Security

• Update Django from 5.2.7 to 5.2.9 which contains patches for CVE-2025-64459, CVE-2025-64458, CVE-2025-13372 and CVE-2025-64460
• Update node_modules/js-yaml from 4.1.0 to 4.1.1

Improvements

• Update bleach from 6.2.0 to 6.3.0
• Update django-grappelli from 4.0.2 to 4.0.3. Fixes Issue #4119
• Update django-tree-queries from 0.21.2 to 0.23.0
• Update markdown from 3.9 to 3.10
• Update psycopg[binary] from 3.2.11 to 3.3.1
• Update python-gitlab from 6.5.0 to 7.0.0
• Add new toolbar menu item on TestRun page, which opens the Execution Dashboard page with executions from the current TestRun. Closes Issue #4084
• Display TestCase ID on Execution Dashboard page
• Display Priority & Automated columns in Execution Dashboard page

API

• Add BugTracker.create() API method
• Add BugTracker.filter() API method
• Add Priority.create() API method
• Add Severity.create() API method
• Add Severity.filter() API method
• Add Tag.create() API method
• Add Template.create() API method
• Add Template.filter() API method
• Add TestCaseStatus.create() API method
• Add TestExecutionStatus.create() API method

Refactoring and testing

• Update actions/checkout from 5 to 6
• Update actions/upload-artifact from 4 to 5
• Update black from 25.9.0 to 25.11.0
• Update locust from 2.42.0 to 2.42.6
• Update sphinx from 8.2.3 to 9.0.4
• Update node_modules/webpack from 5.102.1 to 5.103.0
• Update password reset URL format to match latest in Django 5.2
• Add end-to-end test for password reset functionality
• Remove redundant _fixture_setup() definition

Translations

• Updated Chinese Simplified translation
• Updated Indonesian translation
• Updated Japanese translation
• Updated Polish translation
• Updated Russian translation

Security

• Update Django from 5.2.6 to 5.2.7, addressing one security vulnerability with severity “high” and one security vulnerability with severity “low”: CVE-2025-59681 and CVE-2025-59682

Improvements

• Update jira from 3.8.0 to 3.10.5
• Update psycopg[binary] from 3.2.10 to 3.2.11
• Update python-gitlab from 6.3.0 to 6.5.0
• Update uwsgi from 2.0.30 to 2.0.31
• Display records count in TestPlan page. Fixes Issue #4110
• Add 'Deactivate selected accounts' dropdown on /admin/auth/user/ page
• Add 'Deactivate' button in 'Change user' admin page

API

• Add User.deactivate() API method
• Update documentation and tests for User.filter() method
• Add new internal signal USER_DEACTIVATED_SIGNAL. Sent when account is deactivated

Refactoring and testing

• Update actions/setup-node from 5 to 6
• Update github/codeql-action from 3 to 4
• Update isort from 6.0.1 to 6.1.0
• Update locust from 2.34.1 to 2.42.0
• Update node_modules/webpack from 5.101.3 to 5.102.1
• Pin intermediate dependency Pillow to 11.3.0 to fix failing container build
• Define a login_form template block in login.html
• Update Bitbucket repository URL b/c the original repository has reached a limit of 10k issues and new ones cannot be created anymore
• Add login tests for disabled accounts via browser
• Add tests for API login and method calls from deactivated accounts
• Collect logs from Postgres container during testing

Translations

• Updated Japanese translation

Improvements

• Update Django from 5.1.11 to 5.2.6
• Update django-guardian from 3.0.3 to 3.2.0
• Update django-tree-queries from 0.20.0 to 0.21.2
• Update markdown from 3.8.2 to 3.9
• Update psycopg[binary] from 3.2.9 to 3.2.10
• Update pygithub from 2.6.1 to 2.8.1
• Update python-gitlab from 6.1.0 to 6.3.0
• Support access key authentication for Redmine issue tracker integration (Makson Lee)
• Rename navbar item PLUGINS -> MORE
• Send email notifications when a TestCase is created. Fixes Issue #4058
• Add Cancel button for "New TestCase" & "Edit TestCase" pages. Fixes Issue #4073
• Display number of records found on Search pages. Fixes Issue #3324
• Start keeping track of history for Product, Version and Build records

Database

• WARNING: Postgres 13 is no longer supported. Minimum version is 14!
• New migration management.0011_history_for_product_version_build
• IMPORTANT: For existing Kiwi TCMS installations history will be generated as soon as these objects are changed

Bug fixes

• Correct a typo. Fixes Issue #4072
• Avoid broader matches when searching for harmful HTML attributes in uploaded files. Fixes Issue #4074
• Send a POST request when clicking Logout menu while on Admin page. Fixes Issue #4005

Refactoring and testing

• Update actions/checkout from 4 to 5
• Update actions/setup-node from 4 to 5
• Update actions/setup-python from 5 to 6
• Update github.com/pre-commit/pre-commit-hooks from v5.0.0 to v6.0.0
• Update psf/black from 25.1.0 to 25.9.0
• Update black from 25.1.0 to 25.9.0
• Update node_modules/webpack from 5.99.9 to 5.101.3
• Adjust API tests for Django 5.2
• Add test for Issue #4074
• Add logout tests via browser for Issue #4005

Translations

• Updated Chinese Simplified translation
• Updated Japanese translation
• Updated Polish translation
• Updated Portuguese, Brazilian translation
• Updated Russian translation
• Updated Spanish translation
• Updated Spanish, Argentina translation
• Updated Spanish, Uruguay translation

tcms-api v15.0

• Include host URL in Referer header
• Updates for newer pylint
• Updates for newer Sphynx
• Update GitHub actions

kiwitcms-junit.xml-plugin v15.0

• Update junitparser from 3.1.0 to 3.2.0
• Drop official support for Python 3.8

Security

• Update Django from 5.1.8 to 5.1.11, addressing medium severity vulnerabilities, CVE-2025-32873 and CVE-2025-48432, which do not appear to affect Kiwi TCMS

Improvements

• Remove the django-uuslug dependency
• Update django-colorfield from 0.13.0 to 0.14.0
• Update django-grappelli from 4.0.1 to 4.0.2
• Update django-guardian from 2.4.0 to 3.0.3
• Update django-simple-history from 3.8.0 to 3.10.1
• Update django-tree-queries from 0.19.0 to 0.20.0
• Update markdown from 3.8 to 3.8.2
• Update psycopg[binary] from 3.2.6 to 3.2.9
• Update pygments from 2.19.1 to 2.19.2
• Update python-gitlab from 5.6.0 to 6.1.0
• Update uwsgi from 2.0.29 to 2.0.30
• Update node_modules/pdfmake from 0.2.18 to 0.2.20
• Display nested Test Plan(s) in select drop-down on New Test Run page
• Implement Bugzilla.details() method to fetch more information about reported bugs via the existing Bugzilla integration interface
• Refactor URL /accounts/<username>/profile/ into /accounts/<pk>/profile/ to prevent usernames being exposed in logs or anonymous analytics
• Refactor URL /plan/<pk>/<slug> into /plan/<pk>/ to prevent test plan summary being exposed in logs or anonymous analytics. Fixes Issue #3994

Bug fixes

• Make sure IssueTrackerType.details() method provides id and status fields to prevent crashes when IssueTracker integration falls back to this method
• For Bug.details() API method always cast internal result to dict to avoid the situation where modernrpc/handlers/xmlhandler.py::dumps_result() doesn't know how to serialize that! Fixes Sentry KIWI-TCMS-VV
• Don't send email notifications to inactive users

Refactoring and testing

• Update node_modules/eslint-plugin-import from 2.31.0 to 2.32.0
• Update node_modules/webpack from 5.99.6 to 5.99.9
• Use the public interface tcms_api.TCMS().exec in tests
• Add test for unauthenticated Bugzilla.details() which falls back to OpenGraph

Translations

• Updated Chinese Simplified translation
• Updated Chinese Traditional translation
• Updated Persian translation

Security

• Update Django from 5.1.7 to 5.1.8 addressing a moderate severity denial-of-service vulnerability, CVE-2025-27556, which may be affecting Kiwi TCMS instances running natively on Windows

Improvements

• Update django-attachments from 1.11 to 1.12
• Update django-colorfield from 0.12.0 to 0.13.0
• Update django-extensions from 3.2.3 to 4.1
• Update markdown from 3.7 to 3.8
• Update psycopg from 3.2.5 to 3.2.6
• Update tzdata from 2025.1 to 2025.2
• Update uwsgi from 2.0.28 to 2.0.29
• On Execution Dashboard page add Product & Components columns (Oskar Hurst, USACE)
• Remove duplicate IDs to minimize size of SQL WHERE clause for API calls on Execution Dashboard page
• Remove code which was generating /Kiwi/uploads/installation-id. This file was never used and is not needed

Refactoring and testing

• Update node_modules/webpack from 5.98.0 to 5.99.6
• Update fedora from 41 to 42 in tests/bugzilla/Dockerfile
• Pin the version of Locust to avoid accidental failures
• Replace custom function with django.utils

Translations

• Updated Korean translation
• Updates Ukrainian translation

Security

• Update Django from 5.1.6 to 5.1.7 addressing a medium severity denial-of-service vulnerability, CVE-2025-26699, which does not appear to affect Kiwi TCMS

Improvements

• Update django-simple-captcha from 0.6.1 to 0.6.2
• Update psycopg from 3.2.4 to 3.2.5
• Update pygithub from 2.5.0 to 2.6.1
• Enable search functionality on Tag Admin page (Jurijs Ješkins). Fixes Issue #3739
• After cloning a TestCase load its Edit page. (Martin Bodurov)
• Add Search Test Executions item under SEARCH menu in navigation bar
• Display Default tester field on Search Test Cases page
• Display Default tester fields on Execution Dashboard page. Closes Issue #3766
• On TestRun view page display TestExecution history diff only when user accessing the page has the testruns.view_historicaltestexecution permission. Otherwise it will not be shown
• Display Last Bug ID - Status widget for each TestExecution row on TestRun view page. Closes Issue #3748
• Allow user to exclude Product condition on Search Test Cases page
• Update references to Kiwi TCMS container images across our code base, documentation and website as we may change hosting providers soon
• Update performance results documentation
• Document results for parallel user session performance. Closes Issue #721

API

• Method TestExecution.history() is now controlled by the more granular testruns.view_historicaltestexecution permission instead of the generic testruns.view_testexecution

Refactoring and testing

• Update isort from 6.0.0 to 6.0.1
• Update sphinx from 8.1.3 to 8.2.3
• Update node_modules/webpack from 5.97.1 to 5.98.0
• Remove eslint-plugin-promise as a direct dependency
• Remove duplicate field history_change_reason from ORM query
• Refactor code which displays the red bug icon in TestRun view page

Translations

• Updated Albanian translation
• Updated Korean translation
• Updated Portuguese, Brazilian translation

Security

• Update node_modules/cross-spawn from 7.0.3 to 7.0.6 to resolve a regular expression denial of service (ReDoS) vulnerability, CVE-2024-21538
• Update node_modules/semver from 6.3.0 to 6.3.1 to resolve a regular expression denial of service (ReDoS) vulnerability, CVE-2022-25883
• Note that these are indirect dependencies of Kiwi TCMS, in particular pulled in via some of our developer tools, eslint and webpack, and the risk to existing Kiwi TCMS installations is minimal if at all!

Improvements

• Update Django from 5.0.10 to 5.1.6
• Update django-colorfield from 0.11.0 to 0.12.0
• Update django-modern-rpc from 1.0.3 to 1.1.0
• Update django-simple-captcha from 0.6.0 to 0.6.1
• Update django-simple-history from 3.7.0 to 3.8.0
• Update mysqlclient from 2.2.6 to 2.2.7
• Update psycopg[binary] from 3.2.3 to 3.2.4
• Update pygments from 2.18.0 to 2.19.1
• Update python-gitlab from 5.1.0 to 5.6.0
• Update tzdata from 2024.2 to 2025.1
• Update Node.js runtime from v16 to v22
• Update node_modules/pdfmake from 0.2.15 to 0.2.18
• Add Scarf.sh pixel - open source analytics

Database

• WARNING: Postgres 12 is no longer supported. Minimum version is 13!
• Remove index_together from historical migrations

Settings

• WARNING: the DEFAULT_FILE_STORAGE and STATICFILES_STORAGE settings have been removed!
• Explicitly define the STORAGES setting

Refactoring and testing

• Update black from 24.10.0 to 25.1.0
• Update isort from 5.13.2 to 6.0.0
• Update node_modules/webpack from 5.97.0 to 5.97.1
• Update node_modules/webpack-cli from 5.1.4 to 6.0.1
• Refactor request_contents_processor() to expose only data we use which sometimes lead to traceback recursion when rendering templates!
• Similate an API write performance test with Locust. References Issue #721
• Simulate a web performance test with Locust + Playwright. References Issue #721. Execution frequencies are informed by our Plausible.io stats

Translations

• Updated Chinese Simplified translation
• Updated Hungarian translation

Security

• Update Django from 5.0.9 to 5.0.10, addressing one security issue with severity “high” and one security issue with severity “moderate” which do not appear to affect Kiwi TCMS.

Improvements

• Update bleach from 6.1.0 to 6.2.0
• Update mysqlclient from 2.2.4 to 2.2.6
• Update pygithub from 2.4.0 to 2.5.0
• Update python-gitlab from 4.13.0 to 5.1.0
• Update uwsgi from 2.0.27 to 2.0.28
• Update node_modules/pdfmake from 0.2.14 to 0.2.15
• Speed-up TestCase filtering on the TestPlan view page
• Speed-up TestExecution filtering on TestRun view page

API

• Method Bug.details() will now return the additional fields id, status and url! References Issue #3748

Bug fixes

• Remove internal IssueTrackerType.rpc_cache attribute. Fixes Issue #3757
• Update filtering logic for Automated=False on TestPlan view page. Fixes Issue #3841
• Refresh test execution counter when filtering on TestRun view page

Refactoring and testing

• Update action psf/black from 24.8.0 to 24.10.0
• Update action codecov/codecov-action from 4 to 5
• Update selenium from 4.25.0 to 4.27.1
• Update sphinx from 8.1.1 to 8.1.3
• Update node_modules/webpack from 5.95.0 to 5.97.0
• Update fedora from 40 to 41 in /tests/bugzilla
• Update redmine from 5 to 6 in /tests/redmine

Translations

• New Ukrainian translation (Oleksandr Nemchenko)

Security

• Update Django from 5.0.8 to 5.0.9, addressing multiple potential security vulnerabilities, which do not seem to affect Kiwi TCMS directly however this is not 100% guaranteed

Improvements

• Update markdown from 3.6 to 3.7
• Update psycopg from 3.2.1 to 3.2.3
• Update pygithub from 2.3.0 to 2.4.0
• Update python-bugzilla from 3.2.0 to 3.3.0
• Update python-gitlab from 4.9.0 to 4.13.0
• Update tzdata from 2024.1 to 2024.2
• Update uwsgi from 2.0.26 to 2.0.27
• Update node_modules/pdfmake from 0.2.10 to 0.2.14
• Specify large_client_header_buffers for NGINX proxy configuration example to match the configuration of Kiwi TCMS
• Set uWSGI configuration max-requests to 1024

Settings

• Explicitly set DATA_UPLOAD_MAX_NUMBER_FIELDS to 1024, default is 1000

Bug fixes

• Increase uWSGI configuration buffer-size to 20k to allows the creation of a TestRun with 1000 test cases! Fixes Issue #3387, Issue #3800

Refactoring and testing

• Update black from 24.8.0 to 24.10.0
• Update pylint-django from 2.5.5 to 2.6.1
• Update selenium from 4.23.1 to 4.25.0
• Update sphinx from 8.0.2 to 8.1.1
• Update node_modules/webpack from 5.93.0 to 5.95.0
• Update node_modules/eslint from 8.57.0 to 8.57.1
• Update node_modules/eslint-plugin-import from 2.29.1 to 2.31.0
• Assert that password reset email contains username reminder
• Update translation source strings

Security

• Update Django from 4.2.13 to 5.0.8, addressing multiple potential security vulnerabilities, which do not seem to affect Kiwi TCMS directly however this is not 100% guaranteed

Improvements

• Update psycopg from 3.1.19 to 3.2.1
• Update python-gitlab from 4.6.0 to 4.9.0
• Add a Test Plan + button on New Test Run page. Related to Issue #3680
• Always show the Build + button on New Test Run page. Related to Issue #3680
• Add a Product + button on New Test Run page. Closes Issue #3680
• Add auto-complete for Parent ID field on Edit TestPlan page. Closes Issue #3189

API

• Add TestRun.remove() API method. Fixes Issue #3691

Bug fixes

• Do not call TestExecution.remove_link() on TestRun page with undefined argument (@Melzmann). Fixes Issue #3728 where URLs attached to a test execution suddenly go missing after some time
• On New Test Run page when Product is updated trigger TestPlan on-change to fix a bug where the Build drop-down is not cleared and may be showing values which are invalid for the current selection
• Adjust angle bracket icon direction when viewing nested testplans. Fixes Issue #3163
• Strip newline characters from email subjects to avoid crashes. Fixes Sentry KIWI-TCMS-P7

Refactoring and testing

• Update black from 24.4.2 to 24.8.0
• Update selenium from 4.21.0 to 4.23.1
• Update sphinx from 7.4.7 to 8.0.2
• Update node_modules/webpack from 5.92.0 to 5.93.0
• Update node_modules/eslint-plugin-promise from 6.2.0 to 6.6.0
• Modify test case to include newline characters in TestCase summary

Other

• EthicalAds is a GDPR-compliant ad network for devs which doesn't use cookies, and displays only dev-focused ads. Will be displayed on free-beer releases and the demo version hosted at public.tenant.kiwitcms.org

Translations

• Updated Korean translation
• Updated Portuguese, Brazilian translation

Improvements

• Update Django from 4.2.12 to 4.2.13
• Update django-simple-history from 3.5.0 to 3.7.0
• Update python-gitlab from 4.5.0 to 4.6.0
• Update uwsgi from 2.0.25.1 to 2.0.26
• Update node_modules/html5sortable from 0.13.3 to 0.14.0
• Remove cron job for anonymous analytics
• Remove anonymous analytics from /admin/ pages
• Replace inline HTML attributes with CSS classes
• Make it possible for Kiwi TCMS plugins to provide markdown extensions

Refactoring

• Remove django-debug-toolbar as a development dependency
• Update node_modules/eslint-plugin-promise from 6.1.1 to 6.2.0
• Update node_modules/webpack from 5.91.0 to 5.92.0

Translations

• Updated Chinese Traditional translation
• Updated Korean translation

Improvements

• Update Django from 4.2.11 to 4.2.12
• Update psycopg from 3.1.18 to 3.1.19
• Update PyGithub from 1.58.2 to 2.3.0
• Update pygments from 2.17.2 to 2.18.0
• Update python-gitlab from 4.4.0 to 4.5.0
• Replace more inline style= HTML attributes with CSS classes

Bug fixes

• Truncate TestCase.text length for Jira 1-click bug reports to avoid 400, 414 and/or 500 errors! Text will be truncated to 30k chars for automated POST requests and 6k chars for fallback GET requests to fit inside Jira limitations

Refactoring and testing

• Remove double slash in Jira fallback URL
• Stop using the Github(login_or_token) argument b/c it is deprecated
• Update selenium from 4.20.0 to 4.21.0

Translations

• Updated Chinese Simplified translation
• Updated Chinese Traditional translation

Improvements

• Update Django from 4.2.10 to 4.2.11
• Update django-grappelli from 3.0.8 to 4.0.1
• Update django-modern-rpc from 1.0.2 to 1.0.3
• Update django-tree-queries from 0.16.1 to 0.19.0
• Update jira from 3.6.0 to 3.8.0
• Update markdown from 3.5.2 to 3.6
• Update python-redmine from 2.4.0 to 2.5.0
• Update uwsgi from 2.0.24 to 2.0.25.1
• Update node_modules/pdfmake from 0.2.9 to 0.2.10
• Update node_modules/es5-ext from 0.10.62 to 0.10.63
• Update documentation with better installation instructions when using Docker
• Remove multiple inline style= HTML attributes

Settings

• Don't send outgoing emails to addresses which fail validation, including custom validation configured via the EMAIL_VALIDATORS setting. For example if there are blacklisted addresses Kiwi TCMS will not send messages to them anymore

Refactoring and testing

• Update black from 23.12.1 to 24.4.2
• Update selenium from 4.9.1 to 4.20.0
• Update node_modules/eslint from 8.56.0 to 8.57.0
• Update nodemodules/webpack from 5.90.3 to 5.91.0
• Remove unused has_permissions_to_modify()
• Do not execute Docker image tests as root
• Add tests for file upload via browser UI

Translations

• Updated Albanian translation
• Updated Korean translation
• Updated Portuguese, Brazilian translation
• Updated Turkish translation

Bug fixes

• Downgrade node_modules/datatables.net-buttons from 3.0.0 to 2.4.3. Fixes Issue #3552

Refactoring

• Use max() built-in function instead of an if block

Improvements

• Update django from 4.2.9 to 4.2.10
• Update django-simple-history from 3.4.0 to 3.5.0
• Update mysqlclient from 2.2.1 to 2.2.4
• Update psycopg from 3.1.17 to 3.1.18
• Update tzdata from 2023.4 to 2024.1
• Update uwsgi from 2.0.23 to 2.0.24
• Update node_modules/datatables.net-buttons from 2.4.2 to 3.0.0
• Add robots.txt file to tell various robots to stop probing Kiwi TCMS
• Resolve the path /favicon.ico because some browsers still search for it
• Send Referer: header for container HEALTHCHECK command in order to make NGINX logs more readable
• Allow users to reset their email by asking them to confirm their new address. Fixes Issue #3211
• Add support for custom email validators on the registration page
• Move X-Frame-Options header definition into settings
• Move X-Content-Type-Options header definition into settings
• Enable anonymous analytics, see here

Settings

• New settings ANONYMOUS_ANALYTICS and PLAUSIBLE_DOMAIN control anonymous analytics
• New setting EMAIL_VALIDATORS for custom email validation during registration
• Add the following settings in order to document them - CSRF_COOKIE_AGE, CSRF_COOKIE_HTTPONLY, SESSION_COOKIE_HTTPONLY, CSRF_COOKIE_SECURE and SESSION_COOKIE_SECURE. Most likely you don't need to change their values
• Respect X_FRAME_OPTIONS setting, defaults to DENY
• Respect SECURE_CONTENT_TYPE_NOSNIFF setting, defaults to nosniff
• Configure SECURE_SSL_REDIRECT setting to True

API

• New method TestExecution.remove() which should be used in favor of TestRun.remove_case()

Bug fixes

• Fix a bug where non-distinct values made it into generated property matrix
• On TestRun page allow removal of individual parameterized TestExecution(s). Closes Pull #3282

Refactoring and testing

• Update codecov/codecov-action from 3 to 4
• Update node_modules/webpack from 5.89.0 to 5.90.3
• Update runner image for CircleCI
• Fix failure in test_utf8_uploads on CircleCI
• Several improvements around performance benchmark tests
• Refactor RegistrationForm.clean_email() using field validator function
• Add tests for test matrix generation functionality

Security

• Preventatively patch calls to the built-in xmlrpc.client module using the defusedxml package

Improvements

• Update container runtime from Python 3.9 to Python 3.11
• Update Django from 4.2.7 to 4.2.9
• Update django-colorfield from 0.10.1 to 0.11.0
• Update django-modern-rpc from 0.12.1 to 1.0.2
• Update django-tree-queries from 0.15.0 to 0.16.1
• Update django-simple-captcha from 0.5.20 to 0.6.0
• Update jira from 3.5.2 to 3.6.0
• Update markdown from 3.5.1 to 3.5.2
• Update mysqlclient from 2.2.0 to 2.2.1
• Update psycopg from 2.9.9 to 3.1.17
• Update python-gitlab from 4.1.1 to 4.4.0
• Update tzdata from 2023.3 to 2023.4
• Update node_modules/pdfmake from 0.2.8 to 0.2.9
• Show an icon when some child TPs not shown on Search Test Plans page to let the user know that parent-child hierarchies shown on the page may be incomplete because the data has been filtered out by their search criteria. Closes Issue #3313
• Hide the Expand/Collapse button Search Test Plans page for TP with 0 children in the result set

Settings

WARNING:

The location of the Python runtime inside the container has changed. This affects settings override files as well as any downstream customizations to the Kiwi TCMS container image! For example you may have to adjust Docker volumes like so:

         volumes:
-            - ./local_settings.py:/venv/lib64/python3.9/site-packages/tcms/settings/local_settings.py
+            - ./local_settings.py:/venv/lib64/python3.11/site-packages/tcms/settings/local_settings.py

• Explicitly define the DATA_UPLOAD_MAX_MEMORY_SIZE setting. It controls file uploads via RPC, not webUI, because the payload is base64 encoded and is part of the request body. Closes Issue #3262

API

WARNING:

This version of Kiwi TCMS introduces backward incompatible changes to API methods

• Method TestRun.filter() no longer returns the field plan__product
• Method TestRun.filter() no longer returns the field plan__product_version
• Method TestRun.filter() no longer returns the field plan__product_version__value
• Method TestRun.filter() now returns the new field build__version
• Method TestRun.filter() now returns the new field build__version__product
• Method TestRun.filter() now returns the new field build__version__value

Bug fixes

• Fix TestPlan cloning with different product (@somenewacc)
• Fix row reload when adding new comment in TestRun page (@somenewacc)
• Fix tag display for parametrized executions on TestRun page (@somenewacc)
• Fix bug in search/display of Version on Search TestRun page. The root cause was that the correct relationship here should have been TR -> Build -> Version which is independent of the relationship TP -> Product -> Version. Fixes Issue #3258
• Fix bug in search/display of Product on Search TestRun page. The root cause was that the correct relationship here should have been TR -> Build -> Version -> Product which is independent of the relationship TP -> Product
• Fix Telemetry pages to query Product/Version from execution's data. All of these underlying queries on these pages operate on TestExecution and Product/Version information should be matched against what is stored in TestExecution->Build because it is more accurate over time, while TE->TR->TP->Product/Version is more likely to change as test plan documents evolve
• Adjust Product & Version display on TestRun page using the relationship TR->Build as the starting point
• For IssueTracker integration use Product/Version from execution.build Note that execution.build is initialized with run.build and then may change its value if we're recording results against multiple builds inside the same TestRun. For example mark some executions as PASS, others as FAIL; then update TR to a newer Build; retest and mark the FAIL results as PASS. Using the value of execution.build is more accurate
• Treat the file /Kiwi/etc/uwsgi.override as an ini file and load it if it exists. This means that any override files must include the [uwsgi] section as well

Refactoring and testing

• Adjust Kiwi TCMS for newer version of django-modern-rpc (Antoine Lorence)
• Remove commented out code (@deepsource-autofix[bot])
• Add integration test for uploading files with maximum allowed size
• Update isort from 5.12.0 to 5.13.2
• Update node_modules/eslint from 8.54.0 to 8.56.0
• Update node_modules/eslint-plugin-import from 2.29.0 to 2.29.1
• Update node_modules/eslint-plugin-n from 16.3.1 to 16.6.2
• Update actions/setup-python from 4 to 5
• Update github/codeql-action from 2 to 3
• Update actions/upload-artifact from 3 to 4

Translations

• Updated Chinese Simplified translation
• Updated Japanese translation

Security

• Update django from 4.2.4 to 4.2.7. Fixes CVE-2023-46695, CVE-2023-43665 and CVE-2023-41164
• Update django-simple-captcha from 0.5.18 to 0.5.20
• We believe that none of these issue affect Kiwi TCMS directly however we recommend that you upgrade your installation as soon as possible

Improvements

• Update bleach from 6.0.0 to 6.1.0
• Update django-colorfield from 0.9.0 to 0.10.1
• Update django-grappelli from 3.0.6 to 3.0.8
• Update django-simple-history from 3.3.0 to 3.4.0
• Update markdown from 3.4.4 to 3.5.1
• Update psycopg2 from 2.9.7 to 2.9.9
• Update pygments from 2.16.1 to 2.17.2
• Update python-gitlab from 3.15.0 to 4.1.1
• Update uwsgi from 2.0.22 to 2.0.23
• Update node_modules/crypto-js from 4.1.1 to 4.2.0
• Update node_modules/datatables.net-buttons from 2.4.1 to 2.4.2
• Update node_modules/pdfmake from 0.2.7 to 0.2.8
• Update bug-tracker integration documentation with specifics about matches for product name
• When searching for JIRA projects try also matching by project key
• Fall-back to credentials from database if settings.EXTERNAL_ISSUE_RPC_CREDENTIALS override returns None

Database

• New migrations after upgrading django-color-field. Increases field max_length from 18 to 25

Bug fixes

• Fix error in filtering by TestRun ID on TestCase Search page (@somenewacc)
• Fix TestRun page to not automatically update its stop_date when marking statuses for test executions if there are more neutral executions left on the page outside of the currently filtered selection (@somenewacc)
• Fix bug with JIRA integration not being able to find project via name

Refactoring and testing

• Refactor calls to delete expandedExecutionIds to satisfy https://rules.sonarsource.com/typescript/RSPEC-2870/ (@somenewacc)
• Refactor calls to delete expandedTestCaseIds to satisfy https://rules.sonarsource.com/typescript/RSPEC-2870/
• Use tuple as the cache-key for IssueTrackerType.rpc_cache internally
• Add test for collectstatic because of an upstream issue with django-grappelli
• Improve tests for JIRA integration
• Test against Bugzilla on Fedora 39
• Update actions/checkout from 3 to 4
• Update node_modules/eslint from 8.48.0 to 8.54.0
• Update node_modules/eslint-plugin-import from 2.28.1 to 2.29.0
• Update node_modules/eslint-plugin-n from 16.0.2 to 16.3.1
• Update node_modules/webpack from 5.88.2 to 5.89.0
• Update pylint-django from 2.5.3 to 2.5.5 and all of our custom linter rules

Improvements

• Update allpairspy from 2.5.0 to 2.5.1
• Update django from 4.2.3 to 4.2.4
• Update mysqlclient from 2.1.1 to 2.2.0
• Update uwsgi from 2.0.21 to 2.0.22
• Update pygments from 2.15.1 to 2.16.1
• Update psycopg2 from 2.9.6 to 2.9.7
• Update node_modules/datatables.net-buttons from 2.3.6 to 2.4.1
• Update node_modules/markdown from 3.4.3 to 3.4.4
• Update node_modules/word-wrap from 1.2.3 to 1.2.4
• Update documentation for JIRA integration
• Clarify the django-ses add-on mentioned in documentation
• Add a button to delete URLs from test executions. Fixes Issue #2936
• Show traceback info during IssueTracker health-check to make it easier to debug problems

API

• Define IssueTracker.rpc_credentials property to make it easier to override credentials for IssueTracker integrations

Settings

• Allow overriding IssueTrackerType.rpc_credentials via the EXTERNAL_ISSUE_RPC_CREDENTIALS setting

Bug fixes

• Hide all expanded child rows in TestPlan Search page. Fixes Issue #3245 (@somenewacc)
• Fix wrong query parameter on DASHBOARD page (@somenewacc)
• Fix template variable for form fields in search pages (@somenewacc)
• Prevent multiplication of callbacks for data tables (@somenewacc)
• Don't fail IssueTracker health-check if we didn't use OpenGraph
• Reorder items under SEARCH menu for consistency with items under the TESTING menu. Fixes Issue #3315

Refactoring and testing

• Update node_modules/eslint from 8.44.0 to 8.48.0
• Update node_modules/eslint-plugin-import from 2.27.5 to 2.28.1
• Update node_modules/eslint-plugin-n from 16.0.1 to 16.0.2
• Update node_modules/webpack from 5.88.1 to 5.88.2
• Fix exception when no history objects found in TestExecutionFactory
• Move append items to list definition
• Provide /usr/lib64/pkgconfig/mariadb.pc inside buildroot
• Remove unused translation string in ar_SA locale

Translations

• Updated Russian translation

Security

• Update django from 4.2.2 to 4.2.3. Fixes CVE-2023-36053 - ReDoS vulnerability
• Patch misconfigured HTTP headers allowing stored XSS execution. Fixes CVE-2023-36809
• Sanitize test plan name in tree_view_html() function to reduce the opportunity for exploiting stored XSS vulnerabilities
• Extend the list of file upload validators to reduce the opportunity for exploiting stored XSS vulnerabilities

Improvements

• Update django-colorfield from 0.8.0 to 0.9.0
• Update django-extensions from 3.2.1 to 3.2.3
• Update django-simple-captcha from 0.5.17 to 0.5.18
• Update django-tree-queries from 0.14.0 to 0.15.0
• Update jira from 3.5.1 to 3.5.2
• Update python-gitlab from 3.14.0 to 3.15.0
• Small update to HEALTHCHECK command in container
• Replace mysql with native mariadb commands for backup/restore

Refactoring and testing

• Update node_modules/eslint from 8.42.0 to 8.44.0
• Update node_modules/eslint-plugin-n from 16.0.0 to 16.0.1
• Update node_modules/webpack from 5.85.0 to 5.88.1
• Update node_modules/webpack-cli from 5.1.3 to 5.1.4
• Pin Selenium to 4.9.1 b/c of failures with 4.10.0
• Add configuration for testing with reverse proxy
• Assert that Nginx proxy doesn't strip response headers
• Assert on the number of Content-Type headers for attachments
• Update how we seed GitLab API token used for testing

Translations

• Updated Russian translation