Merge branch 'main' into drop-django4.2

browniebroke · web-flow · commit dfa0160e9afa · 2026-06-09T22:58:13.000+01:00
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -14,7 +14,7 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
         with:
           fetch-depth: 0
 
@@ -56,7 +56,7 @@ jobs:
       DATABASE_URL: postgres://postgres:postgres@localhost:5432/postgres
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v6.0.3
 
     - uses: actions/setup-python@v6
       with:
@@ -70,9 +70,6 @@ jobs:
     - name: Install dependencies
       run: python -m pip install --upgrade tox
 
-    - name: Create unaccent extension
-      run: PGPASSWORD=postgres psql -h localhost -U postgres -d postgres -c 'CREATE EXTENSION IF NOT EXISTS unaccent;'
-
     - name: Run tox targets for ${{ matrix.python-version }}
       run: tox run -f py$(echo ${{ matrix.python-version }} | tr -d . | cut -f 1 -d '-')
 
@@ -82,15 +79,15 @@ jobs:
         tox -e base,dist,docs
 
     - name: Upload coverage
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@v6.0.1
       with:
         env_vars: TOXENV,DJANGO
 
   test-docs:
     name: Test documentation links
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v6.0.3
 
     - uses: actions/setup-python@v6
       with:
diff --git a/.github/workflows/mkdocs-deploy.yml b/.github/workflows/mkdocs-deploy.yml
@@ -20,7 +20,7 @@ jobs:
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
       - run: git fetch --no-tags --prune --depth=1 origin gh-pages
       - uses: actions/setup-python@v6
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
     if: github.repository == 'encode/django-rest-framework'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.3
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
diff --git a/docs/api-guide/requests.md b/docs/api-guide/requests.md
@@ -5,7 +5,7 @@ source:
 
 > If you're doing REST-based web service stuff ... you should ignore request.POST.
 >
-> &mdash; Malcom Tredinnick, [Django developers group][cite]
+> &mdash; Malcolm Tredinnick, [Django developers group][cite]
 
 REST framework's `Request` class extends the standard `HttpRequest`, adding support for REST framework's flexible request parsing and request authentication.
 
diff --git a/pyproject.toml b/pyproject.toml
@@ -107,7 +107,7 @@ max_supported_python = "3.14"
 keep_full_version = true
 
 [tool.pytest.ini_options]
-addopts = "--tb=short --strict-markers -ra"
+addopts = "--tb=short --strict-markers -ra --no-migrations"
 testpaths = [ "tests" ]
 markers = [
   "requires_postgres: marks tests as requiring a PostgreSQL database backend",
diff --git a/rest_framework/fields.py b/rest_framework/fields.py
@@ -708,12 +708,13 @@ def to_internal_value(self, data):
         self.fail("invalid", input=data)
 
     def to_representation(self, value):
-        if self._lower_if_str(value) in self.TRUE_VALUES:
-            return True
-        elif self._lower_if_str(value) in self.FALSE_VALUES:
-            return False
-        if self._lower_if_str(value) in self.NULL_VALUES and self.allow_null:
-            return None
+        with contextlib.suppress(TypeError):
+            if self._lower_if_str(value) in self.TRUE_VALUES:
+                return True
+            elif self._lower_if_str(value) in self.FALSE_VALUES:
+                return False
+            if self._lower_if_str(value) in self.NULL_VALUES and self.allow_null:
+                return None
         return bool(value)
 
 
diff --git a/rest_framework/renderers.py b/rest_framework/renderers.py
@@ -496,6 +496,17 @@ def get_rendered_html_form(self, data, view, method, request):
             existing_serializer = None
 
         with override_method(view, request, method) as request:
+            if method == 'OPTIONS':
+                # The browsable API only needs a placeholder for OPTIONS, so
+                # avoid object-level permission checks against serializer.instance.
+                if method not in view.allowed_methods:
+                    return
+                try:
+                    view.check_permissions(request)
+                except exceptions.APIException:
+                    return
+                return True
+
             if not self.show_form_for_method(view, method, request, instance):
                 return
 
diff --git a/rest_framework/test.py b/rest_framework/test.py
@@ -1,11 +1,14 @@
 # Note that we import as `DjangoRequestFactory` and `DjangoClient` in order
 # to make it harder for the user to import the wrong thing without realizing.
 import io
+from contextlib import contextmanager
 from importlib import import_module
 
 from django.conf import settings
 from django.core.exceptions import ImproperlyConfigured
 from django.core.handlers.wsgi import WSGIHandler
+from django.core.signals import request_finished, request_started
+from django.db import close_old_connections
 from django.test import override_settings, testcases
 from django.test.client import Client as DjangoClient
 from django.test.client import ClientHandler
@@ -22,6 +25,21 @@ def force_authenticate(request, user=None, token=None):
     request._force_auth_token = token
 
 
+@contextmanager
+def _keep_connections_open():
+    """
+    Prevent Django from closing the database connection while a request
+    is dispatched, matching the behavior of Django's ClientHandler.
+    """
+    request_started.disconnect(close_old_connections)
+    request_finished.disconnect(close_old_connections)
+    try:
+        yield
+    finally:
+        request_started.connect(close_old_connections)
+        request_finished.connect(close_old_connections)
+
+
 if requests is not None:
     class HeaderDict(requests.packages.urllib3._collections.HTTPHeaderDict):
         def get_all(self, key, default):
@@ -90,7 +108,8 @@ def start_response(wsgi_status, wsgi_headers, exc_info=None):
 
             # Make the outgoing request via WSGI.
             environ = self.get_environ(request)
-            wsgi_response = self.app(environ, start_response)
+            with _keep_connections_open():
+                wsgi_response = self.app(environ, start_response)
 
             # Build the underlying urllib3.HTTPResponse
             raw_kwargs['body'] = io.BytesIO(b''.join(wsgi_response))
diff --git a/tests/conftest.py b/tests/conftest.py
@@ -3,7 +3,31 @@
 import dj_database_url
 import django
 import pytest
+from django.apps import apps
 from django.core import management
+from django.core.management.color import no_style
+from django.db import connection
+
+
+@pytest.fixture
+def reset_sequences():
+    """
+    Reset all database sequences so PKs start from 1.
+
+    PostgreSQL sequences are non-transactional and persist across
+    TestCase's transaction rollbacks. Apply this fixture to test
+    classes that rely on hardcoded PKs to keep them predictable
+    regardless of execution order. No-op on SQLite.
+    """
+    if connection.vendor != 'postgresql':
+        return
+    table_names = set(connection.introspection.table_names())
+    models = [m for m in apps.get_models() if m._meta.db_table in table_names]
+    sql_list = connection.ops.sequence_reset_sql(no_style(), models)
+    if sql_list:
+        with connection.cursor() as cursor:
+            for sql in sql_list:
+                cursor.execute(sql)
 
 
 def pytest_addoption(parser):
diff --git a/tests/test_fields.py b/tests/test_fields.py
@@ -772,33 +772,38 @@ class TestBooleanField(FieldValues):
         'foo': ['Must be a valid boolean.'],
         None: ['This field may not be null.']
     }
-    outputs = {
-        'True': True,
-        'TRUE': True,
-        'tRuE': True,
-        't': True,
-        'T': True,
-        'true': True,
-        'on': True,
-        'ON': True,
-        'oN': True,
-        'False': False,
-        'FALSE': False,
-        'fALse': False,
-        'f': False,
-        'F': False,
-        'false': False,
-        'off': False,
-        'OFF': False,
-        'oFf': False,
-        '1': True,
-        '0': False,
-        1: True,
-        0: False,
-        True: True,
-        False: False,
-        'other': True
-    }
+    outputs = [
+        ('True', True),
+        ('TRUE', True),
+        ('tRuE', True),
+        ('t', True),
+        ('T', True),
+        ('true', True),
+        ('on', True),
+        ('ON', True),
+        ('oN', True),
+        ('False', False),
+        ('FALSE', False),
+        ('fALse', False),
+        ('f', False),
+        ('F', False),
+        ('false', False),
+        ('off', False),
+        ('OFF', False),
+        ('oFf', False),
+        ('1', True),
+        ('0', False),
+        (1, True),
+        (0, False),
+        (True, True),
+        (False, False),
+        ('other', True),
+        ([], False),
+        ({}, False),
+        (set(), False),
+        ([1], True),
+        ({'example': 'value'}, True),
+    ]
     field = serializers.BooleanField()
 
     def test_disallow_unhashable_collection_types(self):
diff --git a/tests/test_filters.py b/tests/test_filters.py
@@ -45,7 +45,7 @@ def test_filter_queryset_raises_error(self):
 
 
 class SearchFilterModel(models.Model):
-    title = models.CharField(max_length=20)
+    title = models.CharField(max_length=25)
     text = models.CharField(max_length=100)
 
 
@@ -459,6 +459,7 @@ class Meta:
         fields = '__all__'
 
 
+@pytest.mark.usefixtures("reset_sequences")
 class SearchFilterM2MTests(TestCase):
     def setUp(self):
         # Sequence of title/text/attributes is:
@@ -657,6 +658,7 @@ class Meta:
         fields = '__all__'
 
 
+@pytest.mark.usefixtures("reset_sequences")
 class OrderingFilterTests(TestCase):
     def setUp(self):
         # Sequence of title/text is:
@@ -974,6 +976,7 @@ class Meta:
         fields = ('id', 'user')
 
 
+@pytest.mark.usefixtures("reset_sequences")
 class SensitiveOrderingFilterTests(TestCase):
     def setUp(self):
         for idx in range(3):
diff --git a/tests/test_generics.py b/tests/test_generics.py
@@ -76,6 +76,7 @@ class SlugBasedInstanceView(InstanceView):
 
 
 # Tests
+@pytest.mark.usefixtures("reset_sequences")
 class TestRootView(TestCase):
     def setUp(self):
         """
@@ -171,6 +172,7 @@ def test_post_error_root_view(self):
 EXPECTED_QUERIES_FOR_PUT = 2
 
 
+@pytest.mark.usefixtures("reset_sequences")
 class TestInstanceView(TestCase):
     def setUp(self):
         """
@@ -334,6 +336,7 @@ def setUp(self):
         self.view = FKInstanceView.as_view()
 
 
+@pytest.mark.usefixtures("reset_sequences")
 class TestOverriddenGetObject(TestCase):
     """
     Test cases for a RetrieveUpdateDestroyAPIView that does NOT use the
@@ -477,6 +480,7 @@ class Meta:
         return DynamicSerializer
 
 
+@pytest.mark.usefixtures("reset_sequences")
 class TestFilterBackendAppliedToViews(TestCase):
     def setUp(self):
         """
diff --git a/tests/test_model_serializer.py b/tests/test_model_serializer.py
@@ -758,6 +758,7 @@ class DisplayValueModel(models.Model):
     color = models.ForeignKey(DisplayValueTargetModel, on_delete=models.CASCADE)
 
 
+@pytest.mark.usefixtures("reset_sequences")
 class TestRelationalFieldDisplayValue(TestCase):
     def setUp(self):
         DisplayValueTargetModel.objects.bulk_create([
diff --git a/tests/test_pagination.py b/tests/test_pagination.py
@@ -1045,6 +1045,7 @@ class CursorPaginationModel(models.Model):
     created = models.IntegerField()
 
 
+@pytest.mark.usefixtures("reset_sequences")
 class TestCursorPaginationWithValueQueryset(CursorPaginationTestsMixin, TestCase):
     """
     Unit tests for `pagination.CursorPagination` for value querysets.
diff --git a/tests/test_permissions.py b/tests/test_permissions.py
@@ -2,6 +2,7 @@
 import unittest
 from unittest import mock
 
+import pytest
 from django.conf import settings
 from django.contrib.auth.models import AnonymousUser, Group, Permission, User
 from django.db import models
@@ -73,6 +74,7 @@ def basic_auth_header(username, password):
     return 'Basic %s' % base64_credentials
 
 
+@pytest.mark.usefixtures("reset_sequences")
 class ModelPermissionsIntegrationTests(TestCase):
     def setUp(self):
         User.objects.create_user('disallowed', 'disallowed@example.com', 'password')
@@ -325,6 +327,7 @@ def get_queryset(self):
 get_queryset_object_permissions_view = GetQuerysetObjectPermissionInstanceView.as_view()
 
 
+@pytest.mark.usefixtures("reset_sequences")
 @unittest.skipUnless('guardian' in settings.INSTALLED_APPS, 'django-guardian not installed')
 class ObjectPermissionsIntegrationTests(TestCase):
     """
@@ -504,6 +507,7 @@ class DeniedObjectViewWithDetail(PermissionInstanceView):
 denied_object_view_with_detail = DeniedObjectViewWithDetail.as_view()
 
 
+@pytest.mark.usefixtures("reset_sequences")
 class CustomPermissionsTests(TestCase):
     def setUp(self):
         BasicModel(text='foo').save()
diff --git a/tests/test_prefetch_related.py b/tests/test_prefetch_related.py
@@ -1,3 +1,4 @@
+import pytest
 from django.contrib.auth.models import Group, User
 from django.test import TestCase
 
@@ -18,6 +19,7 @@ class UserUpdate(generics.UpdateAPIView):
     serializer_class = UserSerializer
 
 
+@pytest.mark.usefixtures("reset_sequences")
 class TestPrefetchRelatedUpdates(TestCase):
     def setUp(self):
         self.user = User.objects.create(username='tom', email='tom@example.com')
diff --git a/tests/test_relations_hyperlink.py b/tests/test_relations_hyperlink.py
diff --git a/tests/test_relations_pk.py b/tests/test_relations_pk.py
diff --git a/tests/test_relations_slug.py b/tests/test_relations_slug.py
diff --git a/tests/test_renderers.py b/tests/test_renderers.py
diff --git a/tests/test_validators.py b/tests/test_validators.py
diff --git a/tox.ini b/tox.ini

Original file line number	Diff line number	Diff line change
`@@ -5,7 +5,7 @@ source:`
`5`	`5`
`6`	`6`	`> If you're doing REST-based web service stuff ... you should ignore request.POST.`
`7`	`7`	`>`
`8`		`-> — Malcom Tredinnick, [Django developers group][cite]`
	`8`	`+> — Malcolm Tredinnick, [Django developers group][cite]`
`9`	`9`
`10`	`10`	REST framework's `Request` class extends the standard `HttpRequest`, adding support for REST framework's flexible request parsing and request authentication.
`11`	`11`