pip: 26.1.2 → 26.2.2
--------------------

certifi: 2026.6.17 → 2026.10.23
-------------------------------

Plone: 6.1.5 → 6.1.6
--------------------
- Prepare release.
  [maurits]


plone.app.content: 4.2.0 → 4.2.1
--------------------------------
Bug fixes:

- Protect the Users, Groups, and Principals vocabularies using the "List portal members" permission. @davisagli


plone.app.upgrade: 3.3.2 → 3.3.3
--------------------------------
Internal:

- Added upgrade to 6113, Plone 6.1.6.  [maurits]


plone.autoform: 2.0.4 → 2.0.5
-----------------------------
Bug fixes:

- Secure a field when a wrong permission is specified.
  @ale-rt (#92)


plone.batching: 2.0.7 → 2.0.8
-----------------------------
Bug fixes:

- Declare only ``Batch`` public in the ``plone.batching`` module instead of opening the whole module to Restricted Python with ``allow_module``.
  [maurits]


plone.restapi: 9.15.6 → 9.15.8
------------------------------
New features:

- Add support for the `RESTAPI_ADDITIONAL_NON_METADATA_ATTRIBUTES` environment variable, a comma-separated list of extra attribute names appended to the summary serializer's `non_metadata_attributes`.

Bug fixes:

- Fix two cases where REST API search and summary serialization could return HTTP 500 (`TypeError`) based on request parameters: a form or query string parameter named `summary_serializer_metadata`, and a `portal_type` value containing the substring "query" when `use_site_search_settings` is used. Also make the summary serializer's per-request metadata cache effective; it was recomputed for every item. @mliebischer #2060

- Security: no longer allow importing the `json` module in restricted code.
  Some functions could be used to call protected methods on any object.
  See https://github.com/plone/plone.restapi/security/advisories/GHSA-vgxm-pwch-89q6
  @mauritsvanrees

- Fix the security check when a wrong permission is specified.
  @ale-rt #2041

- Security: in summary serializer only allow access to metadata that is available in the catalog.


plone.staticresources: 2.3.8 → 2.3.9
------------------------------------
Bug fixes:

- Update mockup=5.4.11. See https://github.com/plone/mockup/releases/tag/5.4.11.
  Update bootstrap-icons=1.13.2. @petschki


Products.CMFEditions: 4.0.6 → 4.0.7
-----------------------------------
New features:

- Add ``@@check-modifier-conditions`` view on the site root for Managers.
  It lists the modifiers in ``portal_modifier``, shows which ones have a TALES condition that differs from the default, and lets you revert them, one by one or all at once.
  [maurits]

Bug fixes:

- Add missing security declarations to ``ConditionalModifier``, ``ConditionalTalesModifier`` and the two standard size guard modifiers.
  ``edit`` now requires the ``Manage portal`` permission, the accessors require ``View management screens``, and the modifier hooks of the size guards are private.
  [plone devs]

- `AbortVersioningOfLargeFilesAndImages` and `SkipVersioningOfLargeFilesAndImages`: pass `REQUEST` parameter, so the edit form renders on submit.  [maurits]


Products.CMFPlone: 6.1.5 → 6.1.6
--------------------------------
Bug fixes:

- In the Site Setup warn that Plone 6.1 is out of maintenance support.
  Also check the Python version and warn when that is out of security support.
  [maurits]

- Restrict the security declarations of `Products.CMFPlone.utils` and `Products.CMFPlone.browser.navtree` to explicit public names, and stop opening `OFS.ObjectManager` as a whole module. Also make sure `AccessControl.allow_class` can't be called from restricted code.

Internal:

- Updated metadata version to 6113.  @mauritsvanrees


Products.MimetypesRegistry: 3.0.1 → 3.0.2
-----------------------------------------
Bug fixes:

- Declare only ``MimeTypeException`` public in ``Products.MimetypesRegistry.common`` instead of opening the whole module to Restricted Python with ``allow_module``.
  [plone devs]

Internal:

- Move distribution to src layout [gforcada] (#4217)


pytest-plone: 1.0.0a2 → 1.1.1
-----------------------------

zope.sendmail: 7.1 → 7.1.1
--------------------------

click: 8.4.0 → 8.4.2
--------------------

cryptography: 48.0.0 → 50.0.2
-----------------------------

feedparser: 6.0.12 → 6.0.14
---------------------------

importlib-metadata: 9.0.0 → 9.0.1
---------------------------------

iniconfig: 2.3.0 → 2.3.1
------------------------

Markdown: 3.10.2 → 3.10.3
-------------------------

nh3: 0.3.5 → 0.3.7
------------------

prompt-toolkit: 3.0.52 → 3.0.53
-------------------------------

PyJWT: 2.12.1 → 2.15.1
----------------------

pyOpenSSL: 26.2.0 → 26.4.0
--------------------------

pytest: 8.4.2 → 9.2.0
---------------------

python-dotenv: 1.2.2 → 1.2.4
----------------------------

responses: 0.26.0 → 0.26.3
--------------------------

selenium: 4.9.1 → 4.27.1
------------------------

trove-classifiers: 2026.5.20.19 → 2026.9.21.13
----------------------------------------------

types-PyYAML: 6.0.12.10 → 6.0.12.20261103
-----------------------------------------

types-toml: 0.10.8.5 → 0.10.8.20260518
--------------------------------------

tzdata: 2026.2 → 2026.6
-----------------------

tomli: 2.4.0 → 2.4.1
--------------------

RestrictedPython: 8.3 → 8.5
---------------------------