Bump django-guardian from 2.4.0 to 3.0.0

[dependabot]

Bumps django-guardian from 2.4.0 to 3.0.0.

Release notes

Sourced from django-guardian's releases.

Version 3.0.0 - "The phoenix" 🐦‍🔥

🐦‍🔥This release

This is the culmination of more than FIVE YEARS of commits by various dedicated people, and a lot of wrangling to resurrect django-guardian from the dead. It aims to bring guardian up to date with a new team of maintainers and hit reset on the project going forward - it also encompasses updates to be compatible with the latest, greatest versions of django.

📚 Documentation and ⌨️ Typing

Guardian now has static typing, plus check out the new-look docs 🤩 ... thanks @​dpgraham4401 for some substantive contributions here!

🚀 Performance

There are numerous upgrades to performance that are included here. The majority of users should find performance to be neutral or upgraded 🐎🥇.

⚠️⚠️⚠️⚠️⚠️ WARNING ⚠️⚠️⚠️⚠️⚠️ Some alterations have been made that may affect performance. All were done for good reasons, all were reviewed carefully by the maintainers at the time. But frustratingly we have only a rudimentary benchmarks suite. This PR discusses one such possible scenario.

• If you are running large scale, mission critical apps, then you should probably benchmark your application with this new version (or at the very least update just this, making it an easy rollback).
• Your support to create a benchmarks suite is very welcome!

🔧 Why a Major version?

We're reasonably sure that this major version does not actually constitute any breaking changes. However, there's been a complete turnover of the maintenance team, and we're releasing some features which we didn't touch, review or participate in in any way (although all commits have been doubly reviewed when they were merged).

I've gone over to review this entire release as best as I can but without many days of deep introspection, it's realistically possible to miss some changes that have implications deemed "breaking".

Sensible app developers should be pinning their dependencies like >2, <3 (or tighter) so in most cases, the update to this version (v3) will be a conscious choice as opposed to automatic update. It's therefore much safer for us to make a major version release (then possibly have to update the release notes!), than it is to do a minor version release which risks breaking people's systems.

To further mitigate this risk we'll first issue Release Candidate versions which people can install and give feedback on.

In the past, (eg the 2.0.0 release), removal of old django versions (which we have done in this release) was seen to be a breaking change. With modern dependency resolvers like uv and poetry this should no longer break people's installs (simply prevent them from using newer versions) so in future this will not be deemed a breaking change.

What's Changed

• Update tested Django versions to latest patch releases by @​johnthagen in django-guardian/django-guardian#749
• Optimize get_objects_for_* if klass is a queryset by @​TauPan in django-guardian/django-guardian#569
• Security bugfix: GuardedModelAdminMixin did not check for guardian pe… by @​areyal in django-guardian/django-guardian#757
• Revert "Security bugfix: GuardedModelAdminMixin did not check for guardian pe…" by @​ad-m in django-guardian/django-guardian#764
• Add support for Python 3.10 by @​johnthagen in django-guardian/django-guardian#763
• Add Django 4.0 support by @​johnthagen in django-guardian/django-guardian#772
• union users and groups for better perf by @​qeternity in django-guardian/django-guardian#768
• "Fix" performance enhancement related to #811 by @​cmaggiulli in django-guardian/django-guardian#812
• Fix failing checks by @​BonaFideIT in django-guardian/django-guardian#827
• Add security.md by @​thclark in django-guardian/django-guardian#832
• docs: Fix a few typos by @​timgates42 in django-guardian/django-guardian#782
• Upating save() function for better performance by @​Muditalbet in django-guardian/django-guardian#790
• Add support for newer Django versions, up to 5.0 by @​ZbigniewRA in django-guardian/django-guardian#816
• Add workflow for publishing and releasing package by @​cortadocodes in django-guardian/django-guardian#835
• Release flow by @​thclark in django-guardian/django-guardian#840
• Bugfix/custom user doc fix by @​zesameri in django-guardian/django-guardian#795

... (truncated)

Commits

• d9587a8 OPS: Update to correct package metadata
• d75d649 OPS: Version set for 3.0.0
• 167625b Merge pull request #841 from django-guardian/devel
• 6010336 Add initial static type annotations (#858)
• dc7c5b1 OPS: Fix the complete test matrix
• 0841a8f OPS: Move to uv and pyproject.toml (#846)
• e3dd3f3 DOC: Set readthedocs search text color to black (#849)
• 883c8b2 DEP: Remove EOL python 3.8 as supporting it is causing problems with new tool...
• 8ef2fd2 Replace Restructured Text with Markdown (#845)
• 6c78e6b DEP: Support Python 3.13 and Django 5.1 (#844)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #400.