Django 6.2 release notes - UNDER DEVELOPMENTLink to this heading#

Minor featuresLink to this heading#

Database backend APILink to this heading#

This section describes changes that may be needed in third-party database backends.

• …

django.contrib.adminLink to this heading#

• The admin view_on_site URL now consistently returns an HTTP 403 response when a staff user lacks view or change permission for the target model.

• The admin history view now checks permissions before object existence, consistently returning an HTTP 403 response for staff users without the view or change permission regardless of whether the object exists.

django.contrib.gisLink to this heading#

• The seconds value returned by as_datetime() is now a c_float rather than a c_int.

MiscellaneousLink to this heading#

• To facilitate the deprecation of the safe parameter of JsonResponse, it now defaults to False, because the pollution vulnerability in the Array prototype was fixed in ES5.

• DjangoJSONEncoder now omits the millisecond component of serialized datetime.datetime and datetime.time objects if they have zero milliseconds. For example, datetime.datetime(2000, 1, 1, 0, 0, 0, 1) now serializes to "2000-01-01T00:00:00" rather than "2000-01-01T00:00:00.000".

• utils.module_loading.import_string() now deterministically favors submodules in ambiguous cases where depending on prior import state, a same-named attribute of the parent module might have been returned instead.

• The minimum supported version of asgiref is increased from 3.9.1 to 3.12.1.

• In the asynchronous request path, error responses (such as those rendered by handler404 and handler500) are now rendered on the request’s thread-sensitive thread, rather than on a shared thread pool, so that database connections used during error handling are managed by close_old_connections().

MiscellaneousLink to this heading#

• The MiddlewareMixin class moved from django.utils.deprecation to django.middleware. The old import path is deprecated.

• The safe parameter is deprecated from JsonResponse. Omitting the argument is equivalent to the prior safe=False usage.

• Calling QuerySet.aiterator() after prefetch_related() without providing a chunk_size is deprecated. It currently falls back to a chunk_size of 2000, but a ValueError will be raised in Django 7.1.