howto-release-django.txt 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709
  1. =====================
  2. How to release Django
  3. =====================
  4. This document explains how to release Django.
  5. **Please, keep these instructions up-to-date if you make changes!** The point
  6. here is to be descriptive, not prescriptive, so feel free to streamline or
  7. otherwise make changes, but **update this document accordingly!**
  8. Overview
  9. ========
  10. There are three types of releases that you might need to make:
  11. * Security releases: disclosing and fixing a vulnerability. This'll
  12. generally involve two or three simultaneous releases -- e.g.
  13. 3.2.x, 4.0.x, and, depending on timing, perhaps a 4.1.x.
  14. * Regular version releases: either a final release (e.g. 4.1) or a
  15. bugfix update (e.g. 4.1.1).
  16. * Pre-releases: e.g. 4.2 alpha, beta, or rc.
  17. The short version of the steps involved is:
  18. #. If this is a security release, pre-notify the security distribution list
  19. one week before the actual release.
  20. #. Proofread the release notes, looking for organization and writing errors.
  21. Draft a blog post and email announcement.
  22. #. Update version numbers and create the release artifacts.
  23. #. Create the new ``Release`` in the admin on ``djangoproject.com``.
  24. #. Set the proper date but ensure the flag ``is_active`` is disabled.
  25. #. Upload the artifacts (tarball, wheel, and checksums).
  26. #. Verify package(s) signatures, check if they can be installed, and ensure
  27. minimal functionality.
  28. #. Upload the new version(s) to PyPI.
  29. #. Enable the ``is_active`` flag for each release in the admin on
  30. ``djangoproject.com``.
  31. #. Post the blog entry and send out the email announcements.
  32. #. Update version numbers post-release in stable branch(es).
  33. #. Add stub release notes for the next patch release in ``main`` and backport.
  34. There are a lot of details, so please read on.
  35. Prerequisites
  36. =============
  37. You'll need a few things before getting started. If this is your first release,
  38. you'll need to coordinate with another releaser to get all these things lined
  39. up, and write to the Ops mailing list requesting the required access and
  40. permissions.
  41. * A Unix environment with these tools installed (in alphabetical order):
  42. * bash
  43. * git
  44. * GPG
  45. * make
  46. * man
  47. * hashing tools (typically ``md5sum``, ``sha1sum``, and ``sha256sum`` on
  48. Linux, or ``md5`` and ``shasum`` on macOS)
  49. * python
  50. * A GPG key pair. Ensure that the private part of this key is securely stored.
  51. The public part needs to be uploaded to your GitHub account, and also to the
  52. Jenkins server running the "confirm release" job.
  53. .. admonition:: More than one GPG key
  54. If the key you want to use is not your default signing key, you'll need to
  55. add ``-u you@example.com`` to every GPG signing command shown below, where
  56. ``you@example.com`` is the email address associated with the key you want
  57. to use.
  58. * A clean Python virtual environment per Django version being released, with
  59. these required Python packages installed:
  60. .. code-block:: shell
  61. $ python -m pip install build twine
  62. * Access to `Django's project on PyPI <https://pypi.org/project/Django/>`_ to
  63. upload binaries, ideally with extra permissions to `yank a release
  64. <https://pypi.org/help/#yanked>`_ if necessary. Create a project-scoped token
  65. following the `official documentation <https://pypi.org/help/#apitoken>`_
  66. and set up your ``$HOME/.pypirc`` file like this:
  67. .. code-block:: ini
  68. :caption: ``~/.pypirc``
  69. [distutils]
  70. index-servers =
  71. pypi
  72. django
  73. [pypi]
  74. username = __token__
  75. password = # User-scoped or project-scoped token, to set as the default.
  76. [django]
  77. repository = https://upload.pypi.org/legacy/
  78. username = __token__
  79. password = # A project token.
  80. * Access to `Django's project on Transifex
  81. <https://app.transifex.com/django/django/>`_, with a Manager role. Generate
  82. an API Token in the `user setting section
  83. <https://app.transifex.com/user/settings/api/>`_ and set up your
  84. ``$HOME/.transifexrc`` file like this:
  85. .. code-block:: ini
  86. :caption: ``~/.transifexrc``
  87. [https://www.transifex.com]
  88. rest_hostname = https://rest.api.transifex.com
  89. token = # API token
  90. * Access to the Django admin on ``djangoproject.com`` as a "Site maintainer".
  91. * Access to create a post in the `Django Forum - Announcements category
  92. <https://forum.djangoproject.com/c/announcements/7>`_ and to send emails to
  93. the `django-announce <https://groups.google.com/g/django-announce/>`_
  94. mailing list.
  95. * Access to the ``django-security`` repo in GitHub. Among other things, this
  96. provides access to the pre-notification distribution list (needed for
  97. security release preparation tasks).
  98. * Access to the Django project on `Read the Docs
  99. <https://readthedocs.org/projects/django/>`_.
  100. Pre-release tasks
  101. =================
  102. A few items need to be taken care of before even beginning the release process.
  103. This stuff starts about a week before the release; most of it can be done
  104. any time leading up to the actual release.
  105. 10 (or more) days before a security release
  106. -------------------------------------------
  107. #. Request the `CVE IDs <https://cveform.mitre.org/>`_ for the security
  108. issue(s) being released. One CVE ID per issue, requested with
  109. ``Vendor: djangoproject`` and ``Product: django``.
  110. #. Generate the relevant (private) patch(es) using ``git format-patch``, one
  111. for the ``main`` branch and one for each stable branch being patched.
  112. A week before a security release
  113. --------------------------------
  114. #. Send out pre-notification exactly **one week** before the security release.
  115. The template for that email and a list of the recipients are in the private
  116. ``django-security`` GitHub wiki. BCC the pre-notification recipients and be
  117. sure to include the relevant CVE IDs. Attach all the relevant patches
  118. (targeting ``main`` and the stable branches) and sign the email text with
  119. the key you'll use for the release, with a command like:
  120. .. code-block:: shell
  121. $ gpg --clearsign --digest-algo SHA256 prenotification-email.txt
  122. #. :ref:`Notify django-announce <security-disclosure>` of the upcoming
  123. security release with a general message such as:
  124. .. code-block:: text
  125. Notice of upcoming Django security releases (3.2.24, 4.2.10 and 5.0.2)
  126. Django versions 5.0.2, 4.2.10, and 3.2.24 will be released on Tuesday,
  127. February 6th, 2024 around 1500 UTC. They will fix one security defect
  128. with severity "moderate".
  129. For details of severity levels, see:
  130. https://docs.djangoproject.com/en/dev/internals/security/#how-django-discloses-security-issues
  131. A few days before any release
  132. -----------------------------
  133. #. As the release approaches, watch Trac to make sure no release blockers are
  134. left for the upcoming release. Under exceptional circumstances, such as to
  135. meet a pre-determined security release date, a release could still go ahead
  136. with an open release blocker. The releaser is trusted with the decision to
  137. release with an open release blocker or to postpone the release date of a
  138. non-security release if required.
  139. #. Check with the other mergers to make sure they don't have any uncommitted
  140. changes for the release.
  141. #. Proofread the release notes, including looking at the online version to
  142. :ref:`catch any broken links <documentation-link-check>` or reST errors, and
  143. make sure the release notes contain the correct date.
  144. #. Double-check that the release notes mention deprecation timelines
  145. for any APIs noted as deprecated, and that they mention any changes
  146. in Python version support.
  147. #. Double-check that the release notes index has a link to the notes
  148. for the new release; this will be in ``docs/releases/index.txt``.
  149. #. If this is a :term:`feature release`, ensure translations from Transifex
  150. have been integrated. This is typically done by a separate translation's
  151. manager rather than the releaser, but here are the steps. This process is a
  152. bit lengthy so be sure to set aside 4-10 hours to do this, and ideally plan
  153. for this task one or two days ahead of the release day.
  154. In addition to having a configured Transifex account, the
  155. `tx CLI <https://developers.transifex.com/docs/cli>`_ should be available in
  156. your ``PATH``. Then, you can fetch all the translations by running:
  157. .. code-block:: shell
  158. $ python scripts/manage_translations.py fetch
  159. This command takes some time to run. When done, carefully inspect the output
  160. for potential errors and/or warnings. If there are some, you will need to
  161. debug and resolve them on a case by case basis.
  162. The recently fetched translations need some manual adjusting. First of all,
  163. the ``PO-Revision-Date`` values must be manually bumped to be later than
  164. ``POT-Creation-Date``. You can use a command similar to this to bulk update
  165. all the ``.po`` files (compare the diff against the relevant stable branch):
  166. .. code-block:: shell
  167. $ git diff --name-only stable/5.0.x | grep "\.po" | xargs sed -ri "s/PO-Revision-Date: [0-9\-]+ /PO-Revision-Date: $(date -I) /g"
  168. All the new ``.po`` files should be manually and carefully inspected to
  169. avoid committing a change in a file without any new translations. Also,
  170. there shouldn't be any changes in the "plural forms": if there are any
  171. (usually Spanish and French report changes for this) those will need
  172. reverting.
  173. Lastly, commit the changed/added files (both ``.po`` and ``.mo``) and create
  174. a new PR targeting the stable branch of the corresponding release (example
  175. `PR updating translations for 4.2
  176. <https://github.com/django/django/pull/16715>`_).
  177. #. :ref:`Update the django-admin manual page <django-admin-manpage>`:
  178. .. code-block:: shell
  179. $ cd docs
  180. $ make man
  181. $ man _build/man/django-admin.1 # do a quick sanity check
  182. $ cp _build/man/django-admin.1 man/django-admin.1
  183. and then commit the changed man page.
  184. #. If this is the "dot zero" release of a new series, create a new branch from
  185. the current stable branch in the `django-docs-translations
  186. <https://github.com/django/django-docs-translations>`_ repository. For
  187. example, when releasing Django 4.2:
  188. .. code-block:: shell
  189. $ git checkout -b stable/4.2.x origin/stable/4.1.x
  190. $ git push origin stable/4.2.x:stable/4.2.x
  191. #. Write the announcement blog post for the release. You can enter it into the
  192. admin at any time and mark it as inactive. Here are a few examples: `example
  193. security release announcement`__, `example regular release announcement`__,
  194. `example pre-release announcement`__.
  195. __ https://www.djangoproject.com/weblog/2013/feb/19/security/
  196. __ https://www.djangoproject.com/weblog/2012/mar/23/14/
  197. __ https://www.djangoproject.com/weblog/2012/nov/27/15-beta-1/
  198. A few days before a feature freeze
  199. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  200. In preparation for the alpha release, the directory
  201. ``/home/www/www/media/releases/A.B`` must be created on the djangoproject
  202. server.
  203. Before the feature freeze, a branch targeting ``main`` must be created to
  204. prepare for the next feature release. It should be reviewed and approved a few
  205. days before the freeze, allowing it to be merged after the stable branch is
  206. cut. The following items should be addressed in this branch:
  207. #. Update the ``VERSION`` tuple in ``django/__init__.py``, incrementing to the
  208. next expected release (:commit:`example commit
  209. <96700c7b378c592f0b1732302c22af2fd2c87fc6>`).
  210. #. Create a stub release note for the next feature release. Use the stub from
  211. the previous feature release or copy the contents from the current version
  212. and delete most of the contents leaving only the headings
  213. (:commit:`example commit <9b5ad4056ccf9ff7ea548f72d28eb66c1b4f84cc>`).
  214. #. Remove ``.. versionadded::`` and ``.. versionchanged::`` annotations in the
  215. documentation from two releases ago, as well as any remaining older
  216. annotations. For example, in Django 5.1, notes for 4.2 will be removed
  217. (:commit:`example commit <9edb7833b89e811eefd94974fb987f4605b0c0d7>`).
  218. #. Remove features that have reached the end of their deprecation cycle,
  219. including their docs and the ``.. deprecated::`` annotation. Each removal
  220. should be done in a separate commit for clarity. In the commit message, add
  221. a ``Refs #XXXXX --`` prefix linking to the original ticket where the
  222. deprecation began if possible. Make sure this gets noted in the removed
  223. features section in the release notes (:commit:`example commit
  224. <f2d9c76aa7096ef3eed675b9eb824858f9dd81e5>`).
  225. #. Increase the default PBKDF2 iterations in
  226. ``django.contrib.auth.hashers.PBKDF2PasswordHasher`` by about 20%
  227. (pick a round number). Run the tests, and update the 3 failing
  228. hasher tests with the new values. Make sure this gets noted in the
  229. release notes (:commit:`example commit
  230. <7288866da4dddf3705148c703421858ec19cdb78>`).
  231. Concrete examples for past feature release bootstrap branches: `5.2 bootstrap
  232. <https://github.com/django/django/pull/18127>`_, `5.1 bootstrap
  233. <https://github.com/django/django/pull/17246>`_, `5.0 bootstrap
  234. <https://github.com/django/django/pull/16432>`_.
  235. Feature freeze tasks
  236. ====================
  237. #. Remove empty sections from the release notes (:commit:`example commit
  238. <9e6e58bad237a80ddd5e3ab8b834cecdaad8455e>`).
  239. #. Build the release notes locally and read them. Make any necessary change
  240. to improve flow or fix grammar (:commit:`example commit
  241. <435bdab93889dae01e71c79598edab10627cc1f9>`).
  242. #. Create a new stable branch from ``main``. For example, when feature freezing
  243. Django 5.2:
  244. .. code-block:: shell
  245. $ git checkout -b stable/5.2.x upstream/main
  246. $ git push upstream -u stable/5.2.x:stable/5.2.x
  247. At the same time, update the ``django_next_version`` variable in
  248. ``docs/conf.py`` on the stable release branch to point to the new
  249. development version. For example, when creating ``stable/5.2.x``, set
  250. ``django_next_version`` to ``'6.0'`` on the new stable branch
  251. (:commit:`example commit <1eb62e5b622ef7fd6e0123d8bbf6662d893d5d08>`).
  252. #. Go to the `Add release page in the admin`__, create a ``Release`` object for
  253. the *final* release, ensuring that the *Release date* field is blank, thus
  254. marking it as *unreleased*. For example, when creating ``stable/5.2.x``,
  255. create ``5.2`` with the Release date field blank. If the release is part of
  256. an LTS branch, mark it so.
  257. __ https://www.djangoproject.com/admin/releases/release/add/
  258. #. Go to the `Add document release page in the admin`__, create a new
  259. ``DocumentRelease`` object for the English language for the newly created
  260. ``Release`` object. Do not mark this as default.
  261. __ https://www.djangoproject.com/admin/docs/documentrelease/add/
  262. #. Add the new branch to `Read the Docs
  263. <https://readthedocs.org/projects/django/>`_. Since the automatically
  264. generated version names ("stable-A.B.x") differ from the version names
  265. used in Read the Docs ("A.B.x"), `create a ticket
  266. <https://github.com/readthedocs/readthedocs.org/issues/5537>`_ requesting
  267. the new version.
  268. #. `Request the new classifier on PyPI
  269. <https://github.com/pypa/trove-classifiers/issues/29>`_. For example
  270. ``Framework :: Django :: 5.2``.
  271. #. Create a `roadmap page
  272. <https://code.djangoproject.com/wiki/Version6.0Roadmap>`_ for the next
  273. release on Trac. To create a new page on the Wiki, navigate to the URL of
  274. where you wish to create the page and a "Create this page" button will be
  275. available.
  276. #. Update the current branch under active development and add pre-release
  277. branch in the `Django release process
  278. <https://code.djangoproject.com/#Djangoreleaseprocess>`_ on Trac.
  279. #. Update the ``docs/fixtures/doc_releases.json`` JSON fixture for
  280. djangoproject.com, so people without access to the production DB can still
  281. run an up-to-date copy of the docs site
  282. (`example PR <https://github.com/django/djangoproject.com/pull/1446>`__).
  283. This will be merged after the final release.
  284. Actually rolling the release
  285. ============================
  286. OK, this is the fun part, where we actually push out a release! If you're
  287. issuing **multiple releases**, repeat these steps for each release.
  288. #. Check `Jenkins`__ is green for the version(s) you're putting out. You
  289. probably shouldn't issue a release until it's green, and you should make
  290. sure that the latest green run includes the changes that you are releasing.
  291. __ https://djangoci.com
  292. #. Cleanup the release notes for this release. Make these changes in ``main``
  293. and backport to all branches where the release notes for a particular
  294. version are located.
  295. #. For a feature release, remove the ``UNDER DEVELOPMENT`` header at the top
  296. of the release notes, remove the ``Expected`` prefix and update the
  297. release date, if necessary (:commit:`example commit
  298. <1994a2643881a9e3f9fa8d3e0794c1a9933a1831>`).
  299. #. For a patch release, remove the ``Expected`` prefix and update the
  300. release date for all releases, if necessary (:commit:`example commit
  301. <34a503162fe222033a1cd3249bccad014fcd1d20>`).
  302. #. A release always begins from a release branch, so you should make sure
  303. you're on an up-to-date stable branch. Also, you should have available a
  304. clean and dedicated virtual environment per version being released. For
  305. example:
  306. .. code-block:: shell
  307. $ git checkout stable/4.1.x
  308. $ git pull
  309. #. If this is a security release, merge the appropriate patches from
  310. ``django-security``. Rebase these patches as necessary to make each one a
  311. plain commit on the release branch rather than a merge commit. To ensure
  312. this, merge them with the ``--ff-only`` flag; for example:
  313. .. code-block:: shell
  314. $ git checkout stable/4.1.x
  315. $ git merge --ff-only security/4.1.x
  316. (This assumes ``security/4.1.x`` is a branch in the ``django-security`` repo
  317. containing the necessary security patches for the next release in the 4.1
  318. series.)
  319. If git refuses to merge with ``--ff-only``, switch to the security-patch
  320. branch and rebase it on the branch you are about to merge it into (``git
  321. checkout security/4.1.x; git rebase stable/4.1.x``) and then switch back and
  322. do the merge. Make sure the commit message for each security fix explains
  323. that the commit is a security fix and that an announcement will follow
  324. (:commit:`example security commit <bf39978a53f117ca02e9a0c78b76664a41a54745>`).
  325. #. Update the version number in ``django/__init__.py`` for the release.
  326. Please see `notes on setting the VERSION tuple`_ below for details
  327. on ``VERSION`` (:commit:`example commit
  328. <2719a7f8c161233f45d34b624a9df9392c86cc1b>`).
  329. #. If this is a pre-release package also update the "Development Status"
  330. trove classifier in ``pyproject.toml`` to reflect this. An ``rc``
  331. pre-release should not change the trove classifier (:commit:`example
  332. commit for alpha release <759921c8e9ad151932fc913ab429fef0a6112ef8>`,
  333. :commit:`example commit for beta release
  334. <25fec8940b24107e21314ab6616e18ce8dec1c1c>`).
  335. #. Otherwise, make sure the classifier is set to
  336. ``Development Status :: 5 - Production/Stable``.
  337. Building the artifacts
  338. ----------------------
  339. .. admonition:: Optionally use helper scripts
  340. You can streamline some of the steps below using helper scripts from the Wiki:
  341. * `Release script for versions 5.1 and newer
  342. <https://code.djangoproject.com/wiki/ReleaseScript>`_
  343. * `Release script for versions 5.0 and older
  344. <https://code.djangoproject.com/wiki/ReleaseScript5.0AndOlder>`_
  345. * `Test new version script
  346. <https://code.djangoproject.com/wiki/ReleaseTestNewVersion>`_
  347. #. Tag the release using ``git tag``. For example:
  348. .. code-block:: shell
  349. $ git tag --sign --message="Tag 4.1.1" 4.1.1
  350. You can check your work running ``git tag --verify <tag>``.
  351. #. Make sure you have an absolutely clean tree by running ``git clean -dfx``.
  352. #. Run ``python -m build`` to generate the release packages. This will create
  353. the release artifacts (tarball and wheel) in a ``dist/`` directory. For
  354. Django 5.0 or older, you need to run ``make -f extras/Makefile`` instead.
  355. #. Generate the hashes of the release packages:
  356. .. code-block:: shell
  357. $ cd dist
  358. $ md5sum *
  359. $ sha1sum *
  360. $ sha256sum *
  361. #. Create a "checksums" file, ``Django-<<VERSION>>.checksum.txt`` containing
  362. the hashes and release information. Start with this template and insert the
  363. correct version, date, GPG key ID (from
  364. ``gpg --list-keys --keyid-format LONG``), release manager's GitHub username,
  365. release URL, and checksums:
  366. .. code-block:: text
  367. This file contains MD5, SHA1, and SHA256 checksums for the source-code
  368. tarball and wheel files of Django <<VERSION>>, released <<DATE>>.
  369. To use this file, you will need a working install of PGP or other
  370. compatible public-key encryption software. You will also need to have
  371. the Django release manager's public key in your keyring. This key has
  372. the ID ``XXXXXXXXXXXXXXXX`` and can be imported from the MIT
  373. keyserver, for example, if using the open-source GNU Privacy Guard
  374. implementation of PGP:
  375. gpg --keyserver pgp.mit.edu --recv-key XXXXXXXXXXXXXXXX
  376. or via the GitHub API:
  377. curl https://github.com/<<RELEASE MANAGER GITHUB USERNAME>>.gpg | gpg --import -
  378. Once the key is imported, verify this file:
  379. gpg --verify <<THIS FILENAME>>
  380. Once you have verified this file, you can use normal MD5, SHA1, or SHA256
  381. checksumming applications to generate the checksums of the Django
  382. package and compare them to the checksums listed below.
  383. Release packages
  384. ================
  385. https://www.djangoproject.com/download/<<VERSION>>/tarball/
  386. https://www.djangoproject.com/download/<<VERSION>>/wheel/
  387. MD5 checksums
  388. =============
  389. <<MD5SUM>> <<RELEASE TAR.GZ FILENAME>>
  390. <<MD5SUM>> <<RELEASE WHL FILENAME>>
  391. SHA1 checksums
  392. ==============
  393. <<SHA1SUM>> <<RELEASE TAR.GZ FILENAME>>
  394. <<SHA1SUM>> <<RELEASE WHL FILENAME>>
  395. SHA256 checksums
  396. ================
  397. <<SHA256SUM>> <<RELEASE TAR.GZ FILENAME>>
  398. <<SHA256SUM>> <<RELEASE WHL FILENAME>>
  399. #. Sign the checksum file (``gpg --clearsign --digest-algo SHA256
  400. Django-<version>.checksum.txt``). This generates a signed document,
  401. ``Django-<version>.checksum.txt.asc`` which you can then verify using ``gpg
  402. --verify Django-<version>.checksum.txt.asc``.
  403. Making the release(s) available to the public
  404. =============================================
  405. Now you're ready to actually put the release out there. To do this:
  406. #. Create a new ``Release`` entry in the `djangoproject.com's admin
  407. <https://www.djangoproject.com/admin/releases/release/add/>`_. If this is a
  408. security release, this should be done 15 minutes before the announced
  409. release time, no sooner:
  410. Version
  411. Must match the version number as defined in the tarball
  412. (``django-<version>.tar.gz``). For example: "5.2", "4.1.1", or "4.2rc1".
  413. Is active
  414. Set to False until the release is fully published (last step).
  415. LTS
  416. Enable if the release is part of an :abbr:`LTS (Long Term Support)`
  417. branch.
  418. Dates
  419. Set the release date to today. This release will not be published until
  420. ``is_active`` is enabled.
  421. Artifacts
  422. Upload the tarball (``django-<version>.tar.gz``), wheel
  423. (``django-<version>-py3-none-any.whl``), and checksum
  424. (``django-<version>.checksum.txt.asc``) files created earlier.
  425. #. Test that the release packages install correctly using ``pip``. Here's one
  426. simple method (this just tests that the binaries are available, that they
  427. install correctly, and that migrations and the development server start, but
  428. it'll catch silly mistakes):
  429. https://code.djangoproject.com/wiki/ReleaseTestNewVersion.
  430. #. Run the `confirm-release`__ build on Jenkins to verify the checksum file(s)
  431. (e.g. use ``4.2rc1`` for
  432. https://media.djangoproject.com/pgp/Django-4.2rc1.checksum.txt).
  433. __ https://djangoci.com/job/confirm-release/
  434. #. Upload the release packages to PyPI (for pre-releases, only upload the wheel
  435. file):
  436. .. code-block:: shell
  437. $ twine upload --repository django dist/*
  438. #. Update the newly created ``Release`` in the admin in ``djangoproject.com``
  439. and enable the ``is_active`` flag.
  440. #. Push your work and the new tag:
  441. .. code-block:: shell
  442. $ git push
  443. $ git push --tags
  444. #. Make the blog post announcing the release live.
  445. #. For a new version release (e.g. 4.1, 4.2), update the default stable version
  446. of the docs by flipping the ``is_default`` flag to ``True`` on the
  447. appropriate ``DocumentRelease`` object in the ``docs.djangoproject.com``
  448. database (this will automatically flip it to ``False`` for all
  449. others); you can do this using the site's admin.
  450. Create new ``DocumentRelease`` objects for each language that has an entry
  451. for the previous release. Update djangoproject.com's `robots.docs.txt`__
  452. file by copying the result generated from running the command
  453. ``manage_translations.py robots_txt`` in the current stable branch from the
  454. `django-docs-translations repository`__. For example, when releasing Django
  455. 4.2:
  456. .. code-block:: shell
  457. $ git checkout stable/4.2.x
  458. $ git pull
  459. $ python manage_translations.py robots_txt
  460. __ https://github.com/django/djangoproject.com/blob/main/djangoproject/static/robots.docs.txt
  461. __ https://github.com/django/django-docs-translations
  462. #. Post the release announcement to the |django-announce| mailing list and the
  463. Django Forum. This should include a link to the announcement blog post.
  464. #. If this is a security release, send a separate email to
  465. oss-security@lists.openwall.com. Provide a descriptive subject, for example,
  466. "Django" plus the issue title from the release notes (including CVE ID). The
  467. message body should include the vulnerability details, for example, the
  468. announcement blog post text. Include a link to the announcement blog post.
  469. Post-release
  470. ============
  471. You're almost done! All that's left to do now is:
  472. #. If this is not a pre-release, update the ``VERSION`` tuple in
  473. ``django/__init__.py`` again, incrementing to whatever the next expected
  474. release will be. For example, after releasing 4.1.1, update ``VERSION`` to
  475. ``VERSION = (4, 1, 2, 'alpha', 0)`` (:commit:`example commit
  476. <a4d19953d46247ee1992b3427fe652e941524272>`).
  477. #. Add the release in `Trac's versions list`_ if necessary (and make it the
  478. default by changing the ``default_version`` setting in the
  479. code.djangoproject.com's `trac.ini`__, if it's a final release). The new X.Y
  480. version should be added after the alpha release and the default version
  481. should be updated after "dot zero" release.
  482. __ https://github.com/django/code.djangoproject.com/blob/main/trac-env/conf/trac.ini
  483. #. If this was a final release:
  484. #. Update the current stable branch and remove the pre-release branch in the
  485. `Django release process
  486. <https://code.djangoproject.com/#Djangoreleaseprocess>`_ on Trac.
  487. #. Update djangoproject.com's download page (`example PR
  488. <https://github.com/django/djangoproject.com/pull/1444>`__).
  489. #. If this was a security release, update :doc:`/releases/security` with
  490. details of the issues addressed.
  491. .. _Trac's versions list: https://code.djangoproject.com/admin/ticket/versions
  492. Notes on setting the VERSION tuple
  493. ==================================
  494. Django's version reporting is controlled by the ``VERSION`` tuple in
  495. ``django/__init__.py``. This is a five-element tuple, whose elements
  496. are:
  497. #. Major version.
  498. #. Minor version.
  499. #. Micro version.
  500. #. Status -- can be one of "alpha", "beta", "rc" or "final".
  501. #. Series number, for alpha/beta/RC packages which run in sequence
  502. (allowing, for example, "beta 1", "beta 2", etc.).
  503. For a final release, the status is always "final" and the series
  504. number is always 0. A series number of 0 with an "alpha" status will
  505. be reported as "pre-alpha".
  506. Some examples:
  507. * ``(4, 1, 1, "final", 0)`` → "4.1.1"
  508. * ``(4, 2, 0, "alpha", 0)`` → "4.2 pre-alpha"
  509. * ``(4, 2, 0, "beta", 1)`` → "4.2 beta 1"