[Python-announce] Roundup 2.6.0 release

This release is a security, bugfix and feature release (49 changes),
so make sure to read the upgrade documentation:
https://www.roundup-tracker.org/docs/upgrading.html to bring your
tracker up to date or patch an older release.

Version 2.6.0 requires Python version 3.10 or newer.

Among the significant enhancements in version 2.6.0 compared to
the 2.5.0 release are:

* Filter history entries where permissions are handled by check function
  When a property's permission uses a check command, the history
  of changes for that property were shown. The permissions are now
  properly checked using the check function. (security)

* Fix old CSRF prevention for PATCH method when using REST
  The PATCH method was not covered by the old CSRF protection method.
  (security)

* Modern CSRF prevention method available
  This release implements CSRF protection using Cross-Site Request
  Forgery by Filippo Valsorda https://words.filippo.io/csrf/.  This
  is an effective method for CSRF protection and is much simpler as
  well. There are no configurable options unlike the 8 options for the
  older method. This can be opted into using config.ini.

* Require reauthentication when making changes to sensitive fields
  You can trigger a reauthentication when the user changes particular
  fields. For example you can require a password be entered before the
  user changes their password.

* Classic UI interface modernization.

  The classic tracker has basic responsive support for mobile.  The
  table based layout was removed and HTML 5 landmarks (main, nav ...)
  are used along with flex and grid layouts.  The left hand menu now
  collapses to a grid layout in a single column when on a smaller
  display. This can be retrofitted to existing classic trackers.

The file CHANGES.txt
(https://sourceforge.net/p/roundup/code/ci/default/tree/CHANGES.txt)
has a detailed list of feature additions and bug fixes for each release.
_______________________________________________
Python-announce-list mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-announce-list.python.org
Member address: [email protected]