Django 6.2 release notes - UNDER DEVELOPMENTLink to this heading#

Adopting calendar versioningLink to this heading#

Following DEP 20, the releases previously planned as Django 7.0 and 7.1 are now Django 2028 and 2029. Accordingly, the deprecation warning classes are renamed to match the calendar version in which the features they mark are removed: RemovedInDjango70Warning becomes RemovedInDjango2028Warning, and RemovedInDjango71Warning becomes RemovedInDjango2029Warning.

Minor featuresLink to this heading#

Database backend APILink to this heading#

This section describes changes that may be needed in third-party database backends.

• …

django.contrib.adminLink to this heading#

• The admin view_on_site URL now consistently returns an HTTP 403 response when a staff user lacks view or change permission for the target model.

• The admin history view now checks permissions before object existence, consistently returning an HTTP 403 response for staff users without the view or change permission regardless of whether the object exists.

• The undocumented django.contrib.admin.tests module was removed.

django.contrib.gisLink to this heading#

• The seconds value returned by as_datetime() is now a c_float rather than a c_int.

• Support for PostGIS 3.2 is removed.

• Support for GDAL 3.3 and 3.4 is removed.

• Support for GEOS 3.10 is removed.

ModelsLink to this heading#

• Unsaved instances with a composite primary key or a db_default primary key no longer compare equal to other instances.

• django.db.models.GenericIPAddressField now validates IPv6 input strictly when saving and querying. Invalid IPv6 addresses now raise ValidationError instead of being silently accepted, and surrounding whitespace is stripped.

Requests and responsesLink to this heading#

• Most Django-provided middleware now set async_capable = False to avoid repetitive context switching in MiddlewareMixin.__acall__() under ASGI. For atypical use cases, e.g. high in-process concurrency over non-ORM I/O, where no thread is otherwise held, the repetitive context switching may be preferable to pinning a thread per request (see Performance). Such deployments can restore the prior behavior by setting async_capable = True; see MiddlewareMixin. RemoteUserMiddleware is unaffected, because it does not use MiddlewareMixin. Neither is LoginRequiredMiddleware nor django.contrib.admindocs.middleware.XViewMiddleware affected, as they did not implement process_request() or process_response().

TestsLink to this heading#

• The undocumented django.test.selenium module was removed.

Dropped support for PostgreSQL 15Link to this heading#

Upstream support for PostgreSQL 15 ends in November 2027. Django 6.2 supports PostgreSQL 16 and higher.

MiscellaneousLink to this heading#

• To facilitate the deprecation of the safe parameter of JsonResponse, it now defaults to False, because the pollution vulnerability in the Array prototype was fixed in ES5.

• DjangoJSONEncoder now omits the millisecond component of serialized datetime.datetime and datetime.time objects if they have zero milliseconds. For example, datetime.datetime(2000, 1, 1, 0, 0, 0, 1) now serializes to "2000-01-01T00:00:00" rather than "2000-01-01T00:00:00.000".

• utils.module_loading.import_string() now deterministically favors submodules in ambiguous cases where depending on prior import state, a same-named attribute of the parent module might have been returned instead.

• The minimum supported version of asgiref is increased from 3.9.1 to 3.12.1.

• The minimum supported version of oracledb is increased from 2.3.0 to 4.0.2.

• In the asynchronous request path, error responses (such as those rendered by handler404 and handler500) are now rendered on the request’s thread-sensitive thread, rather than on a shared thread pool, so that database connections used during error handling are managed by close_old_connections().

ValidatorsLink to this heading#

• The undocumented EmailValidator.validate_domain_part() method is deprecated in favor of the new validate_domain() method.

MiscellaneousLink to this heading#

• Indexing django.VERSION from its third component on, reading it in a way which depends on its length, such as unpacking it or calling len() on it, and comparing it against three or more components are all deprecated. Under the calendar versioning adopted in DEP 20, versions are YYYY[.N] and have no minor component, so from Django 2028 django.VERSION has four components, (year, patch, status, iteration). Use the .feature, .patch, .status, and .iteration attributes, which give the same answers under both versioning schemes:

  Code

  django.VERSION.feature  # (6, 2) for 6.2.1, and (2028,) for 2028.1
  django.VERSION.patch  # 1 for both 6.2.1 and 2028.1
  

  Comparisons against one or two components, such as django.VERSION >= (6, 2), are unaffected.

• The MiddlewareMixin class moved from django.utils.deprecation to django.middleware. The old import path is deprecated.

• The safe parameter is deprecated from JsonResponse. Omitting the argument is equivalent to the prior safe=False usage.

• Calling QuerySet.aiterator() after prefetch_related() without providing a chunk_size is deprecated. It currently falls back to a chunk_size of 2000, but a ValueError will be raised in Django 2029.

• Omitting the tzinfo argument of Extract and Trunc database functions when used in migrations (for example as a db_default) and USE_TZ is True is deprecated. The timezone information is not captured during migration serialization, which can lead to inconsistent behavior if TIME_ZONE changes. Pass the tzinfo argument explicitly to suppress this warning. In Django 2029, the current timezone will be captured automatically when tzinfo is omitted.