August 1, 2016
\nWelcome to Django 1.10!
\nThese release notes cover the new features, as well as\nsome backwards incompatible changes you’ll\nwant to be aware of when upgrading from Django 1.9 or older versions. We’ve\ndropped some features that have reached the end\nof their deprecation cycle, and we’ve begun the deprecation process for\nsome features.
\nSee the How to upgrade Django to a newer version guide if you’re updating an existing\nproject.
\nLike Django 1.9, Django 1.10 requires Python 2.7, 3.4, or 3.5. We highly\nrecommend and only officially support the latest release of each series.
\ndjango.contrib.postgres now includes a collection of database\nfunctions to allow the use of the full text\nsearch engine. You can search across multiple fields in your relational\ndatabase, combine the searches with other lookups, use different language\nconfigurations and weightings, and rank the results by relevance.
It also now includes trigram support, using the trigram_similar\nlookup, and the TrigramSimilarity and\nTrigramDistance expressions.
A new style of middleware is introduced to\nsolve the lack of strict request/response layering of the old-style of\nmiddleware described in DEP 0005.\nYou’ll need to adapt old, custom middleware and\nswitch from the MIDDLEWARE_CLASSES setting to the new MIDDLEWARE\nsetting to take advantage of the improvements.
The User model in django.contrib.auth\noriginally only accepted ASCII letters and numbers in usernames. Although it\nwasn’t a deliberate choice, Unicode characters have always been accepted when\nusing Python 3.
The username validator now explicitly accepts Unicode characters by\ndefault on Python 3 only.
\nCustom user models may use the new\nASCIIUsernameValidator or\nUnicodeUsernameValidator.
django.contrib.adminLink to this heading#For sites running on a subpath, the default URL for the "View site"\nlink at the top of each admin page\nwill now point to request.META['SCRIPT_NAME'] if set, instead of /.
The success message that appears after adding or editing an object now\ncontains a link to the object’s change form.
All inline JavaScript is removed so you can enable the\nContent-Security-Policy HTTP header if you wish.
The new InlineModelAdmin.classes attribute allows specifying\nclasses on inline fieldsets. Inlines with a collapse class will be\ninitially collapsed and their header will have a small “show” link.
If a user doesn’t have the add permission, the object-tools block on a\nmodel’s changelist will now be rendered (without the add button). This makes\nit easier to add custom tools in this case.
The LogEntry model now stores change\nmessages in a JSON structure so that the message can be dynamically\ntranslated using the current active language. A new\nLogEntry.get_change_message() method is now the preferred way of\nretrieving the change message.
Selected objects for fields in ModelAdmin.raw_id_fields now have a link\nto object’s change form.
Added “No date” and “Has date” choices for DateFieldListFilter if the\nfield is nullable.
The jQuery library embedded in the admin is upgraded from version 2.1.4 to\n2.2.3.
django.contrib.authLink to this heading#Added support for the Argon2 password hash. It’s\nrecommended over PBKDF2, however, it’s not the default as it requires a\nthird-party library.
The default iteration count for the PBKDF2 password hasher has been increased\nby 25%. This backwards compatible change will not affect users who have\nsubclassed django.contrib.auth.hashers.PBKDF2PasswordHasher to change the\ndefault value.
The django.contrib.auth.views.logout() view sends “no-cache” headers\nto prevent an issue where Safari caches redirects and prevents a user from\nbeing able to log out.
Added the optional backend argument to django.contrib.auth.login()\nto allow using it without credentials.
The new LOGOUT_REDIRECT_URL setting controls the redirect of the\ndjango.contrib.auth.views.logout() view, if the view doesn’t get a\nnext_page argument.
The new redirect_authenticated_user parameter for the\ndjango.contrib.auth.views.login() view allows redirecting\nauthenticated users visiting the login page.
The new AllowAllUsersModelBackend and\nAllowAllUsersRemoteUserBackend ignore\nthe value of User.is_active, while\nModelBackend and\nRemoteUserBackend now reject inactive\nusers.
django.contrib.gisLink to this heading#Distance lookups now accept expressions as the\ndistance value parameter.
The new GEOSGeometry.unary_union property computes the\nunion of all the elements of this geometry.
Added the GEOSGeometry.covers() binary predicate.
Added the GDALBand.statistics() method and\nmean\nand std attributes.
Added support for the MakeLine\naggregate and GeoHash\nfunction on SpatiaLite.
Added support for the\nDifference,\nIntersection, and\nSymDifference\nfunctions on MySQL.
Added support for instantiating empty GEOS geometries.
The new trim and\nprecision properties\nof WKTWriter allow controlling\noutput of the fractional part of the coordinates in WKT.
Added the LineString.closed and\nMultiLineString.closed properties.
The GeoJSON serializer now outputs the\nprimary key of objects in the properties dictionary if specific fields\naren’t specified.
The ability to replicate input data on the GDALBand.data() method was added. Band data can\nnow be updated with repeated values efficiently.
Added database functions\nIsValid and\nMakeValid, as well as the\nisvalid lookup, all for PostGIS. This allows filtering and\nrepairing invalid geometries on the database side.
Added raster support for all spatial lookups.
django.contrib.postgresLink to this heading#For convenience, HStoreField now\ncasts its keys and values to strings.
django.contrib.sessionsLink to this heading#The clearsessions management command now removes file-based\nsessions.
django.contrib.sitesLink to this heading#The Site model now supports\nnatural keys.
django.contrib.staticfilesLink to this heading#The static template tag now uses django.contrib.staticfiles\nif it’s in INSTALLED_APPS. This is especially useful for third-party apps\nwhich can now always use {% load static %} (instead of\n{% load staticfiles %} or {% load static from staticfiles %}) and\nnot worry about whether or not the staticfiles app is installed.
You can more easily customize\nthe collectstatic --ignore option with a custom AppConfig.
The file-based cache backend now uses the highest pickling protocol.
The default CSRF_FAILURE_VIEW, views.csrf.csrf_failure() now\naccepts an optional template_name parameter, defaulting to\n'403_csrf.html', to control the template used to render the page.
To protect against BREACH attacks, the CSRF protection mechanism now\nchanges the form token value on every request (while keeping an invariant\nsecret which can be used to validate the different tokens).
Temporal data subtraction was unified on all backends.
If the database supports it, backends can set\nDatabaseFeatures.can_return_ids_from_bulk_insert=True and implement\nDatabaseOperations.fetch_returned_insert_ids() to set primary keys\non objects created using QuerySet.bulk_create().
Added keyword arguments to the as_sql() methods of various expressions\n(Func, When, Case, and OrderBy) to allow database backends to\ncustomize them without mutating self, which isn’t safe when using\ndifferent database backends. See the arg_joiner and **extra_context\nparameters of Func.as_sql() for an\nexample.
Storage backends now present a timezone-aware API with new methods\nget_accessed_time(),\nget_created_time(), and\nget_modified_time(). They return a\ntimezone-aware datetime if USE_TZ is True and a naive\ndatetime in the local timezone otherwise.
The new Storage.generate_filename() method makes it easier\nto implement custom storages that don’t use the os.path calls previously\nin FileField.
Form and widget Media is now served using\ndjango.contrib.staticfiles if installed.
The <input> tag rendered by CharField now includes\na minlength attribute if the field has a min_length.
Required form fields now have the required HTML attribute. Set the new\nForm.use_required_attribute attribute to False to disable\nit. The required attribute isn’t included on forms of formsets because\nthe browser validation may not be correct when adding and deleting formsets.
The View class can now be imported from\ndjango.views.
The i18n_patterns() helper function can now be\nused in a root URLConf specified using request.urlconf.
By setting the new prefix_default_language parameter for\ni18n_patterns() to False, you can allow\naccessing the default language without a URL prefix.
set_language() now returns a 204 status code (No\nContent) for AJAX requests when there is no next parameter in POST or\nGET.
The JavaScriptCatalog and\nJSONCatalog class-based views supersede the\ndeprecated javascript_catalog() and json_catalog() function-based\nviews. The new views are almost equivalent to the old ones except that by\ndefault the new views collect all JavaScript strings in the djangojs\ntranslation domain from all installed apps rather than only the JavaScript\nstrings from LOCALE_PATHS.
call_command() now returns the value returned\nfrom the command.handle() method.
The new check --fail-level option allows specifying the message\nlevel that will cause the command to exit with a non-zero status.
The new makemigrations --check option makes the command exit\nwith a non-zero status when model changes without migrations are detected.
makemigrations now displays the path to the migration files that\nit generates.
The shell --interface option now accepts python to force use of\nthe “plain” Python interpreter.
The new shell --command option lets you run a command as Django and\nexit, instead of opening the interactive shell.
Added a warning to dumpdata if a proxy model is specified (which\nresults in no output) without its concrete parent.
The new BaseCommand.requires_migrations_checks attribute\nmay be set to True if you want your command to print a warning, like\nrunserver does, if the set of migrations on disk don’t match the\nmigrations in the database.
To assist with testing, call_command() now\naccepts a command object as the first argument.
The shell command supports tab completion on systems using\nlibedit, e.g. macOS.
The inspectdb command lets you choose what tables should be\ninspected by specifying their names as arguments.
Added support for serialization of enum.Enum objects.
Added the elidable argument to the\nRunSQL and\nRunPython operations to allow them\nto be removed when squashing migrations.
Added support for non-atomic migrations by\nsetting the atomic attribute on a Migration.
The migrate and makemigrations commands now check for a\nconsistent migration history. If they find\nsome unapplied dependencies of an applied migration,\nInconsistentMigrationHistory is raised.
The pre_migrate() and\npost_migrate() signals now dispatch their\nmigration plan and apps.
Reverse foreign keys from proxy models are now propagated to their\nconcrete class. The reverse relation attached by a\nForeignKey pointing to a proxy model is now\naccessible as a descriptor on the proxied model class and may be referenced\nin queryset filtering.
The new Field.rel_db_type()\nmethod returns the database column data type for fields such as\nForeignKey and OneToOneField that point to another field.
The arity class attribute is added to\nFunc. This attribute can be used to set the number\nof arguments the function accepts.
Added BigAutoField which acts much like an\nAutoField except that it is guaranteed\nto fit numbers from 1 to 9223372036854775807.
QuerySet.in_bulk()\nmay be called without any arguments to return all objects in the queryset.
related_query_name now supports\napp label and class interpolation using the '%(app_label)s' and\n'%(class)s' strings.
Allowed overriding model fields inherited from abstract base classes.
The prefetch_related_objects() function is now a\npublic API.
QuerySet.bulk_create()\nsets the primary key on objects when using PostgreSQL.
Added the Cast database function.
A proxy model may now inherit multiple proxy models that share a common\nnon-abstract parent class.
Added Extract functions to extract\ndatetime components as integers, such as year and hour.
Added Trunc functions to truncate a date\nor datetime to a significant component. They enable queries like\nsales-per-day or sales-per-hour.
Model.__init__() now sets values of virtual fields from its keyword\narguments.
The new Meta.base_manager_name and\nMeta.default_manager_name options allow controlling\nthe _base_manager and\n_default_manager, respectively.
Added request.user to the debug view.
Added HttpResponse methods\nreadable() and\nseekable() to make an instance a\nstream-like object and allow wrapping it with io.TextIOWrapper.
Added the HttpRequest.content_type and\ncontent_params attributes which are\nparsed from the CONTENT_TYPE header.
The parser for request.COOKIES is simplified to better match the behavior\nof browsers. request.COOKIES may now contain cookies that are invalid\naccording to RFC 6265 but are possible to set via document.cookie.
The django.core.serializers.json.DjangoJSONEncoder now knows how to\nserialize lazy strings, typically used for translatable content.
Added the autoescape option to the\nDjangoTemplates backend and the\nEngine class.
Added the is and is not comparison operators to the if tag.
Allowed dictsort to order a list of lists by an element at a\nspecified index.
The debug() context processor\ncontains queries for all database aliases instead of only the default alias.
Added relative path support for string arguments of the extends and\ninclude template tags.
To better catch bugs, TestCase now checks deferrable\ndatabase constraints at the end of each test.
Tests and test cases can be marked with tags\nand run selectively with the new test --tag and test\n--exclude-tag options.
You can now login and use sessions with the test client even if\ndjango.contrib.sessions is not in INSTALLED_APPS.
An addition in django.setup() allows URL resolving that happens\noutside of the request/response cycle (e.g. in management commands and\nstandalone scripts) to take FORCE_SCRIPT_NAME into account when it\nis set.
URLValidator now limits the length of\ndomain name labels to 63 characters and the total length of domain\nnames to 253 characters per RFC 1034.
int_list_validator() now accepts an optional\nallow_negative boolean parameter, defaulting to False, to allow\nnegative integers.
GIS’s AreaField uses an unspecified underlying numeric type that could in\npractice be any numeric Python type. decimal.Decimal values retrieved\nfrom the database are now converted to float to make it easier to combine\nthem with values used by the GIS libraries.
In order to enable temporal subtraction you must set the\nsupports_temporal_subtraction database feature flag to True and\nimplement the DatabaseOperations.subtract_temporals() method. This\nmethod should return the SQL and parameters required to compute the\ndifference in microseconds between the lhs and rhs arguments in the\ndatatype used to store DurationField.
_meta.get_fields() returns consistent reverse fields for proxy modelsLink to this heading#Before Django 1.10, the get_fields()\nmethod returned different reverse fields when called on a proxy model compared\nto its proxied concrete class. This inconsistency was fixed by returning the\nfull set of fields pointing to a concrete class or one of its proxies in both\ncases.
AbstractUser.username max_length increased to 150Link to this heading#A migration for django.contrib.auth.models.User.username is included.\nIf you have a custom user model inheriting from AbstractUser, you’ll need\nto generate and apply a database migration for your user model.
We considered an increase to 254 characters to more easily allow the use of\nemail addresses (which are limited to 254 characters) as usernames but rejected\nit due to a MySQL limitation. When using the utf8mb4 encoding (recommended\nfor proper Unicode support), MySQL can only create unique indexes with 191\ncharacters by default. Therefore, if you need a longer length, please use a\ncustom user model.
If you want to preserve the 30 character limit for usernames, use a custom form\nwhen creating a user or changing usernames:
\nfrom django.contrib.auth.forms import UserCreationForm\n\n\nclass MyUserCreationForm(UserCreationForm):\n username = forms.CharField(\n max_length=30,\n help_text="Required. 30 characters or fewer. Letters, digits and @/./+/-/_ only.",\n )\nIf you wish to keep this restriction in the admin, set UserAdmin.add_form\nto use this form:
from django.contrib.auth.admin import UserAdmin as BaseUserAdmin\nfrom django.contrib.auth.models import User\n\n\nclass UserAdmin(BaseUserAdmin):\n add_form = MyUserCreationForm\n\n\nadmin.site.unregister(User)\nadmin.site.register(User, UserAdmin)\nUpstream support for PostgreSQL 9.1 ends in September 2016. As a consequence,\nDjango 1.10 sets PostgreSQL 9.2 as the minimum version it officially supports.
\nrunserver output goes through loggingLink to this heading#Request and response handling of the runserver command is sent to the\ndjango.server logger instead of to sys.stderr. If you\ndisable Django’s logging configuration or override it with your own, you’ll\nneed to add the appropriate logging configuration if you want to see that\noutput:
LOGGING = {\n # ...\n "formatters": {\n "django.server": {\n "()": "django.utils.log.ServerFormatter",\n "format": "[%(server_time)s] %(message)s",\n }\n },\n "handlers": {\n "django.server": {\n "level": "INFO",\n "class": "logging.StreamHandler",\n "formatter": "django.server",\n },\n },\n "loggers": {\n "django.server": {\n "handlers": ["django.server"],\n "level": "INFO",\n "propagate": False,\n }\n },\n}\nauth.CustomUser and auth.ExtensionUser test models were removedLink to this heading#Since the introduction of migrations for the contrib apps in Django 1.8, the\ntables of these custom user test models were not created anymore making them\nunusable in a testing context.
\nThe apps registry is no longer auto-populated when unpickling models. This was\nadded in Django 1.7.2 as an attempt to allow unpickling models outside of\nDjango, such as in an RQ worker, without calling django.setup(), but it\ncreates the possibility of a deadlock. To adapt your code in the case of RQ,\nyou can provide your own worker script\nthat calls django.setup().
In older versions, assigning None to a non-nullable ForeignKey or\nOneToOneField raised ValueError('Cannot assign None: "model.field" does\nnot allow null values.'). For consistency with other model fields which don’t\nhave a similar check, this check is removed.
PASSWORD_HASHERS settingLink to this heading#Django 0.90 stored passwords as unsalted MD5. Django 0.91 added support for\nsalted SHA1 with automatic upgrade of passwords when a user logs in. Django 1.4\nadded PBKDF2 as the default password hasher.
\nIf you have an old Django project with MD5 or SHA1 (even salted) encoded\npasswords, be aware that these can be cracked fairly easily with today’s\nhardware. To make Django users acknowledge continued use of weak hashers, the\nfollowing hashers are removed from the default PASSWORD_HASHERS\nsetting:
"django.contrib.auth.hashers.SHA1PasswordHasher"
"django.contrib.auth.hashers.MD5PasswordHasher"
"django.contrib.auth.hashers.UnsaltedSHA1PasswordHasher"
"django.contrib.auth.hashers.UnsaltedMD5PasswordHasher"
"django.contrib.auth.hashers.CryptPasswordHasher"
Consider using a wrapped password hasher to\nstrengthen the hashes in your database. If that’s not feasible, add the\nPASSWORD_HASHERS setting to your project and add back any hashers\nthat you need.
You can check if your database has any of the removed hashers like this:
\nfrom django.contrib.auth import get_user_model\n\nUser = get_user_model()\n\n# Unsalted MD5/SHA1:\nUser.objects.filter(password__startswith="md5$$")\nUser.objects.filter(password__startswith="sha1$$")\n# Salted MD5/SHA1:\nUser.objects.filter(password__startswith="md5$").exclude(password__startswith="md5$$")\nUser.objects.filter(password__startswith="sha1$").exclude(password__startswith="sha1$$")\n# Crypt hasher:\nUser.objects.filter(password__startswith="crypt$$")\n\nfrom django.db.models import CharField\nfrom django.db.models.functions import Length\n\nCharField.register_lookup(Length)\n# Unsalted MD5 passwords might not have an 'md5$$' prefix:\nUser.objects.filter(password__length=32)\nField.get_prep_lookup() and Field.get_db_prep_lookup() methods are removedLink to this heading#If you have a custom field that implements either of these methods, register a\ncustom lookup for it. For example:
\nfrom django.db.models import Field\nfrom django.db.models.lookups import Exact\n\n\nclass MyField(Field): ...\n\n\nclass MyFieldExact(Exact):\n def get_prep_lookup(self):\n # do_custom_stuff_for_myfield\n ...\n\n\nMyField.register_lookup(MyFieldExact)\ndjango.contrib.gisLink to this heading#Support for SpatiaLite < 3.0 and GEOS < 3.3 is dropped.
The add_postgis_srs() backwards compatibility alias for\ndjango.contrib.gis.utils.add_srs_entry() is removed.
On Oracle/GIS, the Area\naggregate function now returns a float instead of decimal.Decimal.\n(It’s still wrapped in a measure of square meters.)
The default GEOSGeometry representation\n(WKT output) is trimmed by default. That is, instead of POINT\n(23.0000000000000000 5.5000000000000000), you’ll get POINT (23 5.5).
Two new settings help mitigate denial-of-service attacks via large requests:
\nDATA_UPLOAD_MAX_MEMORY_SIZE limits the size that a request body\nmay be. File uploads don’t count toward this limit.
DATA_UPLOAD_MAX_NUMBER_FIELDS limits the number of GET/POST\nparameters that are parsed.
Applications that receive unusually large form posts may need to tune these\nsettings.
\nThe repr() of a QuerySet is wrapped in <QuerySet > to\ndisambiguate it from a plain list when debugging.
utils.version.get_version() returns PEP 440 compliant release\ncandidate versions (e.g. ‘1.10rc1’ instead of ‘1.10c1’).
CSRF token values are now required to be strings of 64 alphanumerics; values\nof 32 alphanumerics, as set by older versions of Django by default, are\nautomatically replaced by strings of 64 characters. Other values are\nconsidered invalid. This should only affect developers or users who replace\nthese tokens.
The LOGOUT_URL setting is removed as Django hasn’t made use of it\nsince pre-1.0. If you use it in your project, you can add it to your\nproject’s settings. The default value was '/accounts/logout/'.
Objects with a close() method such as files and generators passed to\nHttpResponse are now closed immediately instead of when\nthe WSGI server calls close() on the response.
A redundant transaction.atomic() call in QuerySet.update_or_create()\nis removed. This may affect query counts tested by\nTransactionTestCase.assertNumQueries().
Support for skip_validation in BaseCommand.execute(**options) is\nremoved. Use skip_checks (added in Django 1.7) instead.
loaddata now raises a CommandError instead of showing a\nwarning when the specified fixture file is not found.
Instead of directly accessing the LogEntry.change_message attribute, it’s\nnow better to call the LogEntry.get_change_message() method which will\nprovide the message in the current language.
The default error views now raise TemplateDoesNotExist if a nonexistent\ntemplate_name is specified.
The unused choices keyword argument of the Select and\nSelectMultiple widgets’ render() method is removed. The choices\nargument of the render_options() method is also removed, making\nselected_choices the first argument.
Tests that violate deferrable database constraints will now error when run on\na database that supports deferrable constraints.
Built-in management commands now use indexing of keys in options, e.g.\noptions['verbosity'], instead of options.get() and no longer perform\nany type coercion. This could be a problem if you’re calling commands using\nCommand.execute() (which bypasses the argument parser that sets a default\nvalue) instead of call_command(). Instead of\ncalling Command.execute(), pass the command object as the first argument\nto call_command().
ModelBackend and\nRemoteUserBackend now reject inactive\nusers. This means that inactive users can’t login and will be logged\nout if they are switched from is_active=True to False. If you need\nthe previous behavior, use the new\nAllowAllUsersModelBackend or\nAllowAllUsersRemoteUserBackend\nin AUTHENTICATION_BACKENDS instead.
In light of the previous change, the test client’s\nlogin() method no longer always rejects inactive\nusers but instead delegates this decision to the authentication backend.\nforce_login() also delegates the decision to the\nauthentication backend, so if you’re using the default backends, you need to\nuse an active user.
django.views.i18n.set_language() may now return a 204 status code for\nAJAX requests.
The base_field attribute of\nRangeField is now a type of field,\nnot an instance of a field. If you have created a custom subclass of\nRangeField, you should change the\nbase_field attribute.
Middleware classes are now initialized when the server starts rather than\nduring the first request.
If you override is_authenticated() or is_anonymous() in a custom user\nmodel, you must convert them to attributes or properties as described in\nthe deprecation note.
When using ModelAdmin.save_as=True, the “Save as new” button now\nredirects to the change view for the new object instead of to the model’s\nchangelist. If you need the previous behavior, set the new\nModelAdmin.save_as_continue attribute to False.
Required form fields now have the required HTML attribute. Set the\nForm.use_required_attribute\nattribute to False to disable it. You could also add the novalidate\nattribute to <form> if you don’t want browser validation. To disable\nthe required attribute on custom widgets, override the\nWidget.use_required_attribute()\nmethod.
The WSGI handler no longer removes content of responses from HEAD\nrequests or responses with a status_code of 100-199, 204, or 304. Most\nweb servers already implement this behavior. Responses retrieved using the\nDjango test client continue to have these “response fixes” applied.
Model.__init__() now receives django.db.models.DEFERRED as the value\nof deferred fields.
The Model._deferred attribute is removed as dynamic model classes when\nusing QuerySet.defer() and only() is removed.
Storage.save() no longer\nreplaces '\\' with '/'. This behavior is moved to\nFileSystemStorage since this is a storage\nspecific implementation detail. Any Windows user with a custom storage\nimplementation that relies on this behavior will need to implement it in the\ncustom storage’s save() method.
Private FileField methods get_directory_name()\nand get_filename() are no longer called (and are now deprecated) which is\na backwards incompatible change for users overriding those methods on custom\nfields. To adapt such code, override FileField.generate_filename() or\nStorage.generate_filename() instead. It\nmight be possible to use upload_to also.
The subject of mail sent by AdminEmailHandler is no longer truncated at\n989 characters. If you were counting on a limited length, truncate the\nsubject yourself.
Private expressions django.db.models.expressions.Date and DateTime\nare removed. The new Trunc expressions\nprovide the same functionality.
The _base_manager and _default_manager attributes are removed from\nmodel instances. They remain accessible on the model class.
Accessing a deleted field on a model instance, e.g. after del obj.field,\nreloads the field’s value instead of raising AttributeError.
If you subclass AbstractBaseUser and override clean(), be sure it\ncalls super(). AbstractBaseUser.normalize_username() is called in\na new AbstractBaseUser.clean() method.
Private API django.forms.models.model_to_dict() returns a queryset rather\nthan a list of primary keys for ManyToManyFields.
If django.contrib.staticfiles is\ninstalled, the static template tag uses the staticfiles storage\nto construct the URL rather than simply joining the value with\nSTATIC_ROOT. The new approach encodes the URL, which could be\nbackwards-incompatible in cases such as including a fragment in a path, e.g.\n{% static 'img.svg#fragment' %}, since the # is encoded as %23.\nTo adapt, move the fragment outside the template tag:\n{% static 'img.svg' %}#fragment.
When USE_L10N is True, localization is now applied for the\ndate and time filters when no format string is\nspecified. The DATE_FORMAT and TIME_FORMAT specifiers from the active\nlocale are used instead of the settings of the same name.
Instead of assigning related objects using direct assignment:
\n>>> new_list = [obj1, obj2, obj3]\n>>> e.related_set = new_list\nUse the set() method\nadded in Django 1.9:
>>> e.related_set.set([obj1, obj2, obj3])\nThis prevents confusion about an assignment resulting in an implicit save.
\nStorage APILink to this heading#The old, non-timezone-aware methods accessed_time(), created_time(),\nand modified_time() are deprecated in favor of the new get_*_time()\nmethods.
Third-party storage backends should implement the new methods and mark the old\nones as deprecated. Until then, the new get_*_time() methods on the base\nStorage class convert datetimes from\nthe old methods as required and emit a deprecation warning as they do so.
Third-party storage backends may retain the old methods as long as they\nwish to support earlier versions of Django.
\ndjango.contrib.gisLink to this heading#The get_srid() and set_srid() methods of\nGEOSGeometry are deprecated in favor\nof the srid property.
The get_x(), set_x(), get_y(), set_y(), get_z(), and\nset_z() methods of Point are deprecated\nin favor of the x, y, and z properties.
The get_coords() and set_coords() methods of\nPoint are deprecated in favor of the\ntuple property.
The cascaded_union property of\nMultiPolygon is deprecated in favor of the\nunary_union property.
The django.contrib.gis.utils.precision_wkt() function is deprecated in\nfavor of WKTWriter.
CommaSeparatedIntegerField model fieldLink to this heading#CommaSeparatedIntegerField is deprecated in favor of\nCharField with the\nvalidate_comma_separated_integer_list()\nvalidator:
from django.core.validators import validate_comma_separated_integer_list\nfrom django.db import models\n\n\nclass MyModel(models.Model):\n numbers = models.CharField(..., validators=[validate_comma_separated_integer_list])\nIf you’re using Oracle, CharField uses a different database field type\n(NVARCHAR2) than CommaSeparatedIntegerField (VARCHAR2). Depending\non your database settings, this might imply a different encoding, and thus a\ndifferent length (in bytes) for the same contents. If your stored values are\nlonger than the 4000 byte limit of NVARCHAR2, you should use TextField\n(NCLOB) instead. In this case, if you have any queries that group by the\nfield (e.g. annotating the model with an aggregation or using distinct())\nyou’ll need to change them (to defer the field).
__search query lookupLink to this heading#The search lookup, which supports MySQL only and is extremely limited in\nfeatures, is deprecated. Replace it with a custom lookup:
from django.db import models\n\n\nclass Search(models.Lookup):\n lookup_name = "search"\n\n def as_mysql(self, compiler, connection):\n lhs, lhs_params = self.process_lhs(compiler, connection)\n rhs, rhs_params = self.process_rhs(compiler, connection)\n params = lhs_params + rhs_params\n return "MATCH (%s) AGAINST (%s IN BOOLEAN MODE)" % (lhs, rhs), params\n\n\nmodels.CharField.register_lookup(Search)\nmodels.TextField.register_lookup(Search)\nUser.is_authenticated() and User.is_anonymous() as methodsLink to this heading#The is_authenticated() and is_anonymous() methods of\nAbstractBaseUser and\nAnonymousUser classes are now\nproperties. They will still work as methods until Django 2.0, but all usage\nin Django now uses attribute access.
For example, if you use\nAuthenticationMiddleware and want\nto know whether the user is currently logged-in you would use:
if request.user.is_authenticated:\n ... # Do something for logged-in users.\nelse:\n ... # Do something for anonymous users.\ninstead of request.user.is_authenticated().
This change avoids accidental information leakage if you forget to call the\nmethod, e.g.:
\nif request.user.is_authenticated:\n return sensitive_information\nIf you override these methods in a custom user model, you must change them to\nproperties or attributes.
\nDjango uses a CallableBool object to allow these attributes to work as both\na property and a method. Thus, until the deprecation period ends, you cannot\ncompare these properties using the is operator. That is, the following\nwon’t work:
if request.user.is_authenticated is True:\n ...\ndjango.utils.safestringLink to this heading#The mark_for_escaping() function and the classes it uses: EscapeData,\nEscapeBytes, EscapeText, EscapeString, and EscapeUnicode are\ndeprecated.
As a result, the “lazy” behavior of the escape filter (where it would\nalways be applied as the last filter no matter where in the filter chain it\nappeared) is deprecated. The filter will change to immediately apply\nconditional_escape() in Django 2.0.
The makemigrations --exit option is deprecated in favor of the\nmakemigrations --check option.
django.utils.functional.allow_lazy() is deprecated in favor of the new\nkeep_lazy() function which can be used with a\nmore natural decorator syntax.
The shell --plain option is deprecated in favor of -i python or\n--interface python.
Importing from the django.core.urlresolvers module is deprecated in\nfavor of its new location, django.urls.
The template Context.has_key() method is deprecated in favor of in.
The private attribute virtual_fields of Model._meta is\ndeprecated in favor of private_fields.
The private keyword arguments virtual_only in\nField.contribute_to_class() and virtual in\nModel._meta.add_field() are deprecated in favor of private_only\nand private, respectively.
The javascript_catalog() and json_catalog() views are deprecated in\nfavor of class-based views JavaScriptCatalog\nand JSONCatalog.
In multi-table inheritance, implicit promotion of a OneToOneField to a\nparent_link is deprecated. Add parent_link=True to such fields.
The private API Widget._format_value() is made public and renamed to\nformat_value(). The old name will work\nthrough a deprecation period.
Private FileField methods get_directory_name() and get_filename()\nare deprecated in favor of performing this work in\nStorage.generate_filename().
Old-style middleware that uses settings.MIDDLEWARE_CLASSES are\ndeprecated. Adapt old, custom middleware and\nuse the new MIDDLEWARE setting.
These features have reached the end of their deprecation cycle and are removed\nin Django 1.10. See Features deprecated in 1.8 for details, including how\nto remove usage of these features.
\nSupport for calling a SQLCompiler directly as an alias for calling its\nquote_name_unless_alias method is removed.
The cycle and firstof template tags are removed from the future\ntemplate tag library.
django.conf.urls.patterns() is removed.
Support for the prefix argument to\ndjango.conf.urls.i18n.i18n_patterns() is removed.
SimpleTestCase.urls is removed.
Using an incorrect count of unpacked values in the for template tag\nraises an exception rather than failing silently.
The ability to reverse() URLs using a dotted Python path\nis removed.
The ability to use a dotted Python path for the LOGIN_URL and\nLOGIN_REDIRECT_URL settings is removed.
Support for optparse is dropped for custom management commands.
The class django.core.management.NoArgsCommand is removed.
django.core.context_processors module is removed.
django.db.models.sql.aggregates module is removed.
django.contrib.gis.db.models.sql.aggregates module is removed.
The following methods and properties of django.db.sql.query.Query are\nremoved:
Properties: aggregates and aggregate_select
Methods: add_aggregate, set_aggregate_mask, and\nappend_aggregate_mask.
django.template.resolve_variable is removed.
The following private APIs are removed from\ndjango.db.models.options.Options (Model._meta):
get_field_by_name()
get_all_field_names()
get_fields_with_model()
get_concrete_fields_with_model()
get_m2m_with_model()
get_all_related_objects()
get_all_related_objects_with_model()
get_all_related_many_to_many_objects()
get_all_related_m2m_objects_with_model()
The error_message argument of django.forms.RegexField is removed.
The unordered_list filter no longer supports old style lists.
Support for string view arguments to url() is removed.
The backward compatible shim to rename django.forms.Form._has_changed()\nto has_changed() is removed.
The removetags template filter is removed.
The remove_tags() and strip_entities() functions in\ndjango.utils.html is removed.
The is_admin_site argument to\ndjango.contrib.auth.views.password_reset() is removed.
django.db.models.field.subclassing.SubfieldBase is removed.
django.utils.checksums is removed.
The original_content_type_id attribute on\ndjango.contrib.admin.helpers.InlineAdminForm is removed.
The backwards compatibility shim to allow FormMixin.get_form() to be\ndefined with no default value for its form_class argument is removed.
The following settings are removed, and you must upgrade to the\nTEMPLATES setting:
ALLOWED_INCLUDE_ROOTS
TEMPLATE_CONTEXT_PROCESSORS
TEMPLATE_DEBUG
TEMPLATE_DIRS
TEMPLATE_LOADERS
TEMPLATE_STRING_IF_INVALID
The backwards compatibility alias django.template.loader.BaseLoader is\nremoved.
Django template objects returned by\nget_template() and\nselect_template() no longer accept a\nContext in their\nrender() method.
Template response APIs enforce the use of\ndict and backend-dependent template objects instead of\nContext and Template\nrespectively.
The current_app parameter for the following function and classes is\nremoved:
django.shortcuts.render()
django.template.Context()
django.template.RequestContext()
django.template.response.TemplateResponse()
The dictionary and context_instance parameters for the following\nfunctions are removed:
django.shortcuts.render()
django.shortcuts.render_to_response()
django.template.loader.render_to_string()
The dirs parameter for the following functions is removed:
django.template.loader.get_template()
django.template.loader.select_template()
django.shortcuts.render()
django.shortcuts.render_to_response()
Session verification is enabled regardless of whether or not\n'django.contrib.auth.middleware.SessionAuthenticationMiddleware' is in\nMIDDLEWARE_CLASSES. SessionAuthenticationMiddleware no longer has\nany purpose and can be removed from MIDDLEWARE_CLASSES. It’s kept as\na stub until Django 2.0 as a courtesy for users who don’t read this note.
Private attribute django.db.models.Field.related is removed.
The --list option of the migrate management command is removed.
The ssi template tag is removed.
Support for the = comparison operator in the if template tag is\nremoved.
The backwards compatibility shims to allow Storage.get_available_name()\nand Storage.save() to be defined without a max_length argument are\nremoved.
Support for the legacy %(<foo>)s syntax in ModelFormMixin.success_url\nis removed.
GeoQuerySet aggregate methods collect(), extent(), extent3d(),\nmake_line(), and unionagg() are removed.
The ability to specify ContentType.name when creating a content type\ninstance is removed.
Support for the old signature of allow_migrate is removed.
Support for the syntax of {% cycle %} that uses comma-separated arguments\nis removed.
The warning that Signer issued when given an\ninvalid separator is now a ValueError.