<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom"><title>Apache Allura - release</title><link href="//allura.apache.org/" rel="alternate"></link><link href="//allura.apache.org/feeds/tag.release.atom.xml" rel="self"></link><id>//allura.apache.org/</id><updated>2023-11-06T00:00:00+00:00</updated><entry><title>Apache Allura 1.16.0 released with critical security fix</title><link href="//allura.apache.org/posts/2023-allura-1.16.0.html" rel="alternate"></link><published>2023-11-06T00:00:00+00:00</published><updated>2023-11-06T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2023-11-06:/posts/2023-allura-1.16.0.html</id><summary type="html">&lt;p&gt;Version 1.16.0 of Allura released with critical security fix&lt;/p&gt;</summary><content type="html">&lt;h4&gt;What's New?&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.16.0 has been released.  It has a critical security fix and also drops Python 3.7 support.&lt;/p&gt;
&lt;p&gt;For full details of all the changes and fixes, see the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES"&gt;CHANGES file&lt;/a&gt;. &lt;/p&gt;
&lt;h4&gt;Critical Security Fix&lt;/h4&gt;
&lt;p&gt;CVE-2023-46851 sensitive information exposure via import &lt;/p&gt;
&lt;p&gt;Severity: Critical&lt;br&gt;
Versions Affected: 1.0.1 through 1.15.0&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Description:&lt;/strong&gt;&lt;br&gt;
Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them.  Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Mitigation:&lt;/strong&gt;&lt;br&gt;
Users of Allura should upgrade to Allura 1.16.0 immediately.&lt;/p&gt;
&lt;p&gt;If you are unable to upgrade, set this in your .ini config file:&lt;/p&gt;
&lt;div class="highlight"&gt;&lt;pre&gt;&lt;span&gt;&lt;/span&gt;&lt;code&gt;disable_entry_points.allura.importers = forge-tracker, forge-discussion
&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;

&lt;p&gt;That same .ini setting is also recommend for users who want maximum security on their Allura instance and don't need those importers available.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Credit:&lt;/strong&gt;&lt;br&gt;
This issue was discovered by Stefan Schiller (Sonar)&lt;/p&gt;
&lt;h4&gt;Python 3.8 through 3.11 supported&lt;/h4&gt;
&lt;p&gt;This release drops support for Python 3.7 and supports Python 3.8 through Python 3.11&lt;/p&gt;
&lt;h4&gt;Upgrade Instructions&lt;/h4&gt;
&lt;p&gt;To install updated dependencies, run: &lt;code&gt;pip install -r requirements.txt --no-deps --upgrade --upgrade-strategy=only-if-needed&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Run: &lt;code&gt;paster ensure_index development.ini&lt;/code&gt; in Allura dir&lt;/p&gt;
&lt;p&gt;If switching to a new version of Python, you will need to make a completely new python virtual environment,
and run &lt;code&gt;pip install ...&lt;/code&gt; in it, and then use it to run Allura.&lt;/p&gt;
&lt;p&gt;If using docker, rebuild the allura image and restart containers.&lt;/p&gt;
&lt;p&gt;Feel free to ask any questions on the &lt;a href="https://lists.apache.org/list.html?dev@allura.apache.org"&gt;dev mailing list&lt;/a&gt;.&lt;/p&gt;
&lt;h4&gt;Get 1.16.0&lt;/h4&gt;
&lt;p&gt;&lt;a href="//allura.apache.org/download.html"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.15.0 released</title><link href="//allura.apache.org/posts/2023-allura-1.15.0.html" rel="alternate"></link><published>2023-09-18T00:00:00+00:00</published><updated>2023-09-18T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2023-09-18:/posts/2023-allura-1.15.0.html</id><summary type="html">&lt;p&gt;Version 1.15.0 of Allura released&lt;/p&gt;</summary><content type="html">&lt;h4&gt;What's New?&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.15.0 has been released, after a long time since 1.14.0.  This release adds support for more Python versions (see next section) and Content-Security-Policy headers.  Many other fixes and improvements are also included, they relate to SEO, performance and different parts of Allura.&lt;/p&gt;
&lt;p&gt;For full details of all the changes and fixes, see the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES"&gt;CHANGES file&lt;/a&gt;. &lt;/p&gt;
&lt;h4&gt;Python 3.7 through 3.11 supported&lt;/h4&gt;
&lt;p&gt;This release supports Python 3.7 through Python 3.11&lt;/p&gt;
&lt;p&gt;The next release will drop support for Python 3.7 so please upgrade your Python version soon, to stay compatible with future Allura releases.&lt;/p&gt;
&lt;h4&gt;Upgrade Instructions&lt;/h4&gt;
&lt;p&gt;To install updated dependencies, run: &lt;code&gt;pip install -r requirements.txt --no-deps --upgrade --upgrade-strategy=only-if-needed&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Run: &lt;code&gt;paster ensure_index development.ini&lt;/code&gt; in Allura dir&lt;/p&gt;
&lt;p&gt;If switching to a new version of Python, you will need to make a completely new python virtual environment,
and run &lt;code&gt;pip install ...&lt;/code&gt; in it, and then use it to run Allura.&lt;/p&gt;
&lt;p&gt;If using docker, rebuild the allura image and restart containers.&lt;/p&gt;
&lt;p&gt;Feel free to ask any questions on the &lt;a href="https://lists.apache.org/list.html?dev@allura.apache.org"&gt;dev mailing list&lt;/a&gt;.&lt;/p&gt;
&lt;h4&gt;Get 1.15.0&lt;/h4&gt;
&lt;p&gt;&lt;a href="//allura.apache.org/download.html"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.14.0 released</title><link href="//allura.apache.org/posts/2022-allura-1.14.0.html" rel="alternate"></link><published>2022-09-23T00:00:00+00:00</published><updated>2022-09-23T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2022-09-23:/posts/2022-allura-1.14.0.html</id><summary type="html">&lt;p&gt;Version 1.14.0 of Allura released&lt;/p&gt;</summary><content type="html">&lt;h4&gt;What's New?&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.14.0 has been released, after a long time since 1.13.0.  It includes a new app/tool, SEO improvements
and a huge list of small fixes and improvements.  The highlights are:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Added ForgeFiles app for uploading and managing file releases.&lt;/li&gt;
&lt;li&gt;Many SEO improvements related to links, redirects, canonical and noindex tags.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;For full details of all the changes and fixes, see the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES"&gt;release notes&lt;/a&gt;. &lt;/p&gt;
&lt;h4&gt;Only Python 3.7 supported&lt;/h4&gt;
&lt;p&gt;This release drops support for Python 2.7 and 3.6, and only supports Python 3.7.&lt;/p&gt;
&lt;h4&gt;Upgrade Instructions&lt;/h4&gt;
&lt;p&gt;To install updated dependencies, run: &lt;code&gt;pip install -r requirements.txt --no-deps --upgrade --upgrade-strategy=only-if-needed&lt;/code&gt;&lt;/p&gt;
&lt;p&gt;Run: &lt;code&gt;./rebuild-all.bash&lt;/code&gt; to get new ForgeFiles app available&lt;/p&gt;
&lt;p&gt;Run: &lt;code&gt;paster ensure_index development.ini&lt;/code&gt; in Allura dir&lt;/p&gt;
&lt;p&gt;If switching from Python 3.6 to 3.7, you will need to make a completely new python virtual environment,
and run &lt;code&gt;pip install ...&lt;/code&gt; in it, and then use it to run Allura.  If you're still on Python 2, you probably should upgrade
to the previous release 1.13.0 first, following its upgrade instructions, and then switch to Python 3 before doing the 1.14.0 upgrade.&lt;/p&gt;
&lt;p&gt;If using docker, rebuild the allura image and restart containers.&lt;/p&gt;
&lt;p&gt;Feel free to ask any questions on the &lt;a href="https://lists.apache.org/list.html?dev@allura.apache.org"&gt;dev mailing list&lt;/a&gt;.&lt;/p&gt;
&lt;h4&gt;Get 1.14.0&lt;/h4&gt;
&lt;p&gt;&lt;a href="//allura.apache.org/download.html"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.13.0 released</title><link href="//allura.apache.org/posts/2021-allura-1.13.0.html" rel="alternate"></link><published>2021-05-17T00:00:00+00:00</published><updated>2021-05-17T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2021-05-17:/posts/2021-allura-1.13.0.html</id><summary type="html">&lt;p&gt;Version 1.13.0 of Allura released&lt;/p&gt;</summary><content type="html">&lt;h4&gt;What's New?&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.13.0 has been released, after over a year of development, it includes some major updates and a huge
list of small fixes and improvements.  Some highlights are:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Added ForgeFeedback app&lt;/li&gt;
&lt;li&gt;textarea inputs work better on mobile devices, and use browser spellchecker&lt;/li&gt;
&lt;li&gt;Forum importer for allura's own export format&lt;/li&gt;
&lt;li&gt;Allow multiple site-wide notices to be active&lt;/li&gt;
&lt;/ul&gt;
&lt;h4&gt;Python 2 and 3 supported&lt;/h4&gt;
&lt;p&gt;This release supports Python 2.7, 3.6, and 3.7.  It is the last release planned to support Python 2.  We recommend anyone
running Allura on Python 2 update to Allura 1.13 and then switch from Python 2 to Python 3.  For more details, see
the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES"&gt;release notes&lt;/a&gt; and feel free to ask questions
on the &lt;a href="https://lists.apache.org/list.html?dev@allura.apache.org"&gt;dev mailing list&lt;/a&gt;.&lt;/p&gt;
&lt;h4&gt;Upgrade Instructions&lt;/h4&gt;
&lt;p&gt;Due to supporting both Python 2 and 3, there are quite a few small things to be aware and to update, when upgrading
to 1.13.0.  The &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES"&gt;release notes&lt;/a&gt; has all the details
outlined.&lt;/p&gt;
&lt;h4&gt;Get 1.13.0&lt;/h4&gt;
&lt;p&gt;&lt;a href="//allura.apache.org/download.html"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.12.0 released</title><link href="//allura.apache.org/posts/2019-allura-1.12.0.html" rel="alternate"></link><published>2019-10-07T00:00:00+00:00</published><updated>2019-10-07T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2019-10-07:/posts/2019-allura-1.12.0.html</id><summary type="html">&lt;p&gt;Version 1.12.0 of Allura released&lt;/p&gt;</summary><content type="html">&lt;h4&gt;What's New?&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.12.0 has been released.  New features include user mention notifications.
Thanks to Shalitha and his Google Summer of Code project for implementing this and previous user-mention related functionality.
Read more about &lt;a href="https://medium.com/@shalithasuranga/4e5e4df8b2db"&gt;Shalith's Summer of Code and the user-mention functionality here&lt;/a&gt;.&lt;/p&gt;
&lt;p&gt;An admin option to generate password reset link are also included, along with various performance improvements and bug fixes. 
To see all the bugs fixed and the upgrade instructions, check out the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES"&gt;release changelog&lt;/a&gt;.&lt;/p&gt;
&lt;h4&gt;Security Fix&lt;/h4&gt;
&lt;p&gt;Limited information disclosure in generic search.&lt;/p&gt;
&lt;p&gt;Versions Affected: 1.11.1 and earlier&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Mitigation:&lt;/strong&gt;&lt;br&gt;
Users of Allura should upgrade to Allura 1.12.0&lt;/p&gt;
&lt;h4&gt;Get 1.12.0&lt;/h4&gt;
&lt;p&gt;&lt;a href="//allura.apache.org/download.html"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.11.1 released</title><link href="//allura.apache.org/posts/2019-allura-1.11.1.html" rel="alternate"></link><published>2019-07-16T00:00:00+00:00</published><updated>2019-07-16T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2019-07-16:/posts/2019-allura-1.11.1.html</id><summary type="html">&lt;p&gt;Version 1.11.1 of Allura released&lt;/p&gt;</summary><content type="html">&lt;h4&gt;What's New?&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.11.1 has been released.  It is mostly a bugfix release, with one new feature being infotips for username mentions.&lt;/p&gt;
&lt;p&gt;To see all the bugs fixed and the upgrade instructions, check out the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES"&gt;release changelog&lt;/a&gt;.&lt;/p&gt;
&lt;h4&gt;Security Fix&lt;/h4&gt;
&lt;p&gt;XSS vulnerability when adding another user to a project&lt;/p&gt;
&lt;p&gt;Versions Affected: 1.11.0 and earlier&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Mitigation:&lt;/strong&gt;&lt;br&gt;
Users of Allura should upgrade to Allura 1.11.1&lt;/p&gt;
&lt;h4&gt;Get 1.11.1&lt;/h4&gt;
&lt;p&gt;&lt;a href="https://www.apache.org/dyn/closer.cgi/allura/"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.11.0 released</title><link href="//allura.apache.org/posts/2019-allura-1.11.0.html" rel="alternate"></link><published>2019-06-18T00:00:00+00:00</published><updated>2019-06-18T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2019-06-18:/posts/2019-allura-1.11.0.html</id><summary type="html">&lt;p&gt;Version 1.11.0 of Allura released, with many fixes &amp;amp; improvements and a critical security fix.&lt;/p&gt;</summary><content type="html">&lt;h4&gt;New Features&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.11.0 has been released, with new features including:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Reaction support for comments:&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;img alt="Reaction screenshot" src="//allura.apache.org/images/2019-reactions.png"&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Option to subscribe to forums and other types of threads, when posting&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;img alt="Subscribe when posting screenshot" src="//allura.apache.org/images/2019-post-subscribe.png"&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;@username mentions in markdown editor&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;img alt="Username mentioning screenshot" src="//allura.apache.org/images/2019-usernames.png"&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Optional HaveIBeenPwned checks for password changes&lt;/li&gt;
&lt;/ul&gt;
&lt;h4&gt;Important Security Fix&lt;/h4&gt;
&lt;p&gt;CVE-2019-10085 Apache Allura XSS vulnerability in ticket user dropdown selector&lt;/p&gt;
&lt;p&gt;Severity: Important&lt;br&gt;
Versions Affected: 1.10.0 and earlier&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Description:&lt;/strong&gt;&lt;br&gt;
A vulnerability exists for stored XSS on the user dropdown selector when
creating or editing tickets.  The XSS executes when a user engages with that
dropdown on that page.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Mitigation:&lt;/strong&gt;&lt;br&gt;
Users of Allura should upgrade to Allura 1.11.0 immediately.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Credit:&lt;/strong&gt;&lt;br&gt;
This issue was discovered by Bob "Wombat" Hogg&lt;/p&gt;
&lt;p&gt;There are many smaller improvements and fixes as well.  To see all the details and upgrade instructions, check out the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES"&gt;release changelog&lt;/a&gt;.&lt;/p&gt;
&lt;h4&gt;Get 1.11.0&lt;/h4&gt;
&lt;p&gt;&lt;a href="https://www.apache.org/dyn/closer.cgi/allura/"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.10.0 released</title><link href="//allura.apache.org/posts/2018-allura-1.10.0.html" rel="alternate"></link><published>2018-10-30T00:00:00+00:00</published><updated>2018-10-30T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2018-10-30:/posts/2018-allura-1.10.0.html</id><summary type="html">&lt;p&gt;Version 1.10.0 of Allura released, with many fixes &amp;amp; improvements and a critical security fix.&lt;/p&gt;</summary><content type="html">&lt;h4&gt;New Features&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.10.0 has been released, with new features including:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;interactive checkmark lists &lt;code&gt;* [x] done!&lt;/code&gt;&lt;/li&gt;
&lt;li&gt;emoji shortcode support &lt;code&gt;:rocket:&lt;/code&gt; 🚀&lt;/li&gt;
&lt;li&gt;attachment support for blog posts, and new forum topics&lt;/li&gt;
&lt;/ul&gt;
&lt;h4&gt;Security Fix&lt;/h4&gt;
&lt;p&gt;This release also includes a critical security fix, so upgrading is strongly encouraged.&lt;/p&gt;
&lt;p&gt;There are many smaller improvements and fixes as well.  To see all the details and upgrade instructions, check out the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES"&gt;release changelog&lt;/a&gt;.&lt;/p&gt;
&lt;h4&gt;Get 1.10.0&lt;/h4&gt;
&lt;p&gt;&lt;a href="https://www.apache.org/dyn/closer.cgi/allura/"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.9.0 released</title><link href="//allura.apache.org/posts/2018-allura-1.9.0.html" rel="alternate"></link><published>2018-09-25T00:00:00+00:00</published><updated>2018-09-25T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2018-09-25:/posts/2018-allura-1.9.0.html</id><summary type="html">&lt;p&gt;Version 1.9.0 of Allura released, with many fixes &amp;amp; improvements and a critical security fix.&lt;/p&gt;</summary><content type="html">&lt;h4&gt;New Features&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.9.0 has been released, with a brand new personal dashboard which shows your own tickets, merge requests, projects etc.
Another notable enhancement is automatic saving of content before form submission - no more lost text if you get logged out or disconnected.
Support is added for display of checkboxes lists from markdown, more search help, SVN snapshots of the current directory only, and bulk delete for tickets.
Of course there are also smaller improvements, fixes, and performances improvements as well.  To see all the details, check out the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES"&gt;release changelog&lt;/a&gt;.&lt;/p&gt;
&lt;h4&gt;Dashboard Details&lt;/h4&gt;
&lt;p&gt;The personalized dashboard will show up at the index page for anyone who is logged in.  This provides a comprehensive list of your own tickets and merge requests across all projects, and quick access to relevant projects and activity.  It is extensible so 3rd-party sections can be developed as well, very similarly to the user profile sections.&lt;/p&gt;
&lt;p&gt;Here's an example screenshot:
&lt;img alt="Dashboard screenshot" src="//allura.apache.org/images/2018-dashboard.png"&gt;&lt;/p&gt;
&lt;h4&gt;Get 1.9.0&lt;/h4&gt;
&lt;p&gt;&lt;a href="https://www.apache.org/dyn/closer.cgi/allura/"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.8.1 released</title><link href="//allura.apache.org/posts/2018-allura-1.8.1.html" rel="alternate"></link><published>2018-03-14T00:00:00+00:00</published><updated>2018-03-14T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2018-03-14:/posts/2018-allura-1.8.1.html</id><summary type="html">&lt;p&gt;Version 1.8.1 of Allura released, with many fixes &amp;amp; improvements and a critical security fix.&lt;/p&gt;</summary><content type="html">&lt;h4&gt;New Features&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.8.1 has been released.
It contains a several improvements around spam prevention and content quality on discussions.  It also includes a few performance optimizations, along with a number of fixes and smaller improvements.  To see all the details, check out the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES"&gt;release changelog&lt;/a&gt;.&lt;/p&gt;
&lt;h4&gt;Important Security Fix&lt;/h4&gt;
&lt;p&gt;CVE-2018-1319 Apache Allura HTTP response splitting&lt;/p&gt;
&lt;p&gt;Severity: Important&lt;br&gt;
Versions Affected: All&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Description:&lt;/strong&gt;&lt;br&gt;
Attackers may craft URLs that cause HTTP response splitting.  If a victim goes
to a maliciously crafted URL, unwanted results may occur including XSS or
service denial for the victim's browsing session.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Mitigation:&lt;/strong&gt;&lt;br&gt;
Users of Allura should upgrade to Allura 1.8.1 immediately.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Credit:&lt;/strong&gt;&lt;br&gt;
This issue was discovered by Everardo Padilla Saca&lt;/p&gt;
&lt;h4&gt;Get 1.8.1&lt;/h4&gt;
&lt;p&gt;&lt;a href="https://www.apache.org/dyn/closer.cgi/allura/"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.8.0 released</title><link href="//allura.apache.org/posts/2018-allura-1.8.0.html" rel="alternate"></link><published>2018-02-06T00:00:00+00:00</published><updated>2018-02-06T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2018-02-06:/posts/2018-allura-1.8.0.html</id><summary type="html">&lt;p&gt;Version 1.8.0 of Allura released, with many fixes &amp;amp; improvements and a critical security fix.&lt;/p&gt;</summary><content type="html">&lt;h4&gt;New Features&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.8.0 has been released.
It contains a Docker setup for production environments, and improved security and auditing around user logins.
This release also contains a large number of fixes and smaller improvements.  To see all the details, check out the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES"&gt;release changelog&lt;/a&gt;.&lt;/p&gt;
&lt;h4&gt;Important Security Fix&lt;/h4&gt;
&lt;p&gt;CVE-2018-1299 Apache Allura directory traversal vulnerability&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Versions Affected:&lt;/strong&gt;&lt;br&gt;Apache Allura 1.7.0 and earlier&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Description:&lt;/strong&gt;&lt;br&gt;
Unauthenticated attackers may retrieve arbitrary files through the Allura web
application.  Some webservers used with Allura, such as Nginx, Apache/mod_wsgi
or paster may prevent the attack from succeeding.  Others, such as gunicorn do
not prevent it and leave Allura vulnerable.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Mitigation:&lt;/strong&gt;&lt;br&gt;
Users of vulnerable webservers with Allura should upgrade to Allura 1.8.0
immediately.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Credit:&lt;/strong&gt;&lt;br&gt;
This issue was discovered by Everardo Padilla Saca&lt;/p&gt;
&lt;h4&gt;Get 1.8.0&lt;/h4&gt;
&lt;p&gt;&lt;a href="https://www.apache.org/dyn/closer.cgi/allura/"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.7.0 released</title><link href="//allura.apache.org/posts/2017-allura-1.7.0.html" rel="alternate"></link><published>2017-06-28T00:00:00+00:00</published><updated>2017-06-28T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2017-06-28:/posts/2017-allura-1.7.0.html</id><summary type="html">&lt;p&gt;Version 1.7.0 of Allura: Multifactor authentication, git-http docker container,  per-thread subscriptions in discussion forums, and more.&lt;/p&gt;</summary><content type="html">&lt;h4&gt;New Features&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.7.0 has been released, with support for hi-res project logos, and better content control for "neighborhood" landing pages by using wiki pages.&lt;/p&gt;
&lt;p&gt;This release also contains numerous small improvements and bug fixes.  To see all the details, check out the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/rel/1.7.0/~/tree/CHANGES"&gt;release changelog&lt;/a&gt;.&lt;/p&gt;
&lt;h4&gt;Get 1.7.0&lt;/h4&gt;
&lt;p&gt;&lt;a href="https://www.apache.org/dyn/closer.cgi/allura/"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.6.0 released</title><link href="//allura.apache.org/posts/2016-allura-1.6.0.html" rel="alternate"></link><published>2016-12-15T00:00:00+00:00</published><updated>2016-12-15T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2016-12-15:/posts/2016-allura-1.6.0.html</id><summary type="html">&lt;p&gt;Version 1.6.0 of Allura: Multifactor authentication, git-http docker container,  per-thread subscriptions in discussion forums, and more.&lt;/p&gt;</summary><content type="html">&lt;h4&gt;New Features&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.6.0 has been released. Significant new features have been added in the project like the introduction of multifactor authentication and recovery codes, a git-http docker container, and per-thread subscriptions in discussion forums. &lt;/p&gt;
&lt;p&gt;Also, see our recent post about the changes added in the &lt;a href="//allura.apache.org/posts/2016-two-factor-auth.html"&gt;Two Factor Authentication&lt;/a&gt; update for more details about it.&lt;/p&gt;
&lt;p&gt;There are other fixes and improvements as well, see the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/rel/1.6.0/~/tree/CHANGES"&gt;changelog&lt;/a&gt; for more details.&lt;/p&gt;
&lt;h4&gt;Get 1.6.0&lt;/h4&gt;
&lt;p&gt;&lt;a href="https://www.apache.org/dyn/closer.cgi/allura/"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.5.0 released</title><link href="//allura.apache.org/posts/2016-allura-1.5.0.html" rel="alternate"></link><published>2016-08-23T00:00:00+00:00</published><updated>2016-08-23T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2016-08-23:/posts/2016-allura-1.5.0.html</id><summary type="html">&lt;p&gt;Version 1.5.0 of Allura: updated icons, editor enhancements, admin functionality, and more.&lt;/p&gt;</summary><content type="html">&lt;h4&gt;New Features&lt;/h4&gt;
&lt;p&gt;Apache Allura 1.5.0 has been released.  Major new features include a guided tour after project registration,
improved design for discussions and their attachments, and various usability improvements for merge requests.  Many
of the changes came from work done during Google Summer of Code.&lt;/p&gt;
&lt;p&gt;See our &lt;a href="//allura.apache.org/posts/2016-gsoc-16.html"&gt;Google Summer of Code Summary&lt;/a&gt; for details on all those changes.&lt;/p&gt;
&lt;p&gt;There are lots of other fixes and improvements, see the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/rel/1.5.0/~/tree/CHANGES"&gt;changelog&lt;/a&gt; for details.&lt;/p&gt;
&lt;h4&gt;Upgrade notes&lt;/h4&gt;
&lt;p&gt;No changes are required unless you wish to use the new rate limiting config.  If so, copy all the new
"rate_limits" settings from &lt;code&gt;development.ini&lt;/code&gt; into your &lt;code&gt;.ini&lt;/code&gt; file and configure appropriate values.  Then run
&lt;code&gt;paster ensure_index development.ini&lt;/code&gt;.  Or if you are using Docker, run:
&lt;code&gt;docker-compose run taskd paster ensure_index docker-dev.ini&lt;/code&gt;&lt;/p&gt;
&lt;h4&gt;Get 1.5.0&lt;/h4&gt;
&lt;p&gt;&lt;a href="https://www.apache.org/dyn/closer.cgi/allura/"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.4.0 released</title><link href="//allura.apache.org/posts/2016-allura-1.4.0.html" rel="alternate"></link><published>2016-04-12T00:00:00+00:00</published><updated>2016-04-12T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2016-04-12:/posts/2016-allura-1.4.0.html</id><summary type="html">&lt;p&gt;Version 1.4.0 of Allura: updated icons, editor enhancements, admin functionality, and more.&lt;/p&gt;</summary><content type="html">&lt;p&gt;Apache Allura 1.4.0 has been released.  The biggest new feature is the Admin Nav Bar.
It's a complete overhaul of how you customize the tools in your project.
Read our &lt;a href="//allura.apache.org/posts/2016-admin-toolbar.html"&gt;admin toolbar post&lt;/a&gt; to see how much easier it is to access tool
configurations and add new tools.&lt;/p&gt;
&lt;p&gt;Other significant improvements are:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Config settings to show your custom logo and navigation links in the top header.&lt;/li&gt;
&lt;li&gt;New interface to manage sitewide notifications.  You can specify custom messages to show up on certain pages or page types, or to certain types of users.&lt;/li&gt;
&lt;li&gt;Project exports now can include file attachments from all the tickets, wiki pages, comments, etc.&lt;/li&gt;
&lt;li&gt;Standardized fence blocks in Markdown.  In addition to &lt;code&gt;~~~&lt;/code&gt; to mark off code blocks, you can use the more common &lt;code&gt;```&lt;/code&gt;.
It also works to nest code block notation, and specify the formatting language in more ways.  See &lt;a href="http://spec.commonmark.org/0.25/#fenced-code-blocks"&gt;CommonMark spec for details&lt;/a&gt;.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;There are also dozens of small fixes and improvements, see the &lt;a href="https://forge-allura.apache.org/p/allura/git/ci/rel/1.4.0/~/tree/CHANGES"&gt;changelog&lt;/a&gt; for details.&lt;/p&gt;
&lt;p&gt;&lt;a href="https://www.apache.org/dyn/closer.cgi/allura/"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;
&lt;p&gt;&lt;a href="https://forge-allura.apache.org/p/allura/git/ci/rel/1.4.0/~/tree/CHANGES"&gt;View the full 1.4.0 Changelog&lt;/a&gt;&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.3.2 released</title><link href="//allura.apache.org/posts/2015-allura-1.3.2.html" rel="alternate"></link><published>2015-12-08T00:00:00+00:00</published><updated>2015-12-08T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2015-12-08:/posts/2015-allura-1.3.2.html</id><summary type="html">&lt;p&gt;Version 1.3.2 of Allura: updated icons, editor enhancements, admin functionality, and more.&lt;/p&gt;</summary><content type="html">&lt;p&gt;Apache Allura 1.3.2 has been released.  It includes 2 security fixes and dozens of small fixes and improvements.  The major
new features are:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="//allura.apache.org/posts/2015-updated-icons.html"&gt;Updated icons and cleaner project navigation bar.&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;Enhancements to the &lt;a href="//allura.apache.org/posts/2015-markdown-editor.html"&gt;Markdown editor added in 1.3.1&lt;/a&gt;.  We're talking button
  tooltips, alternate header types, and buttons for section headers, code (works with blocks or inline code), horizontal
  rule, and tables.&lt;/li&gt;
&lt;li&gt;Admin options for any tool available directly in the left sidebar.  No more digging through separate Admin navigation.&lt;/li&gt;
&lt;li&gt;API documented in &lt;a href="http://raml.org/"&gt;.raml&lt;/a&gt; files.  We &lt;a href="//allura.apache.org/posts/2015-rest-api-docs.html"&gt;published the API docs already&lt;/a&gt;,
  which are generated from the .raml definition files.&lt;/li&gt;
&lt;li&gt;A site admin (&lt;code&gt;/nf/admin&lt;/code&gt;) page to permanently delete projects and their data.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;a href="https://www.apache.org/dyn/closer.cgi/allura/"&gt;Download Allura&lt;/a&gt; and &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;install it&lt;/a&gt; today.&lt;/p&gt;
&lt;p&gt;&lt;a href="https://forge-allura.apache.org/p/allura/git/ci/asf_release_1.3.2/tree/CHANGES"&gt;View the full 1.3.2 Changelog&lt;/a&gt;&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry><entry><title>Apache Allura 1.3.1 released</title><link href="//allura.apache.org/posts/2015-allura-1.3.1-release.html" rel="alternate"></link><published>2015-08-10T00:00:00+00:00</published><updated>2015-08-10T00:00:00+00:00</updated><author><name></name></author><id>tag:allura.apache.org,2015-08-10:/posts/2015-allura-1.3.1-release.html</id><summary type="html">&lt;p&gt;Version 1.3.1 of Allura brings security fixes, new markdown editor, CORS, and more.&lt;/p&gt;</summary><content type="html">&lt;p&gt;Apache Allura 1.3.1 has been released.  It includes 3 security fixes and many small fixes and improvements.  The major
new features are:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;&lt;a href="//allura.apache.org/posts/2015-cors.html"&gt;CORS support&lt;/a&gt;, allowing broader access to the REST APIs.&lt;/li&gt;
&lt;li&gt;A &lt;a href="//allura.apache.org/posts/2015-markdown-editor.html"&gt;brand new Markdown editor&lt;/a&gt; with syntax highlighting and an editing toolbar.&lt;/li&gt;
&lt;li&gt;New and updated docs for &lt;a href="https://forge-allura.apache.org/docs/getting_started/installation.html"&gt;Installation&lt;/a&gt; and 
&lt;a href="https://forge-allura.apache.org/docs/getting_started/administration.html"&gt;Administration&lt;/a&gt; &lt;/li&gt;
&lt;li&gt;Ticket notifications include links to attachments.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;&lt;a href="https://forge-allura.apache.org/p/allura/git/ci/asf_release_1.3.1/tree/CHANGES"&gt;View the full Changelog&lt;/a&gt;&lt;/p&gt;</content><category term="misc"></category><category term="release"></category></entry></feed>