- Drop Django 3.2 to 4.1 support.
Updated to the latest set of features from Chrome 131 dev.
New features:
popins
web-app-installation
Drop Python 3.8 support.
Support Python 3.13.
Updated to the latest set of features from Chrome 129 dev.
New features:
captured-surface-control
ch-ua-form-factors
(renamed fromch-ua-form-factor
)deferred-fetch
digital-credentials-get
Removed features:
ch-ua-form-factor
direct-sockets
usb-unrestricted
- Support Django 5.1.
Fix ASGI compatibility on Python 3.12.
Thanks to Alexandre Spaeth in PR #426.
Updated to the latest set of features from Chrome 122 dev.
New features:
publickey-credentials-create
usb-unrestricted
Support Django 5.0.
Updated to the latest set of features from Chrome 119 dev.
New features:
browsing-topics
ch-prefers-reduced-transparency
ch-ua-form-factor
interest-cohort
join-ad-interest-group
private-aggregation
private-state-token-issuance
private-state-token-redemption
run-ad-auction
shared-storage
shared-storage-select-url
window-management
- Drop Python 3.7 support.
- Support Python 3.12.
Support Django 4.2.
Updated to the latest set of features from Chrome 111 dev.
New features:
identity-credentials-get
storage-access
Updated to the latest set of features from Chrome 109 dev.
New features:
ch-prefers-reduced-motion
compute-pressure
direct-sockets
unload
Removed features:
ch-partitioned-cookies
- Add async support to the middleware, to reduce overhead on async views.
- Support Python 3.11.
- Support Django 4.1.
Updated to the latest set of features from Chrome 104 dev.
New features:
bluetooth
ch-save-data
local-fonts
Restore
interest-cohort
feature and recommend disabling it in README. The original API, FLoC, was removed from Chrome, but there’s a replacement proposal The Topics API. The proposal states that theinterest-cohort
feature will be recognized to disable it.
- Drop support for Django 2.2, 3.0, and 3.1.
Updated to the latest set of features from Chrome 100 dev.
New features:
ch-partitioned-cookies
Updated to the latest set of features from Chrome 100 dev.
New features:
ch-ua-wow64
Removed features:
interest-cohort
- Drop Python 3.6 support.
Updated to the latest set of features from Chrome 98 dev.
New features:
ch-ua-full-version-list
keyboard-map
Updated to the latest set of features from Chrome 96 dev and Firefox 93.
New features:
ch-viewport-height
speaker-selection
Removed features:
ch-lang
ch-ua-reduced
shared-autofill
speaker
- Support Python 3.10.
- Support Django 4.0.
Updated to the latest set of features from Chrome 94 dev.
New features:
ch-ua-bitness
ch-ua-reduced
Add type hints.
Updated to the latest set of features from Chrome 92 dev.
New features:
attribution-reporting
ch-prefers-color-scheme
shared-autofill
window-placement
Removed features:
conversion-tracking
- Improve setup instructions.
- Rename the package from
django-feature-policy
todjango-permissions-policy
and the module name fromdjango_feature_policy
todjango_permissions_policy
accordingly. - Stop sending the
Feature-Policy
header. Chrome now logs warnings if it is sent alongsidePermissions-Policy
. - Remove support for the legacy setting name
FEATURE_POLICY
and the old middleware aliasFeaturePolicyMiddleware
. - Stop distributing tests to reduce package size. Tests are not intended to be run outside of the tox setup in the repository. Repackagers can use GitHub's tarballs per tag.
Updated to the latest set of features from Chrome 91 dev.
New features:
conversion-measurement
interest-cohort
otp-credentials
Removed features:
document-write
downloads
forms
modals
orientation-lock
pointer-lock
popups
presentation
scripts
sync-script
top-navigation
- Support Django 3.2.
- Drop Python 3.5 support.
- Support Python 3.9.
Drop Django 2.0 and 2.1 support.
Move license from ISC to MIT License.
Update for the rename of the header from
Feature-Policy
toPermissions-Policy
. This means the middleware has been renamed toPermissionsPolicyMiddleware
and the setting has been renamed toPERMISSIONS_POLICY
. The old names are supported as aliases for backwards compatibility. The middleware also sets both the old and new names for compatibility with older browsers.Updated to the latest set of features from Chrome 86.
New features:
ch-ua-platform-version
clipboard-read
clipboard-write
cross-origin-isolated
gamepad
publickey-credentials-get
Removed features:
layout-animations
lazyload
loading-frame-default-eager
Added features from Firefox 81. This adds some unique features, and restores some features that Chrome has removed.
New features:
display-capture
web-share
Restored features:
speaker
vr
Updated to the latest set of features from Chrome 83.
New features:
ch-ua-full-version
screen-wake-lock
Removed features:
font-display-late-swap
oversized-images
unoptimized-lossless-images
unoptimized-lossless-images-strict
unoptimized-lossy-images
unsized-media
wake-lock
Added Django 3.1 support.
- Dropped Django 1.11 support. Only Django 2.0+ is supported now.
- Updated to the latest set of features from Chrome 81. This adds 'ch-ua-mobile', removes 'document-access', and 'vr', and renames 'downloads-without-user-activation' to 'downloads'.
- Updated to the latest set of features from Chrome. This adds 2 new features: 'document-access' and 'xr-spatial-tracking'. This also removes the 'speaker' since it has now been removed from the w3c specification.
- Updated to the latest set of features from Chrome. This adds 17 new features: 'ch-device-memory', 'ch-downlink', 'ch-dpr', 'ch-ect', 'ch-lang', 'ch-rtt', 'ch-ua', 'ch-ua-arch', 'ch-ua-model', 'ch-ua-platform', 'ch-viewport-width', 'ch-width', 'execution-while-not-rendered', and 'execution-while-out-of-viewport'. Chrome has also removed support for 'speaker' but since this is still in the specification, it has been left.
- Converted setuptools metadata to configuration file. This meant removing the
__version__
attribute from the package. If you want to inspect the installed version, useimportlib.metadata.version("django-feature-policy")
(docs / backport). - Suport Python 3.8.
- Updated to the latest set of features from Chrome. This removes 'legacy-image-formats' and 'unoptimized-images', and adds 17 new features: 'downloads-without-user-activation', 'focus-without-user-activation', 'forms', 'hid', 'idle-detection', 'loading-frame-default-eager', 'modals', 'orientation-lock', 'pointer-lock', 'popups', 'presentation', 'scripts', 'serial', 'top-navigation', 'unoptimized-lossless-images', 'unoptimized-lossless-images-strict' and 'unoptimized-lossy-images'. Note that most of these are still experimental as can be seen on the [W3C feature list](https://github.com/w3c/webappsec-feature-policy/blob/master/features.md).
- Stop marking the distributed wheel as universal. Python 2 was never supported so the wheel was never actually universal.
- Update Python support to 3.5-3.7, as 3.4 has reached its end of life.
- Make the generated header deterministic by iterating the settings dict in sorted order.
- Support Django 1.11 for completeness.
- Fix interpretation of '*' by not automatically adding quotes.
- Optimize header generation to reduce impact on every request.
- Tested on Django 2.2. No changes were needed for compatibility.
- Updated to the latest set of features from Chrome. 'animations', 'image-compression', and 'max-downscaling-image' have been removed, whilst 'document-domain', 'font-display-late-swap', 'layout-animations', 'oversized-images', 'unoptimized-images', and 'wake-lock' have been added. See more at https://github.com/w3c/webappsec-feature-policy/blob/master/features.md .
- Support for new 'lazyload' feature, per https://www.chromestatus.com/feature/5641405942726656.
- First release, supporting adding the header with a middleware.