v1.2.8

Fixed

• A model held in a container prints as its text when a filter prints the whole container. {{ rows|pprint }} and {{ rows|json_script:"x" }} over a list, tuple, QuerySet or dict holding models now write each model's str(), as {{ rows }} does, on every entry (LiveView state, DjustTemplateBackend lists, tuples and QuerySets), instead of the model's serialized mapping. pprint writes [Account:a1, Account:a2] (Django writes the repr()); json_script writes ["Account:a1", "Account:a2"] through the usual escaping (Django raises TypeError). A named read ({{ r.name }}), {{ rows }}, |length, an ordinary dict and the data itself (get_state(), the snapshot) are unchanged. To hand a model's fields to JavaScript, pass a plain dict of the fields you want (not the output of normalize_django_value, which carries a __str__ text). Needs the rebuilt _rust module.
• A model is not a mapping to a template. On a model held in LiveView state or in a container, {{ r.items }}, {{ r.values }} and {{ r.keys }} resolve to nothing (a bare {{ r.items }} prints nothing on most entries, and the text dict_items([]) (dict_keys([]), dict_values([])) on LiveView for a list, QuerySet or top-level model and for QuerySet rows on DjustTemplateBackend, where Django prints nothing; no entry is ever printed), {% for k in r %}, |unordered_list, |safeseq and |escapeseq refuse the model as Django does (|join returns the model's text), and |stringformat:"(name)s", {% if 'name' in r %} / not in (both take the else branch) and |pluralize treat it as the non-mapping Django does, instead of reading the map the model was serialized to. A named read ({{ r.name }}) is unchanged. The sinks go by the full identity shape a serializer stamps (__str__, __model__ and pk), and a model whose __str__ is a SafeString is recognised like any other; a dict from user data that only carries a __str__ key stays a dict (views, iteration, pprint, json_script), while {{ d }} and |length of it keep going by the __str__ text as before. Needs the rebuilt _rust module.

Full Changelog: v1.2.7...v1.2.8

Security

• GHSA-gg2v-v5mp-jx42 (Low): the Fixed entries "A model held in a container prints as its text…" and "A model is not a mapping to a template" close this advisory. A model held in a container was written in full by pprint and json_script, and its mapping was iterable from a template. Upgrade to this release; the fix is in the compiled extension. Affected: >= 1.0.7, < 1.2.8.