6.3.0

• OTP_VALID_WINDOW (default 1): steps accepted on each side of the current one when OTPAuth verifies a 30 s TOTP code, as RFC 6238 recommends. Until now the direct TOTP and the non-mail paths used pyotp's default of 0, so a correct code typed around the 30 s step boundary was refused; the OTP by email keeps its own window of one 5 minute step. Set it to 0 to keep the old behaviour. - System check codenerix.E006: a view routed by ROOT_URLCONF that derives from GenList with haystack = True while django-haystack is not installed. 6.2.0 made the extra optional, and such a view passed manage.py check and answered 500 (ImproperlyConfigured) on its first request. The package is probed with importlib.util.find_spec, never imported by the check; views that are not routed are not reported. - System check codenerix.E007: a HAYSTACK_CONNECTIONS entry whose ENGINE starts with codenerix.contrib., removed in 6.2.0. With django-haystack still installed that configuration passes check and raises ModuleNotFoundError: No module named 'codenerix.contrib' on the first search, and on every model save with a realtime signal processor. A project that keeps "haystack" in INSTALLED_APPS after the package is gone cannot be reported by any check: Django stops while populating the apps, before the checks run.

• manage.py migrate_uuids refuses with a CommandError the target that would break UUID columns on the connected database, before running anything: --target 36 where Django stores UUIDs as 32 hex characters (MySQL, MariaDB < 10.7: dashed values would never match a lookup) and --target 32 where it stores dashed values (MariaDB >= 10.7, has_native_uuid_field: every write would fail with "Data too long"). It used to accept both on any MySQL-family database.

• manage.py migrate_uuids prints, with the plan, the size of every table it would rebuild (information_schema.TABLES, rows and data plus index length) and the free space of the server's data directory (@@datadir) when that directory is on the host running the command, since ALTER ... MODIFY copies each table next to the original. With --execute it refuses to start when the free space is below the sum of those sizes, unless --skip-space-check is given; in dry-run and when the data directory is on another host it only prints what to check. With MariaDB's innodb_alter_copy_bulk ON (the 11.x default) the copy also builds the indexes through a merge-sort file in innodb_tmpdir (tmpdir by default) of about the size of the table being rebuilt, so that directory is checked too, against the largest table, with the same refusal rule; the message gives SET GLOBAL innodb_alter_copy_bulk=OFF as the alternative (row-by-row copy, no merge file). On a tmpfs /tmp that file fills the RAM and the ALTER aborts after writing gigabytes, leaving the table untouched. New --disable-copy-bulk: with --execute, runs SET GLOBAL innodb_alter_copy_bulk=OFF before the rebuilds and =ON afterwards (also when a statement fails), and refuses to start, naming the manual SET GLOBAL, when the database user lacks the privilege (SUPER); the variable has no session scope, so the change applies to every session of the server meanwhile, and a process killed before the restore leaves it off until it is set by hand or the server restarts. The option sends nothing when the variable is already OFF or does not exist (MySQL, MariaDB before 10.11.9), and nothing in dry-run.

• codenerix.E003 and the debug gate accept a project middleware that derives from both codenerix.debug_middleware.UpdateCacheMiddleware and codenerix.debug_middleware.FetchFromCacheMiddleware by multiple inheritance: it bypasses debug requests on both halves, but 6.1.0 compared it against codenerix.debug_middleware.CacheMiddleware only, reported it and switched the debug tools off. Each half is now checked on its own.

• Since 6.1.0, with a debug tool installed, manage.py check and the first request to a debug tool import every entry of MIDDLEWARE to classify the page cache middlewares. Django imports them itself when it builds the handler, so the cost is nil, but check and migrate did not import project middlewares before. An entry that fails to import is treated as not a page cache and left to Django's own error.