Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Scheduled weekly dependency update for week 00 #32

wants to merge 21 commits into from


None yet
1 participant
Copy link

commented Jan 6, 2018


Here's a list of all the updates bundled in this pull request. I've added some links to make it easier for you to find all the information you need.

boto3 1.4.7 » 1.5.9 PyPI | Changelog | Repo
django-anymail 1.0 » 1.2 PyPI | Changelog | Repo
raven 6.2.1 » 6.4.0 PyPI | Changelog | Repo
opbeat 3.5.2 » 3.6.0 PyPI | Changelog | Repo
django 1.11.6 » 2.0.1 PyPI | Changelog | Homepage
django-braces 1.11.0 » 1.12.0 PyPI | Changelog | Repo
django-crispy-forms 1.6.1 » 1.7.0 PyPI | Changelog | Repo
Pillow 4.3.0 » 5.0.0 PyPI | Changelog | Homepage
django-allauth 0.33.0 » 0.34.0 PyPI | Changelog | Repo
psycopg2 » PyPI | Changelog | Homepage
pytz 2017.2 » 2017.3 PyPI | Homepage | Docs
django-ckeditor 5.3.0 » 5.4.0 PyPI | Changelog | Repo
django-extensions 1.9.1 » 1.9.8 PyPI | Changelog | Repo | Docs
coverage 4.4.1 » 4.4.2 PyPI | Changelog | Repo
Sphinx 1.6.4 » 1.6.5 PyPI | Changelog | Homepage
Werkzeug 0.12.2 » 0.14.1 PyPI | Changelog | Homepage
django-test-plus 1.0.18 » 1.0.21 PyPI | Changelog | Repo
django-debug-toolbar 1.8 » 1.9.1 PyPI | Changelog | Repo
flake8 3.4.1 » 3.5.0 PyPI | Changelog | Repo


boto3 1.4.7 -> 1.5.9



  • api-change:ssm: [botocore] Update ssm client to latest version
  • api-change:inspector: [botocore] Update inspector client to latest version
  • api-change:snowball: [botocore] Update snowball client to latest version



  • api-change:rds: [botocore] Update rds client to latest version



  • api-change:workspaces: [botocore] Update workspaces client to latest version



  • api-change:ecs: [botocore] Update ecs client to latest version
  • api-change:ec2: [botocore] Update ec2 client to latest version
  • api-change:inspector: [botocore] Update inspector client to latest version
  • api-change:sagemaker: [botocore] Update sagemaker client to latest version



  • api-change:ec2: [botocore] Update ec2 client to latest version
  • enhancement:Paginator: [botocore] Added paginator support for lambda list aliases operation.
  • api-change:kinesisanalytics: [botocore] Update kinesisanalytics client to latest version
  • api-change:codebuild: [botocore] Update codebuild client to latest version



  • api-change:iot: [botocore] Update iot client to latest version
  • api-change:config: [botocore] Update config client to latest version



  • api-change:route53: [botocore] Update route53 client to latest version
  • api-change:apigateway: [botocore] Update apigateway client to latest version
  • api-change:mediastore-data: [botocore] Update mediastore-data client to latest version



  • bugfix:presigned-url: [botocore] Fixes a bug where content-type would be set on presigned requests for query services.
  • api-change:cloudwatch: [botocore] Update cloudwatch client to latest version



  • api-change:appstream: [botocore] Update appstream client to latest version



  • bugfix:Filters: Fixes a bug where parameters passed to resource collections could be mutated after the collections were created.
  • api-change:ses: [botocore] Update ses client to latest version
  • enhancement:credentials: [botocore] Moved the JSONFileCache from the CLI into botocore so that it can be used without importing from the cli.
  • feature:botocore dependency: Update dependency strategy to always take a floor on the most recent version of botocore. This means whenever there is a release of botocore, boto3 will release as well to account for the new version of botocore.
  • api-change:apigateway: [botocore] Update apigateway client to latest version



  • enhancement:botocore: Raised minor version dependency for botocore

django-anymail 1.0 -> 1.2


New features

  • Postmark: Support new click webhook in normalized tracking events


Bug fixes

  • Mailgun: Support metadata in opened/clicked/unsubscribed tracking webhooks, and fix potential problems if metadata keys collided with Mailgun event parameter names. (See 76, 77)

Other changes

  • Internal: Rework Anymail's ParsedEmail class and rename to EmailAddress to align it with similar functionality in the Python 3.6 email package, in preparation for future inbound support. ParsedEmail was not documented for use outside Anymail's internals (so this change does not bump the semver major version), but if you were using it in an undocumented way you will need to update your code.

raven 6.2.1 -> 6.4.0


  • [Core] Support for defining sanitized_keys on the client (pr/990)
  • [Django] Support for Django 2.0 Urlresolver
  • [Docs] Several fixes and improvements


  • [Core] Changed default timeout on http calls to 5 seconds
  • [Core] Fixed relative paths for traces generated on Windows
  • [Django] Fixed import issues for Django projects < 1.7
  • [Django] Fixed django management command data option
  • [Django/DRF] Added application/octet-stream to non-cacheable types in middleware
  • [Django] Added parsing X-Forwarded-For for user.ip_address
  • [Flask] Added request.remote_addr as fallback for ip addresses
  • [Lambda] Added initial AWS Lambda support with contrib.awslambda.LambdaClient

opbeat 3.5.2 -> 3.6.0


  • fixed compatibility issues with Django 2.0


  • added instrumentation for Botocore (155, thanks szilveszter)
  • several bugfixes

django 1.11.6 -> 2.0.1



January 1, 2018

Django 2.0.1 fixes several bugs in 2.0.


  • Fixed a regression in Django 1.11 that added newlines between MultiWidget's
    subwidgets (🎫28890).
  • Fixed incorrect class-based model index name generation for models with
    quoted db_table (🎫28876).
  • Fixed incorrect foreign key constraint name for models with quoted
    db_table (🎫28876).
  • Fixed a regression in caching of a GenericForeignKey when the referenced
    model instance uses more than one level of multi-table inheritance
  • Reallowed filtering a queryset with GeometryField=None (🎫28896).
  • Corrected admin check to allow a OneToOneField in
    ModelAdmin.autocomplete_fields (🎫28898).
  • Fixed a regression on SQLite where DecimalField returned a result with
    trailing zeros in the fractional part truncated (🎫28915).
  • Fixed crash in the testserver command startup (🎫28941).
  • Fixed crash when coercing a translatable URL pattern to str
  • Fixed crash on SQLite when renaming a field in a model referenced by a
    ManyToManyField (🎫28884).
  • Fixed a crash when chaining values() or values_list() after
    QuerySet.select_for_update(of=(...)) (🎫28944).
  • Fixed admin changelist crash when using a query expression in the page's
    ordering (🎫28958).




December 2, 2017

Welcome to Django 2.0!

These release notes cover the :ref:new features &lt;whats-new-2.0&gt;, as well as
some :ref:backwards incompatible changes &lt;backwards-incompatible-2.0&gt; you'll
want to be aware of when upgrading from Django 1.11 or earlier. We've
:ref:dropped some features&lt;removed-features-2.0&gt; that have reached the end of
their deprecation cycle, and we've :ref:begun the deprecation process for some features &lt;deprecated-features-2.0&gt;.

This release starts Django's use of a :ref:loose form of semantic versioning &lt;internal-release-cadence&gt;, but there aren't any major backwards incompatible
changes that might be expected of a 2.0 release. Upgrading should be a similar
amount of effort as past feature releases.

See the :doc:/howto/upgrade-version guide if you're updating an existing

Python compatibility

Django 2.0 supports Python 3.4, 3.5, and 3.6. We highly recommend and only
officially support the latest release of each series.

The Django 1.11.x series is the last to support Python 2.7.

Django 2.0 will be the last release series to support Python 3.4. If you plan
a deployment of Python 3.4 beyond the end-of-life for Django 2.0 (April 2019),
stick with Django 1.11 LTS (supported until April 2020) instead. Note, however,
that the end-of-life for Python 3.4 is March 2019.

Third-party library support for older version of Django

Following the release of Django 2.0, we suggest that third-party app authors
drop support for all versions of Django prior to 1.11. At that time, you should
be able to run your package's tests using python -Wd so that deprecation
warnings do appear. After making the deprecation warning fixes, your app should
be compatible with Django 2.0.

.. _whats-new-2.0:

What's new in Django 2.0

Simplified URL routing syntax

The new :func:django.urls.path() function allows a simpler, more readable URL
routing syntax. For example, this example from previous Django releases::

url(r'^articles/(?P<year>[0-9]{4})/$', views.year_archive),

could be written as::

path('articles/<int:year>/', views.year_archive),

The new syntax supports type coercion of URL parameters. In the example, the
view will receive the year keyword argument as an integer rather than as
a string. Also, the URLs that will match are slightly less constrained in the
rewritten example. For example, the year 10000 will now match since the year
integers aren't constrained to be exactly four digits long as they are in the
regular expression.

The django.conf.urls.url() function from previous versions is now available
as :func:django.urls.re_path. The old location remains for backwards
compatibility, without an imminent deprecation. The old
django.conf.urls.include() function is now importable from django.urls
so you can use from django.urls import include, path, re_path in your

The :doc:/topics/http/urls document is rewritten to feature the new syntax
and provide more details.

Mobile-friendly contrib.admin

The admin is now responsive and supports all major mobile devices. Older
browsers may experience varying levels of graceful degradation.

Window expressions

The new :class:~django.db.models.expressions.Window expression allows
adding an OVER clause to querysets. You can use :ref:window functions &lt;window-functions&gt; and :ref:aggregate functions &lt;aggregation-functions&gt; in
the expression.

Minor features


  • The new :attr:.ModelAdmin.autocomplete_fields attribute and
    :meth:.ModelAdmin.get_autocomplete_fields method allow using an
    Select2 &lt;;_ search widget for ForeignKey and


  • The default iteration count for the PBKDF2 password hasher is increased from
    36,000 to 100,000.


  • Added MySQL support for the
    :class:~django.contrib.gis.db.models.functions.AsGeoJSON function,
    :class:~django.contrib.gis.db.models.functions.GeoHash function,
    :class:~django.contrib.gis.db.models.functions.IsValid function,
    :lookup:isvalid lookup, and :ref:distance lookups &lt;distance-lookups&gt;.
  • Added the :class:~django.contrib.gis.db.models.functions.Azimuth and
    :class:~django.contrib.gis.db.models.functions.LineLocatePoint functions,
    supported on PostGIS and SpatiaLite.
  • Any :class:~django.contrib.gis.geos.GEOSGeometry imported from GeoJSON now
    has its SRID set.
  • Added the :attr:.OSMWidget.default_zoom attribute to customize the map's
    default zoom level.
  • Made metadata readable and editable on rasters through the
    :attr:~django.contrib.gis.gdal.GDALRaster.metadata,, and
    :attr:~django.contrib.gis.gdal.GDALBand.metadata attributes.
  • Allowed passing driver-specific creation options to
    :class:~django.contrib.gis.gdal.GDALRaster objects using papsz_options.
  • Allowed creating :class:~django.contrib.gis.gdal.GDALRaster objects in
    GDAL's internal virtual filesystem. Rasters can now be :ref:created from and converted to binary data &lt;gdal-raster-vsimem&gt; in-memory.
  • The new :meth:GDALBand.color_interp() &lt;django.contrib.gis.gdal.GDALBand.color_interp&gt; method returns the color
    interpretation for the band.


  • The new distinct argument for
    :class:~django.contrib.postgres.aggregates.ArrayAgg determines if
    concatenated values will be distinct.
  • The new :class:~django.contrib.postgres.functions.RandomUUID database
    function returns a version 4 UUID. It requires use of PostgreSQL's
    pgcrypto extension which can be activated using the new
    :class:~django.contrib.postgres.operations.CryptoExtension migration
  • :class:django.contrib.postgres.indexes.GinIndex now supports the
    fastupdate and gin_pending_list_limit parameters.
  • The new :class:~django.contrib.postgres.indexes.GistIndex class allows
    creating GiST indexes in the database. The new
    :class:~django.contrib.postgres.operations.BtreeGistExtension migration
    operation installs the btree_gist extension to add support for operator
    classes that aren't built-in.
  • :djadmin:inspectdb can now introspect JSONField and various
    RangeField\s (django.contrib.postgres must be in INSTALLED_APPS).


  • Added the protocol keyword argument to the
    :class:~django.contrib.sitemaps.GenericSitemap constructor.


  • cache.set_many() now returns a list of keys that failed to be inserted.
    For the built-in backends, failed inserts can only happen on memcached.

File Storage

  • &lt;; can be used as a context
    manager, e.g. with as f:.


  • The new date_attrs and time_attrs arguments for
    :class:~django.forms.SplitDateTimeWidget and
    :class:~django.forms.SplitHiddenDateTimeWidget allow specifying different
    HTML attributes for the DateInput and TimeInput (or hidden)
  • The new :meth:Form.errors.get_json_data() &lt;django.forms.Form.errors.get_json_data&gt; method returns form errors as
    a dictionary suitable for including in a JSON response.

Generic Views

  • The new :attr:.ContextMixin.extra_context attribute allows adding context
    in View.as_view().

Management Commands

  • :djadmin:inspectdb now translates MySQL's unsigned integer columns to
    PositiveIntegerField or PositiveSmallIntegerField.
  • The new :option:makemessages --add-location option controls the comment
    format in PO files.
  • :djadmin:loaddata can now :ref:read from stdin &lt;loading-fixtures-stdin&gt;.
  • The new :option:diffsettings --output option allows formatting the output
    in a unified diff format.
  • On Oracle, :djadmin:inspectdb can now introspect AutoField if the
    column is created as an identity column.
  • On MySQL, :djadmin:dbshell now supports client-side TLS certificates.


  • The new :option:squashmigrations --squashed-name option allows naming the
    squashed migration.


  • The new :class:~django.db.models.functions.StrIndex database function
    finds the starting index of a string inside another string.
  • On Oracle, AutoField and BigAutoField are now created as identity columns_.

.. _identity columns:

  • The new chunk_size parameter of :meth:.QuerySet.iterator controls the
    number of rows fetched by the Python database client when streaming results
    from the database. For databases that don't support server-side cursors, it
    controls the number of results Django fetches from the database adapter.
  • :meth:.QuerySet.earliest, :meth:.QuerySet.latest, and
    :attr:Meta.get_latest_by &lt;django.db.models.Options.get_latest_by&gt; now
    allow ordering by several fields.
  • Added the :class:~django.db.models.functions.ExtractQuarter function to
    extract the quarter from :class:~django.db.models.DateField and
    :class:~django.db.models.DateTimeField, and exposed it through the
    :lookup:quarter lookup.
  • Added the :class:~django.db.models.functions.TruncQuarter function to
    truncate :class:~django.db.models.DateField and
    :class:~django.db.models.DateTimeField to the first day of a quarter.
  • Added the :attr:~django.db.models.Index.db_tablespace parameter to
    class-based indexes.
  • If the database supports a native duration field (Oracle and PostgreSQL),
    :class:~django.db.models.functions.Extract now works with
  • Added the of argument to :meth:.QuerySet.select_for_update(), supported
    on PostgreSQL and Oracle, to lock only rows from specific tables rather than
    all selected tables. It may be helpful particularly when
    :meth:~.QuerySet.select_for_update() is used in conjunction with
  • The new field_name parameter of :meth:.QuerySet.in_bulk allows fetching
    results based on any unique model field.
  • :meth:.CursorWrapper.callproc() now takes an optional dictionary of keyword
    parameters, if the backend supports this feature. Of Django's built-in
    backends, only Oracle supports it.
  • The new :meth:connection.execute_wrapper() &lt;django.db.backends.base.DatabaseWrapper.execute_wrapper&gt; method allows
    :doc:installing wrappers around execution of database queries &lt;/topics/db/instrumentation&gt;.
  • The new filter argument for built-in aggregates allows :ref:adding different conditionals &lt;conditional-aggregation&gt; to multiple aggregations
    over the same fields or relations.
  • Added support for expressions in :attr:Meta.ordering &lt;django.db.models.Options.ordering&gt;.
  • The new named parameter of :meth:.QuerySet.values_list allows fetching
    results as named tuples.
  • The new :class:.FilteredRelation class allows adding an ON clause to


  • Added :meth:Paginator.get_page() &lt;django.core.paginator.Paginator.get_page&gt;
    to provide the documented pattern of handling invalid page numbers.

Requests and Responses

  • The :djadmin:runserver Web server supports HTTP 1.1.


  • To increase the usefulness of :meth:.Engine.get_default in third-party
    apps, it now returns the first engine if multiple DjangoTemplates engines
    are configured in TEMPLATES rather than raising ImproperlyConfigured.
  • Custom template tags may now accept keyword-only arguments.


  • Added threading support to :class:~django.test.LiveServerTestCase.
  • Added settings that allow customizing the test tablespace parameters for
    Oracle: :setting:DATAFILE_SIZE, :setting:DATAFILE_TMP_SIZE,


  • The new :class:.ProhibitNullCharactersValidator disallows the null
    character in the input of the :class:~django.forms.CharField form field
    and its subclasses. Null character input was observed from vulnerability
    scanning tools. Most databases silently discard null characters, but
    psycopg2 2.7+ raises an exception when trying to save a null character to
    a char/text field with PostgreSQL.

.. _backwards-incompatible-2.0:

Backwards incompatible changes in 2.0

Removed support for bytestrings in some places

To support native Python 2 strings, older Django versions had to accept both
bytestrings and unicode strings. Now that Python 2 support is dropped,
bytestrings should only be encountered around input/output boundaries (handling
of binary fields or HTTP streams, for example). You might have to update your
code to limit bytestring usage to a minimum, as Django no longer accepts
bytestrings in certain code paths.

For example, reverse() now uses str() instead of force_text() to
coerce the args and kwargs it receives, prior to their placement in
the URL. For bytestrings, this creates a string with an undesired b prefix
as well as additional quotes (str(b&#39;foo&#39;) is &quot;b&#39;foo&#39;&quot;). To adapt, call
decode() on the bytestring before passing it to reverse().

Database backend API

This section describes changes that may be needed in third-party database

  • The DatabaseOperations.datetime_cast_date_sql(),
    datetime_cast_time_sql(), datetime_trunc_sql(),
    datetime_extract_sql(), and date_interval_sql() methods now return
    only the SQL to perform the operation instead of SQL and a list of
  • Third-party database backends should add a DatabaseWrapper.display_name
    attribute with the name of the database that your backend works with. Django
    may use it in various messages, such as in system checks.
  • The first argument of SchemaEditor._alter_column_type_sql() is now
    model rather than table.
  • The first argument of SchemaEditor._create_index_name() is now
    table_name rather than model.
  • To enable FOR UPDATE OF support, set
    DatabaseFeatures.has_select_for_update_of = True. If the database
    requires that the arguments to OF be columns rather than tables, set
    DatabaseFeatures.select_for_update_of_column = True.
  • To enable support for :class:~django.db.models.expressions.Window
    expressions, set DatabaseFeatures.supports_over_clause to True. You
    may need to customize the DatabaseOperations.window_start_rows_start_end()
    and/or window_start_range_start_end() methods.
  • Third-party database backends should add a
    DatabaseOperations.cast_char_field_without_max_length attribute with the
    database data type that will be used in the
    :class:~django.db.models.functions.Cast function for a CharField if the
    max_length argument isn't provided.
  • The first argument of DatabaseCreation._clone_test_db() and
    get_test_db_clone_settings() is now suffix rather
    than number (in case you want to rename the signatures in your backend
    for consistency). django.test also now passes those values as strings
    rather than as integers.
  • Third-party database backends should add a
    DatabaseIntrospection.get_sequences() method based on the stub in

Dropped support for Oracle 11.2

The end of upstream support for Oracle 11.2 is Dec. 2020. Django 1.11 will be
supported until April 2020 which almost reaches this date. Django 2.0
officially supports Oracle 12.1+.

Default MySQL isolation level is read committed

MySQL's default isolation level, repeatable read, may cause data loss in
typical Django usage. To prevent that and for consistency with other databases,
the default isolation level is now read committed. You can use the
:setting:DATABASES setting to :ref:use a different isolation level &lt;mysql-isolation-level&gt;, if needed.

:attr:AbstractUser.last_name &lt;django.contrib.auth.models.User.last_name&gt; max_length increased to 150

A migration for :attr:django.contrib.auth.models.User.last_name is included.
If you have a custom user model inheriting from AbstractUser, you'll need
to generate and apply a database migration for your user model.

If you want to preserve the 30 character limit for last names, use a custom

from django.contrib.auth.forms import UserChangeForm

class MyUserChangeForm(UserChangeForm):
last_name = forms.CharField(max_length=30, required=False)

If you wish to keep this restriction in the admin when editing users, set
UserAdmin.form to use this form::

from django.contrib.auth.admin import UserAdmin
from django.contrib.auth.models import User

class MyUserAdmin(UserAdmin):
form = MyUserChangeForm, MyUserAdmin)

QuerySet.reverse() and last() are prohibited after slicing

Calling QuerySet.reverse() or last() on a sliced queryset leads to
unexpected results due to the slice being applied after reordering. This is
now prohibited, e.g.::

>>> Model.objects.all()[:2].reverse()
Traceback (most recent call last):
TypeError: Cannot reverse a query once a slice has been taken.

Form fields no longer accept optional arguments as positional arguments

To help prevent runtime errors due to incorrect ordering of form field
arguments, optional arguments of built-in form fields are no longer accepted
as positional arguments. For example::

forms.IntegerField(25, 10)

raises an exception and should be replaced with::

forms.IntegerField(max_value=25, min_value=10)

call_command() validates the options it receives

call_command() now validates that the argument parser of the command being
called defines all of the options passed to call_command().

For custom management commands that use options not created using
parser.add_argument(), add a stealth_options attribute on the command::

class MyCommand(BaseCommand):
stealth_options = ('option_name', ...)

Indexes no longer accept positional arguments

For example::

models.Index(['headline', '-pub_date'], 'index_name')

raises an exception and should be replaced with::

models.Index(fields=['headline', '-pub_date'], name='index_name')

Foreign key constraints are now enabled on SQLite

This will appear as a backwards-incompatible change (IntegrityError: FOREIGN KEY constraint failed) if attempting to save an existing model
instance that's violating a foreign key constraint.

Foreign keys are now created with DEFERRABLE INITIALLY DEFERRED instead of
DEFERRABLE IMMEDIATE. Thus, tables may need to be rebuilt to recreate
foreign keys with the new definition, particularly if you're using a pattern
like this::

from django.db import transaction

with transaction.atomic():

If you don't recreate the foreign key as DEFERRED, the first create()
would fail now that foreign key constraints are enforced.

Backup your database first! After upgrading to Django 2.0, you can then
rebuild tables using a script similar to this::

from django.apps import apps
from django.db import connection

for app in apps.get_app_configs():
for model in app.get_models(include_auto_created=True):
if model._meta.managed and not (model._meta.proxy or model._meta.swapped):
for base in model.bases:
if hasattr(base, '_meta'):
base._meta.local_many_to_many = []
model._meta.local_many_to_many = []
with connection.schema_editor() as editor:

This script hasn't received extensive testing and needs adaption for various
cases such as multiple databases. Feel free to contribute improvements.

In addition, because of a table alteration limitation of SQLite, it's prohibited
to perform :class:~django.db.migrations.operations.RenameModel and
:class:~django.db.migrations.operations.RenameField operations on models or
fields referenced by other models in a transaction. In order to allow migrations
containing these operations to be applied, you must set the
Migration.atomic attribute to False.


  • The SessionAuthenticationMiddleware class is removed. It provided no
    functionality since session authentication is unconditionally enabled in
    Django 1.10.
  • The default HTTP error handlers (handler404, etc.) are now callables
    instead of dotted Python path strings. Django favors callable references
    since they provide better performance and debugging experience.
  • :class:~django.views.generic.base.RedirectView no longer silences
    NoReverseMatch if the pattern_name doesn't exist.
  • When :setting:USE_L10N is off, :class:~django.forms.FloatField and
    :class:~django.forms.DecimalField now respect :setting:DECIMAL_SEPARATOR
    and :setting:THOUSAND_SEPARATOR during validation. For example, with the
USE_L10N = False

an input of &quot;1.345&quot; is now converted to 1345 instead of 1.345.

  • Subclasses of :class:~django.contrib.auth.models.AbstractBaseUser are no
    longer required to implement get_short_name() and get_full_name().
    (The base implementations that raise NotImplementedError are removed.)
    django.contrib.admin uses these methods if implemented but doesn't
    require them. Third-party apps that use these methods may want to adopt a
    similar approach.
  • The FIRST_DAY_OF_WEEK and NUMBER_GROUPING format settings are now
    kept as integers in JavaScript and JSON i18n view outputs.
  • :meth:~django.test.TransactionTestCase.assertNumQueries now ignores
    connection configuration queries. Previously, if a test opened a new database
    connection, those queries could be included as part of the
    assertNumQueries() count.
  • The default size of the Oracle test tablespace is increased from 20M to 50M
    and the default autoextend size is increased from 10M to 25M.
  • To improve performance when streaming large result sets from the database,
    :meth:.QuerySet.iterator now fetches 2000 rows at a time instead of 100.
    The old behavior can be restored using the chunk_size parameter. For
  • Providing unknown package names in the packages argument of the
    :class:~django.views.i18n.JavaScriptCatalog view now raises ValueError
    instead of passing silently.
  • A model instance's primary key now appears in the default Model.__str__()
    method, e.g. Question object (1).
  • makemigrations now detects changes to the model field limit_choices_to
    option. Add this to your existing migrations or accept an auto-generated
    migration for fields that use it.
  • Performing queries that require :ref:automatic spatial transformations &lt;automatic-spatial-transformations&gt; now raises NotImplementedError
    on MySQL instead of silently using non-transformed geometries.
  • django.core.exceptions.DjangoRuntimeWarning is removed. It was only used
    in the cache backend as an intermediate class in CacheKeyWarning's
    inheritance of RuntimeWarning.
  • Renamed BaseExpression._output_field to output_field. You may need
    to update custom expressions.
  • In older versions, forms and formsets combine their Media with widget
    Media by concatenating the two. The combining now tries to :ref:preserve the relative order of elements in each list &lt;form-media-asset-order&gt;.
    MediaOrderConflictWarning is issued if the order can't be preserved.
  • django.contrib.gis.gdal.OGRException is removed. It's been an alias for
    GDALException since Django 1.8.
  • Support for GEOS 3.3.x is dropped.
  • The way data is selected for GeometryField is changed to improve
    performance, and in raw SQL queries, those fields must now be wrapped in See the :ref:Raw queries note&lt;gis-raw-sql&gt; in
    the GIS tutorial for an example.

.. _deprecated-features-2.0:

Features deprecated in 2.0

context argument of Field.from_db_value() and Expression.convert_value()

The context argument of Field.from_db_value() and
Expression.convert_value() is unused as it's always an empty dictionary.
The signature of both methods is now::

(self, value, expression, connection)

instead of::

(self, value, expression, connection, context)

Support for the old signature in custom fields and expressions remains until
Django 3.0.


  • The django.db.backends.postgresql_psycopg2 module is deprecated in favor
    of django.db.backends.postgresql. It's been an alias since Django 1.9.
    This only affects code that imports from the module directly. The
    DATABASES setting can still use
    &#39;django.db.backends.postgresql_psycopg2&#39;, though you can simplify that by
    using the &#39;django.db.backends.postgresql&#39; name added in Django 1.9.
  • django.shortcuts.render_to_response() is deprecated in favor of
    :func:django.shortcuts.render. render() takes the same arguments
    except that it also requires a request.
  • The DEFAULT_CONTENT_TYPE setting is deprecated. It doesn't interact well
    well with third-party apps and is obsolete since HTML5 has mostly superseded
  • HttpRequest.xreadlines() is deprecated in favor of iterating over the
  • The field_name keyword argument to :meth:.QuerySet.earliest and
    :meth:.QuerySet.latest is deprecated in favor of passing the field
    names as arguments. Write .earliest(&#39;pub_date&#39;) instead of

.. _removed-features-2.0:

Features removed in 2.0

These features have reached the end of their deprecation cycle and are removed
in Django 2.0.

See :ref:deprecated-features-1.9 for details on these changes, including how
to remove usage of these features.

  • The weak argument to django.dispatch.signals.Signal.disconnect() is
  • django.db.backends.base.BaseDatabaseOperations.check_aggregate_support()
    is removed.
  • The django.forms.extras package is removed.
  • The assignment_tag helper is removed.
  • The host argument to SimpleTestCase.assertsRedirects() is removed.
    The compatibility layer which allows absolute URLs to be considered equal to
    relative ones when the path is identical is also removed.
  • Field.rel and are removed.
  • The on_delete argument for ForeignKey and OneToOneField is now
    required in models and migrations. Consider squashing migrations so that you
    have fewer of them to update.
  • django.db.models.fields.add_lazy_relation() is removed.
  • When time zone support is enabled, database backends that don't support time
    zones no longer convert aware datetimes to naive values in UTC anymore when
    such values are passed as parameters to SQL queries executed outside of the
    ORM, e.g. with cursor.execute().
  • django.contrib.auth.tests.utils.skipIfCustomUser() is removed.
  • The GeoManager and GeoQuerySet classes are removed.
  • The django.contrib.gis.geoip module is removed.
  • The supports_recursion check for template loaders is removed from:
  • django.template.engine.Engine.find_template()
  • django.template.loader_tags.ExtendsNode.find_template()
  • django.template.loaders.base.Loader.supports_recursion()
  • django.template.loaders.cached.Loader.supports_recursion()
  • The load_template and load_template_sources template loader methods
    are removed.
  • The template_dirs argument for template loaders is removed:
  • django.template.loaders.base.Loader.get_template()
  • django.template.loaders.cached.Loader.cache_key()
  • django.template.loaders.cached.Loader.get_template()
  • django.template.loaders.cached.Loader.get_template_sources()
  • django.template.loaders.filesystem.Loader.get_template_sources()
  • django.template.loaders.base.Loader.__call__() is removed.
  • Support for custom error views that don't accept an exception parameter
    is removed.
  • The mime_type attribute of django.utils.feedgenerator.Atom1Feed and
    django.utils.feedgenerator.RssFeed is removed.
  • The app_name argument to include() is removed.
  • Support for passing a 3-tuple (including as the first
    argument to include() is removed.
  • Support for setting a URL instance namespace without an application namespace
    is removed.
  • Field._get_val_from_obj() is removed.
  • django.template.loaders.eggs.Loader is removed.
  • The current_app parameter to the contrib.auth function-based views is
  • The callable_obj keyword argument to
    SimpleTestCase.assertRaisesMessage() is removed.
  • Support for the allow_tags attribute on ModelAdmin methods is
  • The enclosure keyword argument to SyndicationFeed.add_item() is
  • The django.template.loader.LoaderOrigin and
    django.template.base.StringOrigin aliases for
    django.template.base.Origin are removed.

See :ref:deprecated-features-1.10 for details on these changes.

  • The makemigrations --exit option is removed.
  • Support for direct assignment to a reverse foreign key or many-to-many
    relation is removed.
  • The get_srid() and set_srid() methods of
    django.contrib.gis.geos.GEOSGeometry are removed.
  • The get_x(), set_x(), get_y(), set_y(), get_z(), and
    set_z() methods of django.contrib.gis.geos.Point are removed.
  • The get_coords() and set_coords() methods of
    django.contrib.gis.geos.Point are removed.
  • The cascaded_union property of django.contrib.gis.geos.MultiPolygon
    is removed.
  • django.utils.functional.allow_lazy() is removed.
  • The shell --plain option is removed.
  • The django.core.urlresolvers module is removed in favor of its new
    location, django.urls.
  • CommaSeparatedIntegerField is removed, except for support in historical
  • The template Context.has_key() method is removed.
  • Support for the,
    created_time(), and modified_time() methods is removed.
  • Support for query lookups using the model name when
    Meta.default_related_name is set is removed.
  • The MySQL __search lookup is removed.
  • The shim for supporting custom related manager classes without a
    _apply_rel_filters() method is removed.
  • Using User.is_authenticated() and User.is_anonymous() as methods
    rather than properties is no longer supported.
  • The Model._meta.virtual_fields attribute is removed.
  • The keyword arguments virtual_only in Field.contribute_to_class() and
    virtual in Model._meta.add_field() are removed.
  • The javascript_catalog() and json_catalog() views are removed.
  • django.contrib.gis.utils.precision_wkt() is removed.
  • In multi-table inheritance, implicit promotion of a OneToOneField to a
    parent_link is removed.
  • Support for Widget._format_value() is removed.
  • FileField methods get_directory_name() and get_filename() are
  • The mark_for_escaping() function and the classes it uses: EscapeData,
    EscapeBytes, EscapeText, EscapeString, and EscapeUnicode are
  • The escape filter now uses django.utils.html.conditional_escape().
  • Manager.use_for_related_fields is removed.
  • Model Manager inheritance follows MRO inheritance rules. The requirement
    to use Meta.manager_inheritance_from_future to opt-in to the behavior is
  • Support for old-style middleware using settings.MIDDLEWARE_CLASSES is




January 1, 2018

Django 1.11.9 fixes several bugs in 1.11.8.


  • Fixed a regression in Django 1.11 that added newlines between MultiWidget's
    subwidgets (🎫28890).
  • Fixed incorrect class-based model index name generation for models with
    quoted db_table (🎫28876).
  • Fixed incorrect foreign key constraint name for models with quoted
    db_table (🎫28876).
  • Fixed a regression in caching of a GenericForeignKey when the referenced
    model instance uses more than one level of multi-table inheritance




December 2, 2017

Django 1.11.8 fixes several bugs in 1.11.7.


  • Reallowed, following a regression in Django 1.10, AuthenticationForm to
    raise the inactive user error when using ModelBackend (🎫28645).
  • Added support for QuerySet.values() and values_list() for
    union(), difference(), and intersection() queries
  • Fixed incorrect index name truncation when using a namespaced db_table
  • Made QuerySet.iterator() use server-side cursors on PostgreSQL after
    values() and values_list() (🎫28817).
  • Fixed crash on SQLite and MySQL when ordering by a filtered subquery that
    uses nulls_first or nulls_last (🎫28848).
  • Made query lookups for CICharField, CIEmailField, and CITextField
    use a citext cast (🎫28702).
  • Fixed a regression in caching of a GenericForeignKey when the referenced
    model instance uses multi-table inheritance (🎫28856).
  • Fixed "Cannot change column 'x': used in a foreign key constraint" crash on
    MySQL with a sequence of AlterField and/or RenameField operations in
    a migration (🎫28305).




November 1, 2017

Django 1.11.7 fixes several bugs in 1.11.6.


  • Prevented cache.get_or_set() from caching None if the default
    argument is a callable that returns None (🎫28601).
  • Fixed the Basque DATE_FORMAT string (🎫28710).
  • Made QuerySet.reverse() affect nulls_first and nulls_last
  • Fixed unquoted table names in Subquery SQL when using OuterRef


django-crispy-forms 1.6.1 -> 1.7.0


  • Fixes compatibility with Django 2.0
  • Various other fixes.

See 1.7 Milestone
for full issue list.

Pillow 4.3.0 -> 5.0.0


  • Docs: Added docstrings from documentation 2914
  • Test: Switch from nose to pytest 2815
  • Rework Source directory layout, preventing accidental import of PIL. 2911
  • Dynamically link libraqm 2753

  • Removed scripts directory 2901

  • TIFF: Run all compressed tiffs through libtiff decoder 2899

  • GIF: Add disposal option when saving GIFs 2902
    [linnil1, wiredfool]

  • EPS: Allow for an empty line in EPS header data 2903
  • PNG: Add support for sRGB and cHRM chunks, permit sRGB when no iCCP chunk present 2898
  • Dependencies: Update Tk Tcl to 8.6.8 2905
  • Decompression bomb error now raised for images 2x larger than a decompression bomb warning 2583
  • Test: avoid random failure in test_effect_noise 2894
  • Increased epsilon for due to Arch update. 2896
  • Removed check parameter from _save in BmpImagePlugin, PngImagePlugin, ImImagePlugin, PalmImagePlugin, and PcxImagePlugin. 2873
  • Make PngImagePlugin.add_text() zip argument type bool 2890
  • Depends: Updated libwebp to 0.6.1 2880
  • Remove unnecessary bool() calls in Image.registered_extensions and skipKnownBadTests 2891
  • Fix count of BITSPERSAMPLE items in broken TIFF files 2883
  • Fillcolor parameter for Image.Transform 2852
  • Test: Display differences for test failures 2862
  • Added executable flag to file with shebang line 2884
  • Setup: Specify compatible Python versions for pip 2877
  • Dependencies: Updated libimagequant to 2.11.4 2878
  • Setup: Warn if trying to install for Py3.7 on Windows 2855
  • Doc: Fonts can be loaded from a file-like object, not just filename 2861
  • Add eog support for Ubuntu Image Viewer 2864
  • Test: Test on 3.7-dev on 2870
  • Dependencies: Update libtiff to 4.0.9 2871
  • Setup: Replace deprecated platform.dist with file existence check 2869
  • Build: Fix on Debian 2853
  • Docs: Correct error in ImageDraw documentation 2858
  • Test: Drop Ubuntu Precise, Fedora 24, Fedora 25, add Fedora 27, Centos 7, Amazon v2 CI Support 2854, 2843, 2895, 2897
  • Dependencies: Updated libimagequant to 2.11.3 2849
  • Test: Fix to use tempfile 2841
  • Replace PIL.OleFileIO deprecation warning with descriptive ImportError 2833
  • WebP: Add support for animated WebP files 2761
  • PDF: Set encoderinfo for images when saving multi-page PDF. Fixes 2804. 2805
  • Allow the olefile dependency to be optional 2789
  • GIF: Permit LZW code lengths up to 12 bits in GIF decode 2813
  • Fix unterminiated string and unchecked exception in _font_text_asBytes. 2825
  • PPM: Use fixed list of whitespace, rather relying on locale, fixes 272. 2831
  • Added support for generators when using append_images 2829, 2835
  • Doc: Correct PixelAccess.rst 2824
  • Depends: Update raqm to 0.3.0 2822
  • Docs: Link to maintained version of aggdraw 2809
  • Include license file in the generated wheel packages 2801
  • Depends: Update openjpeg to 2.3.0 2791
  • Add option to Makefile to build and install with C coverage 2781
  • Add context manager support to ImageFile.Parser and PngImagePlugin.ChunkStream 2793
  • ImageDraw.textsize: fix zero length error 2788
    [wiredfool, hugovk]

django-allauth 0.33.0 -> 0.34.0


Security notice

  • The "Set Password" view did not properly check whether or not the user already
    had a usable password set. This allowed an attacker to set the password
    without providing the current password, but only in case the attacker already
    gained control over the victim's session.

Note worthy changes

  • New provider: Meetup.

psycopg2 ->


  • Wheel package compiled against PostgreSQL 10.0 libpq and OpenSSL 1.0.2l
    (🎟601, 602)

django-ckeditor 5.3.0 -> 5.4.0


. Django 2.0 compatibility


. Actually include the code which sets CKEDITOR_BASEPATH.

django-extensions 1.9.1 -> 1.9.8



  • Fix: show_urls, fix for Django 2.0 (Locale URL Resolvers are still broken)
  • Fix: runserver_plus, fix rendering of ipv6 link
  • Improvement: validate_templates, allow relative paths
  • Improvement: validate_templates, automatically include app templates
  • Improvement: pip_checker, could not find some packages
  • Docs: shell_plus, --print-sql usage clearification


This release add checking types with MyPy to the test suite. At this point
only a few lines of code are explicitly typed.


  • Improvement: shell_plus, Collision resolver implemented.
  • Improvement: shell_plus, Skipping all models importing feature added.
  • Improvement: runscript, Script execution directory policy feature added.
  • django-extensions now requires the typing package.


Fix boo-boo with release version in django_extensions/



  • Fix missing test case



  • Tests: shell_plus, simple test for get_imported_objects



  • Fix: mail_debug, regression in mail_debug for older Pythons
  • Fix: shell_plus, SyntaxError on exec(), python compatibility
  • Fix: ForeignKeyAutocompleteAdminMixin, use text/plain

coverage 4.4.1 -> 4.4.2


  • Support for Python 3.7. In some cases, class and module docstrings are no
    longer counted in statement totals, which could slightly change your total
  • Specifying both --source and --include no longer silently ignores the
    include setting, instead it displays a warning. Thanks, Loïc Dachary. Closes
    issue 265_ and issue 101_.
  • Fixed a race condition when saving data and multiple threads are tracing
    (issue 581_). It could produce a "dictionary changed size during iteration"
    RuntimeError. I believe this mostly but not entirely fixes the race
    condition. A true fix would likely be too expensive. Thanks, Peter Baughman
    for the debugging, and Olivier Grisel for the fix with tests.
  • Configuration values which are file paths will now apply tilde-expansion,
    closing issue 589_.
  • Now secondary config files like tox.ini and setup.cfg can be specified
    explicitly, and prefixed sections like [coverage:run] will be read. Fixes
    issue 588_.
  • Be more flexible about the command name displayed by help, fixing
    issue 600_. Thanks, Ben Finney.

.. _issue 101:
.. _issue 581:
.. _issue 588:
.. _issue 589:
.. _issue 600:

.. _changes_441:

Sphinx 1.6.4 -> 1.6.5



Features added

  • 4107: Make searchtools.js compatible with pre-Sphinx1.5 templates
  • 4112: Don't override the smart_quotes setting if it was already set
  • 4125: Display reference texts of original and translated passages on
    i18n warning message
  • 4147: Include the exception when logging PO/MO file read/write

Bugs fixed

  • 4085: Failed PDF build from image in parsed-literal using :align: option
  • 4100: Remove debug print from autodoc extension
  • 3987: Changing theme from alabaster causes HTML build to fail
  • 4096: C++, don't crash when using the wrong role type. Thanks to mitya57.
  • 4070, 4111: crashes when the warning message contains format strings (again)
  • 4108: Search word highlighting breaks SVG images
  • 3692: Unable to build HTML if writing .buildinfo failed
  • 4152: HTML writer crashes if a field list is placed on top of the document
  • 4063: Sphinx crashes when labeling directive .. todolist::
  • 4134: [doc] :file:docutils.conf is not documented explicitly
  • 4169: Chinese language doesn't trigger Chinese search automatically
  • 1020: ext.todo todolist not linking to the page in pdflatex
  • 3965: New quickstart generates wrong SPHINXBUILD in Makefile
  • 3739: :module: option is ignored at content of pyobjects
  • 4149: Documentation: Help choosing :confval:latex_engine
  • 4090: [doc] :confval:latex_additional_files with extra LaTeX macros should
    not use .tex extension
  • Failed to convert reST parser error to warning (refs: 4132)

Werkzeug 0.12.2 -> 0.14.1


Released on December 31st 2017

  • Resolved a regression with status code handling in the integrated
    development server.


Released on December 31st 2017

  • HTTP exceptions are now automatically caught by
  • Added support for edge as browser.
  • Added support for platforms that lack SpooledTemporaryFile.
  • Add support for etag handling through if-match
  • Added support for the SameSite cookie attribute.
  • Added werkzeug.wsgi.ProxyMiddleware
  • Implemented has for NullCache
  • get_multi on cache clients now returns lists all the time.
  • Improved the watchdog observer shutdown for the reloader to not crash
    on exit on older Python versions.
  • Added support for filename* filename attributes according to
    RFC 2231
  • Resolved an issue where machine ID for the reloader PIN was not
    read accurately on windows.
  • Added a workaround for syntax errors in init files in the reloader.
  • Added support for using the reloader with console scripts on windows.
  • The built-in HTTP server will no longer close a connection in cases
    where no HTTP body is expected (204, 204, HEAD requests etc.)
  • The EnvironHeaders object now skips over empty content type and
    lengths if they are set to falsy values.
  • Werkzeug will no longer send the content-length header on 1xx or
    204/304 responses.
  • Cookie values are now also permitted to include slashes and equal
    signs without quoting.
  • Relaxed the regex for the routing converter arguments.
  • If cookies are sent without values they are now assumed to have an
    empty value and the parser accepts this. Previously this could have
    corrupted cookies that followed the value.
  • The test Client and EnvironBuilder now support mimetypes like
    the request object does.
  • Added support for static weights in URL rules.
  • Better handle some more complex reloader scenarios where sys.path
    contained non directory paths.
  • EnvironHeaders no longer raises weird errors if non string keys
    are passed to it.


Released on December 7th 2017

  • Deprecate support for Python 2.6 and 3.3. CI tests will not run
    for these versions, and support will be dropped completely in the next
    version. (pallets/meta24_)
  • Raise TypeError when port is not an integer. (1088_)
  • Fully deprecate werkzeug.script. Use Click_ instead. (1090_)
  • response.age is parsed as a timedelta. Previously, it was
    incorrectly treated as a datetime. The header value is an integer
    number of seconds, not a date string. (414_)
  • Fix a bug in TypeConversionDict where errors are not propagated
    when using the converter. (1102_)
  • Authorization.qop is a string instead of a set, to comply with
    RFC 2617. (984_)
  • An exception is raised when an encoded cookie is larger than, by
    default, 4093 bytes. Browsers may silently ignore cookies larger than
    this. BaseResponse has a new attribute max_cookie_size and
    dump_cookie has a new argument max_size to configure this.
    (780, 1109)
  • Fix a TypeError in werkzeug.contrib.lint.GuardedIterator.close.
  • BaseResponse.calculate_content_length now correctly works for
    Unicode responses on Python 3. It first encodes using
    iter_encoded. (705_)
  • Secure cookie contrib works with string secret key on Python 3.
  • Shared data middleware accepts a list instead of a dict of static
    locations to preserve lookup order. (1197_)
  • HTTP header values without encoding can contain single quotes.
  • The built-in dev server supports receiving requests with chunked
    transfer encoding. (1198_)

.. _Click:
.. _pallets/meta24: pallets/meta#24
.. _414: pallets/werkzeug#414
.. _705: pallets/werkzeug#705
.. _780: pallets/werkzeug#780
.. _984: pallets/werkzeug#984
.. _1088: pallets/werkzeug#1088
.. _1090: pallets/werkzeug#1090
.. _1102: pallets/werkzeug#1102
.. _1109: pallets/werkzeug#1109
.. _1116: pallets/werkzeug#1116
.. _1197: pallets/werkzeug#1197
.. _1198: pallets/werkzeug#1198
.. _1205: pallets/werkzeug#1205
.. _1208: pallets/werkzeug#1208

django-test-plus 1.0.18 -> 1.0.21


  • The Halloween Release!
  • Fixes to CI to ensure we really test Django 2.0


  • Django 2.0 support
  • Dropped support for Python 3.3
  • Dropped support for Django < 1.8
  • Added APITestCase for better DRF testing

django-debug-toolbar 1.8 -> 1.9.1


This version is compatible with Django 2.0 and requires Django 1.8 or


  • The profiling panel now escapes reported data resulting in valid HTML.
  • Many minor cleanups and bugfixes.

flake8 3.4.1 -> 3.5.0


You can view the 3.5.0 milestone_ on GitLab for more details.

New Dependency Information

  • Allow for PyFlakes 1.6.0 (See also GitLab359_)
  • Start using new PyCodestyle checks for bare excepts and ambiguous identifier
    (See also GitLab361_)


  • Print out information about configuring VCS hooks (See also GitLab335_)
  • Allow users to develop plugins "local" to a repository without using
    setuptools. See our documentation on local plugins

pyup-bot added some commits Jan 6, 2018


This comment has been minimized.

Copy link
Contributor Author

commented Jan 13, 2018

Closing this in favor of #33

@pyup-bot pyup-bot closed this Jan 13, 2018

@Alex-Just Alex-Just deleted the pyup-scheduled-update-01-06-2018 branch Jan 13, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.