3.32.14 (2021-12-01)
====================
👷 Bug fixes
------------

- server: correct RQL generation when we have function in ``ORDERBY`` (`#466 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/466>`_)

3.32.13 (2021-11-17)
====================
👷 Bug fixes
------------

- pkg: pin Yams version < 0.46.0

3.32.12 (2021-11-17)
====================
Various changes
---------------

- depend on sphinx>=4.3

3.32.11 (2021-11-08)
====================
👷 Bug fixes
------------

- views: remove an abusive escape (`#457 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/457>`_)

3.32.10 (2021-11-02)
====================
👷 Bug fixes
------------

- build_doc: docutils version 0.18.0 breaks doc building (`#443 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/443>`_)
- pkg: don't use pyparsing 3 since it's not compatible with rdflib 5 (`#441 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/441>`_)
- pkg: pin pyramid_multiauth version to avoid compatibility issue with Pyramid 1 (`#450 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/450>`_)

3.32.9 (2021-10-12)
===================
👷 Bug fixes
------------

- csrf: ensure that we have a csrf token returned on every requests

3.32.8 (2021-10-04)
===================
👷 Bug fixes
------------

- facet: remove abusive escaping in facets views (`#394 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/394>`_)

3.32.7 (2021-09-29)
===================
👷 Bug fixes
------------

- backout "limit setuptools version to avoid issue with 2to3"
- use our package rdflib-jsonld-without-2to3, this is a fork of
  rdflib-jsonld with 2to3 usage removed, but which still
  contains the whole package code unlike rdflib-jsonld 0.6.x.
- reledit: Do not retrieve a list of schemata with _compute_ttypes

3.32.6 (2021-09-24)
===================
👷 Bug fixes
------------

- don’t escape value in navigation components (`#398 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/389>`_)
- views: remove unneeded xml_escape for primary titles
- setup: keep rdflib-jsonld at version < 0.6.0
- setup: limit setuptools version to avoid issue with 2to3

3.32.5 (2021-09-14)
===================

- upgrade rdflib-jsonld version to keep compatibility with setupools
  58 and above

3.32.4 (2021-09-02)
===================
👷 Bug fixes
------------

- do not use localhost.local has test domain, but keep the one already defined

3.32.3 (2021-08-31)
===================
🎉 New features
---------------

- migration: add a migration script to warn about incompatibility of cwtags. (`#367 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/367>`_)

👷 Bug fixes
------------

- bringing back CubicWebServerTC and porting it to pyramid
- fix bad escaped values in web views
- pkg: since we added csrf mecanism, we need pyramid >= 1.9
- test_newcube were broken because we removed cubicweb-\*.spec file but didn't updated the tests

3.32.2 (2021-07-30)
===================
🎉 New features
---------------

- use open-source/gitlab-ci-templates in cube skeleton

👷 Bug fixes
------------

- add default value for params argument of PyramidCWTest.webapp.post (`#350 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/350>`_)
- csrf: give CSRF token when using /ajax route
- empty identification cookie on webapp.reset()
- remove :file:`*.spec` from skeleton
- views: Fix reledit errors when trying modify relation with multi subjects

3.32.1 (2021-07-23)
===================
👷 Bug fixes
------------

- pin rdflib < 6.0.0 to avoid compatibility issues

🤖 Continuous integration
-------------------------

- use image from heptapod registry since r.intra was shut down

3.32.0 (2021-07-13)
===================

🔒 Security, breaking changes
-----------------------------

Protection against XSS
^^^^^^^^^^^^^^^^^^^^^^

:file:`self.w` API has been changed to automatically escape arguments used to format the string to mitigate XSS attacks.

This means that instead of writing:

.. code:: python

    self.w("some %s string %s" % (a, b))

You need to write:

.. code:: python

    self.w("some %s string %s", a, b)

And CubicWeb will escape all arguments given to :file:`self.w` which are :file:`a` and :file:`b` here.

If for a specific reason (for example generating javascript) you don't want to escape the arguments of :file:`self.w` you can use the :file:`escape` kwarg argument of :file:`self.w` like this:

.. code:: python

    self.w("some %s string %s", a, b, escape=False)

This is normally retrocompatible since :file:`self.w` old API with only one argument still works (but you **shouldn't** use it anymore) but if you have been giving a custom function as :file:`self.w` you'll need to adapt the API of this function to match :file:`self.w` new API which is:

.. code:: python

    def w(self, string, *args, **kwargs, escape=False): ...

Also note that :file:`UStringIO.write` function has also been modified to be compatible with :file:`self.w` new API (so if you are using it you won't need to port this code).

CSRF protection
^^^^^^^^^^^^^^^

A CSRF protection mechanism has been integrated in CubicWeb using Pyramid CSRF built-in protection. Regarding breaking changes:

- Cubicweb now **only works with pyramid**
- if you are only using cubicweb "web" without ajax and you have been doing advanced modification at the session management level this shouldn't break anything for you
- if you are doing POST/PUT/DELETE... requests using AJAX, you need to adapt your code to send the csrf_token otherwise all you requests will be denied. This is explained in the AJAX section of the documentation: :ref:`csrf_protection`

The whole mechanism is explained in the documentation: :ref:`csrf_protection`

🚧 Other breaking changes
-------------------------

We decided to stop releasing cubicweb as debian packages that we used on multi-purpose servers in favor of docker images that we run with docker-compose or on kubernetes. Thanks for all the fishes.

🎉 New features
---------------

- add a component to disable RQL suggestions: :file:`cubicweb.web.views.magicsearch.RQLNoSuggestionsBuilder`

👷 Bug fixes
------------

- [reledit] `display reledit for a relation if some conditions are satisfied <3.32_reledit>`_ ([1] the relation don't have rqlexpr permissions and can be deleted [2] at least one of related entites can be deleted)
- pyramid/predicates: avoid to show an error without a session connection
- be sure db-statement-timeout is not None
- correctly transform cubicweb.web.RemoteCallFailed into pyramid corresponding exceptions, this allow to propagate the correct content type (for example for json exceptions)
- "cubicweb-ctl list" now supports multiple dependencies constraints

🤷 Various changes
------------------

- fix error cases when internationalizable is not defined on rdef
- improve docstring in web.views.basecontrollers

🤖 Continuous integration
-------------------------

- coverage: gitlab-ci is able to read the coverage report we produce
- disable from-forge for now since we aren't using them
- fix path to coverage-\*.xml for non-reports artifacts
- flake8: integrate flake8-gl-codeclimate for QA reports
- integrate junit reports style for tests errors in gitlab
- optimisation: allow to interrupt started jobs that can be replaced
- pytest-html: generate self contained html file for easier test repport browsing
- trigger py3-* jobs on tox.ini/.gitlab-ci.yml/requirements modifications
- use gitlab readthedocs integration

📋 Developer experience
-----------------------

- using black on the whole project \o/ (thx for hg format-source)
- debug/ux: display traceback of stderr when exception in addition of the html page
- testing: activate debug mode during testing
- ux: display on stdout the requests made to the server like nginx
- ux: display traceback on stderr on request failure
- ux: logger.info for selected view by ViewController
