{"title":"Django 2.1 release notes","version":"dev","locale":"en","docname":"releases/2.1","url":"/en/dev/releases/2.1/","canonical":"https://djangodocs.dev/en/dev/releases/2.1/","summary":"Welcome to Django 2.1! These release notes cover the new features, as well as some backwards incompatible changes you’ll want to be aware of when upgrading…","html":"

Django 2.1 release notesLink to this heading#

\n

August 1, 2018

\n

Welcome to Django 2.1!

\n

These release notes cover the new features, as well as\nsome backwards incompatible changes you’ll\nwant to be aware of when upgrading from Django 2.0 or earlier. We’ve\ndropped some features that have reached the end of\ntheir deprecation cycle, and we’ve begun the deprecation process for some\nfeatures.

\n

See the How to upgrade Django to a newer version guide if you’re updating an existing\nproject.

\n
\n

Python compatibilityLink to this heading#

\n

Django 2.1 supports Python 3.5, 3.6, and 3.7. Django 2.0 is the last version to\nsupport Python 3.4. We highly recommend and only officially support the\nlatest release of each series.

\n
\n
\n

What’s new in Django 2.1Link to this heading#

\n
\n

Model “view” permissionLink to this heading#

\n

A “view” permission is added to the model Meta.default_permissions. The new permissions will be\ncreated automatically when running migrate.

\n

This allows giving users read-only access to models in the admin.\nModelAdmin.has_view_permission() is new. The implementation is backwards\ncompatible in that there isn’t a need to assign the “view” permission to allow\nusers who have the “change” permission to edit objects.

\n

There are a couple of backwards incompatible considerations.

\n
\n
\n

Minor featuresLink to this heading#

\n
\n

django.contrib.adminLink to this heading#

\n\n
\n
\n

django.contrib.authLink to this heading#

\n\n
\n
\n

django.contrib.gisLink to this heading#

\n\n
\n
\n

django.contrib.sessionsLink to this heading#

\n\n
\n
\n

CacheLink to this heading#

\n\n
\n
\n

CSRFLink to this heading#

\n\n
\n
\n

FormsLink to this heading#

\n
    \n

  • The widget for ImageField now renders with the HTML attribute\naccept="image/*".

    • \n
\n
\n
\n

InternationalizationLink to this heading#

\n
    \n

  • Added the get_supported_language_variant()\nfunction.

    • \n

  • Untranslated strings for territorial language variants now use the\ntranslations of the generic language. For example, untranslated pt_BR\nstrings use pt translations.

    • \n
\n
\n
\n

Management CommandsLink to this heading#

\n
    \n

  • The new inspectdb --include-views option allows creating models\nfor database views.

    • \n

  • The BaseCommand class now uses a custom help\nformatter so that the standard options like --verbosity or --settings\nappear last in the help output, giving a more prominent position to\nsubclassed command’s options.

    • \n
\n
\n
\n

MigrationsLink to this heading#

\n
    \n

  • Added support for serialization of functools.partialmethod objects.

    • \n

  • To support frozen environments, migrations may be loaded from .pyc files.

    • \n
\n
\n
\n

ModelsLink to this heading#

\n\n
\n
\n

Requests and ResponsesLink to this heading#

\n
    \n

  • Added HttpRequest.get_full_path_info().

    • \n

  • Added the samesite argument to HttpResponse.set_cookie() to allow\nsetting the SameSite cookie flag.

    • \n

  • The new as_attachment argument for FileResponse\nsets the Content-Disposition header to make the browser ask if the user\nwants to download the file. FileResponse also tries to set the\nContent-Type and Content-Length headers where appropriate.

    • \n
\n
\n
\n

TemplatesLink to this heading#

\n
    \n

  • The new json_script filter safely outputs a Python object as JSON,\nwrapped in a <script> tag, ready for use with JavaScript.

    • \n
\n
\n
\n

TestsLink to this heading#

\n
    \n

  • Added test Client support for 307 and 308 redirects.

    • \n

  • The test Client now serializes a request data\ndictionary as JSON if content_type='application/json'. You can customize\nthe JSON encoder with test client’s json_encoder parameter.

    • \n

  • The new SimpleTestCase.assertWarnsMessage() method is a simpler\nversion of assertWarnsRegex().

    • \n
\n
\n
\n
\n
\n

Backwards incompatible changes in 2.1Link to this heading#

\n
\n

Database backend APILink to this heading#

\n

This section describes changes that may be needed in third-party database\nbackends.

\n\n
\n
\n

django.contrib.gisLink to this heading#

\n\n
\n
\n

Dropped support for MySQL 5.5Link to this heading#

\n

The end of upstream support for MySQL 5.5 is December 2018. Django 2.1 supports\nMySQL 5.6 and higher.

\n
\n
\n

Dropped support for PostgreSQL 9.3Link to this heading#

\n

The end of upstream support for PostgreSQL 9.3 is September 2018. Django 2.1\nsupports PostgreSQL 9.4 and higher.

\n
\n
\n

Removed BCryptPasswordHasher from the default PASSWORD_HASHERS settingLink to this heading#

\n

If you used bcrypt with Django 1.4 or 1.5 (before\nBCryptSHA256PasswordHasher was added in Django 1.6), you might have some\npasswords that use the BCryptPasswordHasher hasher.

\n

You can check if that’s the case like this:

\n
Code
from django.contrib.auth import get_user_model\n\nUser = get_user_model()\nUser.objects.filter(password__startswith="bcrypt$$")\n
\n

If you want to continue to allow those passwords to be used, you’ll\nhave to define the PASSWORD_HASHERS setting (if you don’t already)\nand include 'django.contrib.auth.hashers.BCryptPasswordHasher'.

\n
\n
\n

Moved wrap_label widget template context variableLink to this heading#

\n

To fix the lack of <label> when using RadioSelect and\nCheckboxSelectMultiple with MultiWidget, the wrap_label context\nvariable now appears as an attribute of each option. For example, in a custom\ninput_option.html template, change {% if wrap_label %} to\n{% if widget.wrap_label %}.

\n
\n
\n

SameSite cookiesLink to this heading#

\n

The cookies used for django.contrib.sessions, django.contrib.messages,\nand Django’s CSRF protection now set the SameSite flag to Lax by\ndefault. Browsers that respect this flag won’t send these cookies on\ncross-origin requests. If you rely on the old behavior, set the\nSESSION_COOKIE_SAMESITE and/or CSRF_COOKIE_SAMESITE\nsetting to None.

\n
\n
\n

Considerations for the new model “view” permissionLink to this heading#

\n
\n

Custom admin forms need to take the view-only case into accountLink to this heading#

\n

With the new “view” permission, existing custom admin forms may raise errors\nwhen a user doesn’t have the change permission because the form might access\nnonexistent fields. Fix this by overriding ModelAdmin.get_form() and\nchecking if the user has the “change” permissions and returning the default\nform if not:

\n
Code
class MyAdmin(admin.ModelAdmin):\n    def get_form(self, request, obj=None, **kwargs):\n        if not self.has_change_permission(request, obj):\n            return super().get_form(request, obj, **kwargs)\n        return CustomForm\n
\n
\n
\n

New default view permission could allow unwanted access to admin viewsLink to this heading#

\n

If you have a custom permission with a codename of the form\nview_<modelname>, the new view permission handling in the admin will allow\nview access to the changelist and detail pages for those models. If this is\nunwanted, you must change your custom permission codename.

\n
\n
\n
\n

MiscellaneousLink to this heading#

\n\n
\n
\n
\n

Features deprecated in 2.1Link to this heading#

\n
\n

MiscellaneousLink to this heading#

\n\n
\n
\n
\n

Features removed in 2.1Link to this heading#

\n

These features have reached the end of their deprecation cycle and are removed\nin Django 2.1. See Features deprecated in 1.11 for details, including how\nto remove usage of these features.

\n\n
","rootId":"django-2-1-release-notes","toc":[{"title":"Python compatibility","anchor":"python-compatibility","children":[]},{"title":"What’s new in Django 2.1","anchor":"what-s-new-in-django-2-1","children":[{"title":"Model “view” permission","anchor":"model-view-permission","children":[]},{"title":"Minor features","anchor":"minor-features","children":[{"title":"django.contrib.admin","anchor":"django-contrib-admin","children":[]},{"title":"django.contrib.auth","anchor":"django-contrib-auth","children":[]},{"title":"django.contrib.gis","anchor":"django-contrib-gis","children":[]},{"title":"django.contrib.sessions","anchor":"django-contrib-sessions","children":[]},{"title":"Cache","anchor":"cache","children":[]},{"title":"CSRF","anchor":"csrf","children":[]},{"title":"Forms","anchor":"forms","children":[]},{"title":"Internationalization","anchor":"internationalization","children":[]},{"title":"Management Commands","anchor":"management-commands","children":[]},{"title":"Migrations","anchor":"migrations","children":[]},{"title":"Models","anchor":"models","children":[]},{"title":"Requests and Responses","anchor":"requests-and-responses","children":[]},{"title":"Templates","anchor":"templates","children":[]},{"title":"Tests","anchor":"tests","children":[]}]}]},{"title":"Backwards incompatible changes in 2.1","anchor":"backwards-incompatible-changes-in-2-1","children":[{"title":"Database backend API","anchor":"database-backend-api","children":[]},{"title":"django.contrib.gis","anchor":"id1","children":[]},{"title":"Dropped support for MySQL 5.5","anchor":"dropped-support-for-mysql-5-5","children":[]},{"title":"Dropped support for PostgreSQL 9.3","anchor":"dropped-support-for-postgresql-9-3","children":[]},{"title":"Removed BCryptPasswordHasher from the default PASSWORD_HASHERS setting","anchor":"removed-bcryptpasswordhasher-from-the-default-password-hashers-setting","children":[]},{"title":"Moved wrap_label widget template context variable","anchor":"moved-wrap-label-widget-template-context-variable","children":[]},{"title":"SameSite cookies","anchor":"samesite-cookies","children":[]},{"title":"Considerations for the new model “view” permission","anchor":"considerations-for-the-new-model-view-permission","children":[{"title":"Custom admin forms need to take the view-only case into account","anchor":"custom-admin-forms-need-to-take-the-view-only-case-into-account","children":[]},{"title":"New default view permission could allow unwanted access to admin views","anchor":"new-default-view-permission-could-allow-unwanted-access-to-admin-views","children":[]}]},{"title":"Miscellaneous","anchor":"miscellaneous","children":[]}]},{"title":"Features deprecated in 2.1","anchor":"features-deprecated-in-2-1","children":[{"title":"Miscellaneous","anchor":"id2","children":[]}]},{"title":"Features removed in 2.1","anchor":"features-removed-in-2-1","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/2.1.1","title":"Django 2.1.1 release notes","url":"/en/dev/releases/2.1.1/"},"next":{"docname":"releases/2.0.13","title":"Django 2.0.13 release notes","url":"/en/dev/releases/2.0.13/"},"formats":{"html":"/en/dev/releases/2.1/","markdown":"/en/dev/releases/2.1.md","json":"/en/dev/releases/2.1.json"},"source":"https://github.com/django/django/blob/main/docs/releases/2.1.txt","official":"https://docs.djangoproject.com/en/dev/releases/2.1/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1"],"inLocales":["en"]}