(allura-site) 01/02: release 1.22.0

[br...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/allura-site.git

commit 7e45d58ead1813fa766810c161f592dbc06a78ab
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Mon Oct 12 14:14:07 2026 -0400

    release 1.22.0
---
 _src/content/2026-allura-1.22.0.md | 84 ++++++++++++++++++++++++++++++++++++++
 _src/pelicanconf.py                |  6 +--
 2 files changed, 87 insertions(+), 3 deletions(-)

diff --git a/_src/content/2026-allura-1.22.0.md b/_src/content/2026-allura-1.22.0.md
new file mode 100644
index 0000000..dd10868
--- /dev/null
+++ b/_src/content/2026-allura-1.22.0.md
@@ -0,0 +1,84 @@
+Title: Apache Allura 1.22.0 released, with security fixes
+Date: 2026-10-12
+Tags: release
+Slug: allura-1.22.0
+Summary: Version 1.22.0 of Allura released, with security fixes
+
+#### What's New?
+
+Apache Allura 1.22.0 has been released.
+
+#### Security Fixes
+
+##### CVE-2026-92116: OAuth1 missing callback validation
+
+Severity: important<br>
+
+**Description:**<br>
+OAuth1 callback validation vulnerability in Apache Allura.
+
+This issue affects Apache Allura: from through 1.21.0.
+
+**Mitigation:**<br>
+Users are recommended to upgrade to version 1.22.0, which fixes the issue.
+
+**Credit:**<br>
+This issue was reported by MopMonk AI.
+
+##### CVE-2026-92119: REST API Mass Assignment
+
+Severity: moderate<br>
+
+**Description:**<br>
+REST API Mass Assignment vulnerability in Apache Allura.
+
+This issue affects Apache Allura: through 1.21.0.
+
+**Mitigation:**<br>
+Users are recommended to upgrade to version 1.22.0, which fixes the issue.
+
+**Credit:**<br>
+This issue was reported by CyberLeo.
+
+##### CVE-2026-92120: Oauth1 Replay Attack
+
+Severity: low<br>
+
+**Description:**<br>
+OAuth1 Request Replay Attack vulnerability in Apache Allura.
+
+This issue affects Apache Allura: through 1.21.0.
+
+**Mitigation:**<br>
+Users are recommended to upgrade to version 1.22.0, which fixes the issue.
+
+**Credit:**<br>
+This issue was reported by CyberLeo.
+
+#### Other Changes
+
+Additional security hardening and support.
+
+Edit support has been added for OAuth1 and OAuth2 app configurations.
+
+OAuth1 applications must now register at least one https:// Redirect URL, and their callback must match one exactly.  Applications registered before this release keep working with any callback until their owner edits them to add a URL.
+
+ForgeChat (IRC archive tool) has been deprecated and scheduled to be removed in next release.  Join the Allura dev team if you would like to support and maintain this tool.
+
+For full details of all the changes and fixes, see the [CHANGES file](https://forge-allura.apache.org/p/allura/git/ci/master/tree/CHANGES). 
+
+#### Upgrade Instructions
+
+Upgrade to prior release(s) first.  Stop any running Allura services while upgrading.
+
+Install updated dependencies by running: `pip install -r requirements.txt --no-deps --upgrade --upgrade-strategy=only-if-needed`
+
+Run in mongo: `db.getSiblingDB('allura').oauth2_access_token.dropIndex('refresh_token_1')`
+
+Then run: `paster ensure_index development.ini` in Allura dir.  Replace your .ini file path.
+
+Feel free to ask any questions on the [dev mailing list](https://lists.apache.org/list.html?dev@allura.apache.org).
+
+#### Get 1.22.0
+
+[Download Allura](https://allura.apache.org/download.html) and [install it](https://forge-allura.apache.org/docs/getting_started/installation.html) today.
diff --git a/_src/pelicanconf.py b/_src/pelicanconf.py
index ca2bbf8..516ac68 100644
--- a/_src/pelicanconf.py
+++ b/_src/pelicanconf.py
@@ -45,9 +45,9 @@ TAG_FEED_ATOM = 'feeds/tag.{slug}.atom.xml'
 
 CURRENT_YEAR = dt.date.today().year
 
-RELEASE_VERSION = '1.21.0'
-RELEASE_DATE = 'Sept 2026'
-RELEASE_NEWS = 'posts/2026-allura-1.21.0.html'
+RELEASE_VERSION = '1.22.0'
+RELEASE_DATE = 'Oct 2026'
+RELEASE_NEWS = 'posts/2026-allura-1.22.0.html'
 DIST_URL = 'https://downloads.apache.org/allura/'
 
 FORGE_ALLURA_URL = 'https://forge-allura.apache.org/'