Django 2.1

Django 2.1 added a built-in "view" permission for each model alongside add, change, and delete permissions. It added QuerySet.explain() for obtaining database query plans, support for Python 3.7, and template support for safely embedding JSON with json_script. It also raised some platform baselines relative to Django 2.0, including dropping Python 3.4 support and requiring newer SQLite and PostgreSQL versions.

Django 2.1 has reached end of life, so defects and security issues in the framework are no longer corrected on this line. Remaining on it also preserves older Python and database compatibility constraints, makes dependency upgrades harder, and increases the size and risk of a later migration. Applications that implement authorization around model permissions should account for the added view permission when auditing permission assignment and access-control behavior.

Inventory the deployed Python version, database engine and version, Django extensions, authentication and authorization customizations, and any code relying on deprecated Django behavior. Establish a tested upgrade branch, upgrade through supported Django feature releases in sequence rather than skipping compatibility checks, and run the full application, migration, security, and database test suites at each step. Review each intervening release note for removed APIs and changed defaults, specifically test model-permission handling, validate generated migrations and query behavior on the production database, then move to a currently supported Django release.