Changelog
### 2.7.2
```
==========================
Bugfixes
--------
- Fixed an issue with the setup script running in non-UTF-8 environment.
Reported and fixed by gergondet (gh pr 651)
Misc
----
- GH 655
```
### 2.7.1
```
===========================
Data updates
------------
- Updated tzdata version to 2018d.
Bugfixes
--------
- Fixed issue where parser.parse would occasionally raise
decimal.Decimal-specific error types rather than ValueError. Reported by
amureki (gh issue 632). Fixed by pganssle (gh pr 636).
- Improve error message when rrule's dtstart and until are not both naive or
both aware. Reported and fixed by ryanpetrello (gh issue 633, gh pr 634)
Misc
----
- GH 644, GH 648
```
### 2.7.0
```
=============
- Dropped support for Python 2.6 (gh pr 362 by jdufresne)
- Dropped support for Python 3.2 (gh pr 626)
- Updated zoneinfo file to 2018c (gh pr 616)
- Changed licensing scheme so all new contributions are dual licensed under
Apache 2.0 and BSD. (gh pr 542, issue 496)
- Added __all__ variable to the root package. Reported by tebriel
(gh issue 406), fixed by mariocj89 (gh pr 494)
- Added python_requires to setup.py so that pip will distribute the right
version of dateutil. Fixed by jakec-github (gh issue 537, pr 552)
- Added the utils submodule, for miscellaneous utilities.
- Added within_delta function to utils - added by justanr (gh issue 432,
gh pr 437)
- Added today function to utils (gh pr 474)
- Added default_tzinfo function to utils (gh pr 475), solving an issue
reported by nealmcb (gh issue 94)
- Added dedicated ISO 8601 parsing function isoparse (gh issue 424).
Initial implementation by pganssle in gh pr 489 and 622, with a
pre-release fix by kirit93 (gh issue 546, gh pr 573).
- Moved parser module into parser/_parser.py and officially deprecated the use
of several private functions and classes from that module. (gh pr 501, 515)
- Tweaked parser error message to include rejected string format, added by
pbiering (gh pr 300)
- Add support for parsing bytesarray, reported by uckelman (gh issue 417) and
fixed by uckelman and pganssle (gh pr 514)
- Started raising a warning when the parser finds a timezone string that it
cannot construct a tzinfo instance for (rather than succeeding with no
indication of an error). Reported and fixed by jbrockmendel (gh pr 540)
- Dropped the use of assert in the parser. Fixed by jbrockmendel (gh pr 502)
- Fixed to assertion logic in parser to support dates like '2015-15-May',
reported and fixed by jbrockmendel (gh pr 409)
- Fixed IndexError in parser on dates with trailing colons, reported and fixed
by jbrockmendel (gh pr 420)
- Fixed bug where hours were not validated, leading to improper parse. Reported
by heappro (gh pr 353), fixed by jbrockmendel (gh pr 482)
- Fixed problem parsing strings in %b-%Y-%d format. Reported and fixed by
jbrockmendel (gh pr 481)
- Fixed problem parsing strings in the %d%B%y format. Reported by asishm
(gh issue 360), fixed by jbrockmendel (gh pr 483)
- Fixed problem parsing certain unambiguous strings when year <99 (gh pr 510).
Reported by alexwlchan (gh issue 293).
- Fixed issue with parsing an unambiguous string representation of an ambiguous
datetime such that if possible the correct value for fold is set. Fixes
issue reported by JordonPhillips and pganssle (gh issue 318, 320,
gh pr 517)
- Fixed issue with improper rounding of fractional components. Reported by
dddmello (gh issue 427), fixed by m-dz (gh pr 570)
- Performance improvement to parser from removing certain min() calls. Reported
and fixed by jbrockmendel (gh pr 589)
- Significantly refactored parser code by jbrockmendel (gh prs 419, 436,
490, 498, 539) and pganssle (gh prs 435, 468)
- Implementated of __hash__ for relativedelta and weekday, reported and fixed
by mrigor (gh pr 389)
- Implemented __abs__ for relativedelta. Reported by binnisb and pferreir
(gh issue 350, pr 472)
- Fixed relativedelta.weeks property getter and setter to work for both
negative and positive values. Reported and fixed by souliane (gh issue 459,
pr 460)
- Fixed issue where passing whole number floats to the months or years
arguments of the relativedelta constructor would lead to errors during
addition. Reported by arouanet (gh pr 411), fixed by lkollar (gh pr 553)
- Added a pre-built tz.UTC object representing UTC (gh pr 497)
- Added a cache to tz.gettz so that by default it will return the same object
for identical inputs. This will change the semantics of certain operations
between datetimes constructed with tzinfo=tz.gettz(...). (gh pr 628)
- Changed the behavior of tz.tzutc to return a singleton (gh pr 497, 504)
- Changed the behavior of tz.tzoffset to return the same object when passed the
same inputs, with a corresponding performance improvement (gh pr 504)
- Changed the behavior of tz.tzstr to return the same object when passed the
same inputs. (gh pr 628)
- Added .instance alternate constructors for tz.tzoffset and tz.tzstr, to
allow the construction of a new instance if desired. (gh pr 628)
- Added the tz.gettz.nocache function to allow explicit retrieval of a new
instance of the relevant tzinfo. (gh pr 628)
- Expand definition of tz.tzlocal equality so that the local zone is allow
equality with tzoffset and tzutc. (gh pr 598)
- Deprecated the idiosyncratic tzstr format mentioned in several examples but
evidently designed exclusively for dateutil, and very likely not used by
any current users. (gh issue 595, gh pr 606)
- Added the tz.resolve_imaginary function, which generates a real date from
an imaginary one, if necessary. Implemented by Cheukting (gh issue 339,
gh pr 607)
- Fixed issue where the tz.tzstr constructor would erroneously succeed if
passed an invalid value for tzstr. Fixed by pablogsal (gh issue 259,
gh pr 581)
- Fixed issue with tz.gettz for TZ variables that start with a colon. Reported
and fixed by lapointexavier (gh pr 601)
- Added a lock to tz.tzical's cache. Reported and fixed by Unrud (gh pr 430)
- Fixed an issue with fold support on certain Python 3 implementations that
used the pre-3.6 pure Python implementation of datetime.replace, most
notably pypy3 (gh pr 446).
- Added support for VALUE=DATE-TIME for DTSTART in rrulestr. Reported by potuz
(gh issue 401) and fixed by Unrud (gh pr 429)
- Started enforcing that within VTIMEZONE, the VALUE parameter can only be
omitted or DATE-TIME, per RFC 5545. Reported by Unrud (gh pr 439)
- Added support for TZID parameter for DTSTART in rrulestr. Reported and
fixed by ryanpetrello (gh issue 614, gh pr 624)
- Added 'RRULE:' prefix to rrule strings generated by rrule.__str__, in
compliance with the RFC. Reported by AndrewPashkin (gh issue 86), fixed by
jarondl and mlorant (gh pr 450)
- Switched to setuptools_scm for version management, automatically calculating
a version number from the git metadata. Reported by jreback (gh issue 511),
implemented by Sulley38 (gh pr 564)
- Switched setup.py to use find_packages, and started testing against pip
installed versions of dateutil in CI. Fixed issue with parser import
discovered by jreback in pandas-dev/pandas18141. (gh issue 507, pr 509)
- Switched test suite to using pytest (gh pr 495)
- Switched CI over to use tox. Fixed by gaborbernat (gh pr 549)
- Added a test-only dependency on freezegun. (gh pr 474)
- Reduced number of CI builds on Appveyor. Fixed by kirit93 (gh issue 529,
gh pr 579)
- Made xfails strict by default, so that an xpass is a failure. (gh pr 567)
- Added a documentation generation stage to tox and CI. (gh pr 568)
- Added an explicit warning when running python setup.py explaining how to run
the test suites with pytest. Fixed by lkollar. (gh issue 544, gh pr 548)
- Added requirements-dev.txt for test dependency management (gh pr 499, 516)
- Fixed code coverage metrics to account for Windows builds (gh pr 526)
- Fixed code coverage metrics to NOT count xfails. Fixed by gaborbernat
(gh issue 519, gh pr 563)
- Style improvement to zoneinfo.tzfile that was confusing to static type
checkers. Reported and fixed by quodlibetor (gh pr 485)
- Several unused imports were removed by jdufresne. (gh pr 486)
- Switched isinstance(*, collections.Callable) to callable, which is available
on all supported Python versions. Implemented by jdufresne (gh pr 612)
- Added CONTRIBUTING.md (gh pr 533)
- Added AUTHORS.md (gh pr 542)
- Corrected setup.py metadata to reflect author vs. maintainer, (gh issue 477,
gh pr 538)
- Corrected README to reflect that tests are now run in pytest. Reported and
fixed by m-dz (gh issue 556, gh pr 557)
- Updated all references to RFC 2445 (iCalendar) to point to RFC 5545. Fixed
by mariocj89 (gh issue 543, gh pr 555)
- Corrected parse documentation to reflect proper integer offset units,
reported and fixed by abrugh (gh pr 458)
- Fixed dangling parenthesis in tzoffset documentation (gh pr 461)
- Started including the license file in wheels. Reported and fixed by
jdufresne (gh pr 476)
- Indendation fixes to parser docstring by jbrockmendel (gh pr 492)
- Moved many examples from the "examples" documentation into their appropriate
module documentation pages. Fixed by Tomasz-Kluczkowski and jakec-github
(gh pr 558, 561)
- Fixed documentation so that the parser.isoparse documentation displays.
Fixed by alexchamberlain (gh issue 545, gh pr 560)
- Refactored build and release sections and added setup instructions to
CONTRIBUTING. Reported and fixed by kynan (gh pr 562)
- Cleaned up various dead links in the documentation. (gh pr 602, 608, 618)
```
Links
- PyPI: https://pypi.python.org/pypi/python-dateutil
- Changelog: https://pyup.io/changelogs/python-dateutil/
- Docs: https://dateutil.readthedocs.io
Changelog
### 1.7.2
```
=====================================
Incompatible changes
--------------------
* 4520: apidoc: folders with an empty __init__.py are no longer excluded from
TOC
Bugs fixed
----------
* 4669: sphinx.build_main and sphinx.make_main throw NameError
* 4685: autosummary emits meaningless warnings
* autodoc: crashed when invalid options given
* pydomain: always strip parenthesis if empty (refs: 1042)
* 4689: autosummary: unexpectedly strips docstrings containing "i.e."
* 4701: viewcode: Misplaced ``<div>`` in viewcode html output
* 4444: Don't require numfig to use :numref: on sections
* 4727: Option clash for package textcomp
* 4725: Sphinx does not work with python 3.5.0 and 3.5.1
* 4716: Generation PDF file with TexLive on Windows, file not found error
* 4574: vertical space before equation in latex
* 4720: message when an image is mismatched for builder is not clear
* 4655, 4684: Incomplete localization strings in Polish and Chinese
* 2286: Sphinx crashes when error is happens in rendering HTML pages
* 4688: Error to download remote images having long URL
* 4754: sphinx/pycode/__init__.py raises AttributeError
* 1435: qthelp builder should htmlescape keywords
* epub: Fix docTitle elements of toc.ncx is not escaped
* 4520: apidoc: Subpackage not in toc (introduced in 1.6.6) now fixed
```
Links
- PyPI: https://pypi.python.org/pypi/sphinx
- Changelog: https://pyup.io/changelogs/sphinx/
- Homepage: http://sphinx-doc.org/
Changelog
### 2.0.3
```
==========================
*March 6, 2018*
Django 2.0.3 fixes two security issues and several bugs in 2.0.2. Also, the
latest string translations from Transifex are incorporated.
CVE-2018-7536: Denial-of-service possibility in ``urlize`` and ``urlizetrunc`` template filters
===============================================================================================
The ``django.utils.html.urlize()`` function was extremely slow to evaluate
certain inputs due to catastrophic backtracking vulnerabilities in two regular
expressions. The ``urlize()`` function is used to implement the ``urlize`` and
``urlizetrunc`` template filters, which were thus vulnerable.
The problematic regular expressions are replaced with parsing logic that
behaves similarly.
CVE-2018-7537: Denial-of-service possibility in ``truncatechars_html`` and ``truncatewords_html`` template filters
==================================================================================================================
If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods were
passed the ``html=True`` argument, they were extremely slow to evaluate certain
inputs due to a catastrophic backtracking vulnerability in a regular
expression. The ``chars()`` and ``words()`` methods are used to implement the
``truncatechars_html`` and ``truncatewords_html`` template filters, which were
thus vulnerable.
The backtracking problem in the regular expression is fixed.
Bugfixes
========
* Fixed a regression that caused sliced ``QuerySet.distinct().order_by()``
followed by ``count()`` to crash (:ticket:`29108`).
* Prioritized the datetime and time input formats without ``%f`` for the Thai
locale to fix the admin time picker widget displaying "undefined"
(:ticket:`29109`).
* Fixed crash with ``QuerySet.order_by(Exists(...))`` (:ticket:`29118`).
* Made ``Q.deconstruct()`` deterministic with multiple keyword arguments
(:ticket:`29125`). You may need to modify ``Q``'s in existing migrations, or
accept an autogenerated migration.
* Fixed a regression where a ``When()`` expression with a list argument crashes
(:ticket:`29166`).
* Fixed crash when using a ``Window()`` expression in a subquery
(:ticket:`29172`).
* Fixed ``AbstractBaseUser.normalize_username()`` crash if the ``username``
argument isn't a string (:ticket:`29176`).
==========================
```
### 2.0.2
```
==========================
*February 1, 2018*
Django 2.0.2 fixes a security issue and several bugs in 2.0.1.
CVE-2018-6188: Information leakage in ``AuthenticationForm``
============================================================
A regression in Django 1.11.8 made
:class:`~django.contrib.auth.forms.AuthenticationForm` run its
``confirm_login_allowed()`` method even if an incorrect password is entered.
This can leak information about a user, depending on what messages
``confirm_login_allowed()`` raises. If ``confirm_login_allowed()`` isn't
overridden, an attacker enter an arbitrary username and see if that user has
been set to ``is_active=False``. If ``confirm_login_allowed()`` is overridden,
more sensitive details could be leaked.
This issue is fixed with the caveat that ``AuthenticationForm`` can no longer
raise the "This account is inactive." error if the authentication backend
rejects inactive users (the default authentication backend, ``ModelBackend``,
has done that since Django 1.10). This issue will be revisited for Django 2.1
as a fix to address the caveat will likely be too invasive for inclusion in
older versions.
Bugfixes
========
* Fixed hidden content at the bottom of the "The install worked successfully!"
page for some languages (:ticket:`28885`).
* Fixed incorrect foreign key nullification if a model has two foreign keys to
the same model and a target model is deleted (:ticket:`29016`).
* Fixed regression in the use of ``QuerySet.values_list(..., flat=True)``
followed by ``annotate()`` (:ticket:`29067`).
* Fixed a regression where a queryset that annotates with geometry objects
crashes (:ticket:`29054`).
* Fixed a regression where ``contrib.auth.authenticate()`` crashes if an
authentication backend doesn't accept ``request`` and a later one does
(:ticket:`29071`).
* Fixed a regression where ``makemigrations`` crashes if a migrations directory
doesn't have an ``__init__.py`` file (:ticket:`29091`).
* Fixed crash when entering an invalid uuid in ``ModelAdmin.raw_id_fields``
(:ticket:`29094`).
==========================
```
### 2.0.1
```
==========================
*January 1, 2018*
Django 2.0.1 fixes several bugs in 2.0.
Bugfixes
========
* Fixed a regression in Django 1.11 that added newlines between ``MultiWidget``'s
subwidgets (:ticket:`28890`).
* Fixed incorrect class-based model index name generation for models with
quoted ``db_table`` (:ticket:`28876`).
* Fixed incorrect foreign key constraint name for models with quoted
``db_table`` (:ticket:`28876`).
* Fixed a regression in caching of a ``GenericForeignKey`` when the referenced
model instance uses more than one level of multi-table inheritance
(:ticket:`28856`).
* Reallowed filtering a queryset with ``GeometryField=None`` (:ticket:`28896`).
* Corrected admin check to allow a ``OneToOneField`` in
``ModelAdmin.autocomplete_fields`` (:ticket:`28898`).
* Fixed a regression on SQLite where ``DecimalField`` returned a result with
trailing zeros in the fractional part truncated (:ticket:`28915`).
* Fixed crash in the ``testserver`` command startup (:ticket:`28941`).
* Fixed crash when coercing a translatable URL pattern to ``str``
(:ticket:`28947`).
* Fixed crash on SQLite when renaming a field in a model referenced by a
``ManyToManyField`` (:ticket:`28884`).
* Fixed a crash when chaining ``values()`` or ``values_list()`` after
``QuerySet.select_for_update(of=(...))`` (:ticket:`28944`).
* Fixed admin changelist crash when using a query expression in the page's
ordering (:ticket:`28958`).
========================
```
### 2.0
```
========================
*December 2, 2017*
Welcome to Django 2.0!
These release notes cover the :ref:`new features <whats-new-2.0>`, as well as
some :ref:`backwards incompatible changes <backwards-incompatible-2.0>` you'll
want to be aware of when upgrading from Django 1.11 or earlier. We've
:ref:`dropped some features<removed-features-2.0>` that have reached the end of
their deprecation cycle, and we've :ref:`begun the deprecation process for some
features <deprecated-features-2.0>`.
This release starts Django's use of a :ref:`loose form of semantic versioning
<internal-release-cadence>`, but there aren't any major backwards incompatible
changes that might be expected of a 2.0 release. Upgrading should be a similar
amount of effort as past feature releases.
See the :doc:`/howto/upgrade-version` guide if you're updating an existing
project.
Python compatibility
====================
Django 2.0 supports Python 3.4, 3.5, and 3.6. We **highly recommend** and only
officially support the latest release of each series.
The Django 1.11.x series is the last to support Python 2.7.
Django 2.0 will be the last release series to support Python 3.4. If you plan
a deployment of Python 3.4 beyond the end-of-life for Django 2.0 (April 2019),
stick with Django 1.11 LTS (supported until April 2020) instead. Note, however,
that the end-of-life for Python 3.4 is March 2019.
Third-party library support for older version of Django
=======================================================
Following the release of Django 2.0, we suggest that third-party app authors
drop support for all versions of Django prior to 1.11. At that time, you should
be able to run your package's tests using ``python -Wd`` so that deprecation
warnings do appear. After making the deprecation warning fixes, your app should
be compatible with Django 2.0.
.. _whats-new-2.0:
What's new in Django 2.0
========================
Simplified URL routing syntax
-----------------------------
The new :func:`django.urls.path()` function allows a simpler, more readable URL
routing syntax. For example, this example from previous Django releases::
url(r'^articles/(?P<year>[0-9]{4})/$', views.year_archive),
could be written as::
path('articles/<int:year>/', views.year_archive),
The new syntax supports type coercion of URL parameters. In the example, the
view will receive the ``year`` keyword argument as an integer rather than as
a string. Also, the URLs that will match are slightly less constrained in the
rewritten example. For example, the year 10000 will now match since the year
integers aren't constrained to be exactly four digits long as they are in the
regular expression.
The ``django.conf.urls.url()`` function from previous versions is now available
as :func:`django.urls.re_path`. The old location remains for backwards
compatibility, without an imminent deprecation. The old
``django.conf.urls.include()`` function is now importable from ``django.urls``
so you can use ``from django.urls import include, path, re_path`` in your
URLconfs.
The :doc:`/topics/http/urls` document is rewritten to feature the new syntax
and provide more details.
Mobile-friendly ``contrib.admin``
---------------------------------
The admin is now responsive and supports all major mobile devices. Older
browsers may experience varying levels of graceful degradation.
Window expressions
------------------
The new :class:`~django.db.models.expressions.Window` expression allows
adding an ``OVER`` clause to querysets. You can use :ref:`window functions
<window-functions>` and :ref:`aggregate functions <aggregation-functions>` in
the expression.
Minor features
--------------
:mod:`django.contrib.admin`
~~~~~~~~~~~~~~~~~~~~~~~~~~~
* The new :attr:`.ModelAdmin.autocomplete_fields` attribute and
:meth:`.ModelAdmin.get_autocomplete_fields` method allow using an
`Select2 <https://select2.org>`_ search widget for ``ForeignKey`` and
``ManyToManyField``.
:mod:`django.contrib.auth`
~~~~~~~~~~~~~~~~~~~~~~~~~~
* The default iteration count for the PBKDF2 password hasher is increased from
36,000 to 100,000.
:mod:`django.contrib.gis`
~~~~~~~~~~~~~~~~~~~~~~~~~
* Added MySQL support for the
:class:`~django.contrib.gis.db.models.functions.AsGeoJSON` function,
:class:`~django.contrib.gis.db.models.functions.GeoHash` function,
:class:`~django.contrib.gis.db.models.functions.IsValid` function,
:lookup:`isvalid` lookup, and :ref:`distance lookups <distance-lookups>`.
* Added the :class:`~django.contrib.gis.db.models.functions.Azimuth` and
:class:`~django.contrib.gis.db.models.functions.LineLocatePoint` functions,
supported on PostGIS and SpatiaLite.
* Any :class:`~django.contrib.gis.geos.GEOSGeometry` imported from GeoJSON now
has its SRID set.
* Added the :attr:`.OSMWidget.default_zoom` attribute to customize the map's
default zoom level.
* Made metadata readable and editable on rasters through the
:attr:`~django.contrib.gis.gdal.GDALRaster.metadata`,
:attr:`~django.contrib.gis.gdal.GDALRaster.info`, and
:attr:`~django.contrib.gis.gdal.GDALBand.metadata` attributes.
* Allowed passing driver-specific creation options to
:class:`~django.contrib.gis.gdal.GDALRaster` objects using ``papsz_options``.
* Allowed creating :class:`~django.contrib.gis.gdal.GDALRaster` objects in
GDAL's internal virtual filesystem. Rasters can now be :ref:`created from and
converted to binary data <gdal-raster-vsimem>` in-memory.
* The new :meth:`GDALBand.color_interp()
<django.contrib.gis.gdal.GDALBand.color_interp>` method returns the color
interpretation for the band.
:mod:`django.contrib.postgres`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* The new ``distinct`` argument for
:class:`~django.contrib.postgres.aggregates.ArrayAgg` determines if
concatenated values will be distinct.
* The new :class:`~django.contrib.postgres.functions.RandomUUID` database
function returns a version 4 UUID. It requires use of PostgreSQL's
``pgcrypto`` extension which can be activated using the new
:class:`~django.contrib.postgres.operations.CryptoExtension` migration
operation.
* :class:`django.contrib.postgres.indexes.GinIndex` now supports the
``fastupdate`` and ``gin_pending_list_limit`` parameters.
* The new :class:`~django.contrib.postgres.indexes.GistIndex` class allows
creating ``GiST`` indexes in the database. The new
:class:`~django.contrib.postgres.operations.BtreeGistExtension` migration
operation installs the ``btree_gist`` extension to add support for operator
classes that aren't built-in.
* :djadmin:`inspectdb` can now introspect ``JSONField`` and various
``RangeField``\s (``django.contrib.postgres`` must be in ``INSTALLED_APPS``).
:mod:`django.contrib.sitemaps`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* Added the ``protocol`` keyword argument to the
:class:`~django.contrib.sitemaps.GenericSitemap` constructor.
Cache
~~~~~
* ``cache.set_many()`` now returns a list of keys that failed to be inserted.
For the built-in backends, failed inserts can only happen on memcached.
File Storage
~~~~~~~~~~~~
* :meth:`File.open() <django.core.files.File.open>` can be used as a context
manager, e.g. ``with file.open() as f:``.
Forms
~~~~~
* The new ``date_attrs`` and ``time_attrs`` arguments for
:class:`~django.forms.SplitDateTimeWidget` and
:class:`~django.forms.SplitHiddenDateTimeWidget` allow specifying different
HTML attributes for the ``DateInput`` and ``TimeInput`` (or hidden)
subwidgets.
* The new :meth:`Form.errors.get_json_data()
<django.forms.Form.errors.get_json_data>` method returns form errors as
a dictionary suitable for including in a JSON response.
Generic Views
~~~~~~~~~~~~~
* The new :attr:`.ContextMixin.extra_context` attribute allows adding context
in ``View.as_view()``.
Management Commands
~~~~~~~~~~~~~~~~~~~
* :djadmin:`inspectdb` now translates MySQL's unsigned integer columns to
``PositiveIntegerField`` or ``PositiveSmallIntegerField``.
* The new :option:`makemessages --add-location` option controls the comment
format in PO files.
* :djadmin:`loaddata` can now :ref:`read from stdin <loading-fixtures-stdin>`.
* The new :option:`diffsettings --output` option allows formatting the output
in a unified diff format.
* On Oracle, :djadmin:`inspectdb` can now introspect ``AutoField`` if the
column is created as an identity column.
* On MySQL, :djadmin:`dbshell` now supports client-side TLS certificates.
Migrations
~~~~~~~~~~
* The new :option:`squashmigrations --squashed-name` option allows naming the
squashed migration.
Models
~~~~~~
* The new :class:`~django.db.models.functions.StrIndex` database function
finds the starting index of a string inside another string.
* On Oracle, ``AutoField`` and ``BigAutoField`` are now created as `identity
columns`_.
.. _`identity columns`: https://docs.oracle.com/database/121/DRDAA/migr_tools_feat.htmDRDAA109
* The new ``chunk_size`` parameter of :meth:`.QuerySet.iterator` controls the
number of rows fetched by the Python database client when streaming results
from the database. For databases that don't support server-side cursors, it
controls the number of results Django fetches from the database adapter.
* :meth:`.QuerySet.earliest`, :meth:`.QuerySet.latest`, and
:attr:`Meta.get_latest_by <django.db.models.Options.get_latest_by>` now
allow ordering by several fields.
* Added the :class:`~django.db.models.functions.ExtractQuarter` function to
extract the quarter from :class:`~django.db.models.DateField` and
:class:`~django.db.models.DateTimeField`, and exposed it through the
:lookup:`quarter` lookup.
* Added the :class:`~django.db.models.functions.TruncQuarter` function to
truncate :class:`~django.db.models.DateField` and
:class:`~django.db.models.DateTimeField` to the first day of a quarter.
* Added the :attr:`~django.db.models.Index.db_tablespace` parameter to
class-based indexes.
* If the database supports a native duration field (Oracle and PostgreSQL),
:class:`~django.db.models.functions.Extract` now works with
:class:`~django.db.models.DurationField`.
* Added the ``of`` argument to :meth:`.QuerySet.select_for_update()`, supported
on PostgreSQL and Oracle, to lock only rows from specific tables rather than
all selected tables. It may be helpful particularly when
:meth:`~.QuerySet.select_for_update()` is used in conjunction with
:meth:`~.QuerySet.select_related()`.
* The new ``field_name`` parameter of :meth:`.QuerySet.in_bulk` allows fetching
results based on any unique model field.
* :meth:`.CursorWrapper.callproc()` now takes an optional dictionary of keyword
parameters, if the backend supports this feature. Of Django's built-in
backends, only Oracle supports it.
* The new :meth:`connection.execute_wrapper()
<django.db.backends.base.DatabaseWrapper.execute_wrapper>` method allows
:doc:`installing wrappers around execution of database queries
</topics/db/instrumentation>`.
* The new ``filter`` argument for built-in aggregates allows :ref:`adding
different conditionals <conditional-aggregation>` to multiple aggregations
over the same fields or relations.
* Added support for expressions in :attr:`Meta.ordering
<django.db.models.Options.ordering>`.
* The new ``named`` parameter of :meth:`.QuerySet.values_list` allows fetching
results as named tuples.
* The new :class:`.FilteredRelation` class allows adding an ``ON`` clause to
querysets.
Pagination
~~~~~~~~~~
* Added :meth:`Paginator.get_page() <django.core.paginator.Paginator.get_page>`
to provide the documented pattern of handling invalid page numbers.
Requests and Responses
~~~~~~~~~~~~~~~~~~~~~~
* The :djadmin:`runserver` Web server supports HTTP 1.1.
Templates
~~~~~~~~~
* To increase the usefulness of :meth:`.Engine.get_default` in third-party
apps, it now returns the first engine if multiple ``DjangoTemplates`` engines
are configured in ``TEMPLATES`` rather than raising ``ImproperlyConfigured``.
* Custom template tags may now accept keyword-only arguments.
Tests
~~~~~
* Added threading support to :class:`~django.test.LiveServerTestCase`.
* Added settings that allow customizing the test tablespace parameters for
Oracle: :setting:`DATAFILE_SIZE`, :setting:`DATAFILE_TMP_SIZE`,
:setting:`DATAFILE_EXTSIZE`, and :setting:`DATAFILE_TMP_EXTSIZE`.
Validators
~~~~~~~~~~
* The new :class:`.ProhibitNullCharactersValidator` disallows the null
character in the input of the :class:`~django.forms.CharField` form field
and its subclasses. Null character input was observed from vulnerability
scanning tools. Most databases silently discard null characters, but
psycopg2 2.7+ raises an exception when trying to save a null character to
a char/text field with PostgreSQL.
.. _backwards-incompatible-2.0:
Backwards incompatible changes in 2.0
=====================================
Removed support for bytestrings in some places
----------------------------------------------
To support native Python 2 strings, older Django versions had to accept both
bytestrings and unicode strings. Now that Python 2 support is dropped,
bytestrings should only be encountered around input/output boundaries (handling
of binary fields or HTTP streams, for example). You might have to update your
code to limit bytestring usage to a minimum, as Django no longer accepts
bytestrings in certain code paths. Python's :option:`-b` option may help detect
that mistake in your code.
For example, ``reverse()`` now uses ``str()`` instead of ``force_text()`` to
coerce the ``args`` and ``kwargs`` it receives, prior to their placement in
the URL. For bytestrings, this creates a string with an undesired ``b`` prefix
as well as additional quotes (``str(b'foo')`` is ``"b'foo'"``). To adapt, call
``decode()`` on the bytestring before passing it to ``reverse()``.
Database backend API
--------------------
This section describes changes that may be needed in third-party database
backends.
* The ``DatabaseOperations.datetime_cast_date_sql()``,
``datetime_cast_time_sql()``, ``datetime_trunc_sql()``,
``datetime_extract_sql()``, and ``date_interval_sql()`` methods now return
only the SQL to perform the operation instead of SQL and a list of
parameters.
* Third-party database backends should add a ``DatabaseWrapper.display_name``
attribute with the name of the database that your backend works with. Django
may use it in various messages, such as in system checks.
* The first argument of ``SchemaEditor._alter_column_type_sql()`` is now
``model`` rather than ``table``.
* The first argument of ``SchemaEditor._create_index_name()`` is now
``table_name`` rather than ``model``.
* To enable ``FOR UPDATE OF`` support, set
``DatabaseFeatures.has_select_for_update_of = True``. If the database
requires that the arguments to ``OF`` be columns rather than tables, set
``DatabaseFeatures.select_for_update_of_column = True``.
* To enable support for :class:`~django.db.models.expressions.Window`
expressions, set ``DatabaseFeatures.supports_over_clause`` to ``True``. You
may need to customize the ``DatabaseOperations.window_start_rows_start_end()``
and/or ``window_start_range_start_end()`` methods.
* Third-party database backends should add a
``DatabaseOperations.cast_char_field_without_max_length`` attribute with the
database data type that will be used in the
:class:`~django.db.models.functions.Cast` function for a ``CharField`` if the
``max_length`` argument isn't provided.
* The first argument of ``DatabaseCreation._clone_test_db()`` and
``get_test_db_clone_settings()`` is now ``suffix`` rather
than ``number`` (in case you want to rename the signatures in your backend
for consistency). ``django.test`` also now passes those values as strings
rather than as integers.
* Third-party database backends should add a
``DatabaseIntrospection.get_sequences()`` method based on the stub in
``BaseDatabaseIntrospection``.
Dropped support for Oracle 11.2
-------------------------------
The end of upstream support for Oracle 11.2 is Dec. 2020. Django 1.11 will be
supported until April 2020 which almost reaches this date. Django 2.0
officially supports Oracle 12.1+.
Default MySQL isolation level is read committed
-----------------------------------------------
MySQL's default isolation level, repeatable read, may cause data loss in
typical Django usage. To prevent that and for consistency with other databases,
the default isolation level is now read committed. You can use the
:setting:`DATABASES` setting to :ref:`use a different isolation level
<mysql-isolation-level>`, if needed.
:attr:`AbstractUser.last_name <django.contrib.auth.models.User.last_name>` ``max_length`` increased to 150
----------------------------------------------------------------------------------------------------------
A migration for :attr:`django.contrib.auth.models.User.last_name` is included.
If you have a custom user model inheriting from ``AbstractUser``, you'll need
to generate and apply a database migration for your user model.
If you want to preserve the 30 character limit for last names, use a custom
form::
from django.contrib.auth.forms import UserChangeForm
class MyUserChangeForm(UserChangeForm):
last_name = forms.CharField(max_length=30, required=False)
If you wish to keep this restriction in the admin when editing users, set
``UserAdmin.form`` to use this form::
from django.contrib.auth.admin import UserAdmin
from django.contrib.auth.models import User
class MyUserAdmin(UserAdmin):
form = MyUserChangeForm
admin.site.unregister(User)
admin.site.register(User, MyUserAdmin)
``QuerySet.reverse()`` and ``last()`` are prohibited after slicing
------------------------------------------------------------------
Calling ``QuerySet.reverse()`` or ``last()`` on a sliced queryset leads to
unexpected results due to the slice being applied after reordering. This is
now prohibited, e.g.::
>>> Model.objects.all()[:2].reverse()
Traceback (most recent call last):
...
TypeError: Cannot reverse a query once a slice has been taken.
Form fields no longer accept optional arguments as positional arguments
-----------------------------------------------------------------------
To help prevent runtime errors due to incorrect ordering of form field
arguments, optional arguments of built-in form fields are no longer accepted
as positional arguments. For example::
forms.IntegerField(25, 10)
raises an exception and should be replaced with::
forms.IntegerField(max_value=25, min_value=10)
``call_command()`` validates the options it receives
----------------------------------------------------
``call_command()`` now validates that the argument parser of the command being
called defines all of the options passed to ``call_command()``.
For custom management commands that use options not created using
``parser.add_argument()``, add a ``stealth_options`` attribute on the command::
class MyCommand(BaseCommand):
stealth_options = ('option_name', ...)
Indexes no longer accept positional arguments
---------------------------------------------
For example::
models.Index(['headline', '-pub_date'], 'index_name')
raises an exception and should be replaced with::
models.Index(fields=['headline', '-pub_date'], name='index_name')
Foreign key constraints are now enabled on SQLite
-------------------------------------------------
This will appear as a backwards-incompatible change (``IntegrityError:
FOREIGN KEY constraint failed``) if attempting to save an existing model
instance that's violating a foreign key constraint.
Foreign keys are now created with ``DEFERRABLE INITIALLY DEFERRED`` instead of
``DEFERRABLE IMMEDIATE``. Thus, tables may need to be rebuilt to recreate
foreign keys with the new definition, particularly if you're using a pattern
like this::
from django.db import transaction
with transaction.atomic():
Book.objects.create(author_id=1)
Author.objects.create(id=1)
If you don't recreate the foreign key as ``DEFERRED``, the first ``create()``
would fail now that foreign key constraints are enforced.
Backup your database first! After upgrading to Django 2.0, you can then
rebuild tables using a script similar to this::
from django.apps import apps
from django.db import connection
for app in apps.get_app_configs():
for model in app.get_models(include_auto_created=True):
if model._meta.managed and not (model._meta.proxy or model._meta.swapped):
for base in model.__bases__:
if hasattr(base, '_meta'):
base._meta.local_many_to_many = []
model._meta.local_many_to_many = []
with connection.schema_editor() as editor:
editor._remake_table(model)
This script hasn't received extensive testing and needs adaption for various
cases such as multiple databases. Feel free to contribute improvements.
In addition, because of a table alteration limitation of SQLite, it's prohibited
to perform :class:`~django.db.migrations.operations.RenameModel` and
:class:`~django.db.migrations.operations.RenameField` operations on models or
fields referenced by other models in a transaction. In order to allow migrations
containing these operations to be applied, you must set the
``Migration.atomic`` attribute to ``False``.
Miscellaneous
-------------
* The ``SessionAuthenticationMiddleware`` class is removed. It provided no
functionality since session authentication is unconditionally enabled in
Django 1.10.
* The default HTTP error handlers (``handler404``, etc.) are now callables
instead of dotted Python path strings. Django favors callable references
since they provide better performance and debugging experience.
* :class:`~django.views.generic.base.RedirectView` no longer silences
``NoReverseMatch`` if the ``pattern_name`` doesn't exist.
* When :setting:`USE_L10N` is off, :class:`~django.forms.FloatField` and
:class:`~django.forms.DecimalField` now respect :setting:`DECIMAL_SEPARATOR`
and :setting:`THOUSAND_SEPARATOR` during validation. For example, with the
settings::
USE_L10N = False
USE_THOUSAND_SEPARATOR = True
DECIMAL_SEPARATOR = ','
THOUSAND_SEPARATOR = '.'
an input of ``"1.345"`` is now converted to ``1345`` instead of ``1.345``.
* Subclasses of :class:`~django.contrib.auth.models.AbstractBaseUser` are no
longer required to implement ``get_short_name()`` and ``get_full_name()``.
(The base implementations that raise ``NotImplementedError`` are removed.)
``django.contrib.admin`` uses these methods if implemented but doesn't
require them. Third-party apps that use these methods may want to adopt a
similar approach.
* The ``FIRST_DAY_OF_WEEK`` and ``NUMBER_GROUPING`` format settings are now
kept as integers in JavaScript and JSON i18n view outputs.
* :meth:`~django.test.TransactionTestCase.assertNumQueries` now ignores
connection configuration queries. Previously, if a test opened a new database
connection, those queries could be included as part of the
``assertNumQueries()`` count.
* The default size of the Oracle test tablespace is increased from 20M to 50M
and the default autoextend size is increased from 10M to 25M.
* To improve performance when streaming large result sets from the database,
:meth:`.QuerySet.iterator` now fetches 2000 rows at a time instead of 100.
The old behavior can be restored using the ``chunk_size`` parameter. For
example::
Book.objects.iterator(chunk_size=100)
* Providing unknown package names in the ``packages`` argument of the
:class:`~django.views.i18n.JavaScriptCatalog` view now raises ``ValueError``
instead of passing silently.
* A model instance's primary key now appears in the default ``Model.__str__()``
method, e.g. ``Question object (1)``.
* ``makemigrations`` now detects changes to the model field ``limit_choices_to``
option. Add this to your existing migrations or accept an auto-generated
migration for fields that use it.
* Performing queries that require :ref:`automatic spatial transformations
<automatic-spatial-transformations>` now raises ``NotImplementedError``
on MySQL instead of silently using non-transformed geometries.
* ``django.core.exceptions.DjangoRuntimeWarning`` is removed. It was only used
in the cache backend as an intermediate class in ``CacheKeyWarning``'s
inheritance of ``RuntimeWarning``.
* Renamed ``BaseExpression._output_field`` to ``output_field``. You may need
to update custom expressions.
* In older versions, forms and formsets combine their ``Media`` with widget
``Media`` by concatenating the two. The combining now tries to :ref:`preserve
the relative order of elements in each list <form-media-asset-order>`.
``MediaOrderConflictWarning`` is issued if the order can't be preserved.
* ``django.contrib.gis.gdal.OGRException`` is removed. It's been an alias for
``GDALException`` since Django 1.8.
* Support for GEOS 3.3.x is dropped.
* The way data is selected for ``GeometryField`` is changed to improve
performance, and in raw SQL queries, those fields must now be wrapped in
``connection.ops.select``. See the :ref:`Raw queries note<gis-raw-sql>` in
the GIS tutorial for an example.
.. _deprecated-features-2.0:
Features deprecated in 2.0
==========================
``context`` argument of ``Field.from_db_value()`` and ``Expression.convert_value()``
------------------------------------------------------------------------------------
The ``context`` argument of ``Field.from_db_value()`` and
``Expression.convert_value()`` is unused as it's always an empty dictionary.
The signature of both methods is now::
(self, value, expression, connection)
instead of::
(self, value, expression, connection, context)
Support for the old signature in custom fields and expressions remains until
Django 3.0.
Miscellaneous
-------------
* The ``django.db.backends.postgresql_psycopg2`` module is deprecated in favor
of ``django.db.backends.postgresql``. It's been an alias since Django 1.9.
This only affects code that imports from the module directly. The
``DATABASES`` setting can still use
``'django.db.backends.postgresql_psycopg2'``, though you can simplify that by
using the ``'django.db.backends.postgresql'`` name added in Django 1.9.
* ``django.shortcuts.render_to_response()`` is deprecated in favor of
:func:`django.shortcuts.render`. ``render()`` takes the same arguments
except that it also requires a ``request``.
* The ``DEFAULT_CONTENT_TYPE`` setting is deprecated. It doesn't interact well
well with third-party apps and is obsolete since HTML5 has mostly superseded
XHTML.
* ``HttpRequest.xreadlines()`` is deprecated in favor of iterating over the
request.
* The ``field_name`` keyword argument to :meth:`.QuerySet.earliest` and
:meth:`.QuerySet.latest` is deprecated in favor of passing the field
names as arguments. Write ``.earliest('pub_date')`` instead of
``.earliest(field_name='pub_date')``.
.. _removed-features-2.0:
Features removed in 2.0
=======================
These features have reached the end of their deprecation cycle and are removed
in Django 2.0.
See :ref:`deprecated-features-1.9` for details on these changes, including how
to remove usage of these features.
* The ``weak`` argument to ``django.dispatch.signals.Signal.disconnect()`` is
removed.
* ``django.db.backends.base.BaseDatabaseOperations.check_aggregate_support()``
is removed.
* The ``django.forms.extras`` package is removed.
* The ``assignment_tag`` helper is removed.
* The ``host`` argument to ``SimpleTestCase.assertsRedirects()`` is removed.
The compatibility layer which allows absolute URLs to be considered equal to
relative ones when the path is identical is also removed.
* ``Field.rel`` and ``Field.remote_field.to`` are removed.
* The ``on_delete`` argument for ``ForeignKey`` and ``OneToOneField`` is now
required in models and migrations. Consider squashing migrations so that you
have fewer of them to update.
* ``django.db.models.fields.add_lazy_relation()`` is removed.
* When time zone support is enabled, database backends that don't support time
zones no longer convert aware datetimes to naive values in UTC anymore when
such values are passed as parameters to SQL queries executed outside of the
ORM, e.g. with ``cursor.execute()``.
* ``django.contrib.auth.tests.utils.skipIfCustomUser()`` is removed.
* The ``GeoManager`` and ``GeoQuerySet`` classes are removed.
* The ``django.contrib.gis.geoip`` module is removed.
* The ``supports_recursion`` check for template loaders is removed from:
* ``django.template.engine.Engine.find_template()``
* ``django.template.loader_tags.ExtendsNode.find_template()``
* ``django.template.loaders.base.Loader.supports_recursion()``
* ``django.template.loaders.cached.Loader.supports_recursion()``
* The ``load_template`` and ``load_template_sources`` template loader methods
are removed.
* The ``template_dirs`` argument for template loaders is removed:
* ``django.template.loaders.base.Loader.get_template()``
* ``django.template.loaders.cached.Loader.cache_key()``
* ``django.template.loaders.cached.Loader.get_template()``
* ``django.template.loaders.cached.Loader.get_template_sources()``
* ``django.template.loaders.filesystem.Loader.get_template_sources()``
* ``django.template.loaders.base.Loader.__call__()`` is removed.
* Support for custom error views that don't accept an ``exception`` parameter
is removed.
* The ``mime_type`` attribute of ``django.utils.feedgenerator.Atom1Feed`` and
``django.utils.feedgenerator.RssFeed`` is removed.
* The ``app_name`` argument to ``include()`` is removed.
* Support for passing a 3-tuple (including ``admin.site.urls``) as the first
argument to ``include()`` is removed.
* Support for setting a URL instance namespace without an application namespace
is removed.
* ``Field._get_val_from_obj()`` is removed.
* ``django.template.loaders.eggs.Loader`` is removed.
* The ``current_app`` parameter to the ``contrib.auth`` function-based views is
removed.
* The ``callable_obj`` keyword argument to
``SimpleTestCase.assertRaisesMessage()`` is removed.
* Support for the ``allow_tags`` attribute on ``ModelAdmin`` methods is
removed.
* The ``enclosure`` keyword argument to ``SyndicationFeed.add_item()`` is
removed.
* The ``django.template.loader.LoaderOrigin`` and
``django.template.base.StringOrigin`` aliases for
``django.template.base.Origin`` are removed.
See :ref:`deprecated-features-1.10` for details on these changes.
* The ``makemigrations --exit`` option is removed.
* Support for direct assignment to a reverse foreign key or many-to-many
relation is removed.
* The ``get_srid()`` and ``set_srid()`` methods of
``django.contrib.gis.geos.GEOSGeometry`` are removed.
* The ``get_x()``, ``set_x()``, ``get_y()``, ``set_y()``, ``get_z()``, and
``set_z()`` methods of ``django.contrib.gis.geos.Point`` are removed.
* The ``get_coords()`` and ``set_coords()`` methods of
``django.contrib.gis.geos.Point`` are removed.
* The ``cascaded_union`` property of ``django.contrib.gis.geos.MultiPolygon``
is removed.
* ``django.utils.functional.allow_lazy()`` is removed.
* The ``shell --plain`` option is removed.
* The ``django.core.urlresolvers`` module is removed in favor of its new
location, ``django.urls``.
* ``CommaSeparatedIntegerField`` is removed, except for support in historical
migrations.
* The template ``Context.has_key()`` method is removed.
* Support for the ``django.core.files.storage.Storage.accessed_time()``,
``created_time()``, and ``modified_time()`` methods is removed.
* Support for query lookups using the model name when
``Meta.default_related_name`` is set is removed.
* The MySQL ``__search`` lookup is removed.
* The shim for supporting custom related manager classes without a
``_apply_rel_filters()`` method is removed.
* Using ``User.is_authenticated()`` and ``User.is_anonymous()`` as methods
rather than properties is no longer supported.
* The ``Model._meta.virtual_fields`` attribute is removed.
* The keyword arguments ``virtual_only`` in ``Field.contribute_to_class()`` and
``virtual`` in ``Model._meta.add_field()`` are removed.
* The ``javascript_catalog()`` and ``json_catalog()`` views are removed.
* ``django.contrib.gis.utils.precision_wkt()`` is removed.
* In multi-table inheritance, implicit promotion of a ``OneToOneField`` to a
``parent_link`` is removed.
* Support for ``Widget._format_value()`` is removed.
* ``FileField`` methods ``get_directory_name()`` and ``get_filename()`` are
removed.
* The ``mark_for_escaping()`` function and the classes it uses: ``EscapeData``,
``EscapeBytes``, ``EscapeText``, ``EscapeString``, and ``EscapeUnicode`` are
removed.
* The ``escape`` filter now uses ``django.utils.html.conditional_escape()``.
* ``Manager.use_for_related_fields`` is removed.
* Model ``Manager`` inheritance follows MRO inheritance rules. The requirement
to use ``Meta.manager_inheritance_from_future`` to opt-in to the behavior is
removed.
* Support for old-style middleware using ``settings.MIDDLEWARE_CLASSES`` is
removed.
============================
```
### 1.11.11
```
============================
*March 6, 2018*
Django 1.11.11 fixes two security issues in 1.11.10.
CVE-2018-7536: Denial-of-service possibility in ``urlize`` and ``urlizetrunc`` template filters
===============================================================================================
The ``django.utils.html.urlize()`` function was extremely slow to evaluate
certain inputs due to catastrophic backtracking vulnerabilities in two regular
expressions. The ``urlize()`` function is used to implement the ``urlize`` and
``urlizetrunc`` template filters, which were thus vulnerable.
The problematic regular expressions are replaced with parsing logic that
behaves similarly.
CVE-2018-7537: Denial-of-service possibility in ``truncatechars_html`` and ``truncatewords_html`` template filters
==================================================================================================================
If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods were
passed the ``html=True`` argument, they were extremely slow to evaluate certain
inputs due to a catastrophic backtracking vulnerability in a regular
expression. The ``chars()`` and ``words()`` methods are used to implement the
``truncatechars_html`` and ``truncatewords_html`` template filters, which were
thus vulnerable.
The backtracking problem in the regular expression is fixed.
============================
```
Links
- PyPI: https://pypi.python.org/pypi/django
- Changelog: https://pyup.io/changelogs/django/
- Homepage: https://www.djangoproject.com/
Changelog
### 3.0.0.89
```
This release of the Python agent removes previously deprecated APIs, makes SSL communication with New Relic mandatory, and updates support for aiohttp middleware.
The agent can be installed using easy_install/pip/distribute via the Python Package Index or can be downloaded directly from the New Relic download site.
Deprecations
Removed previously deprecated APIs
The following APIs have been removed:
transaction (use current_transaction)
name_transaction (use set_transaction_name)
Application.record_metric (use Application.record_custom_metric)
Application.record_metrics (use Application.record_custom_metrics)
Transaction.notice_error (use Transaction.record_exception)
Transaction.record_metric (use Transaction.record_custom_metric)
Transaction.name_transaction (use Transaction.set_transaction_name)
Deprecate Transaction.add_user_attribute
Transaction.add_user_attribute has been deprecated in favor of Transaction.add_custom_parameter. Transaction.add_user_attribute will be removed in a future release.
Deprecate Transaction.add_user_attributes
Transaction.add_user_attributes has been deprecated in favor of Transaction.add_custom_parameters. Transaction.add_user_attributes will be removed in a future release.
Deprecate wrap_callable
wrap_callable has been deprecated in favor of FunctionWrapper. wrap_callable will be removed in a future release.
Remove data-source admin command
The platform API (used by newrelic-admin data-source) has been removed. Please use data sources in place of the platform API.
SSL
SSL connections to New Relic are now mandatory
Prior to this version, using an SSL connection to New Relic was the default behavior. SSL connections are now enforced (not overrideable).
AIOHTTP Updates
Add automatic tracing of AIOHTTP 3 middleware
In addition to the old-style middleware previously supported, the AIOHTTP 3 style middleware is now automatically traced as part of the AIOHTTP instrumentation package.
```
### 2.106.1.88
```
This release of the Python agent includes a fix for security bulletin nr18-07.
The agent can be installed using easy_install/pip/distribute via the Python Package Index or can be downloaded directly from the New Relic download site.
```
Links
- PyPI: https://pypi.python.org/pypi/newrelic
- Changelog: https://pyup.io/changelogs/newrelic/
- Homepage: http://newrelic.com/docs/python/new-relic-for-python
- Bugtracker: http://support.newrelic.com
Changelog
### 3.4
```
===
- Remove support for Django 1.6 and 1.7 as they're out of life
- Adds pypy3, Django 2.0.x and current Django master to our CI tests
- Allow removing directives using csp_replace
- Add CSP nonce support
```
Links
- PyPI: https://pypi.python.org/pypi/django-csp
- Changelog: https://pyup.io/changelogs/django-csp/
- Repo: http://github.com/mozilla/django-csp
Changelog
### 2.2.1
```
~~~~~~~~~~~~~~~~~~
* Reverted a change to ``GeneralNames`` which prohibited having zero elements,
due to breakages.
* Fixed a bug in
:func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap_with_padding`
that caused it to raise ``InvalidUnwrap`` when key length modulo 8 was
zero.
.. _v2-2:
```
### 2.2
```
~~~~~~~~~~~~~~~~
* **BACKWARDS INCOMPATIBLE:** Support for Python 2.6 has been dropped.
* Resolved a bug in ``HKDF`` that incorrectly constrained output size.
* Added :class:`~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP256R1`,
:class:`~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP384R1`, and
:class:`~cryptography.hazmat.primitives.asymm
Update pytest from 3.4.1 to 3.5.0.
Changelog
### 3.4.2 ``` ========================= Bug Fixes --------- - Removed progress information when capture option is ``no``. (`3203 <https://github.com/pytest-dev/pytest/issues/3203>`_) - Refactor check of bindir from ``exists`` to ``isdir``. (`3241 <https://github.com/pytest-dev/pytest/issues/3241>`_) - Fix ``TypeError`` issue when using ``approx`` with a ``Decimal`` value. (`3247 <https://github.com/pytest-dev/pytest/issues/3247>`_) - Fix reference cycle generated when using the ``request`` fixture. (`3249 <https://github.com/pytest-dev/pytest/issues/3249>`_) - ``[tool:pytest]`` sections in ``*.cfg`` files passed by the ``-c`` option are now properly recognized. (`3260 <https://github.com/pytest-dev/pytest/issues/3260>`_) Improved Documentation ---------------------- - Add logging plugin to plugins list. (`3209 <https://github.com/pytest-dev/pytest/issues/3209>`_) Trivial/Internal Changes ------------------------ - Fix minor typo in fixture.rst (`3259 <https://github.com/pytest-dev/pytest/issues/3259>`_) ```Links
- PyPI: https://pypi.python.org/pypi/pytest - Changelog: https://pyup.io/changelogs/pytest/ - Repo: https://github.com/pytest-dev/pytest/issues - Homepage: http://pytest.orgUpdate python-dateutil from 2.6.1 to 2.7.2.
Changelog
### 2.7.2 ``` ========================== Bugfixes -------- - Fixed an issue with the setup script running in non-UTF-8 environment. Reported and fixed by gergondet (gh pr 651) Misc ---- - GH 655 ``` ### 2.7.1 ``` =========================== Data updates ------------ - Updated tzdata version to 2018d. Bugfixes -------- - Fixed issue where parser.parse would occasionally raise decimal.Decimal-specific error types rather than ValueError. Reported by amureki (gh issue 632). Fixed by pganssle (gh pr 636). - Improve error message when rrule's dtstart and until are not both naive or both aware. Reported and fixed by ryanpetrello (gh issue 633, gh pr 634) Misc ---- - GH 644, GH 648 ``` ### 2.7.0 ``` ============= - Dropped support for Python 2.6 (gh pr 362 by jdufresne) - Dropped support for Python 3.2 (gh pr 626) - Updated zoneinfo file to 2018c (gh pr 616) - Changed licensing scheme so all new contributions are dual licensed under Apache 2.0 and BSD. (gh pr 542, issue 496) - Added __all__ variable to the root package. Reported by tebriel (gh issue 406), fixed by mariocj89 (gh pr 494) - Added python_requires to setup.py so that pip will distribute the right version of dateutil. Fixed by jakec-github (gh issue 537, pr 552) - Added the utils submodule, for miscellaneous utilities. - Added within_delta function to utils - added by justanr (gh issue 432, gh pr 437) - Added today function to utils (gh pr 474) - Added default_tzinfo function to utils (gh pr 475), solving an issue reported by nealmcb (gh issue 94) - Added dedicated ISO 8601 parsing function isoparse (gh issue 424). Initial implementation by pganssle in gh pr 489 and 622, with a pre-release fix by kirit93 (gh issue 546, gh pr 573). - Moved parser module into parser/_parser.py and officially deprecated the use of several private functions and classes from that module. (gh pr 501, 515) - Tweaked parser error message to include rejected string format, added by pbiering (gh pr 300) - Add support for parsing bytesarray, reported by uckelman (gh issue 417) and fixed by uckelman and pganssle (gh pr 514) - Started raising a warning when the parser finds a timezone string that it cannot construct a tzinfo instance for (rather than succeeding with no indication of an error). Reported and fixed by jbrockmendel (gh pr 540) - Dropped the use of assert in the parser. Fixed by jbrockmendel (gh pr 502) - Fixed to assertion logic in parser to support dates like '2015-15-May', reported and fixed by jbrockmendel (gh pr 409) - Fixed IndexError in parser on dates with trailing colons, reported and fixed by jbrockmendel (gh pr 420) - Fixed bug where hours were not validated, leading to improper parse. Reported by heappro (gh pr 353), fixed by jbrockmendel (gh pr 482) - Fixed problem parsing strings in %b-%Y-%d format. Reported and fixed by jbrockmendel (gh pr 481) - Fixed problem parsing strings in the %d%B%y format. Reported by asishm (gh issue 360), fixed by jbrockmendel (gh pr 483) - Fixed problem parsing certain unambiguous strings when year <99 (gh pr 510). Reported by alexwlchan (gh issue 293). - Fixed issue with parsing an unambiguous string representation of an ambiguous datetime such that if possible the correct value for fold is set. Fixes issue reported by JordonPhillips and pganssle (gh issue 318, 320, gh pr 517) - Fixed issue with improper rounding of fractional components. Reported by dddmello (gh issue 427), fixed by m-dz (gh pr 570) - Performance improvement to parser from removing certain min() calls. Reported and fixed by jbrockmendel (gh pr 589) - Significantly refactored parser code by jbrockmendel (gh prs 419, 436, 490, 498, 539) and pganssle (gh prs 435, 468) - Implementated of __hash__ for relativedelta and weekday, reported and fixed by mrigor (gh pr 389) - Implemented __abs__ for relativedelta. Reported by binnisb and pferreir (gh issue 350, pr 472) - Fixed relativedelta.weeks property getter and setter to work for both negative and positive values. Reported and fixed by souliane (gh issue 459, pr 460) - Fixed issue where passing whole number floats to the months or years arguments of the relativedelta constructor would lead to errors during addition. Reported by arouanet (gh pr 411), fixed by lkollar (gh pr 553) - Added a pre-built tz.UTC object representing UTC (gh pr 497) - Added a cache to tz.gettz so that by default it will return the same object for identical inputs. This will change the semantics of certain operations between datetimes constructed with tzinfo=tz.gettz(...). (gh pr 628) - Changed the behavior of tz.tzutc to return a singleton (gh pr 497, 504) - Changed the behavior of tz.tzoffset to return the same object when passed the same inputs, with a corresponding performance improvement (gh pr 504) - Changed the behavior of tz.tzstr to return the same object when passed the same inputs. (gh pr 628) - Added .instance alternate constructors for tz.tzoffset and tz.tzstr, to allow the construction of a new instance if desired. (gh pr 628) - Added the tz.gettz.nocache function to allow explicit retrieval of a new instance of the relevant tzinfo. (gh pr 628) - Expand definition of tz.tzlocal equality so that the local zone is allow equality with tzoffset and tzutc. (gh pr 598) - Deprecated the idiosyncratic tzstr format mentioned in several examples but evidently designed exclusively for dateutil, and very likely not used by any current users. (gh issue 595, gh pr 606) - Added the tz.resolve_imaginary function, which generates a real date from an imaginary one, if necessary. Implemented by Cheukting (gh issue 339, gh pr 607) - Fixed issue where the tz.tzstr constructor would erroneously succeed if passed an invalid value for tzstr. Fixed by pablogsal (gh issue 259, gh pr 581) - Fixed issue with tz.gettz for TZ variables that start with a colon. Reported and fixed by lapointexavier (gh pr 601) - Added a lock to tz.tzical's cache. Reported and fixed by Unrud (gh pr 430) - Fixed an issue with fold support on certain Python 3 implementations that used the pre-3.6 pure Python implementation of datetime.replace, most notably pypy3 (gh pr 446). - Added support for VALUE=DATE-TIME for DTSTART in rrulestr. Reported by potuz (gh issue 401) and fixed by Unrud (gh pr 429) - Started enforcing that within VTIMEZONE, the VALUE parameter can only be omitted or DATE-TIME, per RFC 5545. Reported by Unrud (gh pr 439) - Added support for TZID parameter for DTSTART in rrulestr. Reported and fixed by ryanpetrello (gh issue 614, gh pr 624) - Added 'RRULE:' prefix to rrule strings generated by rrule.__str__, in compliance with the RFC. Reported by AndrewPashkin (gh issue 86), fixed by jarondl and mlorant (gh pr 450) - Switched to setuptools_scm for version management, automatically calculating a version number from the git metadata. Reported by jreback (gh issue 511), implemented by Sulley38 (gh pr 564) - Switched setup.py to use find_packages, and started testing against pip installed versions of dateutil in CI. Fixed issue with parser import discovered by jreback in pandas-dev/pandas18141. (gh issue 507, pr 509) - Switched test suite to using pytest (gh pr 495) - Switched CI over to use tox. Fixed by gaborbernat (gh pr 549) - Added a test-only dependency on freezegun. (gh pr 474) - Reduced number of CI builds on Appveyor. Fixed by kirit93 (gh issue 529, gh pr 579) - Made xfails strict by default, so that an xpass is a failure. (gh pr 567) - Added a documentation generation stage to tox and CI. (gh pr 568) - Added an explicit warning when running python setup.py explaining how to run the test suites with pytest. Fixed by lkollar. (gh issue 544, gh pr 548) - Added requirements-dev.txt for test dependency management (gh pr 499, 516) - Fixed code coverage metrics to account for Windows builds (gh pr 526) - Fixed code coverage metrics to NOT count xfails. Fixed by gaborbernat (gh issue 519, gh pr 563) - Style improvement to zoneinfo.tzfile that was confusing to static type checkers. Reported and fixed by quodlibetor (gh pr 485) - Several unused imports were removed by jdufresne. (gh pr 486) - Switched isinstance(*, collections.Callable) to callable, which is available on all supported Python versions. Implemented by jdufresne (gh pr 612) - Added CONTRIBUTING.md (gh pr 533) - Added AUTHORS.md (gh pr 542) - Corrected setup.py metadata to reflect author vs. maintainer, (gh issue 477, gh pr 538) - Corrected README to reflect that tests are now run in pytest. Reported and fixed by m-dz (gh issue 556, gh pr 557) - Updated all references to RFC 2445 (iCalendar) to point to RFC 5545. Fixed by mariocj89 (gh issue 543, gh pr 555) - Corrected parse documentation to reflect proper integer offset units, reported and fixed by abrugh (gh pr 458) - Fixed dangling parenthesis in tzoffset documentation (gh pr 461) - Started including the license file in wheels. Reported and fixed by jdufresne (gh pr 476) - Indendation fixes to parser docstring by jbrockmendel (gh pr 492) - Moved many examples from the "examples" documentation into their appropriate module documentation pages. Fixed by Tomasz-Kluczkowski and jakec-github (gh pr 558, 561) - Fixed documentation so that the parser.isoparse documentation displays. Fixed by alexchamberlain (gh issue 545, gh pr 560) - Refactored build and release sections and added setup instructions to CONTRIBUTING. Reported and fixed by kynan (gh pr 562) - Cleaned up various dead links in the documentation. (gh pr 602, 608, 618) ```Links
- PyPI: https://pypi.python.org/pypi/python-dateutil - Changelog: https://pyup.io/changelogs/python-dateutil/ - Docs: https://dateutil.readthedocs.ioUpdate Sphinx from 1.7.1 to 1.7.2.
Changelog
### 1.7.2 ``` ===================================== Incompatible changes -------------------- * 4520: apidoc: folders with an empty __init__.py are no longer excluded from TOC Bugs fixed ---------- * 4669: sphinx.build_main and sphinx.make_main throw NameError * 4685: autosummary emits meaningless warnings * autodoc: crashed when invalid options given * pydomain: always strip parenthesis if empty (refs: 1042) * 4689: autosummary: unexpectedly strips docstrings containing "i.e." * 4701: viewcode: Misplaced ``<div>`` in viewcode html output * 4444: Don't require numfig to use :numref: on sections * 4727: Option clash for package textcomp * 4725: Sphinx does not work with python 3.5.0 and 3.5.1 * 4716: Generation PDF file with TexLive on Windows, file not found error * 4574: vertical space before equation in latex * 4720: message when an image is mismatched for builder is not clear * 4655, 4684: Incomplete localization strings in Polish and Chinese * 2286: Sphinx crashes when error is happens in rendering HTML pages * 4688: Error to download remote images having long URL * 4754: sphinx/pycode/__init__.py raises AttributeError * 1435: qthelp builder should htmlescape keywords * epub: Fix docTitle elements of toc.ncx is not escaped * 4520: apidoc: Subpackage not in toc (introduced in 1.6.6) now fixed ```Links
- PyPI: https://pypi.python.org/pypi/sphinx - Changelog: https://pyup.io/changelogs/sphinx/ - Homepage: http://sphinx-doc.org/Update pbr from 3.1.1 to 4.0.0.
The bot wasn't able to find a changelog for this release. Got an idea?
Links
- PyPI: https://pypi.python.org/pypi/pbr - Homepage: https://docs.openstack.org/pbr/latest/Update py from 1.5.2 to 1.5.3.
Changelog
### 1.5.3 ``` ================== - fix 179: ensure we can support 'from py.error import ...' ```Links
- PyPI: https://pypi.python.org/pypi/py - Changelog: https://pyup.io/changelogs/py/ - Repo: https://github.com/pytest-dev/py/issues - Docs: http://py.readthedocs.io/Update Faker from 0.8.11 to 0.8.12.
Changelog
### 0.8.12 ``` -------------------------------------------------------------------------------------- * Fix issue with ``cx_Freeze``. Thanks sedominik. * Add dutch ``nl_NL`` bank provider. Thanks PatSousa. * Add ``distrito`` and ``freguesia`` to ``pt_PT`` ``address`` provider. Thanks ZuluPro. * Fix unicode issues with the ``person`` provider. Thanks karthikarul20. * Add ``en_SG`` ``person`` provider. Thanks karthikarul20. * Add street names to the Ukrainian address provider. Thanks cadmi. * Add ``de_AT`` address provider. Thanks bessl. * Fix credit card prefixes. Thanks jphalip. * Fix capitalization in ``no_NO`` address provider. Thanks cloveras. * Fix deprecated syntax for raw strings. Thanks dchudz. * Add ``latitude`` and ``longitude`` to ``de_AT`` ``address`` provider. Thanks bessl. * Fix incorrect value in list of middle name for locale ``ru_RU``. Thanks damirazo. ```Links
- PyPI: https://pypi.python.org/pypi/faker - Changelog: https://pyup.io/changelogs/faker/ - Repo: https://github.com/joke2k/fakerUpdate dj-database-url from 0.4.2 to 0.5.0.
The bot wasn't able to find a changelog for this release. Got an idea?
Links
- PyPI: https://pypi.python.org/pypi/dj-database-url - Repo: https://github.com/kennethreitz/dj-database-urlUpdate Django from 1.11.10 to 2.0.3.
Changelog
### 2.0.3 ``` ========================== *March 6, 2018* Django 2.0.3 fixes two security issues and several bugs in 2.0.2. Also, the latest string translations from Transifex are incorporated. CVE-2018-7536: Denial-of-service possibility in ``urlize`` and ``urlizetrunc`` template filters =============================================================================================== The ``django.utils.html.urlize()`` function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The ``urlize()`` function is used to implement the ``urlize`` and ``urlizetrunc`` template filters, which were thus vulnerable. The problematic regular expressions are replaced with parsing logic that behaves similarly. CVE-2018-7537: Denial-of-service possibility in ``truncatechars_html`` and ``truncatewords_html`` template filters ================================================================================================================== If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods were passed the ``html=True`` argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The ``chars()`` and ``words()`` methods are used to implement the ``truncatechars_html`` and ``truncatewords_html`` template filters, which were thus vulnerable. The backtracking problem in the regular expression is fixed. Bugfixes ======== * Fixed a regression that caused sliced ``QuerySet.distinct().order_by()`` followed by ``count()`` to crash (:ticket:`29108`). * Prioritized the datetime and time input formats without ``%f`` for the Thai locale to fix the admin time picker widget displaying "undefined" (:ticket:`29109`). * Fixed crash with ``QuerySet.order_by(Exists(...))`` (:ticket:`29118`). * Made ``Q.deconstruct()`` deterministic with multiple keyword arguments (:ticket:`29125`). You may need to modify ``Q``'s in existing migrations, or accept an autogenerated migration. * Fixed a regression where a ``When()`` expression with a list argument crashes (:ticket:`29166`). * Fixed crash when using a ``Window()`` expression in a subquery (:ticket:`29172`). * Fixed ``AbstractBaseUser.normalize_username()`` crash if the ``username`` argument isn't a string (:ticket:`29176`). ========================== ``` ### 2.0.2 ``` ========================== *February 1, 2018* Django 2.0.2 fixes a security issue and several bugs in 2.0.1. CVE-2018-6188: Information leakage in ``AuthenticationForm`` ============================================================ A regression in Django 1.11.8 made :class:`~django.contrib.auth.forms.AuthenticationForm` run its ``confirm_login_allowed()`` method even if an incorrect password is entered. This can leak information about a user, depending on what messages ``confirm_login_allowed()`` raises. If ``confirm_login_allowed()`` isn't overridden, an attacker enter an arbitrary username and see if that user has been set to ``is_active=False``. If ``confirm_login_allowed()`` is overridden, more sensitive details could be leaked. This issue is fixed with the caveat that ``AuthenticationForm`` can no longer raise the "This account is inactive." error if the authentication backend rejects inactive users (the default authentication backend, ``ModelBackend``, has done that since Django 1.10). This issue will be revisited for Django 2.1 as a fix to address the caveat will likely be too invasive for inclusion in older versions. Bugfixes ======== * Fixed hidden content at the bottom of the "The install worked successfully!" page for some languages (:ticket:`28885`). * Fixed incorrect foreign key nullification if a model has two foreign keys to the same model and a target model is deleted (:ticket:`29016`). * Fixed regression in the use of ``QuerySet.values_list(..., flat=True)`` followed by ``annotate()`` (:ticket:`29067`). * Fixed a regression where a queryset that annotates with geometry objects crashes (:ticket:`29054`). * Fixed a regression where ``contrib.auth.authenticate()`` crashes if an authentication backend doesn't accept ``request`` and a later one does (:ticket:`29071`). * Fixed a regression where ``makemigrations`` crashes if a migrations directory doesn't have an ``__init__.py`` file (:ticket:`29091`). * Fixed crash when entering an invalid uuid in ``ModelAdmin.raw_id_fields`` (:ticket:`29094`). ========================== ``` ### 2.0.1 ``` ========================== *January 1, 2018* Django 2.0.1 fixes several bugs in 2.0. Bugfixes ======== * Fixed a regression in Django 1.11 that added newlines between ``MultiWidget``'s subwidgets (:ticket:`28890`). * Fixed incorrect class-based model index name generation for models with quoted ``db_table`` (:ticket:`28876`). * Fixed incorrect foreign key constraint name for models with quoted ``db_table`` (:ticket:`28876`). * Fixed a regression in caching of a ``GenericForeignKey`` when the referenced model instance uses more than one level of multi-table inheritance (:ticket:`28856`). * Reallowed filtering a queryset with ``GeometryField=None`` (:ticket:`28896`). * Corrected admin check to allow a ``OneToOneField`` in ``ModelAdmin.autocomplete_fields`` (:ticket:`28898`). * Fixed a regression on SQLite where ``DecimalField`` returned a result with trailing zeros in the fractional part truncated (:ticket:`28915`). * Fixed crash in the ``testserver`` command startup (:ticket:`28941`). * Fixed crash when coercing a translatable URL pattern to ``str`` (:ticket:`28947`). * Fixed crash on SQLite when renaming a field in a model referenced by a ``ManyToManyField`` (:ticket:`28884`). * Fixed a crash when chaining ``values()`` or ``values_list()`` after ``QuerySet.select_for_update(of=(...))`` (:ticket:`28944`). * Fixed admin changelist crash when using a query expression in the page's ordering (:ticket:`28958`). ======================== ``` ### 2.0 ``` ======================== *December 2, 2017* Welcome to Django 2.0! These release notes cover the :ref:`new features <whats-new-2.0>`, as well as some :ref:`backwards incompatible changes <backwards-incompatible-2.0>` you'll want to be aware of when upgrading from Django 1.11 or earlier. We've :ref:`dropped some features<removed-features-2.0>` that have reached the end of their deprecation cycle, and we've :ref:`begun the deprecation process for some features <deprecated-features-2.0>`. This release starts Django's use of a :ref:`loose form of semantic versioning <internal-release-cadence>`, but there aren't any major backwards incompatible changes that might be expected of a 2.0 release. Upgrading should be a similar amount of effort as past feature releases. See the :doc:`/howto/upgrade-version` guide if you're updating an existing project. Python compatibility ==================== Django 2.0 supports Python 3.4, 3.5, and 3.6. We **highly recommend** and only officially support the latest release of each series. The Django 1.11.x series is the last to support Python 2.7. Django 2.0 will be the last release series to support Python 3.4. If you plan a deployment of Python 3.4 beyond the end-of-life for Django 2.0 (April 2019), stick with Django 1.11 LTS (supported until April 2020) instead. Note, however, that the end-of-life for Python 3.4 is March 2019. Third-party library support for older version of Django ======================================================= Following the release of Django 2.0, we suggest that third-party app authors drop support for all versions of Django prior to 1.11. At that time, you should be able to run your package's tests using ``python -Wd`` so that deprecation warnings do appear. After making the deprecation warning fixes, your app should be compatible with Django 2.0. .. _whats-new-2.0: What's new in Django 2.0 ======================== Simplified URL routing syntax ----------------------------- The new :func:`django.urls.path()` function allows a simpler, more readable URL routing syntax. For example, this example from previous Django releases:: url(r'^articles/(?P<year>[0-9]{4})/$', views.year_archive), could be written as:: path('articles/<int:year>/', views.year_archive), The new syntax supports type coercion of URL parameters. In the example, the view will receive the ``year`` keyword argument as an integer rather than as a string. Also, the URLs that will match are slightly less constrained in the rewritten example. For example, the year 10000 will now match since the year integers aren't constrained to be exactly four digits long as they are in the regular expression. The ``django.conf.urls.url()`` function from previous versions is now available as :func:`django.urls.re_path`. The old location remains for backwards compatibility, without an imminent deprecation. The old ``django.conf.urls.include()`` function is now importable from ``django.urls`` so you can use ``from django.urls import include, path, re_path`` in your URLconfs. The :doc:`/topics/http/urls` document is rewritten to feature the new syntax and provide more details. Mobile-friendly ``contrib.admin`` --------------------------------- The admin is now responsive and supports all major mobile devices. Older browsers may experience varying levels of graceful degradation. Window expressions ------------------ The new :class:`~django.db.models.expressions.Window` expression allows adding an ``OVER`` clause to querysets. You can use :ref:`window functions <window-functions>` and :ref:`aggregate functions <aggregation-functions>` in the expression. Minor features -------------- :mod:`django.contrib.admin` ~~~~~~~~~~~~~~~~~~~~~~~~~~~ * The new :attr:`.ModelAdmin.autocomplete_fields` attribute and :meth:`.ModelAdmin.get_autocomplete_fields` method allow using an `Select2 <https://select2.org>`_ search widget for ``ForeignKey`` and ``ManyToManyField``. :mod:`django.contrib.auth` ~~~~~~~~~~~~~~~~~~~~~~~~~~ * The default iteration count for the PBKDF2 password hasher is increased from 36,000 to 100,000. :mod:`django.contrib.gis` ~~~~~~~~~~~~~~~~~~~~~~~~~ * Added MySQL support for the :class:`~django.contrib.gis.db.models.functions.AsGeoJSON` function, :class:`~django.contrib.gis.db.models.functions.GeoHash` function, :class:`~django.contrib.gis.db.models.functions.IsValid` function, :lookup:`isvalid` lookup, and :ref:`distance lookups <distance-lookups>`. * Added the :class:`~django.contrib.gis.db.models.functions.Azimuth` and :class:`~django.contrib.gis.db.models.functions.LineLocatePoint` functions, supported on PostGIS and SpatiaLite. * Any :class:`~django.contrib.gis.geos.GEOSGeometry` imported from GeoJSON now has its SRID set. * Added the :attr:`.OSMWidget.default_zoom` attribute to customize the map's default zoom level. * Made metadata readable and editable on rasters through the :attr:`~django.contrib.gis.gdal.GDALRaster.metadata`, :attr:`~django.contrib.gis.gdal.GDALRaster.info`, and :attr:`~django.contrib.gis.gdal.GDALBand.metadata` attributes. * Allowed passing driver-specific creation options to :class:`~django.contrib.gis.gdal.GDALRaster` objects using ``papsz_options``. * Allowed creating :class:`~django.contrib.gis.gdal.GDALRaster` objects in GDAL's internal virtual filesystem. Rasters can now be :ref:`created from and converted to binary data <gdal-raster-vsimem>` in-memory. * The new :meth:`GDALBand.color_interp() <django.contrib.gis.gdal.GDALBand.color_interp>` method returns the color interpretation for the band. :mod:`django.contrib.postgres` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * The new ``distinct`` argument for :class:`~django.contrib.postgres.aggregates.ArrayAgg` determines if concatenated values will be distinct. * The new :class:`~django.contrib.postgres.functions.RandomUUID` database function returns a version 4 UUID. It requires use of PostgreSQL's ``pgcrypto`` extension which can be activated using the new :class:`~django.contrib.postgres.operations.CryptoExtension` migration operation. * :class:`django.contrib.postgres.indexes.GinIndex` now supports the ``fastupdate`` and ``gin_pending_list_limit`` parameters. * The new :class:`~django.contrib.postgres.indexes.GistIndex` class allows creating ``GiST`` indexes in the database. The new :class:`~django.contrib.postgres.operations.BtreeGistExtension` migration operation installs the ``btree_gist`` extension to add support for operator classes that aren't built-in. * :djadmin:`inspectdb` can now introspect ``JSONField`` and various ``RangeField``\s (``django.contrib.postgres`` must be in ``INSTALLED_APPS``). :mod:`django.contrib.sitemaps` ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * Added the ``protocol`` keyword argument to the :class:`~django.contrib.sitemaps.GenericSitemap` constructor. Cache ~~~~~ * ``cache.set_many()`` now returns a list of keys that failed to be inserted. For the built-in backends, failed inserts can only happen on memcached. File Storage ~~~~~~~~~~~~ * :meth:`File.open() <django.core.files.File.open>` can be used as a context manager, e.g. ``with file.open() as f:``. Forms ~~~~~ * The new ``date_attrs`` and ``time_attrs`` arguments for :class:`~django.forms.SplitDateTimeWidget` and :class:`~django.forms.SplitHiddenDateTimeWidget` allow specifying different HTML attributes for the ``DateInput`` and ``TimeInput`` (or hidden) subwidgets. * The new :meth:`Form.errors.get_json_data() <django.forms.Form.errors.get_json_data>` method returns form errors as a dictionary suitable for including in a JSON response. Generic Views ~~~~~~~~~~~~~ * The new :attr:`.ContextMixin.extra_context` attribute allows adding context in ``View.as_view()``. Management Commands ~~~~~~~~~~~~~~~~~~~ * :djadmin:`inspectdb` now translates MySQL's unsigned integer columns to ``PositiveIntegerField`` or ``PositiveSmallIntegerField``. * The new :option:`makemessages --add-location` option controls the comment format in PO files. * :djadmin:`loaddata` can now :ref:`read from stdin <loading-fixtures-stdin>`. * The new :option:`diffsettings --output` option allows formatting the output in a unified diff format. * On Oracle, :djadmin:`inspectdb` can now introspect ``AutoField`` if the column is created as an identity column. * On MySQL, :djadmin:`dbshell` now supports client-side TLS certificates. Migrations ~~~~~~~~~~ * The new :option:`squashmigrations --squashed-name` option allows naming the squashed migration. Models ~~~~~~ * The new :class:`~django.db.models.functions.StrIndex` database function finds the starting index of a string inside another string. * On Oracle, ``AutoField`` and ``BigAutoField`` are now created as `identity columns`_. .. _`identity columns`: https://docs.oracle.com/database/121/DRDAA/migr_tools_feat.htmDRDAA109 * The new ``chunk_size`` parameter of :meth:`.QuerySet.iterator` controls the number of rows fetched by the Python database client when streaming results from the database. For databases that don't support server-side cursors, it controls the number of results Django fetches from the database adapter. * :meth:`.QuerySet.earliest`, :meth:`.QuerySet.latest`, and :attr:`Meta.get_latest_by <django.db.models.Options.get_latest_by>` now allow ordering by several fields. * Added the :class:`~django.db.models.functions.ExtractQuarter` function to extract the quarter from :class:`~django.db.models.DateField` and :class:`~django.db.models.DateTimeField`, and exposed it through the :lookup:`quarter` lookup. * Added the :class:`~django.db.models.functions.TruncQuarter` function to truncate :class:`~django.db.models.DateField` and :class:`~django.db.models.DateTimeField` to the first day of a quarter. * Added the :attr:`~django.db.models.Index.db_tablespace` parameter to class-based indexes. * If the database supports a native duration field (Oracle and PostgreSQL), :class:`~django.db.models.functions.Extract` now works with :class:`~django.db.models.DurationField`. * Added the ``of`` argument to :meth:`.QuerySet.select_for_update()`, supported on PostgreSQL and Oracle, to lock only rows from specific tables rather than all selected tables. It may be helpful particularly when :meth:`~.QuerySet.select_for_update()` is used in conjunction with :meth:`~.QuerySet.select_related()`. * The new ``field_name`` parameter of :meth:`.QuerySet.in_bulk` allows fetching results based on any unique model field. * :meth:`.CursorWrapper.callproc()` now takes an optional dictionary of keyword parameters, if the backend supports this feature. Of Django's built-in backends, only Oracle supports it. * The new :meth:`connection.execute_wrapper() <django.db.backends.base.DatabaseWrapper.execute_wrapper>` method allows :doc:`installing wrappers around execution of database queries </topics/db/instrumentation>`. * The new ``filter`` argument for built-in aggregates allows :ref:`adding different conditionals <conditional-aggregation>` to multiple aggregations over the same fields or relations. * Added support for expressions in :attr:`Meta.ordering <django.db.models.Options.ordering>`. * The new ``named`` parameter of :meth:`.QuerySet.values_list` allows fetching results as named tuples. * The new :class:`.FilteredRelation` class allows adding an ``ON`` clause to querysets. Pagination ~~~~~~~~~~ * Added :meth:`Paginator.get_page() <django.core.paginator.Paginator.get_page>` to provide the documented pattern of handling invalid page numbers. Requests and Responses ~~~~~~~~~~~~~~~~~~~~~~ * The :djadmin:`runserver` Web server supports HTTP 1.1. Templates ~~~~~~~~~ * To increase the usefulness of :meth:`.Engine.get_default` in third-party apps, it now returns the first engine if multiple ``DjangoTemplates`` engines are configured in ``TEMPLATES`` rather than raising ``ImproperlyConfigured``. * Custom template tags may now accept keyword-only arguments. Tests ~~~~~ * Added threading support to :class:`~django.test.LiveServerTestCase`. * Added settings that allow customizing the test tablespace parameters for Oracle: :setting:`DATAFILE_SIZE`, :setting:`DATAFILE_TMP_SIZE`, :setting:`DATAFILE_EXTSIZE`, and :setting:`DATAFILE_TMP_EXTSIZE`. Validators ~~~~~~~~~~ * The new :class:`.ProhibitNullCharactersValidator` disallows the null character in the input of the :class:`~django.forms.CharField` form field and its subclasses. Null character input was observed from vulnerability scanning tools. Most databases silently discard null characters, but psycopg2 2.7+ raises an exception when trying to save a null character to a char/text field with PostgreSQL. .. _backwards-incompatible-2.0: Backwards incompatible changes in 2.0 ===================================== Removed support for bytestrings in some places ---------------------------------------------- To support native Python 2 strings, older Django versions had to accept both bytestrings and unicode strings. Now that Python 2 support is dropped, bytestrings should only be encountered around input/output boundaries (handling of binary fields or HTTP streams, for example). You might have to update your code to limit bytestring usage to a minimum, as Django no longer accepts bytestrings in certain code paths. Python's :option:`-b` option may help detect that mistake in your code. For example, ``reverse()`` now uses ``str()`` instead of ``force_text()`` to coerce the ``args`` and ``kwargs`` it receives, prior to their placement in the URL. For bytestrings, this creates a string with an undesired ``b`` prefix as well as additional quotes (``str(b'foo')`` is ``"b'foo'"``). To adapt, call ``decode()`` on the bytestring before passing it to ``reverse()``. Database backend API -------------------- This section describes changes that may be needed in third-party database backends. * The ``DatabaseOperations.datetime_cast_date_sql()``, ``datetime_cast_time_sql()``, ``datetime_trunc_sql()``, ``datetime_extract_sql()``, and ``date_interval_sql()`` methods now return only the SQL to perform the operation instead of SQL and a list of parameters. * Third-party database backends should add a ``DatabaseWrapper.display_name`` attribute with the name of the database that your backend works with. Django may use it in various messages, such as in system checks. * The first argument of ``SchemaEditor._alter_column_type_sql()`` is now ``model`` rather than ``table``. * The first argument of ``SchemaEditor._create_index_name()`` is now ``table_name`` rather than ``model``. * To enable ``FOR UPDATE OF`` support, set ``DatabaseFeatures.has_select_for_update_of = True``. If the database requires that the arguments to ``OF`` be columns rather than tables, set ``DatabaseFeatures.select_for_update_of_column = True``. * To enable support for :class:`~django.db.models.expressions.Window` expressions, set ``DatabaseFeatures.supports_over_clause`` to ``True``. You may need to customize the ``DatabaseOperations.window_start_rows_start_end()`` and/or ``window_start_range_start_end()`` methods. * Third-party database backends should add a ``DatabaseOperations.cast_char_field_without_max_length`` attribute with the database data type that will be used in the :class:`~django.db.models.functions.Cast` function for a ``CharField`` if the ``max_length`` argument isn't provided. * The first argument of ``DatabaseCreation._clone_test_db()`` and ``get_test_db_clone_settings()`` is now ``suffix`` rather than ``number`` (in case you want to rename the signatures in your backend for consistency). ``django.test`` also now passes those values as strings rather than as integers. * Third-party database backends should add a ``DatabaseIntrospection.get_sequences()`` method based on the stub in ``BaseDatabaseIntrospection``. Dropped support for Oracle 11.2 ------------------------------- The end of upstream support for Oracle 11.2 is Dec. 2020. Django 1.11 will be supported until April 2020 which almost reaches this date. Django 2.0 officially supports Oracle 12.1+. Default MySQL isolation level is read committed ----------------------------------------------- MySQL's default isolation level, repeatable read, may cause data loss in typical Django usage. To prevent that and for consistency with other databases, the default isolation level is now read committed. You can use the :setting:`DATABASES` setting to :ref:`use a different isolation level <mysql-isolation-level>`, if needed. :attr:`AbstractUser.last_name <django.contrib.auth.models.User.last_name>` ``max_length`` increased to 150 ---------------------------------------------------------------------------------------------------------- A migration for :attr:`django.contrib.auth.models.User.last_name` is included. If you have a custom user model inheriting from ``AbstractUser``, you'll need to generate and apply a database migration for your user model. If you want to preserve the 30 character limit for last names, use a custom form:: from django.contrib.auth.forms import UserChangeForm class MyUserChangeForm(UserChangeForm): last_name = forms.CharField(max_length=30, required=False) If you wish to keep this restriction in the admin when editing users, set ``UserAdmin.form`` to use this form:: from django.contrib.auth.admin import UserAdmin from django.contrib.auth.models import User class MyUserAdmin(UserAdmin): form = MyUserChangeForm admin.site.unregister(User) admin.site.register(User, MyUserAdmin) ``QuerySet.reverse()`` and ``last()`` are prohibited after slicing ------------------------------------------------------------------ Calling ``QuerySet.reverse()`` or ``last()`` on a sliced queryset leads to unexpected results due to the slice being applied after reordering. This is now prohibited, e.g.:: >>> Model.objects.all()[:2].reverse() Traceback (most recent call last): ... TypeError: Cannot reverse a query once a slice has been taken. Form fields no longer accept optional arguments as positional arguments ----------------------------------------------------------------------- To help prevent runtime errors due to incorrect ordering of form field arguments, optional arguments of built-in form fields are no longer accepted as positional arguments. For example:: forms.IntegerField(25, 10) raises an exception and should be replaced with:: forms.IntegerField(max_value=25, min_value=10) ``call_command()`` validates the options it receives ---------------------------------------------------- ``call_command()`` now validates that the argument parser of the command being called defines all of the options passed to ``call_command()``. For custom management commands that use options not created using ``parser.add_argument()``, add a ``stealth_options`` attribute on the command:: class MyCommand(BaseCommand): stealth_options = ('option_name', ...) Indexes no longer accept positional arguments --------------------------------------------- For example:: models.Index(['headline', '-pub_date'], 'index_name') raises an exception and should be replaced with:: models.Index(fields=['headline', '-pub_date'], name='index_name') Foreign key constraints are now enabled on SQLite ------------------------------------------------- This will appear as a backwards-incompatible change (``IntegrityError: FOREIGN KEY constraint failed``) if attempting to save an existing model instance that's violating a foreign key constraint. Foreign keys are now created with ``DEFERRABLE INITIALLY DEFERRED`` instead of ``DEFERRABLE IMMEDIATE``. Thus, tables may need to be rebuilt to recreate foreign keys with the new definition, particularly if you're using a pattern like this:: from django.db import transaction with transaction.atomic(): Book.objects.create(author_id=1) Author.objects.create(id=1) If you don't recreate the foreign key as ``DEFERRED``, the first ``create()`` would fail now that foreign key constraints are enforced. Backup your database first! After upgrading to Django 2.0, you can then rebuild tables using a script similar to this:: from django.apps import apps from django.db import connection for app in apps.get_app_configs(): for model in app.get_models(include_auto_created=True): if model._meta.managed and not (model._meta.proxy or model._meta.swapped): for base in model.__bases__: if hasattr(base, '_meta'): base._meta.local_many_to_many = [] model._meta.local_many_to_many = [] with connection.schema_editor() as editor: editor._remake_table(model) This script hasn't received extensive testing and needs adaption for various cases such as multiple databases. Feel free to contribute improvements. In addition, because of a table alteration limitation of SQLite, it's prohibited to perform :class:`~django.db.migrations.operations.RenameModel` and :class:`~django.db.migrations.operations.RenameField` operations on models or fields referenced by other models in a transaction. In order to allow migrations containing these operations to be applied, you must set the ``Migration.atomic`` attribute to ``False``. Miscellaneous ------------- * The ``SessionAuthenticationMiddleware`` class is removed. It provided no functionality since session authentication is unconditionally enabled in Django 1.10. * The default HTTP error handlers (``handler404``, etc.) are now callables instead of dotted Python path strings. Django favors callable references since they provide better performance and debugging experience. * :class:`~django.views.generic.base.RedirectView` no longer silences ``NoReverseMatch`` if the ``pattern_name`` doesn't exist. * When :setting:`USE_L10N` is off, :class:`~django.forms.FloatField` and :class:`~django.forms.DecimalField` now respect :setting:`DECIMAL_SEPARATOR` and :setting:`THOUSAND_SEPARATOR` during validation. For example, with the settings:: USE_L10N = False USE_THOUSAND_SEPARATOR = True DECIMAL_SEPARATOR = ',' THOUSAND_SEPARATOR = '.' an input of ``"1.345"`` is now converted to ``1345`` instead of ``1.345``. * Subclasses of :class:`~django.contrib.auth.models.AbstractBaseUser` are no longer required to implement ``get_short_name()`` and ``get_full_name()``. (The base implementations that raise ``NotImplementedError`` are removed.) ``django.contrib.admin`` uses these methods if implemented but doesn't require them. Third-party apps that use these methods may want to adopt a similar approach. * The ``FIRST_DAY_OF_WEEK`` and ``NUMBER_GROUPING`` format settings are now kept as integers in JavaScript and JSON i18n view outputs. * :meth:`~django.test.TransactionTestCase.assertNumQueries` now ignores connection configuration queries. Previously, if a test opened a new database connection, those queries could be included as part of the ``assertNumQueries()`` count. * The default size of the Oracle test tablespace is increased from 20M to 50M and the default autoextend size is increased from 10M to 25M. * To improve performance when streaming large result sets from the database, :meth:`.QuerySet.iterator` now fetches 2000 rows at a time instead of 100. The old behavior can be restored using the ``chunk_size`` parameter. For example:: Book.objects.iterator(chunk_size=100) * Providing unknown package names in the ``packages`` argument of the :class:`~django.views.i18n.JavaScriptCatalog` view now raises ``ValueError`` instead of passing silently. * A model instance's primary key now appears in the default ``Model.__str__()`` method, e.g. ``Question object (1)``. * ``makemigrations`` now detects changes to the model field ``limit_choices_to`` option. Add this to your existing migrations or accept an auto-generated migration for fields that use it. * Performing queries that require :ref:`automatic spatial transformations <automatic-spatial-transformations>` now raises ``NotImplementedError`` on MySQL instead of silently using non-transformed geometries. * ``django.core.exceptions.DjangoRuntimeWarning`` is removed. It was only used in the cache backend as an intermediate class in ``CacheKeyWarning``'s inheritance of ``RuntimeWarning``. * Renamed ``BaseExpression._output_field`` to ``output_field``. You may need to update custom expressions. * In older versions, forms and formsets combine their ``Media`` with widget ``Media`` by concatenating the two. The combining now tries to :ref:`preserve the relative order of elements in each list <form-media-asset-order>`. ``MediaOrderConflictWarning`` is issued if the order can't be preserved. * ``django.contrib.gis.gdal.OGRException`` is removed. It's been an alias for ``GDALException`` since Django 1.8. * Support for GEOS 3.3.x is dropped. * The way data is selected for ``GeometryField`` is changed to improve performance, and in raw SQL queries, those fields must now be wrapped in ``connection.ops.select``. See the :ref:`Raw queries note<gis-raw-sql>` in the GIS tutorial for an example. .. _deprecated-features-2.0: Features deprecated in 2.0 ========================== ``context`` argument of ``Field.from_db_value()`` and ``Expression.convert_value()`` ------------------------------------------------------------------------------------ The ``context`` argument of ``Field.from_db_value()`` and ``Expression.convert_value()`` is unused as it's always an empty dictionary. The signature of both methods is now:: (self, value, expression, connection) instead of:: (self, value, expression, connection, context) Support for the old signature in custom fields and expressions remains until Django 3.0. Miscellaneous ------------- * The ``django.db.backends.postgresql_psycopg2`` module is deprecated in favor of ``django.db.backends.postgresql``. It's been an alias since Django 1.9. This only affects code that imports from the module directly. The ``DATABASES`` setting can still use ``'django.db.backends.postgresql_psycopg2'``, though you can simplify that by using the ``'django.db.backends.postgresql'`` name added in Django 1.9. * ``django.shortcuts.render_to_response()`` is deprecated in favor of :func:`django.shortcuts.render`. ``render()`` takes the same arguments except that it also requires a ``request``. * The ``DEFAULT_CONTENT_TYPE`` setting is deprecated. It doesn't interact well well with third-party apps and is obsolete since HTML5 has mostly superseded XHTML. * ``HttpRequest.xreadlines()`` is deprecated in favor of iterating over the request. * The ``field_name`` keyword argument to :meth:`.QuerySet.earliest` and :meth:`.QuerySet.latest` is deprecated in favor of passing the field names as arguments. Write ``.earliest('pub_date')`` instead of ``.earliest(field_name='pub_date')``. .. _removed-features-2.0: Features removed in 2.0 ======================= These features have reached the end of their deprecation cycle and are removed in Django 2.0. See :ref:`deprecated-features-1.9` for details on these changes, including how to remove usage of these features. * The ``weak`` argument to ``django.dispatch.signals.Signal.disconnect()`` is removed. * ``django.db.backends.base.BaseDatabaseOperations.check_aggregate_support()`` is removed. * The ``django.forms.extras`` package is removed. * The ``assignment_tag`` helper is removed. * The ``host`` argument to ``SimpleTestCase.assertsRedirects()`` is removed. The compatibility layer which allows absolute URLs to be considered equal to relative ones when the path is identical is also removed. * ``Field.rel`` and ``Field.remote_field.to`` are removed. * The ``on_delete`` argument for ``ForeignKey`` and ``OneToOneField`` is now required in models and migrations. Consider squashing migrations so that you have fewer of them to update. * ``django.db.models.fields.add_lazy_relation()`` is removed. * When time zone support is enabled, database backends that don't support time zones no longer convert aware datetimes to naive values in UTC anymore when such values are passed as parameters to SQL queries executed outside of the ORM, e.g. with ``cursor.execute()``. * ``django.contrib.auth.tests.utils.skipIfCustomUser()`` is removed. * The ``GeoManager`` and ``GeoQuerySet`` classes are removed. * The ``django.contrib.gis.geoip`` module is removed. * The ``supports_recursion`` check for template loaders is removed from: * ``django.template.engine.Engine.find_template()`` * ``django.template.loader_tags.ExtendsNode.find_template()`` * ``django.template.loaders.base.Loader.supports_recursion()`` * ``django.template.loaders.cached.Loader.supports_recursion()`` * The ``load_template`` and ``load_template_sources`` template loader methods are removed. * The ``template_dirs`` argument for template loaders is removed: * ``django.template.loaders.base.Loader.get_template()`` * ``django.template.loaders.cached.Loader.cache_key()`` * ``django.template.loaders.cached.Loader.get_template()`` * ``django.template.loaders.cached.Loader.get_template_sources()`` * ``django.template.loaders.filesystem.Loader.get_template_sources()`` * ``django.template.loaders.base.Loader.__call__()`` is removed. * Support for custom error views that don't accept an ``exception`` parameter is removed. * The ``mime_type`` attribute of ``django.utils.feedgenerator.Atom1Feed`` and ``django.utils.feedgenerator.RssFeed`` is removed. * The ``app_name`` argument to ``include()`` is removed. * Support for passing a 3-tuple (including ``admin.site.urls``) as the first argument to ``include()`` is removed. * Support for setting a URL instance namespace without an application namespace is removed. * ``Field._get_val_from_obj()`` is removed. * ``django.template.loaders.eggs.Loader`` is removed. * The ``current_app`` parameter to the ``contrib.auth`` function-based views is removed. * The ``callable_obj`` keyword argument to ``SimpleTestCase.assertRaisesMessage()`` is removed. * Support for the ``allow_tags`` attribute on ``ModelAdmin`` methods is removed. * The ``enclosure`` keyword argument to ``SyndicationFeed.add_item()`` is removed. * The ``django.template.loader.LoaderOrigin`` and ``django.template.base.StringOrigin`` aliases for ``django.template.base.Origin`` are removed. See :ref:`deprecated-features-1.10` for details on these changes. * The ``makemigrations --exit`` option is removed. * Support for direct assignment to a reverse foreign key or many-to-many relation is removed. * The ``get_srid()`` and ``set_srid()`` methods of ``django.contrib.gis.geos.GEOSGeometry`` are removed. * The ``get_x()``, ``set_x()``, ``get_y()``, ``set_y()``, ``get_z()``, and ``set_z()`` methods of ``django.contrib.gis.geos.Point`` are removed. * The ``get_coords()`` and ``set_coords()`` methods of ``django.contrib.gis.geos.Point`` are removed. * The ``cascaded_union`` property of ``django.contrib.gis.geos.MultiPolygon`` is removed. * ``django.utils.functional.allow_lazy()`` is removed. * The ``shell --plain`` option is removed. * The ``django.core.urlresolvers`` module is removed in favor of its new location, ``django.urls``. * ``CommaSeparatedIntegerField`` is removed, except for support in historical migrations. * The template ``Context.has_key()`` method is removed. * Support for the ``django.core.files.storage.Storage.accessed_time()``, ``created_time()``, and ``modified_time()`` methods is removed. * Support for query lookups using the model name when ``Meta.default_related_name`` is set is removed. * The MySQL ``__search`` lookup is removed. * The shim for supporting custom related manager classes without a ``_apply_rel_filters()`` method is removed. * Using ``User.is_authenticated()`` and ``User.is_anonymous()`` as methods rather than properties is no longer supported. * The ``Model._meta.virtual_fields`` attribute is removed. * The keyword arguments ``virtual_only`` in ``Field.contribute_to_class()`` and ``virtual`` in ``Model._meta.add_field()`` are removed. * The ``javascript_catalog()`` and ``json_catalog()`` views are removed. * ``django.contrib.gis.utils.precision_wkt()`` is removed. * In multi-table inheritance, implicit promotion of a ``OneToOneField`` to a ``parent_link`` is removed. * Support for ``Widget._format_value()`` is removed. * ``FileField`` methods ``get_directory_name()`` and ``get_filename()`` are removed. * The ``mark_for_escaping()`` function and the classes it uses: ``EscapeData``, ``EscapeBytes``, ``EscapeText``, ``EscapeString``, and ``EscapeUnicode`` are removed. * The ``escape`` filter now uses ``django.utils.html.conditional_escape()``. * ``Manager.use_for_related_fields`` is removed. * Model ``Manager`` inheritance follows MRO inheritance rules. The requirement to use ``Meta.manager_inheritance_from_future`` to opt-in to the behavior is removed. * Support for old-style middleware using ``settings.MIDDLEWARE_CLASSES`` is removed. ============================ ``` ### 1.11.11 ``` ============================ *March 6, 2018* Django 1.11.11 fixes two security issues in 1.11.10. CVE-2018-7536: Denial-of-service possibility in ``urlize`` and ``urlizetrunc`` template filters =============================================================================================== The ``django.utils.html.urlize()`` function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions. The ``urlize()`` function is used to implement the ``urlize`` and ``urlizetrunc`` template filters, which were thus vulnerable. The problematic regular expressions are replaced with parsing logic that behaves similarly. CVE-2018-7537: Denial-of-service possibility in ``truncatechars_html`` and ``truncatewords_html`` template filters ================================================================================================================== If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods were passed the ``html=True`` argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The ``chars()`` and ``words()`` methods are used to implement the ``truncatechars_html`` and ``truncatewords_html`` template filters, which were thus vulnerable. The backtracking problem in the regular expression is fixed. ============================ ```Links
- PyPI: https://pypi.python.org/pypi/django - Changelog: https://pyup.io/changelogs/django/ - Homepage: https://www.djangoproject.com/Update PyJWT from 1.5.3 to 1.6.1.
Changelog
### 1.6.1 ``` [109]: https://github.com/jpadilla/pyjwt/pull/109 [110]: https://github.com/jpadilla/pyjwt/pull/110 [100]: https://github.com/jpadilla/pyjwt/pull/100 [101]: https://github.com/jpadilla/pyjwt/pull/101 [103]: https://github.com/jpadilla/pyjwt/pull/103 [85]: https://github.com/jpadilla/pyjwt/pull/85 [882524d]: https://github.com/jpadilla/pyjwt/commit/882524d [bd57b02]: https://github.com/jpadilla/pyjwt/commit/bd57b02 [131]: https://github.com/jpadilla/pyjwt/pull/131 [132]: https://github.com/jpadilla/pyjwt/pull/132 [128]: https://github.com/jpadilla/pyjwt/pull/128 [141]: https://github.com/jpadilla/pyjwt/pull/141 [158]: https://github.com/jpadilla/pyjwt/pull/158 [163]: https://github.com/jpadilla/pyjwt/pull/163 [174]: https://github.com/jpadilla/pyjwt/pull/174 [182]: https://github.com/jpadilla/pyjwt/pull/182 [183]: https://github.com/jpadilla/pyjwt/pull/183 [190]: https://github.com/jpadilla/pyjwt/pull/190 [213]: https://github.com/jpadilla/pyjwt/pull/214 [244]: https://github.com/jpadilla/pyjwt/pull/244 [202]: https://github.com/jpadilla/pyjwt/pull/202 [252]: https://github.com/jpadilla/pyjwt/pull/252 [225]: https://github.com/jpadilla/pyjwt/pull/225 [219]: https://github.com/jpadilla/pyjwt/pull/219 [196]: https://github.com/jpadilla/pyjwt/pull/196 [187]: https://github.com/jpadilla/pyjwt/pull/187 [230]: https://github.com/jpadilla/pyjwt/pull/230 [238]: https://github.com/jpadilla/pyjwt/pull/238 [262]: https://github.com/jpadilla/pyjwt/pull/262 [264]: https://github.com/jpadilla/pyjwt/pull/264 [270]: https://github.com/jpadilla/pyjwt/pull/270 [271]: https://github.com/jpadilla/pyjwt/pull/271 [277]: https://github.com/jpadilla/pyjwt/pull/277 [281]: https://github.com/jpadilla/pyjwt/pull/281 [301]: https://github.com/jpadilla/pyjwt/pull/301 [304]: https://github.com/jpadilla/pyjwt/pull/304 [306]: https://github.com/jpadilla/pyjwt/pull/306 [315]: https://github.com/jpadilla/pyjwt/pull/315 [316]: https://github.com/jpadilla/pyjwt/pull/316 [336]: https://github.com/jpadilla/pyjwt/pull/336 [7c1e61d]: https://github.com/jpadilla/pyjwt/commit/7c1e61dde27bafe16e7d1bb6e35199e778962742 ``` ### 1.5.31.5.3 ``` ------------------------------------------------------------------------- Changed - Increase required version of the cryptography package to >=1.4.0. Fixed - Remove uses of deprecated functions from the cryptography package. - Warn about missing `algorithms` param to `decode()` only when `verify` param is `True` [281][281] ``` ### 1.5.21.5.2 ``` ------------------------------------------------------------------------- Fixed - Ensure correct arguments order in decode super call [7c1e61d][7c1e61d] ``` ### 1.5.11.5.1 ``` ------------------------------------------------------------------------- Changed - Change optparse for argparse. [238][238] Fixed - Guard against PKCS1 PEM encododed public keys [277][277] - Add deprecation warning when decoding without specifying `algorithms` [277][277] - Improve deprecation messages [270][270] - PyJWT.decode: move verify param into options [271][271] Added - Support for Python 3.6 [262][262] - Expose jwt.InvalidAlgorithmError [264][264] ```Links
- PyPI: https://pypi.python.org/pypi/pyjwt - Changelog: https://pyup.io/changelogs/pyjwt/ - Repo: http://github.com/jpadilla/pyjwtUpdate newrelic from 2.106.0.87 to 3.0.0.89.
Changelog
### 3.0.0.89 ``` This release of the Python agent removes previously deprecated APIs, makes SSL communication with New Relic mandatory, and updates support for aiohttp middleware. The agent can be installed using easy_install/pip/distribute via the Python Package Index or can be downloaded directly from the New Relic download site. Deprecations Removed previously deprecated APIs The following APIs have been removed: transaction (use current_transaction) name_transaction (use set_transaction_name) Application.record_metric (use Application.record_custom_metric) Application.record_metrics (use Application.record_custom_metrics) Transaction.notice_error (use Transaction.record_exception) Transaction.record_metric (use Transaction.record_custom_metric) Transaction.name_transaction (use Transaction.set_transaction_name) Deprecate Transaction.add_user_attribute Transaction.add_user_attribute has been deprecated in favor of Transaction.add_custom_parameter. Transaction.add_user_attribute will be removed in a future release. Deprecate Transaction.add_user_attributes Transaction.add_user_attributes has been deprecated in favor of Transaction.add_custom_parameters. Transaction.add_user_attributes will be removed in a future release. Deprecate wrap_callable wrap_callable has been deprecated in favor of FunctionWrapper. wrap_callable will be removed in a future release. Remove data-source admin command The platform API (used by newrelic-admin data-source) has been removed. Please use data sources in place of the platform API. SSL SSL connections to New Relic are now mandatory Prior to this version, using an SSL connection to New Relic was the default behavior. SSL connections are now enforced (not overrideable). AIOHTTP Updates Add automatic tracing of AIOHTTP 3 middleware In addition to the old-style middleware previously supported, the AIOHTTP 3 style middleware is now automatically traced as part of the AIOHTTP instrumentation package. ``` ### 2.106.1.88 ``` This release of the Python agent includes a fix for security bulletin nr18-07. The agent can be installed using easy_install/pip/distribute via the Python Package Index or can be downloaded directly from the New Relic download site. ```Links
- PyPI: https://pypi.python.org/pypi/newrelic - Changelog: https://pyup.io/changelogs/newrelic/ - Homepage: http://newrelic.com/docs/python/new-relic-for-python - Bugtracker: http://support.newrelic.comUpdate django_csp from 3.3 to 3.4.
Changelog
### 3.4 ``` === - Remove support for Django 1.6 and 1.7 as they're out of life - Adds pypy3, Django 2.0.x and current Django master to our CI tests - Allow removing directives using csp_replace - Add CSP nonce support ```Links
- PyPI: https://pypi.python.org/pypi/django-csp - Changelog: https://pyup.io/changelogs/django-csp/ - Repo: http://github.com/mozilla/django-cspUpdate cryptography from 2.1.4 to 2.2.2.
Changelog
### 2.2.1 ``` ~~~~~~~~~~~~~~~~~~ * Reverted a change to ``GeneralNames`` which prohibited having zero elements, due to breakages. * Fixed a bug in :func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap_with_padding` that caused it to raise ``InvalidUnwrap`` when key length modulo 8 was zero. .. _v2-2: ``` ### 2.2 ``` ~~~~~~~~~~~~~~~~ * **BACKWARDS INCOMPATIBLE:** Support for Python 2.6 has been dropped. * Resolved a bug in ``HKDF`` that incorrectly constrained output size. * Added :class:`~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP256R1`, :class:`~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP384R1`, and :class:`~cryptography.hazmat.primitives.asymm