pip: 26.2.2 → 26.3 ------------------ setuptools: 81.0.0 → 84.2.1 --------------------------- zc.buildout: 5.2.0 → 6.0.2 -------------------------- certifi: 2026.10.19 → 2026.10.23 -------------------------------- Plone: 6.2.2 → 6.2.3 -------------------- - Prepare release. [maurits] plone.api: 3.0.3 → 3.0.4 ------------------------ Documentation: - Require linkcheck to pass. @stevepiercy plone.app.locales: 7.0.4 → 7.0.5 -------------------------------- New features: - Fix es translation @erral (#621) - Widgets translations: nl @ingovdb (#622) - Update cs and sr translation @Valentina Ostojić (#623) Internal: - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] plone.app.querystring: 3.0.0 → 3.1.1 ------------------------------------ New features: - Allow sorting query results by location (``path``), which orders items by their full physical path. @ericof (#207) - Add the ``plone.app.querystring.operation.string.currentUID`` ("Current item") operation, which filters an index by the UID of the item where the query runs. Add-ons can enable it on fields for their own relation indexes. @ericof (#208) Bug fixes: - Ignore empty string range bounds, preserve the other bound in partially filled between criteria, and avoid converting ignored criteria into equality queries. [davisagli] (empty-range) - Combine "is not" (``selection.none``) with other criteria on the same index into one catalog record (``query`` plus ``not``) instead of letting the last criterion overwrite the first. Several exclusions on one index are merged as well; repeated positive selections keep the previous last-wins behaviour. @petschki - Fix path criteria behind a Virtual Host Monster: paths relative to the virtual hosting root (including ``_vh_`` segments) are now translated to physical paths. Before, the navigation root or portal path was prepended, which gave wrong results when the virtual root was not the portal (e.g. a subsite or language folder) or the context was inside a navigation root. See plone/plone.restapi#2023. @petschki Internal: - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] plone.app.upgrade: 4.1.1 → 4.1.2 -------------------------------- Internal: - Added upgrade to 6206, Plone 6.2.3. [maurits] plone.batching: 3.0.1 → 3.0.3 ----------------------------- Bug fixes: - Declare only ``Batch`` public in the ``plone.batching`` module instead of opening the whole module to Restricted Python with ``allow_module``. [maurits] Internal: - Update configuration files. [plone devs] plone.event: 3.0.0 → 3.0.1 -------------------------- Bug fixes: - Pass ``re.MULTILINE`` to ``re.sub`` as ``flags`` instead of as the positional ``count`` argument, which is deprecated since Python 3.13. [syahra712] Internal: - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] plone.exportimport: 2.1.0 → 2.3.0 --------------------------------- New features: - Enable browser layers when importing/exporting content @gforcada #106 - Add `--path` and `--paths` options to `plone-exporter` to export only parts of a site. Relations, translations, discussions, portlets and redirects are limited to the exported content @ericof #86 Bug fixes: - Do not fail exporting content whose ``language`` is ``None``. Such an item serializes to ``"language": null``, and ``fix_language`` raised ``AttributeError: 'NoneType' object has no attribute 'get'``. It is now treated like a missing language and gets the default-language placeholder, which the importer resolves. @kunalKumar-13 #95 - Fixed export and import of grid blocks whose images have no ``image_scales`` information. @ericof #109 - Fixed ``plone-exporter`` silently skipping fields protected by a read permission not granted to the ``Manager`` role, such as behavior fields on the Plone Site root. Both command line tools now run with the site hook set and without overriding the roles of the system user. @ericof #110 - Do not silently drop file and image fields on import when a blob's file name has another Unicode normalization form on disk. Blob files are now exported under a normalized file name (NFC, without path separators or characters invalid on Windows), the import also finds the NFC form of a recorded blob path, and items that could not be fully deserialized are listed as imported with errors, making `plone-importer` exit with status 1 @ericof #114 Tests: - Fix intermittent failure of the services export/import roundtrip test, which compared ZIP archives including file timestamps @ericof - Fixed test isolation with pytest-plone 1.1.0 by keeping importers and fixtures from committing transactions during tests. @ericof Internal: - Move package metadata from `setup.py` to `pyproject.toml` @plone - Declared ``plone.autoform``, ``plone.behavior``, ``plone.supermodel`` and ``Products.GenericSetup`` as dependencies. @ericof plone.i18n: 6.0.0 → 6.0.1 ------------------------- Bug fixes: - Let the Japanese normalizer return the same answer for the same id each time. This fixes an occasionally failing test. [mauritsvanrees] (#107) Internal: - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] plone.keyring: 5.0.0 → 5.0.1 ---------------------------- Internal: - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] plone.memoize: 4.0.0 → 4.0.1 ---------------------------- Internal: - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] plone.namedfile: 8.1.1 → 8.1.2 ------------------------------ Bug fixes: - Stop ``filestream_range_iterator.read`` at the end of the requested range. WSGI servers like waitress read the ``wsgi.file_wrapper`` instead of iterating it, so a range request read the file from the start of the range to its end. [mliebischer] (#226) Internal: - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] plone.portlet.collection: 5.0.1 → 5.0.2 --------------------------------------- Internal: - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] plone.portlet.static: 5.0.0 → 5.0.1 ----------------------------------- Internal: - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] plone.restapi: 10.0.4 → 10.2.1 ------------------------------ New features: - Controlpanel service: Added `description`, `group_id`, and `icon` to the control panels listed by `GET @controlpanels`, taken from their configlets. @sneridagh #2086 - Add support for `multipart/form-data` in POST and PATCH requests, allowing file uploads alongside JSON metadata. [mamico] #1953 Bug fixes: - Security: no longer allow importing the `json` module in restricted code. Some functions could be used to call protected methods on any object. See https://github.com/plone/plone.restapi/security/advisories/GHSA-vgxm-pwch-89q6 @mauritsvanrees - Schema serialization: Fix serialization of `schema.Object` fields that are not files or images. They use plain property names, list their required fields, and no longer claim a `File` factory. @sneridagh #2061 - Deserializing Boolean values: Reject values other than Booleans and the strings "true" and "false" for Boolean fields. Other strings used to become False silently. @sneridagh #2061 - Remove an existing user portrait when `PATCH @users/` receives `"portrait": null`. @davisagli #2079 - Fix partial updates to `@controlpanels/` failing with a server error when the control panel schema has an invariant that reads a field omitted from the request. Invariants now see the stored registry values for omitted fields. @sneridagh - Fix `@controlpanels/content-rules` to read and write values for content rule action and condition fields that are declared in a non-default fieldset. @ericof #2016 - In the `@search` service, avoid passing `metadata_fields` from the request query to the catalog query. @kunalKumar-13 #2031 - In the `@users` endpoint, fix parsing of the `limit` parameter when a non-integer is passed. @kunalKumar-13 #2046 - Allow anonymous users to read the `@types` schema of the context's own content type, so Volto's default view works for them. Other types and the types list still require authentication. @ericof #2054 - Fix two cases where REST API search and summary serialization could return HTTP 500 (`TypeError`) based on request parameters: a form or query string parameter named `summary_serializer_metadata`, and a `portal_type` value containing the substring "query" when `use_site_search_settings` is used. Also make the summary serializer's per-request metadata cache effective; it was recomputed for every item. @mliebischer #2060 - Return the error instead of 204 No Content when the final `@tus-upload` PATCH fails to create the content. @ericof #2075 - Content rules endpoints return 404 when content rules are not activated in the site, instead of failing with an error. Preparation for PLIP https://github.com/plone/Products.CMFPlone/issues/4119. @jensens - ``POST``, ``PATCH`` and ``DELETE`` on ``@controlpanels`` with an unknown control panel name return 404 instead of 500. @jensens Documentation: - Fix broken links and require linkcheck to pass. @stevepiercy - Fix docs build on Read the Docs. @davisagli Tests: - Add an acceptance test layer and `make acceptance-backend-start` target for running frontend tests against a local REST API checkout. [sneridagh] #2061 - Add an acceptance test layer and `make acceptance-backend-start` target for frontend tests against a local REST API checkout. [sneridagh] #2061 Internal: - Share the code that builds JSON schemas and converts values for `zope.schema` interfaces between control panels, content rules and new services, in private helpers of `plone.restapi.types.utils`. The new `SchemaValues` context replaces the three `FakeDXContext` copies, and `FakeDXContext` remains as an alias. @sneridagh #2061 - Add files for Anthropic's oss-scanner programme to run their tests on the repo. @jackahl #2070 plone.scale: 5.1.0 → 5.1.1 -------------------------- Bug fixes: - Keep the input image unchanged when scaling with ``mode="contain"``. (#167) plone.staticresources: 3.0.6 → 3.0.10 ------------------------------------- New features: - Update Mockup to 5.6.14 and @patternslib/dev to 4.2.0. @petschki - Update Mockup to 5.6.13 and @patternslib/dev to 4.1.0. @thet Bug fixes: - Update Mockup to 5.6.15 (TinyMCE 8.9.3 security fix, Patternslib 9.11.1, Svelte 5.57.3). @petschki Documentation: - Update the version information in the README. @petschki Internal: - Update GitHub action dependencies. @thet - Update JS infrastructure, use pnpm v12, use strict versions. @thet - pnpm: Trust internal packages mockup, @patternslib/patternslib and @patternslib/dev. @thet - Update Mockup to 5.6.11. See https://github.com/plone/mockup/releases/tag/5.6.11 @petschki plone.volto: 6.0.1 → 6.1.0 -------------------------- New features: - Add `personal_tools` actions (Profile, Preferences and Site Setup) for the Volto toolbar's Personal tools menu, with an upgrade step for existing sites. @ericof #217 Bug fixes: - Fix upgrade step from 1100 to 1101 by bumping version in metadata.xml. @jnptk Tests: - Give each test fixture its own site id, so all test layers can stay set up for the whole pytest-plone session: the core layers now use `volto` and the coresandbox layers `coresandbox`. Add-ons using the plone.volto acceptance layers find the site at `/volto` or `/coresandbox` instead of `/plone`. @ericof #217 plonetheme.barceloneta: 4.1.1 → 4.1.2 ------------------------------------- Bug fixes: - Preserve the source order of head metadata, links, styles, and scripts in the Diazo transform. This keeps import maps ahead of module preloads and module scripts, fixing module resolution in Firefox, and preserves CSS/classic-script ordering. @mrtango #465 Internal: - package.json: Synchronize tinymce version with Mockup (8.9.3). @petschki Products.CMFDiffTool: 5.0.0 → 5.0.1 ----------------------------------- Internal: - Fix ``testHTMLDiff`` test on Python 3.15, which adds a ``diff_changed`` css class to changed cells in ``difflib.HtmlDiff`` output. [maurits] - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] - Update configuration files. [plone devs] Products.CMFEditions: 5.0.0 → 5.0.2 ----------------------------------- New features: - Add ``@@check-modifier-conditions`` view on the site root for Managers. It lists the modifiers in ``portal_modifier``, shows which ones have a TALES condition that differs from the default, and lets you revert them, one by one or all at once. [maurits] Bug fixes: - Add missing security declarations to ``ConditionalModifier``, ``ConditionalTalesModifier`` and the two standard size guard modifiers. ``edit`` now requires the ``Manage portal`` permission, the accessors require ``View management screens``, and the modifier hooks of the size guards are private. [plone devs] - `AbortVersioningOfLargeFilesAndImages` and `SkipVersioningOfLargeFilesAndImages`: pass `REQUEST` parameter, so the edit form renders on submit. [maurits] Internal: - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] - Update configuration files. [plone devs] Products.CMFPlone: 6.2.2 → 6.2.3 -------------------------------- Bug fixes: - In the Site Setup warn when the Python version is out of security support. Also warn when Plone 6.2 is out of maintenance or security support. [maurits] - Restrict the security declarations of `Products.CMFPlone.utils` and `Products.CMFPlone.browser.navtree` to explicit public names, and stop opening `OFS.ObjectManager` as a whole module. Also make sure `AccessControl.allow_class` can't be called from restricted code. Internal: - Updated metadata version to 6206. @mauritsvanrees Products.MimetypesRegistry: 4.0.0 → 4.0.2 ----------------------------------------- Bug fixes: - Declare only ``MimeTypeException`` public in ``Products.MimetypesRegistry.common`` instead of opening the whole module to Restricted Python with ``allow_module``. [plone devs] Internal: - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] - Update configuration files. [plone devs] Products.PortalTransforms: 5.0.0 → 5.0.1 ---------------------------------------- Bug fixes: - Fix: Improper warnings on broken transform [ewohnlich, jensens] (#19) - Rename ``IDataStream.setCachable`` to ``setCacheable``, the name ``datastream`` has always implemented. [jensens] (#72) - ``BrokenTransform`` stores only the error message instead of the exception instance, whose traceback kept every frame of the request that loaded the transform alive. [jensens] (#112) - Keep the ``BrokenTransform`` as ``_v_transform`` when the transform module cannot be imported, so that ``convert()`` logs a warning instead of raising ``AttributeError``. [jensens] (#113) Internal: - Move package metadata from ``setup.py`` to ``pyproject.toml``. [plone devs] pytest-plone: 1.1.0 → 1.1.1 --------------------------- z3c.zcmlhook: 3.0 → 3.1 ----------------------- zope.sendmail: 7.2 → 7.3 ------------------------ build: 1.6.0 → 1.6.1 -------------------- coverage: 7.16.0 → 7.16.2 ------------------------- cryptography: 50.0.1 → 50.0.2 ----------------------------- iniconfig: 2.3.0 → 2.3.1 ------------------------ lxml-html-clean: 0.4.5 → 0.4.6 ------------------------------ pluggy: 1.6.0 → 1.7.0 --------------------- PyJWT: 2.13.0 → 2.15.1 ---------------------- pyproject-hooks: 1.2.0 → 1.3.3 ------------------------------ pytest: 9.1.1 → 9.2.0 --------------------- python-dotenv: 1.2.3 → 1.2.4 ---------------------------- robotframework: 7.3.2 → 7.5.1 ----------------------------- robotframework-browser: 20.0.0 → 20.6.0 --------------------------------------- selenium: 4.44.0 → 4.52.0 ------------------------- simplejson: 4.1.2 → 4.2.0 ------------------------- trio: 0.34.0 → 0.35.0 --------------------- trove-classifiers: 2026.6.1.19 → 2026.9.21.13 --------------------------------------------- types-PyYAML: 6.0.12.10 → 6.0.12.20261103 ----------------------------------------- types-toml: 0.10.8.5 → 0.10.8.20260518 -------------------------------------- tzdata: 2026.3 → 2026.6 ----------------------- wcwidth: 0.8.3 → 0.9.4 ---------------------- webresource: 2.0.0 → 2.0.1 -------------------------- wrapt: 2.4.0 → 2.5.2 -------------------- zipp: 4.1.0 → 4.1.2 -------------------