You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@allura.apache.org by br...@apache.org on 2026/08/24 16:03:39 UTC
(allura-site) 03/03: generate html
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/allura-site.git
commit 602819bbf3c036e2dfc636d1bfd4f36cd1f8e98f
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Mon Aug 24 11:42:51 2026 -0400
generate html
---
download.html | 8 +--
feeds/all.atom.xml | 27 +++++++++-
feeds/tag.release.atom.xml | 27 +++++++++-
index.html | 8 +--
news.html | 11 ++++
posts/2026-allura-1.19.1.html | 2 +-
...-allura-1.19.1.html => 2026-allura-1.20.0.html} | 58 ++++++++--------------
tag/release.html | 11 ++++
8 files changed, 103 insertions(+), 49 deletions(-)
diff --git a/download.html b/download.html
index df0d3e7..9a50d71 100644
--- a/download.html
+++ b/download.html
@@ -51,15 +51,15 @@
<div class="col-20 no-float auto-margin">
<div class="row">
<p class="pad-md">
- <a href="https://www.apache.org/dyn/closer.cgi/allura/allura-1.19.1.tar.gz">Download Allura v1.19.1</a>. This is the latest release of Apache Allura, released June 2026.
- <a href="posts/2026-allura-1.19.1.html">Read what's new.</a>
+ <a href="https://www.apache.org/dyn/closer.cgi/allura/allura-1.20.0.tar.gz">Download Allura v1.20.0</a>. This is the latest release of Apache Allura, released August 2026.
+ <a href="posts/2026-allura-1.20.0.html">Read what's new.</a>
</p>
<p>
Verify the download:
</p>
<ul>
- <li><a href="https://downloads.apache.org/allura/allura-1.19.1.tar.gz.sha512">SHA-512</a> checksum</li>
- <li>PGP <a href="https://downloads.apache.org/allura/allura-1.19.1.tar.gz.asc">signature</a> & <a href="https://downloads.apache.org/allura/KEYS">keys</a></li>
+ <li><a href="https://downloads.apache.org/allura/allura-1.20.0.tar.gz.sha512">SHA-512</a> checksum</li>
+ <li>PGP <a href="https://downloads.apache.org/allura/allura-1.20.0.tar.gz.asc">signature</a> & <a href="https://downloads.apache.org/allura/KEYS">keys</a></li>
</ul>
<p>
<a href="https://www.apache.org/info/verification.html">Instructions for how to verify a download using these files.</a>
diff --git a/feeds/all.atom.xml b/feeds/all.atom.xml
index 85a5ef3..888b8ae 100644
--- a/feeds/all.atom.xml
+++ b/feeds/all.atom.xml
@@ -1,5 +1,28 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom"><title>Apache Allura</title><link href="https://allura.apache.org/" rel="alternate"/><link href="https://allura.apache.org/feeds/all.atom.xml" rel="self"/><id>https://allura.apache.org/</id><updated>2026-06-29T00:00:00+00:00</updated><entry><title>Apache Allura 1.19.1 released, with many security fixes</title><link href="https://allura.apache.org/posts/2026-allura-1.19.1.html" rel="alternate"/><published>2026-06-29T00:00:00+00:00</published><upda [...]
+<feed xmlns="http://www.w3.org/2005/Atom"><title>Apache Allura</title><link href="https://allura.apache.org/" rel="alternate"/><link href="https://allura.apache.org/feeds/all.atom.xml" rel="self"/><id>https://allura.apache.org/</id><updated>2026-08-24T00:00:00+00:00</updated><entry><title>Apache Allura 1.20.0 released, with security fix</title><link href="https://allura.apache.org/posts/2026-allura-1.20.0.html" rel="alternate"/><published>2026-08-24T00:00:00+00:00</published><updated>202 [...]
+<p>Apache Allura 1.20.0 has been released.</p>
+<h4>Security Fix</h4>
+<p>CVE-2026-75099: Unauthenticated REST disclosure </p>
+<p>Severity: important<br></p>
+<p><strong>Description:</strong><br>
+Unauthenticated REST disclosure of certain content items in Apache Allura.</p>
+<p>This issue affects Apache Allura through 1.19.1.</p>
+<p><strong>Mitigation:</strong><br>
+Users are recommended to upgrade to version 1.20.0, which fixes the issue.</p>
+<p><strong>Credit:</strong><br>
+This issue was discovered by Venkatraman Kumar, securin.io.</p>
+<h4>Other Changes</h4>
+<p>Field-level encryption of sensitive fields has continued, adding email addresses and some IP addresses in this release.</p>
+<p>Support for webp screenshots &amp; attachments has been added, and some rss/atom changes, and more. For full details of all the changes and fixes, see the <a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES">CHANGES file</a>. </p>
+<h4>Upgrade Instructions</h4>
+<p>Upgrade to prior release(s) first. Stop any running Allura services while upgrading.</p>
+<p>Install updated dependencies by running: <code>pip install -r requirements.txt --no-deps --upgrade --upgrade-strategy=only-if-needed</code></p>
+<p>Run <code>scripts/migrations/037-field-encryption.sh</code> If using docker, this is the full command (replace your .ini file path): <code>docker compose run -e INI=docker-dev.ini --rm taskd ../scripts/migrations/037-field-encryption.sh</code></p>
+<p>Run: <code>paster ensure_index development.ini --clean</code> in Allura dir. Replace your .ini file path</p>
+<p>After the new version of Allura is up and running, delete the plaintext versions of the encrypted fields by running <code>scripts/migrations/038-field-encryption-cleanup.sh</code></p>
+<p>Feel free to ask any questions on the <a href="https://lists.apache.org/list.html?dev@allura.apache.org">dev mailing list</a>.</p>
+<h4>Get 1.20.0</h4>
+<p><a href="https://allura.apache.org/download.html">Download Allura</a> and <a href="https://forge-allura.apache.org/docs/getting_started/installation.html">install it</a> today.</p></content><category term="misc"/><category term="release"/></entry><entry><title>Apache Allura 1.19.1 released, with many security fixes</title><link href="https://allura.apache.org/posts/2026-allura-1.19.1.html" rel="alternate"/><published>2026-06-29T00:00:00+00:00</publi [...]
<p>Apache Allura 1.19.1 has been released. (Version 1.19.0 was skipped)</p>
<p><strong>Security: a large number of security fixes have been applied, as well as general security hardening in many areas.
We recommend upgrading immediately. These include the following CVEs:</strong></p>
@@ -12,7 +35,7 @@ We recommend upgrading immediately. These include the following CVEs:</stron
</ul>
<p>Field-level encryption of sensitive fields has begun, for some fields. Future releases will add more fields.</p>
<p>Support for Python 3.13 and 3.14 has been added.</p>
-<p>Various other changes, fixes, and performancement impovements are also in this release. For full details of all the changes and fixes, see the <a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES">CHANGES file</a>. </p>
+<p>Various other changes, fixes, and performance improvements are also in this release. For full details of all the changes and fixes, see the <a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES">CHANGES file</a>. </p>
<h4>Breaking Changes</h4>
<p>Python 3.9 and 3.10 are no longer supported. Python 3.11 through 3.14 are supported in this release.</p>
<h4>Upgrade Instructions</h4>
diff --git a/feeds/tag.release.atom.xml b/feeds/tag.release.atom.xml
index aa0356d..ef89d6c 100644
--- a/feeds/tag.release.atom.xml
+++ b/feeds/tag.release.atom.xml
@@ -1,5 +1,28 @@
<?xml version="1.0" encoding="utf-8"?>
-<feed xmlns="http://www.w3.org/2005/Atom"><title>Apache Allura - release</title><link href="https://allura.apache.org/" rel="alternate"/><link href="https://allura.apache.org/feeds/tag.release.atom.xml" rel="self"/><id>https://allura.apache.org/</id><updated>2026-06-29T00:00:00+00:00</updated><entry><title>Apache Allura 1.19.1 released, with many security fixes</title><link href="https://allura.apache.org/posts/2026-allura-1.19.1.html" rel="alternate"/><published>2026-06-29T00:00:00+00:0 [...]
+<feed xmlns="http://www.w3.org/2005/Atom"><title>Apache Allura - release</title><link href="https://allura.apache.org/" rel="alternate"/><link href="https://allura.apache.org/feeds/tag.release.atom.xml" rel="self"/><id>https://allura.apache.org/</id><updated>2026-08-24T00:00:00+00:00</updated><entry><title>Apache Allura 1.20.0 released, with security fix</title><link href="https://allura.apache.org/posts/2026-allura-1.20.0.html" rel="alternate"/><published>2026-08-24T00:00:00+00:00</publ [...]
+<p>Apache Allura 1.20.0 has been released.</p>
+<h4>Security Fix</h4>
+<p>CVE-2026-75099: Unauthenticated REST disclosure </p>
+<p>Severity: important<br></p>
+<p><strong>Description:</strong><br>
+Unauthenticated REST disclosure of certain content items in Apache Allura.</p>
+<p>This issue affects Apache Allura through 1.19.1.</p>
+<p><strong>Mitigation:</strong><br>
+Users are recommended to upgrade to version 1.20.0, which fixes the issue.</p>
+<p><strong>Credit:</strong><br>
+This issue was discovered by Venkatraman Kumar, securin.io.</p>
+<h4>Other Changes</h4>
+<p>Field-level encryption of sensitive fields has continued, adding email addresses and some IP addresses in this release.</p>
+<p>Support for webp screenshots &amp; attachments has been added, and some rss/atom changes, and more. For full details of all the changes and fixes, see the <a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES">CHANGES file</a>. </p>
+<h4>Upgrade Instructions</h4>
+<p>Upgrade to prior release(s) first. Stop any running Allura services while upgrading.</p>
+<p>Install updated dependencies by running: <code>pip install -r requirements.txt --no-deps --upgrade --upgrade-strategy=only-if-needed</code></p>
+<p>Run <code>scripts/migrations/037-field-encryption.sh</code> If using docker, this is the full command (replace your .ini file path): <code>docker compose run -e INI=docker-dev.ini --rm taskd ../scripts/migrations/037-field-encryption.sh</code></p>
+<p>Run: <code>paster ensure_index development.ini --clean</code> in Allura dir. Replace your .ini file path</p>
+<p>After the new version of Allura is up and running, delete the plaintext versions of the encrypted fields by running <code>scripts/migrations/038-field-encryption-cleanup.sh</code></p>
+<p>Feel free to ask any questions on the <a href="https://lists.apache.org/list.html?dev@allura.apache.org">dev mailing list</a>.</p>
+<h4>Get 1.20.0</h4>
+<p><a href="https://allura.apache.org/download.html">Download Allura</a> and <a href="https://forge-allura.apache.org/docs/getting_started/installation.html">install it</a> today.</p></content><category term="misc"/><category term="release"/></entry><entry><title>Apache Allura 1.19.1 released, with many security fixes</title><link href="https://allura.apache.org/posts/2026-allura-1.19.1.html" rel="alternate"/><published>2026-06-29T00:00:00+00:00</publi [...]
<p>Apache Allura 1.19.1 has been released. (Version 1.19.0 was skipped)</p>
<p><strong>Security: a large number of security fixes have been applied, as well as general security hardening in many areas.
We recommend upgrading immediately. These include the following CVEs:</strong></p>
@@ -12,7 +35,7 @@ We recommend upgrading immediately. These include the following CVEs:</stron
</ul>
<p>Field-level encryption of sensitive fields has begun, for some fields. Future releases will add more fields.</p>
<p>Support for Python 3.13 and 3.14 has been added.</p>
-<p>Various other changes, fixes, and performancement impovements are also in this release. For full details of all the changes and fixes, see the <a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES">CHANGES file</a>. </p>
+<p>Various other changes, fixes, and performance improvements are also in this release. For full details of all the changes and fixes, see the <a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES">CHANGES file</a>. </p>
<h4>Breaking Changes</h4>
<p>Python 3.9 and 3.10 are no longer supported. Python 3.11 through 3.14 are supported in this release.</p>
<h4>Upgrade Instructions</h4>
diff --git a/index.html b/index.html
index a665a2d..cebffc2 100644
--- a/index.html
+++ b/index.html
@@ -81,18 +81,18 @@
<h3 class="text-center">Get the Latest Version of Allura</h3>
<div class="row pad-vert-md">
<div id="release" class="col-12 auto-margin pad-vert-xs text-center">
- <a href="https://allura.apache.org/download.html"><button class="auto-margin">Download v1.19.1</button></a>
- <span class="text-white">June 2026 —</span>
- <a href="posts/2026-allura-1.19.1.html">What's New</a>
+ <a href="https://allura.apache.org/download.html"><button class="auto-margin">Download v1.20.0</button></a>
+ <span class="text-white">August 2026 —</span>
+ <a href="posts/2026-allura-1.20.0.html">What's New</a>
</div>
<div id="news" class="col-12 auto-margin pad-vert-xs text-center">
<h5>News</h5>
<ul>
+ <li><a href="https://allura.apache.org/posts/2026-allura-1.20.0.html">Apache Allura 1.20.0 released, with security fix</a></li>
<li><a href="https://allura.apache.org/posts/2026-allura-1.19.1.html">Apache Allura 1.19.1 released, with many security fixes</a></li>
<li><a href="https://allura.apache.org/posts/2025-allura-1.18.0.html">Apache Allura 1.18.0 released</a></li>
<li><a href="https://allura.apache.org/posts/2024-allura-1.17.1.html">Apache Allura 1.17.1 released, with security fix</a></li>
<li><a href="https://allura.apache.org/posts/2024-allura-1.17.0.html">Apache Allura 1.17.0 released, including critical security fix</a></li>
- <li><a href="https://allura.apache.org/posts/2023-allura-1.16.0.html">Apache Allura 1.16.0 released with critical security fix</a></li>
<li><a href="https://allura.apache.org/news.html">All News →</a></li>
</ul>
</div>
diff --git a/news.html b/news.html
index 0b768c6..1735188 100644
--- a/news.html
+++ b/news.html
@@ -49,6 +49,17 @@
<h2>All News</h2>
<div class="row bg-white pad-bot-md text-center">
+ <div class="row pad-top-md">
+ <h3><a class="text-black" href="https://allura.apache.org/posts/2026-allura-1.20.0.html">Apache Allura 1.20.0 released, with security fix</a></h3>
+ </div>
+
+ <div class="post-info">
+ Published:
+ <abbr class="published" title="2026-08-24T00:00:00+00:00">
+ Mon 24 August 2026
+ </abbr>
+ </div>
+ <div class="entry-content"> <p>Version 1.20.0 of Allura released, with security fix</p> </div>
<div class="row pad-top-md">
<h3><a class="text-black" href="https://allura.apache.org/posts/2026-allura-1.19.1.html">Apache Allura 1.19.1 released, with many security fixes</a></h3>
</div>
diff --git a/posts/2026-allura-1.19.1.html b/posts/2026-allura-1.19.1.html
index a46f61b..e02c277 100644
--- a/posts/2026-allura-1.19.1.html
+++ b/posts/2026-allura-1.19.1.html
@@ -78,7 +78,7 @@ We recommend upgrading immediately. These include the following CVEs:</strong><
</ul>
<p>Field-level encryption of sensitive fields has begun, for some fields. Future releases will add more fields.</p>
<p>Support for Python 3.13 and 3.14 has been added.</p>
-<p>Various other changes, fixes, and performancement impovements are also in this release. For full details of all the changes and fixes, see the <a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES">CHANGES file</a>. </p>
+<p>Various other changes, fixes, and performance improvements are also in this release. For full details of all the changes and fixes, see the <a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES">CHANGES file</a>. </p>
<h4>Breaking Changes</h4>
<p>Python 3.9 and 3.10 are no longer supported. Python 3.11 through 3.14 are supported in this release.</p>
<h4>Upgrade Instructions</h4>
diff --git a/posts/2026-allura-1.19.1.html b/posts/2026-allura-1.20.0.html
similarity index 66%
copy from posts/2026-allura-1.19.1.html
copy to posts/2026-allura-1.20.0.html
index a46f61b..df86fc5 100644
--- a/posts/2026-allura-1.19.1.html
+++ b/posts/2026-allura-1.20.0.html
@@ -2,7 +2,7 @@
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
- <title> Apache Allura 1.19.1 released, with many security fixes
+ <title> Apache Allura 1.20.0 released, with security fix
</title>
<meta charset="utf-8">
<meta name="description" content="Allura is an open source implementation of a software forge, a site that manages source code repositories, bug reports, discussions, and more for projects.">
@@ -49,13 +49,13 @@
<div class="article-content">
<div class="row bg-white pad-vert-lg">
<div class="row">
- <h3 class="text-black text-center">Apache Allura 1.19.1 released, with many security fixes</h3>
+ <h3 class="text-black text-center">Apache Allura 1.20.0 released, with security fix</h3>
</div>
<div class="post-info text-center">
Published:
- <abbr class="published" title="2026-06-29T00:00:00+00:00">
- Mon 29 June 2026
+ <abbr class="published" title="2026-08-24T00:00:00+00:00">
+ Mon 24 August 2026
</abbr>
<br>
Tagged:
@@ -66,42 +66,28 @@
<div class="col-20 no-float auto-margin">
<div class="row">
<div class="pad-md text-black"><h4>What's New?</h4>
-<p>Apache Allura 1.19.1 has been released. (Version 1.19.0 was skipped)</p>
-<p><strong>Security: a large number of security fixes have been applied, as well as general security hardening in many areas.
-We recommend upgrading immediately. These include the following CVEs:</strong></p>
-<ul>
-<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-69223">CVE-2026-69223</a></li>
-<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-73237">CVE-2026-73237</a></li>
-<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-73238">CVE-2026-73238</a></li>
-<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-73239">CVE-2026-73239</a></li>
-<li><a href="https://www.cve.org/CVERecord?id=CVE-2026-73240">CVE-2026-73240</a></li>
-</ul>
-<p>Field-level encryption of sensitive fields has begun, for some fields. Future releases will add more fields.</p>
-<p>Support for Python 3.13 and 3.14 has been added.</p>
-<p>Various other changes, fixes, and performancement impovements are also in this release. For full details of all the changes and fixes, see the <a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES">CHANGES file</a>. </p>
-<h4>Breaking Changes</h4>
-<p>Python 3.9 and 3.10 are no longer supported. Python 3.11 through 3.14 are supported in this release.</p>
+<p>Apache Allura 1.20.0 has been released.</p>
+<h4>Security Fix</h4>
+<p>CVE-2026-75099: Unauthenticated REST disclosure </p>
+<p>Severity: important<br></p>
+<p><strong>Description:</strong><br>
+Unauthenticated REST disclosure of certain content items in Apache Allura.</p>
+<p>This issue affects Apache Allura through 1.19.1.</p>
+<p><strong>Mitigation:</strong><br>
+Users are recommended to upgrade to version 1.20.0, which fixes the issue.</p>
+<p><strong>Credit:</strong><br>
+This issue was discovered by Venkatraman Kumar, securin.io.</p>
+<h4>Other Changes</h4>
+<p>Field-level encryption of sensitive fields has continued, adding email addresses and some IP addresses in this release.</p>
+<p>Support for webp screenshots & attachments has been added, and some rss/atom changes, and more. For full details of all the changes and fixes, see the <a href="https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES">CHANGES file</a>. </p>
<h4>Upgrade Instructions</h4>
-<p>Stop any running Allura services while upgrading.</p>
+<p>Upgrade to prior release(s) first. Stop any running Allura services while upgrading.</p>
<p>Install updated dependencies by running: <code>pip install -r requirements.txt --no-deps --upgrade --upgrade-strategy=only-if-needed</code></p>
-<p>In your .ini file, set <code>csp.form_action_urls</code> to your base URL.</p>
-<p>In your .ini file, enable or disable importers like Trac importer as you see fit (see <code>disable_entry_points</code> lines in <code>development.ini</code>)</p>
-<p>Field-level mongo encryption setup:</p>
-<ul>
-<li>Copy the new <code>ming.*encryption*</code> lines from development.ini to your own .ini file. </li>
-<li>Generate a secret key with: python -c 'import base64, secrets; print(base64.b64encode(secrets.token_bytes(96)).decode())'</li>
-<li>Put that secret key in your .ini file in 3 spots:</li>
-</ul>
-<div class="highlight"><pre><span></span><code> ming.main.encryption.kms_providers.local.key = ...
- ming.project.encryption.kms_providers.local.key = ...
- ming.task.encryption.kms_providers.local.key = ...
-</code></pre></div>
-
-<p>Run <code>scripts/migrations/035-field-encryption.sh</code> If using docker, this is the full command (replace your .ini file path): <code>docker compose run -e INI=docker-dev.ini --rm taskd ../scripts/migrations/035-field-encryption.sh</code></p>
+<p>Run <code>scripts/migrations/037-field-encryption.sh</code> If using docker, this is the full command (replace your .ini file path): <code>docker compose run -e INI=docker-dev.ini --rm taskd ../scripts/migrations/037-field-encryption.sh</code></p>
<p>Run: <code>paster ensure_index development.ini --clean</code> in Allura dir. Replace your .ini file path</p>
-<p>After the new version of Allura is up and running, delete the plaintext versions of the encrypted fields by running <code>scripts/migrations/036-field-encryption-cleanup.sh</code></p>
+<p>After the new version of Allura is up and running, delete the plaintext versions of the encrypted fields by running <code>scripts/migrations/038-field-encryption-cleanup.sh</code></p>
<p>Feel free to ask any questions on the <a href="https://lists.apache.org/list.html?dev@allura.apache.org">dev mailing list</a>.</p>
-<h4>Get 1.19.1</h4>
+<h4>Get 1.20.0</h4>
<p><a href="https://allura.apache.org/download.html">Download Allura</a> and <a href="https://forge-allura.apache.org/docs/getting_started/installation.html">install it</a> today.</p></div>
</div>
</div>
diff --git a/tag/release.html b/tag/release.html
index aa4581b..9b9936c 100644
--- a/tag/release.html
+++ b/tag/release.html
@@ -49,6 +49,17 @@
<h2>Articles tagged 'release'</h2>
<div class="row bg-white pad-bot-md text-center">
+ <div class="row pad-top-md">
+ <h3><a class="text-black" href="https://allura.apache.org/posts/2026-allura-1.20.0.html">Apache Allura 1.20.0 released, with security fix</a></h3>
+ </div>
+
+ <div class="post-info">
+ Published:
+ <abbr class="published" title="2026-08-24T00:00:00+00:00">
+ Mon 24 August 2026
+ </abbr>
+ </div>
+ <div class="entry-content"> <p>Version 1.20.0 of Allura released, with security fix</p> </div>
<div class="row pad-top-md">
<h3><a class="text-black" href="https://allura.apache.org/posts/2026-allura-1.19.1.html">Apache Allura 1.19.1 released, with many security fixes</a></h3>
</div>