CHANGELOG.rst



To find the state of this project's repository at the time of any of these versions, check out the tags.


Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

Unreleased

Changed

Change default network policy of the Apollo client to cache-and-network.


Fixed

In case the status code of a response was not in the range between 200 and 299
but still indicates that the response should be delivered, e. g. in the case
of a redirected request, the service worker served the offline fallback page.
In some cases, the resize listener for the IFrame in the LegacyBaseTemplate
did not trigger.


3.0b1 - 2023-02-27
Added

Support for two factor authentication via email codes and Webauthn.


3.0b0 - 2023-02-15
This release starts a new era of the AlekSIS® framework, by introducing a
dynamic frontend app written in Vue.js which communicates with the backend
through GraphQL.  Support for legacy views (Django templates and
Materialize) was removed; while there is backwards compatibility for now,
this is only used by official apps until their views are fully migrated.
AlekSIS and its new frontend require Node.js version 18 or higher to run the
Vite bundler. On Debian, this means that Debian 12 (bookworm) is needed, or
Node.js must be installed from a third-party repository.

Removed

Official support for views rendered server-side in Django is removed. The
LegacyBaseTemplate provided for backwards compatibility must not be used
by apps declaring a dependency on AlekSIS >= 3.0.
Support for deploying AlekSIS in sub-URLs
Support for production deployments without HTTPS


Deprecated

The webpack_bundle management command is replaced by the new vite
command. The webpack_bundle command will be removed in AlekSIS-Core 4.0.


Added

Notification drawer in top nav bar
GraphQL queries for base system and some core data management
[Dev] New mechanism to register classes over all apps (RegistryObject)
Model for rooms


Changed


Show languages in local language


Rewrite of frontend (base template) using Vuetify
* Frontend bundling migrated from Webpack to Vite (cf. installation docs)
* [Dev] The runuwsgi dev server now starts a Vite dev server with HMR in the

background


OIDC scope "profile" now exposes the avatar instead of the official photo


Based on Django 4.0
* Use built-in Redis cache backend
* Introduce PBKDF2-SHA1 password hashing


Persistent database connections are now health-checked as to not fail
requests


[Dev] The undocumented field check on DataCheckResult was renamed to data_check


Frontend bundling migrated from Webpack to Vite


Get dashboard widgets and data checks from apps with new registration mechanism.


Use write-through cache for sessions to retain on clear_cache


Better error page with redirect option to login page when user has no permission to access a route.


Users now can setup as many 2FA devices as they want.


The 2FA profile overview was completely redesigned.


Fixed

The system tried to send notifications for done background tasks
in addition to tasks started in the foreground
2FA via messages or phone calls didn't work after a faulty dependency
update
[Dev] Site reference on extensible models can no longer cause name clashes
because of its related name


Removed


iCal feed URLs for birthdays (will be reintroduced later)


[Dev] Django debug toolbar
* It caused major performance issues and is not useful with the new

frontend anymore


2.12.3 - 2023-03-07
Fixed

The permission check for the dashboard edit page failed when the user had no person assigned.
OIDC scope "phone" had no claims.
AlekSIS groups were not synced to Django groups on registration of existing persons
Invitations for existing short name did not work.
Invitations for persons without pre-defined e-mail address did not behave correctly


2.12.2 - 2022-12-18
Fixed

Incorporate SPDX license list for app licenses on About page because
spdx-license-list dependency vanished.


2.12.1 - 2022-11-06
Fixed

An invalid backport caused OIDC clients without PKCD to fail.


2.12 - 2022-11-04

Added

Show also group ownerships on person detail page
[Dev] Provide plain PDF template without header/footer for special layouts.
[Dev] Introduce support for reformattinga and linting JS, Vue, and CSS files.


Changed

OIDC scope "profile" now exposes the avatar instead of the official photo
Language selection on Vue pages now runs via GraphQL queries.
[Dev] Provide function to generate PDF files from fully-rendered templates.
[Dev] Accept pre-created file object for PDF generation to define
the redirect URL in advance.


Fixed

The logo in the PDF files was displayed at the wrong position.
Sometimes the PDF files were not generated correctly
and images were displayed only partially.
Error message in permission form was misleading.
Personal invites did not work
Invite Person view threw an error when personal invites existed
Detailed information for done Celery tasks weren't saved.


2.11 - 2022-08-27
This release sunsets the 2.x series of the AleKSIS core.

Deprecated

All frontends using Django views and Django templates are deprecated and support
for them will be removed in AlekSIS-Core 3.0. All frontend code must be written in
Vue.js and be properly separated from the backend. In the same spirit, all backend
features must expose GraphQL APIs for the frontend to use.


Added
The following features are introduced here mainly to simplify gradual
updates. GraphQL and the Vuetify/Vue.js frontend mechanisms are preview
functionality and app developers should not rely on them before AlekSIS-Core
3.0.

Introduce GraphQL API and Vue.js frontend implementation
Introduce webpack bundling for frontend code


2.10.2 - 2022-08-25
Fixed

Celery's logging did not honour Django's logging level
Automatically clean up expired OAuth tokens after 24 hourse


2.10.1 - 2022-07-24

Changed

Make External Link Widget icons clickable


Fixed

The progress page for background tasks didn't show all status messages.


2.10 - 2022-06-25

Added

Add Ukrainian locale (contributed by Sergiy Gorichenko from Fre(i)e Software GmbH).
Add third gender to gender choices
Add DataCheck to validate specific fields of specific models


Changed

Restructure group page and show more information about members.
django-two-factor-auth >= 1.14.0 is now required due to a
backwards-incompatible breakage in that library


Fixed

Password change view did not redirect to login when accessed unauthenticated.
Sorting icons were inlined into stylesheet
iOS devices used the favicon instead of the PWA icon when the PWA was added to the home screen.


Changed

Update icon choices for models to new icon set


2.9 - 2022-05-25

Added

Allow to disable exception mails to admins
Add possibility to create iCal feeds in all apps and dynamically create user-specific urls.


Fixed

The menu button used to be displayed twice on smaller screens.
The icons were loaded from external servers instead from local server.
Weekdays were not translated if system locales were missing
Added locales-all to base image and note to docs


The icons in the account menu were still the old ones.
Due to a merge error, the once removed account menu in the sidenav appeared again.
Scheduled notifications were shown on dashboard before time.
Remove broken notifications menu item in favor of item next to account menu.
Serve OAuth discovery information under root of domain
[OAuth2] Resources which are protected with client credentials
allowed access if no scopes were allowed (CVE-2022-29773).
The site logo could overlap with the menu for logos with an unexpected aspect ratio.
Some OAuth2 views stopped working with long scope names.
Resetting password was impossible due to a missing rule
Language selection was broken when only one language was enabled in
preferences.


Removed

Remove option to limit available languages in preferences.


Changed

[Dev] ActionForm now checks permissions on objects before executing
[Dev] ActionForm now returns a proper return value from the executed action
Pin version of javascript dependencies


2.8.1 - 2022-03-13
Changed

Official apps can now override any setting


2.8 - 2022-03-11

Added

Add iconify icons
Use identicons where avatars are missing.
Display personal photos instead of avatars based on a site preference.
Add an account menu in the top navbar.
Create a reusable snippet for avatar content.
Allow to configure if additional field is required
Allow to configure description of additional fields
Allow configuring regex for allowed usernames
[Dev] Support scheduled notifications.
Implement StaticContentWidget
Allow to enable password change independently of password reset


Changed

Added a Retry button to the server error page


Fixed

The user handbook was lacking images and instructions on PWA usage with the Safari browser.
The reset password button on the login site used to overflow the card on smaller devices.


Deprecated

Legacy material icon font will be removed in AlekSIS-Core 3.0


2.7.4 - 2022-02-09

Changed

Allow disabling query caching with cachalot
Add invitation key to success message when a person without e-mail address is invited by id


Fixed

Only exactly one person without e-mail address could be invited
No person was created and linked to the PersonInvitation object when invite by e-mail is used
No valid data in the second e-mail field of the signup form when it was disabled
Invitation options were displayed to superusers even when the feature was disabled
Inviting newly created persons for registration failed
Invited person was not displayed correctly in list of sent invitations
[Docker] Do not clear cache in migration container die to session invalidation issues
Notification email about user changes was broken
SQL cache invalidation could fail when hitting OOT database


2.7.3 - 2022-02-03

Fixed

Migration added in 2.7.2 did not work in all scenarios
[Dev] Field change tracking API for Person was broken in 2.7.2
[OAuth] Automatic clean-up of expired OAuth tokens could fail
Allow maskable icons for non-masked use
Add missing documentation


Known issues

Maskable and non-masked icons *purpose) any cannot be separated


2.7.2 - 2022-01-31

Changed

[Dev] The (undocumented) setting PDF_CONTEXT_PROCESSORS is now named NON_REQUEST_CONTEXT_PROCESSORS
[Docker] Cache is now cleared if migrations are applied
Update German translations.