Scheduled weekly dependency update for week 26

[pyup-bot]

Update django from 2.1.7 to 2.2.3.

Changelog

2.2.3

==========================

*Expected July 1, 2019*

Django 2.2.3 fixes several bugs in 2.2.2. Also, the latest string translations
from Transifex are incorporated.

Bugfixes
========

* Fixed a regression in Django 2.2 where :class:`~django.db.models.Avg`,
:class:`~django.db.models.StdDev`, and :class:`~django.db.models.Variance`
crash with ``filter`` argument (:ticket:`30542`).

* Fixed a regression in Django 2.2.2 where auto-reloader crashes with
``AttributeError``, e.g. when using ``ipdb`` (:ticket:`30588`).


==========================

2.2.2

==========================

*June 3, 2019*

Django 2.2.2 fixes security issues and several bugs in 2.2.1.

CVE-2019-12308: AdminURLFieldWidget XSS
---------------------------------------

The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayed
the provided value without validating it as a safe URL. Thus, an unvalidated
value stored in the database, or a value provided as a URL query parameter
payload, could result in an clickable JavaScript link.

``AdminURLFieldWidget`` now validates the provided value using
:class:`~django.core.validators.URLValidator` before displaying the clickable
link. You may customize the validator by passing a ``validator_class`` kwarg to
``AdminURLFieldWidget.__init__()``, e.g. when using
:attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`.

Patched bundled jQuery for CVE-2019-11358: Prototype pollution
--------------------------------------------------------------

jQuery before 3.4.0, mishandles ``jQuery.extend(true, {}, ...)`` because of
``Object.prototype`` pollution. If an unsanitized source object contained an
enumerable ``__proto__`` property, it could extend the native
``Object.prototype``.

The bundled version of jQuery used by the Django admin has been patched to
allow for the ``select2`` library's use of ``jQuery.extend()``.

Bugfixes
========

* Fixed a regression in Django 2.2 that stopped Show/Hide toggles working on
dynamically added admin inlines (:ticket:`30459`).

* Fixed a regression in Django 2.2 where deprecation message crashes if
``Meta.ordering`` contains an expression (:ticket:`30463`).

* Fixed a regression in Django 2.2.1 where
:class:`~django.contrib.postgres.search.SearchVector` generates SQL with a
redundant ``Coalesce`` call (:ticket:`30488`).

* Fixed a regression in Django 2.2 where auto-reloader doesn't detect changes
in ``manage.py`` file when using ``StatReloader`` (:ticket:`30479`).

* Fixed crash of :class:`~django.contrib.postgres.aggregates.ArrayAgg` and
:class:`~django.contrib.postgres.aggregates.StringAgg` with ``ordering``
argument when used in a ``Subquery`` (:ticket:`30315`).

* Fixed a regression in Django 2.2 that caused a crash of auto-reloader when
an exception with custom signature is raised (:ticket:`30516`).

* Fixed a regression in Django 2.2.1 where auto-reloader unnecessarily reloads
translation files multiple times when using ``StatReloader``
(:ticket:`30523`).


==========================

2.2.1

==========================

*May 1, 2019*

Django 2.2.1 fixes several bugs in 2.2.

Bugfixes
========

* Fixed a regression in Django 2.1 that caused the incorrect quoting of
database user password when using :djadmin:`dbshell` on Oracle
(:ticket:`30307`).

* Added compatibility for ``psycopg2`` 2.8 (:ticket:`30331`).

* Fixed a regression in Django 2.2 that caused a crash when loading the
template for the technical 500 debug page (:ticket:`30324`).

* Fixed crash of ``ordering`` argument in
:class:`~django.contrib.postgres.aggregates.ArrayAgg` and
:class:`~django.contrib.postgres.aggregates.StringAgg` when it contains an
expression with params (:ticket:`30332`).

* Fixed a regression in Django 2.2 that caused a single instance fast-delete
to not set the primary key to ``None`` (:ticket:`30330`).

* Prevented :djadmin:`makemigrations` from generating infinite migrations for
check constraints and partial indexes when ``condition`` contains
a :class:`~python:range` object (:ticket:`30350`).

* Reverted an optimization in Django 2.2 (:ticket:`29725`) that caused the
inconsistent behavior of ``count()`` and ``exists()`` on a reverse
many-to-many relationship with a custom manager (:ticket:`30325`).

* Fixed a regression in Django 2.2 where
:class:`~django.core.paginator.Paginator` crashes if ``object_list`` is
a queryset ordered or aggregated over a nested ``JSONField`` key transform
(:ticket:`30335`).

* Fixed a regression in Django 2.2 where ``IntegerField`` validation of
database limits crashes if ``limit_value`` attribute in a custom validator is
callable (:ticket:`30328`).

* Fixed a regression in Django 2.2 where
:class:`~django.contrib.postgres.search.SearchVector` generates SQL that is
not indexable (:ticket:`30385`).

* Fixed a regression in Django 2.2 that caused an exception to be raised when
a custom error handler could not be imported (:ticket:`30318`).

* Relaxed the system check added in Django 2.2 for the admin app's dependencies
to reallow use of
:class:`~django.contrib.sessions.middleware.SessionMiddleware` subclasses,
rather than requiring :mod:`django.contrib.sessions` to be in
:setting:`INSTALLED_APPS` (:ticket:`30312`).

* Increased the default timeout when using ``Watchman`` to 5 seconds to prevent
falling back to ``StatReloader`` on larger projects and made it customizable
via the ``DJANGO_WATCHMAN_TIMEOUT`` environment variable (:ticket:`30361`).

* Fixed a regression in Django 2.2 that caused a crash when migrating
permissions for proxy models if the target permissions already existed. For
example, when a permission had been created manually or a model had been
migrated from concrete to proxy (:ticket:`30351`).

* Fixed a regression in Django 2.2 that caused a crash of :djadmin:`runserver`
when URLConf modules raised exceptions (:ticket:`30323`).

* Fixed a regression in Django 2.2 where changes were not reliably detected by
auto-reloader when using ``StatReloader`` (:ticket:`30323`).

* Fixed a migration crash on Oracle and PostgreSQL when adding a check
constraint with a ``contains``, ``startswith``, or ``endswith`` lookup (or
their case-insensitive variant) (:ticket:`30408`).

* Fixed a migration crash on Oracle and SQLite when adding a check constraint
with ``condition`` contains ``|`` (``OR``) operator (:ticket:`30412`).


========================

2.2

========================

*April 1, 2019*

Welcome to Django 2.2!

These release notes cover the :ref:`new features <whats-new-2.2>`, as well as
some :ref:`backwards incompatible changes <backwards-incompatible-2.2>` you'll
want to be aware of when upgrading from Django 2.1 or earlier. We've
:ref:`begun the deprecation process for some features
<deprecated-features-2.2>`.

See the :doc:`/howto/upgrade-version` guide if you're updating an existing
project.

Django 2.2 is designated as a :term:`long-term support release`. It will
receive security updates for at least three years after its release. Support
for the previous LTS, Django 1.11, will end in April 2020.

Python compatibility
====================

Django 2.2 supports Python 3.5, 3.6, and 3.7. We **highly recommend** and only
officially support the latest release of each series.

.. _whats-new-2.2:

What's new in Django 2.2
========================

Constraints
-----------

The new :class:`~django.db.models.CheckConstraint` and
:class:`~django.db.models.UniqueConstraint` classes enable adding custom
database constraints. Constraints are added to models using the
:attr:`Meta.constraints <django.db.models.Options.constraints>` option.

Minor features
--------------

:mod:`django.contrib.admin`
~~~~~~~~~~~~~~~~~~~~~~~~~~~

* Added a CSS class to the column headers of
:class:`~django.contrib.admin.TabularInline`.

:mod:`django.contrib.auth`
~~~~~~~~~~~~~~~~~~~~~~~~~~

* The ``HttpRequest`` is now passed as the first positional argument to
:meth:`.RemoteUserBackend.configure_user`, if it accepts it.

:mod:`django.contrib.gis`
~~~~~~~~~~~~~~~~~~~~~~~~~

* Added Oracle support for the
:class:`~django.contrib.gis.db.models.functions.Envelope` function.

* Added SpatiaLite support for the :lookup:`coveredby` and :lookup:`covers`
lookups.

:mod:`django.contrib.postgres`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

* The new ``ordering`` argument for
:class:`~django.contrib.postgres.aggregates.ArrayAgg` and
:class:`~django.contrib.postgres.aggregates.StringAgg` determines the
ordering of the aggregated elements.

* The new :class:`~django.contrib.postgres.indexes.BTreeIndex`,
:class:`~django.contrib.postgres.indexes.HashIndex` and
:class:`~django.contrib.postgres.indexes.SpGistIndex` classes allow
creating ``B-Tree``, ``hash``, and ``SP-GiST`` indexes in the database.

* :class:`~django.contrib.postgres.indexes.BrinIndex` now has the
``autosummarize`` parameter.

* The new ``search_type`` parameter of
:class:`~django.contrib.postgres.search.SearchQuery` allows searching for
a phrase or raw expression.

:mod:`django.contrib.staticfiles`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

* Added path matching to the :option:`collectstatic --ignore` option so that
patterns like ``/vendor/*.js`` can be used.

Database backends
~~~~~~~~~~~~~~~~~

* Added result streaming for :meth:`.QuerySet.iterator` on SQLite.

Generic Views
~~~~~~~~~~~~~

* The new :meth:`View.setup <django.views.generic.base.View.setup>` hook
initializes view attributes before calling
:meth:`~django.views.generic.base.View.dispatch`. It allows mixins to setup
instance attributes for reuse in child classes.

Internationalization
~~~~~~~~~~~~~~~~~~~~

* Added support and translations for the Armenian language.

Management Commands
~~~~~~~~~~~~~~~~~~~

* The new :option:`--force-color` option forces colorization of the command
output.

* :djadmin:`inspectdb` now creates models for foreign tables on PostgreSQL.

* :option:`inspectdb --include-views` now creates models for materialized views
on Oracle and PostgreSQL.

* The new :option:`inspectdb --include-partitions` option allows creating
models for partition tables on PostgreSQL. In older versions, models are
created child tables instead the parent.

* :djadmin:`inspectdb` now introspects :class:`~django.db.models.DurationField`
for Oracle and PostgreSQL, and :class:`~django.db.models.AutoField` for
SQLite.

* On Oracle, :djadmin:`dbshell` is wrapped with ``rlwrap``, if available.
``rlwrap`` provides a command history and editing of keyboard input.

* The new :option:`makemigrations --no-header` option avoids writing header
comments in generated migration file(s). This option is also available for
:djadmin:`squashmigrations`.

* :djadmin:`runserver` can now use `Watchman
<https://facebook.github.io/watchman/>`_ to improve the performance of
watching a large number of files for changes.

Migrations
~~~~~~~~~~

* The new :option:`migrate --plan` option prints the list of migration
operations that will be performed.

* ``NoneType`` can now be serialized in migrations.

* You can now :ref:`register custom serializers <custom-migration-serializers>`
for migrations.

Models
~~~~~~

* Added support for PostgreSQL operator classes (:attr:`.Index.opclasses`).

* Added support for partial indexes (:attr:`.Index.condition`).

* Added the :class:`~django.db.models.functions.NullIf` and
:class:`~django.db.models.functions.Reverse` database functions, as well as
many :ref:`math database functions <math-functions>`.

* Setting the new ``ignore_conflicts`` parameter of
:meth:`.QuerySet.bulk_create` to ``True`` tells the database to ignore
failure to insert rows that fail uniqueness constraints or other checks.

* The new :class:`~django.db.models.functions.ExtractIsoYear` function extracts
ISO-8601 week-numbering years from :class:`~django.db.models.DateField` and
:class:`~django.db.models.DateTimeField`, and the new :lookup:`iso_year`
lookup allows querying by an ISO-8601 week-numbering year.

* The new :meth:`.QuerySet.bulk_update` method allows efficiently updating
specific fields on multiple model instances.

* Django no longer always starts a transaction when a single query is being
performed, such as ``Model.save()``, ``QuerySet.update()``, and
``Model.delete()``. This improves the performance of autocommit by reducing
the number of database round trips.

* Added SQLite support for the :class:`~django.db.models.StdDev` and
:class:`~django.db.models.Variance` functions.

* The handling of ``DISTINCT`` aggregation is added to the
:class:`~django.db.models.Aggregate` class. Adding :attr:`allow_distinct =
True <django.db.models.Aggregate.allow_distinct>` as a class attribute on
``Aggregate`` subclasses allows a ``distinct`` keyword argument to be
specified on initialization to ensure that the aggregate function is only
called for each distinct value of ``expressions``.

* The :meth:`.RelatedManager.add`, :meth:`~.RelatedManager.create`,
:meth:`~.RelatedManager.remove`,  :meth:`~.RelatedManager.set`,
``get_or_create()``, and ``update_or_create()`` methods are now allowed on
many-to-many relationships with intermediate models. The new
``through_defaults`` argument is used to specify values for new intermediate
model instance(s).

Requests and Responses
~~~~~~~~~~~~~~~~~~~~~~

* Added :attr:`.HttpRequest.headers` to allow simple access to a request's
headers.

Serialization
~~~~~~~~~~~~~

* You can now deserialize data using natural keys containing :ref:`forward
references <natural-keys-and-forward-references>` by passing
``handle_forward_references=True`` to ``serializers.deserialize()``.
Additionally, :djadmin:`loaddata` handles forward references automatically.

Tests
~~~~~

* The new :meth:`.SimpleTestCase.assertURLEqual` assertion checks for a given
URL, ignoring the ordering of the query string.
:meth:`~.SimpleTestCase.assertRedirects` uses the new assertion.

* The test :class:`~.django.test.Client` now supports automatic JSON
serialization of list and tuple ``data`` when
``content_type='application/json'``.

* The new :setting:`ORACLE_MANAGED_FILES <TEST_ORACLE_MANAGED_FILES>` test
database setting allows using Oracle Managed Files (OMF) tablespaces.

* Deferrable database constraints are now checked at the end of each
:class:`~django.test.TestCase` test on SQLite 3.20+, just like on other
backends that support deferrable constraints. These checks aren't implemented
for older versions of SQLite because they would require expensive table
introspection there.

* :class:`~django.test.runner.DiscoverRunner` now skips the setup of databases
not :ref:`referenced by tests<testing-multi-db>`.

URLs
~~~~

* The new :attr:`.ResolverMatch.route` attribute stores the route of the
matching URL pattern.

Validators
~~~~~~~~~~

* :class:`.MaxValueValidator`, :class:`.MinValueValidator`,
:class:`.MinLengthValidator`, and :class:`.MaxLengthValidator` now accept
a callable ``limit_value``.

.. _backwards-incompatible-2.2:

Backwards incompatible changes in 2.2
=====================================

Database backend API
--------------------

This section describes changes that may be needed in third-party database
backends.

* Third-party database backends must implement support for table check
constraints or set ``DatabaseFeatures.supports_table_check_constraints`` to
``False``.

* Third party database backends must implement support for ignoring
constraints or uniqueness errors while inserting or set
``DatabaseFeatures.supports_ignore_conflicts`` to ``False``.

* Third party database backends must implement introspection for
``DurationField`` or set ``DatabaseFeatures.can_introspect_duration_field``
to ``False``.

* ``DatabaseFeatures.uses_savepoints`` now defaults to ``True``.

* Third party database backends must implement support for partial indexes or
set ``DatabaseFeatures.supports_partial_indexes`` to ``False``.

* ``DatabaseIntrospection.table_name_converter()`` and
``column_name_converter()`` are removed. Third party database backends may
need to instead implement ``DatabaseIntrospection.identifier_converter()``.
In that case, the constraint names that
``DatabaseIntrospection.get_constraints()`` returns must be normalized by
``identifier_converter()``.

* SQL generation for indexes is moved from :class:`~django.db.models.Index` to
``SchemaEditor`` and these ``SchemaEditor`` methods are added:

* ``_create_primary_key_sql()`` and ``_delete_primary_key_sql()``
* ``_delete_index_sql()`` (to pair with ``_create_index_sql()``)
* ``_delete_unique_sql`` (to pair with ``_create_unique_sql()``)
* ``_delete_fk_sql()`` (to pair with ``_create_fk_sql()``)
* ``_create_check_sql()`` and ``_delete_check_sql()``

* The third argument of ``DatabaseWrapper.__init__()``,
``allow_thread_sharing``, is removed.

Admin actions are no longer collected from base ``ModelAdmin`` classes
----------------------------------------------------------------------

For example, in older versions of Django::

 from django.contrib import admin

 class BaseAdmin(admin.ModelAdmin):
     actions = ['a']

 class SubAdmin(BaseAdmin):
     actions = ['b']

``SubAdmin`` would have actions ``'a'`` and ``'b'``.

Now ``actions`` follows standard Python inheritance. To get the same result as
before::

 class SubAdmin(BaseAdmin):
     actions = BaseAdmin.actions + ['b']

:mod:`django.contrib.gis`
-------------------------

* Support for GDAL 1.9 and 1.10 is dropped.

``TransactionTestCase`` serialized data loading
-----------------------------------------------

Initial data migrations are now loaded in
:class:`~django.test.TransactionTestCase` at the end of the test, after the
database flush. In older versions, this data was loaded at the beginning of the
test, but this prevents the :option:`test --keepdb` option from working
properly (the database was empty at the end of the whole test suite). This
change shouldn't have an impact on your tests unless you've customized
:class:`~django.test.TransactionTestCase`'s internals.

``sqlparse`` is required dependency
-----------------------------------

To simplify a few parts of Django's database handling, `sqlparse
<https://pypi.org/project/sqlparse/>`_ is now a required dependency. It's
automatically installed along with Django.

``cached_property`` aliases
---------------------------

In usage like::

 from django.utils.functional import cached_property

 class A:

     cached_property
     def base(self):
         return ...

     alias = base

``alias`` is not cached. Where the problem can be detected (Python 3.6 and
later), such usage now raises ``TypeError: Cannot assign the same
cached_property to two different names ('base' and 'alias').``

Use this instead::

 import operator

 class A:

     ...

     alias = property(operator.attrgetter('base'))

Permissions for proxy models
----------------------------

:ref:`Permissions for proxy models <proxy-models-permissions-topic>` are now
created using the content type of the proxy model rather than the content type
of the concrete model. A migration will update existing permissions when you
run :djadmin:`migrate`.

In the admin, the change is transparent for proxy models having the same
``app_label`` as their concrete model. However, in older versions, users with
permissions for a proxy model with a *different* ``app_label`` than its
concrete model couldn't access the model in the admin. That's now fixed, but
you might want to audit the permissions assignments for such proxy models
(``[add|view|change|delete]_myproxy``) prior to upgrading to ensure the new
access is appropriate.

Finally, proxy model permission strings must be updated to use their own
``app_label``. For example, for ``app.MyProxyModel`` inheriting from
``other_app.ConcreteModel``, update
``user.has_perm('other_app.add_myproxymodel')`` to
``user.has_perm('app.add_myproxymodel')``.

Merging of form ``Media`` assets
--------------------------------

Form ``Media`` assets are now merged using a topological sort algorithm, as the
old pairwise merging algorithm is insufficient for some cases. CSS and
JavaScript files which don't include their dependencies may now be sorted
incorrectly (where the old algorithm produced results correctly by
coincidence).

Audit all ``Media`` classes for any missing dependencies. For example,
widgets depending on ``django.jQuery`` must specify
``js=['admin/js/jquery.init.js', ...]`` when :ref:`declaring form media assets
<assets-as-a-static-definition>`.

Miscellaneous
-------------

* To improve readability, the ``UUIDField`` form field now displays values with
dashes, e.g. ``550e8400-e29b-41d4-a716-446655440000`` instead of
``550e8400e29b41d4a716446655440000``.

* On SQLite, ``PositiveIntegerField`` and ``PositiveSmallIntegerField`` now
include a check constraint to prevent negative values in the database. If you
have existing invalid data and run a migration that recreates a table, you'll
see ``CHECK constraint failed``.

* For consistency with WSGI servers, the test client now sets the
``Content-Length`` header to a string rather than an integer.

* The return value of :func:`django.utils.text.slugify` is no longer marked as
HTML safe.

* The default truncation character used by the :tfilter:`urlizetrunc`,
:tfilter:`truncatechars`, :tfilter:`truncatechars_html`,
:tfilter:`truncatewords`, and :tfilter:`truncatewords_html` template filters
is now the real ellipsis character (``…``) instead of 3 dots. You may have to
adapt some test output comparisons.

* Support for bytestring paths in the template filesystem loader is removed.

* :func:`django.utils.http.urlsafe_base64_encode` now returns a string instead
of a bytestring, and :func:`django.utils.http.urlsafe_base64_decode` may no
longer be passed a bytestring.

* Support for ``cx_Oracle`` < 6.0 is removed.

* The minimum supported version of ``mysqlclient`` is increased from 1.3.7 to
1.3.13.

* The minimum supported version of SQLite is increased from 3.7.15 to 3.8.3.

* In an attempt to provide more semantic query data, ``NullBooleanSelect`` now
renders ``<option>`` values of ``unknown``, ``true``, and ``false`` instead
of ``1``, ``2``, and ``3``. For backwards compatibility, the old values are
still accepted as data.

* :attr:`Group.name <django.contrib.auth.models.Group.name>` ``max_length``
is increased from 80 to 150 characters.

* Tests that violate deferrable database constraints now error when run on
SQLite 3.20+, just like on other backends that support such constraints.

* To catch usage mistakes, the test :class:`~django.test.Client` and
:func:`django.utils.http.urlencode` now raise ``TypeError`` if ``None`` is
passed as a value to encode because ``None`` can't be encoded in GET and POST
data. Either pass an empty string or omit the value.

* The :djadmin:`ping_google` management command now defaults to ``https``
instead of ``http`` for the sitemap's URL. If your site uses http, use the
new :option:`ping_google --sitemap-uses-http` option. If you use the
:func:`~django.contrib.sitemaps.ping_google` function, set the new
``sitemap_uses_https`` argument to ``False``.

* :djadmin:`runserver` no longer supports `pyinotify` (replaced by Watchman).

* The :class:`~django.db.models.Avg`, :class:`~django.db.models.StdDev`, and
:class:`~django.db.models.Variance` aggregate functions now return a
``Decimal`` instead of a ``float`` when the input is ``Decimal``.

* Tests will fail on SQLite if apps without migrations have relations to apps
with migrations. This has been a documented restriction since migrations were
added in Django 1.7, but it fails more reliably now. You'll see tests failing
with errors like ``no such table: <app_label>_<model>``. This was observed
with several third-party apps that had models in tests without migrations.
You must add migrations for such models.

.. _deprecated-features-2.2:

Features deprecated in 2.2
==========================

Model ``Meta.ordering`` will no longer affect ``GROUP BY`` queries
------------------------------------------------------------------

A model's ``Meta.ordering`` affecting ``GROUP BY`` queries (such as
``.annotate().values()``) is a common source of confusion. Such queries now
issue a deprecation warning with the advice to add an ``order_by()`` to retain
the current query. ``Meta.ordering`` will be ignored in such queries starting
in Django 3.1.

Miscellaneous
-------------

* ``django.utils.timezone.FixedOffset`` is deprecated in favor of
:class:`datetime.timezone`.

* The undocumented ``QuerySetPaginator`` alias of
``django.core.paginator.Paginator`` is deprecated.

* The ``FloatRangeField`` model and form fields in ``django.contrib.postgres``
are deprecated in favor of a new name, ``DecimalRangeField``, to match the
underlying ``numrange`` data type used in the database.

* The ``FILE_CHARSET`` setting is deprecated. Starting with Django 3.1, files
read from disk must be UTF-8 encoded.

* ``django.contrib.staticfiles.storage.CachedStaticFilesStorage`` is
deprecated due to the intractable problems that it has. Use
:class:`.ManifestStaticFilesStorage` or a third-party cloud storage instead.

* :meth:`.RemoteUserBackend.configure_user` is now passed ``request`` as the
first positional argument, if it accepts it. Support for overrides that don't
accept it will be removed in Django 3.1.

* The :attr:`.SimpleTestCase.allow_database_queries`,
:attr:`.TransactionTestCase.multi_db`, and :attr:`.TestCase.multi_db`
attributes are deprecated in favor of :attr:`.SimpleTestCase.databases`,
:attr:`.TransactionTestCase.databases`, and :attr:`.TestCase.databases`.
These new attributes allow databases dependencies to be declared in order to
prevent unexpected queries against non-default databases to leak state
between tests. The previous behavior of ``allow_database_queries=True`` and
``multi_db=True`` can be achieved by setting ``databases='__all__'``.


===========================

2.1.10

===========================

*July 1, 2019*

Django 2.1.10 fixes a security issue in 2.1.9.


============================

2.1.9

============================

*June 3, 2019*

Django 2.1.9 fixes security issues in 2.1.8.

CVE-2019-12308: AdminURLFieldWidget XSS
---------------------------------------

The clickable "Current URL" link generated by ``AdminURLFieldWidget`` displayed
the provided value without validating it as a safe URL. Thus, an unvalidated
value stored in the database, or a value provided as a URL query parameter
payload, could result in an clickable JavaScript link.

``AdminURLFieldWidget`` now validates the provided value using
:class:`~django.core.validators.URLValidator` before displaying the clickable
link. You may customize the validator by passing a ``validator_class`` kwarg to
``AdminURLFieldWidget.__init__()``, e.g. when using
:attr:`~django.contrib.admin.ModelAdmin.formfield_overrides`.

Patched bundled jQuery for CVE-2019-11358: Prototype pollution
--------------------------------------------------------------

jQuery before 3.4.0, mishandles ``jQuery.extend(true, {}, ...)`` because of
``Object.prototype`` pollution. If an unsanitized source object contained an
enumerable ``__proto__`` property, it could extend the native
``Object.prototype``.

The bundled version of jQuery used by the Django admin has been patched to
allow for the ``select2`` library's use of ``jQuery.extend()``.


==========================

2.1.8

==========================

*April 1, 2019*

Django 2.1.8 fixes a bug in 2.1.7.

Bugfixes
========

* Prevented admin inlines for a ``ManyToManyField``\'s implicit through model
from being editable if the user only has the view permission
(:ticket:`30289`).


==========================

Links

• PyPI: https://pypi.org/project/django
• Changelog: https://pyup.io/changelogs/django/
• Homepage: https://www.djangoproject.com/

Update django-htmlmin from 0.10.0 to 0.11.0.

Changelog

0.11.0

support Django 1.11 and Django 2

Links

• PyPI: https://pypi.org/project/django-htmlmin
• Changelog: https://pyup.io/changelogs/django-htmlmin/

Update django-ckeditor from 5.6.1 to 5.7.1.

Changelog

5.7.1

-----

5.7.0

-----
. Fix Django 1.8 - 1.10 regression

Links

• PyPI: https://pypi.org/project/django-ckeditor
• Changelog: https://pyup.io/changelogs/django-ckeditor/
• Repo: https://github.com/django-ckeditor/django-ckeditor

Update Pillow from 5.4.1 to 6.0.0.

Changelog

6.0.0

------------------

- Python 2.7 support will be removed in Pillow 7.0.0 3682
[hugovk]

- Add EXIF class 3625
[radarhere]

- Add ImageOps exif_transpose method 3687
[radarhere]

- Added warnings to deprecated CMSProfile attributes 3615
[hugovk]

- Documented reading TIFF multiframe images 3720
[akuchling]

- Improved speed of opening an MPO file 3658
[Glandos]

- Update palette in quantize 3721
[radarhere]

- Improvements to TIFF is_animated and n_frames 3714
[radarhere]

- Fixed incompatible pointer type warnings 3754
[radarhere]

- Improvements to PA and LA conversion and palette operations 3728
[radarhere]

- Consistent DPI rounding 3709
[radarhere]

- Change size of MPO image to match frame 3588
[radarhere]

- Read Photoshop resolution data 3701
[radarhere]

- Ensure image is mutable before saving 3724
[radarhere]

- Correct remap_palette documentation 3740
[radarhere]

- Promote P images to PA in putalpha 3726
[radarhere]

- Allow RGB and RGBA values for new P images 3719
[radarhere]

- Fixed TIFF bug when seeking backwards and then forwards 3713
[radarhere]

- Cache EXIF information 3498
[Glandos]

- Added transparency for all PNG greyscale modes 3744
[radarhere]

- Fix deprecation warnings in Python 3.8 3749
[radarhere]

- Fixed GIF bug when rewinding to a non-zero frame 3716
[radarhere]

- Only close original fp in __del__ and __exit__ if original fp is exclusive 3683
[radarhere]

- Fix BytesWarning in Tests/test_numpy.py 3725
[jdufresne]

- Add missing MIME types and extensions 3520
[pirate486743186]

- Add I;16 PNG save 3566
[radarhere]

- Add support for BMP RGBA bitfield compression 3705
[radarhere]

- Added ability to set language for text rendering 3693
[iwsfutcmd]

- Only close exclusive fp on Image __exit__ 3698
[radarhere]

- Changed EPS subprocess stdout from devnull to None 3635
[radarhere]

- Add reading old-JPEG compressed TIFFs 3489
[kkopachev]

- Add EXIF support for PNG 3674
[radarhere]

- Add option to set dither param on quantize 3699
[glasnt]

- Add reading of DDS uncompressed RGB data 3673
[radarhere]

- Correct length of Tiff BYTE tags 3672
[radarhere]

- Add DIB saving and loading through Image open 3691
[radarhere]

- Removed deprecated VERSION 3624
[hugovk]

- Fix 'BytesWarning: Comparison between bytes and string' in PdfDict 3580
[jdufresne]

- Do not resize in Image.thumbnail if already the destination size 3632
[radarhere]

- Replace .seek() magic numbers with io.SEEK_* constants 3572
[jdufresne]

- Make ContainerIO.isatty() return a bool, not int 3568
[jdufresne]

- Add support to all transpose operations for I;16 modes 3563, 3741
[radarhere]

- Deprecate support for PyQt4 and PySide 3655
[hugovk, radarhere]

- Add TIFF compression codecs: LZMA, Zstd, WebP 3555
[cgohlke]

- Fixed pickling of iTXt class with protocol > 1 3537
[radarhere]

- _util.isPath returns True for pathlib.Path objects 3616
[wbadart]

- Remove unnecessary unittest.main() boilerplate from test files 3631
[jdufresne]

- Exif: Seek to IFD offset 3584
[radarhere]

- Deprecate PIL.*ImagePlugin.__version__ attributes 3628
[jdufresne]

- Docs: Add note about ImageDraw operations that exceed image bounds 3620
[radarhere]

- Allow for unknown PNG chunks after image data 3558
[radarhere]

- Changed EPS subprocess stdin from devnull to None 3611
[radarhere]

- Fix possible integer overflow 3609
[cgohlke]

- Catch BaseException for resource cleanup handlers 3574
[jdufresne]

- Improve pytest configuration to allow specific tests as CLI args 3579
[jdufresne]

- Drop support for Python 3.4 3596
[hugovk]

- Remove deprecated PIL.OleFileIO 3598
[hugovk]

- Remove deprecated ImageOps undocumented functions 3599
[hugovk]

- Depends: Update libwebp to 1.0.2 3602
[radarhere]

- Detect MIME types 3525
[radarhere]

Links

• PyPI: https://pypi.org/project/pillow
• Changelog: https://pyup.io/changelogs/pillow/
• Homepage: http://python-pillow.org

Update ptvsd from 4.2.4 to 4.2.10.

Changelog

4.2.10

Enhancements:
* Support for Visual Studio F11/F5. 1387

Bug Fixes:
* No longer switch off getpass on import. 988
* Fixes a crash on evaluate request. 1401
* Fix a issue with running no-debug. 1408
* Fixes a hang in Visual Studio. 1413
* Fixes issue with forwarding sys.stdin.read(). 1423
* Remove sys.prefix form library roots. 1422

4.2.9

Bug Fixes:
* Fix warning shown in python 3.8. 1374
* Fix hang when editing dictionary values in VS. 1385

4.2.9b

Bug Fixes:
* Fix warning shown in python 3.8. 1374
* Fix hang when editing dictionary values in VS. 1385

4.2.8

Bug fixes:
* Path mapping bug fixes. 1311, 1325
* Fix for hang when using debug console. 1326
* Fix for set next statement. 1358
* Fix for multi-threading. 1361

4.2.8b1

Bug fixes:
* Path mapping bug fixes. 1311, 1325 
* Fix for hang when using debug console. 1326
* Fix for set next statement. 1358  
* Fix for multi-threading. 1361

4.2.7

Enhancements:
* Add setting to limit number of lines in stack for exception details. 582

Bug Fixes:
* Various fixes for django templates. 1276, 1289, 1294 
* Fix for module name conflict while debugging with -m. 1307

Community contributed bug fixes:
* Don't fail in DictResolver when there are more items than MAX_ITEMS_TO_HANDLE. 1301 by baek9
* Fix single quote issue during process attach. by martinRenou

4.2.6

Bug fixes:
* Fix issue with expanding variables in watch window and hover. 1277, 1273
* Fix issue with launching a sub-module. 1272

4.2.5

Enhancements:
* Set Next Statement. 18
* Provide option to enable logging. 890

Bug Fixes:
* Subprocess arguments incorrectly escaped. 1227
* Fix issues with django and jinja2 exceptions. 694, 1181
* Detaching sometimes throws ValueError. 1165
* StackTrace request respecting just-my-code. 1187
* Don't give error redirecting output with pythonw. 1023
* Fix for stop on entry issue. 1159

Links

• PyPI: https://pypi.org/project/ptvsd
• Changelog: https://pyup.io/changelogs/ptvsd/
• Homepage: https://aka.ms/ptvs

Update autopep8 from 1.4.3 to 1.4.4.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/autopep8
• Changelog: https://pyup.io/changelogs/autopep8/
• Repo: https://github.com/hhatto/autopep8

Update coverage from 4.5.2 to 4.5.3.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/coverage
• Changelog: https://pyup.io/changelogs/coverage/
• Repo: https://github.com/nedbat/coveragepy

Update coveralls from 1.6.0 to 1.8.1.

Changelog

1.8.1

Bug Fixes

* **dependencies:**  pin `coverage` to `< 5.0`, since the current `5.0` alphas are
                  introducing breaking changes. Once `5.0` is stable, we'll
                  remove the pin.

<a name="1.8.0"></a>

1.8.0

Features

* **flag:**  allow disabling SSL verification ([2e3b5c61](2e3b5c61))

Bug Fixes

* **git:**  fix support for case where git binary is missing ([5bbceaae](5bbceaae))

<a name="1.7.0"></a>

1.7.0

Features

* **api:**  support pull requests on buildkite (197) ([2700e3e2](2700e3e2))

Bug Fixes

* **cli:**  ensure upload failures trigger cli failures ([16192b84](16192b84))

<a name="1.6.0"></a>

Links

• PyPI: https://pypi.org/project/coveralls
• Changelog: https://pyup.io/changelogs/coveralls/
• Repo: http://github.com/coveralls-clients/coveralls-python

Update pre-commit from 1.14.4 to 1.17.0.

Changelog

1.17.0

===================

Features
- Produce better output on `^C`
 - 1030 PR by asottile.
- Warn on unknown keys at the top level and repo level
 - 1028 PR by yoavcaspi.
 - 1048 PR by asottile.

Fixes
- Fix handling of `^C` in wrapper script in python 3.x
 - 1027 PR by asottile.
- Fix `rmtree` for non-writable directories
 - 1042 issue by detailyang.
 - 1043 PR by asottile.
- Pass `--color` option to `git diff` in `--show-diff-on-failure`
 - 1007 issue by chadrik.
 - 1051 PR by mandarvaze.

Misc.
- Fix test when `pre-commit` is installed globally
 - 1032 issue by yoavcaspi.
 - 1045 PR by asottile.

1.16.1

===================

Fixes
- Don't `UnicodeDecodeError` on unexpected non-UTF8 output in python health
check on windows.
 - 1021 issue by nicoddemus.
 - 1022 PR by asottile.

1.16.0

===================

Features
- Add support for `prepare-commit-msg` hook
 - 1004 PR by marcjay.

Fixes
- Fix repeated legacy `pre-commit install` on windows
 - 1010 issue by AbhimanyuHK.
 - 1011 PR by asottile.
- Whitespace fixup
 - 1014 PR by mxr.
- Fix CI check for working pcre support
 - 1015 PR by Myrheimb.

Misc.
- Switch CI from travis / appveyor to azure pipelines
 - 1012 PR by asottile.

1.15.2

===================

Fixes
- Fix cloning non-branch tag while in the fallback slow-clone strategy.
 - 997 issue by jpinner.
 - 998 PR by asottile.

1.15.1

===================

Fixes
- Fix command length calculation on posix when `SC_ARG_MAX` is not defined.
 - 691 issue by ushuz.
 - 987 PR by asottile.

1.15.0

===================

Features
- No longer require being in a `git` repo to run `pre-commit` `clean` / `gc` /
`sample-config`.
 - 959 PR by asottile.
- Improve command line length limit detection.
 - 691 issue by antonbabenko.
 - 966 PR by asottile.
- Use shallow cloning when possible.
 - 958 PR by DanielChabrowski.
- Add `minimum_pre_commit_version` top level key to require a new-enough
version of `pre-commit`.
 - 977 PR by asottile.
- Add helpful CI-friendly message when running
`pre-commit run --all-files --show-diff-on-failure`.
- 982 PR by bnorquist.

Fixes
- Fix `try-repo` for staged untracked changes.
 - 973 PR by DanielChabrowski.
- Fix rpm build by explicitly using `!/usr/bin/env python3` in hook template.
 - 985 issue by tim77.
 - 986 PR by tim77.
- Guard against infinite recursion when executing legacy hook script.
 - 981 PR by tristan0x.

Misc
- Add test for `git.no_git_env()`
 - 972 PR by javabrett.

Links

• PyPI: https://pypi.org/project/pre-commit
• Changelog: https://pyup.io/changelogs/pre-commit/
• Repo: https://github.com/pre-commit/pre-commit

Update tox from 3.7.0 to 3.13.1.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/tox
• Docs: http://tox.readthedocs.org

Update pytest from 4.3.0 to 5.0.0.

Changelog

5.0.0

=========================

Important
---------

This release is a Python3.5+ only release.

For more details, see our `Python 2.7 and 3.4 support plan <https://docs.pytest.org/en/latest/py27-py34-deprecation.html>`__.

Removals
--------

- `1149 <https://github.com/pytest-dev/pytest/issues/1149>`_: Pytest no longer accepts prefixes of command-line arguments, for example
typing ``pytest --doctest-mod`` inplace of ``--doctest-modules``.
This was previously allowed where the ``ArgumentParser`` thought it was unambiguous,
but this could be incorrect due to delayed parsing of options for plugins.
See for example issues `1149 <https://github.com/pytest-dev/pytest/issues/1149>`__,
`3413 <https://github.com/pytest-dev/pytest/issues/3413>`__, and
`4009 <https://github.com/pytest-dev/pytest/issues/4009>`__.


- `5402 <https://github.com/pytest-dev/pytest/issues/5402>`_: **PytestDeprecationWarning are now errors by default.**

Following our plan to remove deprecated features with as little disruption as
possible, all warnings of type ``PytestDeprecationWarning`` now generate errors
instead of warning messages.

**The affected features will be effectively removed in pytest 5.1**, so please consult the
`Deprecations and Removals <https://docs.pytest.org/en/latest/deprecations.html>`__
section in the docs for directions on how to update existing code.

In the pytest ``5.0.X`` series, it is possible to change the errors back into warnings as a stop
gap measure by adding this to your ``pytest.ini`` file:

.. code-block:: ini

   [pytest]
   filterwarnings =
       ignore::pytest.PytestDeprecationWarning

But this will stop working when pytest ``5.1`` is released.

**If you have concerns** about the removal of a specific feature, please add a
comment to `5402 <https://github.com/pytest-dev/pytest/issues/5402>`__.


- `5412 <https://github.com/pytest-dev/pytest/issues/5412>`_: ``ExceptionInfo`` objects (returned by ``pytest.raises``) now have the same ``str`` representation as ``repr``, which
avoids some confusion when users use ``print(e)`` to inspect the object.



Deprecations
------------

- `4488 <https://github.com/pytest-dev/pytest/issues/4488>`_: The removal of the ``--result-log`` option and module has been postponed to (tentatively) pytest 6.0 as
the team has not yet got around to implement a good alternative for it.


- `466 <https://github.com/pytest-dev/pytest/issues/466>`_: The ``funcargnames`` attribute has been an alias for ``fixturenames`` since
pytest 2.3, and is now deprecated in code too.



Features
--------

- `3457 <https://github.com/pytest-dev/pytest/issues/3457>`_: New `pytest_assertion_pass <https://docs.pytest.org/en/latest/reference.html_pytest.hookspec.pytest_assertion_pass>`__
hook, called with context information when an assertion *passes*.

This hook is still **experimental** so use it with caution.


- `5440 <https://github.com/pytest-dev/pytest/issues/5440>`_: The `faulthandler <https://docs.python.org/3/library/faulthandler.html>`__ standard library
module is now enabled by default to help users diagnose crashes in C modules.

This functionality was provided by integrating the external
`pytest-faulthandler <https://github.com/pytest-dev/pytest-faulthandler>`__ plugin into the core,
so users should remove that plugin from their requirements if used.

For more information see the docs: https://docs.pytest.org/en/latest/usage.htmlfault-handler


- `5452 <https://github.com/pytest-dev/pytest/issues/5452>`_: When warnings are configured as errors, pytest warnings now appear as originating from ``pytest.`` instead of the internal ``_pytest.warning_types.`` module.


- `5125 <https://github.com/pytest-dev/pytest/issues/5125>`_: ``Session.exitcode`` values are now coded in ``pytest.ExitCode``, an ``IntEnum``. This makes the exit code available for consumer code and are more explicit other than just documentation. User defined exit codes are still valid, but should be used with caution.

The team doesn't expect this change to break test suites or plugins in general, except in esoteric/specific scenarios.

**pytest-xdist** users should upgrade to ``1.29.0`` or later, as ``pytest-xdist`` required a compatibility fix because of this change.



Bug Fixes
---------

- `1403 <https://github.com/pytest-dev/pytest/issues/1403>`_: Switch from ``imp`` to ``importlib``.


- `1671 <https://github.com/pytest-dev/pytest/issues/1671>`_: The name of the ``.pyc`` files cached by the assertion writer now includes the pytest version
to avoid stale caches.


- `2761 <https://github.com/pytest-dev/pytest/issues/2761>`_: Honor PEP 235 on case-insensitive file systems.


- `5078 <https://github.com/pytest-dev/pytest/issues/5078>`_: Test module is no longer double-imported when using ``--pyargs``.


- `5260 <https://github.com/pytest-dev/pytest/issues/5260>`_: Improved comparison of byte strings.

When comparing bytes, the assertion message used to show the byte numeric value when showing the differences::

       def test():
   >       assert b'spam' == b'eggs'
   E       AssertionError: assert b'spam' == b'eggs'
   E         At index 0 diff: 115 != 101
   E         Use -v to get the full diff

It now shows the actual ascii representation instead, which is often more useful::

       def test():
   >       assert b'spam' == b'eggs'
   E       AssertionError: assert b'spam' == b'eggs'
   E         At index 0 diff: b's' != b'e'
   E         Use -v to get the full diff


- `5335 <https://github.com/pytest-dev/pytest/issues/5335>`_: Colorize level names when the level in the logging format is formatted using
'%(levelname).Xs' (truncated fixed width alignment), where X is an integer.


- `5354 <https://github.com/pytest-dev/pytest/issues/5354>`_: Fix ``pytest.mark.parametrize`` when the argvalues is an iterator.


- `5370 <https://github.com/pytest-dev/pytest/issues/5370>`_: Revert unrolling of ``all()`` to fix ``NameError`` on nested comprehensions.


- `5371 <https://github.com/pytest-dev/pytest/issues/5371>`_: Revert unrolling of ``all()`` to fix incorrect handling of generators with ``if``.


- `5372 <https://github.com/pytest-dev/pytest/issues/5372>`_: Revert unrolling of ``all()`` to fix incorrect assertion when using ``all()`` in an expression.


- `5383 <https://github.com/pytest-dev/pytest/issues/5383>`_: ``-q`` has again an impact on the style of the collected items
(``--collect-only``) when ``--log-cli-level`` is used.


- `5389 <https://github.com/pytest-dev/pytest/issues/5389>`_: Fix regressions of `5063 <https://github.com/pytest-dev/pytest/pull/5063>`__ for ``importlib_metadata.PathDistribution`` which have their ``files`` attribute being ``None``.


- `5390 <https://github.com/pytest-dev/pytest/issues/5390>`_: Fix regression where the ``obj`` attribute of ``TestCase`` items was no longer bound to methods.


- `5404 <https://github.com/pytest-dev/pytest/issues/5404>`_: Emit a warning when attempting to unwrap a broken object raises an exception,
for easier debugging (`5080 <https://github.com/pytest-dev/pytest/issues/5080>`__).


- `5432 <https://github.com/pytest-dev/pytest/issues/5432>`_: Prevent "already imported" warnings from assertion rewriter when invoking pytest in-process multiple times.


- `5433 <https://github.com/pytest-dev/pytest/issues/5433>`_: Fix assertion rewriting in packages (``__init__.py``).


- `5444 <https://github.com/pytest-dev/pytest/issues/5444>`_: Fix ``--stepwise`` mode when the first file passed on the command-line fails to collect.


- `5482 <https://github.com/pytest-dev/pytest/issues/5482>`_: Fix bug introduced in 4.6.0 causing collection errors when passing
more than 2 positional arguments to ``pytest.mark.parametrize``.


- `5505 <https://github.com/pytest-dev/pytest/issues/5505>`_: Fix crash when discovery fails while using ``-p no:terminal``.



Improved Documentation
----------------------

- `5315 <https://github.com/pytest-dev/pytest/issues/5315>`_: Expand docs on mocking classes and dictionaries with ``monkeypatch``.


- `5416 <https://github.com/pytest-dev/pytest/issues/5416>`_: Fix PytestUnknownMarkWarning in run/skip example.

4.6.4

=========================

Bug Fixes
---------

- `5404 <https://github.com/pytest-dev/pytest/issues/5404>`_: Emit a warning when attempting to unwrap a broken object raises an exception,
for easier debugging (`5080 <https://github.com/pytest-dev/pytest/issues/5080>`__).


- `5444 <https://github.com/pytest-dev/pytest/issues/5444>`_: Fix ``--stepwise`` mode when the first file passed on the command-line fails to collect.


- `5482 <https://github.com/pytest-dev/pytest/issues/5482>`_: Fix bug introduced in 4.6.0 causing collection errors when passing
more than 2 positional arguments to ``pytest.mark.parametrize``.


- `5505 <https://github.com/pytest-dev/pytest/issues/5505>`_: Fix crash when discovery fails while using ``-p no:terminal``.

4.6.3

=========================

Bug Fixes
---------

- `5383 <https://github.com/pytest-dev/pytest/issues/5383>`_: ``-q`` has again an impact on the style of the collected items
(``--collect-only``) when ``--log-cli-level`` is used.


- `5389 <https://github.com/pytest-dev/pytest/issues/5389>`_: Fix regressions of `5063 <https://github.com/pytest-dev/pytest/pull/5063>`__ for ``importlib_metadata.PathDistribution`` which have their ``files`` attribute being ``None``.


- `5390 <https://github.com/pytest-dev/pytest/issues/5390>`_: Fix regression where the ``obj`` attribute of ``TestCase`` items was no longer bound to methods.

4.6.2

=========================

Bug Fixes
---------

- `5370 <https://github.com/pytest-dev/pytest/issues/5370>`_: Revert unrolling of ``all()`` to fix ``NameError`` on nested comprehensions.


- `5371 <https://github.com/pytest-dev/pytest/issues/5371>`_: Revert unrolling of ``all()`` to fix incorrect handling of generators with ``if``.


- `5372 <https://github.com/pytest-dev/pytest/issues/5372>`_: Revert unrolling of ``all()`` to fix incorrect assertion when using ``all()`` in an expression.

4.6.1

=========================

Bug Fixes
---------

- `5354 <https://github.com/pytest-dev/pytest/issues/5354>`_: Fix ``pytest.mark.parametrize`` when the argvalues is an iterator.


- `5358 <https://github.com/pytest-dev/pytest/issues/5358>`_: Fix assertion rewriting of ``all()`` calls to deal with non-generators.

4.6.0

=========================

Important
---------

The ``4.6.X`` series will be the last series to support **Python 2 and Python 3.4**.

For more details, see our `Python 2.7 and 3.4 support plan <https://docs.pytest.org/en/latest/py27-py34-deprecation.html>`__.


Features
--------

- `4559 <https://github.com/pytest-dev/pytest/issues/4559>`_: Added the ``junit_log_passing_tests`` ini value which can be used to enable or disable logging of passing test output in the Junit XML file.


- `4956 <https://github.com/pytest-dev/pytest/issues/4956>`_: pytester's ``testdir.spawn`` uses ``tmpdir`` as HOME/USERPROFILE directory.


- `5062 <https://github.com/pytest-dev/pytest/issues/5062>`_: Unroll calls to ``all`` to full for-loops with assertion rewriting for better failure messages, especially when using Generator Expressions.


- `5063 <https://github.com/pytest-dev/pytest/issues/5063>`_: Switch from ``pkg_resources`` to ``importlib-metadata`` for entrypoint detection for improved performance and import time.


- `5091 <https://github.com/pytest-dev/pytest/issues/5091>`_: The output for ini options in ``--help`` has been improved.


- `5269 <https://github.com/pytest-dev/pytest/issues/5269>`_: ``pytest.importorskip`` includes the ``ImportError`` now in the default ``reason``.


- `5311 <https://github.com/pytest-dev/pytest/issues/5311>`_: Captured logs that are output for each failing test are formatted using the
ColoredLevelFormatter.


- `5312 <https://github.com/pytest-dev/pytest/issues/5312>`_: Improved formatting of multiline log messages in Python 3.



Bug Fixes
---------

- `2064 <https://github.com/pytest-dev/pytest/issues/2064>`_: The debugging plugin imports the wrapped ``Pdb`` class (``--pdbcls``) on-demand now.


- `4908 <https://github.com/pytest-dev/pytest/issues/4908>`_: The ``pytest_enter_pdb`` hook gets called with post-mortem (``--pdb``).


- `5036 <https://github.com/pytest-dev/pytest/issues/5036>`_: Fix issue where fixtures dependent on other parametrized fixtures would be erroneously parametrized.


- `5256 <https://github.com/pytest-dev/pytest/issues/5256>`_: Handle internal error due to a lone surrogate unicode character not being representable in Jython.


- `5257 <https://github.com/pytest-dev/pytest/issues/5257>`_: Ensure that ``sys.stdout.mode`` does not include ``'b'`` as it is a text stream.


- `5278 <https://github.com/pytest-dev/pytest/issues/5278>`_: Pytest's internal python plugin can be disabled using ``-p no:python`` again.


- `5286 <https://github.com/pytest-dev/pytest/issues/5286>`_: Fix issue with ``disable_test_id_escaping_and_forfeit_all_rights_to_community_support`` option not working when using a list of test IDs in parametrized tests.


- `5330 <https://github.com/pytest-dev/pytest/issues/5330>`_: Show the test module being collected when emitting ``PytestCollectionWarning`` messages for
test classes with ``__init__`` and ``__new__`` methods to make it easier to pin down the problem.


- `5333 <https://github.com/pytest-dev/pytest/issues/5333>`_: Fix regression in 4.5.0 with ``--lf`` not re-running all tests with known failures from non-selected tests.



Improved Documentation
----------------------

- `5250 <https://github.com/pytest-dev/pytest/issues/5250>`_: Expand docs on use of ``setenv`` and ``delenv`` with ``monkeypatch``.

4.5.0

=========================

Features
--------

- `4826 <https://github.com/pytest-dev/pytest/issues/4826>`_: A warning is now emitted when unknown marks are used as a decorator.
This is often due to a typo, which can lead to silently broken tests.


- `4907 <https://github.com/pytest-dev/pytest/issues/4907>`_: Show XFail reason as part of JUnitXML message field.


- `5013 <https://github.com/pytest-dev/pytest/issues/5013>`_: Messages from crash reports are displayed within test summaries now, truncated to the terminal width.


- `5023 <https://github.com/pytest-dev/pytest/issues/5023>`_: New flag ``--strict-markers`` that triggers an error when unknown markers (e.g. those not registered using the `markers option`_ in the configuration file) are used in the test suite.

The existing ``--strict`` option has the same behavior currently, but can be augmented in the future for additional checks.

.. _`markers option`: https://docs.pytest.org/en/latest/reference.htmlconfval-markers


- `5026 <https://github.com/pytest-dev/pytest/issues/5026>`_: Assertion failure messages for sequences and dicts contain the number of different items now.


- `5034 <https://github.com/pytest-dev/pytest/issues/5034>`_: Improve reporting with ``--lf`` and ``--ff`` (run-last-failure).


- `5035 <https://github.com/pytest-dev/pytest/issues/5035>`_: The ``--cache-show`` option/action accepts an optional glob to show only matching cache entries.


- `5059 <https://github.com/pytest-dev/pytest/issues/5059>`_: Standard input (stdin) can be given to pytester's ``Testdir.run()`` and ``Testdir.popen()``.


- `5068 <https://github.com/pytest-dev/pytest/issues/5068>`_: The ``-r`` option learnt about ``A`` to display all reports (including passed ones) in the short test summary.


- `5108 <https://github.com/pytest-dev/pytest/issues/5108>`_: The short test summary is displayed after passes with output (``-rP``).


- `5172 <https://github.com/pytest-dev/pytest/issues/5172>`_: The ``--last-failed`` (``--lf``) option got smarter and will now skip entire files if all tests
of that test file have passed in previous runs, greatly speeding up collection.


- `5177 <https://github.com/pytest-dev/pytest/issues/5177>`_: Introduce new specific warning ``PytestWarning`` subclasses to make it easier to filter warnings based on the class, rather than on the message. The new subclasses are:


* ``PytestAssertRewriteWarning``

* ``PytestCacheWarning``

* ``PytestCollectionWarning``

* ``PytestConfigWarning``

* ``PytestUnhandledCoroutineWarning``

* ``PytestUnknownMarkWarning``


- `5202 <https://github.com/pytest-dev/pytest/issues/5202>`_: New ``record_testsuite_property`` session-scoped fixture allows users to log ``<property>`` tags at the ``testsuite``
level with the ``junitxml`` plugin.

The generated XML is compatible with the latest xunit standard, contrary to
the properties recorded by ``record_property`` and ``record_xml_attribute``.


- `5214 <https://github.com/pytest-dev/pytest/issues/5214>`_: The default logging format has been changed to improve readability. Here is an
example of a previous logging message::

   test_log_cli_enabled_disabled.py    3 CRITICAL critical message logged by test

This has now become::

   CRITICAL root:test_log_cli_enabled_disabled.py:3 critical message logged by test

The formatting can be changed through the `log_format <https://docs.pytest.org/en/latest/reference.htmlconfval-log_format>`__ configuration option.


- `5220 <https://github.com/pytest-dev/pytest/issues/5220>`_: ``--fixtures`` now also shows fixture scope for scopes other than ``"function"``.



Bug Fixes
---------

- `5113 <https://github.com/pytest-dev/pytest/issues/5113>`_: Deselected items from plugins using ``pytest_collect_modifyitems`` as a hookwrapper are correctly reported now.


- `5144 <https://github.com/pytest-dev/pytest/issues/5144>`_: With usage errors ``exitstatus`` is set to ``EXIT_USAGEERROR`` in the ``pytest_sessionfinish`` hook now as expected.


- `5235 <https://github.com/pytest-dev/pytest/issues/5235>`_: ``outcome.exit`` is not used with ``EOF`` in the pdb wrapper anymore, but only with ``quit``.



Improved Documentation
----------------------

- `4935 <https://github.com/pytest-dev/pytest/issues/4935>`_: Expand docs on registering marks and the effect of ``--strict``.



Trivial/Internal Changes
------------------------

- `4942 <https://github.com/pytest-dev/pytest/issues/4942>`_: ``logging.raiseExceptions`` is not set to ``False`` anymore.


- `5013 <https://github.com/pytest-dev/pytest/issues/5013>`_: pytest now depends on `wcwidth <https://pypi.org/project/wcwidth>`__ to properly track unicode character sizes for more precise terminal output.


- `5059 <https://github.com/pytest-dev/pytest/issues/5059>`_: pytester's ``Testdir.popen()`` uses ``stdout`` and ``stderr`` via keyword arguments with defaults now (``subprocess.PIPE``).


- `5069 <https://github.com/pytest-dev/pytest/issues/5069>`_: The code for the short test summary in the terminal was moved to the terminal plugin.


- `5082 <https://github.com/pytest-dev/pytest/issues/5082>`_: Improved validation of kwargs for various methods in the pytester plugin.


- `5202 <https://github.com/pytest-dev/pytest/issues/5202>`_: ``record_property`` now emits a ``PytestWarning`` when used with ``junit_family=xunit2``: the fixture generates
``property`` tags as children of ``testcase``, which is not permitted according to the most
`recent schema <https://github.com/jenkinsci/xunit-plugin/blob/master/
src/main/resources/org/jenkinsci/plugins/xunit/types/model/xsd/junit-10.xsd>`__.


- `5239 <https://github.com/pytest-dev/pytest/issues/5239>`_: Pin ``pluggy`` to ``< 1.0`` so we don't update to ``1.0`` automatically when
it gets released: there are planned breaking changes, and we want to ensure
pytest properly supports ``pluggy 1.0``.

4.4.2

=========================

Bug Fixes
---------

- `5089 <https://github.com/pytest-dev/pytest/issues/5089>`_: Fix crash caused by error in ``__repr__`` function with both ``showlocals`` and verbose output enabled.


- `5139 <https://github.com/pytest-dev/pytest/issues/5139>`_: Eliminate core dependency on 'terminal' plugin.


- `5229 <https://github.com/pytest-dev/pytest/issues/5229>`_: Require ``pluggy>=0.11.0`` which reverts a dependency to ``importlib-metadata`` added in ``0.10.0``.
The ``importlib-metadata`` package cannot be imported when installed as an egg and causes issues when relying on ``setup.py`` to install test dependencies.



Improved Documentation
----------------------

- `5171 <https://github.com/pytest-dev/pytest/issues/5171>`_: Doc: ``pytest_ignore_collect``, ``pytest_collect_directory``, ``pytest_collect_file`` and ``pytest_pycollect_makemodule`` hooks's 'path' parameter documented type is now ``py.path.local``


- `5188 <https://github.com/pytest-dev/pytest/issues/5188>`_: Improve help for ``--runxfail`` flag.



Trivial/Internal Changes
------------------------

- `5182 <https://github.com/pytest-dev/pytest/issues/5182>`_: Removed internal and unused ``_pytest.deprecated.MARK_INFO_ATTRIBUTE``.

4.4.1

=========================

Bug Fixes
---------

- `5031 <https://github.com/pytest-dev/pytest/issues/5031>`_: Environment variables are properly restored when using pytester's ``testdir`` fixture.


- `5039 <https://github.com/pytest-dev/pytest/issues/5039>`_: Fix regression with ``--pdbcls``, which stopped working with local modules in 4.0.0.


- `5092 <https://github.com/pytest-dev/pytest/issues/5092>`_: Produce a warning when unknown keywords are passed to ``pytest.param(...)``.


- `5098 <https://github.com/pytest-dev/pytest/issues/5098>`_: Invalidate import caches with ``monkeypatch.syspath_prepend``, which is required with namespace packages being used.

4.4.0

=========================

Features
--------

- `2224 <https://github.com/pytest-dev/pytest/issues/2224>`_: ``async`` test functions are skipped and a warning is emitted when a suitable
async plugin is not installed (such as ``pytest-asyncio`` or ``pytest-trio``).

Previously ``async`` functions would not execute at all but still be marked as "passed".


- `2482 <https://github.com/pytest-dev/pytest/issues/2482>`_: Include new ``disable_test_id_escaping_and_forfeit_all_rights_to_community_support`` option to disable ascii-escaping in parametrized values. This ma