December 1, 2015
\nWelcome to Django 1.9!
\nThese release notes cover the new features, as well as\nsome backwards incompatible changes you’ll\nwant to be aware of when upgrading from Django 1.8 or older versions. We’ve\ndropped some features that have reached the end of\ntheir deprecation cycle, and we’ve begun the deprecation process for some\nfeatures.
\nSee the How to upgrade Django to a newer version guide if you’re updating an existing\nproject.
\nDjango 1.9 requires Python 2.7, 3.4, or 3.5. We highly recommend and only\nofficially support the latest release of each series.
\nThe Django 1.8 series is the last to support Python 3.2 and 3.3.
\nThe new on_commit() hook allows performing actions\nafter a database transaction is successfully committed. This is useful for\ntasks such as sending notification emails, creating queued tasks, or\ninvalidating caches.
This functionality from the django-transaction-hooks package has been\nintegrated into Django.
\nDjango now offers password validation to help prevent the usage of weak\npasswords by users. The validation is integrated in the included password\nchange and reset forms and is simple to integrate in any other code.\nValidation is performed by one or more validators, configured in the new\nAUTH_PASSWORD_VALIDATORS setting.
Four validators are included in Django, which can enforce a minimum length,\ncompare the password to the user’s attributes like their name, ensure\npasswords aren’t entirely numeric, or check against an included list of common\npasswords. You can combine multiple validators, and some validators have\ncustom configuration options. For example, you can choose to provide a custom\nlist of common passwords. Each validator provides a help text to explain its\nrequirements to the user.
\nBy default, no validation is performed and all passwords are accepted, so if\nyou don’t set AUTH_PASSWORD_VALIDATORS, you will not see any\nchange. In new projects created with the default startproject\ntemplate, a simple set of validators is enabled. To enable basic validation in\nthe included auth forms for your project, you could set, for example:
AUTH_PASSWORD_VALIDATORS = [\n {\n "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",\n },\n {\n "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",\n },\n {\n "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",\n },\n {\n "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",\n },\n]\nSee Password validation for more details.
\nDjango now ships with the mixins\nAccessMixin,\nLoginRequiredMixin,\nPermissionRequiredMixin, and\nUserPassesTestMixin to provide the\nfunctionality of the django.contrib.auth.decorators for class-based views.\nThese mixins have been taken from, or are at least inspired by, the\ndjango-braces project.
There are a few differences between Django’s and django-braces'\nimplementation, though:
The raise_exception attribute\ncan only be True or False. Custom exceptions or callables are not\nsupported.
The handle_no_permission()\nmethod does not take a request argument. The current request is available\nin self.request.
The custom test_func() of\nUserPassesTestMixin does not take a\nuser argument. The current user is available in self.request.user.
The\npermission_required\nattribute supports a string (defining one permission) or a list/tuple of\nstrings (defining multiple permissions) that need to be fulfilled to grant\naccess.
The new\npermission_denied_message\nattribute allows passing a message to the PermissionDenied exception.
contrib.adminLink to this heading#The admin sports a modern, flat design with new SVG icons which look perfect\non HiDPI screens. It still provides a fully-functional experience to YUI’s\nA-grade browsers. Older browser may experience varying levels of graceful\ndegradation.
\nThe test command now supports a --parallel option to run a project’s tests in multiple processes in parallel.
Each process gets its own database. You must ensure that different test cases\ndon’t access the same resources. For instance, test cases that touch the\nfilesystem should create a temporary directory for their own use.
\nThis option is enabled by default for Django’s own test suite provided:
\nthe OS supports it (all but Windows)
the database backend supports it (all the built-in backends but Oracle)
django.contrib.adminLink to this heading#Admin views now have model_admin or admin_site attributes.
The URL of the admin change view has been changed (was at\n/admin/<app>/<model>/<pk>/ by default and is now at\n/admin/<app>/<model>/<pk>/change/). This should not affect your\napplication unless you have hardcoded admin URLs. In that case, replace those\nlinks by reversing admin URLs instead. Note that\nthe old URL still redirects to the new one for backwards compatibility, but\nit may be removed in a future version.
ModelAdmin.get_list_select_related() was added to allow\nchanging the select_related() values used in the admin’s changelist query\nbased on the request.
The available_apps context variable, which lists the available\napplications for the current user, has been added to the\nAdminSite.each_context()\nmethod.
AdminSite.empty_value_display and\nModelAdmin.empty_value_display were added to override\nthe display of empty values in admin change list. You can also customize the\nvalue for each field.
Added jQuery events when an inline form is added or removed on the change form page.
The time picker widget includes a ‘6 p.m’ option for consistency of having\npredefined options every 6 hours.
JavaScript slug generation now supports Romanian characters.
django.contrib.admindocsLink to this heading#The model section of the admindocs now also describes methods that take\narguments, rather than ignoring them.
django.contrib.authLink to this heading#The default iteration count for the PBKDF2 password hasher has been increased\nby 20%. This backwards compatible change will not affect users who have\nsubclassed django.contrib.auth.hashers.PBKDF2PasswordHasher to change the\ndefault value.
The BCryptSHA256PasswordHasher will now update passwords if its\nrounds attribute is changed.
AbstractBaseUser and BaseUserManager were moved to a new\ndjango.contrib.auth.base_user module so that they can be imported without\nincluding django.contrib.auth in INSTALLED_APPS (doing so\nraised a deprecation warning in older versions and is no longer supported in\nDjango 1.9).
The permission argument of\npermission_required() accepts all\nkinds of iterables, not only list and tuples.
The new\nPersistentRemoteUserMiddleware\nmakes it possible to use REMOTE_USER for setups where the header is only\npopulated on login pages instead of every request in the session.
The django.contrib.auth.views.password_reset() view accepts an\nextra_email_context parameter.
django.contrib.contenttypesLink to this heading#It’s now possible to use\norder_with_respect_to with a\nGenericForeignKey.
django.contrib.gisLink to this heading#All GeoQuerySet methods have been deprecated and replaced by\nequivalent database functions. As soon\nas the legacy methods have been replaced in your code, you should even be\nable to remove the special GeoManager from your GIS-enabled classes.
The GDAL interface now supports instantiating file-based and in-memory\nGDALRaster objects from raw data.\nSetters for raster properties such as projection or pixel values have\nbeen added.
For PostGIS users, the new RasterField\nallows storing GDALRaster objects.\nIt supports automatic spatial index creation and reprojection when saving a\nmodel. It does not yet support spatial querying.
The new GDALRaster.warp()\nmethod allows warping a raster by specifying target raster properties such as\norigin, width, height, or pixel size (among others).
The new GDALRaster.transform() method allows transforming a\nraster into a different spatial reference system by specifying a target\nsrid.
The new GeoIP2 class allows using\nMaxMind’s GeoLite2 databases which includes support for IPv6 addresses.
The default OpenLayers library version included in widgets has been updated\nfrom 2.13 to 2.13.1.
django.contrib.postgresLink to this heading#Added support for the rangefield.contained_by lookup for some built\nin fields which correspond to the range fields.
Added django.contrib.postgres.fields.JSONField.
Added the TransactionNow database\nfunction.
django.contrib.sessionsLink to this heading#The session model and SessionStore classes for the db and\ncached_db backends are refactored to allow a custom database session\nbackend to build upon them. See\nExtending database-backed session engines for more details.
django.contrib.sitesLink to this heading#get_current_site() now handles the case\nwhere request.get_host() returns domain:port, e.g.\nexample.com:80. If the lookup fails because the host does not match a\nrecord in the database and the host has a port, the port is stripped and the\nlookup is retried with the domain part only.
django.core.cache.backends.base.BaseCache now has a get_or_set()\nmethod.
django.views.decorators.cache.never_cache() now sends more persuasive\nheaders (added no-cache, no-store, must-revalidate to Cache-Control)\nto better prevent caching. This was also added in Django 1.8.8.
The request header’s name used for CSRF authentication can be customized\nwith CSRF_HEADER_NAME.
The CSRF referer header is now validated against the\nCSRF_COOKIE_DOMAIN setting if set. See How it works for\ndetails.
The new CSRF_TRUSTED_ORIGINS setting provides a way to allow\ncross-origin unsafe requests (e.g. POST) over HTTPS.
The PostgreSQL backend (django.db.backends.postgresql_psycopg2) is also\navailable as django.db.backends.postgresql. The old name will continue to\nbe available for backwards compatibility.
Storage.get_valid_name() is now called when\nthe upload_to is a callable.
File now has the seekable() method when using\nPython 3.
ModelForm accepts the new Meta option\nfield_classes to customize the type of the fields. See\nOverriding the default fields for details.
You can now specify the order in which form fields are rendered with the\nfield_order attribute, the field_order\nconstructor argument , or the order_fields() method.
A form prefix can be specified inside a form class, not only when\ninstantiating a form. See Prefixes for forms for details.
You can now specify keyword arguments\nthat you want to pass to the constructor of forms in a formset.
SlugField now accepts an\nallow_unicode argument to allow Unicode\ncharacters in slugs.
CharField now accepts a\nstrip argument to strip input data of leading\nand trailing whitespace. As this defaults to True this is different\nbehavior from previous releases.
Form fields now support the disabled argument,\nallowing the field widget to be displayed disabled by browsers.
It’s now possible to customize bound fields by overriding a field’s\nget_bound_field() method.
Class-based views generated using as_view() now have view_class\nand view_initkwargs attributes.
method_decorator() can now be used with a list\nor tuple of decorators. It can also be used to decorate classes instead\nof methods.
The django.views.i18n.set_language() view now properly redirects to\ntranslated URLs, when available.
The django.views.i18n.javascript_catalog() view now works correctly\nif used multiple times with different configurations on the same page.
The django.utils.timezone.make_aware() function gained an is_dst\nargument to help resolve ambiguous times during DST transitions.
You can now use locale variants supported by gettext. These are usually used\nfor languages which can be written in different scripts, for example Latin\nand Cyrillic (e.g. be@latin).
Added the django.views.i18n.json_catalog() view to help build a custom\nclient-side i18n library upon Django translations. It returns a JSON object\ncontaining a translations catalog, formatting settings, and a plural rule.
Added the name_translated attribute to the object returned by the\nget_language_info template tag. Also added a corresponding template\nfilter: language_name_translated.
You can now run compilemessages from the root directory of your\nproject and it will find all the app message files that were created by\nmakemessages.
makemessages now calls xgettext once per locale directory\nrather than once per translatable file. This speeds up localization builds.
blocktrans supports assigning its output to a variable using\nasvar.
Two new languages are available: Colombian Spanish and Scottish Gaelic.
The new sendtestemail command lets you send a test email to\neasily confirm that email sending through Django is working.
To increase the readability of the SQL code generated by\nsqlmigrate, the SQL code generated for each migration operation is\npreceded by the operation’s description.
The dumpdata command output is now deterministically ordered.\nMoreover, when the --output option is specified, it also shows a progress\nbar in the terminal.
The createcachetable command now has a --dry-run flag to\nprint out the SQL rather than execute it.
The startapp command creates an apps.py file. Since it doesn’t\nuse default_app_config (a discouraged API), you must specify the app config’s path,\ne.g. 'polls.apps.PollsConfig', in INSTALLED_APPS for it to be\nused (instead of just 'polls').
When using the PostgreSQL backend, the dbshell command can connect\nto the database using the password from your settings file (instead of\nrequiring it to be manually entered).
The django package may be run as a script, i.e. python -m django,\nwhich will behave the same as django-admin.
Management commands that have the --noinput option now also take\n--no-input as an alias for that option.
Initial migrations are now marked with an initial = True class attribute which allows\nmigrate --fake-initial to more easily detect initial migrations.
Added support for serialization of functools.partial and LazyObject\ninstances.
When supplying None as a value in MIGRATION_MODULES, Django\nwill consider the app an app without migrations.
When applying migrations, the “Rendering model states” step that’s displayed\nwhen running migrate with verbosity 2 or higher now computes only the states\nfor the migrations that have already been applied. The model states for\nmigrations being applied are generated on demand, drastically reducing the\namount of required memory.
\nHowever, this improvement is not available when unapplying migrations and\ntherefore still requires the precomputation and storage of the intermediate\nmigration states.
\nThis improvement also requires that Django no longer supports mixed migration\nplans. Mixed plans consist of a list of migrations where some are being\napplied and others are being unapplied. This was never officially supported\nand never had a public API that supports this behavior.
\nThe squashmigrations command now supports specifying the starting\nmigration from which migrations will be squashed.
QuerySet.bulk_create()\nnow works on proxy models.
Database configuration gained a TIME_ZONE\noption for interacting with databases that store datetimes in local time and\ndon’t support time zones when USE_TZ is True.
Added the RelatedManager.set() method to the related\nmanagers created by ForeignKey, GenericForeignKey, and\nManyToManyField.
The add() method on\na reverse foreign key now has a bulk parameter to allow executing one\nquery regardless of the number of objects being added rather than one query\nper object.
Added the keep_parents parameter to Model.delete() to allow deleting only a child’s data in a\nmodel that uses multi-table inheritance.
Model.delete()\nand QuerySet.delete() return\nthe number of objects deleted.
Added a system check to prevent defining both Meta.ordering and\norder_with_respect_to on the same model.
Date and time lookups can be chained with other lookups\n(such as exact, gt, lt, etc.). For example:\nEntry.objects.filter(pub_date__month__gt=6).
Time lookups (hour, minute, second) are now supported by\nTimeField for all database backends. Support for\nbackends other than SQLite was added but undocumented in Django 1.7.
You can specify the output_field parameter of the\nAvg aggregate in order to aggregate over\nnon-numeric columns, such as DurationField.
Added the date lookup to DateTimeField\nto allow querying the field by only the date portion.
Added the Now database function, which\nreturns the current date and time.
Transform is now a subclass of\nFunc() which allows Transforms to be used on\nthe right hand side of an expression, just like regular Funcs. This\nallows registering some database functions like\nLength,\nLower, and\nUpper as transforms.
SlugField now accepts an\nallow_unicode argument to allow Unicode\ncharacters in slugs.
Added support for referencing annotations in QuerySet.distinct().
connection.queries shows queries with substituted parameters on SQLite.
Query expressions can now be used when\ncreating new model instances using save(), create(), and\nbulk_create().
Unless HttpResponse.reason_phrase is explicitly set, it now is\ndetermined by the current value of HttpResponse.status_code. Modifying the value of\nstatus_code outside of the constructor will also modify the value of\nreason_phrase.
The debug view now shows details of chained exceptions on Python 3.
The default 40x error views now accept a second positional parameter, the\nexception that triggered the view.
View error handlers now support\nTemplateResponse, commonly used with\nclass-based views.
Exceptions raised by the render() method are now passed to the\nprocess_exception() method of each middleware.
Request middleware can now set HttpRequest.urlconf to None to revert any changes made\nby previous middleware and return to using the ROOT_URLCONF.
The DISALLOWED_USER_AGENTS check in\nCommonMiddleware now raises a\nPermissionDenied exception as opposed to\nreturning an HttpResponseForbidden so that\nhandler403 is invoked.
Added HttpRequest.get_port() to\nfetch the originating port of the request.
Added the json_dumps_params parameter to\nJsonResponse to allow passing keyword arguments to the\njson.dumps() call used to generate the response.
The BrokenLinkEmailsMiddleware now\nignores 404s when the referer is equal to the requested URL. To circumvent\nthe empty referer check already implemented, some web bots set the referer to\nthe requested URL.
Template tags created with the simple_tag()\nhelper can now store results in a template variable by using the as\nargument.
Added a Context.setdefault()\nmethod.
The django.template logger was added and\nincludes the following messages:
\nA DEBUG level message for missing context variables.
A WARNING level message for uncaught exceptions raised\nduring the rendering of an {% include %} when debug mode is off\n(helpful since {% include %} silences the exception and returns an\nempty string).
The firstof template tag supports storing the output in a variable\nusing ‘as’.
Context.update() can now be used as\na context manager.
Django template loaders can now extend templates recursively.
The debug page template postmortem now include output from each engine that\nis installed.
Debug page integration for custom\ntemplate engines was added.
The DjangoTemplates backend gained\nthe ability to register libraries and builtins explicitly through the\ntemplate OPTIONS.
The timesince and timeuntil filters were improved to deal with leap\nyears when given large time spans.
The include tag now caches parsed templates objects during template\nrendering, speeding up reuse in places such as for loops.
Added the json() method to test client\nresponses to give access to the response body as JSON.
Added the force_login() method to the test\nclient. Use this method to simulate the effect of a user logging into the\nsite while skipping the authentication and verification steps of\nlogin().
Regular expression lookaround assertions are now allowed in URL patterns.
The application namespace can now be set using an app_name attribute\non the included module or object. It can also be set by passing a 2-tuple\nof (<list of patterns>, <application namespace>) as the first argument to\ninclude().
System checks have been added for common URL pattern mistakes.
Added django.core.validators.int_list_validator() to generate\nvalidators of strings containing integers separated with a custom character.
EmailValidator now limits the length of\ndomain name labels to 63 characters per RFC 1034.
Added validate_unicode_slug() to validate slugs\nthat may contain Unicode characters.
A couple of new tests rely on the ability of the backend to introspect column\ndefaults (returning the result as Field.default). You can set the\ncan_introspect_default database feature to False if your backend\ndoesn’t implement this. You may want to review the implementation on the\nbackends that Django includes for reference (#24245).
Registering a global adapter or converter at the level of the DB-API module\nto handle time zone information of datetime values passed\nas query parameters or returned as query results on databases that don’t\nsupport time zones is discouraged. It can conflict with other libraries.
The recommended way to add a time zone to datetime values\nfetched from the database is to register a converter for DateTimeField\nin DatabaseOperations.get_db_converters().
The needs_datetime_string_cast database feature was removed. Database\nbackends that set it must register a converter instead, as explained above.
The DatabaseOperations.value_to_db_<type>() methods were renamed to\nadapt_<type>field_value() to mirror the convert_<type>field_value()\nmethods.
To use the new date lookup, third-party database backends may need to\nimplement the DatabaseOperations.datetime_cast_date_sql() method.
The DatabaseOperations.time_extract_sql() method was added. It calls the\nexisting date_extract_sql() method. This method is overridden by the\nSQLite backend to add time lookups (hour, minute, second) to\nTimeField, and may be needed by third-party\ndatabase backends.
The DatabaseOperations.datetime_cast_sql() method (not to be confused\nwith DatabaseOperations.datetime_cast_date_sql() mentioned above)\nhas been removed. This method served to format dates on Oracle long\nbefore 1.0, but hasn’t been overridden by any core backend in years\nand hasn’t been called anywhere in Django’s code or tests.
In order to support test parallelization, you must implement the\nDatabaseCreation._clone_test_db() method and set\nDatabaseFeatures.can_clone_databases = True. You may have to adjust\nDatabaseCreation.get_test_db_clone_settings().
The default settings in django.conf.global_settings were a combination of\nlists and tuples. All settings that were formerly tuples are now lists.
is_usable attribute on template loaders is removedLink to this heading#Django template loaders previously required an is_usable attribute to be\ndefined. If a loader was configured in the template settings and this attribute\nwas False, the loader would be silently ignored. In practice, this was only\nused by the egg loader to detect if setuptools was installed. The\nis_usable attribute is now removed and the egg loader instead fails at\nruntime if setuptools is not installed.
When using the\nfilesystem.Loader or\napp_directories.Loader\ntemplate loaders, earlier versions of Django raised a\nTemplateDoesNotExist error if a template source existed\nbut was unreadable. This could happen under many circumstances, such as if\nDjango didn’t have permissions to open the file, or if the template source was\na directory. Now, Django only silences the exception if the template source\ndoes not exist. All other situations result in the original IOError being\nraised.
Relative redirects are no longer converted to absolute URIs. RFC 2616\nrequired the Location header in redirect responses to be an absolute URI,\nbut it has been superseded by RFC 7231 which allows relative URIs in\nLocation, recognizing the actual practice of user agents, almost all of\nwhich support them.
Consequently, the expected URLs passed to assertRedirects should generally\nno longer include the scheme and domain part of the URLs. For example,\nself.assertRedirects(response, 'http://testserver/some-url/') should be\nreplaced by self.assertRedirects(response, '/some-url/') (unless the\nredirection specifically contained an absolute URL).
In the rare case that you need the old behavior (discovered with an ancient\nversion of Apache with mod_scgi that interprets a relative redirect as an\n“internal redirect”), you can restore it by writing a custom middleware:
class LocationHeaderFix(object):\n def process_response(self, request, response):\n if "Location" in response:\n response["Location"] = request.build_absolute_uri(response["Location"])\n return response\nUpstream support for PostgreSQL 9.0 ended in September 2015. As a consequence,\nDjango 1.9 sets 9.1 as the minimum PostgreSQL version it officially supports.
\nUpstream support for Oracle 11.1 ended in August 2015. As a consequence, Django\n1.9 sets 11.2 as the minimum Oracle version it officially supports.
\nLoaderOrigin and StringOrigin are removedLink to this heading#In previous versions of Django, when a template engine was initialized with\ndebug as True, an instance of django.template.loader.LoaderOrigin or\ndjango.template.base.StringOrigin was set as the origin attribute on the\ntemplate object. These classes have been combined into\nOrigin and is now always set regardless of the\nengine debug setting. For a minimal level of backwards compatibility, the old\nclass names will be kept as aliases to the new Origin class until\nDjango 2.0.
To make it easier to write custom logging configurations, Django’s default\nlogging configuration no longer defines django.request and\ndjango.security loggers. Instead, it defines a single django logger,\nfiltered at the INFO level, with two handlers:
console: filtered at the INFO level and only active if DEBUG=True.
mail_admins: filtered at the ERROR level and only active if\nDEBUG=False.
If you aren’t overriding Django’s default logging, you should see minimal\nchanges in behavior, but you might see some new logging to the runserver\nconsole, for example.
If you are overriding Django’s default logging, you should check to see how\nyour configuration merges with the new defaults.
\nHttpRequest details in error reportingLink to this heading#It was redundant to display the full details of the\nHttpRequest each time it appeared as a stack frame\nvariable in the HTML version of the debug page and error email. Thus, the HTTP\nrequest will now display the same standard representation as other variables\n(repr(request)). As a result, the\nExceptionReporterFilter.get_request_repr() method and the undocumented\ndjango.http.build_request_repr() function were removed.
The contents of the text version of the email were modified to provide a\ntraceback of the same structure as in the case of AJAX requests. The traceback\ndetails are rendered by the ExceptionReporter.get_traceback_text() method.
Django no longer registers global adapters and converters for managing time\nzone information on datetime values sent to the database as\nquery parameters or read from the database in query results. This change\naffects projects that meet all the following conditions:
The USE_TZ setting is True.
The database is SQLite, MySQL, Oracle, or a third-party database that\ndoesn’t support time zones. In doubt, you can check the value of\nconnection.features.supports_timezones.
The code queries the database outside of the ORM, typically with\ncursor.execute(sql, params).
If you’re passing aware datetime parameters to such\nqueries, you should turn them into naive datetimes in UTC:
from django.utils import timezone\n\nparam = timezone.make_naive(param, timezone.utc)\nIf you fail to do so, the conversion will be performed as in earlier versions\n(with a deprecation warning) up until Django 1.11. Django 2.0 won’t perform any\nconversion, which may result in data corruption.
\nIf you’re reading datetime values from the results, they\nwill be naive instead of aware. You can compensate as follows:
from django.utils import timezone\n\nvalue = timezone.make_aware(value, timezone.utc)\nYou don’t need any of this if you’re querying the database through the ORM,\neven if you’re using raw()\nqueries. The ORM takes care of managing time zone information.
The DjangoTemplates backend now\nperforms discovery on installed template tag modules when instantiated. This\nupdate enables libraries to be provided explicitly via the 'libraries'\nkey of OPTIONS when defining a\nDjangoTemplates backend. Import\nor syntax errors in template tag modules now fail early at instantiation time\nrather than when a template with a {% load %} tag is first\ncompiled.
django.template.base.add_to_builtins() is removedLink to this heading#Although it was a private API, projects commonly used add_to_builtins() to\nmake template tags and filters available without using the\n{% load %} tag. This API has been formalized. Projects should now\ndefine built-in libraries via the 'builtins' key of OPTIONS when defining a\nDjangoTemplates backend.
simple_tag now wraps tag output in conditional_escapeLink to this heading#In general, template tags do not autoescape their contents, and this behavior\nis documented. For tags like\ninclusion_tag, this is not a problem because\nthe included template will perform autoescaping. For assignment_tag(),\nthe output will be escaped when it is used as a variable in the template.
For the intended use cases of simple_tag,\nhowever, it is very easy to end up with incorrect HTML and possibly an XSS\nexploit. For example:
@register.simple_tag(takes_context=True)\ndef greeting(context):\n return "Hello {0}!".format(context["request"].user.first_name)\nIn older versions of Django, this will be an XSS issue because\nuser.first_name is not escaped.
In Django 1.9, this is fixed: if the template context has autoescape=True\nset (the default), then simple_tag will wrap the output of the tag function\nwith conditional_escape().
To fix your simple_tags, it is best to apply the following practices:
Any code that generates HTML should use either the template system or\nformat_html().
If the output of a simple_tag needs escaping, use\nescape() or\nconditional_escape().
If you are absolutely certain that you are outputting HTML from a trusted\nsource (e.g. a CMS field that stores HTML entered by admins), you can mark it\nas such using mark_safe().
Tags that follow these rules will be correct and safe whether they are run on\nDjango 1.9+ or earlier.
\nPaginator.page_rangeLink to this heading#Paginator.page_range is\nnow an iterator instead of a list.
In versions of Django previous to 1.8, Paginator.page_range returned a\nlist in Python 2 and a range in Python 3. Django 1.8 consistently\nreturned a list, but an iterator is more efficient.
Existing code that depends on list specific features, such as indexing,\ncan be ported by converting the iterator into a list using list().
QuerySet __in lookup removedLink to this heading#In earlier versions, queries such as:
\nModel.objects.filter(related_id=RelatedModel.objects.all())\nwould implicitly convert to:
\nModel.objects.filter(related_id__in=RelatedModel.objects.all())\nresulting in SQL like "related_id IN (SELECT id FROM ...)".
This implicit __in no longer happens so the “IN” SQL is now “=”, and if the\nsubquery returns multiple results, at least some databases will throw an error.
contrib.admin browser supportLink to this heading#The admin no longer supports Internet Explorer 8 and below, as these browsers\nhave reached end-of-life.
\nCSS and images to support Internet Explorer 6 and 7 have been removed. PNG and\nGIF icons have been replaced with SVG icons, which are not supported by\nInternet Explorer 8 and earlier.
\nThe jQuery library embedded in the admin has been upgraded from version 1.11.2\nto 2.1.4. jQuery 2.x has the same API as jQuery 1.x, but does not support\nInternet Explorer 6, 7, or 8, allowing for better performance and a smaller\nfile size. If you need to support IE8 and must also use the latest version of\nDjango, you can override the admin’s copy of jQuery with your own by creating\na Django application with this structure:
\napp/static/admin/js/vendor/\n jquery.js\n jquery.min.js\nSyntaxError when installing Django setuptools 5.5.xLink to this heading#When installing Django 1.9 or 1.9.1 with setuptools 5.5.x, you’ll see:
Compiling django/conf/app_template/apps.py ...\n File "django/conf/app_template/apps.py", line 4\n class {{ camel_case_app_name }}Config(AppConfig):\n ^\nSyntaxError: invalid syntax\n\nCompiling django/conf/app_template/models.py ...\n File "django/conf/app_template/models.py", line 1\n {{ unicode_literals }}from django.db import models\n ^\nSyntaxError: invalid syntax\nIt’s safe to ignore these errors (Django will still install just fine), but you\ncan avoid them by upgrading setuptools to a more recent version. If you’re\nusing pip, you can upgrade pip using python -m pip install -U pip which\nwill also upgrade setuptools. This is resolved in later versions of Django\nas described in the Django 1.9.2 release notes.
The jQuery static files in contrib.admin have been moved into a\nvendor/jquery subdirectory.
The text displayed for null columns in the admin changelist list_display\ncells has changed from (None) (or its translated equivalent) to - (a\ndash).
django.http.responses.REASON_PHRASES and\ndjango.core.handlers.wsgi.STATUS_CODE_TEXT have been removed. Use\nPython’s Standard Library instead: http.client.responses for Python\n3 and httplib.responses for Python 2.
ValuesQuerySet and ValuesListQuerySet have been removed.
The admin/base.html template no longer sets\nwindow.__admin_media_prefix__ or window.__admin_utc_offset__. Image\nreferences in JavaScript that used that value to construct absolute URLs have\nbeen moved to CSS for easier customization. The UTC offset is stored on a\ndata attribute of the <body> tag.
CommaSeparatedIntegerField validation has been refined to forbid values\nlike ',', ',1', and '1,,2'.
Form initialization was moved from the ProcessFormView.get() method to the new\nFormMixin.get_context_data() method. This may be\nbackwards incompatible if you have overridden the get_context_data()\nmethod without calling super().
Support for PostGIS 1.5 has been dropped.
The django.contrib.sites.models.Site.domain field was changed to be\nunique.
In order to enforce test isolation, database queries are not allowed\nby default in SimpleTestCase tests anymore. You\ncan disable this behavior by setting the allow_database_queries class\nattribute to True on your test class.
ResolverMatch.app_name was changed to contain the full namespace path in\nthe case of nested namespaces. For consistency with\nResolverMatch.namespace, the empty value is now an empty string instead\nof None.
For security hardening, session keys must be at least 8 characters.
Private function django.utils.functional.total_ordering() has been\nremoved. It contained a workaround for a functools.total_ordering() bug\nin Python versions older than 2.7.3.
XML serialization (either through dumpdata or the syndication\nframework) used to output any characters it received. Now if the content to\nbe serialized contains any control characters not allowed in the XML 1.0\nstandard, the serialization will fail with a ValueError.
CharField now strips input of leading and trailing\nwhitespace by default. This can be disabled by setting the new\nstrip argument to False.
Template text that is translated and uses two or more consecutive percent\nsigns, e.g. "%%", may have a new msgid after makemessages is run\n(most likely the translation will be marked fuzzy). The new msgid will be\nmarked "#, python-format".
If neither request.current_app\nnor Context.current_app are set, the\nurl template tag will now use the namespace of the current request.\nSet request.current_app to None if you don’t want to use a namespace\nhint.
The SILENCED_SYSTEM_CHECKS setting now silences messages of all\nlevels. Previously, messages of ERROR level or higher were printed to the\nconsole.
The FlatPage.enable_comments field is removed from the FlatPageAdmin\nas it’s unused by the application. If your project or a third-party app makes\nuse of it, create a custom ModelAdmin to add it\nback.
The return value of\nsetup_databases() and the first\nargument of teardown_databases()\nchanged. They used to be (old_names, mirrors) tuples. Now they’re just\nthe first item, old_names.
By default LiveServerTestCase attempts to find an\navailable port in the 8081-8179 range instead of just trying port 8081.
The system checks for ModelAdmin now check\ninstances rather than classes.
The private API to apply mixed migration plans has been dropped for\nperformance reasons. Mixed plans consist of a list of migrations where some\nare being applied and others are being unapplied.
The related model object descriptor classes in\ndjango.db.models.fields.related (private API) are moved from the\nrelated module to related_descriptors and renamed as follows:
ReverseSingleRelatedObjectDescriptor is ForwardManyToOneDescriptor
SingleRelatedObjectDescriptor is ReverseOneToOneDescriptor
ForeignRelatedObjectsDescriptor is ReverseManyToOneDescriptor
ManyRelatedObjectsDescriptor is ManyToManyDescriptor
If you implement a custom handler404 view, it must\nreturn a response with an HTTP 404 status code. Use\nHttpResponseNotFound or pass status=404 to the\nHttpResponse. Otherwise, APPEND_SLASH won’t\nwork correctly with DEBUG=False.
assignment_tag()Link to this heading#Django 1.4 added the assignment_tag helper to ease the creation of\ntemplate tags that store results in a template variable. The\nsimple_tag() helper has gained this same\nability, making the assignment_tag obsolete. Tags that use\nassignment_tag should be updated to use simple_tag.
{% cycle %} syntax with comma-separated argumentsLink to this heading#The cycle tag supports an inferior old syntax from previous Django\nversions:
{% cycle row1,row2,row3 %}\nIts parsing caused bugs with the current syntax, so support for the old syntax\nwill be removed in Django 1.10 following an accelerated deprecation.
\nForeignKey and OneToOneField on_delete argumentLink to this heading#In order to increase awareness about cascading model deletion, the\non_delete argument of ForeignKey and OneToOneField will be required\nin Django 2.0.
Update models and existing migrations to explicitly set the argument. Since the\ndefault is models.CASCADE, add on_delete=models.CASCADE to all\nForeignKey and OneToOneFields that don’t use a different option. You\ncan also pass it as the second positional argument if you don’t care about\ncompatibility with older versions of Django.
Field.rel changesLink to this heading#Field.rel and its methods and attributes have changed to match the related\nfields API. The Field.rel attribute is renamed to remote_field and many\nof its methods and attributes are either changed or renamed.
The aim of these changes is to provide a documented API for relation fields.
\nGeoManager and GeoQuerySet custom methodsLink to this heading#All custom GeoQuerySet methods (area(), distance(), gml(), …)\nhave been replaced by equivalent geographic expressions in annotations (see in\nnew features). Hence the need to set a custom GeoManager to GIS-enabled\nmodels is now obsolete. As soon as your code doesn’t call any of the deprecated\nmethods, you can simply remove the objects = GeoManager() lines from your\nmodels.
Django template loaders have been updated to allow recursive template\nextending. This change necessitated a new template loader API. The old\nload_template() and load_template_sources() methods are now deprecated.\nDetails about the new API can be found in the template loader\ndocumentation.
app_name to include()Link to this heading#The instance namespace part of passing a tuple as an argument to include()\nhas been replaced by passing the namespace argument to include(). For\nexample:
polls_patterns = [\n url(...),\n]\n\nurlpatterns = [\n url(r"^polls/", include((polls_patterns, "polls", "author-polls"))),\n]\nbecomes:
\npolls_patterns = (\n [\n url(...),\n ],\n "polls",\n) # 'polls' is the app_name\n\nurlpatterns = [\n url(r"^polls/", include(polls_patterns, namespace="author-polls")),\n]\nThe app_name argument to include() has been replaced by passing a\n2-tuple (as above), or passing an object or module with an app_name\nattribute (as below). If the app_name is set in this new way, the\nnamespace argument is no longer required. It will default to the value of\napp_name. For example, the URL patterns in the tutorial are changed from:
mysite/urls.pyurlpatterns = [url(r"^polls/", include("polls.urls", namespace="polls")), ...]\nto:
\nmysite/urls.pyurlpatterns = [\n url(r"^polls/", include("polls.urls")), # 'namespace="polls"' removed\n ...,\n]\npolls/urls.pyapp_name = "polls" # added\nurlpatterns = [...]\nThis change also means that the old way of including an AdminSite instance\nis deprecated. Instead, pass admin.site.urls directly to\ndjango.conf.urls.url():
urls.pyfrom django.conf.urls import url\nfrom django.contrib import admin\n\nurlpatterns = [\n url(r"^admin/", admin.site.urls),\n]\nIn the past, an instance namespace without an application namespace\nwould serve the same purpose as the application namespace, but it was\nimpossible to reverse the patterns if there was an application namespace\nwith the same name. Includes that specify an instance namespace require that\nthe included URLconf sets an application namespace.
\ncurrent_app parameter to contrib.auth viewsLink to this heading#All views in django.contrib.auth.views have the following structure:
def view(request, ..., current_app=None, ...):\n\n ...\n\n if current_app is not None:\n request.current_app = current_app\n\n return TemplateResponse(request, template_name, context)\nAs of Django 1.8, current_app is set on the request object. For\nconsistency, these views will require the caller to set current_app on the\nrequest instead of passing it in a separate argument.
django.contrib.gis.geoipLink to this heading#The django.contrib.gis.geoip2 module supersedes\ndjango.contrib.gis.geoip. The new module provides a similar API except that\nit doesn’t provide the legacy GeoIP-Python API compatibility methods.
The weak argument to django.dispatch.signals.Signal.disconnect() has\nbeen deprecated as it has no effect.
The check_aggregate_support() method of\ndjango.db.backends.base.BaseDatabaseOperations has been deprecated and\nwill be removed in Django 2.0. The more general\ncheck_expression_support() should be used instead.
django.forms.extras is deprecated. You can find\nSelectDateWidget in django.forms.widgets\n(or simply django.forms) instead.
Private API django.db.models.fields.add_lazy_relation() is deprecated.
The django.contrib.auth.tests.utils.skipIfCustomUser() decorator is\ndeprecated. With the test discovery changes in Django 1.6, the tests for\ndjango.contrib apps are no longer run as part of the user’s project.\nTherefore, the @skipIfCustomUser decorator is no longer needed to\ndecorate tests in django.contrib.auth.
If you customized some error handlers, the view\nsignatures with only one request parameter are deprecated. The views should\nnow also accept a second exception positional parameter.
The django.utils.feedgenerator.Atom1Feed.mime_type and\ndjango.utils.feedgenerator.RssFeed.mime_type attributes are deprecated in\nfavor of content_type.
Signer now issues a warning if an invalid\nseparator is used. This will become an exception in Django 1.10.
django.db.models.Field._get_val_from_obj() is deprecated in favor of\nField.value_from_object().
django.template.loaders.eggs.Loader is deprecated as distributing\napplications as eggs is not recommended.
The callable_obj keyword argument to\nSimpleTestCase.assertRaisesMessage() is deprecated. Pass the callable as\na positional argument instead.
The allow_tags attribute on methods of ModelAdmin has been\ndeprecated. Use format_html(),\nformat_html_join(), or\nmark_safe() when constructing the method’s\nreturn value instead.
The enclosure keyword argument to SyndicationFeed.add_item() is\ndeprecated. Use the new enclosures argument which accepts a list of\nEnclosure objects instead of a single one.
The django.template.loader.LoaderOrigin and\ndjango.template.base.StringOrigin aliases for\ndjango.template.base.Origin are deprecated.
These features have reached the end of their deprecation cycle and are removed\nin Django 1.9. See Features deprecated in 1.7 for details, including how to\nremove usage of these features.
\ndjango.utils.dictconfig is removed.
django.utils.importlib is removed.
django.utils.tzinfo is removed.
django.utils.unittest is removed.
The syncdb command is removed.
django.db.models.signals.pre_syncdb and\ndjango.db.models.signals.post_syncdb is removed.
Support for allow_syncdb on database routers is removed.
Automatic syncing of apps without migrations is removed. Migrations are\ncompulsory for all apps unless you pass the migrate --run-syncdb\noption.
The SQL management commands for apps without migrations, sql, sqlall,\nsqlclear, sqldropindexes, and sqlindexes, are removed.
Support for automatic loading of initial_data fixtures and initial SQL\ndata is removed.
All models need to be defined inside an installed application or declare an\nexplicit app_label. Furthermore, it isn’t\npossible to import them before their application is loaded. In particular, it\nisn’t possible to import models inside the root package of an application.
The model and form IPAddressField is removed. A stub field remains for\ncompatibility with historical migrations.
AppCommand.handle_app() is no longer supported.
RequestSite and get_current_site() are no longer importable from\ndjango.contrib.sites.models.
FastCGI support via the runfcgi management command is removed.
django.utils.datastructures.SortedDict is removed.
ModelAdmin.declared_fieldsets is removed.
The util modules that provided backwards compatibility are removed:
django.contrib.admin.util
django.contrib.gis.db.backends.util
django.db.backends.util
django.forms.util
ModelAdmin.get_formsets is removed.
The backward compatible shims introduced to rename the\nBaseMemcachedCache._get_memcache_timeout() method to\nget_backend_timeout() is removed.
The --natural and -n options for dumpdata are removed.
The use_natural_keys argument for serializers.serialize() is removed.
Private API django.forms.forms.get_declared_fields() is removed.
The ability to use a SplitDateTimeWidget with DateTimeField is\nremoved.
The WSGIRequest.REQUEST property is removed.
The class django.utils.datastructures.MergeDict is removed.
The zh-cn and zh-tw language codes are removed.
The internal django.utils.functional.memoize() is removed.
django.core.cache.get_cache is removed.
django.db.models.loading is removed.
Passing callable arguments to querysets is no longer possible.
BaseCommand.requires_model_validation is removed in favor of\nrequires_system_checks. Admin validators is replaced by admin checks.
The ModelAdmin.validator_class and default_validator_class attributes\nare removed.
ModelAdmin.validate() is removed.
django.db.backends.DatabaseValidation.validate_field is removed in\nfavor of the check_field method.
The validate management command is removed.
django.utils.module_loading.import_by_path is removed in favor of\ndjango.utils.module_loading.import_string.
ssi and url template tags are removed from the future template\ntag library.
django.utils.text.javascript_quote() is removed.
Database test settings as independent entries in the database settings,\nprefixed by TEST_, are no longer supported.
The cache_choices option to ModelChoiceField and\nModelMultipleChoiceField is removed.
The default value of the\nRedirectView.permanent\nattribute has changed from True to False.
django.contrib.sitemaps.FlatPageSitemap is removed in favor of\ndjango.contrib.flatpages.sitemaps.FlatPageSitemap.
Private API django.test.utils.TestTemplateLoader is removed.
The django.contrib.contenttypes.generic module is removed.