Merge branch 'master' into zmi_update_ace

.github/workflows/tests.yml

@@ -28,7 +28,7 @@ jobs:
         - ["3.9",   "py39"]
         - ["3.10",  "py310"]
         - ["3.11",  "py311"]
-        - ["3.12.0-rc.3",  "py312"]
+        - ["3.12",  "py312"]
         - ["3.9",   "docs"]
         - ["3.9",   "coverage"]
         exclude:
@@ -41,7 +41,7 @@ jobs:
           # macOS/Python 3.11+ is set up for universal2 architecture
           # which causes build and package selection issues.
           - { os: ["macos", "macos-11"], config: ["3.11",  "py311"] }
-          - { os: ["macos", "macos-11"], config: ["3.12.0-rc.3",  "py312"] }
+          - { os: ["macos", "macos-11"], config: ["3.12",  "py312"] }
 
     runs-on: ${{ matrix.os[1] }}
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name

.meta.toml

@@ -2,7 +2,7 @@
 # https://github.com/zopefoundation/meta/tree/master/config/zope-product
 [meta]
 template = "zope-product"
-commit-id = "b21fbbf2"
+commit-id = "571024f0"
 
 [python]
 with-pypy = false

CHANGES.rst

@@ -7,10 +7,18 @@ since the branch point at Zope 4.1.2.
 The change log for the previous version, Zope 4, is at
 https://github.com/zopefoundation/Zope/blob/4.x/CHANGES.rst
 
+5.8.7 (unreleased)
+------------------
+
+- Update to newest compatible versions of dependencies.
 
-5.8.6 (unreleased)
+
+5.8.6 (2023-10-04)
 ------------------
 
+- Make sure the object title in the ZMI breadcrumbs is quoted
+  to prevent a cross-site scripting issue.
+
 - Update to newest compatible versions of dependencies.
 
 - Base the inline/attachment logic developed for CVE-2023-42458

constraints.txt

@@ -1,16 +1,16 @@
 AccessControl==6.2
-Acquisition==5.0
+Acquisition==5.1
 AuthEncoding==5.0
-BTrees==5.0
-Chameleon==4.1.0
+BTrees==5.1
+Chameleon==4.2.0
 DateTime==5.2
 DocumentTemplate==4.5
-ExtensionClass==5.0
+ExtensionClass==5.1
 MultiMapping==5.0
-Paste==3.5.3
+Paste==3.6.0
 PasteDeploy==2.1.1; python_version == '3.7'
 PasteDeploy==3.0.1; python_version > '3.7'
-Persistence==4.0.post1
+Persistence==4.1
 RestrictedPython==6.2; python_version == '3.10'
 RestrictedPython==6.2; python_version == '3.11'
 RestrictedPython==6.2; python_version == '3.7'
@@ -24,9 +24,10 @@ ZConfig==4.0
 ZODB==5.8.1
 Zope2==4.0
 beautifulsoup4==4.12.2
-cffi==1.15.1
+cffi==1.15.1; python_version == '3.7'
+cffi==1.16.0; python_version > '3.7'
 multipart==0.2.4
-persistent==5.0
+persistent==5.1
 pycparser==2.21
 python-gettext==5.0
 pytz==2023.3.post1
@@ -40,7 +41,7 @@ z3c.pt==4.0
 zExceptions==5.0
 zc.lockfile==3.0.post1
 zc.recipe.egg==2.0.7
-zodbpickle==3.0.1
+zodbpickle==3.1
 zope.annotation==5.0
 zope.browser==3.0
 zope.browsermenu==5.0
@@ -49,7 +50,7 @@ zope.browserresource==5.1
 zope.cachedescriptors==5.0
 zope.component==6.0
 zope.configuration==5.0
-zope.container==5.1
+zope.container==5.2
 zope.contentprovider==5.0
 zope.contenttype==5.1
 zope.datetime==5.0.0
@@ -60,19 +61,19 @@ zope.event==5.0
 zope.exceptions==5.0.1
 zope.filerepresentation==6.0
 zope.globalrequest==2.0
-zope.hookable==5.4
+zope.hookable==6.0
 zope.i18n==5.1
-zope.i18nmessageid==6.0.1
-zope.interface==6.0
+zope.i18nmessageid==6.1.0
+zope.interface==6.1
 zope.lifecycleevent==5.0
 zope.location==5.0
 zope.pagetemplate==5.0
 zope.processlifetime==3.0
-zope.proxy==5.0.0
+zope.proxy==5.1
 zope.ptresource==5.0
 zope.publisher==7.0
 zope.schema==7.0.1
-zope.security==6.1
+zope.security==6.2
 zope.sequencesort==5.0
 zope.site==5.0
 zope.size==5.0

docs/conf.py

@@ -27,7 +27,7 @@
 # The short X.Y version
 version = '5.8'
 # The full version, including alpha/beta/rc tags
-release = '5.8.5'
+release = '5.8.6'
 
 
 # -- General configuration ---------------------------------------------------
@@ -82,7 +82,7 @@
 # The theme to use for HTML and HTML Help pages.  See the documentation for
 # a list of builtin themes.
 #
-html_theme = 'default'
+html_theme = 'sphinx_rtd_theme'
 
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the

docs/requirements.txt

@@ -1,3 +1,5 @@
 Sphinx
+sphinx_rtd_theme>1
+docutils<0.19
 ZConfig
 tempstorage

requirements-full.txt

@@ -1,17 +1,17 @@
 -e git+https://github.com/zopefoundation/Zope.git@master#egg=Zope
 AccessControl==6.2
-Acquisition==5.0
+Acquisition==5.1
 AuthEncoding==5.0
-BTrees==5.0
-Chameleon==4.1.0
+BTrees==5.1
+Chameleon==4.2.0
 DateTime==5.2
 DocumentTemplate==4.5
-ExtensionClass==5.0
+ExtensionClass==5.1
 MultiMapping==5.0
-Paste==3.5.3
+Paste==3.6.0
 PasteDeploy==2.1.1; python_version == '3.7'
 PasteDeploy==3.0.1; python_version > '3.7'
-Persistence==4.0.post1
+Persistence==4.1
 RestrictedPython==6.2; python_version == '3.10'
 RestrictedPython==6.2; python_version == '3.11'
 RestrictedPython==6.2; python_version == '3.7'
@@ -25,9 +25,10 @@ ZConfig==4.0
 ZODB==5.8.1
 Zope2==4.0
 beautifulsoup4==4.12.2
-cffi==1.15.1
+cffi==1.15.1; python_version == '3.7'
+cffi==1.16.0; python_version > '3.7'
 multipart==0.2.4
-persistent==5.0
+persistent==5.1
 pycparser==2.21
 python-gettext==5.0
 pytz==2023.3.post1
@@ -41,7 +42,7 @@ z3c.pt==4.0
 zExceptions==5.0
 zc.lockfile==3.0.post1
 zc.recipe.egg==2.0.7
-zodbpickle==3.0.1
+zodbpickle==3.1
 zope.annotation==5.0
 zope.browser==3.0
 zope.browsermenu==5.0
@@ -50,7 +51,7 @@ zope.browserresource==5.1
 zope.cachedescriptors==5.0
 zope.component==6.0
 zope.configuration==5.0
-zope.container==5.1
+zope.container==5.2
 zope.contentprovider==5.0
 zope.contenttype==5.1
 zope.datetime==5.0.0
@@ -61,19 +62,19 @@ zope.event==5.0
 zope.exceptions==5.0.1
 zope.filerepresentation==6.0
 zope.globalrequest==2.0
-zope.hookable==5.4
+zope.hookable==6.0
 zope.i18n==5.1
-zope.i18nmessageid==6.0.1
-zope.interface==6.0
+zope.i18nmessageid==6.1.0
+zope.interface==6.1
 zope.lifecycleevent==5.0
 zope.location==5.0
 zope.pagetemplate==5.0
 zope.processlifetime==3.0
-zope.proxy==5.0.0
+zope.proxy==5.1
 zope.ptresource==5.0
 zope.publisher==7.0
 zope.schema==7.0.1
-zope.security==6.1
+zope.security==6.2
 zope.sequencesort==5.0
 zope.site==5.0
 zope.size==5.0

setup.py

@@ -29,7 +29,7 @@ def _read_file(filename):
 README = _read_file('README.rst')
 CHANGES = _read_file('CHANGES.rst')
 
-version = '5.8.6.dev0'
+version = '5.8.7.dev0'
 
 setup(
     name='Zope',

src/App/dtml/manage_tabs.dtml

@@ -42,7 +42,7 @@
 
 	<nav aria-label="breadcrumb">
 	<dtml-let breadcrumb_length="tabs_path_length(REQUEST)">
-		<ol class="breadcrumb <dtml-var "'zmi-' + title_or_id().replace(' ','')">"
+		<ol class="breadcrumb <dtml-var "'zmi-' + title_or_id().replace(' ','')" html_quote>"
 			data-length="<dtml-var breadcrumb_length>">
 			<li class="breadcrumb-item meta_type">
 				<dtml-if meta_type>

versions-prod.cfg

@@ -5,27 +5,27 @@
 Zope =
 Zope2 = 4.0
 AccessControl = 6.2
-Acquisition = 5.0
+Acquisition = 5.1
 AuthEncoding = 5.0
-BTrees = 5.0
-Chameleon = 4.1.0
+BTrees = 5.1
+Chameleon = 4.2.0
 DateTime = 5.2
 DocumentTemplate = 4.5
-ExtensionClass = 5.0
+ExtensionClass = 5.1
 MultiMapping = 5.0
-Paste = 3.5.3
+Paste = 3.6.0
 PasteDeploy = 3.0.1
-Persistence = 4.0.post1
+Persistence = 4.1
 RestrictedPython = 7.0a1.dev1
 WebTest = 3.0.0
 WSGIProxy2 = 0.5.1
 WebOb = 1.8.7
 ZConfig = 4.0
 ZODB = 5.8.1
 beautifulsoup4 = 4.12.2
-cffi = 1.15.1
+cffi = 1.16.0
 multipart = 0.2.4
-persistent = 5.0
+persistent = 5.1
 pycparser = 2.21
 python-gettext = 5.0
 pytz = 2023.3.post1
@@ -38,7 +38,7 @@ z3c.pt = 4.0
 zExceptions = 5.0
 zc.lockfile = 3.0.post1
 zc.recipe.egg = 2.0.7
-zodbpickle = 3.0.1
+zodbpickle = 3.1
 zope.annotation = 5.0
 zope.browser = 3.0
 zope.browsermenu = 5.0
@@ -47,7 +47,7 @@ zope.browserresource = 5.1
 zope.cachedescriptors = 5.0
 zope.component = 6.0
 zope.configuration = 5.0
-zope.container = 5.1
+zope.container = 5.2
 zope.contentprovider = 5.0
 zope.contenttype = 5.1
 zope.datetime = 5.0.0
@@ -58,19 +58,19 @@ zope.event = 5.0
 zope.exceptions = 5.0.1
 zope.filerepresentation = 6.0
 zope.globalrequest = 2.0
-zope.hookable = 5.4
+zope.hookable = 6.0
 zope.i18n = 5.1
-zope.i18nmessageid = 6.0.1
-zope.interface = 6.0
+zope.i18nmessageid = 6.1.0
+zope.interface = 6.1
 zope.lifecycleevent = 5.0
 zope.location = 5.0
 zope.pagetemplate = 5.0
 zope.processlifetime = 3.0
-zope.proxy = 5.0.0
+zope.proxy = 5.1
 zope.ptresource = 5.0
 zope.publisher = 7.0
 zope.schema = 7.0.1
-zope.security = 6.1
+zope.security = 6.2
 zope.sequencesort = 5.0
 zope.site = 5.0
 zope.size = 5.0
@@ -89,6 +89,8 @@ PasteDeploy = 2.1.1
 soupsieve = 2.4.1
 # Only use dev version on Python 3.12
 RestrictedPython = 6.2
+# cffi 1.16.0 requires Python 3.8
+cffi = 1.15.1
 
 [versions:python38]
 # Only use dev version on Python 3.12

versions.cfg

@@ -5,7 +5,7 @@ versions = versions
 
 [versions]
 # Version pins for development and optional dependencies.
-Babel = 2.12.1
+Babel = 2.13.0
 Jinja2 = 3.1.2
 Missing = 5.0
 MarkupSafe = 2.1.3
@@ -16,7 +16,7 @@ Record = 4.0
 Sphinx = 7.2.6
 alabaster = 0.7.13
 certifi = 2023.7.22
-charset-normalizer = 3.2.0
+charset-normalizer = 3.3.0
 collective.recipe.template = 2.2
 colorama = 0.4.6
 # sphinx-rtd-theme 1.3.0 requires docutils<19
@@ -26,7 +26,7 @@ idna = 3.4
 imagesize = 1.4.1
 importlib-metadata = 6.8.0
 mr.developer = 2.0.1
-packaging = 23.1
+packaging = 23.2
 plone.recipe.command = 1.1
 requests = 2.31.0
 snowballstemmer = 2.2.0
@@ -39,7 +39,7 @@ sphinxcontrib-jsmath = 1.0.1
 sphinxcontrib-qthelp = 1.0.6
 sphinxcontrib-serializinghtml = 1.1.9
 tempstorage = 6.0
-urllib3 = 2.0.5
+urllib3 = 2.0.6
 z3c.checkversions = 2.1
 zc.recipe.testrunner = 3.0
 zipp = 3.17.0