Release schedule roundup 2.5 July 2025

Hi all:

I am planning on releasing roundup 2.5 on July 13th.
The 2.5 release drops support for python 2.

To that end I am releasing a beta either next week or the week after.
(I am going to try to restore support for PGP signed emails before
the beta.)

It has 38 changes. The following fixes/features that need testing during
the beta period:

 * This release includes better documentation on REST and makes some
    changes to the REST workflow. If you use a REST front end, please test
    against the beta.

 * The default password algorithm now uses SHA512 and not SHA1, this can
    result in a faster login than the default SHA1 with 2million rounds
    depending on the hardware. Reporting the results of:

        roundup-admin perftest

     for SHA512 and SHA1 hashing would be helpful to get a better feel for the
     impact of choosing a more secure hash method.

  * Errors in filter expression are now reported to the user. The user guide
     includes a section on how to interpret these. Feedback on the docs
     and error messages welcome.

  * Support for generating XHTML was deprecated in 2.3 and has been
     fully removed in 2.5.

  * roundup_gettext now extracts translatable strings from extensions and
    detectors. If you have any in your tracker please test.

  * Permission objects can push filtering down to the database level (for sql).
     This speeds up index pages where a lot of items have to be checked.
     (See reference.txt in the Security/Access control section.)

  *  when using SSL/TLS session cookies are marked as secure. This can
      cause existing session to be locked out requiring a new login but better
      isolates the session cookies. AFAIK there are no other issues with this.

  * file or msg data can be retrieved from the REST endpoint using the
     /binary_content endpoint. The request should use the mime type for the
     data. E.G. if the file3 is a jpeg image:
rest/data/file/3/binary_content with
     an Accept: HTTP header set to 'image/jpg' or 'application/octet-stream' the
     raw data will be returned with the matching mime type. This data is much
     smaller than encoded json data. See rest/txt for details.

  * roundup can use defusedxml if installed to better secure the xmlrpc server.
     If you use the XMLRPC endpoint/server please install defusedxml and
     note any regressions.

  * experimental support for using native HTML number/integer and date inputs.
     These are off by default because they have issues when not working in a
     pure english locale. See the discussion in upgrading.txt or issue2551398.

  * Assigning a class to the classhelper (date popup) now produces valid
    HTML (issue2551231). So if you have tried changing the look/feel of the
    date classhelper by adding a class, it should work now.

If you have any other tickets that you think are ready to be merged,
let me know and I'll see what I can do.

Have a great week.

-- rouilj