# What changed in django-guardian

> 10 changes in django-guardian 3 from its official release notes, upgrade guides and advisories: 3 breaking, 1 deprecations, 1 new APIs and options. Each one cited. Sources checked 2026-10-25. HTML: https://unstale.sh/pypi/django-guardian/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## django-guardian 3

### Breaking changes

- With accept_global_perms=True, the global permission check now uses any() when any_perm is set, so holding one required permission globally can grant access. (3.5.2) — [release notes](https://github.com/django-guardian/django-guardian/releases/tag/3.5.2)
- Global permissions are now filtered by the queried model's content type, preventing permissions on another model with the same codename from granting access to its objects. (3.5.2) — [release notes](https://github.com/django-guardian/django-guardian/releases/tag/3.5.2)
- With any_perm=False, objects are returned only when the user holds every remaining requested permission, directly or through their groups. (3.5.1) — [release notes](https://github.com/django-guardian/django-guardian/releases/tag/3.5.1)

### Deprecations

- Set this to True to restore pre-3.5.1 behavior temporarily; it defaults to False, emits a DeprecationWarning on affected calls, and will be removed in 3.6.0. (3.5.1) — [release notes](https://github.com/django-guardian/django-guardian/releases/tag/3.5.1)

### New APIs and options

- Adds async support to PermissionRequiredMixin. (3.5.0) — [release notes](https://github.com/django-guardian/django-guardian/releases/tag/3.5.0)

### Performance

- The backend now uses get_anonymous_user(), applying GUARDIAN_ANONYMOUS_USER_CACHE_TTL and avoiding a database lookup on every anonymous has_perm() or get_all_permissions() call. (3.5.2) — [release notes](https://github.com/django-guardian/django-guardian/releases/tag/3.5.2)

### Behavior and default changes

- Adds get_objects_for_user filtering to GuardedModelAdminMixin. (3.5.0) — [release notes](https://github.com/django-guardian/django-guardian/releases/tag/3.5.0)

### Fixes and other changes

- Batched cleanup continues from the last seen primary key so deleting orphans no longer causes rows or the final partial group batch to be skipped; resume hints no longer skip rows. (3.5.2) — [release notes](https://github.com/django-guardian/django-guardian/releases/tag/3.5.2)
- With GUARDIAN_AUTO_PREFETCH enabled, active superusers now get every permission for the object's content type; the shortcut and get_obj_perms template tag are fixed too. (3.5.2) — [release notes](https://github.com/django-guardian/django-guardian/releases/tag/3.5.2)
- Dispatch LoginRequiredMixin asynchronously for asynchronous views. (3.5.1) — [release notes](https://github.com/django-guardian/django-guardian/releases/tag/3.5.1)