# What changed in djangorestframework

> 14 changes in djangorestframework 3 from its official release notes, upgrade guides and advisories: 2 breaking, 3 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/pypi/djangorestframework/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## djangorestframework 3

### Breaking changes

- Non-text encoding charsets are refused. (3.18.2) — [release notes](https://github.com/encode/django-rest-framework/releases/tag/3.18.2)
- Rejects non-finite values such as nan and inf. (3.18.1) — [release notes](https://github.com/encode/django-rest-framework/releases/tag/3.18.1)

### Security

- Content negotiation is hardened against large Accept headers. (3.18.2) — [release notes](https://github.com/encode/django-rest-framework/releases/tag/3.18.2)
- Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests (3.17.2) — [security advisory](https://github.com/advisories/GHSA-G47C-3XMW-Q6M2)
- Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data` (3.17.2) — [security advisory](https://github.com/advisories/GHSA-2M8G-3CMR-WG3W)

### New APIs and options

- Adds a compatibility setting for ListSerializer error formats. (3.18.1) — [release notes](https://github.com/encode/django-rest-framework/releases/tag/3.18.1)

### Fixes and other changes

- Restored from 3.18.1 to fix a broken return value. (3.18.3) — [release notes](https://github.com/encode/django-rest-framework/releases/tag/3.18.3)
- Python 3.15 is supported. (3.18.2) — [release notes](https://github.com/encode/django-rest-framework/releases/tag/3.18.2)
- Deleting a TokenProxy now actually deletes the token. (3.18.2) — [release notes](https://github.com/encode/django-rest-framework/releases/tag/3.18.2)
- Validation now works correctly for unique constraints with conditional fields. (3.18.2) — [release notes](https://github.com/encode/django-rest-framework/releases/tag/3.18.2)
- Fields with blank=True in unique constraints are no longer treated as required. (3.18.2) — [release notes](https://github.com/encode/django-rest-framework/releases/tag/3.18.2)
- Fixes duplicate validation errors for GenericIPAddressField when a protocol is specified. (3.18.1) — [release notes](https://github.com/encode/django-rest-framework/releases/tag/3.18.1)
- Fixes int64 format detection for negative IntegerField minimums in OpenAPI schema definitions. (3.18.1) — [release notes](https://github.com/encode/django-rest-framework/releases/tag/3.18.1)
- Fixes the list serializer when used with a unique constraint validator. (3.18.1) — [release notes](https://github.com/encode/django-rest-framework/releases/tag/3.18.1)