Merge remote-tracking branch 'origin/6.1' into explicitacquisition

.github/workflows/versioncheck.yml

@@ -2,7 +2,7 @@ name: Plone Versioncheck
 
 on:
   push:
-    branches: ["6.0"]
+    branches: ["6.1"]
 
 jobs:
   build:

bootstrap.sh

@@ -1,5 +1,5 @@
 #/bin/sh
-`which python3.10` -m venv .
+`which python3.11` -m venv .
 ./bin/pip install -r requirements.txt
 ./bin/buildout $*
 echo "run plone with: ./bin/instance fg"

checkouts.cfg

@@ -3,26 +3,16 @@ always-checkout = force
 # always-checkout = false
 auto-checkout =
 # These packages are always checkout out:
+    docs
+    mockup
     Plone
     plone.app.locales
     plone.app.upgrade
     Products.CMFPlone
-    mockup
-    docs
 # These packages are manually added, or automatically added by mr.roboto:
-    Zope
-    plone.staticresources
-    plone.rest
+    plone.app.z3cform
+    plone.releaser
+    plone.app.multilingual
     plone.restapi
-    plone.app.layout
+    plone.rest
     plone.app.viewletmanager
-    plone.app.portlets
-    plone.app.content
-    plone.app.contenttypes
-    plone.app.querystring
-    plone.app.vocabularies
-    plonetheme.barceloneta
-    plone.base
-    plone.batching
-    plone.app.dexterity
-    Products.CMFCore

core.cfg

@@ -103,6 +103,7 @@ eggs =
 [vscode]
 recipe = collective.recipe.vscode
 eggs = ${test:eggs}
+robot-enabled = true
 flake8-enabled = false
 black-enabled = true
 generate-envfile = true

release/RELEASE-NOTES.md

@@ -1,49 +1,72 @@
-# Release notes for Plone 6.0.4
+# Release notes for Plone 6.0.7
 
-* Updated: Monday April 24, 2023
+* Released: Thursday September 21, 2023
 * Check the [release schedule](https://plone.org/download/release-schedule).
 * Read the [upgrade guide](https://6.docs.plone.org/upgrade/index.html), explaining the biggest changes compared to 5.2.
-* Canonical place for these [release notes](https://dist.plone.org/release/6.0.4/RELEASE-NOTES.md) and the full [packages changelog](https://dist.plone.org/release/6.0.4/changelog.txt).
+* Canonical place for these [release notes](https://dist.plone.org/release/6.0.7/RELEASE-NOTES.md) and the full [packages changelog](https://dist.plone.org/release/6.0.7/changelog.txt).
 
 If you want to jump straight in, here are two important links:
 
-* With pip you can use the constraints file at [https://dist.plone.org/release/6.0.4/constraints.txt](https://dist.plone.org/release/6.0.4/constraints.txt)
-* With Buildout you can use the versions file at [https://dist.plone.org/release/6.0.4/versions.cfg](https://dist.plone.org/release/6.0.4/versions.cfg), plus optionally [`versions-extra.cfg`](https://dist.plone.org/release/6.0.4/versions-extra.cfg) and [`versions-ecosystem.cfg`](https://dist.plone.org/release/6.0.4/versions-ecosystem.cfg).
+* With pip you can use the constraints file at [https://dist.plone.org/release/6.0.7/constraints.txt](https://dist.plone.org/release/6.0.7/constraints.txt)
+* With Buildout you can use the versions file at [https://dist.plone.org/release/6.0.7/versions.cfg](https://dist.plone.org/release/6.0.7/versions.cfg), plus optionally [`versions-extra.cfg`](https://dist.plone.org/release/6.0.7/versions-extra.cfg) and [`versions-ecosystem.cfg`](https://dist.plone.org/release/6.0.7/versions-ecosystem.cfg).
 
 
 ## Highlights
 
-Major changes since 6.0.3:
-
-* `plone.app.event` and `plone.app.multilingual`: Breaking dependency cleanup: move declaration of language independence of IEventBasic fields from `plone.app.event` to `plone.app.multilingual`.
-* `plone.app.locales`: Updated translations for `es` and `eu`.
-* `plone.base`: Check for container field / attribute when trying to create content with same id.
+Major changes since 6.0.6:
+
+* This includes security fixes from today's announcement:
+  * https://community.plone.org/t/plone-security-advisory-2023-09-21/17941
+  * https://plone.org/security/hotfix/20230921
+* `Zope`:
+  * Security fixes in `AccessControl` and `RestrictedPython`.  See [community announcement](https://community.plone.org/t/zope-4-8-9-and-5-8-4-released-with-a-security-fix/17849).
+  * Allow only some image types to be displayed inline. Force download for others, especially SVG images.
+  * Tighten down the ZMI frame source logic to only allow site-local sources.
+  * Added image dimensions to SVG file properties.
+* `plone.namedfile`:
+  * Fix stored XSS (Cross Site Scripting) for SVG images.
+  * Add internal modification timestamp with fallback to _p_mtime.
+  * Use new internal modification timestamp as part of the hash key for scales.
+  * Fixed issue with SVG images that contain extensive metadata.
+* `plone.rest`: When ``++api++`` is in the url multiple times, redirect to the proper url.
 * `plone.restapi`:
-  * Apply a cache ruleset to the `/@querystring-search` endpoint.
-  * Add `UID` to `relationvalue_converter` summary.
-  * Add `querystring_search` `GET` method.
-* `plone.schema`:
-  * Introduce extras `plone.schema[supermodel]` and `plone.schema[schemaeditor]`.
-  * The package now works in its vanilla installation as an addon for z3c.form, without any other plone dependencies.
-* `plone.staticresources`: Update to `mockup` 5.0.10. Fixes `pat-recurrence` UI issues.
-* `Products.CMFPlone`:
-  * Add a last modification time to the resource registry.
-    We update this when changing anything related: when changing the resource registry in its control panel or activating an add-on.
-    This avoids needing a restart before seeing changes when you run in production mode.
-  * Mockup TinyMCE settings: Fix URLs in TinyMCE `external_plugins` settings.
+  * Fix stored XSS (Cross Site Scripting) for SVG image in user portrait.
+  * Allow passing additional parameters to the delete users endpoint to request not to delete local roles and memberareas.
+  * When serializing blocks, `image_scales` is now added to blocks that contain a resolveuid-based `url`.
+  * When deserializing blocks, `image_scales` is removed.
+  * Add `visit_blocks` util for finding all nested blocks.
+* `plone.dexterity`: Fix a memory leak. For details see [issue 3829](https://github.com/plone/Products.CMFPlone/issues/3829).
+* `plone.app.widgets`: Make this package deprecated. It still works, and is included in Plone 6.0, but Plone 6.1 will not ship with it.
+  Widget base classes have been moved to ``plone.app.z3cform.widgets.patterns``.
+  Also see ``plone.app.widgets.utils`` for information about moving utility methods to their new location.
+* `plone.app.robotframework`: Add support for `playwright`-based tests via `robotframework-browser`.
+* `plone.app.z3cform`: Introduce new Email-Widget which is used for `plone.schema.email.IEmail` fields.  It uses the input type `email`.
+* `plone.volto`: Add `block_types` index to zcatalog. By default it is only added for new Plone sites.
+  To add it to an existing site, run `plone.volto.upgrades.add_block_types_index` manually.
+* `plone.app.multilingual`: Fixes for Indonesian in a multilingual site.  Fix `set_recursive_language` to actually find child objects.
+* `plone.app.querystring`: Fix the `currentUser`` operation when the current user's username is different from their user id.
+* `plone.staticresources`: Update Bootstrap to `5.3.2`, bootstrap-icons to `1.11.1` and Mockup to `5.1.5`:
+  * pat structure: Fix popover-structure-columns, use 2-column layout. (9fb499e)
+  * pat structure: Fix sticky position when toolbar is on top.
+  * pat tinymce: Fix image modal with selected image. Properly await the select2 initialization when using it from the insert image or insert link dialogs.
+* `plonetheme.barceloneta`: Update Bootstrap to `5.3.2`
+* `Products.CMFCore`:
+  * Improve handling of PortalFolder filter input.
+  * Provide a way to not publish items that are acquired.
+* `plone.app.locales`: Updates to nl translations.
 
 
 ## Volto frontend
 
-The default frontend for new Plone 6 sites is Volto. Latest release is [16.20.4](https://www.npmjs.com/package/@plone/volto/v/16.20.4).  See the [changelog](https://github.com/plone/volto/blob/16.20.4/CHANGELOG.md).
+The default frontend for new Plone 6 sites is Volto. Latest release is [16.24.0](https://www.npmjs.com/package/@plone/volto/v/16.24.0).  See the [changelog](https://github.com/plone/volto/blob/16.24.0/CHANGELOG.md).
 Note that this is a JavaScript frontend that you need to run in a separate process with NodeJS.
 
 Also, existing Plone sites need some or more extensive changes to be upgraded before they can use the Volto Frontend. Please read the guide on [migrating from Plone Classic UI to Volto](https://6.docs.plone.org/backend/upgrading/version-specific-migration/migrate-to-volto.html).
 
 
 ## Classic UI
 
-The HTML based and server side rendered UI that was present in Plone 5.2 and earlier major Plone releases is still available  and has also been updated and improved upon in Plone 6.  Our documentation now refers to this frontend as 'Classic UI'.  Support for Classic UI is especially relevant for existing Plone sites which for whatever reason or requirements are not yet ready to be upgraded to the Volto frontend.
+The HTML based and server side rendered UI that was present in Plone 5.2 and earlier major Plone releases is still available and has also been updated and improved upon in Plone 6.  Our documentation now refers to this frontend as 'Classic UI'.  Support for Classic UI is especially relevant for existing Plone sites which for whatever reason or requirements are not yet ready to be upgraded to the Volto frontend.
 
 
 ## Python compatibility
@@ -56,15 +79,16 @@ This release supports Python 3.8, 3.9, 3.10, and 3.11.
 In Plone core we use these versions to install Plone:
 
 ```
-pip==23.0.1
-setuptools==67.6.1
+pip==23.2
+setuptools==68.0.0
 wheel==0.40.0
 zc.buildout==3.0.1
 ```
 
 In general you are free to use whatever versions work for you, but these worked for us.
 
 Note that `setuptools` 66 or higher is more strict with what versions it can recognize.  If you run `pip` or `buildout` and it suddenly cannot find a package with a non-standard version, then this may be the cause.
+And  `setuptools` 68.1.0 until at least 68.1.2 may give problems with namespace packages, especially when they have multiple levels, like `plone.app.*`, and are installed in editable mode.  And pinning a specific version of `setuptools` in your virtual environment may not even be enough for this case.  See https://github.com/plone/meta/issues/172
 
 
 ## Installation