summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-05-20Removed versionadded/changed annotations for 6.0.Sarah Boyce
2026-05-20Added stub release notes for 6.2.Sarah Boyce
2026-05-20Bumped version; main is now 6.2 pre-alpha.Sarah Boyce
2026-05-20Updated man page for Django 6.1 alpha 1.Jacob Walls
2026-05-20Made cosmetic edits to docs/releases/6.1.txt.Jacob Walls
2026-05-20Removed empty sections from 6.1 release notes.Jacob Walls
2026-05-20Fixed #37091 -- Confirmed support for GDAL 3.13.Milad Zarour
Thanks David Smith for reviews.
2026-05-20Fixed #37045 -- Renamed savepoint() to savepoint_create().Samuel Searles-Bryant
This makes the name consistent with the `savepoint_commit` and `savepoint_rollback` functions. The previous name is maintained as a deprecated alias. This also frees up the `savepoint` name, which would allow the context manager from `django-subatomic` to be included in Django. Co-authored-by: Lily <code@lilyf.org>
2026-05-20Fixed #36458 -- Trapped focus in the admin calendar and clock widgets.Skyiesac
2026-05-20Refs #35514 -- Cleaned up mailers docs.Mike Edmunds
* Fixed typos related to automated EMAIL_PROVIDERS -> MAILERS renaming. * Clarified wording in some recently added/updated sections. * Removed deprecated, extraneous `fail_silently=False` from examples. * Moved EmailBackend API documentation out of "Email backends" intro into a dedicated section in email.txt. * Sorted MAILERS alphabetically in settings.txt.
2026-05-20Refs #36825 -- Fixed regression in CSPSeleniumTestCase.Johannes Maron
The CSP report test relied on the debug view having a CSP error, which has been fixed in 3e4e0db. This commit added a custom view to reintroduce the same error to verify the reporting behavior. Follow-up to 3e4e0db66961a48a080ff3ff91f6c0d954261366.
2026-05-20Refs #12090 -- Aligned admin change form and list minimum permission to run ↵Sarah Boyce
action.
2026-05-20Fixed #37105 -- Disallowed admin change form actions on different objects.Sarah Boyce
Bug in f30acb184f75fd9260cfd6ddc48a3bbbd49f9c1d. Refs #12090.
2026-05-18Fixed #36825 -- Extended admin templates so CSP nonce is included if available.Johannes Maron
Error pages, admin, and registration templates were updated to use `{% csp_nonce %}` on their explicit `<script>`, `<link>`, and `<style>` HTML elements. Co-authored-by: Antoliny0919 <antoliny0919@gmail.com> Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
2026-05-18Refs #37097 -- Removed compilation-time order clearing on combined queries ↵Jacob Walls
on Oracle. Thanks Simon Charette, JaeHyuck Sa, and Shai Berger for reviews.
2026-05-18Refs #36938 -- Reverted "Refs #36938 -- Tolerated unnecessary ordering in ↵Jacob Walls
compound queries on SQLite." This mostly reverts 2314cdf1ff860058a6579bb9f9bac1253fc9ab43, but keeps the removal of some test skips.
2026-05-18Fixed #37097 -- Made Query.clear_ordering() clear ordering on combined ↵Jacob Walls
queries also. Thanks Shai Berger for the report. Regression in 087bb9e8f3478d53f12b1737af865992af17c5f2. (That commit drove more traffic into an error that would have been reachable only with an explicit order_by() after each union().) Co-authored-by: Simon Charette <charettes@gmail.com> Co-authored-by: siddus <dcsid10@gmail.com>
2026-05-15Fixed #37062 -- Added preserve_request support to RedirectView.VAIBHAVPANT07
2026-05-15Pinned selenium version to "<4.44.0" due to change in get_attribute("class") ↵Sarah Boyce
behavior. Before selenium 4.44.0, target_element.get_attribute("class") returned "" when there was no class attribute. This now returns None.
2026-05-14Refs #36664 -- Updated SMTP EmailBackend tests for Python 3.15.Mike Edmunds
Versions of Python prior to 3.15 would incorrectly encode non-ASCII email addresses using rfc2047, resulting in undeliverable email. The SMTP EmailBackend detects and prevents that (#35713). Python 3.15 fixes that behavior (CPython issue gh-122476). Updated test_rejects_non_ascii_local_part() to feature-detect the fix (in case it is backported) and check for a representative section of the Python error message if so; otherwise test for the SMTP EmailBackend workaround. Updated comments to clarify need and requirement.
2026-05-13Fixed #37092, Refs #35870 -- Added missing deprecation warnings for ↵Jacob Walls
USE_BLANK_CHOICE_DASH. Follow-up to 63c56cda133a85a158502891c40465bc0331d3d9. Modeled on 5d80843ebc5376d00f98bf2a6aadbada4c29365c.
2026-05-13Fixed #37098 -- Added dynamically linked binary env vars to tox passenv.VAIBHAVPANT07
2026-05-13Fixed #35514 -- Implemented dictionary-based MAILERS.Mike Edmunds
See DEP 0018. Added: * MAILERS setting. * django.core.mail.mailers dict-like EmailBackend factory. * `using` argument to mail sending APIs. * `sent_using` attribute to mail.outbox messages in locmem backend. * MAILERS in startproject settings template, set to console backend. * AdminLogHandler.using argument. * BrokenLinkEmailsMiddleware.send_mail() method. Updated: * BaseEmailBackend to track the MAILERS alias used to construct it, and to report errors for unknown kwargs (OPTIONS). * EmailBackend implementations to initialize from kwargs (OPTIONS) only when MAILERS is being used. * smtp.EmailBackend to require `host` option and to default `port` option based on SSL/TLS options. * SimpleTestCase setup to substitute the locmem backend for all defined MAILERS configurations. * Django's tests that send mail to define MAILERS. Deprecated: * EMAIL_BACKEND and other backend-related EMAIL_* settings. * mail.get_connection(). * The `connection`, `fail_silently`, `auth_user`, and `auth_password` arguments to mail functions. * The EmailMessage.connection attribute. * BaseEmailBackend support for `fail_silently`. Backends that support fail_silently (SMTP, console, file) now implement it directly. * AdminEmailHandler.email_backend argument. Removed undocumented features without deprecation: * EmailMessage.get_connection() method. (send() now raises an error if a subclass has attempted to override it.) * EmailMessage.send() no longer sets self.connection to the connection used for sending. (It still _uses_ a pre-existing self.connection.) * AdminEmailHandler.connection() method. (Init now raises an error if a subclass has attempted to override it.) Thanks to Natalia Bidart for shepherding DEP 0018 and for extensive reviews and suggestions on the implementation. Thanks to Jacob Rief for the initial implementation and multiple iterations while refining the design. Co-authored-by: Jacob Rief <jacob.rief@gmail.com>
2026-05-13Fixed #37094 -- Replaced "Go" with "Run" in list_editable alert message.Jacob Walls
Bug in 019acad112da3d00bb81b3022fd25ccd8457e5d9.
2026-05-13Fixed #12090 -- Added admin actions to the admin change form.Marcelo Galigniana
Thank you to Benjamin Balder Bach and Jacob Walls for reviews. Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
2026-05-13Refs CVE-2025-64460 -- Removed workaround for minidom document checks.Jacob Walls
CVE-2025-12084 was fixed upstream in CPython and backported to 3.14.2, 3.13.11, and 3.12.13, making this workaround unnecessary. https://github.com/python/cpython/issues/142145
2026-05-12Fixed #37095 -- Checked maximum redirect lengths against percent-encoded URLs.Jacob Walls
2026-05-12Fixed #37096 -- Fixed test_invalid_choice_db_option on Python 3.14.5+.kasey
2026-05-12Fixed #27825 -- Doc'd that setting model fields does not convert types.1wos
Co-authored-by: Jacob Walls <jacobtylerwalls@gmail.com>
2026-05-12Removed constraints' test_validate_nullable_condition dependency on ↵Tim Graham
generated columns. Co-authored-by: JaeHyuckSa <jaehyuck.sa.dev@gmail.com>
2026-05-11Refs #36938 -- Tolerated unnecessary ordering in compound queries on SQLite.Jacob Walls
2026-05-11Fixed #36938 -- Removed unnecessary ordering from compound queries.siddus
2026-05-11Removed hardcoded pks in AdminViewPermissionsTest.Artyom Kotovskiy
Replaced obj.id permission checks with explicit boolean fields.
2026-05-11Fixed typo in docs/topics/db/search.txt.Stephanie
2026-05-11Refs #36593 -- Replaced reference to select_related() in design philosophies.Jacob Walls
2026-05-11Refs #36593 -- Deprecated setting ModelAdmin.list_select_related to True.Adam Johnson
Now that calling `QuerySet.select_related()` without arguments is deprecated, this commit deprecates the corresponding admin features.
2026-05-11Fixed #36593 -- Deprecated QuerySet.select_related() with no arguments.Adam Johnson
This commit deprecates the "fetch all relations" form of `QuerySet.select_related()` due to its poor performance characteristics, and updates several tests relying on that feature to ignore the new warning.
2026-05-11Refs #36593 -- Used explicit select_related() in admin history_view().Adam Johnson
This commit prepares for the deprecation of `QuerySet.select_related()` with no arguments by explicitly naming the fields to select in this view.
2026-05-11Refs #36593 -- Used explicit select_related() calls in tests.Adam Johnson
This commit prepares for the deprecation of select_related() without arguments by updating tests that used select_related() as a shorthand to explicitly specify the related fields to be selected.
2026-05-11Refs #36593 -- Made ModelAdmin.list_select_related = False more efficient.Adam Johnson
This change makes `list_select_related = False` avoid unnecessary joins by only selecting the related fields that are actually used in `list_display`. Consequently, it avoids one code path that calls `QuerySet.select_related()` with no arguments, which is targeted for deprecation.
2026-05-08Refs #37060 -- Shortened app label in AlterField test for Oracle.Jacob Walls
This avoids having to run connection.ops.truncate_name() when deriving the table name. Follow-up to 21c51c2623a966ba1ad8fd10e36bc8bbec93b70e.
2026-05-08Fixed #37074 -- Synced admin calendar today highlight with server time.Aaryan P
2026-05-08Refs #36712, #36664 -- Used annotation_format parameter of getfullargspec() ↵Jacob Walls
on Python 3.15. https://github.com/python/cpython/pull/149457
2026-05-08Refs #35514 -- Decoupled settings from functional EmailBackend tests.Mike Edmunds
Reworked tests/mail/test_backends.py so that cases covering functional behavior don't depend on EMAIL_BACKEND or other EMAIL_* settings. (But kept unchanged existing tests to verify backend instance properties are initialized from EMAIL_* settings.) Most backend behavior tests had implicitly relied on email settings overrides in test setup (e.g., to use an emulated SMTP server). They either used mail.get_connection(...) or directly constructed a backend class instance with the specific attributes being tested, relying on the settings overrides to initialize other required attributes. That approach won't work after those settings are deprecated as part of EMAIL_PROVIDERS. Instead, replaced backend construction in "functional" tests with new SharedEmailBackendTests.create_backend() which constructs the testable backend instance with _all_ options needed to avoid global settings. Tests to verify the settings are read correctly continue to directly construct backend instances, without using create_backend().
2026-05-08Refs #35514 -- Fixed settings deprecation warning helper.Mike Edmunds
Replaced the (currently unused) LazySettings._show_deprecation_warning() with a module-level _show_settings_deprecation_warning() function. The new function can be called from any settings-related code, not just LazySettings methods. It correctly distinguishes internal from external settings usage when override_settings() is involved.
2026-05-07Fixed #37084 -- Added CSP nonce context processor system check.Milad Zarour
2026-05-07Fixed #37085 -- Added support for object-based form media stylesheet assets.Natalia
Thank you James Walls and James Bligh for reviews. Co-authored-by: Johannes Maron <johannes@maron.family>
2026-05-07Fixed #37060 -- Propagated AlterField through attname-based to_field references.Andrea Zanotto
Schema dependency discovery treated to_field values as raw field names, so attname aliases such as "primary_id" were not matched to the underlying relation field "primary". As a result, AlterField on a unique target field updated direct dependencies but missed transitive attname-based references. Resolved the dependency matching by comparing resolved remote fields rather than only field names, and updated SQLite's related-table rebuild path to use the same recursive dependency discovery. Added a regression test covering a transitive relation chain where ForeignKey(..., to_field="primary_id") must widen along with the unique leaf field it ultimately references.
2026-05-07Refs #15727 -- Moved security.E026 out of list of deploy=True checks.Jacob Walls
2026-05-06Refs #35514 -- Cleaned up logging and middleware tests.Mike Edmunds
Simplified and removed use of soon-to-be-deprecated or removed features from tests for AdminEmailHandler and BrokenLinkEmailsMiddleware. Added or updated cases to ensure `fail_silently` usage remains consistent during the transition to email providers. Changed custom FailingEmailBackend to respect fail_silently and record its use in a class-level property. In AdminEmailHandlerTest: * Added make_log_record() helper to reduce duplicated code. * Changed test_fail_silently() to send through the FailingEmailBackend, which will fail if not initialized with fail_silently=True. (Rather than inspecting attributes of a soon-to-be-deprecated connection.) * Simplified test_uses_custom_email_backend() by replacing monkeypatches with inspectable custom backend. * In test_customize_send_mail_method(), removed use of the undocumented self.connection() method and the soon-to-be-deprecated `connection` arg to mail_managers(). This test verifies a subclass can customize sending by mailing the managers rather than the admins. Involving a email backend connection was irrelevant. In BrokenLinkEmailsMiddlewareTest, added a case with FailingEmailBackend to verify send uses fail_silently=True.