3.33.13 (2022-03-09)
====================
👷 Bug fixes
------------

- avoid excaping cubicweb:loadurl's value twice (to `#523 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/523>`_)
- don't escape whole key="value" attributes in TreeViewItemView (to `#523 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/523>`_)
- escape URLs passed as href attributes (to `#523 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/523>`_)

3.33.12 (2021-12-01)
====================
👷 Bug fixes
------------

- server: correct RQL generation when we have function in ``ORDERBY`` (`#466 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/466>`_)

3.33.11 (2021-11-17)
====================
👷 Bug fixes
------------

- pkg: pin Yams version < 0.46.0

3.33.10 (2021-11-17)
====================

- Removed allowed-http-host-headers configuration (which was a breaking change),
  since we don't have this vulnerability in CubicWeb.

Various changes
---------------

- depend on sphinx >= 4.3


3.33.9 (2021-11-08)
===================
👷 Bug fixes
------------

- views: remove an abusive escape (`#457 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/457>`_)

3.33.8 (2021-11-02)
===================
👷 Bug fixes
------------

- build_doc: docutils version 0.18.0 breaks doc building (`#443 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/443>`_)
- pkg: don't use pyparsing 3 since it's not compatible with rdflib 5 (`#441 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/441>`_)
- pkg: pin pyramid_multiauth version to avoid compatibility issue with Pyramid 1 (`#450 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/450>`_)

3.33.7 (2021-10-12)
===================
👷 Bug fixes
------------

- ldap: upgrade to ldap3 (datetime, encode fix)
- csrf: ensure that we have a csrf token returned on every requests

3.33.6 (2021-10-04)
===================
👷 Bug fixes
------------

- facet: remove abusive escaping in facets views. (`#394 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/394>`_)

3.33.5 (2021-09-29)
===================
👷 Bug fixes
------------

- backout "limit setuptools version to avoid issue with 2to3"
- use our package rdflib-jsonld-without-2to3, this is a fork of
  rdflib-jsonld with 2to3 usage removed, but which still
  contains the whole package code unlike rdflib-jsonld 0.6.x.
- reledit: Do not retrieve a list of schemata with _compute_ttypes

3.33.4 (2021-09-24)
===================

- don’t escape value in navigation components (`#389 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/389>`_)
- views: remove unneeded xml_escape for primary titles
- setup: keep rdflib-jsonld at version < 0.6.0
- setup: limit setuptools version to avoid issue with 2to3

3.33.3 (2021-09-14)
===================

- upgrade rdflib-jsonld version to keep compatibility with setupools
  58 and above

👷 Bug fixes
------------

- startup: Fix RQL query to take advantage of caching (`#384 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/384>`_)

3.33.2 (2021-09-02)
===================
📝 Documentation
----------------

- tuto: Fix path

3.33.1 (2021-08-31)
===================
🎉 New features
---------------

- allowed-http-host-headers: automatically add default hostname to the allowed list on debug mode
- req: Add a "limit" parameter to RequestSessionBase.find
- req: Add exists for optimized search of at least one entity
- ux: better error message when a controller can't be select

👷 Bug fixes
------------

- fyzz dep was missing for running certain tests
- only fyzz 0.2.2 is compatible with python 3
- typo: fix some mispellings

📝 Documentation
----------------

- fix allowed-http-host-header label and quote from Django's doc

🤖 Continuous integration
-------------------------

- integrate can-i-merge

🤷 Various changes
------------------

- 3.33: improve changelog quality
- fix(bwcompat)!: return a 400 instead of a 401 when failed to select a controller
- fix: allowed-http-host-headers has been released in 3.33 actually
- misc: fix rst syntax

3.33.0 (2021-08-03)
===================
🎉 New features
---------------

- BREAKING security: introduce allowed-http-host-header against host attack
  (However, this is backed out in 3.33.10).
- add postgresql extra requires
- config: add 'debug' option in "[main]" of all-in-one.conf that does the same thing than "-D" in "cubicweb-ctl pyramid"
- `rich <https://github.com/willmcgugan/rich/>`: to have nicer tracebacks,
  `use rich.traceback <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/348>`
  (`removed in 3.34 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/434#note_93131>`)

👷 Bug fixes
------------

- add default value for params argument in pyramid webtest post function (`#350 <https://forge.extranet.logilab.fr/cubicweb/cubicweb/-/issues/350>`_)
- csrf: give CSRF token when using /ajax route
- empty identification cookie on webapp.reset()
- pin rdflib < 6.0.0 to avoid compatibility issues
- rdf: graph.serialize needs to encode its content in utf-8
- security: change configuration [WEB]interface default value to 127.0.0.1
- views: Fix reledit errors when trying modify relation with multi subjects

🤖 Continuous integration
-------------------------

- use image from heptapod registry since r.intra was shut down

🤷 Various changes
------------------

- use open-source/gitlab-ci-templates in cube skeleton
- drop mention of MySQL and SQLServer support
- update cube installation procedure documentation
- remove :file:`*.spec` from skeleton
