309 sections across all versions Narrow to Django 6.0 (current) →
Release notes Django 1.4 release notes
Some nice security additions, including improved password hashing (featuring PBKDF2 and bcrypt support), new tools for cryptographic signing, several CSRF improvements, and simple clickjacking protection. An updated default project layout and manage.py that removes the “magic” from prior versions.
Release notes Django 1.4 release notes
CSRF check Note: This is actually a Django 1.1 fallback, not Django 1.2, and it applies only if you’re upgrading from 1.1. Consequences: The user will see a 403 error with any CSRF-protected POST form.
Release notes Django 4.0 release notes
CsrfViewMiddleware now uses request.META['CSRF_COOKIE_NEEDS_UPDATE'] in place of request.META['CSRF_COOKIE_USED'], request.csrf_cookie_needs_reset, and response.csrf_cookie_set to track whether the CSRF cookie should be sent. This is an undocumented, private API. The undocumented TRANSLATOR_COMMENT_MARK constant is moved from django.template.base to django.utils.translation.template.
Release notes Django 5.0 release notes
The SitemapIndexItem.__str__() method is removed. The CSRF_COOKIE_MASKED transitional setting is removed. The name argument of django.utils.functional.cached_property() is removed. The opclasses argument of django.contrib.postgres.constraints.ExclusionConstraint is removed. The undocumented ability to pass errors=None to SimpleTestCase.assertFormError() and assertFormsetError() is removed. django.contrib.sessions.serializers.PickleSerializer is removed.
Release notes Django 1.2 release notes Backwards-incompatible changes in 1.2
For example, you would change code from this: to this: or: For those of you who’ve been following the development trunk, this change also applies to other decorators introduced since 1.1, including csrf_protect, cache_control and anything created using decorator_from_middleware.
Release notes Django 1.4 release notes
Some nice security additions, including improved password hashing (featuring PBKDF2 and bcrypt support), new tools for cryptographic signing, several CSRF improvements, and simple clickjacking protection. An updated default project layout and manage.py that removes the “magic” from prior versions.
Release notes Django 1.4 release notes Backwards incompatible changes in 1.4
CSRF check Note: This is actually a Django 1.1 fallback, not Django 1.2, and it applies only if you’re upgrading from 1.1. Consequences: The user will see a 403 error with any CSRF-protected POST form.
Release notes Django 4.0 release notes Features deprecated in 4.0
CsrfViewMiddleware now uses request.META['CSRF_COOKIE_NEEDS_UPDATE'] in place of request.META['CSRF_COOKIE_USED'], request.csrf_cookie_needs_reset, and response.csrf_cookie_set to track whether the CSRF cookie should be sent. This is an undocumented, private API. The undocumented TRANSLATOR_COMMENT_MARK constant is moved from django.template.base to django.utils.translation.template.
Release notes Django 5.0 release notes
The SitemapIndexItem.__str__() method is removed. The CSRF_COOKIE_MASKED transitional setting is removed. The name argument of django.utils.functional.cached_property() is removed. The opclasses argument of django.contrib.postgres.constraints.ExclusionConstraint is removed. The undocumented ability to pass errors=None to SimpleTestCase.assertFormError() and assertFormsetError() is removed. django.contrib.sessions.serializers.PickleSerializer is removed.