pypi / django-guardian

django-guardian

What changed in django-guardian 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-25.

3 breaking1 deprecations1 new APIs and options1 performance1 behavior and defaults3 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

django-guardian 310 changes

With accept_global_perms=True, the global permission check now uses any() when any_perm is set, so holding one required permission globally can grant access.
3.5.2release notes
Global permissions are now filtered by the queried model's content type, preventing permissions on another model with the same codename from granting access to its objects.
3.5.2release notes
With any_perm=False, objects are returned only when the user holds every remaining requested permission, directly or through their groups.
3.5.1release notes

Set this to True to restore pre-3.5.1 behavior temporarily; it defaults to False, emits a DeprecationWarning on affected calls, and will be removed in 3.6.0.
3.5.1release notes

The backend now uses get_anonymous_user(), applying GUARDIAN_ANONYMOUS_USER_CACHE_TTL and avoiding a database lookup on every anonymous has_perm() or get_all_permissions() call.
3.5.2release notes

Adds get_objects_for_user filtering to GuardedModelAdminMixin.
3.5.0release notes

Batched cleanup continues from the last seen primary key so deleting orphans no longer causes rows or the final partial group batch to be skipped; resume hints no longer skip rows.
3.5.2release notes
With GUARDIAN_AUTO_PREFETCH enabled, active superusers now get every permission for the object's content type; the shortcut and get_obj_perms template tag are fixed too.
3.5.2release notes
Dispatch LoginRequiredMixin asynchronously for asynchronous views.
3.5.1release notes