pypi / djangorestframework

djangorestframework

What changed in djangorestframework 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-21.

2 breaking3 security1 new APIs and options8 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

djangorestframework 314 changes

Content negotiation is hardened against large Accept headers.
3.18.2release notes
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
3.17.2security advisory
Django REST framework: Potential bypass of Django DATA_UPLOAD_MAX_MEMORY_SIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data
3.17.2security advisory

Adds a compatibility setting for ListSerializer error formats.
3.18.1release notes

Restored from 3.18.1 to fix a broken return value.
3.18.3release notes
Python 3.15 is supported.
3.18.2release notes
Deleting a TokenProxy now actually deletes the token.
3.18.2release notes
Validation now works correctly for unique constraints with conditional fields.
3.18.2release notes
Fields with blank=True in unique constraints are no longer treated as required.
3.18.2release notes
Fixes duplicate validation errors for GenericIPAddressField when a protocol is specified.
3.18.1release notes
Fixes int64 format detection for negative IntegerField minimums in OpenAPI schema definitions.
3.18.1release notes
Fixes the list serializer when used with a unique constraint validator.
3.18.1release notes