GeezerVison

What's Changed

Bug fixes

• Restore order_by_precedence from 3.18.1 to fix broken return value by @browniebroke in #10066

Full Changelog: 3.18.2...3.18.3

Contributors

What's Changed

Security

• GHSA-33wh-fxxf-88vv: Harden content negotiation against large Accept headers by @jisung-02 in 148ab65. Thanks @jisung-02 for the report.
• GHSA-3547-9m27-7rxg: Refuse non-text encoding charsets by @syrull in 3c26345. Thanks @syrull and @jisung-02 who both reported the problem.
• GHSA-xw6w-gcfp-cf8m: Make TokenProxy deletion actually delete the token by @syrull in af3fabf. Thanks @syrull for the report.

Features

• Add support for Python 3.15 by @p-r-a-v-i-n in #10025

Bug fixes

• Fix blank=True fields in unique constraints being treated as required by @MehrazRumman in #10039
• Fix UniqueConstraint validation with conditional fields by @majidkhazaei in #10021

New Contributors

• @olitreadwell made their first contribution in #10038
• @majidkhazaei made their first contribution in #10021
• @rblotsky made their first contribution in #10045
• @mrchatam made their first contribution in #10042
• @haimingZZ made their first contribution in #10052
• @jisung-02 made their first contribution in 148ab65
• @syrull made their first contribution in 3c26345

Full Changelog: 3.18.1...3.18.2

Contributors

What's Changed

Bug fixes

• Fix duplicate validation errors for GenericIPAddressField with protocol by @browniebroke in #10011
• Fix int64 format detection for negative IntegerField minimums in OpenAPI schema definition by @zainnadeem786 in #9989
• Fix list serializer on unique constraint validator by @MehrazRumman in #10033
• Reject non-finite values (nan, inf) in FloatField by @winklemad in #9998

Other changes

• Add a compatibility setting for ListSerializer error formats by @Kub-AT in #10027
• Expand deprecation classes and review deprecation policy by @browniebroke in #10034

New Contributors

• @abidaliamanat9 made their first contribution in #10028
• @epuronta made their first contribution in #10030
• @Kub-AT made their first contribution in #10027
• @winklemad made their first contribution in #9998

Full Changelog: 3.18.0...3.18.1

Contributors

What's Changed

Breaking changes

• Drop support for Django 4.2, Django 5.0 and Django 5.1 by @p-r-a-v-i-n in #9899
• Change errors for list serializers (many=True) to dict format by @p-r-a-v-i-n in #9837

Features

• Add unaccent to SearchFilter by @mgaligniana in #9385
• Add support for Django 6.1 by @browniebroke in #10003
• Add @throttle_scope function based view decorator by @d-ryzhykau in #9963
• Add nulls_distinct support to UniqueTogetherValidator by @mag123c in #9866

Bug fixes

• Include choices param for non-editable fields by @ticosax in #9929
• Improve cursor pagination template accessibility in browsable API by @kosbemrunal in #9905
• Fix partial form data updates involving ListField by @Natgho in #9902
• Fix crash due to browsable API extra action permissions by @dlfoerster in #9934
• Handle unhashable BooleanField representation value by @emfpdlzj in #9973
• Fix OpenAPI schema for zero numeric bounds on ListField children by @zainnadeem786 in #9977
• Replace cc_delim_re usage with split_header_value for Django 6.1+ compatibility by @laymonage in #9978
• Fix set_rollback to only rollback initialized connections by @jdetaeye in #9599
• Fix DictField HTML input returning empty dict for missing fields by @veeceey in #9891
• Raise clear error for unsupported unique-together list updates by @zainnadeem786 in #9981

Other changes

• Prepare release 3.18.0 by @github-actions[bot] in #10015

New Contributors

• @Im-Bilal made their first contribution in #9967
• @dlfoerster made their first contribution in #9934
• @emfpdlzj made their first contribution in #9973
• @zainnadeem786 made their first contribution in #9977
• @laymonage made their first contribution in #9978
• @harshitkandpal made their first contribution in #9993
• @udit-prabhakar made their first contribution in #9962
• @sai09111995 made their first contribution in #9884
• @d-ryzhykau made their first contribution in #9963
• @Elkasitu made their first contribution in #8494
• @vishalanandl177 made their first contribution in #10002
• @jdetaeye made their first contribution in #9599
• @veeceey made their first contribution in #9891
• @mag123c made their first contribution in #9866
• @anurag12anu made their first contribution in #9814
• @github-actions[bot] made their first contribution in #10015

Full Changelog: 3.17.1...3.18.0

Contributors

What's Changed

Bug fixes

• Fix disclosure of GET-protected data in case of validation error with AdminRenderer by @browniebroke in #10012. Thanks, @zainnadeem786 for the report.
• Enforce DATA_UPLOAD_MAX_MEMORY_SIZE for request.data parsing by @zainnadeem786 in #10013. Thanks, @zainnadeem786 for the report.

Full Changelog: 3.17.1...3.17.2

Contributors

What's Changed

Bug fixes

• Fix HTMLFormRenderer with empty datetime values by @p-r-a-v-i-n in #9928

Full Changelog: 3.17.0...3.17.1

Contributors

What's Changed

Breaking changes

• Drop support for Python 3.9 by @auvipy in #9781
• Drop deprecated coreapi support by @browniebroke in #9895

Features

• Add ability to specify output format for DurationField by @sevdog in #8532
• Add missing decorators: @versioning_class(), @content_negotiation_class(), @metadata_class() for function-based views by @qqii in #9719
• Add support for Python 3.14 by @cclauss in #9780
• Support violation_error_code and violation_error_message from UniqueConstraint in UniqueTogetherValidator by @s-aleshin in #9766
• Add support for ipaddress objects in JSONEncoder by @corenting in #9087
• Add optional support to serialize BigInteger to string by @HoodyH in #9775
• Add Django 6.0 support by @MehrazRumman in #9819

Bug fixes

• Prevent small risk of Token overwrite by @mahdirahimi1999 in #9754
• Fix UniqueTogetherValidator validation when condition references a read-only field by @ticosax in #9764
• Fix validation on many to many field when default=None by @Genarito in #9790
• Fix invalid SPDX license expression in __init__.py by @TheFunctionalGuy in #9799
• Fix HTMLFormRenderer to ensure a valid datetime-local format by @mgaligniana in #9365
• Fix mutable default arguments in OrderingFilter methods by @killerdevildog in #9742
• Update TokenAdmin to respect USERNAME_FIELD of the user model by @m000 in #9836
• Preserve ordering in MultipleChoiceField by @fbozhang in #9735

Translations

• Update French translation by @SebCorbin in #9770
• Update Brazilian Portuguese translations by @JVPinheiroReis in #9828
• Fix and improve French translations by @deronnax in #9896
• Add missing Russian translation by @minorytanaka in #9903

Packaging

• Migrate packaging to pyproject.toml by @deronnax in #9056
• Move package data rules from MANIFEST.in to pyproject.toml by @p-r-a-v-i-n in #9825
• Set up release workflow with trusted publisher by @browniebroke in #9852

Other changes

• Refactor token generation to use the secrets module by @mahdirahimi1999 in #9760
• Add validation for decorator out-of-order with @api_view by @kernelshard in #9821
• Switch to mkdocs material theme for documentation by @browniebroke in #9849

New Contributors

• @khaledsukkar2 made their first contribution in #9717
• @qqii made their first contribution in #9719
• @zankoAn made their first contribution in #9788
• @uche-wealth made their first contribution in #9795
• @s-aleshin made their first contribution in #9766
• @Infamous003 made their first contribution in #9794
• @Genarito made their first contribution in #9790
• @TheFunctionalGuy made their first contribution in #9799
• @mahdighadiriii made their first contribution in #9800
• @p-r-a-v-i-n made their first contribution in #9801
• @itssimon made their first contribution in #9718
• @huynguyengl99 made their first contribution in #9785
• @corenting made their first contribution in #9087
• @killerdevildog made their first contribution in #9742
• @dayandavid made their first contribution in #9820
• @abhishektiwari made their first contribution in #9826
• @HoodyH made their first contribution in #9775
• @Shrikantgiri25 made their first contribution in #9808
• @JVPinheiroReis made their first contribution in #9828
• @m000 made their first contribution in #9836
• @Nabute made their first contribution in #9767
• @therealjozber made their first contribution in #9845
• @nexapytech made their first contribution in #9867
• @RispaJoseph made their first contribution in #9874
• @LorenzoGuideri made their first contribution in #9875
• @maldoinc made their first contribution in #9893
• @0Nafi0 made their first contribution in #9861
• @MoeSalah1999 made their first contribution in #9870
• @kelsonbrito50 made their first contribution in #9901
• @fbozhang made their first contribution in #9735
• @minorytanaka made their first contribution in #9903
• @kosbemrunal made their first contribution in #9904
• @htvictoire made their first contribution in #9916

Full Changelog: 3.16.1...3.17.0

Contributors

This release fixes a few bugs, clean-up some old code paths for unsupported Python versions and improve translations.

Minor changes

• Cleanup optional backports.zoneinfo dependency and conditions on unsupported Python 3.8 and lower in #9681. Python versions prior to 3.9 were already unsupported so this isn't considered as a breaking change.

Bug fixes

• Fix regression in unique_together validation with SerializerMethodField in #9712
• Fix UniqueTogetherValidator to handle fields with source attribute in #9688
• Drop HTML line breaks on long headers in browsable API in #9438

Translations

• Add Kazakh locale support in #9713
• Update translations for Korean translations in #9571
• Update German translations in #9676
• Update Chinese translations in #9675
• Update Arabic translations-sal in #9595
• Update Persian translations in #9576
• Update Spanish translations in #9701
• Update Turkish Translations in #9749
• Fix some typos in Brazilian Portuguese translations in #9673

Documentation

• Removed reference to GitHub Issues and Discussions in #9660
• Add drf-restwind and update outdated images in browsable-api.md in #9680
• Updated funding page to represent current scope in #9686
• Fix broken Heroku JSON Schema link in #9693
• Update Django documentation links to use stable version in #9698
• Expand docs on unique constraints cause 'required=True' in #9725
• Revert extension back from djangorestframework-guardian2 to djangorestframework-guardian in #9734
• Add note to tutorial about required request in serializer context when using HyperlinkedModelSerializer in #9732

Internal changes

• Update GitHub Actions to use Ubuntu 24.04 for testing in #9677
• Update test matrix to use Django 5.2 stable version in #9679
• Add pyupgrade to pre-commit hooks in #9682
• Fix test with Django 5 when pytz is available in #9715

New Contributors

• @araggohnxd made their first contribution in #9673
• @mbeijen made their first contribution in #9660
• @stefan6419846 made their first contribution in #9676
• @ren000thomas made their first contribution in #9675
• @ulgens made their first contribution in #9682
• @bukh-sal made their first contribution in #9595
• @rezatn0934 made their first contribution in #9576
• @Rohit10jr made their first contribution in #9693
• @kushibayev made their first contribution in #9713
• @alihassancods made their first contribution in #9732
• @kulikjak made their first contribution in #9715
• @Natgho made their first contribution in #9749

Full Changelog: 3.16.0...3.16.1

Contributors

This release is considered a significant release to improve upstream support with Django and Python. Some of these may change the behaviour of existing features and pre-existing behaviour. Specifically, some fixes were added to around the support of UniqueConstraint with nullable fields which will improve built-in serializer validation.

Features

• Add official support for Django 5.1 and its new LoginRequiredMiddleware in #9514 and #9657
• Add official Django 5.2a1 support in #9634
• Add support for Python 3.13 in #9527 and #9556
• Support Django 2.1+ test client JSON data automatically serialized in #6511 and fix a regression in #9615

Bug fixes

• Fix unique together validator to respect condition's fields from UniqueConstraint in #9360
• Fix raising on nullable fields part of UniqueConstraint in #9531
• Fix unique_together validation with source in #9482
• Added protections to AttributeError raised within properties in #9455
• Fix get_template_context to handle also lists in #9467
• Fix "Converter is already registered" deprecation warning. in #9512
• Fix noisy warning and accept integers as min/max values of DecimalField in #9515
• Fix usages of open() in setup.py in #9661

Translations

• Add some missing Chinese translations in #9505
• Fix spelling mistakes in Farsi language were corrected in #9521
• Fixing and adding missing Brazilian Portuguese translations in #9535

Removals

• Remove support for Python 3.8 in #9670
• Remove long deprecated code from request wrapper in #9441
• Remove deprecated AutoSchema._get_reference method in #9525

Documentation and internal changes

• Provide tests for hashing of OperandHolder in #9437
• Update documentation: Add adrf third party package in #9198
• Update tutorials links in Community contributions docs in #9476
• Fix usage of deprecated Django function in example from docs in #9509
• Move path converter docs into a separate section in #9524
• Add test covering update view without queryset attribute in #9528
• Fix Transifex link in #9541
• Fix example httpie call in docs in #9543
• Fix example for serializer field with choices in docs in #9563
• Remove extra <> in validators example in #9590
• Update strftime link in the docs in #9624
• Switch to codecov GHA in #9618
• Add note regarding availability of the action attribute in 'Introspecting ViewSet actions' docs section in #9633
• Improved description of allowed throttling rates in documentation in #9640
• Add rest-framework-gm2m-relations package to the list of 3rd party libraries in #9063
• Fix a number of typos in the test suite in the docs in #9662
• Add django-pyoidc as a third party authentication library in #9667

New Contributors

• @maerteijn made their first contribution in #9198
• @FraCata00 made their first contribution in #9444
• @AlvaroVega made their first contribution in #9451
• @james-mchugh made their first contribution in #9455
• @ifeanyidavid made their first contribution in #9479
• @p-schlickmann made their first contribution in #9480
• @akkuman made their first contribution in #9505
• @rafaelgramoschi made their first contribution in #9509
• @Sinaatkd made their first contribution in #9521
• @gtkacz made their first contribution in #9535
• @sliverc made their first contribution in #9556
• @gabrielromagnoli1987 made their first contribution in #9543
• @cheehong1030 made their first contribution in #9563
• @amansharma612 made their first contribution in #9590
• @Gluroda made their first contribution in #9616
• @deepakangadi made their first contribution in #9624
• @EXG1O made their first contribution in #9633
• @decadenza made their first contribution in #9640
• @mojtabaakbari221b made their first contribution in #9063
• @mikemanger made their first contribution in #9661
• @gbip made their first contribution in #9667

Full Changelog: 3.15.2...3.16.0

What's Changed

• Add @api_view example to caching documentation by @BradWells in #9131
• Update docstring by @jthevos in #9340
• Apply black formatting to caching markdown by @jthevos in #9341
• Update renderers documentation example by @mgaligniana in #9362
• Removing live examples of tutorial code that are no longer hosted by @TGoddessana in #9363
• Docs: Remove an unnecessary step from quickstart.md by @Gogowitsch in #9387
• Documentation: Add Python 3.12 to the requirements by @Szaroslav in #9382
• Tweak README.md links. by @tomchristie in #9375
• Revert "Ensure CursorPagination respects nulls in the ordering field" by @max-muoto in #9381
• use warnings rather than logging a warning for DecimalField warnings by @terencehonles in #9367
• 20240426 docs by @peterthomassen in #9392
• Cleanup by @peterthomassen in #9393
• tests: Check urlpatterns after cleanups by @stanislavlevin in #9400
• docs: Correct some evaluation results and a httpie option in Tutorial1 by @wkwkhautbois in #9421
• Add __hash__ method for permissions.OperandHolder class by @vanya909 in #9417
• Fix potential XSS vulnerability in break_long_headers template filter by @ch4n3-yoon in #9435
• Version 3.15.2. by @tomchristie in #9439

New Contributors

• @BradWells made their first contribution in #9131
• @jthevos made their first contribution in #9340
• @Gogowitsch made their first contribution in #9387
• @Szaroslav made their first contribution in #9382
• @wkwkhautbois made their first contribution in #9421
• @ch4n3-yoon made their first contribution in #9435

Full Changelog: 3.15.1...3.15.2

Contributors