Article <20250713041255.EF3066A01A3@pe15.cs.umb.edu>

Deutsch English Français Italiano
<20250713041255.EF3066A01A3@pe15.cs.umb.edu>

View for Bookmarking (what is this?)
Look up another Usenet article
Path: nntp.eternal-september.org!news.eternal-september.org!eternal-september.org!feeder3.eternal-september.org!fu-berlin.de!uni-berlin.de!not-for-mail
From: "John P. Rouillard" <rouilj@cs.umb.edu>
Newsgroups: comp.lang.python.announce
Subject: [Python-announce] Roundup 2.5.0 release announcement (including security fix)
Date: Sun, 13 Jul 2025 00:12:55 -0400
Lines: 371
Sender: rouilj@cs.umb.edu
Approved: python-announce-list@python.org
Message-ID: <20250713041255.EF3066A01A3@pe15.cs.umb.edu>
Reply-To: python-list@python.org, rouilj@ieee.org
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Cancel-Lock: sha1:bGt7xsxMlDpP7yXXDNr7ehrj5dI= sha256:eiezewUEuqAGV0mByM7lUvvVOAfTC2YhdNTK/dz+Y8A=
ZReturn-Receipt-To: rouilj@cs.umb.edu
ZDisposition-Notification-To: rouilj@cs.umb.edu
Content-ID: <1539020.1752379975.1@pe15.cs.umb.edu>
Message-ID-Hash: BOITRFLKXUM23EAGJ3XNEBLVMD4YITJF
Precedence: list
Archived-At: <https://mail.python.org/archives/list/python-announce-list@python.org/message/BOITRFLKXUM23EAGJ3XNEBLVMD4YITJF/>

Hello all:

I'm proud to release version 2.5.0 of the Roundup issue
tracker.  This release is a bugfix and feature release, so
make sure to read https://www.roundup-tracker.org/docs/upgrading.html
to bring your tracker up to date.

The 42 changes, as usual, include some new features and many bug
fixes. One bug fix is an XSS security issue with CVE-2025-53865
primarily with the responsve and devel templates. See: =


   https://www.roundup-tracker.org/docs/upgrading.html#xss-security-issue-=
with-devel-and-responsive-templates-recommended

Version 2.5.0 does not support Python 2. The minimum Python
version is 3.7.

Among the significant enhancements in version 2.5.0 compared to
the 2.4.0 release are:

* **XSS vulnerability with devel and responsive templates fixed**

  Just before release an XSS security issue with trackers based on
  the devel or responsive templates was discovered. The updating
  directions include instructions on fixing this issue with the
  html templates.

* **The property/field advanced search expression feature has been
  enhanced and documented.**

  Search expressions are usually built using the
  expression editor on the search page. They can be built manually
  by modifying the search URL but the RPN search expression format
  was undocumented. Errors in expressions could return results that
  didn't match the user's intent. This release documents the RPN
  expression syntax, adds basic expression error detection, and
  improves error reporting.

* **The default hash method for password storage is more secure.**

  We use PBKDF2 with SHA512 (was SHA1). With this change you can
  lower the value of password_pbkdf2_default_rounds in your
  tracker's config.ini. Check the upgrading documentation for more
  info. (Note this may cause longer authentication times, the
  upgrade doc describes how to downgrade the hash method if required.)

* **Roundup's session token is now prefixed with the magic
  ``__Secure__`` tag when using HTTPS.**

  This adds another layer of protection in addition to the
  existing ``Secure`` property that comes with the session cookie.

* **Data authorization can be done at the database level speeding up
  display of index pages.**

  Roundup verifies the user's authorization for the data fetched
  from the database after retrieving data from the database. A new
  optional ``filter`` argument has been added to Permission
  objects. When the administrator supplies a filter function, it
  can boost performance with SQL server databases by pushing
  selection criteria to the database. By offloading some
  permission checks to the database, less data is retrieved from
  the database. This leads to quicker display of index pages with
  reduced CPU and network traffic.

* **The REST endpoint can supply binary data (images, pdf, ...) to
  its clients.**

  Requesting binary data from a REST endpoint has been a
  hassle. Since JSON can't handle binary data, images (and other
  binary data) need to be encoded. This makes them significantly
  larger. The workaround was to use a non-REST endpoint for fetching
  non-text attachments. This update lets the REST endpoint return
  raw message or file content data. You can utilize the
  ``binary_content`` endpoint along with an appropriate ``Accept``
  header (e.g. ``image/jpeg``) in your request.

* **Extract translatable strings from your tracker easily.**

  The ``roundup-gettext`` tool has been enhanced to extract
  translatable strings from detectors and extensions. This will
  simplify the process of translating your trackers.

Other miscellaneous fixes include:

* Fix a crash bug on Windows with Python 3.13.

* Update documentation on required REST headers, along with other
  documentation updates.

* Improve handling of an error condition generated when an invalid
  REST response format is requested. For example if XML output is
  requested, but dicttoxml is not installed, we now return an
  error without doing any work.

* Fix an incorrect error report when a PUT REST request sets
  the user's email address to its current value.

* Add support for the ``defusedxml`` Python module to enhance
  security when using XML.

* Introduce the templating function:
  ``utils.set_http_response(integer)`` to set the HTTP return code
========== REMAINDER OF ARTICLE TRUNCATED ==========