docs/release-notes/release-notes-4.10.0.rst

|RCE| 4.10.0 |RNS|
------------------

Release Date
^^^^^^^^^^^^

- 2017-11-02


New Features
^^^^^^^^^^^^

- SSH (Beta): added support for authentication via SSH keys. It's possible
  to use SSH key based authentication instead of HTTP. Users are allowed to
  store multiple keys and use them to push/pull code via SSH.
- Pull requests: store and show a merge strategy. Pull request strategy will
  be also now shown in the UI.
  Close/delete branch are shown if that option is selected.
- Pull requests: Add option to close a branch before merging for Mercurial.
- Processes page. RhodeCode will show a list of all current workers with
  CPU and Memory usage.
  It's also possible to restart each worker from the web interface.
- Auth tokens: allow specifying a custom expiration date from UI.
- Integrations: webhook, allow to set a custom header.
- Integrations: webhook, add possibility to specify username and password.
- UI: added copy-to-clipboard for commits, file paths, gist/clone urls.
- UI: improve support for meta-tags in repository description:
  Tags are extracted to the beginning of the description during rendering.
  Show helpers in proper places in groups/repos/forks with all available tags.
  Add a new deprecated tag.
- UI: commits page, hide evolve commits.
  Now optionally it's possible to show them via a new link on changelog page.
- Audit logs: allow showing individual entries for audit log.
- Audit logs: expose repo related audit logs in repository view.
- User sessions: get ability to count memcached sessions.
- Core: added support for REDIS based user sessions and cache backend.
- Core: added support for Golang go-import functionality.
- SVN: allow specifying alternative template file for mod_dav config.
- Markup: make relative links pin to raw files for images/files as links.
  Allows building relative MD/RST links that go to rendered content
- Auth: allow binding the whitelist views to specific auth tokens. This allows
  to access only specific pages via given auth token. E.g possible to expose
  raw diff/raw file content only for specific single token.
  The new format is `viewName@TOKEN`
- Channelstream: push events with comments on single commits. Users will get
  live notification for events on single commits too.


General
^^^^^^^

- License: add helper to show alternative application method for license via
  ishell.
- http: set REMOTE_USER and REMOTE_HOST http variables in order for more
  Mercurial extensions compatibility.
- User/User groups: show if users or user groups are a part of review rules.
- Permissions: new improved visual permissions summary. Show exactly how
  permissions were inherited, and which rule overwrote the other.
- Permissions: added new JSON endpoint to extract permissions as JSON data
  for 3rd party processing. This allows access for reporting tools without
  giving any ADMIN API access to fetch permissions.
- Pyramid: ported all controllers to Pyramid, with python3 compatible code.
- Gunicorn: allow custom logger to be set for a consistent formatting of
  Gunicorn logs with RhodeCode logs.
- Search: per-repo search shouldn't require admin permissions. Read is enough
  because we access the repo data only.
- Git: updated to 2.13.5 release
- Mercurial: updated to 4.2.3 release.
- Mercurial Evolve: updated to 6.6.0 release.
- Dependencies: bumped pysqlite to Mako to 1.0.7
- Dependencies: bumped pysqlite to 2.8.3
- Dependencies: bumped psycopg2 to 2.7.1
- Dependencies: bumped docutils to 0.13.1
- Dependencies: bumped simplejson to 3.11.1
- Dependencies: bumped alembic to 0.9.2
- Dependencies: bumped Beaker to 1.9.0
- Dependencies: bumped Markdown to 2.6.8
- Dependencies: bumped dogpile.cache to 0.6.4
- Dependencies: bumped colander to 1.3.3
- Dependencies: bumped appenlight_client to 0.6.21
- Dependencies: bumped cprofileV to 1.0.7
- Dependencies: bumped ipdb to 0.10.3
- Dependencies: bumped supervisor to 3.3.2
- Dependencies: bumped subprocess32 to 3.2.7
- Dependencies: bumped pathlib2 to 2.3.0.
- Dependencies: bumped gunicorn==19.7.1
- Dependencies: bumped gevent to 1.2.2 together with greenlet to 0.4.12
- Dependencies: bumped venusian to 1.1.0
- Dependencies: bumped ptyprocess to 0.5.2
- Dependencies: bumped testpath to 0.3.1
- Dependencies: bumped Pyramid to 1.9.1
- Dependencies: bumped supervisor to 3.3.3
- Dependencies: bumped sqlalchemy to version 1.1.11


Security
^^^^^^^^

- Security: use no-referrer for outside link to stop leaking potential
  parameters such as auth token stored inside GET flags.
- Auth tokens: always check permissions to scope tokens to prevent resource
  discovery of private repos.
- Strip: fix XSS in repo strip view.
- Files: prevent XSS in fake errors message on filenodes.
- Files: remove right-to-left override character for display in files.
  This allows faking the name a bit, we in this particular place want to
  skip the override for enhanced security.
- Repo forks: security, check for access to fork_id parameter to prevent
  resource discovery.
- Pull requests: security double check permissions on injected forms of
  source and target repositories. Fixes resource discovery.
- Pull requests: security, prevent from injecting comments to other pull
  requests for users don't have access to.


Performance
^^^^^^^^^^^

- Goto-switcher: use special commit: prefix to explicitly search for commits.
  previous solution could make the go-to switcher slow in case of larger search
  index present.
- Goto-switcher: optimized performance and query capabilities.
- Diffs: use whole chunk diff to calculate if it's oversized or not.
  This fixes an issue if a file is added that has very large number of small
  lines. In this case the time to detect if the diff should be limited was
  very long and CPU intensive.
- Markup: use cached version of http pattern for urlify_text. This
  increases performance because we don't have to compile the pattern each time
  we execute this commonly used function.
- Changelog: fix and optimize loading of chunks for file history.
- Vcs: reduce sql queries used during pull/push operations.
- Auth: use cache_ttl from a plugin to also cache calculated permissions.
  This gives a 30% speed increase in operations like svn commit.


Fixes
^^^^^

- Initial-gravatars: fix case of dot being present before @domain.
- Vcs: report 404 for shadow repos that are not existing anymore.
- RSS/Atom Feeds: generate entries with proper unique ids.
- DB: use LONGTEXT for mysql in user_logs. Fixes problem with mysql rejecting
  insert because of too long json data.
- Pull request: add missing audit data for pull_request.close action.
- User groups: properly set add/delete members for usage in audit data.
- Repo, auth-tokens: UX, set VCS scope if repo scopped token is selected.
- Changelog: fix and optimize loading of chunks for file history.
- Error reporting: improve handling of exception that are non-standard.
  Inject traceback information into unhandled exceptions.
- Users: add additional information why user with pending reviews
  shouldn't be deleted.
- Auth ldap: improve messages when users failed to authenticate via LDAP.
- Sqlalchemy: enabled connection ping.
  should fix potential issues with Mysql server has gone away issues.
- License page: fix usage of url() that could prevent from using convert license.
- Permissions: use same way of sorting of user_group permissions like user ones.


Upgrade notes
^^^^^^^^^^^^^

- Searching for commits in goto-switcher must be now prefixed with
  commit:<hash>
- Because of pyramid porting view names have changed, and we made a backward
  compatibility mapping for most common ones only.
  We recommend reviewing your whitelist view access list.
  There's a new dedicated page with ALL views listed under admin > permissions
  Please take a look in there to port any non-standard views for whitelist access.

- SSH support is implemented via combination of internal, and installed hooks.
  A file called `hgrc_rhodecode` is added to each repository that was used with
  SSH access. This file is then imported inside main hgrc file, it contains
  some Mercurial hooks for ACL checks.
  This breaks full backward compatibility with releases prior to 4.10.0.
  If you install 4.10+, enable SSH module and use SSH with a Mercurial repo, then
  rollback used version to 4.9.1. In such case one additional actions is required.
  Remove following line from `hgrc` file stored inside the repository:
  `%include hgrc_rhodecode`