# Feature catalog — django/django

> Canonical page: https://codevetter.com/unpack/django/feature-catalog

# Feature catalog — django/django

Scanned commit dd6f6b1531984823e3dc56740dfa93f3ceb09357 (2026-09-20). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

User-facing surface area is a CLI (django-admin / manage.py), an HTTP stack (URLs, middleware, views, templates, forms), an ORM with migrations, and optional contrib apps. The generated project turns on admin, auth, sessions, messages, and static files, and mounts admin.site.urls at admin/. Batteries that are present in the tree but not in the default project include GIS, Postgres-only fields, flatpages, redirects, sitemaps, and the CSP middleware. A first-party tasks API and a mailers migration sit beside the older email backend.
- Core CLI subcommands implemented as Command classes include check, compilemessages, createcachetable, dbshell, diffsettings, dumpdata, flush, inspectdb, listurls, loaddata, makemessages, makemigrations, migrate, optimizemigration, runserver, sendtestemail, shell, showmigrations, sqlflush, sqlmigrate, sqlsequencereset, squashmigrations, startapp, startproject, test, and testserver. — [django/core/management/__init__.py#L52-80](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/management/__init__.py#L52-L80) [django/core/management/commands/migrate.py#L18-91](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/management/commands/migrate.py#L18-L91) [django/core/management/commands/runserver.py#L27-61](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/management/commands/runserver.py#L27-L61)
- runserver starts a development WSGI server (WSGIServer) on 127.0.0.1:8000 by default, with --ipv6, --nothreading, and --noreload. It raises CommandError if DEBUG is False and ALLOWED_HOSTS is empty, and uses autoreload.run_with_reloader unless --noreload is set. — [django/core/management/commands/runserver.py#L27-117](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/management/commands/runserver.py#L27-L117)
- migrate updates schema via MigrationExecutor. Flags include --fake, --fake-initial, --plan, --run-syncdb, --check (unapplied migrations), and --prune. makemigrations, sqlmigrate, showmigrations, squashmigrations, and optimizemigration are the surrounding schema commands. — [django/core/management/commands/migrate.py#L18-91](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/management/commands/migrate.py#L18-L91) [docs/intro/overview.txt#L50-64](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/docs/intro/overview.txt#L50-L64)
- The ORM exposes Model.save/asave/delete and QuerySet.filter, exclude, get, create, iterator, and prefetch. Models are registered through ModelBase and served by a manager API with no code generation, as described in the overview doc. — [django/db/models/base.py#L847-932](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/db/models/base.py#L847-L932) [django/db/models/query.py#L1723-1757](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/db/models/query.py#L1723-L1757) [docs/intro/overview.txt#L66-136](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/docs/intro/overview.txt#L66-L136)
- django.contrib.admin.sites.AdminSite.register binds a Model to a ModelAdmin (or a dynamic subclass when options are passed). The startproject URLconf mounts path('admin/', admin.site.urls). — [django/contrib/admin/sites.py#L95-149](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/contrib/admin/sites.py#L95-L149) [django/conf/project_template/project_name/urls.py-tpl#L17-22](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/conf/project_template/project_name/urls.py-tpl#L17-L22)
- Auth provides ModelBackend (default AUTHENTICATION_BACKENDS), RemoteUserBackend, LoginView/LogoutView/password-reset views in django.contrib.auth.urls, and password hashers selected by PASSWORD_HASHERS. AUTH_USER_MODEL defaults to auth.User. — [django/conf/global_settings.py#L534-556](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/conf/global_settings.py#L534-L556) [django/contrib/auth/backends.py#L59-101](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/contrib/auth/backends.py#L59-L101) [django/contrib/auth/urls.py#L9-36](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/contrib/auth/urls.py#L9-L36)
- Forms: BaseForm.is_valid() is true only when the form is bound and full_clean() produced no errors. full_clean runs _clean_fields (including clean_<field>), _clean_form, and _post_clean. — [django/forms/forms.py#L204-206](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/forms/forms.py#L204-L206) [django/forms/forms.py#L324-359](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/forms/forms.py#L324-L359)
- The template Engine defaults builtins to defaulttags, defaultfilters, and loader_tags, and when app_dirs is true wraps filesystem and app_directories loaders in the cached loader. Tags and filters register on Library.tags and Library.filters. — [django/template/engine.py#L13-60](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/template/engine.py#L13-L60) [django/template/library.py#L17-55](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/template/library.py#L17-L55)
- Sessions default to SESSION_ENGINE django.contrib.sessions.backends.db, cookie name sessionid, age two weeks, HttpOnly, SameSite Lax. SessionMiddleware loads the engine from settings and attaches request.session from the cookie. — [django/conf/global_settings.py#L487-515](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/conf/global_settings.py#L487-L515) [django/contrib/sessions/middleware.py#L12-20](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/contrib/sessions/middleware.py#L12-L20)
- Static files use STATICFILES_FINDERS FileSystemFinder and AppDirectoriesFinder. BaseFinder is the extension interface (find/list/check). startproject sets STATIC_URL to 'static/'. — [django/conf/global_settings.py#L632-646](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/conf/global_settings.py#L632-L646) [django/contrib/staticfiles/finders.py#L18-38](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/contrib/staticfiles/finders.py#L18-L38) [django/conf/project_template/project_name/settings.py-tpl#L114-117](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/conf/project_template/project_name/settings.py-tpl#L114-L117)
- HTTP middleware shipped under django/middleware includes SecurityMiddleware (HSTS, nosniff, COOP, Referrer-Policy, optional HTTPS redirect), CsrfViewMiddleware, ContentSecurityPolicyMiddleware (SECURE_CSP / SECURE_CSP_REPORT_ONLY), plus cache, clickjacking, common, gzip, http, and locale modules. The project template enables security, sessions, common, csrf, auth, messages, and XFrameOptionsMiddleware, not CSP. — [django/middleware/security.py#L8-66](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/middleware/security.py#L8-L66) [django/middleware/csrf.py#L165-172](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/middleware/csrf.py#L165-L172) [django/middleware/csp.py#L10-33](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/middleware/csp.py#L10-L33) [django/conf/project_template/project_name/settings.py-tpl#L42-50](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/conf/project_template/project_name/settings.py-tpl#L42-L50)
- Tasks: @task / Task.enqueue go through task_backends. The default TASKS backend is django.tasks.backends.immediate.ImmediateBackend, which validates, builds a TaskResult, and runs the callable inside enqueue, emitting task_enqueued, task_started, and task_finished. — [django/tasks/base.py#L100-177](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/tasks/base.py#L100-L177) [django/tasks/backends/immediate.py#L16-80](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/tasks/backends/immediate.py#L16-L80) [django/conf/global_settings.py#L689-692](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/conf/global_settings.py#L689-L692)
- Mail still defaults EMAIL_BACKEND to django.core.mail.backends.smtp.EmailBackend (localhost:25). get_connection() is deprecated (RemovedInDjango2028Warning) and, when MAILERS is configured, refuses a backend argument and uses mailers.create_connection('default'). MAILERS and deprecated EMAIL_* settings cannot both be set. — [django/conf/global_settings.py#L190-207](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/conf/global_settings.py#L190-L207) [django/core/mail/__init__.py#L71-100](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/mail/__init__.py#L71-L100) [django/conf/__init__.py#L42-70](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/conf/__init__.py#L42-L70)
- Serialization formats registered in BUILTIN_SERIALIZERS are xml, python, json, yaml, and jsonl. register_serializer(format, serializer_module) adds more; registering into the global map is documented as not thread-safe. — [django/core/serializers/__init__.py#L26-67](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/core/serializers/__init__.py#L26-L67)
- Other contrib packages in the tree, beyond the startproject set, include admindocs, flatpages, gis (GDAL/GEOS), humanize, postgres, redirects, sitemaps, sites, syndication, and contenttypes. Generic class-based views start at View.as_view/dispatch in django/views/generic/base.py. — [django/views/generic/base.py#L37-143](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/views/generic/base.py#L37-L143) [django/conf/project_template/project_name/settings.py-tpl#L33-40](https://github.com/django/django/blob/dd6f6b1531984823e3dc56740dfa93f3ceb09357/django/conf/project_template/project_name/settings.py-tpl#L33-L40)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)