
:class:`~django.db.models.UniqueConstraint`, and
:class:`~django.db.models.Index` now support app label and class
interpolation using the ``'%(app_label)s'`` and ``'%(class)s'`` placeholders.
* The new :attr:`.Field.descriptor_class` attribute allows model fields to
customize the get and set behavior by overriding their
:py:ref:`descriptors <descriptors>`.
* :class:`~django.db.models.Avg` and :class:`~django.db.models.Sum` now support
the ``distinct`` argument.
* Added :class:`~django.db.models.SmallAutoField` which acts much like an
:class:`~django.db.models.AutoField` except that it only allows values under
a certain (database-dependent) limit. Values from ``1`` to ``32767`` are safe
in all databases supported by Django.
* :class:`~django.db.models.AutoField`,
:class:`~django.db.models.BigAutoField`, and
:class:`~django.db.models.SmallAutoField` now inherit from
``IntegerField``, ``BigIntegerField`` and ``SmallIntegerField`` respectively.
System checks and validators are now also properly inherited.
* :attr:`.FileField.upload_to` now supports :class:`pathlib.Path`.
* :class:`~django.db.models.CheckConstraint` is now supported on MySQL 8.0.16+.
* The new ``allows_group_by_selected_pks_on_model()`` method of
``django.db.backends.base.BaseDatabaseFeatures`` allows optimization of
``GROUP BY`` clauses to require only the selected models' primary keys. By
default, it's supported only for managed models on PostgreSQL.
To enable the ``GROUP BY`` primary key-only optimization for unmanaged
models, you have to subclass the PostgreSQL database engine, overriding the
features class ``allows_group_by_selected_pks_on_model()`` method as you
require. See :ref:`Subclassing the built-in database backends
<subclassing-database-backends>` for an example.
Requests and Responses
~~~~~~~~~~~~~~~~~~~~~~
* Allowed :class:`~django.http.HttpResponse` to be initialized with
:class:`memoryview` content.
* For use in, for example, Django templates, :attr:`.HttpRequest.headers` now
allows lookups using underscores (e.g. ``user_agent``) in place of hyphens.
.. _whats-new-security-3.0:
Security
~~~~~~~~
* :setting:`X_FRAME_OPTIONS` now defaults to ``'DENY'``. In older versions, the
:setting:`X_FRAME_OPTIONS` setting defaults to ``'SAMEORIGIN'``. If your site
uses frames of itself, you will need to explicitly set ``X_FRAME_OPTIONS =
'SAMEORIGIN'`` for them to continue working.
* :setting:`SECURE_CONTENT_TYPE_NOSNIFF` now defaults to ``True``. With this
enabled, :class:`~django.middleware.security.SecurityMiddleware` sets the
:ref:`x-content-type-options` header on all responses that do not already
have it.
* :class:`~django.middleware.security.SecurityMiddleware` can now send the
:ref:`Referrer-Policy <referrer-policy>` header.
Tests
~~~~~
* The new test :class:`~django.test.Client` argument
``raise_request_exception`` allows controlling whether or not exceptions
raised during the request should also be raised in the test. The value
defaults to ``True`` for backwards compatibility. If it is ``False`` and an
exception occurs, the test client will return a 500 response with the
attribute :attr:`~django.test.Response.exc_info`, a tuple providing
information of the exception that occurred.
* Tests and test cases to run can be selected by test name pattern using the
new :option:`test -k` option.
* HTML comparison, as used by
:meth:`~django.test.SimpleTestCase.assertHTMLEqual`, now treats text, character
references, and entity references that refer to the same character as
equivalent.
* Django test runner now supports headless mode for selenium tests on supported
browsers. Add the ``--headless`` option to enable this mode.
* Django test runner now supports ``--start-at`` and ``--start-after`` options
to run tests starting from a specific top-level module.
* Django test runner now supports a ``--pdb`` option to spawn a debugger at
each error or failure.
.. _backwards-incompatible-3.0:
Backwards incompatible changes in 3.0
=====================================
``Model.save()`` when providing a default for the primary key
-------------------------------------------------------------
:meth:`.Model.save` no longer attempts to find a row when saving a new
``Model`` instance and a default value for the primary key is provided, and
always performs a single ``INSERT`` query. In older Django versions,
``Model.save()`` performed either an ``INSERT`` or an ``UPDATE`` based on
whether or not the row exists.
This makes calling ``Model.save()`` while providing a default primary key value
equivalent to passing :ref:`force_insert=True <ref-models-force-insert>` to
model's ``save()``. Attempts to use a new ``Model`` instance to update an
existing row will result in an ``IntegrityError``.
In order to update an existing model for a specific primary key value, use the
:meth:`~django.db.models.query.QuerySet.update_or_create` method or
``QuerySet.filter(pk=…).update(…)`` instead. For example::
>>> MyModel.objects.update_or_create(pk=existing_pk, defaults={'name': 'new name'})
>>> MyModel.objects.filter(pk=existing_pk).update(name='new name')
Database backend API
--------------------
This section describes changes that may be needed in third-party database
backends.
* The second argument of ``DatabaseIntrospection.get_geometry_type()`` is now
the row description instead of the column name.
* ``DatabaseIntrospection.get_field_type()`` may no longer return tuples.
* If the database can create foreign keys in the same SQL statement that adds a
field, add ``SchemaEditor.sql_create_column_inline_fk`` with the appropriate
SQL; otherwise, set ``DatabaseFeatures.can_create_inline_fk = False``.
* ``DatabaseFeatures.can_return_id_from_insert`` and
``can_return_ids_from_bulk_insert`` are renamed to
``can_return_columns_from_insert`` and ``can_return_rows_from_bulk_insert``.
* Database functions now handle :class:`datetime.timezone` formats when created
using :class:`datetime.timedelta` instances (e.g.
``timezone(timedelta(hours=5))``, which would output ``'UTC+05:00'``).
Third-party backends should handle this format when preparing
:class:`~django.db.models.DateTimeField` in ``datetime_cast_date_sql()``,
``datetime_extract_sql()``, etc.
* Entries for ``AutoField``, ``BigAutoField``, and ``SmallAutoField`` are added
to ``DatabaseOperations.integer_field_ranges`` to support the integer range
validators on these field types. Third-party backends may need to customize
the default entries.
* ``DatabaseOperations.fetch_returned_insert_id()`` is replaced by
``fetch_returned_insert_columns()`` which returns a list of values returned
by the ``INSERT … RETURNING`` statement, instead of a single value.
* ``DatabaseOperations.return_insert_id()`` is replaced by
``return_insert_columns()`` that accepts a ``fields``
argument, which is an iterable of fields to be returned after insert. Usually
this is only the auto-generated primary key.
:mod:`django.contrib.admin`
---------------------------
* Admin's model history change messages now prefers more readable field labels
instead of field names.
:mod:`django.contrib.gis`
-------------------------
* Support for PostGIS 2.1 is removed.
* Support for SpatiaLite 4.1 and 4.2 is removed.
* Support for GDAL 1.11 and GEOS 3.4 is removed.
Dropped support for PostgreSQL 9.4
----------------------------------
Upstream support for PostgreSQL 9.4 ends in December 2019. Django 3.0 supports
PostgreSQL 9.5 and higher.
Dropped support for Oracle 12.1
-------------------------------
Upstream support for Oracle 12.1 ends in July 2021. Django 2.2 will be
supported until April 2022. Django 3.0 officially supports Oracle 12.2 and 18c.
Removed private Python 2 compatibility APIs
-------------------------------------------
While Python 2 support was removed in Django 2.0, some private APIs weren't
removed from Django so that third party apps could continue using them until
the Python 2 end-of-life.
Since we expect apps to drop Python 2 compatibility when adding support for
Django 3.0, we're removing these APIs at this time.
* ``django.test.utils.str_prefix()`` - Strings don't have 'u' prefixes in
Python 3.
* ``django.test.utils.patch_logger()`` - Use
:meth:`unittest.TestCase.assertLogs` instead.
* ``django.utils.lru_cache.lru_cache()`` - Alias of
:func:`functools.lru_cache`.
* ``django.utils.decorators.available_attrs()`` - This function returns
``functools.WRAPPER_ASSIGNMENTS``.
* ``django.utils.decorators.ContextDecorator`` - Alias of
:class:`contextlib.ContextDecorator`.
* ``django.utils._os.abspathu()`` - Alias of :func:`os.path.abspath`.
* ``django.utils._os.upath()`` and ``npath()`` - These functions do nothing on
Python 3.
* ``django.utils.six`` - Remove usage of this vendored library or switch to
`six <https://pypi.org/project/six/>`_.
* ``django.utils.encoding.python_2_unicode_compatible()`` - Alias of
``six.python_2_unicode_compatible()``.
* ``django.utils.functional.curry()`` - Use :func:`functools.partial` or
:class:`functools.partialmethod`. See :commit:`5b1c389603a353625ae1603`.
* ``django.utils.safestring.SafeBytes`` - Unused since Django 2.0.
New default value for the ``FILE_UPLOAD_PERMISSIONS`` setting
-------------------------------------------------------------
In older versions, the :setting:`FILE_UPLOAD_PERMISSIONS` setting defaults to
``None``. With the default :setting:`FILE_UPLOAD_HANDLERS`, this results in
uploaded files having different permissions depending on their size and which
upload handler is used.
``FILE_UPLOAD_PERMISSION`` now defaults to ``0o644`` to avoid this
inconsistency.
New default values for security settings
----------------------------------------
To make Django projects more secure by default, some security settings now have
more secure default values:
* :setting:`X_FRAME_OPTIONS` now defaults to ``'DENY'``.
* :setting:`SECURE_CONTENT_TYPE_NOSNIFF` now defaults to ``True``.
See the *What's New* :ref:`Security section <whats-new-security-3.0>` above for
more details on these changes.
Miscellaneous
-------------
* ``ContentType.__str__()`` now includes the model's ``app_label`` to
disambiguate models with the same name in different apps.
* Because accessing the language in the session rather than in the cookie is
deprecated, ``LocaleMiddleware`` no longer looks for the user's language in
the session and :func:`django.contrib.auth.logout` no longer preserves the
session's language after logout.
* :func:`django.utils.html.escape` now uses :func:`html.escape` to escape HTML.
This converts ``'`` to ``&x27;`` instead of the previous equivalent decimal
code ``&39;``.
* The ``django-admin test -k`` option now works as the :option:`unittest
-k<unittest.-k>` option rather than as a shortcut for ``--keepdb``.
* Support for ``pywatchman`` < 1.2.0 is removed.
* :func:`~django.utils.http.urlencode` now encodes iterable values as they are
when ``doseq=False``, rather than iterating them, bringing it into line with
the standard library :func:`urllib.parse.urlencode` function.
* ``intword`` template filter now translates ``1.0`` as a singular phrase and
all other numeric values as plural. This may be incorrect for some languages.
* Assigning a value to a model's :class:`~django.db.models.ForeignKey` or
:class:`~django.db.models.OneToOneField` ``'_id'`` attribute now unsets the
corresponding field. Accessing the field afterwards will result in a query.
* :func:`~django.utils.cache.patch_vary_headers` now handles an asterisk
``'*'`` according to :rfc:`7231section-7.1.4`, i.e. if a list of header
field names contains an asterisk, then the ``Vary`` header will consist of a
single asterisk ``'*'``.
* On MySQL 8.0.16+, ``PositiveIntegerField`` and ``PositiveSmallIntegerField``
now include a check constraint to prevent negative values in the database.
* ``alias=None`` is added to the signature of
:meth:`.Expression.get_group_by_cols`.
* Support for ``sqlparse`` < 0.2.2 is removed.
* ``RegexPattern``, used by :func:`~django.urls.re_path`, no longer returns
keyword arguments with ``None`` values to be passed to the view for the
optional named groups that are missing.
.. _deprecated-features-3.0:
Features deprecated in 3.0
==========================
``django.utils.encoding.force_text()`` and ``smart_text()``
-----------------------------------------------------------
The ``smart_text()`` and ``force_text()`` aliases (since Django 2.0) of
``smart_str()`` and ``force_str()`` are deprecated. Ignore this deprecation if
your code supports Python 2 as the behavior of ``smart_str()`` and
``force_str()`` is different there.
Miscellaneous
-------------
* ``django.utils.http.urlquote()``, ``urlquote_plus()``, ``urlunquote()``, and
``urlunquote_plus()`` are deprecated in favor of the functions that they're
aliases for: :func:`urllib.parse.quote`, :func:`~urllib.parse.quote_plus`,
:func:`~urllib.parse.unquote`, and :func:`~urllib.parse.unquote_plus`.
* ``django.utils.translation.ugettext()``, ``ugettext_lazy()``,
``ugettext_noop()``, ``ungettext()``, and ``ungettext_lazy()`` are deprecated
in favor of the functions that they're aliases for:
:func:`django.utils.translation.gettext`,
:func:`~django.utils.translation.gettext_lazy`,
:func:`~django.utils.translation.gettext_noop`,
:func:`~django.utils.translation.ngettext`, and
:func:`~django.utils.translation.ngettext_lazy`.
* To limit creation of sessions and hence favor some caching strategies,
:func:`django.views.i18n.set_language` will stop setting the user's language
in the session in Django 4.0. Since Django 2.1, the language is always stored
in the :setting:`LANGUAGE_COOKIE_NAME` cookie.
* ``django.utils.text.unescape_entities()`` is deprecated in favor of
:func:`html.unescape`. Note that unlike ``unescape_entities()``,
``html.unescape()`` evaluates lazy strings immediately.
* To avoid possible confusion as to effective scope, the private internal
utility ``is_safe_url()`` is renamed to
``url_has_allowed_host_and_scheme()``. That a URL has an allowed host and
scheme doesn't in general imply that it's "safe". It may still be quoted
incorrectly, for example. Ensure to also use
:func:`~django.utils.encoding.iri_to_uri` on the path component of untrusted
URLs.
.. _removed-features-3.0:
Features removed in 3.0
=======================
These features have reached the end of their deprecation cycle and are removed
in Django 3.0.
See :ref:`deprecated-features-2.0` for details on these changes, including how
to remove usage of these features.
* The ``django.db.backends.postgresql_psycopg2`` module is removed.
* ``django.shortcuts.render_to_response()`` is removed.
* The ``DEFAULT_CONTENT_TYPE`` setting is removed.
* ``HttpRequest.xreadlines()`` is removed.
* Support for the ``context`` argument of ``Field.from_db_value()`` and
``Expression.convert_value()`` is removed.
* The ``field_name`` keyword argument of ``QuerySet.earliest()`` and
``latest()`` is removed.
See :ref:`deprecated-features-2.1` for details on these changes, including how
to remove usage of these features.
* The ``ForceRHR`` GIS function is removed.
* ``django.utils.http.cookie_date()`` is removed.
* The ``staticfiles`` and ``admin_static`` template tag libraries are removed.
* ``django.contrib.staticfiles.templatetags.staticfiles.static()`` is removed.
===========================
```
### 2.2.12
```
===========================
*April 1, 2020*
Django 2.2.12 fixes a bug in 2.2.11.
Bugfixes
========
* Added the ability to handle ``.po`` files containing different plural
equations for the same language (:ticket:`30439`).
===========================
```
### 2.2.11
```
===========================
*March 4, 2020*
Django 2.2.11 fixes a security issue and a data loss bug in 2.2.10.
CVE-2020-9402: Potential SQL injection via ``tolerance`` parameter in GIS functions and aggregates on Oracle
============================================================================================================
GIS functions and aggregates on Oracle were subject to SQL injection,
using a suitably crafted ``tolerance``.
Bugfixes
========
* Fixed a data loss possibility in the
:meth:`~django.db.models.query.QuerySet.select_for_update`. When using
related fields or parent link fields with :ref:`multi-table-inheritance` in
the ``of`` argument, the corresponding models were not locked
(:ticket:`31246`).
===========================
```
### 2.2.10
```
===========================
*February 3, 2020*
Django 2.2.10 fixes a security issue in 2.2.9.
CVE-2020-7471: Potential SQL injection via ``StringAgg(delimiter)``
===================================================================
:class:`~django.contrib.postgres.aggregates.StringAgg` aggregation function was
subject to SQL injection, using a suitably crafted ``delimiter``.
==========================
```
### 2.2.9
```
==========================
*December 18, 2019*
Django 2.2.9 fixes a security issue and a data loss bug in 2.2.8.
CVE-2019-19844: Potential account hijack via password reset form
================================================================
By submitting a suitably crafted email address making use of Unicode
characters, that compared equal to an existing user email when lower-cased for
comparison, an attacker could be sent a password reset token for the matched
account.
In order to avoid this vulnerability, password reset requests now compare the
submitted email using the stricter, recommended algorithm for case-insensitive
comparison of two identifiers from `Unicode Technical Report 36, section
2.11.2(B)(2)`__. Upon a match, the email containing the reset token will be
sent to the email address on record rather than the submitted address.
.. __: https://www.unicode.org/reports/tr36/Recommendations_General
Bugfixes
========
* Fixed a data loss possibility in
:class:`~django.contrib.postgres.forms.SplitArrayField`. When using with
``ArrayField(BooleanField())``, all values after the first ``True`` value
were marked as checked instead of preserving passed values (:ticket:`31073`).
==========================
```
### 2.2.8
```
==========================
*December 2, 2019*
Django 2.2.8 fixes a security issue, several bugs in 2.2.7, and adds
compatibility with Python 3.8.
CVE-2019-19118: Privilege escalation in the Django admin.
=========================================================
Since Django 2.1, a Django model admin displaying a parent model with related
model inlines, where the user has view-only permissions to a parent model but
edit permissions to the inline model, would display a read-only view of the
parent model but editable forms for the inline.
Submitting these forms would not allow direct edits to the parent model, but
would trigger the parent model's ``save()`` method, and cause pre and post-save
signal handlers to be invoked. This is a privilege escalation as a user who
lacks permission to edit a model should not be able to trigger its save-related
signals.
To resolve this issue, the permission handling code of the Django admin
interface has been changed. Now, if a user has only the "view" permission for a
parent model, the entire displayed form will not be editable, even if the user
has permission to edit models included in inlines.
This is a backwards-incompatible change, and the Django security team is aware
that some users of Django were depending on the ability to allow editing of
inlines in the admin form of an otherwise view-only parent model.
Given the complexity of the Django admin, and in-particular the permissions
related checks, it is the view of the Django security team that this change was
necessary: that it is not currently feasible to maintain the existing behavior
whilst escaping the potential privilege escalation in a way that would avoid a
recurrence of similar issues in the future, and that would be compatible with
Django's *safe by default* philosophy.
For the time being, developers whose applications are affected by this change
should replace the use of inlines in read-only parents with custom forms and
views that explicitly implement the desired functionality. In the longer term,
adding a documented, supported, and properly-tested mechanism for
partially-editable multi-model forms to the admin interface may occur in Django
itself.
Bugfixes
========
* Fixed a data loss possibility in the admin changelist view when a custom
:ref:`formset's prefix <formset-prefix>` contains regular expression special
characters, e.g. ``'$'`` (:ticket:`31031`).
* Fixed a regression in Django 2.2.1 that caused a crash when migrating
permissions for proxy models with a multiple database setup if the
``default`` entry was empty (:ticket:`31021`).
* Fixed a data loss possibility in the
:meth:`~django.db.models.query.QuerySet.select_for_update()`. When using
``'self'`` in the ``of`` argument with :ref:`multi-table inheritance
<multi-table-inheritance>`, a parent model was locked instead of the
queryset's model (:ticket:`30953`).
==========================
```
### 2.2.7
```
==========================
*November 4, 2019*
Django 2.2.7 fixes several bugs in 2.2.6.
Bugfixes
========
* Fixed a crash when using a ``contains``, ``contained_by``, ``has_key``,
``has_keys``, or ``has_any_keys`` lookup on
:class:`~django.contrib.postgres.fields.JSONField`, if the right or left hand
side of an expression is a key transform (:ticket:`30826`).
* Prevented :option:`migrate --plan` from showing that ``RunPython`` operations
are irreversible when ``reverse_code`` callables don't have docstrings or
when showing a forward migration plan (:ticket:`30870`).
* Fixed migrations crash on PostgreSQL when adding an
:class:`~django.db.models.Index` with fields ordering and
:attr:`~.Index.opclasses` (:ticket:`30903`).
* Restored the ability to override
:meth:`~django.db.models.Model.get_FOO_display` (:ticket:`30931`).
==========================
```
### 2.2.6
```
==========================
*October 1, 2019*
Django 2.2.6 fixes several bugs in 2.2.5.
Bugfixes
========
* Fixed migrations crash on SQLite when altering a model containing partial
indexes (:ticket:`30754`).
* Fixed a regression in Django 2.2.4 that caused a crash when filtering with a
``Subquery()`` annotation of a queryset containing
:class:`~django.contrib.postgres.fields.JSONField` or
:class:`~django.contrib.postgres.fields.HStoreField` (:ticket:`30769`).
==========================
```
### 2.2.5
```
==========================
*September 2, 2019*
Django 2.2.5 fixes several bugs in 2.2.4.
Bugfixes
========
* Relaxed the system check added in Django 2.2 for models to reallow use of the
same ``db_table`` by multiple models when database routers are installed
(:ticket:`30673`).
* Fixed crash of ``KeyTransform()`` for
:class:`~django.contrib.postgres.fields.JSONField` and
:class:`~django.contrib.postgres.fields.HStoreField` when using on
expressions with params (:ticket:`30672`).
* Fixed a regression in Django 2.2 where
:attr:`ModelAdmin.list_filter <django.contrib.admin.ModelAdmin.list_filter>`
choices to foreign objects don't respect a model's ``Meta.ordering``
(:ticket:`30449`).
==========================
```
### 2.2.4
```
==========================
*August 1, 2019*
Django 2.2.4 fixes security issues and several bugs in 2.2.3.
CVE-2019-14232: Denial-of-service possibility in ``django.utils.text.Truncator``
================================================================================
If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods
were passed the ``html=True`` argument, they were extremely slow to evaluate
certain inputs due to a catastrophic backtracking vulnerability in a regular
expression. The ``chars()`` and ``words()`` methods are used to implement the
:tfilter:`truncatechars_html` and :tfilter:`truncatewords_html` template
filters, which were thus vulnerable.
The regular expressions used by ``Truncator`` have been simplified in order to
avoid potential backtracking issues. As a consequence, trailing punctuation may
now at times be included in the truncated output.
CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``
=================================================================
Due to the behavior of the underlying ``HTMLParser``,
:func:`django.utils.html.strip_tags` would be extremely slow to evaluate
certain inputs containing large sequences of nested incomplete HTML entities.
The ``strip_tags()`` method is used to implement the corresponding
:tfilter:`striptags` template filter, which was thus also vulnerable.
``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress
removing tags, but necessarily incomplete HTML entities, stops being made.
Remember that absolutely NO guarantee is provided about the results of
``strip_tags()`` being HTML safe. So NEVER mark safe the result of a
``strip_tags()`` call without escaping it first, for example with
:func:`django.utils.html.escape`.
CVE-2019-14234: SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField``
====================================================================================================
:lookup:`Key and index lookups <jsonfield.key>` for
:class:`~django.contrib.postgres.fields.JSONField` and :lookup:`key lookups
<hstorefield.key>` for :class:`~django.contrib.postgres.fields.HStoreField`
were subject to SQL injection, using a suitably crafted dictionary, with
dictionary expansion, as the ``**kwargs`` passed to ``QuerySet.filter()``.
CVE-2019-14235: Potential memory exhaustion in ``django.utils.encoding.uri_to_iri()``
=====================================================================================
If passed certain inputs, :func:`django.utils.encoding.uri_to_iri` could lead
to significant memory usage due to excessive recursion when re-percent-encoding
invalid UTF-8 octet sequences.
``uri_to_iri()`` now avoids recursion when re-percent-encoding invalid UTF-8
octet sequences.
Bugfixes
========
* Fixed a regression in Django 2.2 when ordering a ``QuerySet.union()``,
``intersection()``, or ``difference()`` by a field type present more than
once results in the wrong ordering being used (:ticket:`30628`).
* Fixed a migration crash on PostgreSQL when adding a check constraint
with a ``contains`` lookup on
:class:`~django.contrib.postgres.fields.DateRangeField` or
:class:`~django.contrib.postgres.fields.DateTimeRangeField`, if the right
hand side of an expression is the same type (:ticket:`30621`).
* Fixed a regression in Django 2.2 where auto-reloader crashes if a file path
contains nulls characters (``'\x00'``) (:ticket:`30506`).
* Fixed a regression in Django 2.2 where auto-reloader crashes if a translation
directory cannot be resolved (:ticket:`30647`).
==========================
```
### 2.2.3
```
==========================
*July 1, 2019*
Django 2.2.3 fixes a security issue and several bugs in 2.2.2. Also, the latest
string translations from Transifex are incorporated.
CVE-2019-12781: Incorrect HTTP detection with reverse-proxy connecting via HTTPS
--------------------------------------------------------------------------------
When deployed behind a reverse-proxy connecting to Django via HTTPS,
:attr:`django.http.HttpRequest.scheme` would incorrectly detect client
requests made via HTTP as using HTTPS. This entails incorrect results for
:meth:`~django.http.HttpRequest.is_secure`, and
:meth:`~django.http.HttpRequest.build_absolute_uri`, and that HTTP
requests would not be redirected to HTTPS in accordance with
:setting:`SECURE_SSL_REDIRECT`.
``HttpRequest.scheme`` now respects :setting:`SECURE_PROXY_SSL_HEADER`, if it is
configured, and the appropriate header is set on the request, for both HTTP and
HTTPS requests.
If you deploy Django behind a reverse-proxy that forwards HTTP requests, and
that connects to Django via HTTPS, be sure to verify that your application
correctly handles code paths relying on ``scheme``, ``is_secure()``,
``build_absolute_uri()``, and ``SECURE_SSL_REDIRECT``.
Bugfixes
========
* Fixed a regression in Django 2.2 where :class:`~django.db.models.Avg`,
:class:`~django.db.models.StdDev`, and :class:`~django.db.models.Variance`
crash with ``filter`` argument (:ticket:`30542`).
* Fixed a regression in Django 2.2.2 where auto-reloader crashes with
``AttributeError``, e.g. when using ``ipdb`` (:ticket:`30588`).
==========================
```
### 2.2.2
```
==========================
*June 3, 2019*
Django 2.2.2 fixes security issues and several bugs in 2.2.1.
CVE-2019-12308: AdminURLFieldWidget XSS
---------------------------------------
The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayed
the provided value without validating it as a safe URL. Thus, an unvalidated
value stored in the database, or a value provided as a URL query parameter
payload, could result in an clickable JavaScript link.
``AdminURLFieldWidget`` now validates the provided value using
:class:`~django.core.validators.URLValidator` before displaying the clickable
link. You may customize the validator by passing a ``validator_class`` kwarg to
``AdminURLFieldWidget.__init__()``, e.g. when using
:attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`.
Patched bundled jQuery for CVE-2019-11358: Prototype pollution
--------------------------------------------------------------
jQuery before 3.4.0, mishandles ``jQuery.extend(true, {}, ...)`` because of
``Object.prototype`` pollution. If an unsanitized source object contained an
enumerable ``__proto__`` property, it could extend the native
``Object.prototype``.
The bundled version of jQuery used by the Django admin has been patched to
allow for the ``select2`` library's use of ``jQuery.extend()``.
Bugfixes
========
* Fixed a regression in Django 2.2 that stopped Show/Hide toggles working on
dynamically added admin inlines (:ticket:`30459`).
* Fixed a regression in Django 2.2 where deprecation message crashes if
``Meta.ordering`` contains an expression (:ticket:`30463`).
* Fixed a regression in Django 2.2.1 where
:class:`~django.contrib.postgres.search.SearchVector` generates SQL with a
redundant ``Coalesce`` call (:ticket:`30488`).
* Fixed a regression in Django 2.2 where auto-reloader doesn't detect changes
in ``manage.py`` file when using ``StatReloader`` (:ticket:`30479`).
* Fixed crash of :class:`~django.contrib.postgres.aggregates.ArrayAgg` and
:class:`~django.contrib.postgres.aggregates.StringAgg` with ``ordering``
argument when used in a ``Subquery`` (:ticket:`30315`).
* Fixed a regression in Django 2.2 that caused a crash of auto-reloader when
an exception with custom signature is raised (:ticket:`30516`).
* Fixed a regression in Django 2.2.1 where auto-reloader unnecessarily reloads
translation files multiple times when using ``StatReloader``
(:ticket:`30523`).
==========================
```
### 2.2.1
```
==========================
*May 1, 2019*
Django 2.2.1 fixes several bugs in 2.2.
Bugfixes
========
* Fixed a regression in Django 2.1 that caused the incorrect quoting of
database user password when using :djadmin:`dbshell` on Oracle
(:ticket:`30307`).
* Added compatibility for ``psycopg2`` 2.8 (:ticket:`30331`).
* Fixed a regression in Django 2.2 that caused a crash when loading the
template for the technical 500 debug page (:ticket:`30324`).
* Fixed crash of ``ordering`` argument in
:class:`~django.contrib.postgres.aggregates.ArrayAgg` and
:class:`~django.contrib.postgres.aggregates.StringAgg` when it contains an
expression with params (:ticket:`30332`).
* Fixed a regression in Django 2.2 that caused a single instance fast-delete
to not set the primary key to ``None`` (:ticket:`30330`).
* Prevented :djadmin:`makemigrations` from generating infinite migrations for
check constraints and partial indexes when ``condition`` contains
a :class:`~python:range` object (:ticket:`30350`).
* Reverted an optimization in Django 2.2 (:ticket:`29725`) that caused the
inconsistent behavior of ``count()`` and ``exists()`` on a reverse
many-to-many relationship with a custom manager (:ticket:`30325`).
* Fixed a regression in Django 2.2 where
:class:`~django.core.paginator.Paginator` crashes if ``object_list`` is
a queryset ordered or aggregated over a nested ``JSONField`` key transform
(:ticket:`30335`).
* Fixed a regression in Django 2.2 where ``IntegerField`` validation of
database limits crashes if ``limit_value`` attribute in a custom validator is
callable (:ticket:`30328`).
* Fixed a regression in Django 2.2 where
:class:`~django.contrib.postgres.search.SearchVector` generates SQL that is
not indexable (:ticket:`30385`).
* Fixed a regression in Django 2.2 that caused an exception to be raised when
a custom error handler could not be imported (:ticket:`30318`).
* Relaxed the system check added in Django 2.2 for the admin app's dependencies
to reallow use of
:class:`~django.contrib.sessions.middleware.SessionMiddleware` subclasses,
rather than requiring :mod:`django.contrib.sessions` to be in
:setting:`INSTALLED_APPS` (:ticket:`30312`).
* Increased the default timeout when using ``Watchman`` to 5 seconds to prevent
falling back to ``StatReloader`` on larger projects and made it customizable
via the :envvar:`DJANGO_WATCHMAN_TIMEOUT` environment variable
(:ticket:`30361`).
* Fixed a regression in Django 2.2 that caused a crash when migrating
permissions for proxy models if the target permissions already existed. For
example, when a permission had been created manually or a model had been
migrated from concrete to proxy (:ticket:`30351`).
* Fixed a regression in Django 2.2 that caused a crash of :djadmin:`runserver`
when URLConf modules raised exceptions (:ticket:`30323`).
* Fixed a regression in Django 2.2 where changes were not reliably detected by
auto-reloader when using ``StatReloader`` (:ticket:`30323`).
* Fixed a migration crash on Oracle and PostgreSQL when adding a check
constraint with a ``contains``, ``startswith``, or ``endswith`` lookup (or
their case-insensitive variant) (:ticket:`30408`).
* Fixed a migration crash on Oracle and SQLite when adding a check constraint
with ``condition`` contains ``|`` (``OR``) operator (:ticket:`30412`).
========================
```
### 2.2
```
========================
*April 1, 2019*
Welcome to Django 2.2!
These release notes cover the :ref:`new features <whats-new-2.2>`, as well as
some :ref:`backwards incompatible changes <backwards-incompatible-2.2>` you'll
want to be aware of when upgrading from Django 2.1 or earlier. We've
:ref:`begun the deprecation process for some features
<deprecated-features-2.2>`.
See the :doc:`/howto/upgrade-version` guide if you're updating an existing
project.
Django 2.2 is designated as a :term:`long-term support release
<Long-term support release>`. It will receive security updates for at least
three years after its release. Support for the previous LTS, Django 1.11, will
end in April 2020.
Python compatibility
====================
Django 2.2 supports Python 3.5, 3.6, 3.7, and 3.8 (as of 2.2.8). We
**highly recommend** and only officially support the latest release of each
series.
.. _whats-new-2.2:
What's new in Django 2.2
========================
Constraints
-----------
The new :class:`~django.db.models.CheckConstraint` and
:class:`~django.db.models.UniqueConstraint` classes enable adding custom
database constraints. Constraints are added to models using the
:attr:`Meta.constraints <django.db.models.Options.constraints>` option.
Minor features
--------------
:mod:`django.contrib.admin`
~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Added a CSS class to the column headers of
:class:`~django.contrib.admin.TabularInline`.
:mod:`django.contrib.auth`
~~~~~~~~~~~~~~~~~~~~~~~~~~
* The ``HttpRequest`` is now passed as the first positional argument to
:meth:`.RemoteUserBackend.configure_user`, if it accepts it.
:mod:`django.contrib.gis`
~~~~~~~~~~~~~~~~~~~~~~~~~
* Added Oracle support for the
:class:`~django.contrib.gis.db.models.functions.Envelope` function.
* Added SpatiaLite support for the :lookup:`coveredby` and :lookup:`covers`
lookups.
:mod:`django.contrib.postgres`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* The new ``ordering`` argument for
:class:`~django.contrib.postgres.aggregates.ArrayAgg` and
:class:`~django.contrib.postgres.aggregates.StringAgg` determines the
ordering of the aggregated elements.
* The new :class:`~django.contrib.postgres.indexes.BTreeIndex`,
:class:`~django.contrib.postgres.indexes.HashIndex` and
:class:`~django.contrib.postgres.indexes.SpGistIndex` classes allow
creating ``B-Tree``, ``hash``, and ``SP-GiST`` indexes in the database.
* :class:`~django.contrib.postgres.indexes.BrinIndex` now has the
``autosummarize`` parameter.
* The new ``search_type`` parameter of
:class:`~django.contrib.postgres.search.SearchQuery` allows searching for
a phrase or raw expression.
:mod:`django.contrib.staticfiles`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Added path matching to the :option:`collectstatic --ignore` option so that
patterns like ``/vendor/*.js`` can be used.
Database backends
~~~~~~~~~~~~~~~~~
* Added result streaming for :meth:`.QuerySet.iterator` on SQLite.
Generic Views
~~~~~~~~~~~~~
* The new :meth:`View.setup <django.views.generic.base.View.setup>` hook
initializes view attributes before calling
:meth:`~django.views.generic.base.View.dispatch`. It allows mixins to setup
instance attributes for reuse in child classes.
Internationalization
~~~~~~~~~~~~~~~~~~~~
* Added support and translations for the Armenian language.
Management Commands
~~~~~~~~~~~~~~~~~~~
* The new :option:`--force-color` option forces colorization of the command
output.
* :djadmin:`inspectdb` now creates models for foreign tables on PostgreSQL.
* :option:`inspectdb --include-views` now creates models for materialized views
on Oracle and PostgreSQL.
* The new :option:`inspectdb --include-partitions` option allows creating
models for partition tables on PostgreSQL. In older versions, models are
created child tables instead the parent.
* :djadmin:`inspectdb` now introspects :class:`~django.db.models.DurationField`
for Oracle and PostgreSQL, and :class:`~django.db.models.AutoField` for
SQLite.
* On Oracle, :djadmin:`dbshell` is wrapped with ``rlwrap``, if available.
``rlwrap`` provides a command history and editing of keyboard input.
* The new :option:`makemigrations --no-header` option avoids writing header
comments in generated migration file(s). This option is also available for
:djadmin:`squashmigrations`.
* :djadmin:`runserver` can now use `Watchman
<https://facebook.github.io/watchman/>`_ to improve the performance of
watching a large number of files for changes.
Migrations
~~~~~~~~~~
* The new :option:`migrate --plan` option prints the list of migration
operations that will be performed.
* ``NoneType`` can now be serialized in migrations.
* You can now :ref:`register custom serializers <custom-migration-serializers>`
for migrations.
Models
~~~~~~
* Added support for PostgreSQL operator classes (:attr:`.Index.opclasses`).
* Added support for partial indexes (:attr:`.Index.condition`).
* Added the :class:`~django.db.models.functions.NullIf` and
:class:`~django.db.models.functions.Reverse` database functions, as well as
many :ref:`math database functions <math-functions>`.
* Setting the new ``ignore_conflicts`` parameter of
:meth:`.QuerySet.bulk_create` to ``True`` tells the database to ignore
failure to insert rows that fail uniqueness constraints or other checks.
* The new :class:`~django.db.models.functions.ExtractIsoYear` function extracts
ISO-8601 week-numbering years from :class:`~django.db.models.DateField` and
:class:`~django.db.models.DateTimeField`, and the new :lookup:`iso_year`
lookup allows querying by an ISO-8601 week-numbering year.
* The new :meth:`.QuerySet.bulk_update` method allows efficiently updating
specific fields on multiple model instances.
* Django no longer always starts a transaction when a single query is being
performed, such as ``Model.save()``, ``QuerySet.update()``, and
``Model.delete()``. This improves the performance of autocommit by reducing
the number of database round trips.
* Added SQLite support for the :class:`~django.db.models.StdDev` and
:class:`~django.db.models.Variance` functions.
* The handling of ``DISTINCT`` aggregation is added to the
:class:`~django.db.models.Aggregate` class. Adding :attr:`allow_distinct =
True <django.db.models.Aggregate.allow_distinct>` as a class attribute on
``Aggregate`` subclasses allows a ``distinct`` keyword argument to be
specified on initialization to ensure that the aggregate function is only
called for each distinct value of ``expressions``.
* The :meth:`.RelatedManager.add`, :meth:`~.RelatedManager.create`,
:meth:`~.RelatedManager.remove`, :meth:`~.RelatedManager.set`,
``get_or_create()``, and ``update_or_create()`` methods are now allowed on
many-to-many relationships with intermediate models. The new
``through_defaults`` argument is used to specify values for new intermediate
model instance(s).
Requests and Responses
~~~~~~~~~~~~~~~~~~~~~~
* Added :attr:`.HttpRequest.headers` to allow simple access to a request's
headers.
Serialization
~~~~~~~~~~~~~
* You can now deserialize data using natural keys containing :ref:`forward
references <natural-keys-and-forward-references>` by passing
``handle_forward_references=True`` to ``serializers.deserialize()``.
Additionally, :djadmin:`loaddata` handles forward references automatically.
Tests
~~~~~
* The new :meth:`.SimpleTestCase.assertURLEqual` assertion checks for a given
URL, ignoring the ordering of the query string.
:meth:`~.SimpleTestCase.assertRedirects` uses the new assertion.
* The test :class:`~.django.test.Client` now supports automatic JSON
serialization of list and tuple ``data`` when
``content_type='application/json'``.
* The new :setting:`ORACLE_MANAGED_FILES <TEST_ORACLE_MANAGED_FILES>` test
database setting allows using Oracle Managed Files (OMF) tablespaces.
* Deferrable database constraints are now checked at the end of each
:class:`~django.test.TestCase` test on SQLite 3.20+, just like on other
backends that support deferrable constraints. These checks aren't implemented
for older versions of SQLite because they would require expensive table
introspection there.
* :class:`~django.test.runner.DiscoverRunner` now skips the setup of databases
not :ref:`referenced by tests<testing-multi-db>`.
URLs
~~~~
* The new :attr:`.ResolverMatch.route` attribute stores the route of the
m
Update twine from 1.15.0 to 3.1.1.
Changelog
### 3.1.1 ``` * :bug:`548` Restore ``--non-interactive`` as a flag not expecting an argument. ``` ### 3.1.0 ``` * :feature:`547` Add support for specifying ``--non-interactive`` as an environment variable. ``` ### 3.0.0 ``` * :feature:`336` When a client certificate is indicated, all password processing is disabled. * :feature:`489` Add ``--non-interactive`` flag to abort upload rather than interactively prompt if credentials are missing. * :feature:`524` Twine now unconditionally requires the keyring library and no longer supports uninstalling ``keyring`` as a means to disable that functionality. Instead, use ``keyring --disable`` keyring functionality if necessary. * :feature:`518` Add Python 3.8 to classifiers. * :bug:`332 major` More robust handling of server response in ``--skip-existing`` ``` ### 2.0.0 ``` * :feature:`437` Twine now requires Python 3.6 or later. Use pip 9 or pin to "twine<2" to install twine on older Python versions. * :bug:`491 major` Require requests 2.20 or later to avoid reported security vulnerabilities in earlier releases. ```Links
- PyPI: https://pypi.org/project/twine - Changelog: https://pyup.io/changelogs/twine/ - Docs: https://twine.readthedocs.io/Update coverage from 5.0.3 to 5.1.
Changelog
### 5.1 ``` -------------------------- - The JSON report now includes counts of covered and missing branches. Thanks, Salvatore Zagaria. - On Python 3.8, try-finally-return reported wrong branch coverage with decorated async functions (`issue 946`_). This is now fixed. Thanks, Kjell Braden. - The :meth:`~coverage.Coverage.get_option` and :meth:`~coverage.Coverage.set_option` methods can now manipulate the ``[paths]`` configuration setting. Thanks to Bernát Gábor for the fix for `issue 967`_. .. _issue 946: https://github.com/nedbat/coveragepy/issues/946 .. _issue 967: https://github.com/nedbat/coveragepy/issues/967 .. _changes_504: ``` ### 5.0.4 ``` ---------------------------- - If using the ``[run] relative_files`` setting, the XML report will use relative files in the ``<source>`` elements indicating the location of source code. Closes `issue 948`_. - The textual summary report could report missing lines with negative line numbers on PyPy3 7.1 (`issue 943`_). This is now fixed. - Windows wheels for Python 3.8 were incorrectly built, but are now fixed. (`issue 949`_) - Updated Python 3.9 support to 3.9a4. - HTML reports couldn't be sorted if localStorage wasn't available. This is now fixed: sorting works even though the sorting setting isn't retained. (`issue 944`_ and `pull request 945`_). Thanks, Abdeali Kothari. .. _issue 943: https://github.com/nedbat/coveragepy/issues/943 .. _issue 944: https://github.com/nedbat/coveragepy/issues/944 .. _pull request 945: https://github.com/nedbat/coveragepy/pull/945 .. _issue 948: https://github.com/nedbat/coveragepy/issues/948 .. _issue 949: https://github.com/nedbat/coveragepy/issues/949 .. _changes_503: ```Links
- PyPI: https://pypi.org/project/coverage - Changelog: https://pyup.io/changelogs/coverage/ - Repo: https://github.com/nedbat/coveragepyUpdate django from 1.11.29 to 3.0.6.
Changelog
### 3.0.6 ``` ========================== *May 4, 2020* Django 3.0.6 fixes a bug in 3.0.5. Bugfixes ======== * Fixed a regression in Django 3.0 that caused a crash when filtering a ``Subquery()`` annotation of a queryset containing a single related field against a ``SimpleLazyObject`` (:ticket:`31420`). ========================== ``` ### 3.0.5 ``` ========================== *April 1, 2020* Django 3.0.5 fixes several bugs in 3.0.4. Bugfixes ======== * Added the ability to handle ``.po`` files containing different plural equations for the same language (:ticket:`30439`). * Fixed a regression in Django 3.0 where ``QuerySet.values()`` and ``values_list()`` crashed if a queryset contained an aggregation and ``Subquery()`` annotation that collides with a field name (:ticket:`31377`). ========================== ``` ### 3.0.4 ``` ========================== *March 4, 2020* Django 3.0.4 fixes a security issue and several bugs in 3.0.3. CVE-2020-9402: Potential SQL injection via ``tolerance`` parameter in GIS functions and aggregates on Oracle ============================================================================================================ GIS functions and aggregates on Oracle were subject to SQL injection, using a suitably crafted ``tolerance``. Bugfixes ======== * Fixed a data loss possibility when using caching from async code (:ticket:`31253`). * Fixed a regression in Django 3.0 that caused a file response using a temporary file to be closed incorrectly (:ticket:`31240`). * Fixed a data loss possibility in the :meth:`~django.db.models.query.QuerySet.select_for_update`. When using related fields or parent link fields with :ref:`multi-table-inheritance` in the ``of`` argument, the corresponding models were not locked (:ticket:`31246`). * Fixed a regression in Django 3.0 that caused misplacing parameters in logged SQL queries on Oracle (:ticket:`31271`). * Fixed a regression in Django 3.0.3 that caused misplacing parameters of SQL queries when subtracting ``DateField`` or ``DateTimeField`` expressions on MySQL (:ticket:`31312`). * Fixed a regression in Django 3.0 that didn't include subqueries spanning multivalued relations in the ``GROUP BY`` clause (:ticket:`31150`). ========================== ``` ### 3.0.3 ``` ========================== *February 3, 2020* Django 3.0.3 fixes a security issue and several bugs in 3.0.2. CVE-2020-7471: Potential SQL injection via ``StringAgg(delimiter)`` =================================================================== :class:`~django.contrib.postgres.aggregates.StringAgg` aggregation function was subject to SQL injection, using a suitably crafted ``delimiter``. Bugfixes ======== * Fixed a regression in Django 3.0 that caused a crash when subtracting ``DateField``, ``DateTimeField``, or ``TimeField`` from a ``Subquery()`` annotation (:ticket:`31133`). * Fixed a regression in Django 3.0 where ``QuerySet.values()`` and ``values_list()`` crashed if a queryset contained an aggregation and ``Exists()`` annotation (:ticket:`31136`). * Relaxed the system check added in Django 3.0 to reallow use of a sublanguage in the :setting:`LANGUAGE_CODE` setting, when a base language is available in Django but the sublanguage is not (:ticket:`31141`). * Added support for using enumeration types ``TextChoices``, ``IntegerChoices``, and ``Choices`` in templates (:ticket:`31154`). * Fixed a system check to ensure the ``max_length`` attribute fits the longest choice, when a named group contains only non-string values (:ticket:`31155`). * Fixed a regression in Django 2.2 that caused a crash of :class:`~django.contrib.postgres.aggregates.ArrayAgg` and :class:`~django.contrib.postgres.aggregates.StringAgg` with ``filter`` argument when used in a ``Subquery`` (:ticket:`31097`). * Fixed a regression in Django 2.2.7 that caused :meth:`~django.db.models.Model.get_FOO_display` to work incorrectly when overriding inherited choices (:ticket:`31124`). * Fixed a regression in Django 3.0 that caused a crash of ``QuerySet.prefetch_related()`` for ``GenericForeignKey`` with a custom ``ContentType`` foreign key (:ticket:`31190`). ========================== ``` ### 3.0.2 ``` ========================== *January 2, 2020* Django 3.0.2 fixes several bugs in 3.0.1. Bugfixes ======== * Fixed a regression in Django 3.0 that didn't include columns referenced by a ``Subquery()`` in the ``GROUP BY`` clause (:ticket:`31094`). * Fixed a regression in Django 3.0 where ``QuerySet.exists()`` crashed if a queryset contained an aggregation over a ``Subquery()`` (:ticket:`31109`). * Fixed a regression in Django 3.0 that caused a migration crash on PostgreSQL 10+ when adding a foreign key and changing data in the same migration (:ticket:`31106`). * Fixed a regression in Django 3.0 where loading fixtures crashed for models defining a :attr:`~django.db.models.Field.default` for the primary key (:ticket:`31071`). ========================== ``` ### 3.0.1 ``` ========================== *December 18, 2019* Django 3.0.1 fixes a security issue and several bugs in 3.0. CVE-2019-19844: Potential account hijack via password reset form ================================================================ By submitting a suitably crafted email address making use of Unicode characters, that compared equal to an existing user email when lower-cased for comparison, an attacker could be sent a password reset token for the matched account. In order to avoid this vulnerability, password reset requests now compare the submitted email using the stricter, recommended algorithm for case-insensitive comparison of two identifiers from `Unicode Technical Report 36, section 2.11.2(B)(2)`__. Upon a match, the email containing the reset token will be sent to the email address on record rather than the submitted address. .. __: https://www.unicode.org/reports/tr36/Recommendations_General Bugfixes ======== * Fixed a regression in Django 3.0 by restoring the ability to use Django inside Jupyter and other environments that force an async context, by adding an option to disable :ref:`async-safety` mechanism with :envvar:`DJANGO_ALLOW_ASYNC_UNSAFE` environment variable (:ticket:`31056`). * Fixed a regression in Django 3.0 where ``RegexPattern``, used by :func:`~django.urls.re_path`, returned positional arguments to be passed to the view when all optional named groups were missing (:ticket:`31061`). * Reallowed, following a regression in Django 3.0, :class:`~django.db.models.expressions.Window` expressions to be used in conditions outside of queryset filters, e.g. in :class:`~django.db.models.expressions.When` conditions (:ticket:`31060`). * Fixed a data loss possibility in :class:`~django.contrib.postgres.forms.SplitArrayField`. When using with ``ArrayField(BooleanField())``, all values after the first ``True`` value were marked as checked instead of preserving passed values (:ticket:`31073`). ======================== ``` ### 3.0 ``` ======================== *December 2, 2019* Welcome to Django 3.0! These release notes cover the :ref:`new features <whats-new-3.0>`, as well as some :ref:`backwards incompatible changes <backwards-incompatible-3.0>` you'll want to be aware of when upgrading from Django 2.2 or earlier. We've :ref:`dropped some features<removed-features-3.0>` that have reached the end of their deprecation cycle, and we've :ref:`begun the deprecation process for some features <deprecated-features-3.0>`. See the :doc:`/howto/upgrade-version` guide if you're updating an existing project. Python compatibility ==================== Django 3.0 supports Python 3.6, 3.7, and 3.8. We **highly recommend** and only officially support the latest release of each series. The Django 2.2.x series is the last to support Python 3.5. Third-party library support for older version of Django ======================================================= Following the release of Django 3.0, we suggest that third-party app authors drop support for all versions of Django prior to 2.2. At that time, you should be able to run your package's tests using ``python -Wd`` so that deprecation warnings appear. After making the deprecation warning fixes, your app should be compatible with Django 3.0. .. _whats-new-3.0: What's new in Django 3.0 ======================== MariaDB support --------------- Django now officially supports `MariaDB <https://mariadb.org/>`_ 10.1 and higher. See :ref:`MariaDB notes <mariadb-notes>` for more details. ASGI support ------------ Django 3.0 begins our journey to making Django fully async-capable by providing support for running as an `ASGI <https://asgi.readthedocs.io/>`_ application. This is in addition to our existing WSGI support. Django intends to support both for the foreseeable future. Async features will only be available to applications that run under ASGI, however. At this stage async support only applies to the outer ASGI application. Internally everything remains synchronous. Asynchronous middleware, views, etc. are not yet supported. You can, however, use ASGI middleware around Django's application, allowing you to combine Django with other ASGI frameworks. There is no need to switch your applications over unless you want to start experimenting with asynchronous code, but we have :doc:`documentation on deploying with ASGI </howto/deployment/asgi/index>` if you want to learn more. Note that as a side-effect of this change, Django is now aware of asynchronous event loops and will block you calling code marked as "async unsafe" - such as ORM operations - from an asynchronous context. If you were using Django from async code before, this may trigger if you were doing it incorrectly. If you see a ``SynchronousOnlyOperation`` error, then closely examine your code and move any database operations to be in a synchronous child thread. Exclusion constraints on PostgreSQL ----------------------------------- The new :class:`~django.contrib.postgres.constraints.ExclusionConstraint` class enable adding exclusion constraints on PostgreSQL. Constraints are added to models using the :attr:`Meta.constraints <django.db.models.Options.constraints>` option. Filter expressions ------------------ Expressions that output :class:`~django.db.models.BooleanField` may now be used directly in ``QuerySet`` filters, without having to first annotate and then filter against the annotation. Enumerations for model field choices ------------------------------------ Custom enumeration types ``TextChoices``, ``IntegerChoices``, and ``Choices`` are now available as a way to define :attr:`.Field.choices`. ``TextChoices`` and ``IntegerChoices`` types are provided for text and integer fields. The ``Choices`` class allows defining a compatible enumeration for other concrete data types. These custom enumeration types support human-readable labels that can be translated and accessed via a property on the enumeration or its members. See :ref:`Enumeration types <field-choices-enum-types>` for more details and examples. Minor features -------------- :mod:`django.contrib.admin` ~~~~~~~~~~~~~~~~~~~~~~~~~~~ * Added support for the ``admin_order_field`` attribute on properties in :attr:`.ModelAdmin.list_display`. * The new :meth:`ModelAdmin.get_inlines() <django.contrib.admin.ModelAdmin.get_inlines>` method allows specifying the inlines based on the request or model instance. * Select2 library is upgraded from version 4.0.3 to 4.0.7. * jQuery is upgraded from version 3.3.1 to 3.4.1. :mod:`django.contrib.auth` ~~~~~~~~~~~~~~~~~~~~~~~~~~ * The new ``reset_url_token`` attribute in :class:`~django.contrib.auth.views.PasswordResetConfirmView` allows specifying a token parameter displayed as a component of password reset URLs. * Added :class:`~django.contrib.auth.backends.BaseBackend` class to ease customization of authentication backends. * Added :meth:`~django.contrib.auth.models.User.get_user_permissions()` method to mirror the existing :meth:`~django.contrib.auth.models.User.get_group_permissions()` method. * Added HTML ``autocomplete`` attribute to widgets of username, email, and password fields in :mod:`django.contrib.auth.forms` for better interaction with browser password managers. * :djadmin:`createsuperuser` now falls back to environment variables for password and required fields, when a corresponding command line argument isn't provided in non-interactive mode. * :attr:`~django.contrib.auth.models.CustomUser.REQUIRED_FIELDS` now supports :class:`~django.db.models.ManyToManyField`\s. * The new :meth:`.UserManager.with_perm` method returns users that have the specified permission. * The default iteration count for the PBKDF2 password hasher is increased from 150,000 to 180,000. :mod:`django.contrib.gis` ~~~~~~~~~~~~~~~~~~~~~~~~~ * Allowed MySQL spatial lookup functions to operate on real geometries. Previous support was limited to bounding boxes. * Added the :class:`~django.contrib.gis.db.models.functions.GeometryDistance` function, supported on PostGIS. * Added support for the ``furlong`` unit in :class:`~django.contrib.gis.measure.Distance`. * The :setting:`GEOIP_PATH` setting now supports :class:`pathlib.Path`. * The :class:`~django.contrib.gis.geoip2.GeoIP2` class now accepts :class:`pathlib.Path` ``path``. :mod:`django.contrib.postgres` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * The new :class:`~django.contrib.postgres.fields.RangeOperators` helps to avoid typos in SQL operators that can be used together with :class:`~django.contrib.postgres.fields.RangeField`. * The new :class:`~django.contrib.postgres.fields.RangeBoundary` expression represents the range boundaries. * The new :class:`~django.contrib.postgres.operations.AddIndexConcurrently` and :class:`~django.contrib.postgres.operations.RemoveIndexConcurrently` classes allow creating and dropping indexes ``CONCURRENTLY`` on PostgreSQL. :mod:`django.contrib.sessions` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * The new :meth:`~django.contrib.sessions.backends.base.SessionBase.get_session_cookie_age()` method allows dynamically specifying the session cookie age. :mod:`django.contrib.syndication` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * Added the ``language`` class attribute to the :class:`django.contrib.syndication.views.Feed` to customize a feed language. The default value is :func:`~django.utils.translation.get_language()` instead of :setting:`LANGUAGE_CODE`. Cache ~~~~~ * :func:`~django.utils.cache.add_never_cache_headers` and :func:`~django.views.decorators.cache.never_cache` now add the ``private`` directive to ``Cache-Control`` headers. File Storage ~~~~~~~~~~~~ * The new :meth:`.Storage.get_alternative_name` method allows customizing the algorithm for generating filenames if a file with the uploaded name already exists. Forms ~~~~~ * Formsets may control the widget used when ordering forms via :attr:`~django.forms.formsets.BaseFormSet.can_order` by setting the :attr:`~django.forms.formsets.BaseFormSet.ordering_widget` attribute or overriding :attr:`~django.forms.formsets.BaseFormSet.get_ordering_widget()`. Internationalization ~~~~~~~~~~~~~~~~~~~~ * Added the :setting:`LANGUAGE_COOKIE_HTTPONLY`, :setting:`LANGUAGE_COOKIE_SAMESITE`, and :setting:`LANGUAGE_COOKIE_SECURE` settings to set the ``HttpOnly``, ``SameSite``, and ``Secure`` flags on language cookies. The default values of these settings preserve the previous behavior. * Added support and translations for the Uzbek language. Logging ~~~~~~~ * The new ``reporter_class`` parameter of :class:`~django.utils.log.AdminEmailHandler` allows providing an ``django.views.debug.ExceptionReporter`` subclass to customize the traceback text sent to site :setting:`ADMINS` when :setting:`DEBUG` is ``False``. Management Commands ~~~~~~~~~~~~~~~~~~~ * The new :option:`compilemessages --ignore` option allows ignoring specific directories when searching for ``.po`` files to compile. * :option:`showmigrations --list` now shows the applied datetimes when ``--verbosity`` is 2 and above. * On PostgreSQL, :djadmin:`dbshell` now supports client-side TLS certificates. * :djadmin:`inspectdb` now introspects :class:`~django.db.models.OneToOneField` when a foreign key has a unique or primary key constraint. * The new :option:`--skip-checks` option skips running system checks prior to running the command. * The :option:`startapp --template` and :option:`startproject --template` options now support templates stored in XZ archives (``.tar.xz``, ``.txz``) and LZMA archives (``.tar.lzma``, ``.tlz``). Models ~~~~~~ * Added hash database functions :class:`~django.db.models.functions.MD5`, :class:`~django.db.models.functions.SHA1`, :class:`~django.db.models.functions.SHA224`, :class:`~django.db.models.functions.SHA256`, :class:`~django.db.models.functions.SHA384`, and :class:`~django.db.models.functions.SHA512`. * Added the :class:`~django.db.models.functions.Sign` database function. * The new ``is_dst`` parameter of the :class:`~django.db.models.functions.Trunc` database functions determines the treatment of nonexistent and ambiguous datetimes. * ``connection.queries`` now shows ``COPY … TO`` statements on PostgreSQL. * :class:`~django.db.models.FilePathField` now accepts a callable for ``path``. * Allowed symmetrical intermediate table for self-referential :class:`~django.db.models.ManyToManyField`. * The ``name`` attributes of :class:`~django.db.models.CheckConstraint`, :class:`~django.db.models.UniqueConstraint`, and :class:`~django.db.models.Index` now support app label and class interpolation using the ``'%(app_label)s'`` and ``'%(class)s'`` placeholders. * The new :attr:`.Field.descriptor_class` attribute allows model fields to customize the get and set behavior by overriding their :py:ref:`descriptors <descriptors>`. * :class:`~django.db.models.Avg` and :class:`~django.db.models.Sum` now support the ``distinct`` argument. * Added :class:`~django.db.models.SmallAutoField` which acts much like an :class:`~django.db.models.AutoField` except that it only allows values under a certain (database-dependent) limit. Values from ``1`` to ``32767`` are safe in all databases supported by Django. * :class:`~django.db.models.AutoField`, :class:`~django.db.models.BigAutoField`, and :class:`~django.db.models.SmallAutoField` now inherit from ``IntegerField``, ``BigIntegerField`` and ``SmallIntegerField`` respectively. System checks and validators are now also properly inherited. * :attr:`.FileField.upload_to` now supports :class:`pathlib.Path`. * :class:`~django.db.models.CheckConstraint` is now supported on MySQL 8.0.16+. * The new ``allows_group_by_selected_pks_on_model()`` method of ``django.db.backends.base.BaseDatabaseFeatures`` allows optimization of ``GROUP BY`` clauses to require only the selected models' primary keys. By default, it's supported only for managed models on PostgreSQL. To enable the ``GROUP BY`` primary key-only optimization for unmanaged models, you have to subclass the PostgreSQL database engine, overriding the features class ``allows_group_by_selected_pks_on_model()`` method as you require. See :ref:`Subclassing the built-in database backends <subclassing-database-backends>` for an example. Requests and Responses ~~~~~~~~~~~~~~~~~~~~~~ * Allowed :class:`~django.http.HttpResponse` to be initialized with :class:`memoryview` content. * For use in, for example, Django templates, :attr:`.HttpRequest.headers` now allows lookups using underscores (e.g. ``user_agent``) in place of hyphens. .. _whats-new-security-3.0: Security ~~~~~~~~ * :setting:`X_FRAME_OPTIONS` now defaults to ``'DENY'``. In older versions, the :setting:`X_FRAME_OPTIONS` setting defaults to ``'SAMEORIGIN'``. If your site uses frames of itself, you will need to explicitly set ``X_FRAME_OPTIONS = 'SAMEORIGIN'`` for them to continue working. * :setting:`SECURE_CONTENT_TYPE_NOSNIFF` now defaults to ``True``. With this enabled, :class:`~django.middleware.security.SecurityMiddleware` sets the :ref:`x-content-type-options` header on all responses that do not already have it. * :class:`~django.middleware.security.SecurityMiddleware` can now send the :ref:`Referrer-Policy <referrer-policy>` header. Tests ~~~~~ * The new test :class:`~django.test.Client` argument ``raise_request_exception`` allows controlling whether or not exceptions raised during the request should also be raised in the test. The value defaults to ``True`` for backwards compatibility. If it is ``False`` and an exception occurs, the test client will return a 500 response with the attribute :attr:`~django.test.Response.exc_info`, a tuple providing information of the exception that occurred. * Tests and test cases to run can be selected by test name pattern using the new :option:`test -k` option. * HTML comparison, as used by :meth:`~django.test.SimpleTestCase.assertHTMLEqual`, now treats text, character references, and entity references that refer to the same character as equivalent. * Django test runner now supports headless mode for selenium tests on supported browsers. Add the ``--headless`` option to enable this mode. * Django test runner now supports ``--start-at`` and ``--start-after`` options to run tests starting from a specific top-level module. * Django test runner now supports a ``--pdb`` option to spawn a debugger at each error or failure. .. _backwards-incompatible-3.0: Backwards incompatible changes in 3.0 ===================================== ``Model.save()`` when providing a default for the primary key ------------------------------------------------------------- :meth:`.Model.save` no longer attempts to find a row when saving a new ``Model`` instance and a default value for the primary key is provided, and always performs a single ``INSERT`` query. In older Django versions, ``Model.save()`` performed either an ``INSERT`` or an ``UPDATE`` based on whether or not the row exists. This makes calling ``Model.save()`` while providing a default primary key value equivalent to passing :ref:`force_insert=True <ref-models-force-insert>` to model's ``save()``. Attempts to use a new ``Model`` instance to update an existing row will result in an ``IntegrityError``. In order to update an existing model for a specific primary key value, use the :meth:`~django.db.models.query.QuerySet.update_or_create` method or ``QuerySet.filter(pk=…).update(…)`` instead. For example:: >>> MyModel.objects.update_or_create(pk=existing_pk, defaults={'name': 'new name'}) >>> MyModel.objects.filter(pk=existing_pk).update(name='new name') Database backend API -------------------- This section describes changes that may be needed in third-party database backends. * The second argument of ``DatabaseIntrospection.get_geometry_type()`` is now the row description instead of the column name. * ``DatabaseIntrospection.get_field_type()`` may no longer return tuples. * If the database can create foreign keys in the same SQL statement that adds a field, add ``SchemaEditor.sql_create_column_inline_fk`` with the appropriate SQL; otherwise, set ``DatabaseFeatures.can_create_inline_fk = False``. * ``DatabaseFeatures.can_return_id_from_insert`` and ``can_return_ids_from_bulk_insert`` are renamed to ``can_return_columns_from_insert`` and ``can_return_rows_from_bulk_insert``. * Database functions now handle :class:`datetime.timezone` formats when created using :class:`datetime.timedelta` instances (e.g. ``timezone(timedelta(hours=5))``, which would output ``'UTC+05:00'``). Third-party backends should handle this format when preparing :class:`~django.db.models.DateTimeField` in ``datetime_cast_date_sql()``, ``datetime_extract_sql()``, etc. * Entries for ``AutoField``, ``BigAutoField``, and ``SmallAutoField`` are added to ``DatabaseOperations.integer_field_ranges`` to support the integer range validators on these field types. Third-party backends may need to customize the default entries. * ``DatabaseOperations.fetch_returned_insert_id()`` is replaced by ``fetch_returned_insert_columns()`` which returns a list of values returned by the ``INSERT … RETURNING`` statement, instead of a single value. * ``DatabaseOperations.return_insert_id()`` is replaced by ``return_insert_columns()`` that accepts a ``fields`` argument, which is an iterable of fields to be returned after insert. Usually this is only the auto-generated primary key. :mod:`django.contrib.admin` --------------------------- * Admin's model history change messages now prefers more readable field labels instead of field names. :mod:`django.contrib.gis` ------------------------- * Support for PostGIS 2.1 is removed. * Support for SpatiaLite 4.1 and 4.2 is removed. * Support for GDAL 1.11 and GEOS 3.4 is removed. Dropped support for PostgreSQL 9.4 ---------------------------------- Upstream support for PostgreSQL 9.4 ends in December 2019. Django 3.0 supports PostgreSQL 9.5 and higher. Dropped support for Oracle 12.1 ------------------------------- Upstream support for Oracle 12.1 ends in July 2021. Django 2.2 will be supported until April 2022. Django 3.0 officially supports Oracle 12.2 and 18c. Removed private Python 2 compatibility APIs ------------------------------------------- While Python 2 support was removed in Django 2.0, some private APIs weren't removed from Django so that third party apps could continue using them until the Python 2 end-of-life. Since we expect apps to drop Python 2 compatibility when adding support for Django 3.0, we're removing these APIs at this time. * ``django.test.utils.str_prefix()`` - Strings don't have 'u' prefixes in Python 3. * ``django.test.utils.patch_logger()`` - Use :meth:`unittest.TestCase.assertLogs` instead. * ``django.utils.lru_cache.lru_cache()`` - Alias of :func:`functools.lru_cache`. * ``django.utils.decorators.available_attrs()`` - This function returns ``functools.WRAPPER_ASSIGNMENTS``. * ``django.utils.decorators.ContextDecorator`` - Alias of :class:`contextlib.ContextDecorator`. * ``django.utils._os.abspathu()`` - Alias of :func:`os.path.abspath`. * ``django.utils._os.upath()`` and ``npath()`` - These functions do nothing on Python 3. * ``django.utils.six`` - Remove usage of this vendored library or switch to `six <https://pypi.org/project/six/>`_. * ``django.utils.encoding.python_2_unicode_compatible()`` - Alias of ``six.python_2_unicode_compatible()``. * ``django.utils.functional.curry()`` - Use :func:`functools.partial` or :class:`functools.partialmethod`. See :commit:`5b1c389603a353625ae1603`. * ``django.utils.safestring.SafeBytes`` - Unused since Django 2.0. New default value for the ``FILE_UPLOAD_PERMISSIONS`` setting ------------------------------------------------------------- In older versions, the :setting:`FILE_UPLOAD_PERMISSIONS` setting defaults to ``None``. With the default :setting:`FILE_UPLOAD_HANDLERS`, this results in uploaded files having different permissions depending on their size and which upload handler is used. ``FILE_UPLOAD_PERMISSION`` now defaults to ``0o644`` to avoid this inconsistency. New default values for security settings ---------------------------------------- To make Django projects more secure by default, some security settings now have more secure default values: * :setting:`X_FRAME_OPTIONS` now defaults to ``'DENY'``. * :setting:`SECURE_CONTENT_TYPE_NOSNIFF` now defaults to ``True``. See the *What's New* :ref:`Security section <whats-new-security-3.0>` above for more details on these changes. Miscellaneous ------------- * ``ContentType.__str__()`` now includes the model's ``app_label`` to disambiguate models with the same name in different apps. * Because accessing the language in the session rather than in the cookie is deprecated, ``LocaleMiddleware`` no longer looks for the user's language in the session and :func:`django.contrib.auth.logout` no longer preserves the session's language after logout. * :func:`django.utils.html.escape` now uses :func:`html.escape` to escape HTML. This converts ``'`` to ``&x27;`` instead of the previous equivalent decimal code ``&39;``. * The ``django-admin test -k`` option now works as the :option:`unittest -k<unittest.-k>` option rather than as a shortcut for ``--keepdb``. * Support for ``pywatchman`` < 1.2.0 is removed. * :func:`~django.utils.http.urlencode` now encodes iterable values as they are when ``doseq=False``, rather than iterating them, bringing it into line with the standard library :func:`urllib.parse.urlencode` function. * ``intword`` template filter now translates ``1.0`` as a singular phrase and all other numeric values as plural. This may be incorrect for some languages. * Assigning a value to a model's :class:`~django.db.models.ForeignKey` or :class:`~django.db.models.OneToOneField` ``'_id'`` attribute now unsets the corresponding field. Accessing the field afterwards will result in a query. * :func:`~django.utils.cache.patch_vary_headers` now handles an asterisk ``'*'`` according to :rfc:`7231section-7.1.4`, i.e. if a list of header field names contains an asterisk, then the ``Vary`` header will consist of a single asterisk ``'*'``. * On MySQL 8.0.16+, ``PositiveIntegerField`` and ``PositiveSmallIntegerField`` now include a check constraint to prevent negative values in the database. * ``alias=None`` is added to the signature of :meth:`.Expression.get_group_by_cols`. * Support for ``sqlparse`` < 0.2.2 is removed. * ``RegexPattern``, used by :func:`~django.urls.re_path`, no longer returns keyword arguments with ``None`` values to be passed to the view for the optional named groups that are missing. .. _deprecated-features-3.0: Features deprecated in 3.0 ========================== ``django.utils.encoding.force_text()`` and ``smart_text()`` ----------------------------------------------------------- The ``smart_text()`` and ``force_text()`` aliases (since Django 2.0) of ``smart_str()`` and ``force_str()`` are deprecated. Ignore this deprecation if your code supports Python 2 as the behavior of ``smart_str()`` and ``force_str()`` is different there. Miscellaneous ------------- * ``django.utils.http.urlquote()``, ``urlquote_plus()``, ``urlunquote()``, and ``urlunquote_plus()`` are deprecated in favor of the functions that they're aliases for: :func:`urllib.parse.quote`, :func:`~urllib.parse.quote_plus`, :func:`~urllib.parse.unquote`, and :func:`~urllib.parse.unquote_plus`. * ``django.utils.translation.ugettext()``, ``ugettext_lazy()``, ``ugettext_noop()``, ``ungettext()``, and ``ungettext_lazy()`` are deprecated in favor of the functions that they're aliases for: :func:`django.utils.translation.gettext`, :func:`~django.utils.translation.gettext_lazy`, :func:`~django.utils.translation.gettext_noop`, :func:`~django.utils.translation.ngettext`, and :func:`~django.utils.translation.ngettext_lazy`. * To limit creation of sessions and hence favor some caching strategies, :func:`django.views.i18n.set_language` will stop setting the user's language in the session in Django 4.0. Since Django 2.1, the language is always stored in the :setting:`LANGUAGE_COOKIE_NAME` cookie. * ``django.utils.text.unescape_entities()`` is deprecated in favor of :func:`html.unescape`. Note that unlike ``unescape_entities()``, ``html.unescape()`` evaluates lazy strings immediately. * To avoid possible confusion as to effective scope, the private internal utility ``is_safe_url()`` is renamed to ``url_has_allowed_host_and_scheme()``. That a URL has an allowed host and scheme doesn't in general imply that it's "safe". It may still be quoted incorrectly, for example. Ensure to also use :func:`~django.utils.encoding.iri_to_uri` on the path component of untrusted URLs. .. _removed-features-3.0: Features removed in 3.0 ======================= These features have reached the end of their deprecation cycle and are removed in Django 3.0. See :ref:`deprecated-features-2.0` for details on these changes, including how to remove usage of these features. * The ``django.db.backends.postgresql_psycopg2`` module is removed. * ``django.shortcuts.render_to_response()`` is removed. * The ``DEFAULT_CONTENT_TYPE`` setting is removed. * ``HttpRequest.xreadlines()`` is removed. * Support for the ``context`` argument of ``Field.from_db_value()`` and ``Expression.convert_value()`` is removed. * The ``field_name`` keyword argument of ``QuerySet.earliest()`` and ``latest()`` is removed. See :ref:`deprecated-features-2.1` for details on these changes, including how to remove usage of these features. * The ``ForceRHR`` GIS function is removed. * ``django.utils.http.cookie_date()`` is removed. * The ``staticfiles`` and ``admin_static`` template tag libraries are removed. * ``django.contrib.staticfiles.templatetags.staticfiles.static()`` is removed. =========================== ``` ### 2.2.12 ``` =========================== *April 1, 2020* Django 2.2.12 fixes a bug in 2.2.11. Bugfixes ======== * Added the ability to handle ``.po`` files containing different plural equations for the same language (:ticket:`30439`). =========================== ``` ### 2.2.11 ``` =========================== *March 4, 2020* Django 2.2.11 fixes a security issue and a data loss bug in 2.2.10. CVE-2020-9402: Potential SQL injection via ``tolerance`` parameter in GIS functions and aggregates on Oracle ============================================================================================================ GIS functions and aggregates on Oracle were subject to SQL injection, using a suitably crafted ``tolerance``. Bugfixes ======== * Fixed a data loss possibility in the :meth:`~django.db.models.query.QuerySet.select_for_update`. When using related fields or parent link fields with :ref:`multi-table-inheritance` in the ``of`` argument, the corresponding models were not locked (:ticket:`31246`). =========================== ``` ### 2.2.10 ``` =========================== *February 3, 2020* Django 2.2.10 fixes a security issue in 2.2.9. CVE-2020-7471: Potential SQL injection via ``StringAgg(delimiter)`` =================================================================== :class:`~django.contrib.postgres.aggregates.StringAgg` aggregation function was subject to SQL injection, using a suitably crafted ``delimiter``. ========================== ``` ### 2.2.9 ``` ========================== *December 18, 2019* Django 2.2.9 fixes a security issue and a data loss bug in 2.2.8. CVE-2019-19844: Potential account hijack via password reset form ================================================================ By submitting a suitably crafted email address making use of Unicode characters, that compared equal to an existing user email when lower-cased for comparison, an attacker could be sent a password reset token for the matched account. In order to avoid this vulnerability, password reset requests now compare the submitted email using the stricter, recommended algorithm for case-insensitive comparison of two identifiers from `Unicode Technical Report 36, section 2.11.2(B)(2)`__. Upon a match, the email containing the reset token will be sent to the email address on record rather than the submitted address. .. __: https://www.unicode.org/reports/tr36/Recommendations_General Bugfixes ======== * Fixed a data loss possibility in :class:`~django.contrib.postgres.forms.SplitArrayField`. When using with ``ArrayField(BooleanField())``, all values after the first ``True`` value were marked as checked instead of preserving passed values (:ticket:`31073`). ========================== ``` ### 2.2.8 ``` ========================== *December 2, 2019* Django 2.2.8 fixes a security issue, several bugs in 2.2.7, and adds compatibility with Python 3.8. CVE-2019-19118: Privilege escalation in the Django admin. ========================================================= Since Django 2.1, a Django model admin displaying a parent model with related model inlines, where the user has view-only permissions to a parent model but edit permissions to the inline model, would display a read-only view of the parent model but editable forms for the inline. Submitting these forms would not allow direct edits to the parent model, but would trigger the parent model's ``save()`` method, and cause pre and post-save signal handlers to be invoked. This is a privilege escalation as a user who lacks permission to edit a model should not be able to trigger its save-related signals. To resolve this issue, the permission handling code of the Django admin interface has been changed. Now, if a user has only the "view" permission for a parent model, the entire displayed form will not be editable, even if the user has permission to edit models included in inlines. This is a backwards-incompatible change, and the Django security team is aware that some users of Django were depending on the ability to allow editing of inlines in the admin form of an otherwise view-only parent model. Given the complexity of the Django admin, and in-particular the permissions related checks, it is the view of the Django security team that this change was necessary: that it is not currently feasible to maintain the existing behavior whilst escaping the potential privilege escalation in a way that would avoid a recurrence of similar issues in the future, and that would be compatible with Django's *safe by default* philosophy. For the time being, developers whose applications are affected by this change should replace the use of inlines in read-only parents with custom forms and views that explicitly implement the desired functionality. In the longer term, adding a documented, supported, and properly-tested mechanism for partially-editable multi-model forms to the admin interface may occur in Django itself. Bugfixes ======== * Fixed a data loss possibility in the admin changelist view when a custom :ref:`formset's prefix <formset-prefix>` contains regular expression special characters, e.g. ``'$'`` (:ticket:`31031`). * Fixed a regression in Django 2.2.1 that caused a crash when migrating permissions for proxy models with a multiple database setup if the ``default`` entry was empty (:ticket:`31021`). * Fixed a data loss possibility in the :meth:`~django.db.models.query.QuerySet.select_for_update()`. When using ``'self'`` in the ``of`` argument with :ref:`multi-table inheritance <multi-table-inheritance>`, a parent model was locked instead of the queryset's model (:ticket:`30953`). ========================== ``` ### 2.2.7 ``` ========================== *November 4, 2019* Django 2.2.7 fixes several bugs in 2.2.6. Bugfixes ======== * Fixed a crash when using a ``contains``, ``contained_by``, ``has_key``, ``has_keys``, or ``has_any_keys`` lookup on :class:`~django.contrib.postgres.fields.JSONField`, if the right or left hand side of an expression is a key transform (:ticket:`30826`). * Prevented :option:`migrate --plan` from showing that ``RunPython`` operations are irreversible when ``reverse_code`` callables don't have docstrings or when showing a forward migration plan (:ticket:`30870`). * Fixed migrations crash on PostgreSQL when adding an :class:`~django.db.models.Index` with fields ordering and :attr:`~.Index.opclasses` (:ticket:`30903`). * Restored the ability to override :meth:`~django.db.models.Model.get_FOO_display` (:ticket:`30931`). ========================== ``` ### 2.2.6 ``` ========================== *October 1, 2019* Django 2.2.6 fixes several bugs in 2.2.5. Bugfixes ======== * Fixed migrations crash on SQLite when altering a model containing partial indexes (:ticket:`30754`). * Fixed a regression in Django 2.2.4 that caused a crash when filtering with a ``Subquery()`` annotation of a queryset containing :class:`~django.contrib.postgres.fields.JSONField` or :class:`~django.contrib.postgres.fields.HStoreField` (:ticket:`30769`). ========================== ``` ### 2.2.5 ``` ========================== *September 2, 2019* Django 2.2.5 fixes several bugs in 2.2.4. Bugfixes ======== * Relaxed the system check added in Django 2.2 for models to reallow use of the same ``db_table`` by multiple models when database routers are installed (:ticket:`30673`). * Fixed crash of ``KeyTransform()`` for :class:`~django.contrib.postgres.fields.JSONField` and :class:`~django.contrib.postgres.fields.HStoreField` when using on expressions with params (:ticket:`30672`). * Fixed a regression in Django 2.2 where :attr:`ModelAdmin.list_filter <django.contrib.admin.ModelAdmin.list_filter>` choices to foreign objects don't respect a model's ``Meta.ordering`` (:ticket:`30449`). ========================== ``` ### 2.2.4 ``` ========================== *August 1, 2019* Django 2.2.4 fixes security issues and several bugs in 2.2.3. CVE-2019-14232: Denial-of-service possibility in ``django.utils.text.Truncator`` ================================================================================ If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods were passed the ``html=True`` argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The ``chars()`` and ``words()`` methods are used to implement the :tfilter:`truncatechars_html` and :tfilter:`truncatewords_html` template filters, which were thus vulnerable. The regular expressions used by ``Truncator`` have been simplified in order to avoid potential backtracking issues. As a consequence, trailing punctuation may now at times be included in the truncated output. CVE-2019-14233: Denial-of-service possibility in ``strip_tags()`` ================================================================= Due to the behavior of the underlying ``HTMLParser``, :func:`django.utils.html.strip_tags` would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities. The ``strip_tags()`` method is used to implement the corresponding :tfilter:`striptags` template filter, which was thus also vulnerable. ``strip_tags()`` now avoids recursive calls to ``HTMLParser`` when progress removing tags, but necessarily incomplete HTML entities, stops being made. Remember that absolutely NO guarantee is provided about the results of ``strip_tags()`` being HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without escaping it first, for example with :func:`django.utils.html.escape`. CVE-2019-14234: SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField`` ==================================================================================================== :lookup:`Key and index lookups <jsonfield.key>` for :class:`~django.contrib.postgres.fields.JSONField` and :lookup:`key lookups <hstorefield.key>` for :class:`~django.contrib.postgres.fields.HStoreField` were subject to SQL injection, using a suitably crafted dictionary, with dictionary expansion, as the ``**kwargs`` passed to ``QuerySet.filter()``. CVE-2019-14235: Potential memory exhaustion in ``django.utils.encoding.uri_to_iri()`` ===================================================================================== If passed certain inputs, :func:`django.utils.encoding.uri_to_iri` could lead to significant memory usage due to excessive recursion when re-percent-encoding invalid UTF-8 octet sequences. ``uri_to_iri()`` now avoids recursion when re-percent-encoding invalid UTF-8 octet sequences. Bugfixes ======== * Fixed a regression in Django 2.2 when ordering a ``QuerySet.union()``, ``intersection()``, or ``difference()`` by a field type present more than once results in the wrong ordering being used (:ticket:`30628`). * Fixed a migration crash on PostgreSQL when adding a check constraint with a ``contains`` lookup on :class:`~django.contrib.postgres.fields.DateRangeField` or :class:`~django.contrib.postgres.fields.DateTimeRangeField`, if the right hand side of an expression is the same type (:ticket:`30621`). * Fixed a regression in Django 2.2 where auto-reloader crashes if a file path contains nulls characters (``'\x00'``) (:ticket:`30506`). * Fixed a regression in Django 2.2 where auto-reloader crashes if a translation directory cannot be resolved (:ticket:`30647`). ========================== ``` ### 2.2.3 ``` ========================== *July 1, 2019* Django 2.2.3 fixes a security issue and several bugs in 2.2.2. Also, the latest string translations from Transifex are incorporated. CVE-2019-12781: Incorrect HTTP detection with reverse-proxy connecting via HTTPS -------------------------------------------------------------------------------- When deployed behind a reverse-proxy connecting to Django via HTTPS, :attr:`django.http.HttpRequest.scheme` would incorrectly detect client requests made via HTTP as using HTTPS. This entails incorrect results for :meth:`~django.http.HttpRequest.is_secure`, and :meth:`~django.http.HttpRequest.build_absolute_uri`, and that HTTP requests would not be redirected to HTTPS in accordance with :setting:`SECURE_SSL_REDIRECT`. ``HttpRequest.scheme`` now respects :setting:`SECURE_PROXY_SSL_HEADER`, if it is configured, and the appropriate header is set on the request, for both HTTP and HTTPS requests. If you deploy Django behind a reverse-proxy that forwards HTTP requests, and that connects to Django via HTTPS, be sure to verify that your application correctly handles code paths relying on ``scheme``, ``is_secure()``, ``build_absolute_uri()``, and ``SECURE_SSL_REDIRECT``. Bugfixes ======== * Fixed a regression in Django 2.2 where :class:`~django.db.models.Avg`, :class:`~django.db.models.StdDev`, and :class:`~django.db.models.Variance` crash with ``filter`` argument (:ticket:`30542`). * Fixed a regression in Django 2.2.2 where auto-reloader crashes with ``AttributeError``, e.g. when using ``ipdb`` (:ticket:`30588`). ========================== ``` ### 2.2.2 ``` ========================== *June 3, 2019* Django 2.2.2 fixes security issues and several bugs in 2.2.1. CVE-2019-12308: AdminURLFieldWidget XSS --------------------------------------- The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayed the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link. ``AdminURLFieldWidget`` now validates the provided value using :class:`~django.core.validators.URLValidator` before displaying the clickable link. You may customize the validator by passing a ``validator_class`` kwarg to ``AdminURLFieldWidget.__init__()``, e.g. when using :attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`. Patched bundled jQuery for CVE-2019-11358: Prototype pollution -------------------------------------------------------------- jQuery before 3.4.0, mishandles ``jQuery.extend(true, {}, ...)`` because of ``Object.prototype`` pollution. If an unsanitized source object contained an enumerable ``__proto__`` property, it could extend the native ``Object.prototype``. The bundled version of jQuery used by the Django admin has been patched to allow for the ``select2`` library's use of ``jQuery.extend()``. Bugfixes ======== * Fixed a regression in Django 2.2 that stopped Show/Hide toggles working on dynamically added admin inlines (:ticket:`30459`). * Fixed a regression in Django 2.2 where deprecation message crashes if ``Meta.ordering`` contains an expression (:ticket:`30463`). * Fixed a regression in Django 2.2.1 where :class:`~django.contrib.postgres.search.SearchVector` generates SQL with a redundant ``Coalesce`` call (:ticket:`30488`). * Fixed a regression in Django 2.2 where auto-reloader doesn't detect changes in ``manage.py`` file when using ``StatReloader`` (:ticket:`30479`). * Fixed crash of :class:`~django.contrib.postgres.aggregates.ArrayAgg` and :class:`~django.contrib.postgres.aggregates.StringAgg` with ``ordering`` argument when used in a ``Subquery`` (:ticket:`30315`). * Fixed a regression in Django 2.2 that caused a crash of auto-reloader when an exception with custom signature is raised (:ticket:`30516`). * Fixed a regression in Django 2.2.1 where auto-reloader unnecessarily reloads translation files multiple times when using ``StatReloader`` (:ticket:`30523`). ========================== ``` ### 2.2.1 ``` ========================== *May 1, 2019* Django 2.2.1 fixes several bugs in 2.2. Bugfixes ======== * Fixed a regression in Django 2.1 that caused the incorrect quoting of database user password when using :djadmin:`dbshell` on Oracle (:ticket:`30307`). * Added compatibility for ``psycopg2`` 2.8 (:ticket:`30331`). * Fixed a regression in Django 2.2 that caused a crash when loading the template for the technical 500 debug page (:ticket:`30324`). * Fixed crash of ``ordering`` argument in :class:`~django.contrib.postgres.aggregates.ArrayAgg` and :class:`~django.contrib.postgres.aggregates.StringAgg` when it contains an expression with params (:ticket:`30332`). * Fixed a regression in Django 2.2 that caused a single instance fast-delete to not set the primary key to ``None`` (:ticket:`30330`). * Prevented :djadmin:`makemigrations` from generating infinite migrations for check constraints and partial indexes when ``condition`` contains a :class:`~python:range` object (:ticket:`30350`). * Reverted an optimization in Django 2.2 (:ticket:`29725`) that caused the inconsistent behavior of ``count()`` and ``exists()`` on a reverse many-to-many relationship with a custom manager (:ticket:`30325`). * Fixed a regression in Django 2.2 where :class:`~django.core.paginator.Paginator` crashes if ``object_list`` is a queryset ordered or aggregated over a nested ``JSONField`` key transform (:ticket:`30335`). * Fixed a regression in Django 2.2 where ``IntegerField`` validation of database limits crashes if ``limit_value`` attribute in a custom validator is callable (:ticket:`30328`). * Fixed a regression in Django 2.2 where :class:`~django.contrib.postgres.search.SearchVector` generates SQL that is not indexable (:ticket:`30385`). * Fixed a regression in Django 2.2 that caused an exception to be raised when a custom error handler could not be imported (:ticket:`30318`). * Relaxed the system check added in Django 2.2 for the admin app's dependencies to reallow use of :class:`~django.contrib.sessions.middleware.SessionMiddleware` subclasses, rather than requiring :mod:`django.contrib.sessions` to be in :setting:`INSTALLED_APPS` (:ticket:`30312`). * Increased the default timeout when using ``Watchman`` to 5 seconds to prevent falling back to ``StatReloader`` on larger projects and made it customizable via the :envvar:`DJANGO_WATCHMAN_TIMEOUT` environment variable (:ticket:`30361`). * Fixed a regression in Django 2.2 that caused a crash when migrating permissions for proxy models if the target permissions already existed. For example, when a permission had been created manually or a model had been migrated from concrete to proxy (:ticket:`30351`). * Fixed a regression in Django 2.2 that caused a crash of :djadmin:`runserver` when URLConf modules raised exceptions (:ticket:`30323`). * Fixed a regression in Django 2.2 where changes were not reliably detected by auto-reloader when using ``StatReloader`` (:ticket:`30323`). * Fixed a migration crash on Oracle and PostgreSQL when adding a check constraint with a ``contains``, ``startswith``, or ``endswith`` lookup (or their case-insensitive variant) (:ticket:`30408`). * Fixed a migration crash on Oracle and SQLite when adding a check constraint with ``condition`` contains ``|`` (``OR``) operator (:ticket:`30412`). ======================== ``` ### 2.2 ``` ======================== *April 1, 2019* Welcome to Django 2.2! These release notes cover the :ref:`new features <whats-new-2.2>`, as well as some :ref:`backwards incompatible changes <backwards-incompatible-2.2>` you'll want to be aware of when upgrading from Django 2.1 or earlier. We've :ref:`begun the deprecation process for some features <deprecated-features-2.2>`. See the :doc:`/howto/upgrade-version` guide if you're updating an existing project. Django 2.2 is designated as a :term:`long-term support release <Long-term support release>`. It will receive security updates for at least three years after its release. Support for the previous LTS, Django 1.11, will end in April 2020. Python compatibility ==================== Django 2.2 supports Python 3.5, 3.6, 3.7, and 3.8 (as of 2.2.8). We **highly recommend** and only officially support the latest release of each series. .. _whats-new-2.2: What's new in Django 2.2 ======================== Constraints ----------- The new :class:`~django.db.models.CheckConstraint` and :class:`~django.db.models.UniqueConstraint` classes enable adding custom database constraints. Constraints are added to models using the :attr:`Meta.constraints <django.db.models.Options.constraints>` option. Minor features -------------- :mod:`django.contrib.admin` ~~~~~~~~~~~~~~~~~~~~~~~~~~~ * Added a CSS class to the column headers of :class:`~django.contrib.admin.TabularInline`. :mod:`django.contrib.auth` ~~~~~~~~~~~~~~~~~~~~~~~~~~ * The ``HttpRequest`` is now passed as the first positional argument to :meth:`.RemoteUserBackend.configure_user`, if it accepts it. :mod:`django.contrib.gis` ~~~~~~~~~~~~~~~~~~~~~~~~~ * Added Oracle support for the :class:`~django.contrib.gis.db.models.functions.Envelope` function. * Added SpatiaLite support for the :lookup:`coveredby` and :lookup:`covers` lookups. :mod:`django.contrib.postgres` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * The new ``ordering`` argument for :class:`~django.contrib.postgres.aggregates.ArrayAgg` and :class:`~django.contrib.postgres.aggregates.StringAgg` determines the ordering of the aggregated elements. * The new :class:`~django.contrib.postgres.indexes.BTreeIndex`, :class:`~django.contrib.postgres.indexes.HashIndex` and :class:`~django.contrib.postgres.indexes.SpGistIndex` classes allow creating ``B-Tree``, ``hash``, and ``SP-GiST`` indexes in the database. * :class:`~django.contrib.postgres.indexes.BrinIndex` now has the ``autosummarize`` parameter. * The new ``search_type`` parameter of :class:`~django.contrib.postgres.search.SearchQuery` allows searching for a phrase or raw expression. :mod:`django.contrib.staticfiles` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * Added path matching to the :option:`collectstatic --ignore` option so that patterns like ``/vendor/*.js`` can be used. Database backends ~~~~~~~~~~~~~~~~~ * Added result streaming for :meth:`.QuerySet.iterator` on SQLite. Generic Views ~~~~~~~~~~~~~ * The new :meth:`View.setup <django.views.generic.base.View.setup>` hook initializes view attributes before calling :meth:`~django.views.generic.base.View.dispatch`. It allows mixins to setup instance attributes for reuse in child classes. Internationalization ~~~~~~~~~~~~~~~~~~~~ * Added support and translations for the Armenian language. Management Commands ~~~~~~~~~~~~~~~~~~~ * The new :option:`--force-color` option forces colorization of the command output. * :djadmin:`inspectdb` now creates models for foreign tables on PostgreSQL. * :option:`inspectdb --include-views` now creates models for materialized views on Oracle and PostgreSQL. * The new :option:`inspectdb --include-partitions` option allows creating models for partition tables on PostgreSQL. In older versions, models are created child tables instead the parent. * :djadmin:`inspectdb` now introspects :class:`~django.db.models.DurationField` for Oracle and PostgreSQL, and :class:`~django.db.models.AutoField` for SQLite. * On Oracle, :djadmin:`dbshell` is wrapped with ``rlwrap``, if available. ``rlwrap`` provides a command history and editing of keyboard input. * The new :option:`makemigrations --no-header` option avoids writing header comments in generated migration file(s). This option is also available for :djadmin:`squashmigrations`. * :djadmin:`runserver` can now use `Watchman <https://facebook.github.io/watchman/>`_ to improve the performance of watching a large number of files for changes. Migrations ~~~~~~~~~~ * The new :option:`migrate --plan` option prints the list of migration operations that will be performed. * ``NoneType`` can now be serialized in migrations. * You can now :ref:`register custom serializers <custom-migration-serializers>` for migrations. Models ~~~~~~ * Added support for PostgreSQL operator classes (:attr:`.Index.opclasses`). * Added support for partial indexes (:attr:`.Index.condition`). * Added the :class:`~django.db.models.functions.NullIf` and :class:`~django.db.models.functions.Reverse` database functions, as well as many :ref:`math database functions <math-functions>`. * Setting the new ``ignore_conflicts`` parameter of :meth:`.QuerySet.bulk_create` to ``True`` tells the database to ignore failure to insert rows that fail uniqueness constraints or other checks. * The new :class:`~django.db.models.functions.ExtractIsoYear` function extracts ISO-8601 week-numbering years from :class:`~django.db.models.DateField` and :class:`~django.db.models.DateTimeField`, and the new :lookup:`iso_year` lookup allows querying by an ISO-8601 week-numbering year. * The new :meth:`.QuerySet.bulk_update` method allows efficiently updating specific fields on multiple model instances. * Django no longer always starts a transaction when a single query is being performed, such as ``Model.save()``, ``QuerySet.update()``, and ``Model.delete()``. This improves the performance of autocommit by reducing the number of database round trips. * Added SQLite support for the :class:`~django.db.models.StdDev` and :class:`~django.db.models.Variance` functions. * The handling of ``DISTINCT`` aggregation is added to the :class:`~django.db.models.Aggregate` class. Adding :attr:`allow_distinct = True <django.db.models.Aggregate.allow_distinct>` as a class attribute on ``Aggregate`` subclasses allows a ``distinct`` keyword argument to be specified on initialization to ensure that the aggregate function is only called for each distinct value of ``expressions``. * The :meth:`.RelatedManager.add`, :meth:`~.RelatedManager.create`, :meth:`~.RelatedManager.remove`, :meth:`~.RelatedManager.set`, ``get_or_create()``, and ``update_or_create()`` methods are now allowed on many-to-many relationships with intermediate models. The new ``through_defaults`` argument is used to specify values for new intermediate model instance(s). Requests and Responses ~~~~~~~~~~~~~~~~~~~~~~ * Added :attr:`.HttpRequest.headers` to allow simple access to a request's headers. Serialization ~~~~~~~~~~~~~ * You can now deserialize data using natural keys containing :ref:`forward references <natural-keys-and-forward-references>` by passing ``handle_forward_references=True`` to ``serializers.deserialize()``. Additionally, :djadmin:`loaddata` handles forward references automatically. Tests ~~~~~ * The new :meth:`.SimpleTestCase.assertURLEqual` assertion checks for a given URL, ignoring the ordering of the query string. :meth:`~.SimpleTestCase.assertRedirects` uses the new assertion. * The test :class:`~.django.test.Client` now supports automatic JSON serialization of list and tuple ``data`` when ``content_type='application/json'``. * The new :setting:`ORACLE_MANAGED_FILES <TEST_ORACLE_MANAGED_FILES>` test database setting allows using Oracle Managed Files (OMF) tablespaces. * Deferrable database constraints are now checked at the end of each :class:`~django.test.TestCase` test on SQLite 3.20+, just like on other backends that support deferrable constraints. These checks aren't implemented for older versions of SQLite because they would require expensive table introspection there. * :class:`~django.test.runner.DiscoverRunner` now skips the setup of databases not :ref:`referenced by tests<testing-multi-db>`. URLs ~~~~ * The new :attr:`.ResolverMatch.route` attribute stores the route of the m