django-debug-toolbar 6.0.0__tar.gz → 6.2.0__tar.gz

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/.editorconfig

@@ -18,3 +18,6 @@ indent_style = tab
 
 [*.bat]
 indent_style = tab
+
+[*.yml]
+indent_size = 2

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/.github/PULL_REQUEST_TEMPLATE.md

@@ -10,3 +10,6 @@ Fixes # (issue)
 
 - [ ] I have added the relevant tests for this change.
 - [ ] I have added an item to the Pending section of ``docs/changes.rst``.
+
+#### AI/LLM Usage
+- [ ] This PR includes code generated with the help of an AI/LLM

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/.github/dependabot.yml

@@ -11,3 +11,5 @@ updates:
           - "*"  # Group all Actions updates into a single larger pull request
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7

django_debug_toolbar-6.2.0/.github/release.yml

@@ -0,0 +1,6 @@
+---
+changelog:
+  exclude:
+    authors:
+      - dependabot[bot]
+      - pre-commit-ci[bot]

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/.github/workflows/coverage.yml

@@ -2,7 +2,7 @@
 name: Post coverage comment
 
 on:
-  workflow_run:
+  workflow_run: # zizmor: ignore[dangerous-triggers] - This follows GitHub's recommended pattern for posting PR comments from untrusted forks
     workflows: ["Test"]
     types:
       - completed
@@ -27,7 +27,7 @@ jobs:
       # DO NOT run actions/checkout here, for security reasons
       # For details, refer to https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
       - name: Post comment
-        uses: py-cov-action/python-coverage-comment-action@v3
+        uses: py-cov-action/python-coverage-comment-action@e623398c19eb3853a5572d4a516e10b15b5cefbc # v3.39
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_PR_RUN_ID: ${{ github.event.workflow_run.id }}

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/.github/workflows/release.yml

@@ -2,6 +2,8 @@ name: Publish Python 🐍 distribution 📦 to PyPI and TestPyPI
 
 on: push
 
+permissions: {}
+
 env:
   PYPI_URL: https://pypi.org/p/django-debug-toolbar
   PYPI_TEST_URL: https://test.pypi.org/p/django-debug-toolbar
@@ -13,9 +15,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3.x"
     - name: Install pypa/build
@@ -24,7 +28,7 @@ jobs:
     - name: Build a binary wheel and a source tarball
       run: python3 -m build
     - name: Store the distribution packages
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v5
       with:
         name: python-package-distributions
         path: dist/
@@ -43,12 +47,12 @@ jobs:
       id-token: write  # IMPORTANT: mandatory for trusted publishing
     steps:
     - name: Download all the dists
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v6
       with:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution 📦 to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1.12
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1.13
 
   github-release:
     name: >-
@@ -64,12 +68,12 @@ jobs:
 
     steps:
     - name: Download all the dists
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v6
       with:
         name: python-package-distributions
         path: dist/
     - name: Sign the dists with Sigstore
-      uses: sigstore/gh-action-sigstore-python@v3.0.1
+      uses: sigstore/gh-action-sigstore-python@f832326173235dcb00dd5d92cd3f353de3188e6c # v3.1.0
       with:
         inputs: >-
           ./dist/*.tar.gz
@@ -79,7 +83,7 @@ jobs:
         GITHUB_TOKEN: ${{ github.token }}
       run: >-
         gh release create
-        '${{ github.ref_name }}'
+        "${GITHUB_REF_NAME}"
         --repo '${{ github.repository }}'
         --notes ""
     - name: Upload artifact signatures to GitHub Release
@@ -90,7 +94,7 @@ jobs:
       # sigstore-produced signatures and certificates.
       run: >-
         gh release upload
-        '${{ github.ref_name }}' dist/**
+        "${GITHUB_REF_NAME}" dist/**
         --repo '${{ github.repository }}'
 
   publish-to-testpypi:
@@ -109,12 +113,12 @@ jobs:
 
     steps:
     - name: Download all the dists
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v6
       with:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution 📦 to TestPyPI
-      uses: pypa/gh-action-pypi-publish@release/v1.12
+      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1.13
       with:
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/.github/workflows/test.yml

@@ -2,11 +2,22 @@ name: Test
 
 on:
   push:
+    branches:
+    - main
+    tags:
+    - '**'
   pull_request:
   schedule:
     # Run weekly on Saturday
     - cron: '37 3 * * SAT'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
 jobs:
   mysql:
     runs-on: ubuntu-latest
@@ -14,11 +25,11 @@ jobs:
       fail-fast: false
       max-parallel: 5
       matrix:
-        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13']
+        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
 
     services:
       mariadb:
-        image: mariadb
+        image: mariadb:11.8
         env:
           MARIADB_ROOT_PASSWORD: debug_toolbar
         options: >-
@@ -30,10 +41,12 @@ jobs:
         - 3306:3306
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python-version }}
         allow-prereleases: true
@@ -51,6 +64,7 @@ jobs:
           ${{ matrix.python-version }}-v1-${{ hashFiles('**/pyproject.toml') }}-${{ hashFiles('**/tox.ini') }}
         restore-keys: |
           ${{ matrix.python-version }}-v1-
+        lookup-only: true
 
     - name: Install dependencies
       run: |
@@ -65,6 +79,14 @@ jobs:
         DB_PASSWORD: debug_toolbar
         DB_HOST: 127.0.0.1
         DB_PORT: 3306
+        COVERAGE_FILE: ".coverage.mysql.${{ matrix.python-version }}"
+
+    - name: Store coverage file
+      uses: actions/upload-artifact@v5
+      with:
+        name: coverage-mysql-${{ matrix.python-version }}
+        path: .coverage.mysql.${{ matrix.python-version }}*
+        include-hidden-files: true
 
 
   postgres:
@@ -73,25 +95,35 @@ jobs:
       fail-fast: false
       max-parallel: 5
       matrix:
-        # Skip 3.13 here, it needs the psycopg3 / postgis3 database
-        python-version: ['3.9', '3.10', '3.11', '3.12']
-        database: [postgresql, postgis]
-        # Add psycopg3 to our matrix for modern python versions
+        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
+        database: [postgresql, postgis, psycopg3]
+        exclude:
+            - python-version: '3.13'
+              database: postgis
+            - python-version: '3.13'
+              database: postgresql
+            - python-version: '3.14'
+              database: postgis
+            - python-version: '3.14'
+              database: postgresql
+        # Add postgis3 to our matrix for modern Python versions
         include:
-            - python-version: '3.10'
-              database: psycopg3
-            - python-version: '3.11'
-              database: psycopg3
-            - python-version: '3.12'
-              database: psycopg3
             - python-version: '3.13'
-              database: psycopg3
+              database: postgis3
             - python-version: '3.13'
+              database: psycopg3
+              env:
+                DJANGO_SELENIUM_TESTS=true
+            - python-version: '3.14'
               database: postgis3
+            - python-version: '3.14'
+              database: psycopg3
+              env:
+                DJANGO_SELENIUM_TESTS=true
 
     services:
       postgres:
-        image: postgis/postgis:14-3.1
+        image: postgis/postgis:17-3.5
         env:
           POSTGRES_DB: debug_toolbar
           POSTGRES_USER: debug_toolbar
@@ -105,10 +137,12 @@ jobs:
           --health-retries 5
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python-version }}
         allow-prereleases: true
@@ -126,6 +160,7 @@ jobs:
           ${{ matrix.python-version }}-v1-${{ hashFiles('**/pyproject.toml') }}-${{ hashFiles('**/tox.ini') }}
         restore-keys: |
           ${{ matrix.python-version }}-v1-
+        lookup-only: true
 
     - name: Install gdal-bin (for postgis)
       run: |
@@ -143,6 +178,15 @@ jobs:
         DB_BACKEND: ${{ matrix.database }}
         DB_HOST: localhost
         DB_PORT: 5432
+        DJANGO_SELENIUM_TESTS: ${{ matrix.env.DJANGO_SELENIUM_TESTS }}
+        COVERAGE_FILE: ".coverage.${{ matrix.database }}.${{ matrix.python-version }}"
+
+    - name: Store coverage file
+      uses: actions/upload-artifact@v5
+      with:
+        name: coverage-${{ matrix.database }}-${{ matrix.python-version }}
+        path: .coverage.${{ matrix.database }}.${{ matrix.python-version }}*
+        include-hidden-files: true
 
   sqlite:
     runs-on: ubuntu-latest
@@ -150,13 +194,15 @@ jobs:
       fail-fast: false
       max-parallel: 5
       matrix:
-        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13']
+        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: ${{ matrix.python-version }}
         allow-prereleases: true
@@ -174,6 +220,7 @@ jobs:
           ${{ matrix.python-version }}-v1-${{ hashFiles('**/pyproject.toml') }}-${{ hashFiles('**/tox.ini') }}
         restore-keys: |
           ${{ matrix.python-version }}-v1-
+        lookup-only: true
 
     - name: Install dependencies
       run: |
@@ -185,6 +232,14 @@ jobs:
       env:
         DB_BACKEND: sqlite3
         DB_NAME: ":memory:"
+        COVERAGE_FILE: ".coverage.sqlite.${{ matrix.python-version }}"
+
+    - name: Store coverage file
+      uses: actions/upload-artifact@v5
+      with:
+        name: coverage-sqlite-${{ matrix.python-version }}
+        path: .coverage.sqlite.${{ matrix.python-version }}*
+        include-hidden-files: true
 
   lint:
     runs-on: ubuntu-latest
@@ -192,12 +247,14 @@ jobs:
       fail-fast: false
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
+      with:
+        persist-credentials: false
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
-        python-version: 3.9
+        python-version: '3.10'
 
     - name: Get pip cache dir
       id: pip-cache
@@ -212,6 +269,7 @@ jobs:
           ${{ matrix.python-version }}-v1-${{ hashFiles('**/pyproject.toml') }}-${{ hashFiles('**/tox.ini') }}
         restore-keys: |
           ${{ matrix.python-version }}-v1-
+        lookup-only: true
 
     - name: Install dependencies
       run: |
@@ -220,3 +278,39 @@ jobs:
 
     - name: Test with tox
       run: tox -e docs,packaging
+
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+    needs:
+      - mysql
+      - postgres
+      - sqlite
+    permissions:
+      pull-requests: write
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Persist the credentials because coverage_comment needs them too.
+          persist-credentials: true
+
+      - uses: actions/download-artifact@v6
+        id: download
+        with:
+          pattern: coverage-*
+          merge-multiple: true
+
+      - name: Coverage comment
+        id: coverage_comment
+        uses: py-cov-action/python-coverage-comment-action@e623398c19eb3853a5572d4a516e10b15b5cefbc # v3.39
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MERGE_COVERAGE_FILES: true
+
+      - name: Store Pull Request comment to be posted
+        uses: actions/upload-artifact@v5
+        if: steps.coverage_comment.outputs.COMMENT_FILE_WRITTEN == 'true'
+        with:
+          name: python-coverage-comment-action
+          path: python-coverage-comment-action.txt

django_debug_toolbar-6.2.0/.github/workflows/zizmor.yml

@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read # only needed for private repos
+      actions: read # only needed for private repos
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/.gitignore

@@ -15,4 +15,5 @@ coverage.xml
 venv
 .direnv/
 .envrc
-venv
+.venv
+.vscode

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
 -   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
     -   id: check-toml
     -   id: check-yaml
@@ -14,12 +14,12 @@ repos:
     hooks:
     -   id: doc8
 -   repo: https://github.com/adamchainz/django-upgrade
-    rev: 1.25.0
+    rev: 1.29.1
     hooks:
     -   id: django-upgrade
         args: [--target-version, "4.2"]
 -   repo: https://github.com/adamchainz/djade-pre-commit
-    rev: "1.4.0"
+    rev: "1.7.0"
     hooks:
     -   id: djade
         args: [--target-version, "4.2"]
@@ -29,18 +29,18 @@ repos:
     -   id: rst-backticks
     -   id: rst-directive-colons
 -   repo: https://github.com/biomejs/pre-commit
-    rev: v2.1.2
+    rev: v2.3.10
     hooks:
       - id: biome-check
         verbose: true
 -   repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 'v0.12.4'
+    rev: 'v0.14.11'
     hooks:
       - id: ruff
         args: [--fix, --exit-non-zero-on-fix]
       - id: ruff-format
 -   repo: https://github.com/tox-dev/pyproject-fmt
-    rev: v2.6.0
+    rev: v2.11.1
     hooks:
       - id: pyproject-fmt
 -   repo: https://github.com/abravalheri/validate-pyproject

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-debug-toolbar
-Version: 6.0.0
+Version: 6.2.0
 Summary: A configurable set of panels that display various debug information about the current request/response.
 Project-URL: Changelog, https://django-debug-toolbar.readthedocs.io/en/latest/changes.html
 Project-URL: Documentation, https://django-debug-toolbar.readthedocs.io/
@@ -15,21 +15,21 @@ Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Web Environment
 Classifier: Framework :: Django
 Classifier: Framework :: Django :: 4.2
-Classifier: Framework :: Django :: 5.0
 Classifier: Framework :: Django :: 5.1
 Classifier: Framework :: Django :: 5.2
+Classifier: Framework :: Django :: 6.0
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: BSD License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Requires-Dist: django>=4.2.9
 Requires-Dist: sqlparse>=0.2
 Description-Content-Type: text/x-rst
@@ -76,7 +76,7 @@ Here's a screenshot of the toolbar in action:
 In addition to the built-in panels, a number of third-party panels are
 contributed by the community.
 
-The current stable version of the Debug Toolbar is 6.0.0. It works on
+The current stable version of the Debug Toolbar is 6.2.0. It works on
 Django ≥ 4.2.0.
 
 The Debug Toolbar has experimental support for `Django's asynchronous views

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/README.rst

@@ -40,7 +40,7 @@ Here's a screenshot of the toolbar in action:
 In addition to the built-in panels, a number of third-party panels are
 contributed by the community.
 
-The current stable version of the Debug Toolbar is 6.0.0. It works on
+The current stable version of the Debug Toolbar is 6.2.0. It works on
 Django ≥ 4.2.0.
 
 The Debug Toolbar has experimental support for `Django's asynchronous views

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/biome.json

@@ -1,5 +1,5 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.0.6/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.3.7/schema.json",
     "formatter": {
         "enabled": true,
         "useEditorconfig": true
@@ -15,6 +15,9 @@
         "enabled": true,
         "rules": {
             "recommended": true,
+            "complexity": {
+                "noImportantStyles": "off"
+            },
             "correctness": {
                 "noUndeclaredVariables": "error"
             },

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/debug_toolbar/__init__.py

@@ -4,7 +4,7 @@ APP_NAME = "djdt"
 
 # Do not use pkg_resources to find the version but set it here directly!
 # see issue #1446
-VERSION = "6.0.0"
+VERSION = "6.2.0"
 
 # Code that discovers files or modules in INSTALLED_APPS imports this module.
 urls = "debug_toolbar.urls", APP_NAME

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/debug_toolbar/_compat.py

@@ -1,3 +1,5 @@
+import django
+
 try:
     from django.contrib.auth.decorators import login_not_required
 except ImportError:
@@ -8,3 +10,11 @@ except ImportError:
         """
         view_func.login_required = False
         return view_func
+
+
+if django.VERSION >= (6, 0):
+    from django.middleware.csp import get_nonce
+else:
+    # For Django < 6.0, there is no native CSP support, hence no CSP nonces.
+    def get_nonce(request):
+        return None

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/debug_toolbar/_stubs.py

@@ -1,8 +1,9 @@
 from __future__ import annotations
 
-from typing import Any, NamedTuple, Optional
+from typing import Any, NamedTuple, Protocol
 
 from django import template as dj_template
+from django.http import HttpRequest, HttpResponse
 
 
 class InspectStack(NamedTuple):
@@ -14,7 +15,7 @@ class InspectStack(NamedTuple):
     index: int
 
 
-TidyStackTrace = list[tuple[str, int, str, str, Optional[Any]]]
+TidyStackTrace = list[tuple[str, int, str, str, Any | None]]
 
 
 class RenderContext(dj_template.context.RenderContext):
@@ -24,3 +25,7 @@ class RenderContext(dj_template.context.RenderContext):
 class RequestContext(dj_template.RequestContext):
     template: dj_template.Template
     render_context: RenderContext
+
+
+class GetResponse(Protocol):
+    def __call__(self, request: HttpRequest) -> HttpResponse: ...

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/debug_toolbar/apps.py

@@ -24,6 +24,35 @@ class DebugToolbarConfig(AppConfig):
         # allows panels like CachePanel to enable their instrumentation immediately.
         for cls in DebugToolbar.get_panel_classes():
             cls.ready()
+        _manage_migrations_visibility(self.name)
+
+    def import_models(self):
+        """
+        Override import models to avoid allowing users to dynamically fetch a model
+        that doesn't have a table behind it unless they are using the DatabaseStore.
+        This also prevents the command `migrate --run-syncdb` from creating tables
+        for the models.
+        """
+        dt_config = dt_settings.get_config()
+        if dt_config["TOOLBAR_STORE_CLASS"] == "debug_toolbar.store.DatabaseStore":
+            return super().import_models()
+        # Not using the database store, don't import the models
+        self.models = {}
+
+
+def _manage_migrations_visibility(app_name):
+    """
+    Adjust the toolbar's migration visibility by manipulating the
+    project's settings.
+
+    This is a hack since it's manipulating settings.
+    """
+    if (
+        dt_settings.get_config()["TOOLBAR_STORE_CLASS"]
+        != "debug_toolbar.store.DatabaseStore"
+    ):
+        # This effectively hides the migrations by telling Django they don't exist.
+        settings.MIGRATION_MODULES.setdefault(app_name, None)
 
 
 def check_template_config(config):

{django_debug_toolbar-6.0.0 → django_debug_toolbar-6.2.0}/debug_toolbar/forms.py

@@ -3,7 +3,8 @@ import json
 from django import forms
 from django.core import signing
 from django.core.exceptions import ValidationError
-from django.utils.encoding import force_str
+
+from debug_toolbar.sanitize import force_str
 
 
 class SignedDataForm(forms.Form):