packaging: 24.2 → 25.0 ---------------------- pip: 25.0.1 → 26.0.1 -------------------- setuptools: 75.8.2 → 80.10.2 ---------------------------- wheel: 0.45.1 → 0.48.0 ---------------------- zc.buildout: 4.1.4 → 4.2.0 -------------------------- borg.localrole: 3.1.11 → 4.0.2 ------------------------------ Breaking changes: - Make major release. Versions 3.1.10 and 3.1.11 (from 2023) are backwards incompatible with Plone 5.2. A 3.x branch was made, but we forgot to bump the version on the master branch. [maurits] (#14) Internal: - Move to src-layout. [maurits] - Test on Plone 6.0 and 6.1 only. (#37) diazo: 2.0.3 → 2.0.6 -------------------- Internal: - Update action workflows and other configuration files. [plone devs] - Update configuration files. [plone devs] - Do not test what happens when trying to put a title tag within a title tag. ``lxml`` 6 wants only text within the title tag. Rewrite the test to use a div in the body. [mauritsvanrees] Plone: 6.0.15 → 6.0.16 ---------------------- - Prepare release. [maurits] plone.alterego: 2.0.1 → 2.0.2 ----------------------------- Internal: - Update configuration files. [plone devs] (6e36bcc4) - Move distribution to src layout [gforcada] (#4217) plone.api: 2.5.0 → 2.5.3 ------------------------ Bug fixes: - Drop `pkg_resources` usage @gforcada #4126 - Make plone.api.exc.UserNotFoundError message more informative by including the not found username [@ale-rt] #585 Documentation: - Add missing members to API methods and sort items. @stevepiercy #579 - Resolve Sphinx warning `duplicate object description of plone` by using `currentmodule` instead of `module`. This avoids creating duplicate entries in the index. They are already documented in the `docs/api/*.md` files. @stevepiercy #581 - Pin plone-sphinx-theme to prepare for PLIP 4097. See https://github.com/plone/Products.CMFPlone/issues/4097. @stevepiercy #583 Internal: - Add project URLs to display on PyPI. @stevepiercy #582 plone.app.content: 4.1.9 → 4.2.1 -------------------------------- New features: - Alphabetically sort the list of portal types in the constraints configuration form @erral (#320) Bug fixes: - Protect the Users, Groups, and Principals vocabularies using the "List portal members" permission. @davisagli - @@getSource supports object widgets [ale-rt] (#303) Internal: - Update configuration files. [plone devs] - Move distribution to src layout [gforcada] (#4217) - Remove support for obsolete check_id Plone scripts. [thet] - Do not test in Plone 6.2.x @erral (#323) plone.app.contentlisting: 3.0.5 → 3.0.6 --------------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.app.contentmenu: 3.0.7 → 3.0.8 ------------------------------------ Internal: - Move distribution to src layout [gforcada] (#4217) plone.app.contentrules: 5.0.6 → 5.0.8 ------------------------------------- Bug fixes: - Fix ``EditForm`` for ``LoggerAction``. @petschki (#110) Internal: - Move distribution to src layout [gforcada] (#4217) plone.app.contenttypes: 3.0.11 → 3.0.12 --------------------------------------- Bug fixes: - Restrict title to 1024 and description to 10000. This is for images and files. For others, a similar change is done in ``plone.app.dexterity``. See `security advisory `_. [maurits] Internal: - Update configuration files. [plone devs] plone.app.customerize: 2.0.2 → 2.0.3 ------------------------------------ Internal: - Move distribution to src layout [gforcada] (#4217) plone.app.dexterity: 3.2.2 → 3.2.3 ---------------------------------- Bug fixes: - Added ``max_length`` constraints to the ``title`` (1024 characters) and ``description`` (10000 characters) fields of the ``IBasic`` behavior. Very long values slow down the site because these fields are rendered in listings, navigation, and the management interface. Developers who need higher limits can override the fields in a downstream package:: from plone.app.dexterity.behaviors.metadata import IBasic IBasic["title"].max_length = 5000 # or None to remove the limit IBasic["description"].max_length = 50000 # same pattern for description Place this in your package's ``__init__.py`` or any other Python module loaded at startup. See `security advisory `_. (#433) Internal: - Update configuration files. [plone devs] plone.app.event: 5.2.1 → 5.2.4 ------------------------------ Bug fixes: - Security: harden the icalendar import to prevent denial of service and stored XSS. - Be more strict in which urls we accept. - Check for timeout and limit the number of bytes. Get this limit from environment variable ``MAXIMUM_ICAL_IMPORT_SIZE_BYTES``, default 500000. - Add limit to how many events can be imported via ical. Get this limit from environment variable ``MAXIMUM_ICAL_IMPORT_EVENTS``, default 366. - Use transaction savepoints instead of a commit per event. - Check that event urls (via import or normal edit) are valid, for example no ``javascript`` urls. [maurits] - Be more strict in which urls we accept. - Check for timeout and limit the number of bytes. Get this limit from environment variable ``MAXIMUM_ICAL_IMPORT_SIZE_BYTES``, default 500000. - Add limit to how many events can be imported via ical. Get this limit from environment variable ``MAXIMUM_ICAL_IMPORT_EVENTS``, default 366. - Use transaction savepoints instead of a commit per event. - Check that event urls (via import or normal edit) are valid, for example no ``javascript`` urls. - Fix import problem for plone_displayview by explicitly depending on plone.app.contentmenu. [thet] Internal: - Move distribution to src layout [gforcada] (#4217) - Stabilize tests. At the end of a month the calendar test was failing due to some dates reaching into the next month and not being rendered anymore in the current month. This is now stabilized. [thet] plone.app.i18n: 4.0.1 → 4.0.2 ----------------------------- Internal: - Update configuration files. [plone devs] (7723aeaf, 6e36bcc4) - Move distribution to src layout [gforcada] (#4217) plone.app.intid: 2.0.0 → 2.0.1 ------------------------------ Internal: - Update configuration files. [plone devs] (55bda5c9, 6e36bcc4) - Move distribution to src layout [gforcada] (#4217) plone.app.lockingbehavior: 2.0.2 → 2.0.3 ---------------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.app.portlets: 5.0.7 → 5.0.8 --------------------------------- Bug fixes: - Fix TALES expression injection (remote code execution) in the Classic portlet. The user-supplied ``template`` and ``macro`` fields are now validated against a strict whitelist that forbids TALES metacharacters (notably ``:`` and ``|``), so they can no longer be turned into a TALES expression with a ``python:`` type or a ``|`` fallback chain when passed to the TAL ``path()`` helper. Validation is enforced both on the add/edit form fields and again at render time (for assignments created programmatically). Reported by Giuseppe Caruso (giuseppe.caruso@betrusted.it) (GHSA-rr49-f9g6-c9r5). (ghsa-rr49-f9g6-c9r5) - RSS portlet: fix passing last modified header. [maurits] - Security fixes in RSS portlet. - Be strict in which RSS feed urls we accept in the RSS portlet. Only http/https urls. Refuse internal IP addresses, single word domains, and port numbers, to avoid abuse as port scanner. - Refuse downloading gigantic RSS feeds, to avoid denial of service attack. You can influence this by setting environment variable ``MAXIMUM_RSS_FEED_SIZE_BYTES``. Default maximum is 1 million. See `security advisory `_. [maurits] - Be strict in which RSS feed urls we accept in the RSS portlet. Only http/https urls. Refuse internal IP addresses, single word domains, and port numbers, to avoid abuse as port scanner. - Refuse downloading gigantic RSS feeds, to avoid denial of service attack. You can influence this by setting environment variable ``MAXIMUM_RSS_FEED_SIZE_BYTES``. Default maximum is 1 million. Internal: - Update configuration files. [plone devs] (6e36bcc4) plone.app.querystring: 2.1.3 → 2.1.7 ------------------------------------ Bug fixes: - Fix merging multiple date operations. @davisagli (#188) Internal: - Update configuration files. [plone devs] - Move distribution to src layout [gforcada] (#4217) - Fix tests for ``not`` queries in ``Products.ZCatalog`` 7.2.0+. [maurits] plone.app.redirector: 3.0.4 → 3.0.5 ----------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.app.registry: 2.0.6 → 2.0.7 --------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.app.robotframework: 2.1.5 → 2.1.6 --------------------------------------- Internal: - Add the robocop pre-commit check. [ale-rt] plone.app.testing: 7.1.1 → 7.1.2 -------------------------------- Internal: - Update config files [plone devs] plone.app.textfield: 2.0.1 → 2.0.2 ---------------------------------- Bug fixes: - Security: Always sanitize RichText output for safe-HTML output type. See https://github.com/plone/plone.app.textfield/security/advisories/GHSA-4r4f-gg25-rmg5 @gyst Internal: - Update configuration files. [plone devs] (6e36bcc4) plone.app.theming: 5.0.12 → 5.0.15 ---------------------------------- Bug fixes: - Only disable the diazo rule cache if "DIAZO_ALWAYS_CACHE_RULES" is a yes-like value. [thet] (#245) - Unify the usage of parsing yes/no alike parameters. The following are interpreted as true-ish values: True, 1 and these strings in any casing: "y", "yes", "t", "true", "on". Everything else is considered False. [thet] (#255) Internal: - Skip releases 5.0.13 and 5.0.14. These releases were made from the master branch instead of the 5.x branch. [maurits] (#263) plone.app.upgrade: 3.2.0 → 3.3.3 -------------------------------- New features: - Add ``utils.remove_utility`` helper function. Code taken over from ``collective.migrationhelpers``. [maurits, pbauer] (#338) Bug fixes: - Remove upgrades for Plone 6.2. On Plone 6.2 you need ``plone.app.upgrade`` 4.0.0a1 or higher. [maurits] - Fix upgrading TinyMCE plugins with invalid/outdated plugins. @petschki (#351) - Update TinyMCE toolbar and menu button names to match TinyMCE version 6. @petschki (#86) - Remove ``IPropertiesTool`` components. These were left over after the removal of the ``portal_properties`` tool in Plone 6.1. [maurits] (#338) - Cleanup `ITinyMCESchema.plugins` and remove non-existing plugins. @petschki (#1500) - Do not "fix" menubar value of ITinyMCESchema if it is already a string. [maurits] (#340) - add upgrade step to fix menubar value of ITinyMCESchema, value is now a string, not a list [1letter] (#340) - Harden condition of external editor action to not fail when the ``externalEditorEnabled`` script is not available. [maurits] (#4179) Internal: - Added upgrade to 6113, Plone 6.1.6. [maurits] - Added upgrade to 6112, Plone 6.1.5. [maurits] (#6112) - Added upgrade to 6111, Plone 6.1.4. [maurits] (#6111) - Move distribution to src layout [gforcada] (#4217) - Added upgrade to 6110, Plone 6.1.3. [maurits] (#6110) - Add 6.2 upgrade for the IClassicUISchema control panel and the use_ajax_main_template registry entry. - Use ``plone.meta`` to ease maintenance [gforcada] - Added upgrade to 6027, Plone 6.0.16. [maurits] (#6027) - Added upgrade to 6109, Plone 6.1.2. [maurits] (#6109) plone.app.users: 3.1.1 → 3.1.4 ------------------------------ Bug fixes: - Rename article#content to article#user-content to avoid duplicate IDs when included into the main_template. [pilz] (#140) - Remove superfluous comma on registration form. Replace "e.g." with "for example". [maurits] (#139) Internal: - Move distribution to src layout [gforcada] (#4217) plone.app.uuid: 2.2.3 → 2.2.4 ----------------------------- Internal: - Update configuration files. [plone devs] (6e36bcc4) - Move distribution to src layout [gforcada] (#4217) plone.app.versioningbehavior: 2.0.4 → 2.0.5 ------------------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.app.viewletmanager: 4.0.4 → 4.0.5 --------------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.autoform: 2.0.3 → 2.0.5 ----------------------------- Bug fixes: - Secure a field when a wrong permission is specified. @ale-rt (#92) Internal: - Move distribution to src layout [gforcada] (#4217) plone.autoinclude: 2.0.3 → 2.0.5 -------------------------------- Internal: - Build system: require ``setuptools < 80``. [maurits] - Fix tests with buildout 4, and add tests with buildout 5. This is needed because we get more namespace packages. [maurits] - GitHub Actions: do not use a cache. [maurits] - Remove ``pkg_resources`` from tests. [maurits] - Test with latest ``zc.buildout`` 4.1.12, and run the buildout tests in GitHub Actions. [maurits] plone.batching: 2.0.6 → 2.0.8 ----------------------------- Bug fixes: - Declare only ``Batch`` public in the ``plone.batching`` module instead of opening the whole module to Restricted Python with ``allow_module``. [maurits] Internal: - Update configuration files. [plone devs] (6e36bcc4) - Move distribution to src layout [gforcada] (#4217) plone.behavior: 2.0.1 → 2.0.3 ----------------------------- Bug fixes: - Fix `logger.warn()` deprecation warning. [szakitibi] (#48) Internal: - Move distribution to src layout [gforcada] (#4217) plone.cachepurging: 3.0.2 → 3.0.3 --------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.caching: 2.0.1 → 2.0.2 ---------------------------- plone.contentrules: 3.0.1 → 3.0.2 --------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) - Update configuration files. [plone devs] plone.dexterity: 3.0.7 → 3.0.8 ------------------------------ Internal: - Move distribution to src layout [gforcada] (#4217) plone.event: 2.0.2 → 2.0.3 -------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.folder: 4.0.1 → 4.0.2 --------------------------- Bug fixes: - Fix `AttributeError` in `orderObjects` after deleting an object and restarting Zope. @wesleybl (#50) Internal: - Update configuration files. [plone devs] plone.formwidget.namedfile: 3.1.1 → 3.1.2 ----------------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.formwidget.recurrence: 3.0.5 → 3.0.6 ------------------------------------------ Internal: - Move distribution to src layout [gforcada] (#4217) plone.i18n: 5.1.0 → 5.1.1 ------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.indexer: 2.0.1 → 2.0.2 ---------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) - Update configuration files. [plone devs] plone.intelligenttext: 4.0.1 → 4.0.2 ------------------------------------ Internal: - Move distribution to src layout [gforcada] (#4217) - Remove old way to run tests with setuptools [gforcada] plone.keyring: 4.0.2 → 4.0.3 ---------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.memoize: 3.0.3 → 3.0.5 ---------------------------- Internal: - Update configuration files. Require ``setuptools<82`` in the build system. [plone devs] - Move distribution to src layout [gforcada] (#4217) - Update configuration files. [plone devs] plone.namedfile: 7.0.1 → 7.4.0 ------------------------------ New features: - Add original image size url in the srcset generated in the srcset method @erral - Add default width and height attributes if none provided when using the srcset method @erral (#188) - "Scale" SVGs by setting the correct height and width for the given scale in its metadata. Require plone.scale 4.2.0 as minimum. [jensens] (#133) - Add a srcset method to the @@images view [erral] (#170) Bug fixes: - Support for extracting metadata from WebP images without loading the entire image into memory, as already done for other formats. [mamico] (#181) - Adjusted schema validation to prevent file/image loading during upload/import (#167) Internal: - Update configuration files. [plone devs] - Move distribution to src layout [gforcada] (#4217) plone.outputfilters: 5.0.4 → 5.0.5 ---------------------------------- Internal: - Update configuration files. [plone devs] (6e36bcc4) - Move distribution to src layout [gforcada] (#4217) plone.portlet.collection: 4.0.4 → 4.0.5 --------------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.portlet.static: 4.0.4 → 4.0.5 ----------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.portlets: 3.0.2 → 3.0.3 ----------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.protect: 5.0.3 → 5.0.5 ---------------------------- Bug fixes: - Do not allow the confirm-action view to be called without a valid authenticator. [ale-rt] (#131) - In login event subscriber, do not fail if request is not found. This probably only happens in tests, not in real world usage. [maurits] (#122) plone.recipe.zope2instance: 8.0.0 → 8.0.1 ----------------------------------------- Bug fixes: - Check for presence of Products.CMFPlone with multiple keys. This is needed, depending on the used `zc.buildout` and `setuptools` versions. [maurits] (#205) plone.registry: 2.0.1 → 2.0.2 ----------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.resource: 3.0.2 → 3.0.3 ----------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.resourceeditor: 4.0.1 → 4.0.2 ----------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.rest: 5.0.0 → 5.1.0 ------------------------- New features: - Add a `context` URL to exception responses. This can be used by a client to retrieve contextual data that may be needed to display the exception. @davisagli (#186) plone.restapi: 9.13.3 → 9.15.8 ------------------------------ New features: - Add support for the `RESTAPI_ADDITIONAL_NON_METADATA_ATTRIBUTES` environment variable, a comma-separated list of extra attribute names appended to the summary serializer's `non_metadata_attributes`. - Include all summary fields when serializing `next_item` and `previous_item`. @davisagli - `@site` service: Add a way for add-ons to add additional data using an `ISiteEndpointExpander` adapter. @davisagli #1921 Bug fixes: - Fix two cases where REST API search and summary serialization could return HTTP 500 (`TypeError`) based on request parameters: a form or query string parameter named `summary_serializer_metadata`, and a `portal_type` value containing the substring "query" when `use_site_search_settings` is used. Also make the summary serializer's per-request metadata cache effective; it was recomputed for every item. @mliebischer #2060 - Security: no longer allow importing the `json` module in restricted code. Some functions could be used to call protected methods on any object. See https://github.com/plone/plone.restapi/security/advisories/GHSA-vgxm-pwch-89q6 @mauritsvanrees - Fix the security check when a wrong permission is specified. @ale-rt #2041 - Security: in summary serializer only allow access to metadata that is available in the catalog. - Security: in rich text fields, do not accept input that claims it is already sanitized. Specifically, raise a ValueError when deserializing a text field with input mimetype `text/x-html-safe`. See https://github.com/plone/plone.restapi/security/advisories/GHSA-8rqh-vxpr-x77p @gyst, @mauritsvanrees - In the `@search` service, fix a case where the `sort_order` parameter was ignored. @mamico, @davisagli #1954 - Remove default limit of 1000 from service @querystring-search. @wesleybl #1955 - Add some German translations. @valipod #1950 - Serialize the `layout` of a Plone Site if it is a Plone 6 site. @erral #1939 - When deserializing datetimes into an empty field, store them as timezone-aware datetimes. @davisagli - Optimize `@navroot` endpoint: fields `items` and `@components` are no longer computed/returned. @pgrunewald #1841 - In the `@search` service, fix an `AttributeError` that could occur with bad input. @davisagli #1898 - In the `@controlpanels` service, removed empty `data` and `schema` from special control panels that do not use a schema (`dexterity-types` and `rules`). @davisagli #1927 - In the `RelationListFieldSerializer`, fix `list` used a default argument. @ale-rt #1922 - Fix exposing protected fields in schema serializer. [maethu] #1916 - Fix `AttributeError` when updating the default blocks layout for a content type. @nileshgulia, @davisagli #1917 - Micro-optimization for validation in vocabulary serializer. @davisagli #1906 - In the teaser block serializer, don't include data from the target item if the current user doesn't have View permission on it. @davisagli #1911 - Avoid finding control panel adapters when looking up normal views. @rohnsha0, @davisagli #4156 Documentation: - Fix contributor documentation. @davisagli - Pin plone-sphinx-theme to prepare for PLIP 4097. See https://github.com/plone/Products.CMFPlone/issues/4097. @stevepiercy #4097 Internal: - Consolidate test layers so PAM, Iterate, Blocks, and Workflows all share `PLONE_RESTAPI_DX_FIXTURE` as base, reducing redundant layer setup time. @jensens #1983 - Update configuration files @plone - Update configuration files @plone - Add tests for inherit service. @ujsquared #1897 plone.rfc822: 3.0.1 → 3.0.2 --------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.scale: 4.1.4 → 4.3.1 -------------------------- New features: - Handle animated WebP images [gforcada] (#124) - Add method to 'scale' SVGs by modifying display size and viewbox. [jensens[ (#68) Bug fixes: - Fix a problem where scaled animated GIFs could be saved with a much larger file size than the original image. @davisagli (#134) Internal: - Move distribution to src layout [gforcada] (#4217) plone.schema: 2.0.2 → 2.0.3 --------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.schemaeditor: 4.0.11 → 4.0.13 ----------------------------------- Tests - Fix robottests for new autotoc implementation. @petschki Internal: - Move distribution to src layout [gforcada] (#4217) - Fixes random failure in robot test `Scenario: Add a fieldSet and move a field into this fieldset`. @wesleybl (#141) plone.session: 4.0.4 → 4.0.6 ---------------------------- Bug fixes: - Fix ValueError when processing malformed session tickets. @rohnsha0 (#33) Internal: - Move distribution to src layout [gforcada] (#4217) - Update configuration files. [plone devs] (6e36bcc4) plone.staticresources: 2.1.17 → 2.1.19 -------------------------------------- Internal: - Upgrade mockup to 5.1.18 with dependency security fixes (DOMPurify, js-cookie, underscore, moment). See https://github.com/plone/mockup/releases/tag/5.1.18 @petschki - Upgrade mockup to 5.1.17. See https://github.com/plone/mockup/releases/tag/5.1.17 @thet plone.stringinterp: 2.0.2 → 2.0.3 --------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.subrequest: 2.0.5 → 2.0.6 ------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.supermodel: 2.0.4 → 2.0.5 ------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.testing: 9.0.5 → 9.0.7 ---------------------------- Bug fixes: - Fix ``zope.uninstallProduct`` for ``Products`` installed with pip. [maurits] (#110) Internal: - Use pathlib on setup.py [gforcada] plone.theme: 4.0.3 → 4.0.4 -------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.tiles: 2.3.1 → 3.0.3 -------------------------- Breaking changes: - Remove Python 2 and Plone 5.2 support. @petschki Bug fixes: - Drop ``pkg_resources`` usage. [maurits] (#4126) - Implement `PersistentTile.absolute_url()` to fix canonical header introduced in `plone.namedfile`. @petschki Internal: - Move distribution to src layout [gforcada] (#4217) - Update configuration files. [plone devs] plone.transformchain: 3.0.1 → 3.0.2 ----------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.uuid: 2.0.1 → 2.0.2 ------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) plone.z3cform: 2.0.4 → 2.0.5 ---------------------------- Bug fixes: - Fix traversing to widgets nested in an object widget [ale-rt] (#29) plonetheme.barceloneta: 3.1.11 → 3.1.13 --------------------------------------- New features: - Support for required and invalid styles on form tabs. [thet] Bug fixes: - Update dependencies: Bootstrap 5.3.8. @petschki Products.CMFDiffTool: 4.0.4 → 4.0.5 ----------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) Products.CMFDynamicViewFTI: 7.0.2 → 7.0.3 ----------------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) Products.CMFEditions: 4.0.5 → 4.0.7 ----------------------------------- New features: - Add ``@@check-modifier-conditions`` view on the site root for Managers. It lists the modifiers in ``portal_modifier``, shows which ones have a TALES condition that differs from the default, and lets you revert them, one by one or all at once. [maurits] Bug fixes: - Add missing security declarations to ``ConditionalModifier``, ``ConditionalTalesModifier`` and the two standard size guard modifiers. ``edit`` now requires the ``Manage portal`` permission, the accessors require ``View management screens``, and the modifier hooks of the size guards are private. [plone devs] - `AbortVersioningOfLargeFilesAndImages` and `SkipVersioningOfLargeFilesAndImages`: pass `REQUEST` parameter, so the edit form renders on submit. [maurits] Internal: - Move distribution to src layout [gforcada] (#4217) Products.CMFPlacefulWorkflow: 3.0.5 → 3.0.6 ------------------------------------------- Internal: - Move distribution to src layout [gforcada] (#4217) Products.CMFPlone: 6.0.15 → 6.0.16 ---------------------------------- Bug fixes: - Fix `redirect_after_login` in VHM environments. @ale-rt, @petschki #4151 - TinyMCE: Restore ability to choose which content are folderish types [frapell] #4207 - Allow a Site Administrator to manage the users roles if there are users that have the Manager role set through the portal_role plugin. [ale-rt] #4287 - Fix the end-of-life dates for Python 3.10 and higher in the control panel overview. Warn from the end-of-life date itself. [maurits] - Restrict the security declarations of `Products.CMFPlone.utils` and `Products.CMFPlone.browser.navtree` to explicit public names, and stop opening `OFS.ObjectManager` as a whole module. Also make sure `AccessControl.allow_class` can't be called from restricted code. Internal: - Updated metadata version to 6027. [maurits] #6027 Products.ExtendedPathIndex: 4.0.1 → 5.0.0 ----------------------------------------- Breaking changes: - Drop support for Plone 5.2. Drop support for Python 2. Require Python 3.9 or higher. [gforcada, maurits] Internal: - Move distribution to src layout [gforcada] (#4217) - Use ``plone.meta`` to ease maintenance [gforcada] Products.isurlinportal: 2.0.3 → 2.1.0 ------------------------------------- New features: - Prevent URLs that start with more than two slashes to be considered as URLs in portal. See `security advisory `_. [ale-rt, maurits] Internal: - Update configuration files. [plone devs] Products.MimetypesRegistry: 3.0.1 → 3.0.2 ----------------------------------------- Bug fixes: - Declare only ``MimeTypeException`` public in ``Products.MimetypesRegistry.common`` instead of opening the whole module to Restricted Python with ``allow_module``. [plone devs] Internal: - Move distribution to src layout [gforcada] (#4217) Products.statusmessages: 5.0.6 → 5.0.7 -------------------------------------- collective.monkeypatcher: 2.0.0 → 2.0.1 --------------------------------------- Internal: - Update configuration files. [plone devs] icalendar: 5.0.13 → 5.0.14 -------------------------- - Add PyData Theme version switcher to documentation. See `Issue 825 `_. repoze.xmliter: 1.0b1 → 1.0 --------------------------- - Add support for Python 3.8 - 3.14. [maurits] - Drop support for Python 3.7: it is almost two years out of support and cannot easily be tested. [maurits] attrs: 24.2.0 → 24.3.0 ---------------------- cryptography: 44.0.0 → 50.0.2 ----------------------------- click: 8.1.7 → 8.1.8 -------------------- cssselect: 1.2.0 → 1.5.0 ------------------------ decorator: 5.1.1 → 5.3.1 ------------------------ exceptiongroup: 1.2.2 → 1.3.1 ----------------------------- feedparser: 6.0.11 → 6.0.12 --------------------------- furl: 2.1.3 → 2.1.4 ------------------- h11: 0.14.0 → 0.16.0 -------------------- importlib-resources: 6.4.5 → 6.5.2 ---------------------------------- jsonschema: 4.23.0 → 4.25.1 --------------------------- jsonschema-specifications: 2024.10.1 → 2025.9.1 ----------------------------------------------- jeepney: 0.8.0 → 0.9.0 ---------------------- lxml: 5.3.0 → 5.4.0 ------------------- lxml-html-clean: 0.4.1 → 0.4.4 ------------------------------ Markdown: 3.7 → 3.10.3 ---------------------- mock: 5.1.0 → 5.2.0 ------------------- orderedmultidict: 1.0.1 → 1.0.2 ------------------------------- Pillow: 11.0.0 → 12.3.0 ----------------------- prompt-toolkit: 3.0.48 → 3.0.52 ------------------------------- PyJWT: 2.8.0 → 2.15.1 --------------------- pyOpenSSL: 24.3.0 → 26.4.0 -------------------------- PyYAML: 6.0.2 → 6.0.3 --------------------- referencing: 0.35.1 → 0.36.2 ---------------------------- responses: 0.25.3 → 0.26.3 -------------------------- seedir: 0.5.0 → 0.5.1 --------------------- simplejson: 3.19.3 → 3.20.2 --------------------------- types-PyYAML: 6.0.12.10 → 6.0.12.20250915 ----------------------------------------- types-toml: 0.10.8.5 → 0.10.8.20240310 -------------------------------------- typing-extensions: 4.12.2 → 4.16.0 ---------------------------------- Unidecode: 1.3.8 → 1.4.0 ------------------------ wcwidth: 0.2.13 → 0.2.14 ------------------------ wrapt: 1.17.0 → 1.17.3 ----------------------