December 2, 2019
\nWelcome to Django 3.0!
\nThese release notes cover the new features, as well as\nsome backwards incompatible changes you’ll\nwant to be aware of when upgrading from Django 2.2 or earlier. We’ve\ndropped some features that have reached the end of\ntheir deprecation cycle, and we’ve begun the deprecation process for\nsome features.
\nSee the How to upgrade Django to a newer version guide if you’re updating an existing\nproject.
\nDjango 3.0 supports Python 3.6, 3.7, 3.8, and 3.9 (as of 3.0.11). We highly\nrecommend and only officially support the latest release of each series.
\nThe Django 2.2.x series is the last to support Python 3.5.
\nFollowing the release of Django 3.0, we suggest that third-party app authors\ndrop support for all versions of Django prior to 2.2. At that time, you should\nbe able to run your package’s tests using python -Wd so that deprecation\nwarnings appear. After making the deprecation warning fixes, your app should be\ncompatible with Django 3.0.
Django now officially supports MariaDB 10.1 and\nhigher. See MariaDB notes for more details.
\nDjango 3.0 begins our journey to making Django fully async-capable by providing\nsupport for running as an ASGI application.
\nThis is in addition to our existing WSGI support. Django intends to support\nboth for the foreseeable future. Async features will only be available to\napplications that run under ASGI, however.
\nAt this stage async support only applies to the outer ASGI application.\nInternally everything remains synchronous. Asynchronous middleware, views, etc.\nare not yet supported. You can, however, use ASGI middleware around Django’s\napplication, allowing you to combine Django with other ASGI frameworks.
\nThere is no need to switch your applications over unless you want to start\nexperimenting with asynchronous code, but we have\ndocumentation on deploying with ASGI if\nyou want to learn more.
\nNote that as a side-effect of this change, Django is now aware of asynchronous\nevent loops and will block you calling code marked as “async unsafe” - such as\nORM operations - from an asynchronous context. If you were using Django from\nasync code before, this may trigger if you were doing it incorrectly. If you\nsee a SynchronousOnlyOperation error, then closely examine your code and\nmove any database operations to be in a synchronous child thread.
The new ExclusionConstraint class\nenable adding exclusion constraints on PostgreSQL. Constraints are added to\nmodels using the\nMeta.constraints option.
Expressions that output BooleanField may now be\nused directly in QuerySet filters, without having to first annotate and\nthen filter against the annotation.
Custom enumeration types TextChoices, IntegerChoices, and Choices\nare now available as a way to define Field.choices. TextChoices\nand IntegerChoices types are provided for text and integer fields. The\nChoices class allows defining a compatible enumeration for other concrete\ndata types. These custom enumeration types support human-readable labels that\ncan be translated and accessed via a property on the enumeration or its\nmembers. See Enumeration types for more\ndetails and examples.
django.contrib.adminLink to this heading#Added support for the admin_order_field attribute on properties in\nModelAdmin.list_display.
The new ModelAdmin.get_inlines() method allows specifying the\ninlines based on the request or model instance.
Select2 library is upgraded from version 4.0.3 to 4.0.7.
jQuery is upgraded from version 3.3.1 to 3.4.1.
django.contrib.authLink to this heading#The new reset_url_token attribute in\nPasswordResetConfirmView allows\nspecifying a token parameter displayed as a component of password reset\nURLs.
Added BaseBackend class to ease\ncustomization of authentication backends.
Added get_user_permissions() method\nto mirror the existing\nget_group_permissions() method.
Added HTML autocomplete attribute to widgets of username, email, and\npassword fields in django.contrib.auth.forms for better interaction\nwith browser password managers.
createsuperuser now falls back to environment variables for\npassword and required fields, when a corresponding command line argument\nisn’t provided in non-interactive mode.
REQUIRED_FIELDS now supports\nManyToManyFields.
The new UserManager.with_perm() method returns users that have the\nspecified permission.
The default iteration count for the PBKDF2 password hasher is increased from\n150,000 to 180,000.
django.contrib.gisLink to this heading#Allowed MySQL spatial lookup functions to operate on real geometries.\nPrevious support was limited to bounding boxes.
Added the GeometryDistance\nfunction, supported on PostGIS.
Added support for the furlong unit in\nDistance.
The GEOIP_PATH setting now supports pathlib.Path.
The GeoIP2 class now accepts\npathlib.Path path.
django.contrib.postgresLink to this heading#The new RangeOperators helps to\navoid typos in SQL operators that can be used together with\nRangeField.
The new RangeBoundary expression\nrepresents the range boundaries.
The new AddIndexConcurrently\nand RemoveIndexConcurrently\nclasses allow creating and dropping indexes CONCURRENTLY on PostgreSQL.
django.contrib.sessionsLink to this heading#The new\nget_session_cookie_age()\nmethod allows dynamically specifying the session cookie age.
add_never_cache_headers() and\nnever_cache() now add the private\ndirective to Cache-Control headers.
The new Storage.get_alternative_name() method allows customizing the\nalgorithm for generating filenames if a file with the uploaded name already\nexists.
Formsets may control the widget used when ordering forms via\ncan_order by setting the\nordering_widget attribute or\noverriding get_ordering_widget.
Added the LANGUAGE_COOKIE_HTTPONLY,\nLANGUAGE_COOKIE_SAMESITE, and LANGUAGE_COOKIE_SECURE\nsettings to set the HttpOnly, SameSite, and Secure flags on\nlanguage cookies. The default values of these settings preserve the previous\nbehavior.
Added support and translations for the Uzbek language.
The new reporter_class parameter of\nAdminEmailHandler allows providing an\ndjango.views.debug.ExceptionReporter subclass to customize the traceback\ntext sent to site ADMINS when DEBUG is False.
The new compilemessages --ignore option allows ignoring specific\ndirectories when searching for .po files to compile.
showmigrations --list now shows the applied datetimes when\n--verbosity is 2 and above.
On PostgreSQL, dbshell now supports client-side TLS certificates.
inspectdb now introspects OneToOneField\nwhen a foreign key has a unique or primary key constraint.
The new --skip-checks option skips running system checks prior to\nrunning the command.
The startapp --template and startproject --template\noptions now support templates stored in XZ archives (.tar.xz, .txz)\nand LZMA archives (.tar.lzma, .tlz).
Added hash database functions MD5,\nSHA1,\nSHA224,\nSHA256,\nSHA384, and\nSHA512.
Added the Sign database function.
The new is_dst parameter of the\nTrunc database functions determines the\ntreatment of nonexistent and ambiguous datetimes.
connection.queries now shows COPY … TO statements on PostgreSQL.
FilePathField now accepts a callable for path.
Allowed symmetrical intermediate table for self-referential\nManyToManyField.
The name attributes of CheckConstraint,\nUniqueConstraint, and\nIndex now support app label and class\ninterpolation using the '%(app_label)s' and '%(class)s' placeholders.
The new Field.descriptor_class attribute allows model fields to\ncustomize the get and set behavior by overriding their\ndescriptors.
Added SmallAutoField which acts much like an\nAutoField except that it only allows values under\na certain (database-dependent) limit. Values from 1 to 32767 are safe\nin all databases supported by Django.
AutoField,\nBigAutoField, and\nSmallAutoField now inherit from\nIntegerField, BigIntegerField and SmallIntegerField respectively.\nSystem checks and validators are now also properly inherited.
FileField.upload_to now supports pathlib.Path.
CheckConstraint is now supported on MySQL 8.0.16+.
The new allows_group_by_selected_pks_on_model() method of\ndjango.db.backends.base.BaseDatabaseFeatures allows optimization of\nGROUP BY clauses to require only the selected models’ primary keys. By\ndefault, it’s supported only for managed models on PostgreSQL.
To enable the GROUP BY primary key-only optimization for unmanaged\nmodels, you have to subclass the PostgreSQL database engine, overriding the\nfeatures class allows_group_by_selected_pks_on_model() method as you\nrequire. See Subclassing the built-in database backends for an example.
Allowed HttpResponse to be initialized with\nmemoryview content.
For use in, for example, Django templates, HttpRequest.headers now\nallows lookups using underscores (e.g. user_agent) in place of hyphens.
X_FRAME_OPTIONS now defaults to 'DENY'. In older versions, the\nX_FRAME_OPTIONS setting defaults to 'SAMEORIGIN'. If your site\nuses frames of itself, you will need to explicitly set X_FRAME_OPTIONS =\n'SAMEORIGIN' for them to continue working.
SECURE_CONTENT_TYPE_NOSNIFF now defaults to True. With this\nenabled, SecurityMiddleware sets the\nX-Content-Type-Options: nosniff header on all responses that do not already\nhave it.
SecurityMiddleware can now send the\nReferrer-Policy header.
The new test Client argument\nraise_request_exception allows controlling whether or not exceptions\nraised during the request should also be raised in the test. The value\ndefaults to True for backwards compatibility. If it is False and an\nexception occurs, the test client will return a 500 response with the\nattribute exc_info, a tuple providing\ninformation of the exception that occurred.
Tests and test cases to run can be selected by test name pattern using the\nnew test -k option.
HTML comparison, as used by\nassertHTMLEqual(), now treats text,\ncharacter references, and entity references that refer to the same character\nas equivalent.
DiscoverRunner can now spawn a debugger at each\nerror or failure using the test --pdb option.
Model.save() when providing a default for the primary keyLink to this heading#Model.save() no longer attempts to find a row when saving a new\nModel instance and a default value for the primary key is provided, and\nalways performs a single INSERT query. In older Django versions,\nModel.save() performed either an INSERT or an UPDATE based on\nwhether or not the row exists.
This makes calling Model.save() while providing a default primary key value\nequivalent to passing force_insert=True to\nmodel’s save(). Attempts to use a new Model instance to update an\nexisting row will result in an IntegrityError.
In order to update an existing model for a specific primary key value, use the\nupdate_or_create() method or\nQuerySet.filter(pk=…).update(…) instead. For example:
>>> MyModel.objects.update_or_create(pk=existing_pk, defaults={"name": "new name"})\n>>> MyModel.objects.filter(pk=existing_pk).update(name="new name")\nThis section describes changes that may be needed in third-party database\nbackends.
\nThe second argument of DatabaseIntrospection.get_geometry_type() is now\nthe row description instead of the column name.
DatabaseIntrospection.get_field_type() may no longer return tuples.
If the database can create foreign keys in the same SQL statement that adds a\nfield, add SchemaEditor.sql_create_column_inline_fk with the appropriate\nSQL; otherwise, set DatabaseFeatures.can_create_inline_fk = False.
DatabaseFeatures.can_return_id_from_insert and\ncan_return_ids_from_bulk_insert are renamed to\ncan_return_columns_from_insert and can_return_rows_from_bulk_insert.
Database functions now handle datetime.timezone formats when created\nusing datetime.timedelta instances (e.g.\ntimezone(timedelta(hours=5)), which would output 'UTC+05:00').\nThird-party backends should handle this format when preparing\nDateTimeField in datetime_cast_date_sql(),\ndatetime_extract_sql(), etc.
Entries for AutoField, BigAutoField, and SmallAutoField are added\nto DatabaseOperations.integer_field_ranges to support the integer range\nvalidators on these field types. Third-party backends may need to customize\nthe default entries.
DatabaseOperations.fetch_returned_insert_id() is replaced by\nfetch_returned_insert_columns() which returns a list of values returned\nby the INSERT … RETURNING statement, instead of a single value.
DatabaseOperations.return_insert_id() is replaced by\nreturn_insert_columns() that accepts a fields\nargument, which is an iterable of fields to be returned after insert. Usually\nthis is only the auto-generated primary key.
django.contrib.adminLink to this heading#Admin’s model history change messages now prefers more readable field labels\ninstead of field names.
django.contrib.gisLink to this heading#Support for PostGIS 2.1 is removed.
Support for SpatiaLite 4.1 and 4.2 is removed.
Support for GDAL 1.11 and GEOS 3.4 is removed.
Upstream support for PostgreSQL 9.4 ends in December 2019. Django 3.0 supports\nPostgreSQL 9.5 and higher.
\nUpstream support for Oracle 12.1 ends in July 2021. Django 2.2 will be\nsupported until April 2022. Django 3.0 officially supports Oracle 12.2 and 18c.
\nWhile Python 2 support was removed in Django 2.0, some private APIs weren’t\nremoved from Django so that third party apps could continue using them until\nthe Python 2 end-of-life.
\nSince we expect apps to drop Python 2 compatibility when adding support for\nDjango 3.0, we’re removing these APIs at this time.
\ndjango.test.utils.str_prefix() - Strings don’t have ‘u’ prefixes in\nPython 3.
django.test.utils.patch_logger() - Use\nunittest.TestCase.assertLogs() instead.
django.utils.lru_cache.lru_cache() - Alias of\nfunctools.lru_cache().
django.utils.decorators.available_attrs() - This function returns\nfunctools.WRAPPER_ASSIGNMENTS.
django.utils.decorators.ContextDecorator - Alias of\ncontextlib.ContextDecorator.
django.utils._os.abspathu() - Alias of os.path.abspath().
django.utils._os.upath() and npath() - These functions do nothing on\nPython 3.
django.utils.six - Remove usage of this vendored library or switch to\nsix.
django.utils.encoding.python_2_unicode_compatible() - Alias of\nsix.python_2_unicode_compatible().
django.utils.functional.curry() - Use functools.partial() or\nfunctools.partialmethod. See\n5b1c389603a353625ae1603ba345147356336afb.
django.utils.safestring.SafeBytes - Unused since Django 2.0.
FILE_UPLOAD_PERMISSIONS settingLink to this heading#In older versions, the FILE_UPLOAD_PERMISSIONS setting defaults to\nNone. With the default FILE_UPLOAD_HANDLERS, this results in\nuploaded files having different permissions depending on their size and which\nupload handler is used.
FILE_UPLOAD_PERMISSIONS now defaults to 0o644 to avoid this\ninconsistency.
To make Django projects more secure by default, some security settings now have\nmore secure default values:
\nX_FRAME_OPTIONS now defaults to 'DENY'.
SECURE_CONTENT_TYPE_NOSNIFF now defaults to True.
See the What’s New Security section above for\nmore details on these changes.
\nContentType.__str__() now includes the model’s app_label to\ndisambiguate models with the same name in different apps.
Because accessing the language in the session rather than in the cookie is\ndeprecated, LocaleMiddleware no longer looks for the user’s language in\nthe session and django.contrib.auth.logout() no longer preserves the\nsession’s language after logout.
django.utils.html.escape() now uses html.escape() to escape HTML.\nThis converts ' to ' instead of the previous equivalent decimal\ncode '.
The django-admin test -k option now works as the unittest\n-k option rather than as a shortcut for --keepdb.
Support for pywatchman < 1.2.0 is removed.
urlencode() now encodes iterable values as they are\nwhen doseq=False, rather than iterating them, bringing it into line with\nthe standard library urllib.parse.urlencode() function.
intword template filter now translates 1.0 as a singular phrase and\nall other numeric values as plural. This may be incorrect for some languages.
Assigning a value to a model’s ForeignKey or\nOneToOneField '_id' attribute now unsets the\ncorresponding field. Accessing the field afterward will result in a query.
patch_vary_headers() now handles an asterisk\n'*' according to RFC 7231 Section 7.1.4, i.e. if a list of header\nfield names contains an asterisk, then the Vary header will consist of a\nsingle asterisk '*'.
On MySQL 8.0.16+, PositiveIntegerField and PositiveSmallIntegerField\nnow include a check constraint to prevent negative values in the database.
alias=None is added to the signature of\nExpression.get_group_by_cols().
RegexPattern, used by re_path(), no longer returns\nkeyword arguments with None values to be passed to the view for the\noptional named groups that are missing.
django.utils.encoding.force_text() and smart_text()Link to this heading#The smart_text() and force_text() aliases (since Django 2.0) of\nsmart_str() and force_str() are deprecated. Ignore this deprecation if\nyour code supports Python 2 as the behavior of smart_str() and\nforce_str() is different there.
django.utils.http.urlquote(), urlquote_plus(), urlunquote(), and\nurlunquote_plus() are deprecated in favor of the functions that they’re\naliases for: urllib.parse.quote(), quote_plus(),\nunquote(), and unquote_plus().
django.utils.translation.ugettext(), ugettext_lazy(),\nugettext_noop(), ungettext(), and ungettext_lazy() are deprecated\nin favor of the functions that they’re aliases for:\ndjango.utils.translation.gettext(),\ngettext_lazy(),\ngettext_noop(),\nngettext(), and\nngettext_lazy().
To limit creation of sessions and hence favor some caching strategies,\ndjango.views.i18n.set_language() will stop setting the user’s language\nin the session in Django 4.0. Since Django 2.1, the language is always stored\nin the LANGUAGE_COOKIE_NAME cookie.
django.utils.text.unescape_entities() is deprecated in favor of\nhtml.unescape(). Note that unlike unescape_entities(),\nhtml.unescape() evaluates lazy strings immediately.
To avoid possible confusion as to effective scope, the private internal\nutility is_safe_url() is renamed to\nurl_has_allowed_host_and_scheme(). That a URL has an allowed host and\nscheme doesn’t in general imply that it’s “safe”. It may still be quoted\nincorrectly, for example. Ensure to also use\niri_to_uri() on the path component of untrusted\nURLs.
These features have reached the end of their deprecation cycle and are removed\nin Django 3.0.
\nSee Features deprecated in 2.0 for details on these changes, including how\nto remove usage of these features.
\nThe django.db.backends.postgresql_psycopg2 module is removed.
django.shortcuts.render_to_response() is removed.
The DEFAULT_CONTENT_TYPE setting is removed.
HttpRequest.xreadlines() is removed.
Support for the context argument of Field.from_db_value() and\nExpression.convert_value() is removed.
The field_name keyword argument of QuerySet.earliest() and\nlatest() is removed.
See Features deprecated in 2.1 for details on these changes, including how\nto remove usage of these features.
\nThe ForceRHR GIS function is removed.
django.utils.http.cookie_date() is removed.
The staticfiles and admin_static template tag libraries are removed.
django.contrib.staticfiles.templatetags.staticfiles.static() is removed.