Django 6.0 release notes - UNDER DEVELOPMENT¶

Content Security Policy support¶

Built-in support for the Content Security Policy (CSP) standard is now available, making it easier to protect web applications against content injection attacks such as cross-site scripting (XSS). CSP allows declaring trusted sources of content by giving browsers strict rules about which scripts, styles, images, or other resources can be loaded.

CSP policies can now be enforced or monitored directly using built-in tools: headers are added via the ContentSecurityPolicyMiddleware, nonces are supported through the csp() context processor, and policies are configured using the SECURE_CSP and SECURE_CSP_REPORT_ONLY settings.

These settings accept Python dictionaries and support Django-provided constants for clarity and safety. For example:

from django.utils.csp import CSP

SECURE_CSP = {
    "default-src": [CSP.SELF],
    "script-src": [CSP.SELF, CSP.NONCE],
    "img-src": [CSP.SELF, "https:"],
}

The resulting Content-Security-Policy header would be set to:

default-src 'self'; script-src 'self' 'nonce-SECRET'; img-src 'self' https:

To get started, follow the CSP how-to guide. For in-depth guidance, see the CSP security overview and the reference docs.

Minor features¶

Database backend API¶

This section describes changes that may be needed in third-party database backends.

• BaseDatabaseCreation.create_test_db(serialize) is deprecated. Use serialize_db_to_string() instead.

• BaseDatabaseSchemaEditor and PostgreSQL backends no longer use CASCADE when dropping a column.

Dropped support for MariaDB 10.5¶

Upstream support for MariaDB 10.5 ends in June 2025. Django 6.0 supports MariaDB 10.6 and higher.

Dropped support for Python < 3.12¶

Because Python 3.12 is now the minimum supported version for Django, any optional dependencies must also meet that requirement. The following versions of each library are the first to add or confirm compatibility with Python 3.12:

• aiosmtpd 1.4.5

• argon2-cffi 23.1.0

• bcrypt 4.1.1

• geoip2 4.8.0

• Pillow 10.1.0

• mysqlclient 2.2.1

• numpy 1.26.0

• PyYAML 6.0.2

• psycopg 3.1.12

• psycopg2 2.9.9

• redis-py 5.1.0

• selenium 4.23.0

• sqlparse 0.5.0

• tblib 3.0.0

Miscellaneous¶

• The JSON serializer now writes a newline at the end of the output, even without the indent option set.

• The undocumented django.utils.http.parse_header_parameters() function is refactored to use Python’s email.message.Message for parsing. Input headers exceeding 10000 characters will now raise ValueError.

• Widgets from django.contrib.gis.forms.widgets now render without inline JavaScript in templates. If you have customized any geometry widgets or their templates, you may need to update them to match the new layout.

• Message levels messages.DEBUG and messages.INFO now have distinct icons and CSS styling in the admin. Previously, these used the same icon and styling as the messages.SUCCESS level. Since ModelAdmin.message_user() uses the messages.INFO level by default, set the level to messages.SUCCESS to retain the previous icon and styling.

Miscellaneous¶

• BaseDatabaseCreation.create_test_db(serialize) is deprecated. Use serialize_db_to_string() instead.

• The PostgreSQL StringAgg class is deprecated in favor of the generally available StringAgg class.

• The PostgreSQL OrderableAggMixin is deprecated in favor of the order_by attribute now available on the Aggregate class.

• The default protocol in urlize and urlizetrunc will change from HTTP to HTTPS in Django 7.0. Set the transitional setting URLIZE_ASSUME_HTTPS to True to opt into assuming HTTPS during the Django 6.x release cycle.

• URLIZE_ASSUME_HTTPS transitional setting is deprecated.

• Setting ADMINS or MANAGERS to a list of (name, address) tuples is deprecated. Set to a list of email address strings instead. Django never used the name portion. To include a name, format the address string as '"Name" <address>' or use Python’s email.utils.formataddr().

• Support for the orphans argument being larger than or equal to the per_page argument of django.core.paginator.Paginator and django.core.paginator.AsyncPaginator is deprecated.

• Using a percent sign in a column alias or annotation is deprecated.