docs: added release notes for 4.10.0

docs/release-notes/release-notes-4.10.0.rst

@@ -0,0 +1,178 b''
+|RCE| 4.10.0 |RNS|
+------------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2017-11-02
+
+
+New Features
+^^^^^^^^^^^^
+
+- SSH (Beta): added support for authentication via SSH keys. It's possible
+  to use SSH key based authentication instead of HTTP. Users are allowed to
+  store multiple keys and use them to push/pull code via SSH.
+- Pull requests: store and show a merge strategy. Pull request strategy will
+  be also now shown in the UI.
+  Close/delete branch are shown if that option is selected.
+- Pull requests: Add option to close a branch before merging for Mercurial.
+- Processes page. RhodeCode will show a list of all current workers with
+  CPU and Memory usage.
+  It's also possible to restart each worker from the web interface.
+- Auth tokens: allow specifying a custom expiration date from UI.
+- Integrations: webhook, allow to set a custom header.
+- Integrations: webhook, add possibility to specify username and password.
+- UI: added copy-to-clipboard for commits, file paths, gist/clone urls.
+- UI: improve support for meta-tags in repository description:
+  Tags are extracted to the beginning of the description during rendering.
+  Show helpers in proper places in groups/repos/forks with all available tags.
+  Add a new deprecated tag.
+- UI: commits page, hide evolve commits.
+  Now optionally it's possible to show them via a new link on changelog page.
+- Audit logs: allow showing individual entries for audit log.
+- Audit logs: expose repo related audit logs in repository view.
+- User sessions: get ability to count memcached sessions.
+- Core: added support for REDIS based user sessions and cache backend.
+- Core: added support for Golang go-import functionality.
+- SVN: allow specifying alternative template file for mod_dav config.
+- Markup: make relative links pin to raw files for images/files as links.
+  Allows building relative MD/RST links that go to rendered content
+- Auth: allow binding the whitelist views to specific auth tokens. This allows
+  to access only specific pages via given auth token. E.g possible to expose
+  raw diff/raw file content only for specific single token.
+  The new format is `viewName@TOKEN`
+- Channelstream: push events with comments on single commits. Users will get
+  live notification for events on single commits too.
+
+
+General
+^^^^^^^
+
+- License: add helper to show alternative application method for license via
+  ishell.
+- http: set REMOTE_USER and REMOTE_HOST http variables in order for more
+  Mercurial extensions compatibility.
+- User/User groups: show if users or user groups are a part of review rules.
+- Permissions: new improved visual permissions summary. Show exactly how
+  permissions were inherited, and which rule overwrote the other.
+- Permissions: added new JSON endpoint to extract permissions as JSON data
+  for 3rd party processing. This allows access for reporting tools without
+  giving any ADMIN API access to fetch permissions.
+- Pyramid: ported all controllers to Pyramid, with python3 compatible code.
+- Gunicorn: allow custom logger to be set for a consistent formatting of
+  Gunicorn logs with RhodeCode logs.
+- Search: per-repo search shouldn't require admin permissions. Read is enough
+  because we access the repo data only.
+- Git: updated to 2.13.5 release
+- Mercurial: updated to 4.2.3 release.
+- Mercurial Evolve: updated to 6.6.0 release.
+- Dependencies: bumped pysqlite to Mako to 1.0.7
+- Dependencies: bumped pysqlite to 2.8.3
+- Dependencies: bumped psycopg2 to 2.7.1
+- Dependencies: bumped docutils to 0.13.1
+- Dependencies: bumped simplejson to 3.11.1
+- Dependencies: bumped alembic to 0.9.2
+- Dependencies: bumped Beaker to 1.9.0
+- Dependencies: bumped Markdown to 2.6.8
+- Dependencies: bumped dogpile.cache to 0.6.4
+- Dependencies: bumped colander to 1.3.3
+- Dependencies: bumped appenlight_client to 0.6.21
+- Dependencies: bumped cprofileV to 1.0.7
+- Dependencies: bumped ipdb to 0.10.3
+- Dependencies: bumped supervisor to 3.3.2
+- Dependencies: bumped subprocess32 to 3.2.7
+- Dependencies: bumped pathlib2 to 2.3.0.
+- Dependencies: bumped gunicorn==19.7.1
+- Dependencies: bumped gevent to 1.2.2 together with greenlet to 0.4.12
+- Dependencies: bumped venusian to 1.1.0
+- Dependencies: bumped ptyprocess to 0.5.2
+- Dependencies: bumped testpath to 0.3.1
+- Dependencies: bumped Pyramid to 1.9.1
+- Dependencies: bumped supervisor to 3.3.3
+- Dependencies: bumped sqlalchemy to version 1.1.11
+
+
+Security
+^^^^^^^^
+
+- Security: use no-referrer for outside link to stop leaking potential
+  parameters such as auth token stored inside GET flags.
+- Auth tokens: always check permissions to scope tokens to prevent resource
+  discovery of private repos.
+- Strip: fix XSS in repo strip view.
+- Files: prevent XSS in fake errors message on filenodes.
+- Files: remove right-to-left override character for display in files.
+  This allows faking the name a bit, we in this particular place want to
+  skip the override for enhanced security.
+- Repo forks: security, check for access to fork_id parameter to prevent
+  resource discovery.
+- Pull requests: security double check permissions on injected forms of
+  source and target repositories. Fixes resource discovery.
+- Pull requests: security, prevent from injecting comments to other pull
+  requests for users don't have access to.
+
+
+Performance
+^^^^^^^^^^^
+
+- Goto-switcher: use special commit: prefix to explicitly search for commits.
+  previous solution could make the go-to switcher slow in case of larger search
+  index present.
+- Goto-switcher: optimized performance and query capabilities.
+- Diffs: use whole chunk diff to calculate if it's oversized or not.
+  This fixes an issue if a file is added that has very large number of small
+  lines. In this case the time to detect if the diff should be limited was
+  very long and CPU intensive.
+- Markup: use cached version of http pattern for urlify_text. This
+  increases performance because we don't have to compile the pattern each time
+  we execute this commonly used function.
+- Changelog: fix and optimize loading of chunks for file history.
+- Vcs: reduce sql queries used during pull/push operations.
+- Auth: use cache_ttl from a plugin to also cache calculated permissions.
+  This gives a 30% speed increase in operations like svn commit.
+
+
+Fixes
+^^^^^
+
+- Initial-gravatars: fix case of dot being present before @domain.
+- Vcs: report 404 for shadow repos that are not existing anymore.
+- RSS/Atom Feeds: generate entries with proper unique ids.
+- DB: use LONGTEXT for mysql in user_logs. Fixes problem with mysql rejecting
+  insert because of too long json data.
+- Pull request: add missing audit data for pull_request.close action.
+- User groups: properly set add/delete members for usage in audit data.
+- Repo, auth-tokens: UX, set VCS scope if repo scopped token is selected.
+- Changelog: fix and optimize loading of chunks for file history.
+- Error reporting: improve handling of exception that are non-standard.
+  Inject traceback information into unhandled exceptions.
+- Users: add additional information why user with pending reviews
+  shouldn't be deleted.
+- Auth ldap: improve messages when users failed to authenticate via LDAP.
+- Sqlalchemy: enabled connection ping.
+  should fix potential issues with Mysql server has gone away issues.
+- License page: fix usage of url() that could prevent from using convert license.
+- Permissions: use same way of sorting of user_group permissions like user ones.
+
+
+Upgrade notes
+^^^^^^^^^^^^^
+
+- Searching for commits in goto-switcher must be now prefixed with
+  commit:<hash>
+- Because of pyramid porting view names have changed, and we made a backward
+  compatibility mapping for most common ones only.
+  We recommend reviewing your whitelist view access list.
+  There's a new dedicated page with ALL views listed under admin > permissions
+  Please take a look in there to port any non-standard views for whitelist access.
+
+- SSH support is implemented via combination of internal, and installed hooks.
+  A file called `hgrc_rhodecode` is added to each repository that was used with
+  SSH access. This file is then imported inside main hgrc file, it contains
+  some Mercurial hooks for ACL checks.
+  This breaks full backward compatibility with releases prior to 4.10.0.
+  If you install 4.10+, enable SSH module and use SSH with a Mercurial repo, then
+  rollback used version to 4.9.1. In such case one additional actions is required.
+  Remove following line from `hgrc` file stored inside the repository:
+  `%include hgrc_rhodecode`

docs/release-notes/release-notes.rst

@@ -9,6 +9,7 b' Release Notes'
 .. toctree::
    :maxdepth: 1
 
+   release-notes-4.10.0.rst
    release-notes-4.9.1.rst
    release-notes-4.9.0.rst
    release-notes-4.8.0.rst