Clarify and/or conditions in AXES_LOCKOUT_PARAMETERS examples

Bumps [black](https://github.com/psf/black) from 26.1.0 to 26.3.1.
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](https://github.com/psf/black/compare/26.1.0...26.3.1)

---
updated-dependencies:
- dependency-name: black
  dependency-version: 26.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

CHANGES.rst

@@ -2,6 +2,18 @@
 Changes
 =======
 
+8.3.1 (2026-02-11)
+------------------
+
+- Fix configuration JSON serialization errors for Celery.
+  [aleksihakli]
+
+8.3.0 (2026-02-09)
+------------------
+
+- Remove deprecated pkg_resources in favour of new importlib.
+  [hugovk]
+
 8.2.0 (2026-02-06)
 ------------------
 

axes/admin.py

@@ -19,8 +19,10 @@ class IsLockedOutFilter(admin.SimpleListFilter):
 
     def queryset(self, request, queryset):
         if self.value() == "yes":
-            return queryset.filter(failures_since_start__gte=settings.AXES_FAILURE_LIMIT)
-        elif self.value() == "no":
+            return queryset.filter(
+                failures_since_start__gte=settings.AXES_FAILURE_LIMIT
+            )
+        if self.value() == "no":
             return queryset.filter(failures_since_start__lt=settings.AXES_FAILURE_LIMIT)
         return queryset
 
@@ -34,9 +36,9 @@ class AccessAttemptAdmin(admin.ModelAdmin):
         "path_info",
         "failures_since_start",
     ]
-    
+
     if settings.AXES_USE_ATTEMPT_EXPIRATION:
-        list_display.append('expiration')
+        list_display.append("expiration")
 
     list_filter = ["attempt_time", "path_info"]
 
@@ -44,14 +46,17 @@ class AccessAttemptAdmin(admin.ModelAdmin):
         # This will only add the status field if AXES_FAILURE_LIMIT is set to a positive integer
         # Because callable failure limit requires scope of request object
         list_display.append("status")
-        list_filter.append(IsLockedOutFilter)
+        list_filter.append(IsLockedOutFilter)  # type: ignore[arg-type]
 
     search_fields = ["ip_address", "username", "user_agent", "path_info"]
 
     date_hierarchy = "attempt_time"
 
     fieldsets = (
-        (None, {"fields": ("username", "path_info", "failures_since_start", "expiration")}),
+        (
+            None,
+            {"fields": ("username", "path_info", "failures_since_start", "expiration")},
+        ),
         (_("Form Data"), {"fields": ("get_data", "post_data")}),
         (_("Meta Data"), {"fields": ("user_agent", "ip_address", "http_accept")}),
     )
@@ -69,10 +74,10 @@ class AccessAttemptAdmin(admin.ModelAdmin):
         "expiration",
     ]
 
-    actions = ['cleanup_expired_attempts']
+    actions = ["cleanup_expired_attempts"]
 
-    @admin.action(description=_('Clean up expired attempts'))
-    def cleanup_expired_attempts(self, request, queryset):
+    @admin.action(description=_("Clean up expired attempts"))
+    def cleanup_expired_attempts(self, request, queryset):  # noqa
         count = self.handler.clean_expired_user_attempts(request=request)
         self.message_user(request, _(f"Cleaned up {count} expired access attempts."))
 
@@ -85,10 +90,15 @@ class AccessAttemptAdmin(admin.ModelAdmin):
 
     def expiration(self, obj: AccessAttempt):
         return obj.expiration.expires_at if hasattr(obj, "expiration") else _("Not set")
-    
+
     def status(self, obj: AccessAttempt):
-        return f"{settings.AXES_FAILURE_LIMIT - obj.failures_since_start} "+_("Attempt Remaining") if \
-            obj.failures_since_start < settings.AXES_FAILURE_LIMIT else _("Locked Out")
+        return (
+            f"{settings.AXES_FAILURE_LIMIT - obj.failures_since_start} "
+            + _("Attempt Remaining")
+            if obj.failures_since_start < settings.AXES_FAILURE_LIMIT
+            else _("Locked Out")
+        )
+
 
 class AccessLogAdmin(admin.ModelAdmin):
     list_display = (

axes/attempts.py

@@ -20,7 +20,7 @@ def get_cool_off_threshold(request: Optional[HttpRequest] = None) -> datetime:
             "Cool off threshold can not be calculated with settings.AXES_COOLOFF_TIME set to None"
         )
 
-    attempt_time = request.axes_attempt_time
+    attempt_time = request.axes_attempt_time  # type: ignore[union-attr]
     if attempt_time is None:
         return now() - cool_off
     return attempt_time - cool_off

axes/checks.py

@@ -235,4 +235,4 @@ def is_valid_callable(value) -> bool:
         except ImportError:
             return False
 
-    return True
+    return True

axes/conf.py

@@ -3,6 +3,19 @@ from django.contrib.auth import get_user_model
 from django.utils.functional import SimpleLazyObject
 from django.utils.translation import gettext_lazy as _
 
+
+class JSONSerializableLazyObject(SimpleLazyObject):
+    """
+    Celery/Kombu config inspection may JSON-encode Django settings.
+    Provide a JSON-friendly representation for lazy values.
+
+    Fixes jazzband/django-axes#1391
+    """
+
+    def __json__(self):
+        return str(self)
+
+
 # disable plugin when set to False
 settings.AXES_ENABLED = getattr(settings, "AXES_ENABLED", True)
 
@@ -43,6 +56,7 @@ settings.AXES_ONLY_ADMIN_SITE = getattr(settings, "AXES_ONLY_ADMIN_SITE", False)
 # show Axes logs in admin
 settings.AXES_ENABLE_ADMIN = getattr(settings, "AXES_ENABLE_ADMIN", True)
 
+
 # use a specific username field to retrieve from login POST data
 def _get_username_field_default():
     return get_user_model().USERNAME_FIELD
@@ -51,7 +65,7 @@ def _get_username_field_default():
 settings.AXES_USERNAME_FORM_FIELD = getattr(
     settings,
     "AXES_USERNAME_FORM_FIELD",
-    SimpleLazyObject(_get_username_field_default),
+    JSONSerializableLazyObject(_get_username_field_default),
 )
 
 # use a specific password field to retrieve from login POST data
@@ -94,7 +108,9 @@ settings.AXES_LOCKOUT_URL = getattr(settings, "AXES_LOCKOUT_URL", None)
 
 settings.AXES_COOLOFF_TIME = getattr(settings, "AXES_COOLOFF_TIME", None)
 
-settings.AXES_USE_ATTEMPT_EXPIRATION = getattr(settings, "AXES_USE_ATTEMPT_EXPIRATION", False)
+settings.AXES_USE_ATTEMPT_EXPIRATION = getattr(
+    settings, "AXES_USE_ATTEMPT_EXPIRATION", False
+)
 
 settings.AXES_VERBOSE = getattr(settings, "AXES_VERBOSE", settings.AXES_ENABLED)
 

axes/handlers/database.py

@@ -21,7 +21,12 @@ from axes.helpers import (
     get_query_str,
     get_attempt_expiration,
 )
-from axes.models import AccessAttempt, AccessAttemptExpiration, AccessFailureLog, AccessLog
+from axes.models import (
+    AccessAttempt,
+    AccessAttemptExpiration,
+    AccessFailureLog,
+    AccessLog,
+)
 from axes.signals import user_locked_out
 
 log = getLogger(__name__)
@@ -223,15 +228,17 @@ class AxesDatabaseHandler(AbstractAxesHandler, AxesBaseHandler):
                 if settings.AXES_USE_ATTEMPT_EXPIRATION:
                     if not hasattr(attempt, "expiration") or attempt.expiration is None:
                         log.debug(
-                            "AXES: Creating new AccessAttemptExpiration for %s", client_str
+                            "AXES: Creating new AccessAttemptExpiration for %s",
+                            client_str,
                         )
                         attempt.expiration = AccessAttemptExpiration.objects.create(
                             access_attempt=attempt,
-                            expires_at=get_attempt_expiration(request)
+                            expires_at=get_attempt_expiration(request),
                         )
                     else:
                         attempt.expiration.expires_at = max(
-                            get_attempt_expiration(request), attempt.expiration.expires_at
+                            get_attempt_expiration(request),
+                            attempt.expiration.expires_at,
                         )
                         attempt.expiration.save()
 
@@ -365,7 +372,7 @@ class AxesDatabaseHandler(AbstractAxesHandler, AxesBaseHandler):
         return attempts_list
 
     def get_user_attempts(
-        self, request: HttpRequest, credentials: Optional[dict] = None
+        self, request: HttpRequest, credentials: Optional[dict] = None  # noqa
     ) -> List[QuerySet]:
         """
         Get list of querysets with valid user attempts that match the given request and credentials.
@@ -386,7 +393,9 @@ class AxesDatabaseHandler(AbstractAxesHandler, AxesBaseHandler):
         ]
 
     def clean_expired_user_attempts(
-        self, request: Optional[HttpRequest] = None, credentials: Optional[dict] = None
+        self,
+        request: Optional[HttpRequest] = None,
+        credentials: Optional[dict] = None,  # noqa
     ) -> int:
         """
         Clean expired user attempts from the database.
@@ -400,7 +409,9 @@ class AxesDatabaseHandler(AbstractAxesHandler, AxesBaseHandler):
 
         if settings.AXES_USE_ATTEMPT_EXPIRATION:
             threshold = timezone.now()
-            count, _ = AccessAttempt.objects.filter(expiration__expires_at__lte=threshold).delete()
+            count, _ = AccessAttempt.objects.filter(
+                expiration__expires_at__lte=threshold
+            ).delete()
             log.info(
                 "AXES: Cleaned up %s expired access attempts from database that expiry were older than %s",
                 count,
@@ -408,7 +419,9 @@ class AxesDatabaseHandler(AbstractAxesHandler, AxesBaseHandler):
             )
         else:
             threshold = get_cool_off_threshold(request)
-            count, _ = AccessAttempt.objects.filter(attempt_time__lte=threshold).delete()
+            count, _ = AccessAttempt.objects.filter(
+                attempt_time__lte=threshold
+            ).delete()
             log.info(
                 "AXES: Cleaned up %s expired access attempts from database that were older than %s",
                 count,

axes/helpers.py

@@ -100,6 +100,7 @@ def get_cool_off_iso8601(delta: timedelta) -> str:
         return f"P{days_str}T{time_str}"
     return f"P{days_str}"
 
+
 def get_attempt_expiration(request: Optional[HttpRequest] = None) -> datetime:
     """
     Get threshold for fetching access attempts from the database.
@@ -111,11 +112,12 @@ def get_attempt_expiration(request: Optional[HttpRequest] = None) -> datetime:
             "Cool off threshold can not be calculated with settings.AXES_COOLOFF_TIME set to None"
         )
 
-    attempt_time = request.axes_attempt_time
+    attempt_time = request.axes_attempt_time  # type: ignore[union-attr]
     if attempt_time is None:
         return datetime.now() + cool_off
     return attempt_time + cool_off
 
+
 def get_credentials(username: Optional[str] = None, **kwargs) -> dict:
     """
     Calculate credentials for Axes to use internally from given username and kwargs.
@@ -162,7 +164,7 @@ def get_client_username(
         log.debug(
             "Using parameter credentials to get username with key settings.AXES_USERNAME_FORM_FIELD"
         )
-        return credentials.get(settings.AXES_USERNAME_FORM_FIELD, None)
+        return credentials.get(settings.AXES_USERNAME_FORM_FIELD, None)  # type: ignore[return-value]
 
     log.debug(
         "Using parameter request.POST to get username with key settings.AXES_USERNAME_FORM_FIELD"

axes/middleware.py

@@ -60,6 +60,8 @@ class AxesMiddleware:
                 credentials = getattr(request, "axes_credentials", None)
                 response = await sync_to_async(
                     get_lockout_response, thread_sensitive=True
-                )(request, credentials)  # type: ignore
+                )(
+                    request, credentials
+                )  # type: ignore
 
         return response

axes/models.py

@@ -68,9 +68,12 @@ class AccessAttemptExpiration(models.Model):
         verbose_name = _("access attempt expiration")
         verbose_name_plural = _("access attempt expirations")
 
+
 class AccessLog(AccessBase):
     logout_time = models.DateTimeField(_("Logout Time"), null=True, blank=True)
-    session_hash = models.CharField(_("Session key hash (sha256)"), default="", blank=True, max_length=64)
+    session_hash = models.CharField(
+        _("Session key hash (sha256)"), default="", blank=True, max_length=64
+    )
 
     def __str__(self):
         return f"Access Log for {self.username} @ {self.attempt_time}"

docs/5_customization.rst

@@ -188,7 +188,7 @@ Example ``AXES_LOCKOUT_PARAMETERS`` configuration:
 
     AXES_LOCKOUT_PARAMETERS = ["ip_address", ["username", "user_agent"]]
 
-This way, axes will lock out users using ip_address and/or combination of username and user agent
+This way, axes will lock out users using ip_address or combination of username and user_agent
 
 Example of callable ``AXES_LOCKOUT_PARAMETERS``:
 
@@ -213,7 +213,7 @@ Example of callable ``AXES_LOCKOUT_PARAMETERS``:
 
     AXES_LOCKOUT_PARAMETERS = "example.utils.get_lockout_parameters"
 
-This way, if client ip_address is localhost, axes will lockout client only by username. In other case, axes will lockout client by username and/or ip_address.
+This way, if client ip_address is localhost, axes will lockout client only by username. In other case, axes will lockout client by username or ip_address.
 
 Customizing client ip address lookups
 -------------------------------------

docs/conf.py

@@ -7,7 +7,7 @@ More information on the configuration options is available at:
 """
 
 # import sphinx_rtd_theme
-from pkg_resources import get_distribution
+from importlib.metadata import version as get_version
 
 import django
 from django.conf import settings
@@ -43,7 +43,7 @@ copyright = "2016, Jazzband"
 author = "Jazzband"
 
 # The full version, including alpha/beta/rc tags.
-release = get_distribution("django-axes").version
+release = get_version("django-axes")
 
 # The short X.Y version.
 version = ".".join(release.split(".")[:2])

mypy.ini

@@ -1,5 +1,5 @@
 [mypy]
-python_version = 3.12
+python_version = 3.14
 ignore_missing_imports = True
 
 [mypy-axes.migrations.*]

pyproject.toml

@@ -13,8 +13,8 @@ envlist =
     py{310,311,312}-dj42
     py{310,311,312,313}-dj52
     py{312,313,314}-dj60
-    py312-djmain
-    py312-djqa
+    py314-djmain
+    py314-djqa
 
 [gh-actions]
 python =
@@ -36,9 +36,9 @@ DJANGO =
 [testenv]
 deps =
     -r requirements.txt
-    dj42: django>=4.2,<5
-    dj52: django>=5.2,<6
-    dj60: django>=6.0,<7
+    dj42: django>=4.2,<4.3
+    dj52: django>=5.2,<5.3
+    dj60: django>=6.0,<6.1
     djmain: https://github.com/django/django/archive/main.tar.gz
 usedevelop = true
 commands = pytest
@@ -51,10 +51,11 @@ ignore_errors =
     djmain: True
 
 # QA runs type checks, linting, and code formatting checks
-[testenv:py312-djqa]
+[testenv:py314-djqa]
+stoponfail = false
 deps = -r requirements.txt
 commands =
     mypy axes
-    prospector
-    black -t py312 --check --diff axes
+    prospector axes
+    black --check --diff axes
 """

requirements.txt

@@ -1,12 +1,12 @@
 -e .
-black==26.1.0
-coverage==7.13.3
+black==26.3.1
+coverage==7.13.4
 django-ipware>=3
 mypy==1.19.1
 prospector==1.18.0
 pytest-cov==7.0.0
-pytest-django==4.11.1
+pytest-django==4.12.0
 pytest-subtests==0.15.0
 pytest==9.0.2
 sphinx_rtd_theme==3.1.0
-tox==4.34.1
+tox==4.49.1