{"title":"Django 1.11 release notes","version":"dev","locale":"en","docname":"releases/1.11","url":"/en/dev/releases/1.11/","canonical":"https://djangodocs.dev/en/dev/releases/1.11/","summary":"Welcome to Django 1.11! These release notes cover the new features, as well as some backwards incompatible changes you’ll want to be aware of when upgrading…","html":"

Django 1.11 release notesLink to this heading#

\n

April 4, 2017

\n

Welcome to Django 1.11!

\n

These release notes cover the new features, as well as\nsome backwards incompatible changes you’ll\nwant to be aware of when upgrading from Django 1.10 or older versions. We’ve\nbegun the deprecation process for some features.

\n

See the How to upgrade Django to a newer version guide if you’re updating an existing\nproject.

\n

Django 1.11 is designated as a long-term support release. It will receive security updates for at least\nthree years after its release. Support for the previous LTS, Django 1.8, will\nend in April 2018.

\n
\n

Python compatibilityLink to this heading#

\n

Django 1.11 requires Python 2.7, 3.4, 3.5, 3.6, or 3.7 (as of 1.11.17). We\nhighly recommend and only officially support the latest release of each\nseries.

\n

The Django 1.11.x series is the last to support Python 2. The next major\nrelease, Django 2.0, will only support Python 3.4+.

\n
\n
\n

Deprecating warnings are no longer loud by defaultLink to this heading#

\n

Unlike older versions of Django, Django’s own deprecation warnings are no\nlonger displayed by default. This is consistent with Python’s default behavior.

\n

This change allows third-party apps to support both Django 1.11 LTS and Django\n1.8 LTS without having to add code to avoid deprecation warnings.

\n

Following the release of Django 2.0, we suggest that third-party app authors\ndrop support for all versions of Django prior to 1.11. At that time, you should\nbe able run your package’s tests using python -Wd so that deprecation\nwarnings do appear. After making the deprecation warning fixes, your app should\nbe compatible with Django 2.0.

\n
\n
\n

What’s new in Django 1.11Link to this heading#

\n
\n

Class-based model indexesLink to this heading#

\n

The new django.db.models.indexes module contains classes which ease\ncreating database indexes. Indexes are added to models using the\nMeta.indexes option.

\n

The Index class creates a b-tree index, as if you\nused db_index on the model field or\nindex_together on the model Meta class. It can be subclassed to support\ndifferent index types, such as\nGinIndex. It also allows defining the\norder (ASC/DESC) for the columns of the index.

\n
\n
\n

Template-based widget renderingLink to this heading#

\n

To ease customizing widgets, form widget rendering is now done using the\ntemplate system rather than in Python. See The form rendering API.

\n

You may need to adjust any custom widgets that you’ve written for a few\nbackwards incompatible changes.

\n
\n
\n

Subquery expressionsLink to this heading#

\n

The new Subquery and\nExists database expressions allow creating\nexplicit subqueries. Subqueries may refer to fields from the outer queryset\nusing the OuterRef class.

\n
\n
\n

Minor featuresLink to this heading#

\n
\n

django.contrib.adminLink to this heading#

\n\n
\n
\n

django.contrib.authLink to this heading#

\n
    \n

  • The default iteration count for the PBKDF2 password hasher is increased by\n20%.

    • \n

  • The LoginView and\nLogoutView class-based views supersede\nthe deprecated login() and logout() function-based views.

    • \n

  • The PasswordChangeView,\nPasswordChangeDoneView,\nPasswordResetView,\nPasswordResetDoneView,\nPasswordResetConfirmView, and\nPasswordResetCompleteView class-based\nviews supersede the deprecated password_change(),\npassword_change_done(), password_reset(), password_reset_done(),\npassword_reset_confirm(), and password_reset_complete()\nfunction-based views.

    • \n

  • The new post_reset_login attribute for\nPasswordResetConfirmView allows\nautomatically logging in a user after a successful password reset.\nIf you have multiple AUTHENTICATION_BACKENDS configured, use the\npost_reset_login_backend attribute to choose which one to use.

    • \n

  • To avoid the possibility of leaking a password reset token via the HTTP\nReferer header (for example, if the reset page includes a reference to CSS or\nJavaScript hosted on another domain), the\nPasswordResetConfirmView (but not the\ndeprecated password_reset_confirm() function-based view) stores the token\nin a session and redirects to itself to present the password change form to\nthe user without the token in the URL.

    • \n

  • update_session_auth_hash() now rotates the session\nkey to allow a password change to invalidate stolen session cookies.

    • \n

  • The new success_url_allowed_hosts attribute for\nLoginView and\nLogoutView allows specifying a set of\nhosts that are safe for redirecting after login and logout.

    • \n

  • Added password validators help_text to\nUserCreationForm.

    • \n

  • The HttpRequest is now passed to\nauthenticate() which in turn passes it to the\nauthentication backend if it accepts a request argument.

    • \n

  • The user_login_failed() signal now\nreceives a request argument.

    • \n

  • PasswordResetForm supports custom user\nmodels that use an email field named something other than 'email'. Set\nCustomUser.EMAIL_FIELD to the name of the\nfield.

    • \n

  • get_user_model() can now be called at import time,\neven in modules that define models.

    • \n
\n
\n
\n

django.contrib.contenttypesLink to this heading#

\n
    \n

  • When stale content types are detected in the\nremove_stale_contenttypes command, there’s now a list of related\nobjects such as auth.Permissions that will also be deleted. Previously,\nonly the content types were listed (and this prompt was after migrate\nrather than in a separate command).

    • \n
\n
\n
\n

django.contrib.gisLink to this heading#

\n
    \n

  • The new GEOSGeometry.from_gml() and OGRGeometry.from_gml()\nmethods allow creating geometries from GML.

    • \n

  • Added support for the dwithin lookup on SpatiaLite.

    • \n

  • The Area function,\nDistance function, and\ndistance lookups now work with geodetic coordinates on SpatiaLite.

    • \n

  • The OpenLayers-based form widgets now use OpenLayers.js from\nhttps://cdnjs.cloudflare.com which is more suitable for production use\nthan the old https://openlayers.org/ source. They are also updated to use\nOpenLayers 3.

    • \n

  • PostGIS migrations can now change field dimensions.

    • \n

  • Added the ability to pass the size, shape, and offset parameters\nwhen creating GDALRaster objects.

    • \n

  • Added SpatiaLite support for the\nIsValid function,\nMakeValid function, and\nisvalid lookup.

    • \n

  • Added Oracle support for the\nAsGML function,\nBoundingCircle function,\nIsValid function, and\nisvalid lookup.

    • \n
\n
\n
\n

django.contrib.postgresLink to this heading#

\n
    \n

  • The new distinct argument for\nStringAgg determines if\nconcatenated values will be distinct.

    • \n

  • The new GinIndex and\nBrinIndex classes allow\ncreating GIN and BRIN indexes in the database.

    • \n

  • django.contrib.postgres.fields.JSONField accepts a new encoder\nparameter to specify a custom class to encode data types not supported by the\nstandard encoder.

    • \n

  • The new CIText mixin and\nCITextExtension migration\noperation allow using PostgreSQL’s citext extension for case-insensitive\nlookups. Three fields are provided: CICharField, CIEmailField, and\nCITextField.

    • \n

  • The new JSONBAgg allows\naggregating values as a JSON array.

    • \n

  • The HStoreField (model field) and\nHStoreField (form field) allow\nstoring null values.

    • \n
\n
\n
\n

CacheLink to this heading#

\n
    \n

  • Memcached backends now pass the contents of\nOPTIONS as keyword arguments to the client\nconstructors, allowing for more advanced control of client behavior. See the\ncache arguments documentation for examples.

    • \n

  • Memcached backends now allow defining multiple servers as a comma-delimited\nstring in LOCATION, for convenience with\nthird-party services that use such strings in environment variables.

    • \n
\n
\n
\n

CSRFLink to this heading#

\n
    \n

  • Added the CSRF_USE_SESSIONS setting to allow storing the CSRF\ntoken in the user’s session rather than in a cookie.

    • \n
\n
\n
\n

Database backendsLink to this heading#

\n
    \n

  • Added the skip_locked argument to QuerySet.select_for_update()\non PostgreSQL 9.5+ and Oracle to execute queries with\nFOR UPDATE SKIP LOCKED.

    • \n

  • Added the TEST['TEMPLATE'] setting to let\nPostgreSQL users specify a template for creating the test database.

    • \n

  • QuerySet.iterator() now uses server-side cursors on PostgreSQL.\nThis feature transfers some of the worker memory load (used to hold query\nresults) to the database and might increase database memory usage.

    \n
    • \n

  • Added MySQL support for the 'isolation_level' option in\nOPTIONS to allow specifying the transaction isolation level. To avoid possible data loss, it’s recommended to\nswitch from MySQL’s default level, repeatable read, to read committed.

    • \n

  • Added support for cx_Oracle 5.3.

    • \n
\n
\n
\n

EmailLink to this heading#

\n
    \n

  • Added the EMAIL_USE_LOCALTIME setting to allow sending SMTP date\nheaders in the local time zone rather than in UTC.

    • \n

  • EmailMessage.attach() and attach_file() now fall back to MIME type\napplication/octet-stream when binary content that can’t be\ndecoded as UTF-8 is specified for a text/* attachment.

    • \n
\n
\n
\n

File StorageLink to this heading#

\n
    \n

  • To make it wrappable by io.TextIOWrapper,\nFile now has the readable(), writable(),\nand seekable() methods.

    • \n
\n
\n
\n

FormsLink to this heading#

\n\n
\n
\n

InternationalizationLink to this heading#

\n
    \n

  • Number formatting and the NUMBER_GROUPING setting support\nnon-uniform digit grouping.

    • \n
\n
\n
\n

Management CommandsLink to this heading#

\n
    \n

  • The new loaddata --exclude option allows excluding models and apps\nwhile loading data from fixtures.

    • \n

  • The new diffsettings --default option allows specifying a settings\nmodule other than Django’s default settings to compare against.

    • \n

  • app_labels arguments now limit the showmigrations --plan\noutput.

    • \n
\n
\n
\n

MigrationsLink to this heading#

\n
    \n

  • Added support for serialization of uuid.UUID objects.

    • \n
\n
\n
\n

ModelsLink to this heading#

\n\n
\n
\n

Requests and ResponsesLink to this heading#

\n\n
\n
\n

SerializationLink to this heading#

\n
    \n

  • The new django.core.serializers.base.Serializer.stream_class attribute\nallows subclasses to customize the default stream.

    • \n

  • The encoder used by the JSON serializer\ncan now be customized by passing a cls keyword argument to the\nserializers.serialize() function.

    • \n

  • DjangoJSONEncoder now serializes\ntimedelta objects (used by\nDurationField).

    • \n
\n
\n
\n

TemplatesLink to this heading#

\n
    \n

  • mark_safe() can now be used as a decorator.

    • \n

  • The Jinja2 template backend now\nsupports context processors by setting the 'context_processors' option in\nOPTIONS.

    • \n

  • The regroup tag now returns namedtuples instead of dictionaries\nso you can unpack the group object directly in a loop, e.g.\n{% for grouper, list in regrouped %}.

    • \n

  • Added a resetcycle template tag to allow resetting the sequence of\nthe cycle template tag.

    • \n

  • You can now specify specific directories for a particular\nfilesystem.Loader.

    • \n
\n
\n
\n

TestsLink to this heading#

\n\n
\n
\n

ValidatorsLink to this heading#

\n\n
\n
\n
\n
\n

Backwards incompatible changes in 1.11Link to this heading#

\n
\n

django.contrib.gisLink to this heading#

\n\n
\n
\n

django.contrib.staticfilesLink to this heading#

\n\n
\n
\n

Database backend APILink to this heading#

\n

This section describes changes that may be needed in third-party database\nbackends.

\n\n
\n
\n

Dropped support for PostgreSQL 9.2 and PostGIS 2.0Link to this heading#

\n

Upstream support for PostgreSQL 9.2 ends in September 2017. As a consequence,\nDjango 1.11 sets PostgreSQL 9.3 as the minimum version it officially supports.

\n

Support for PostGIS 2.0 is also removed as PostgreSQL 9.2 is the last version\nto support it.

\n

Also, the minimum supported version of psycopg2 is increased from 2.4.5 to\n2.5.4.

\n
\n
\n

LiveServerTestCase binds to port zeroLink to this heading#

\n

Rather than taking a port range and iterating to find a free port,\nLiveServerTestCase binds to port zero and relies on the operating system\nto assign a free port. The DJANGO_LIVE_TEST_SERVER_ADDRESS environment\nvariable is no longer used, and as it’s also no longer used, the\nmanage.py test --liveserver option is removed.

\n

If you need to bind LiveServerTestCase to a specific port, use the port\nattribute added in Django 1.11.2.

\n
\n
\n

Protection against insecure redirects in django.contrib.auth and i18n viewsLink to this heading#

\n

LoginView, LogoutView (and the deprecated function-based equivalents),\nand set_language() protect users from being redirected\nto non-HTTPS next URLs when the app is running over HTTPS.

\n
\n
\n

QuerySet.get_or_create() and update_or_create() validate argumentsLink to this heading#

\n

To prevent typos from passing silently,\nget_or_create() and\nupdate_or_create() check that their\narguments are model fields. This should be backwards-incompatible only in the\nfact that it might expose a bug in your project.

\n
\n
\n

pytz is a required dependency and support for settings.TIME_ZONE = None is removedLink to this heading#

\n

To simplify Django’s timezone handling, pytz is now a required dependency.\nIt’s automatically installed along with Django.

\n

Support for settings.TIME_ZONE = None is removed as the behavior isn’t\ncommonly used and is questionably useful. If you want to automatically detect\nthe timezone based on the system timezone, you can use tzlocal:

\n
Code
from tzlocal import get_localzone\n\nTIME_ZONE = get_localzone().zone\n
\n

This works similar to settings.TIME_ZONE = None except that it also sets\nos.environ['TZ']. Let us know\nif there’s a use case where you find you can’t adapt your code to set a\nTIME_ZONE.

\n
\n
\n

HTML changes in admin templatesLink to this heading#

\n

<p class="help"> is replaced with a <div> tag to allow including lists\ninside help text.

\n

Read-only fields are wrapped in <div class="readonly">...</div> instead of\n<p>...</p> to allow any kind of HTML as the field’s content.

\n
\n
\n

Changes due to the introduction of template-based widget renderingLink to this heading#

\n

Some undocumented classes in django.forms.widgets are removed:

\n\n

The undocumented Select.render_option() method is removed.

\n

The Widget.format_output() method is removed. Use a custom widget template\ninstead.

\n

Some widget values, such as <select> options, are now localized if\nsettings.USE_L10N=True. You could revert to the old behavior with custom\nwidget templates that uses the localize template tag to turn off\nlocalization.

\n
\n
\n

django.template.backends.django.Template.render() prohibits non-dict contextLink to this heading#

\n

For compatibility with multiple template engines,\ndjango.template.backends.django.Template.render() (returned from high-level\ntemplate loader APIs such as loader.get_template()) must receive a\ndictionary of context rather than Context or RequestContext. If you\nwere passing either of the two classes, pass a dictionary instead – doing so\nis backwards-compatible with older versions of Django.

\n
\n
\n

Model state changes in migration operationsLink to this heading#

\n

To improve the speed of applying migrations, rendering of related models is\ndelayed until an operation that needs them (e.g. RunPython). If you have a\ncustom operation that works with model classes or model instances from the\nfrom_state argument in database_forwards() or database_backwards(),\nyou must render model states using the clear_delayed_apps_cache() method as\ndescribed in writing your own migration operation.

\n
\n
\n

Server-side cursors on PostgreSQLLink to this heading#

\n

The change to make QuerySet.iterator() use server-side cursors on\nPostgreSQL prevents running Django with PgBouncer in transaction pooling mode.\nTo reallow that, use the DISABLE_SERVER_SIDE_CURSORS setting (added in Django 1.11.1) in\nDATABASES.

\n

See Transaction pooling and server-side cursors for more discussion.

\n
\n
\n

MiscellaneousLink to this heading#

\n\n
\n
\n
\n

Features deprecated in 1.11Link to this heading#

\n\n
\n

MiscellaneousLink to this heading#

\n\n
\n
","rootId":"django-1-11-release-notes","toc":[{"title":"Python compatibility","anchor":"python-compatibility","children":[]},{"title":"Deprecating warnings are no longer loud by default","anchor":"deprecating-warnings-are-no-longer-loud-by-default","children":[]},{"title":"What’s new in Django 1.11","anchor":"what-s-new-in-django-1-11","children":[{"title":"Class-based model indexes","anchor":"class-based-model-indexes","children":[]},{"title":"Template-based widget rendering","anchor":"template-based-widget-rendering","children":[]},{"title":"Subquery expressions","anchor":"subquery-expressions","children":[]},{"title":"Minor features","anchor":"minor-features","children":[{"title":"django.contrib.admin","anchor":"django-contrib-admin","children":[]},{"title":"django.contrib.auth","anchor":"django-contrib-auth","children":[]},{"title":"django.contrib.contenttypes","anchor":"django-contrib-contenttypes","children":[]},{"title":"django.contrib.gis","anchor":"django-contrib-gis","children":[]},{"title":"django.contrib.postgres","anchor":"django-contrib-postgres","children":[]},{"title":"Cache","anchor":"cache","children":[]},{"title":"CSRF","anchor":"csrf","children":[]},{"title":"Database backends","anchor":"database-backends","children":[]},{"title":"Email","anchor":"email","children":[]},{"title":"File Storage","anchor":"file-storage","children":[]},{"title":"Forms","anchor":"forms","children":[]},{"title":"Internationalization","anchor":"internationalization","children":[]},{"title":"Management Commands","anchor":"management-commands","children":[]},{"title":"Migrations","anchor":"migrations","children":[]},{"title":"Models","anchor":"models","children":[]},{"title":"Requests and Responses","anchor":"requests-and-responses","children":[]},{"title":"Serialization","anchor":"serialization","children":[]},{"title":"Templates","anchor":"templates","children":[]},{"title":"Tests","anchor":"tests","children":[]},{"title":"Validators","anchor":"validators","children":[]}]}]},{"title":"Backwards incompatible changes in 1.11","anchor":"backwards-incompatible-changes-in-1-11","children":[{"title":"django.contrib.gis","anchor":"id1","children":[]},{"title":"django.contrib.staticfiles","anchor":"django-contrib-staticfiles","children":[]},{"title":"Database backend API","anchor":"database-backend-api","children":[]},{"title":"Dropped support for PostgreSQL 9.2 and PostGIS 2.0","anchor":"dropped-support-for-postgresql-9-2-and-postgis-2-0","children":[]},{"title":"LiveServerTestCase binds to port zero","anchor":"liveservertestcase-binds-to-port-zero","children":[]},{"title":"Protection against insecure redirects in django.contrib.auth and i18n views","anchor":"protection-against-insecure-redirects-in-django-contrib-auth-and-i18n-views","children":[]},{"title":"QuerySet.get_or_create() and update_or_create() validate arguments","anchor":"queryset-get-or-create-and-update-or-create-validate-arguments","children":[]},{"title":"pytz is a required dependency and support for settings.TIME_ZONE = None is removed","anchor":"pytz-is-a-required-dependency-and-support-for-settings-time-zone-none-is-removed","children":[]},{"title":"HTML changes in admin templates","anchor":"html-changes-in-admin-templates","children":[]},{"title":"Changes due to the introduction of template-based widget rendering","anchor":"changes-due-to-the-introduction-of-template-based-widget-rendering","children":[]},{"title":"django.template.backends.django.Template.render() prohibits non-dict context","anchor":"django-template-backends-django-template-render-prohibits-non-dict-context","children":[]},{"title":"Model state changes in migration operations","anchor":"model-state-changes-in-migration-operations","children":[]},{"title":"Server-side cursors on PostgreSQL","anchor":"server-side-cursors-on-postgresql","children":[]},{"title":"Miscellaneous","anchor":"miscellaneous","children":[]}]},{"title":"Features deprecated in 1.11","anchor":"features-deprecated-in-1-11","children":[{"title":"models.permalink() decorator","anchor":"models-permalink-decorator","children":[]},{"title":"Miscellaneous","anchor":"id2","children":[]}]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.11.1","title":"Django 1.11.1 release notes","url":"/en/dev/releases/1.11.1/"},"next":{"docname":"releases/1.10.8","title":"Django 1.10.8 release notes","url":"/en/dev/releases/1.10.8/"},"formats":{"html":"/en/dev/releases/1.11/","markdown":"/en/dev/releases/1.11.md","json":"/en/dev/releases/1.11.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.11.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.11/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11"],"inLocales":["en"]}