Scheduled weekly dependency update for week 09

[pyup-bot]

Update cffi from 1.13.2 to 1.14.0.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/cffi
• Docs: http://cffi.readthedocs.org

Update django-any-imagefield from 1.0 to 1.1.

Changelog

1.1

---------------------------

* Fixed ``solr.FixedSorlAdminImageWidget.render()`` method for Django 2.1+

Links

• PyPI: https://pypi.org/project/django-any-imagefield
• Changelog: https://pyup.io/changelogs/django-any-imagefield/
• Repo: https://github.com/edoburu/django-any-imagefield/zipball/master

Update django-crispy-forms from 1.8.1 to 1.9.0.

Changelog

1.9.0

* Removed support for Python 2.
* Removed support for Django versions prior to 2.2.
* CSS for Column layout object in Bootstrap 4 template pack changed to 'col-md'. Default is now over ridden when another 'col' class is added to css_class.

See the [1.9.0 Milestone](https://github.com/django-crispy-forms/django-crispy-forms/milestone/9) for the full change list.

Links

• PyPI: https://pypi.org/project/django-crispy-forms
• Changelog: https://pyup.io/changelogs/django-crispy-forms/
• Repo: https://github.com/django-crispy-forms/django-crispy-forms

Update django from 2.2.10 to 3.0.3.

Changelog

3.0.3

==========================

*February 3, 2020*

Django 3.0.3 fixes a security issue and several bugs in 3.0.2.

CVE-2020-7471: Potential SQL injection via ``StringAgg(delimiter)``
===================================================================

:class:`~django.contrib.postgres.aggregates.StringAgg` aggregation function was
subject to SQL injection, using a suitably crafted ``delimiter``.

Bugfixes
========

* Fixed a regression in Django 3.0 that caused a crash when subtracting
``DateField``, ``DateTimeField``, or ``TimeField`` from a ``Subquery()``
annotation (:ticket:`31133`).

* Fixed a regression in Django 3.0 where ``QuerySet.values()`` and
``values_list()`` crashed if a queryset contained an aggregation and
``Exists()`` annotation (:ticket:`31136`).

* Relaxed the system check added in Django 3.0 to reallow use of a sublanguage
in the :setting:`LANGUAGE_CODE` setting, when a base language is available in
Django but the sublanguage is not (:ticket:`31141`).

* Added support for using enumeration types ``TextChoices``,
``IntegerChoices``, and ``Choices`` in templates (:ticket:`31154`).

* Fixed a system check to ensure the ``max_length`` attribute fits the longest
choice, when a named group contains only non-string values (:ticket:`31155`).

* Fixed a regression in Django 2.2 that caused a crash of
:class:`~django.contrib.postgres.aggregates.ArrayAgg` and
:class:`~django.contrib.postgres.aggregates.StringAgg` with ``filter``
argument when used in a ``Subquery`` (:ticket:`31097`).

* Fixed a regression in Django 2.2.7 that caused
:meth:`~django.db.models.Model.get_FOO_display` to work incorrectly when
overriding inherited choices (:ticket:`31124`).

* Fixed a regression in Django 3.0 that caused a crash of
``QuerySet.prefetch_related()`` for ``GenericForeignKey`` with a custom
``ContentType`` foreign key (:ticket:`31190`).


==========================

3.0.2

==========================

*January 2, 2020*

Django 3.0.2 fixes several bugs in 3.0.1.

Bugfixes
========

* Fixed a regression in Django 3.0 that didn't include columns referenced by a
``Subquery()`` in the ``GROUP BY`` clause (:ticket:`31094`).

* Fixed a regression in Django 3.0 where ``QuerySet.exists()`` crashed if a
queryset contained an aggregation over a ``Subquery()`` (:ticket:`31109`).

* Fixed a regression in Django 3.0 that caused a migration crash on PostgreSQL
10+ when adding a foreign key and changing data in the same migration
(:ticket:`31106`).

* Fixed a regression in Django 3.0 where loading fixtures crashed for models
defining a :attr:`~django.db.models.Field.default` for the primary key
(:ticket:`31071`).


==========================

3.0.1

==========================

*December 18, 2019*

Django 3.0.1 fixes a security issue and several bugs in 3.0.

CVE-2019-19844: Potential account hijack via password reset form
================================================================

By submitting a suitably crafted email address making use of Unicode
characters, that compared equal to an existing user email when lower-cased for
comparison, an attacker could be sent a password reset token for the matched
account.

In order to avoid this vulnerability, password reset requests now compare the
submitted email using the stricter, recommended algorithm for case-insensitive
comparison of two identifiers from `Unicode Technical Report 36, section
2.11.2(B)(2)`__. Upon a match, the email containing the reset token will be
sent to the email address on record rather than the submitted address.

.. __: https://www.unicode.org/reports/tr36/Recommendations_General

Bugfixes
========

* Fixed a regression in Django 3.0 by restoring the ability to use Django
inside Jupyter and other environments that force an async context, by adding
an option to disable :ref:`async-safety` mechanism with
``DJANGO_ALLOW_ASYNC_UNSAFE`` environment variable (:ticket:`31056`).

* Fixed a regression in Django 3.0 where ``RegexPattern``, used by
:func:`~django.urls.re_path`, returned positional arguments to be passed to
the view when all optional named groups were missing (:ticket:`31061`).

* Reallowed, following a regression in Django 3.0,
:class:`~django.db.models.expressions.Window` expressions to be used in
conditions outside of queryset filters, e.g. in
:class:`~django.db.models.expressions.When` conditions (:ticket:`31060`).

* Fixed a data loss possibility in
:class:`~django.contrib.postgres.forms.SplitArrayField`. When using with
``ArrayField(BooleanField())``, all values after the first ``True`` value
were marked as checked instead of preserving passed values (:ticket:`31073`).


========================

3.0

========================

*December 2, 2019*

Welcome to Django 3.0!

These release notes cover the :ref:`new features <whats-new-3.0>`, as well as
some :ref:`backwards incompatible changes <backwards-incompatible-3.0>` you'll
want to be aware of when upgrading from Django 2.2 or earlier. We've
:ref:`dropped some features<removed-features-3.0>` that have reached the end of
their deprecation cycle, and we've :ref:`begun the deprecation process for
some features <deprecated-features-3.0>`.

See the :doc:`/howto/upgrade-version` guide if you're updating an existing
project.

Python compatibility
====================

Django 3.0 supports Python 3.6, 3.7, and 3.8. We **highly recommend** and only
officially support the latest release of each series.

The Django 2.2.x series is the last to support Python 3.5.

Third-party library support for older version of Django
=======================================================

Following the release of Django 3.0, we suggest that third-party app authors
drop support for all versions of Django prior to 2.2. At that time, you should
be able to run your package's tests using ``python -Wd`` so that deprecation
warnings appear. After making the deprecation warning fixes, your app should be
compatible with Django 3.0.

.. _whats-new-3.0:

What's new in Django 3.0
========================

MariaDB support
---------------

Django now officially supports `MariaDB <https://mariadb.org/>`_ 10.1 and
higher. See :ref:`MariaDB notes <mariadb-notes>` for more details.

ASGI support
------------

Django 3.0 begins our journey to making Django fully async-capable by providing
support for running as an `ASGI <https://asgi.readthedocs.io/>`_ application.

This is in addition to our existing WSGI support. Django intends to support
both for the foreseeable future. Async features will only be available to
applications that run under ASGI, however.

There is no need to switch your applications over unless you want to start
experimenting with asynchronous code, but we have
:doc:`documentation on deploying with ASGI </howto/deployment/asgi/index>` if
you want to learn more.

Note that as a side-effect of this change, Django is now aware of asynchronous
event loops and will block you calling code marked as "async unsafe" - such as
ORM operations - from an asynchronous context. If you were using Django from
async code before, this may trigger if you were doing it incorrectly. If you
see a ``SynchronousOnlyOperation`` error, then closely examine your code and
move any database operations to be in a synchronous child thread.

Exclusion constraints on PostgreSQL
-----------------------------------

The new :class:`~django.contrib.postgres.constraints.ExclusionConstraint` class
enable adding exclusion constraints on PostgreSQL. Constraints are added to
models using the
:attr:`Meta.constraints <django.db.models.Options.constraints>` option.

Filter expressions
------------------

Expressions that output :class:`~django.db.models.BooleanField` may now be
used directly in ``QuerySet`` filters, without having to first annotate and
then filter against the annotation.

Enumerations for model field choices
------------------------------------

Custom enumeration types ``TextChoices``, ``IntegerChoices``, and ``Choices``
are now available as a way to define :attr:`.Field.choices`. ``TextChoices``
and ``IntegerChoices`` types are provided for text and integer fields. The
``Choices`` class allows defining a compatible enumeration for other concrete
data types. These custom enumeration types support human-readable labels that
can be translated and accessed via a property on the enumeration or its
members. See :ref:`Enumeration types <field-choices-enum-types>` for more
details and examples.

Minor features
--------------

:mod:`django.contrib.admin`
~~~~~~~~~~~~~~~~~~~~~~~~~~~

* Added support for the ``admin_order_field`` attribute on properties in
:attr:`.ModelAdmin.list_display`.

* The new :meth:`ModelAdmin.get_inlines()
<django.contrib.admin.ModelAdmin.get_inlines>` method allows specifying the
inlines based on the request or model instance.

* Select2 library is upgraded from version 4.0.3 to 4.0.7.

* jQuery is upgraded from version 3.3.1 to 3.4.1.

:mod:`django.contrib.auth`
~~~~~~~~~~~~~~~~~~~~~~~~~~

* The new ``reset_url_token`` attribute in
:class:`~django.contrib.auth.views.PasswordResetConfirmView` allows
specifying a token parameter displayed as a component of password reset
URLs.

* Added :class:`~django.contrib.auth.backends.BaseBackend` class to ease
customization of authentication backends.

* Added :meth:`~django.contrib.auth.models.User.get_user_permissions()` method
to mirror the existing
:meth:`~django.contrib.auth.models.User.get_group_permissions()` method.

* Added HTML ``autocomplete`` attribute to widgets of username, email, and
password fields in :mod:`django.contrib.auth.forms` for better interaction
with browser password managers.

* :djadmin:`createsuperuser` now falls back to environment variables for
password and required fields, when a corresponding command line argument
isn't provided in non-interactive mode.

* :attr:`~django.contrib.auth.models.CustomUser.REQUIRED_FIELDS` now supports
:class:`~django.db.models.ManyToManyField`\s.

* The new :meth:`.UserManager.with_perm` method returns users that have the
specified permission.

* The default iteration count for the PBKDF2 password hasher is increased from
150,000 to 180,000.

:mod:`django.contrib.gis`
~~~~~~~~~~~~~~~~~~~~~~~~~

* Allowed MySQL spatial lookup functions to operate on real geometries.
Previous support was limited to bounding boxes.

* Added the :class:`~django.contrib.gis.db.models.functions.GeometryDistance`
function, supported on PostGIS.

* Added support for the ``furlong`` unit in
:class:`~django.contrib.gis.measure.Distance`.

* The :setting:`GEOIP_PATH` setting now supports :class:`pathlib.Path`.

* The :class:`~django.contrib.gis.geoip2.GeoIP2` class now accepts
:class:`pathlib.Path` ``path``.

:mod:`django.contrib.postgres`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

* The new :class:`~django.contrib.postgres.fields.RangeOperators` helps to
avoid typos in SQL operators that can be used together with
:class:`~django.contrib.postgres.fields.RangeField`.

* The new :class:`~django.contrib.postgres.fields.RangeBoundary` expression
represents the range boundaries.

* The new :class:`~django.contrib.postgres.operations.AddIndexConcurrently`
and :class:`~django.contrib.postgres.operations.RemoveIndexConcurrently`
classes allow creating and dropping indexes ``CONCURRENTLY`` on PostgreSQL.

:mod:`django.contrib.sessions`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

* The new
:meth:`~django.contrib.sessions.backends.base.SessionBase.get_session_cookie_age()`
method allows dynamically specifying the session cookie age.

:mod:`django.contrib.syndication`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

* Added the ``language`` class attribute to the
:class:`django.contrib.syndication.views.Feed` to customize a feed language.
The default value is :func:`~django.utils.translation.get_language()` instead
of :setting:`LANGUAGE_CODE`.

Cache
~~~~~

* :func:`~django.utils.cache.add_never_cache_headers` and
:func:`~django.views.decorators.cache.never_cache` now add the ``private``
directive to ``Cache-Control`` headers.

File Storage
~~~~~~~~~~~~

* The new :meth:`.Storage.get_alternative_name` method allows customizing the
algorithm for generating filenames if a file with the uploaded name already
exists.

Forms
~~~~~

* Formsets may control the widget used when ordering forms via
:attr:`~django.forms.formsets.BaseFormSet.can_order` by setting the
:attr:`~django.forms.formsets.BaseFormSet.ordering_widget` attribute or
overriding :attr:`~django.forms.formsets.BaseFormSet.get_ordering_widget()`.

Internationalization
~~~~~~~~~~~~~~~~~~~~

* Added the :setting:`LANGUAGE_COOKIE_HTTPONLY`,
:setting:`LANGUAGE_COOKIE_SAMESITE`, and :setting:`LANGUAGE_COOKIE_SECURE`
settings to set the ``HttpOnly``, ``SameSite``, and ``Secure`` flags on
language cookies. The default values of these settings preserve the previous
behavior.

* Added support and translations for the Uzbek language.

Logging
~~~~~~~

* The new ``reporter_class`` parameter of
:class:`~django.utils.log.AdminEmailHandler` allows providing an
``django.views.debug.ExceptionReporter`` subclass to customize the traceback
text sent to site :setting:`ADMINS` when :setting:`DEBUG` is ``False``.

Management Commands
~~~~~~~~~~~~~~~~~~~

* The new :option:`compilemessages --ignore` option allows ignoring specific
directories when searching for ``.po`` files to compile.

* :option:`showmigrations --list` now shows the applied datetimes when
``--verbosity`` is 2 and above.

* On PostgreSQL, :djadmin:`dbshell` now supports client-side TLS certificates.

* :djadmin:`inspectdb` now introspects :class:`~django.db.models.OneToOneField`
when a foreign key has a unique or primary key constraint.

* The new :option:`--skip-checks` option skips running system checks prior to
running the command.

* The :option:`startapp --template` and :option:`startproject --template`
options now support templates stored in XZ archives (``.tar.xz``, ``.txz``)
and LZMA archives (``.tar.lzma``, ``.tlz``).

Models
~~~~~~

* Added hash database functions :class:`~django.db.models.functions.MD5`,
:class:`~django.db.models.functions.SHA1`,
:class:`~django.db.models.functions.SHA224`,
:class:`~django.db.models.functions.SHA256`,
:class:`~django.db.models.functions.SHA384`, and
:class:`~django.db.models.functions.SHA512`.

* Added the :class:`~django.db.models.functions.Sign` database function.

* The new ``is_dst``  parameter of the
:class:`~django.db.models.functions.Trunc` database functions determines the
treatment of nonexistent and ambiguous datetimes.

* ``connection.queries`` now shows ``COPY … TO`` statements on PostgreSQL.

* :class:`~django.db.models.FilePathField` now accepts a callable for ``path``.

* Allowed symmetrical intermediate table for self-referential
:class:`~django.db.models.ManyToManyField`.

* The ``name`` attributes of :class:`~django.db.models.CheckConstraint`,
:class:`~django.db.models.UniqueConstraint`, and
:class:`~django.db.models.Index` now support app label and class
interpolation using the ``'%(app_label)s'`` and ``'%(class)s'`` placeholders.

* The new :attr:`.Field.descriptor_class` attribute allows model fields to
customize the get and set behavior by overriding their
:py:ref:`descriptors <descriptors>`.

* :class:`~django.db.models.Avg` and :class:`~django.db.models.Sum` now support
the ``distinct`` argument.

* Added :class:`~django.db.models.SmallAutoField` which acts much like an
:class:`~django.db.models.AutoField` except that it only allows values under
a certain (database-dependent) limit. Values from ``1`` to ``32767`` are safe
in all databases supported by Django.

* :class:`~django.db.models.AutoField`,
:class:`~django.db.models.BigAutoField`, and
:class:`~django.db.models.SmallAutoField` now inherit from
``IntegerField``, ``BigIntegerField`` and ``SmallIntegerField`` respectively.
System checks and validators are now also properly inherited.

* :attr:`.FileField.upload_to` now supports :class:`pathlib.Path`.

* :class:`~django.db.models.CheckConstraint` is now supported on MySQL 8.0.16+.

* The new ``allows_group_by_selected_pks_on_model()`` method of
``django.db.backends.base.BaseDatabaseFeatures`` allows optimization of
``GROUP BY`` clauses to require only the selected models' primary keys. By
default, it's supported only for managed models on PostgreSQL.

To enable the ``GROUP BY`` primary key-only optimization for unmanaged
models, you have to subclass the PostgreSQL database engine, overriding the
features class ``allows_group_by_selected_pks_on_model()`` method as you
require. See :ref:`Subclassing the built-in database backends
<subclassing-database-backends>` for an example.

Requests and Responses
~~~~~~~~~~~~~~~~~~~~~~

* Allowed :class:`~django.http.HttpResponse` to be initialized with
:class:`memoryview` content.

* For use in, for example, Django templates, :attr:`.HttpRequest.headers` now
allows lookups using underscores (e.g. ``user_agent``) in place of hyphens.

.. _whats-new-security-3.0:

Security
~~~~~~~~

* :setting:`X_FRAME_OPTIONS` now defaults to ``'DENY'``. In older versions, the
:setting:`X_FRAME_OPTIONS` setting defaults to ``'SAMEORIGIN'``. If your site
uses frames of itself, you will need to explicitly set ``X_FRAME_OPTIONS =
'SAMEORIGIN'`` for them to continue working.

* :setting:`SECURE_CONTENT_TYPE_NOSNIFF` setting now defaults to ``True``. With
the enabled :setting:`SECURE_CONTENT_TYPE_NOSNIFF`, the
:class:`~django.middleware.security.SecurityMiddleware` sets the
:ref:`x-content-type-options` header on all responses that do not already
have it.

* :class:`~django.middleware.security.SecurityMiddleware` can now send the
:ref:`Referrer-Policy <referrer-policy>` header.

Tests
~~~~~

* The new test :class:`~django.test.Client` argument
``raise_request_exception`` allows controlling whether or not exceptions
raised during the request should also be raised in the test. The value
defaults to ``True`` for backwards compatibility. If it is ``False`` and an
exception occurs, the test client will return a 500 response with the
attribute :attr:`~django.test.Response.exc_info`, a tuple providing
information of the exception that occurred.

* Tests and test cases to run can be selected by test name pattern using the
new :option:`test -k` option.

* HTML comparison, as used by
:meth:`~django.test.SimpleTestCase.assertHTMLEqual`, now treats text, character
references, and entity references that refer to the same character as
equivalent.

* Django test runner now supports headless mode for selenium tests on supported
browsers. Add the ``--headless`` option to enable this mode.

* Django test runner now supports ``--start-at`` and ``--start-after`` options
to run tests starting from a specific top-level module.

* Django test runner now supports a ``--pdb`` option to spawn a debugger at
each error or failure.

.. _backwards-incompatible-3.0:

Backwards incompatible changes in 3.0
=====================================

``Model.save()`` when providing a default for the primary key
-------------------------------------------------------------

:meth:`.Model.save` no longer attempts to find a row when saving a new
``Model`` instance and a default value for the primary key is provided, and
always performs a single ``INSERT`` query. In older Django versions,
``Model.save()`` performed either an ``INSERT`` or an ``UPDATE`` based on
whether or not the row exists.

This makes calling ``Model.save()`` while providing a default primary key value
equivalent to passing :ref:`force_insert=True <ref-models-force-insert>` to
model's ``save()``. Attempts to use a new ``Model`` instance to update an
existing row will result in an ``IntegrityError``.

In order to update an existing model for a specific primary key value, use the
:meth:`~django.db.models.query.QuerySet.update_or_create` method or
``QuerySet.filter(pk=…).update(…)`` instead. For example::

 >>> MyModel.objects.update_or_create(pk=existing_pk, defaults={'name': 'new name'})
 >>> MyModel.objects.filter(pk=existing_pk).update(name='new name')

Database backend API
--------------------

This section describes changes that may be needed in third-party database
backends.

* The second argument of ``DatabaseIntrospection.get_geometry_type()`` is now
the row description instead of the column name.

* ``DatabaseIntrospection.get_field_type()`` may no longer return tuples.

* If the database can create foreign keys in the same SQL statement that adds a
field, add ``SchemaEditor.sql_create_column_inline_fk`` with the appropriate
SQL; otherwise, set ``DatabaseFeatures.can_create_inline_fk = False``.

* ``DatabaseFeatures.can_return_id_from_insert`` and
``can_return_ids_from_bulk_insert`` are renamed to
``can_return_columns_from_insert`` and ``can_return_rows_from_bulk_insert``.

* Database functions now handle :class:`datetime.timezone` formats when created
using :class:`datetime.timedelta` instances (e.g.
``timezone(timedelta(hours=5))``, which would output ``'UTC+05:00'``).
Third-party backends should handle this format when preparing
:class:`~django.db.models.DateTimeField` in ``datetime_cast_date_sql()``,
``datetime_extract_sql()``, etc.

* Entries for ``AutoField``, ``BigAutoField``, and ``SmallAutoField`` are added
to  ``DatabaseOperations.integer_field_ranges`` to support the integer range
validators on these field types. Third-party backends may need to customize
the default entries.

* ``DatabaseOperations.fetch_returned_insert_id()`` is replaced by
``fetch_returned_insert_columns()`` which returns a list of values returned
by the ``INSERT … RETURNING`` statement, instead of a single value.

* ``DatabaseOperations.return_insert_id()`` is replaced by
``return_insert_columns()`` that accepts a ``fields``
argument, which is an iterable of fields to be returned after insert. Usually
this is only the auto-generated primary key.

:mod:`django.contrib.admin`
---------------------------

* Admin's model history change messages now prefers more readable field labels
instead of field names.

:mod:`django.contrib.gis`
-------------------------

* Support for PostGIS 2.1 is removed.

* Support for SpatiaLite 4.1 and 4.2 is removed.

* Support for GDAL 1.11 and GEOS 3.4 is removed.

Dropped support for PostgreSQL 9.4
----------------------------------

Upstream support for PostgreSQL 9.4 ends in December 2019. Django 3.0 supports
PostgreSQL 9.5 and higher.

Dropped support for Oracle 12.1
-------------------------------

Upstream support for Oracle 12.1 ends in July 2021. Django 2.2 will be
supported until April 2022. Django 3.0 officially supports Oracle 12.2 and 18c.

Removed private Python 2 compatibility APIs
-------------------------------------------

While Python 2 support was removed in Django 2.0, some private APIs weren't
removed from Django so that third party apps could continue using them until
the Python 2 end-of-life.

Since we expect apps to drop Python 2 compatibility when adding support for
Django 3.0, we're removing these APIs at this time.

* ``django.test.utils.str_prefix()`` - Strings don't have 'u' prefixes in
Python 3.

* ``django.test.utils.patch_logger()`` - Use
:meth:`unittest.TestCase.assertLogs` instead.

* ``django.utils.lru_cache.lru_cache()`` - Alias of
:func:`functools.lru_cache`.

* ``django.utils.decorators.available_attrs()`` - This function returns
``functools.WRAPPER_ASSIGNMENTS``.

* ``django.utils.decorators.ContextDecorator`` - Alias of
:class:`contextlib.ContextDecorator`.

* ``django.utils._os.abspathu()`` - Alias of :func:`os.path.abspath`.

* ``django.utils._os.upath()`` and ``npath()`` - These functions do nothing on
Python 3.

* ``django.utils.six`` - Remove usage of this vendored library or switch to
`six <https://pypi.org/project/six/>`_.

* ``django.utils.encoding.python_2_unicode_compatible()`` - Alias of
``six.python_2_unicode_compatible()``.

* ``django.utils.functional.curry()`` - Use :func:`functools.partial` or
:class:`functools.partialmethod`. See :commit:`5b1c389603a353625ae1603`.

* ``django.utils.safestring.SafeBytes`` - Unused since Django 2.0.

New default value for the ``FILE_UPLOAD_PERMISSIONS`` setting
-------------------------------------------------------------

In older versions, the :setting:`FILE_UPLOAD_PERMISSIONS` setting defaults to
``None``. With the default :setting:`FILE_UPLOAD_HANDLERS`, this results in
uploaded files having different permissions depending on their size and which
upload handler is used.

``FILE_UPLOAD_PERMISSION`` now defaults to ``0o644`` to avoid this
inconsistency.

New default values for security settings
----------------------------------------

To make Django projects more secure by default, some security settings now have
more secure default values:

* :setting:`X_FRAME_OPTIONS` now defaults to ``'DENY'``.

* :setting:`SECURE_CONTENT_TYPE_NOSNIFF` now defaults to ``True``.

See the *What's New* :ref:`Security section <whats-new-security-3.0>` above for
more details on these changes.

Miscellaneous
-------------

* ``ContentType.__str__()`` now includes the model's ``app_label`` to
disambiguate models with the same name in different apps.

* Because accessing the language in the session rather than in the cookie is
deprecated, ``LocaleMiddleware`` no longer looks for the user's language in
the session and :func:`django.contrib.auth.logout` no longer preserves the
session's language after logout.

* :func:`django.utils.html.escape` now uses :func:`html.escape` to escape HTML.
This converts ``'`` to ``&x27;`` instead of the previous equivalent decimal
code ``&39;``.

* The ``django-admin test -k`` option now works as the :option:`unittest
-k<unittest.-k>` option rather than as a shortcut for ``--keepdb``.

* Support for ``pywatchman`` < 1.2.0 is removed.

* :func:`~django.utils.http.urlencode` now encodes iterable values as they are
when ``doseq=False``, rather than iterating them, bringing it into line with
the standard library :func:`urllib.parse.urlencode` function.

* ``intword`` template filter now translates ``1.0`` as a singular phrase and
all other numeric values as plural. This may be incorrect for some languages.

* Assigning a value to a model's :class:`~django.db.models.ForeignKey` or
:class:`~django.db.models.OneToOneField` ``'_id'`` attribute now unsets the
corresponding field. Accessing the field afterwards will result in a query.

* :func:`~django.utils.cache.patch_vary_headers` now handles an asterisk
``'*'`` according to :rfc:`7231section-7.1.4`, i.e. if a list of header
field names contains an asterisk, then the ``Vary`` header will consist of a
single asterisk ``'*'``.

* On MySQL 8.0.16+, ``PositiveIntegerField`` and ``PositiveSmallIntegerField``
now include a check constraint to prevent negative values in the database.

* ``alias=None`` is added to the signature of
:meth:`.Expression.get_group_by_cols`.

* Support for ``sqlparse`` < 0.2.2 is removed.

* ``RegexPattern``, used by :func:`~django.urls.re_path`, no longer returns
keyword arguments with ``None`` values to be passed to the view for the
optional named groups that are missing.

.. _deprecated-features-3.0:

Features deprecated in 3.0
==========================

``django.utils.encoding.force_text()`` and ``smart_text()``
-----------------------------------------------------------

The ``smart_text()`` and ``force_text()`` aliases (since Django 2.0) of
``smart_str()`` and ``force_str()`` are deprecated. Ignore this deprecation if
your code supports Python 2 as the behavior of ``smart_str()`` and
``force_str()`` is different there.

Miscellaneous
-------------

* ``django.utils.http.urlquote()``, ``urlquote_plus()``, ``urlunquote()``, and
``urlunquote_plus()`` are deprecated in favor of the functions that they're
aliases for: :func:`urllib.parse.quote`, :func:`~urllib.parse.quote_plus`,
:func:`~urllib.parse.unquote`, and :func:`~urllib.parse.unquote_plus`.

* ``django.utils.translation.ugettext()``, ``ugettext_lazy()``,
``ugettext_noop()``, ``ungettext()``, and ``ungettext_lazy()`` are deprecated
in favor of the functions that they're aliases for:
:func:`django.utils.translation.gettext`,
:func:`~django.utils.translation.gettext_lazy`,
:func:`~django.utils.translation.gettext_noop`,
:func:`~django.utils.translation.ngettext`, and
:func:`~django.utils.translation.ngettext_lazy`.

* To limit creation of sessions and hence favor some caching strategies,
:func:`django.views.i18n.set_language` will stop setting the user's language
in the session in Django 4.0. Since Django 2.1, the language is always stored
in the :setting:`LANGUAGE_COOKIE_NAME` cookie.

* ``django.utils.text.unescape_entities()`` is deprecated in favor of
:func:`html.unescape`. Note that unlike ``unescape_entities()``,
``html.unescape()`` evaluates lazy strings immediately.

* To avoid possible confusion as to effective scope, the private internal
utility ``is_safe_url()`` is renamed to
``url_has_allowed_host_and_scheme()``. That a URL has an allowed host and
scheme doesn't in general imply that it's "safe". It may still be quoted
incorrectly, for example. Ensure to also use
:func:`~django.utils.encoding.iri_to_uri` on the path component of untrusted
URLs.

.. _removed-features-3.0:

Features removed in 3.0
=======================

These features have reached the end of their deprecation cycle and are removed
in Django 3.0.

See :ref:`deprecated-features-2.0` for details on these changes, including how
to remove usage of these features.

* The ``django.db.backends.postgresql_psycopg2`` module is removed.

* ``django.shortcuts.render_to_response()`` is removed.

* The ``DEFAULT_CONTENT_TYPE`` setting is removed.

* ``HttpRequest.xreadlines()`` is removed.

* Support for the ``context`` argument of ``Field.from_db_value()`` and
``Expression.convert_value()`` is removed.

* The ``field_name`` keyword argument of ``QuerySet.earliest()`` and
``latest()`` is removed.

See :ref:`deprecated-features-2.1` for details on these changes, including how
to remove usage of these features.

* The ``ForceRHR`` GIS function is removed.

* ``django.utils.http.cookie_date()`` is removed.

* The ``staticfiles`` and ``admin_static`` template tag libraries are removed.

* ``django.contrib.staticfiles.templatetags.staticfiles.static()`` is removed.


===========================

Links

• PyPI: https://pypi.org/project/django
• Changelog: https://pyup.io/changelogs/django/
• Homepage: https://www.djangoproject.com/

Update idna from 2.8 to 2.9.

Changelog

2.9

++++++++++++++++

- Update to Unicode 12.1.0.
- Prohibit A-labels ending with a hyphen (Thanks, Julien Bernard!)
- Future-proofing: Test on Python 3.7 and 3.8, don't immediately
fail should Python 4 come along.
- Made BSD 3-clause license clearer

Links

• PyPI: https://pypi.org/project/idna
• Changelog: https://pyup.io/changelogs/idna/
• Repo: https://github.com/kjd/idna

Update mock from 3.0.5 to 4.0.1.

Changelog

4.0.1

-----

- Remove the universal marker from the wheel.

4.0.0

-----

- No Changes from 4.0.0b1.

4.0.0b1

-------

- The release is a fresh cut of cpython's `4a686504`__. All changes to :mod:`mock`
from that commit and before are included in this release along with the
subsequent changes listed below.

__ https://github.com/python/cpython/commit/4a686504eb2bbf69adf78077458508a7ba131667

- Issue 37972: Subscripts to the `unittest.mock.call` objects now receive
the same chaining mechanism as any other custom attributes, so that the
following usage no longer raises a `TypeError`:

call().foo().__getitem__('bar')

Patch by blhsing

- Issue 38839: Fix some unused functions in tests. Patch by Adam Johnson.

- Issue 39485: Fix a bug in :func:`unittest.mock.create_autospec` that
would complain about the wrong number of arguments for custom descriptors
defined in an extension module returning functions.

- Issue 39082: Allow AsyncMock to correctly patch static/class methods

- Issue 38093: Fixes AsyncMock so it doesn't crash when used with
AsyncContextManagers or AsyncIterators.

- Issue 38859: AsyncMock now returns StopAsyncIteration on the exaustion of
a side_effects iterable. Since PEP-479 its Impossible to raise a
StopIteration exception from a coroutine.

- Issue 38163: Child mocks will now detect their type as either synchronous
or asynchronous, asynchronous child mocks will be AsyncMocks and
synchronous child mocks will be either MagicMock or Mock (depending on
their parent type).

- Issue 38473: Use signature from inner mock for autospecced methods
attached with :func:`unittest.mock.attach_mock`. Patch by Karthikeyan
Singaravelan.

- Issue 38136: Changes AsyncMock call count and await count to be two
different counters. Now await count only counts when a coroutine has been
awaited, not when it has been called, and vice-versa. Update the
documentation around this.

- Issue 37555: Fix `NonCallableMock._call_matcher` returning tuple instead
of `_Call` object when `self._spec_signature` exists. Patch by Elizabeth
Uselton

- Issue 37251: Remove `__code__` check in AsyncMock that incorrectly
evaluated function specs as async objects but failed to evaluate classes
with `__await__` but no `__code__` attribute defined as async objects.

- Issue 38669: Raise :exc:`TypeError` when passing target as a string with
:meth:`unittest.mock.patch.object`.

- Issue 25597: Ensure, if ``wraps`` is supplied to
:class:`unittest.mock.MagicMock`, it is used to calculate return values
for the magic methods instead of using the default return values. Patch by
Karthikeyan Singaravelan.

- Issue 38108: Any synchronous magic methods on an AsyncMock now return a
MagicMock. Any asynchronous magic methods on a MagicMock now return an
AsyncMock.

- Issue 21478: Record calls to parent when autospecced object is attached
to a mock using :func:`unittest.mock.attach_mock`. Patch by Karthikeyan
Singaravelan.

- Issue 38857: AsyncMock fix for return values that are awaitable types.
This also covers side_effect iterable values that happend to be awaitable,
and wraps callables that return an awaitable type. Before these awaitables
were being awaited instead of being returned as is.

- Issue 38932: Mock fully resets child objects on reset_mock(). Patch by
Vegard Stikbakke

- Issue 37685: Fixed ``__eq__``, ``__lt__`` etc implementations in some
classes. They now return :data:`NotImplemented` for unsupported type of
the other operand. This allows the other operand to play role (for example
the equality comparison with :data:`~unittest.mock.ANY` will return
``True``).

- Issue 37212: :func:`unittest.mock.call` now preserves the order of
keyword arguments in repr output. Patch by Karthikeyan Singaravelan.

- Issue 37828: Fix default mock name in
:meth:`unittest.mock.Mock.assert_called` exceptions. Patch by Abraham
Toriz Cruz.

- Issue 36871: Improve error handling for the assert_has_calls and
assert_has_awaits methods of mocks. Fixed a bug where any errors
encountered while binding the expected calls to the mock's spec were
silently swallowed, leading to misleading error output.

- Issue 21600: Fix :func:`mock.patch.stopall` to stop active patches that
were created with :func:`mock.patch.dict`.

- Issue 38161: Removes _AwaitEvent from AsyncMock.

- Issue 36871: Ensure method signature is used instead of constructor
signature of a class while asserting mock object against method calls.
Patch by Karthikeyan Singaravelan.

Links

• PyPI: https://pypi.org/project/mock
• Changelog: https://pyup.io/changelogs/mock/
• Docs: http://mock.readthedocs.org/en/latest/

Update requests from 2.22.0 to 2.23.0.

Changelog

2.23.0

-------------------

**Improvements**

- Remove defunct reference to `prefetch` in Session `__attrs__` (5110)

**Bugfixes**

- Requests no longer outputs password in basic auth usage warning. (5099)

**Dependencies**

- Pinning for `chardet` and `idna` now uses major version instead of minor.
This hopefully reduces the need for releases everytime a dependency is updated.

Links

• PyPI: https://pypi.org/project/requests
• Changelog: https://pyup.io/changelogs/requests/
• Docs: https://requests.readthedocs.io

Update sorl-thumbnail from 12.6.2 to 12.6.3.

Changelog

12.6.3

======

* Deprecate Python 2 compatibility shims in favor of Python 3 only codebase. 623
* Fix README on notes about ImageField cleaning up references on delete. 624
* Fix image ratios with EXIF orientation. 619
* Fix test coverage tracking. 622 and 617

Links

• PyPI: https://pypi.org/project/sorl-thumbnail
• Changelog: https://pyup.io/changelogs/sorl-thumbnail/
• Repo: https://github.com/jazzband/sorl-thumbnail

Update soupsieve from 1.9.5 to 2.0.

Changelog

2.0.0

- **NEW**: `SelectorSyntaxError` is derived from `Exception` not `SyntaxError`.
- **NEW**: Remove deprecated `comments` and `icomments` from the API.
- **NEW**: Drop support for EOL Python versions (Python 2 and Python < 3.5).
- **FIX**: Corner case with splitting namespace and tag name that have an escaped `|`.

Links

• PyPI: https://pypi.org/project/soupsieve
• Changelog: https://pyup.io/changelogs/soupsieve/
• Repo: https://github.com/facelessuser/soupsieve

Update sqlparse from 0.3.0 to 0.3.1.

Changelog

0.3.1

----------------------------

Enhancements

* Add HQL keywords (pr475, by matwalk).
* Add support for time zone casts (issue489).
* Enhance formatting of AS keyword (issue507, by john-bodley).
* Stabilize grouping engine when parsing invalid SQL statements.

Bug Fixes

* Fix splitting of SQL with multiple statements inside
parentheses (issue485, pr486 by win39).
* Correctly identify NULLS FIRST / NULLS LAST as keywords (issue487).
* Fix splitting of SQL statements that contain dollar signs in
identifiers (issue491).
* Remove support for parsing double slash comments introduced in
0.3.0 (issue456) as it had some side-effects with other dialects and
doesn't seem to be widely used (issue476).
* Restrict detection of alias names to objects that acutally could
have an alias (issue455, adopted some parts of pr509 by john-bodley).
* Fix parsing of date/time literals (issue438, by vashek).
* Fix initialization of TokenList (issue499, pr505 by john-bodley).
* Fix parsing of LIKE (issue493, pr525 by dbczumar).
* Improve parsing of identifiers (pr527 by liulk).

Links

• PyPI: https://pypi.org/project/sqlparse
• Changelog: https://pyup.io/changelogs/sqlparse/
• Repo: https://github.com/andialbrecht/sqlparse

Update zipp from 2.1.0 to 3.0.0.

Changelog

3.0.0

======

44: Merge with v1.2.0.

2.2.1

======

43: Merge with v1.1.1.

2.2.0

======

36: Rebuild package with minimum Python version declared both
in package metadata and in the python tag.

Links

• PyPI: https://pypi.org/project/zipp
• Changelog: https://pyup.io/changelogs/zipp/
• Repo: https://github.com/jaraco/zipp

Update django-extensions from 2.2.6 to 2.2.8.

Changelog

2.2.8

-----

Changes:
- Locale: zh_Hans, removed as it generated UnicodeDecodeError errors (1478)

2.2.7

-----

Changes:
- Improvement: shell_plus, 865 always add manage.py basedir to path for notebook kernel
- Improvement: docs, add zh-Hans locale
- Improvement: runserver_plus, fix broken import for werkzeug v1.0.0
- Improvement: runserver_plus, 1461 fix always trying to load StaticFilesHandler
- Improvement: pipchecker, 1471 fix import of PipSession

Links

• PyPI: https://pypi.org/project/django-extensions
• Changelog: https://pyup.io/changelogs/django-extensions/
• Repo: http://github.com/django-extensions/django-extensions

Update Sphinx from 2.3.1 to 2.4.3.

Changelog

2.4.3

=====================================

Bugs fixed
----------

* 7184: autodoc: ``*args`` and ``**kwarg`` in type comments are not handled
properly
* 7189: autodoc: classmethod coroutines are not detected
* 7183: intersphinx: ``:attr:`` reference to property is broken
* 6244, 6387: html search: Search breaks/hangs when built with dirhtml builder
* 7195: todo: emit doctree-resolved event with non-document node incorrectly

2.4.2

=====================================

Bugs fixed
----------

* 7138: autodoc: ``autodoc.typehints`` crashed when variable has unbound object
as a value
* 7156: autodoc: separator for keyword only arguments is not shown
* 7146: autodoc: IndexError is raised on suppressed type_comment found
* 7161: autodoc: typehints extension does not support parallel build
* 7178: autodoc: TypeError is raised on fetching type annotations
* 7151: crashed when extension assigns a value to ``env.indexentries``
* 7170: text: Remove debug print
* 7137: viewcode: Avoid to crash when non-python code given

2.4.1

=====================================

Bugs fixed
----------

* 7120: html: crashed when on scaling SVG images which have float dimentions
* 7126: autodoc: TypeError: 'getset_descriptor' object is not iterable

2.4.0

=====================================

Deprecated
----------

* The ``decode`` argument of ``sphinx.pycode.ModuleAnalyzer()``
* ``sphinx.directives.other.Index``
* ``sphinx.environment.temp_data['gloss_entries']``
* ``sphinx.environment.BuildEnvironment.indexentries``
* ``sphinx.environment.collectors.indexentries.IndexEntriesCollector``
* ``sphinx.ext.apidoc.INITPY``
* ``sphinx.ext.apidoc.shall_skip()``
* ``sphinx.io.FiletypeNotFoundError``
* ``sphinx.io.get_filetype()``
* ``sphinx.pycode.ModuleAnalyzer.encoding``
* ``sphinx.roles.Index``
* ``sphinx.util.detect_encoding()``
* ``sphinx.util.get_module_source()``
* ``sphinx.util.inspect.Signature``
* ``sphinx.util.inspect.safe_getmembers()``
* ``sphinx.writers.latex.LaTeXTranslator.settings.author``
* ``sphinx.writers.latex.LaTeXTranslator.settings.contentsname``
* ``sphinx.writers.latex.LaTeXTranslator.settings.docclass``
* ``sphinx.writers.latex.LaTeXTranslator.settings.docname``
* ``sphinx.writers.latex.LaTeXTranslator.settings.title``
* ``sphinx.writers.latex.ADDITIONAL_SETTINGS``
* ``sphinx.writers.latex.DEFAULT_SETTINGS``
* ``sphinx.writers.latex.LUALATEX_DEFAULT_FONTPKG``
* ``sphinx.writers.latex.PDFLATEX_DEFAULT_FONTPKG``
* ``sphinx.writers.latex.XELATEX_DEFAULT_FONTPKG``
* ``sphinx.writers.latex.XELATEX_GREEK_DEFAULT_FONTPKG``

Features added
--------------

* 6910: inheritance_diagram: Make the background of diagrams transparent
* 6446: duration: Add ``sphinx.ext.durations`` to inspect which documents slow
down the build
* 6837: LaTeX: Support a nested table
* 7115: LaTeX: Allow to override LATEXOPTS and LATEXMKOPTS via environment
variable
* 6966: graphviz: Support ``:class:`` option
* 6696: html: ``:scale:`` option of image/figure directive not working for SVG
images (imagesize-1.2.0 or above is required)
* 7025: html search: full text search can be disabled for individual document
using ``:nosearch:`` file-wide metadata
* 6994: imgconverter: Support illustrator file (.ai) to .png conversion
* autodoc: Support Positional-Only Argument separator (PEP-570 compliant)
* autodoc: Support type annotations for variables
* 2755: autodoc: Add new event: :event:`autodoc-before-process-signature`
* 2755: autodoc: Support type_comment style (ex. `` type: (str) -> str``)
annotation (python3.8+ or `typed_ast <https://github.com/python/typed_ast>`_
is required)
* 7051: autodoc: Support instance variables without defaults (PEP-526)
* 6418: autodoc: Add a new extension ``sphinx.ext.autodoc.typehints``. It shows
typehints as object description if ``autodoc_typehints = "description"`` set.
This is an experimental extension and it will be integrated into autodoc core
in Sphinx-3.0
* SphinxTranslator now calls visitor/departure method for super node class if
visitor/departure method for original node class not found
* 6418: Add new event: :event:`object-description-transform`
* py domain: :rst:dir:`py:data` and :rst:dir:`py:attribute` take new options
named ``:type:`` and ``:value:`` to describe its type and initial value
* 6785: py domain: ``:py:attr:`` is able to refer properties again
* 6772: apidoc: Add ``-q`` option for quiet mode

Bugs fixed
----------

* 6925: html: Remove redundant type="text/javascript" from <script> elements
* 7112: html: SVG image is not layouted as float even if aligned
* 6906, 6907: autodoc: failed to read the source codes encoeded in cp1251
* 6961: latex: warning for babel shown twice
* 7059: latex: LaTeX compilation falls into infinite loop (wrapfig issue)
* 6581: latex: ``:reversed:`` option for toctree does not effect to LaTeX build
* 6559: Wrong node-ids are generated in glossary directive
* 6986: apidoc: misdetects module name for .so file inside module
* 6899: apidoc: private members are not shown even if ``--private`` given
* 6327: apidoc: Support a python package consisted of __init__.so file
* 6999: napoleon: fails to parse tilde in :exc: role
* 7019: gettext: Absolute path used in message catalogs
* 7023: autodoc: nested partial functions are not listed
* 7023: autodoc: partial functions imported from other modules are listed as
module members without :impoprted-members: option
* 6889: autodoc: Trailing comma in ``:members::`` option causes cryptic warning
* 6568: autosummary: ``autosummary_imported_members`` is ignored on generating
a stub file for submodule
* 7055: linkcheck: redirect is treated as an error
* 7088: HTML template: If ``navigation_with_keys`` option is activated,
modifier keys are ignored, which means the feature can interfere with browser
features
* 7090: std domain: Can't assign numfig-numbers for custom container nodes
* 7106: std domain: enumerated nodes are marked as duplicated when extensions
call ``note_explicit_target()``
* 7095: dirhtml: Cross references are broken via intersphinx and ``:doc:`` role
* C++:

- Don't crash when using the ``struct`` role in some cases.
- Don't warn when using the ``var``/``member`` role for function
 parameters.
- Render call and braced-init expressions correctly.
* 7097: Filenames of images generated by
``sphinx.transforms.post_transforms.images.ImageConverter``
or its subclasses (used for latex build) are now sanitized,
to prevent broken paths

Links

• PyPI: https://pypi.org/project/sphinx
• Changelog: https://pyup.io/changelogs/sphinx/
• Homepage: http://sphinx-doc.org/

Update ipython from 7.12.0 to 7.13.0.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/ipython
• Changelog: https://pyup.io/changelogs/ipython/
• Homepage: https://ipython.org

Update ptpython from 3.0.0 to 3.0.1.

Changelog

3.0.1

-----------------

- Fix backwards-compatibility of the `run_config` function. (used by
django-extensions).
- Fix input mode in status bar for block selection.

Links

• PyPI: https://pypi.org/project/ptpython
• Changelog: https://pyup.io/changelogs/ptpython/
• Repo: https://github.com/prompt-toolkit/ptpython

[codecov]

Codecov Report

Merging #274 into master will not change coverage by %.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #274   +/-   ##
=======================================
  Coverage   66.74%   66.74%           
=======================================
  Files          21       21           
  Lines         445      445           
=======================================
  Hits          297      297           
  Misses        148      148           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update af3f443...4077549. Read the comment docs.

[pyup-bot]

Closing this in favor of #275