Version 1.3.1 [09-09-2026]

Version 1.2.3 [09-09-2026]

Version 1.3.0 [02-09-2026]

Version 1.2.2 [25-04-2026]

Version 1.2.1 [22-04-2026]

Version 1.2.0 [2025-10-23]

Version 1.1.0 [2024-11-20]

Features
~~~~~~~~

- Added support for `password expiration
  <https://openwisp.io/docs/dev/users/user/settings.html#openwisp-users-user-password-expiration>`_,
  allowing user passwords to automatically expire after a set period.
- Added `multi-tenant Django filters
  <https://openwisp.io/docs/dev/users/developer/django-rest-framework-utils.html#filtering-items-by-organization>`_.
- Added `MultitenantOrgFilter
  <https://openwisp.io/docs/dev/users/developer/admin-utils.html#multitenantorgfilter>`_
  to add autocomplete filter in ``ModelAdmin``.
- Added `export-users
  <https://openwisp.io/docs/dev/users/user/management-commands.html#export-users>`_
  command line utility to export users.
- Added `ProtectedApiMixin
  <https://openwisp.io/docs/dev/users/developer/django-rest-framework-utils.html#protectedapimixin>`_.
- Added `PasswordReuseValidator
  <https://openwisp.io/docs/dev/users/developer/misc-utils.html#passwordreusevalidator>`_
  which prevents users from reusing their current password when setting a
  new one.
- Allowed creating users with a verified email via REST API.

Changes
~~~~~~~

- Added autocomplete fields in ``OrganizationOwner`` admin.
- Enabled ``OrganizationUserAdmin`` by default.

**Dependencies**:

- Bumped ``django-organizations~=2.4.1``.
- Bumped ``django-extensions~=3.2.3``.
- Bumped ``django-allauth[socialaccount]~=0.63.6``.
- Bumped ``django-phonenumber-field~=8.13.48``.
- Bumped ``django-reversion~=5.1.0``.
- Bumped ``phonenumbers~=8.13.48``.
- Bumped ``django-sesame~=3.2.2``.
- Bumped ``openwisp-utils[rest,celery]~=1.1.1``.
- Added support for Django ``4.1.x`` and ``4.2.x``.
- Added support for Python ``3.10``.
- Dropped support for Python ``3.7``.
- Dropped support for Django ``3.0.x`` and ``3.1.x``.

Bugfixes
~~~~~~~~

- User need to have required model permissions to perform admin actions.
- Don't allow organization admin to create shared object.
- Fixed user's organization cache invalidation.
- Invalidate org membership cache when organization's active status
  changes.
- Fixed an issue where the organization admin would see multiple entries
  for the same user in the user changelist.
- Fixed admin unregistration failures for ``EmailAddress`` and
  ``TokenProxy`` models.
- Fixed an ``IntegrityError`` that occurred when adding the first user to
  an organization via ``Organization.add_user``.
- Fixed `UsersAuthenticationBackend
  <https://openwisp.io/docs/dev/users/developer/misc-utils.html#usersauthenticationbackend>`_
  to support phone numbers with leading zero.
- Prevented users registered via social login from setting a password.

Version 1.0.2 [2022-06-28]

- Bumped django-all-auth from 0.46.0 to 0.51.0
  to fix mild security issues (see the `change log
  of django-all-auth for more information
  <https://github.com/pennersr/django-allauth/blob/master/ChangeLog.rst>`_)
- The ``@classmethod`` decorator was mistakenly forgotten and hence
  missing from the following methods of
  ``openwisp_users.apps.OpenwispUsersConfig``:

  - ``update_organizations_dict``
  - ``create_organization_owner``
- Fixed a broken example in the DRF Permission Classes section
  of the documentation

Version 1.0.1 [2022-05-24]

- Updated fur translations

Version 1.0.0 [2022-03-19]

Features
~~~~~~~~

- Added `UsersAuthenticationBackend class
  <https://github.com/openwisp/openwisp-users#authentication-backend>`_
  that allows users to authenticate using either email, phone_number or username.
- Added the possibility to filter users by their organization in
  the user administration section.
- Added `REST API endpoints for openwisp-users
  <https://github.com/openwisp/openwisp-users#list-of-endpoints>`_.
- Added various `Django REST Framework mixins and utilities
  <https://github.com/openwisp/openwisp-users#django-rest-framework-mixins>`_
  which allow to implement.
- Added `DRF permission classes
  <https://github.com/openwisp/openwisp-users#django-rest-framework-permission-classes>`_.
- Added `passwordless authentication backend for REST APIs
  <https://github.com/openwisp/openwisp-users#2-openwisp_usersapiauthenticationsesameauthentication>`_.
- Added ``OrganizationInvitation`` model.
- Added `email verification success view
  <https://github.com/openwisp/openwisp-users/issues/277>`_.
- Added logout success view.

Changes
~~~~~~~

- `Authentication REST API endpoints are now enabled by default
  <https://github.com/openwisp/openwisp-users#openwisp_users_auth_api>`_.
- Following changes have been made to the User model:

  - Increased max length of `User.location field
    <https://github.com/openwisp/openwisp-users/commit/0088b0bdfe882e54cf6dfd2fbbafa7ccd79a8beb>`_.
  - Added `User.birth_date field
    <https://github.com/openwisp/openwisp-users/issues/221>`_.
  - Added `User.notes field
    <https://github.com/openwisp/openwisp-users/commit/e8b4f0a125969453795a57333e8b2cb612e2743e>`_.
  - Added `User.language field
    <https://github.com/openwisp/openwisp-users/issues/261>`_.
  - Made `User.email case insensitive
    <https://github.com/openwisp/openwisp-users/issues/227>`_.
    Email addresses will always get converted to lower case before
    storage and comparison.

- Updated ``OrganizationOwnerInline`` to use ``raw_id`` field for
  ``organization_user`` field.
- Updated ``OrganizationUserInline`` to use ``autocomplete`` field
  for ``organization`` field.
- **Backward incompatible:** removed `custom permission helpers
  <https://github.com/openwisp/openwisp-users/issues/266>`_.
- **Backward incompatible:** the REST API endpoint ``/api/v1/user/token/``
  has been changed to ``/api/v1/users/token/`` for consistency
  with the rest of the API.

**Dependencies**:

- Dropped support for Django ``2.2.x``.
- Dropped support for Python ``3.6``.
- Added support for Python ``3.8`` and Python ``3.9``.
- Added support for Django ``3.2.x`` and ``4.0.x``.
- Bumped ``django-allauth~=0.46.0``.
- Bumped ``django-organizations~=2.0.1``
- Bumped ``django-phonenumber-field~=6.0.0``.
- Bumped ``openwisp-utils~=1.0.0``.
- Bumped ``swapper~=1.3.0``
- Added ``django-sesame~=2.4.0``.

Bugfixes
~~~~~~~~

- Fixed `internal server error on "/accounts/login/" page
  <https://github.com/openwisp/openwisp-users/issues/218>`_
  when the social account app is disabled.
- Fixed `error on restoring "Group" object with django-reversion
  <https://github.com/openwisp/openwisp-users/issues/214>`_.
- Fixed `error on visiting Django admin URL for non-existing users
  <https://github.com/openwisp/openwisp-users/issues/228>`_.
- Fixed `organization managers could escalate their privileges to superuser
  <https://github.com/openwisp/openwisp-users/issues/284>`_.