Django 4.2 release notes - UNDER DEVELOPMENT¶

Psycopg 3 support¶

Django now supports psycopg version 3.1 or higher. To update your code, install the psycopg library, you don’t need to change the ENGINE as django.db.backends.postgresql supports both libraries.

Support for psycopg2 is likely to be deprecated and removed at some point in the future.

Mitigation for the BREACH attack¶

GZipMiddleware now includes a mitigation for the BREACH attack. It will add up to 100 random bytes to gzip responses to make BREACH attacks harder. Read more about the mitigation technique in the Heal The Breach (HTB) paper.

Minor features¶

Database backend API¶

This section describes changes that may be needed in third-party database backends.

• DatabaseFeatures.allows_group_by_pk is removed as it only remained to accommodate a MySQL extension that has been supplanted by proper functional dependency detection in MySQL 5.7.15. Note that DatabaseFeatures.allows_group_by_selected_pks is still supported and should be enabled if your backend supports functional dependency detection in GROUP BY clauses as specified by the SQL:1999 standard.

Dropped support for MariaDB 10.3¶

Upstream support for MariaDB 10.3 ends in May 2023. Django 4.2 supports MariaDB 10.4 and higher.

Dropped support for MySQL 5.7¶

Upstream support for MySQL 5.7 ends in October 2023. Django 4.2 supports MySQL 8 and higher.

Dropped support for PostgreSQL 11¶

Upstream support for PostgreSQL 11 ends in November 2023. Django 4.2 supports PostgreSQL 12 and higher.

Setting update_fields in Model.save() may now be required¶

In order to avoid updating unnecessary columns, QuerySet.update_or_create() now passes update_fields to the Model.save() calls. As a consequence, any fields modified in the custom save() methods should be added to the update_fields keyword argument before calling super(). See Overriding predefined model methods for more details.

Miscellaneous¶

• The undocumented SimpleTemplateResponse.rendering_attrs and TemplateResponse.rendering_attrs are renamed to non_picklable_attrs.
• The undocumented django.http.multipartparser.parse_header() function is removed. Use django.utils.http.parse_header_parameters() instead.
• {% blocktranslate asvar … %} result is now marked as safe for (HTML) output purposes.
• The autofocus HTML attribute in the admin search box is removed as it can be confusing for screen readers.
• The makemigrations --check option no longer creates missing migration files.
• The alias argument for Expression.get_group_by_cols() is removed.
• The minimum supported version of sqlparse is increased from 0.2.2 to 0.2.3.
• The undocumented negated parameter of the Exists expression is removed.
• The is_summary argument of the undocumented Query.add_annotation() method is removed.
• The minimum supported version of SQLite is increased from 3.9.0 to 3.21.0.
• inspectdb now uses display_size from DatabaseIntrospection.get_table_description() rather than internal_size for CharField.
• The minimum supported version of asgiref is increased from 3.5.2 to 3.6.0.

index_together option is deprecated in favor of indexes¶

The Meta.index_together option is deprecated in favor of the indexes option.

Migrating existing index_together should be handled as a migration. For example:

class Author(models.Model):
    rank = models.IntegerField()
    name = models.CharField(max_length=30)

    class Meta:
        index_together = [["rank", "name"]]

Should become:

class Author(models.Model):
    rank = models.IntegerField()
    name = models.CharField(max_length=30)

    class Meta:
        indexes = [models.Index(fields=["rank", "name"])]

Running the makemigrations command will generate a migration containing a RenameIndex operation which will rename the existing index.

The AlterIndexTogether migration operation is now officially supported only for pre-Django 4.2 migration files. For backward compatibility reasons, it’s still part of the public API, and there’s no plan to deprecate or remove it, but it should not be used for new migrations. Use AddIndex and RemoveIndex operations instead.

Passing encoded JSON string literals to JSONField is deprecated¶

JSONField and its associated lookups and aggregates use to allow passing JSON encoded string literals which caused ambiguity on whether string literals were already encoded from database backend’s perspective.

During the deprecation period string literals will be attempted to be JSON decoded and a warning will be emitted on success that points at passing non-encoded forms instead.

Code that use to pass JSON encoded string literals:

Document.objects.bulk_create(
    Document(data=Value("null")),
    Document(data=Value("[]")),
    Document(data=Value('"foo-bar"')),
)
Document.objects.annotate(
    JSONBAgg("field", default=Value('[]')),
)

Should become:

Document.objects.bulk_create(
    Document(data=Value(None, JSONField())),
    Document(data=[]),
    Document(data="foo-bar"),
)
Document.objects.annotate(
    JSONBAgg("field", default=[]),
)

From Django 5.1+ string literals will be implicitly interpreted as JSON string literals.

Miscellaneous¶

• The BaseUserManager.make_random_password() method is deprecated. See recipes and best practices for using Python’s secrets module to generate passwords.

• The length_is template filter is deprecated in favor of length and the == operator within an {% if %} tag. For example

  {% if value|length == 4 %}…{% endif %}
  {% if value|length == 4 %}True{% else %}False{% endif %}
  

  instead of:

  {% if value|length_is:4 %}…{% endif %}
  {{ value|length_is:4 }}
  

• django.contrib.auth.hashers.SHA1PasswordHasher, django.contrib.auth.hashers.UnsaltedSHA1PasswordHasher, and django.contrib.auth.hashers.UnsaltedMD5PasswordHasher are deprecated.

• django.contrib.postgres.fields.CICharField is deprecated in favor of CharField(db_collation="…") with a case-insensitive non-deterministic collation.

• django.contrib.postgres.fields.CIEmailField is deprecated in favor of EmailField(db_collation="…") with a case-insensitive non-deterministic collation.

• django.contrib.postgres.fields.CITextField is deprecated in favor of TextField(db_collation="…") with a case-insensitive non-deterministic collation.

• django.contrib.postgres.fields.CIText mixin is deprecated.

• The map_height and map_width attributes of BaseGeometryWidget are deprecated, use CSS to size map widgets instead.

• SimpleTestCase.assertFormsetError() is deprecated in favor of assertFormSetError().

• TransactionTestCase.assertQuerysetEqual() is deprecated in favor of assertQuerySetEqual().

• Passing positional arguments to Signer and TimestampSigner is deprecated in favor of keyword-only arguments.