Plone 6.0.0a3

There may be hotfixes applicable to this release. Always check the Plone Hotfix page before production deployment.

Release notes

LicenseGPL
Date released2022-01-28
Release managerEric Steele

Highlights

Changes since 6.0.0a2:

  • plone.app.contenttypes: Security fix: prevent cache poisoning with the Referer header.
    See security advisory.
  • Updated the versions of the build requirements: setuptools to 59.6.0, zc.buildout to 3.0.0rc1, pip to 21.3.1.
  • Zope 5.4:
    • Add support for Python 3.10 (Plone does not have this yet).
    • WebDAV fixes.
    • https://zope.dev is now the canonical Zope developer community site.
  • plone.volto: Removed collective.folderishtypes dependency.
  • Products.CMFEditions:
    • Got rid of the skins directory. Most items in here have been moved to browser views. Some were no longer used, or had an alternative, and were removed.
    • The VersionView class is deprecated because it contained just one method that is now part of the @@plone view.
  • plone.app.linkintegrity: Track integrity of video and audio files in HTML source tags.
  • plone.app.uuid: Speed up uuidToPhysicalPath and uuidToObject.
  • plone.namedfile:
    • Make DefaultImageScalingFactory more flexible, with methods you can override.
    • Drop support for Python 2.7. Main target is now Plone 6, but we try to keep it running on Plone 5.2 with Python 3.
  • diazo: Removed FormEncode test dependency.
  • Pillow updated to 9.0.0
  • plone.app.content: Deprecate the human_readable_size method of the ContentStatusHistoryView class because the one from the @@plone view should be used.
  • plone.app.layout: Improved the Global section viewlet:
    • Catalog based navigation.
    • Allow more customization by adding methods as hooks.
    • Various performance optimizations.
    • Deprecate now unused navtree_depth property.
  • plone.app.layout: Removed deprecated methods.
  • plone.app.layout: Add viewlet to display customizable favicon. See the Site Settings.
  • Various packages: No longer use deprecated property types ulines, utext, utoken, and ustring, but their non-unicode variants, without a u at the beginning. See issue 3305.
  • plone.restapi:
    • Enhance @addons endpoint to return a list of upgradeable addons.
    • Add support for DX Plone Site root in Plone 6. Remove blocks behavior hack for site root in Plone 6.
  • Products.CMFPlacefulWorkflow: Removed the CMFPlacefulWorkflow skin layer.

Expected

There are some items that we want to include during the alpha phase, but which are not ready yet:

  • Updated JavaScript for Plone Classic, using ES6 modules. No more through-the-web compiling of JavaScript. See PLIP 3211.
  • Add plone.volto as dependency of the Plone package. See issue 1.
  • Add plone.base as basic package with shared code. See issue 3395.

Installation

Some documentation about installation:

If you use Docker, we have some images:

  • plone/plone-backend (5.2 and 6.0)
  • plone/plone-frontend (Volto)
  • plone/plone-haproxy

(Docker for 6.0.0a3 is being prepared.)

If you don't do Docker, you will have to do the backend by hand.
The links above should give you information on how to install the prerequisites, like Python, also on Windows.
Here, we will focus on Unix-like systems (Linux, Mac OSX), but Windows should work as well.
The steps are:

  • Install the Plone (Classic) backend with buildout or pip.
  • Create the Plone Site in the browser.
  • Install the Plone frontend (Volto) with node.

Install backend with buildout

Change to a new directory and put a file buildout.cfg in it:

[buildout]
extends = https://dist.plone.org/release/6.0.0a3/versions.cfg
parts = instance

[instance]
recipe = plone.recipe.zope2instance
eggs =
    Plone
    plone.volto
user = admin:admin
zodb-temporary-storage = off

Install it with:

python3.9 -m venv .
bin/pip install -r https://dist.plone.org/release/6.0.0a3/requirements.txt
bin/buildout
bin/instance fg

Install backend with pip

If you don't want to use buildout, you can install the Plone Python packages with pip.
Change to a new directory and then:

python3.9 -m venv .
bin/pip install -U pip setuptools wheel
bin/pip install Plone plone.volto -c https://dist.plone.org/release/6.0.0a3v/constraints.txt --use-deprecated legacy-resolver
bin/mkwsgiinstance -u admin:admin -d .
bin/runwsgi -v etc/zope.ini

Create Plone backend

After you have installed the backend with buildout or pip, open a browser and go to http://localhost:8080/.
Click 'Create a new Plone site' to prepare for the new Volto frontend.
If you want Plone Classic instead, click 'Create Classic Plone site'.
(If this button is not available, then you did not install plone.volto with buildout or pip. 'Create a new Plone site' will create a Classic site then.)

Note: For Volto, make sure the Path identifier is Plone. You can change this, but then you need to change some Volto frontend configuration as well.

Submit the form and your backend is ready.
If you want Classic Plone, you are done.
If you want the full Plone 6 with Volto, read on.

Frontend with node

You should probably read one of documentation pages linked above.
But the following gives you the general idea.

First install nvm, the Node Version Manager

  • On Linux: apt-get install nvm
  • On Mac: brew install nvm
  • Or use the installation procedure detailed in the nvm documentation

Create a Volto project:

nvm install --lts
npm install --global yarn
npm init yo @plone/volto

This will take long, and then ask for a project name.
It will create a directory with this name.
Go to that directory and start the frontend:

yarn start

In your browser go to http://localhost:3000.

You are done. Welcome to Plone 6!

Downloads

Changes

Zope: 5.3 → 5.4

  • Audit and fix all hyperlinks in code and documentation
    • Change zope.org references to zope.dev due to ongoing domain ownership issues. zope.dev is owned by the Plone Foundation and thus safe from interference. XML/ZCML namespace URLs remain unchanged.
    • Remove all links that are completely dead, such as the old zope.org Collectors issue trackers.
    • Update all other miscellaneous links to make them work again or remove if the information is gone.
  • Improve type guessing for the default WebDAV PUT factory (#997)
  • Enable WebDAV PUT factories to change a newly created object's ID (#997)
  • Fix potential race condition in App.version_txt.getZopeVersion (#999)
  • Don't coerce file upload fields for adding DTML Documents/Methods to string. This makes the Add forms work again with the ZPublisher converter code changes.
  • Remove deprecated ulines, utext, utokens, ustring from more code. In the properties form, show a deprecation warning.
  • Add function ZPublisher.utils.fix_properties. You can call this to fix lines properties to only contain strings, not bytes. It also replaces the deprecated property types ulines, utext, utoken, and ustring with their non-unicode variants. (#987)
  • Add support for Python 3.10.
  • Update to newest compatible versions of dependencies.

setuptools: 54.0.0 → 59.6.0

zc.buildout: 3.0.0b2 → 3.0.0rc1

pip: 21.0.1 → 21.3.1

plone.releaser: 1.8.5 → 1.8.6

Bug fixes:

  • Insert buildout:docs-directory when reading sources. Workaround for issue similar to mr.roboto 89. [maurits] (#89)

msgpack: 0.6.2 → 1.0.3

pillow: 8.3.1 → 9.0.0

repoze.xmliter: 0.6 → 0.6.1

  • Fixed tests with lxml 4.7.1 or higher. Fixes issue 8. [maurits]

diazo: 1.4.1 → 1.4.2

Bug fixes:

  • Remove FormEncode test dependency. [maurits] (#83)

Plone: 6.0.0a2 → 6.0.0a3

Bug fixes:

  • Release 6.0.0a3. [maurits]

plone.app.content: 4.0.0a8 → 4.0.0a9

Breaking changes:

  • Deprecate the human_readable_size method of the ContentStatusHistoryView class because the one from the @@plone view should be used [ale-rt] (#240)

plone.app.contentlisting: 2.0.5 → 2.0.6

Bug fixes:

  • Do not throw an error when the contenttype is not in the mimetypes_registry. [tschorr] (#41)

plone.app.contentrules: 5.0.0a2 → 5.0.0a3

Bug fixes:

  • remove obsolete info icon update element management to bootstrap5 [petschki] (#66)

plone.app.contenttypes: 3.0.0a5 → 3.0.0a9

Breaking changes:

  • Remove upgrade steps that are not relevant anymore in Plone 6 [ale-rt] (#613)

Bug fixes:

  • Security fix: prevent cache poisoning with the Referer header. See security advisory <https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-f7qw-5fgj-247x>. [maurits] (#1)
  • Depend on plone.namedfile core instead of its empty [blobs] extra. [maurits] (#106)
  • Fix tests with ES6. [maurits] (#6)
  • Fix author url in tabular listing [petschki] (#627)

plone.app.dexterity: 3.0.0a4 → 3.0.0a7

Bug fixes:

  • Depend on plone.namedfile core instead of its empty [scales] extra. [maurits] (#106)
  • Fix warning about legacy version specifiers in setup.py. [maurits] (#337)
  • Use the shared 'Plone test setup' and 'Plone test teardown' keywords in Robot tests. [Rotonen] (#292)
  • Fix form text. [agitator] (#336)

plone.app.layout: 4.0.0a5 → 4.0.0a9

Breaking changes:

  • Remove (marked for removal im Plone 6) deprecated methods. [jensens] (#285)

New features:

  • Add viewlet to display customizable favicon with handler to update its MIME-type [talarias] (plip-favicon)

  • Global section viewlet: Catalog based navigation. Show the global sections also if navigation contains items but tabs are empty. This allows for disabling portal tabs rendering and constructing the navigation only from the catalog query. [thet] (273-1)

  • Global sections viewlet: Customize entries and query. Also allow customizing the tabs entries and the navigation query along with the other navigation entries. [thet] (273-2)

  • Global sections viewlet: Factor out types_using_view. Factor out types_using_view so that this method can be re-used, e.g. in a subclass with a customize_entry method. [thet] (273-3)

  • Global sections viewlet performance optimizations:

    • Remove pointless caching on types_using_view,
    • Store settings in variable for multiple access, bypassing cache checks,
    • Remove now pointless caching on settings property,
    • Deprecate now unused navtree_depth property.

    [thet] (#275)

  • Remove pointless caching on types_using_view,

  • Store settings in variable for multiple access, bypassing cache checks,

  • Remove now pointless caching on settings property,

  • Deprecate now unused navtree_depth property.

Bug fixes:

  • In global sections viewlet fetch registry only one time. Also: Code style black and minor code cleanup. [jensens] (#285)
  • Escape navigation titles only once. [thomasmassmann] (#280)

plone.app.linkintegrity: 3.4.1 → 3.5.0

New features:

  • Track integrity of video and audio files in HTML source tags. (#77)

plone.app.multilingual: 6.0.0a5 → 6.0.0a7

Bug fixes:

  • In CMFPlone the ILanguage schema was moved to plone.i18n and is referenced as such there, here the change was missing. [jensens] (#394)
  • Fix typos in documentation. [telshock] (#340)

plone.app.registry: 2.0.0a5 → 2.0.0a7

Bug fixes:

  • structured form description and explicit macro call [petschki] (#60)
  • Ignoring dotted files in registry directories. [iham] (#3990)

plone.app.upgrade: 3.0.0a1 → 3.0.0a3

Bug fixes:

  • Rerelease without changes as 3.0.0a3 so it fits better with the Plone 6.0.0a3 version. It is not guaranteed to keep matching. [maurits] (#300)
  • Upgrade Step for renamed error-log-form view link in ControlPanel [jmevissen] (#266)
  • Fix unicode properties. See issue 3305. [maurits] (#3305)
  • Added upgrade to 6003, Plone 6.0.0a3. [maurits] (#6003)

plone.app.users: 3.0.0a4 → 3.0.0a5

Bug fixes:

  • Test fix: remove deprecated ustring handling, which is only needed on Python 2. [maurits] (#3305)

plone.app.uuid: 2.0.2 → 2.1.0

New features:

  • Speed up uuidToPhysicalPath and uuidToObject. Do this by using an IndexQuery to only query the UID index. Note: of the four functions in utils.py, only uuidToObject checks the security. For the other functions, it is up to the caller to do this, if needed. We may change this in the future, but for now the behavior should be the same as in previous versions. [maurits] (#11)

plone.app.z3cform: 4.0.0a4 → 4.0.0a6

Bug fixes:

  • re-enable HTML rendering in form description [petschki] (#138)
  • Remove errorneous extra curly bracket in class name of the widget wrapper. [thet] (#136)

plone.cachepurging: 2.0.3 → 2.0.4

Bug fixes:

  • Better debugging capabilities by enhancing the output of the purge views @@plone.cachepurging.purge and @@plone.cachepurging.queue. [jensens] (#21)

plone.dexterity: 2.10.5 → 3.0.0a2

Breaking changes:

  • Plone 6: Always use a lines property for behaviors, no longer the deprecated ulines. Part of issue 3305. [maurits] (#3305)

Bug fixes:

  • Really always use a lines property for behaviors, no longer the deprecated ulines. This improves the fix from the previous release. Part of issue 3305. [maurits] (#3305)

plone.i18n: 5.0.0a3 → 5.0.0a4

Bug fixes:

  • Tests: call self.publish with handle_errors=False. [maurits] (#41)

plone.namedfile: 5.5.1 → 6.0.0a1

Breaking changes:

  • Drop support for Python 2.7. Main target is now Plone 6, but we try to keep it running on Plone 5.2 with Python 3. See discussion in plone.scale issue 44. [maurits] (#44)

New features:

  • Make DefaultImageScalingFactory more flexible, with methods you can override. [maurits] (#104)

Bug fixes:

  • Fixed NameError file on Python 3. Use io.IOBase instead. (#3)

plone.rest: 2.0.0a1 → 2.0.0a2

Bug fixes:

  • Fix typo in README.rst [jensens] (#123)
  • Use document_view as default for site root. [agitator] (#126)
  • Resolve all the deprecation warnings that originate in this package's code that are exposed by running the tests that do not stem from backwards compatibility we support. [rpatterson] (#128)

plone.restapi: 8.16.2 → 8.21.0

New features:

  • Enhance @addons endpoint to return a list of upgradeable addons. [sneridagh] (#1319)
  • Add support for DX Plone Site root in Plone 6. Remove blocks behavior hack for site root in Plone 6. [sneridagh] (#1219)
  • Update build to Plone 6 alpha 2 [sneridagh] (#1312)
  • Improve vocabulary endpoint when asking for a list of tokens adding resilience and deprecation warning [sneridagh] (#1298)
  • Expandable params as list and deprecations for list as comma separated [sneridagh] (#1300)
  • Enhance the vocabularies serializer to accept a list of tokens [sneridagh] (#1294)

Bug fixes:

  • Do not break in recursive transition when children already are in destination state. [cekk] (#1291)
  • Resolve the bulk of deprecation and resource leak warnings when running the full test suite. [rpatterson] (#1302)
  • SearchableText indexer should maintain the order of the blocks [ericof] (#1292)
  • Be permissive when testing the schema of the querystring endpoint [reebalazs] (#1307)

plone.volto: 3.1.0a6 → 4.0.0a2

  • Remove c.folderishtypes dependency
  • Bring back the draftJS as default, until Slate is integrated in full in Volto [sneridagh]
  • Code cleanup, remove some outdated and unused helpers in setuptools.py [sneridagh]
  • Workaround a test fixture isolation issue with the IVoltoSettings.frontend_domain setting. [rpatterson]
  • Add new field in the coresandbox: not constrained by vocabulary field but the vocabulary defined in the widget. [sneridagh]
  • Computed copyright dates for content demo pages [sneridagh]
  • Test with Plone 6.0.0a2 [ericof]

plonetheme.barceloneta: 3.0.0a8 → 3.0.0a9

New features:

  • del favicons from index.html and rules [talarias] (plip-favicon)

Bug fixes:

  • Be more specific where replacing the head title element [ale-rt] (#264)

Products.CMFDynamicViewFTI: 6.0.3 → 7.0.0a1

Breaking changes:

  • Plone 6: always use lines for the view_methods property. Part of issue 3305. Also, remove Python 2 code and the six dependency. [maurits] (#3305)

Products.CMFEditions: 4.0.0a1 → 4.0.0a3

Breaking changes:

  • The VersionView class is deprecated because it contained just one method that is now part of the @@plone view [ale-rt] (#84)
  • Removed versioning_config.py and versioning_config_form.pt from skin. Instead, you can change the versioning config in the @@content-controlpanel. [maurits] (#72)
  • Removed migration code from version 1.0alpha3 to 1.0beta1 from 2006. Removed Storage Migration Support. This had code for creating a test hierarchy for migration tests. [maurits] (#72)
  • Removed unused versions_history.pt which defines a versions_history macro. We do still have versions_history_form. [maurits] (#72)

New features:

  • Merged skin script checkUpToDate into versions_history_form view. Merged can_diff view into versions_history_form view. [maurits] (#71)
  • Remove now empty CMFEditions skin layer in an upgrade step. [maurits] (#71)
  • Moved various items from from skin to a browser view: saveasnewversion, revertversion, diff_legend, versions_history_form, compare.css. [maurits] (#71)

Bug fixes:

  • Removed version_diff.pt. This template is deprecated. Use the @@history view instead. [maurits] (#71)
  • QA: black, isort, flake8, fix deprecation warnings, remove use of six, upgrade to Python 3.7-only syntax. [maurits] (#80)

Products.CMFPlacefulWorkflow: 2.0.4 → 3.0.0a1

Breaking changes:

  • Use toolbar-action/workflow as icon. Only works in Plone 6. Removed the CMFPlacefulWorkflow skin layer. Removed ancient upgrade step, added new one for the above. [maurits] (#33)

Bug fixes:

  • Fix a test that picks up the footer-portlets link instead of a document. (#36)
  • Fixed undefined name portal_url. Fixed traceback on the policy mapping form when the workflow policy id is missing or wrong. [maurits] (#39)

Products.CMFPlone: 6.0.0a2 → 6.0.0a3

New features:

  • add a new entry in site-controlpanel to change the favicon and its MIME-type The favicon can be a .ico/png or SVG-file [talarias] (plip-barceloneta_lts_favicon)
  • The @@plone view exposes the human_readable_size helper [ale-rt] (#3146)
  • Allow from warnings import warn and warn("message", DeprecationWarning) TTW, like in Python Scripts. [jensens] (#3376)
  • Customize breadcrumbs hook customize_entry for subclasses (like already in global navigation). [jensens] (#3377)

Bug fixes:

  • Cleanup Error Log Form after Review [jmevissen] (#3241)
  • Removed management_page_charset support from usergroup-groupdetails page. This is related to deprecated unicode property types, like ustring. Part of issue 3305. [maurits] (#3305)
  • Update Controlpanel Error Log Form Layout Rename ControlPanel Error Log Form View prefs_error_log_form -> error-log-form [jmevissen] (#3393)
  • Use label_site_administration instead of label_site_admin in error and mail_password_form templates (#3397)
  • Updated metadata version to 6003. [maurits] (#6003)

Products.MimetypesRegistry: 2.1.8 → 2.1.9

Bug fixes:

  • Fix missing comma in install_requires. [maurits] (#21)

Products.PlonePAS: 7.0.0a1 → 7.0.0a2

Bug fixes:

  • Fixed deprecation warning for AccessControl.AuthEncoding. [maurits] (#64)
  • Fix broken Zope root /acl_users cookie plugin on PlonePAS install. [rpatterson] (#65)

Products.PluggableAuthService: 2.6.4 → 2.7.0

  • Add support for Python 3.10.
  • Improve the PAS override for Zope's manage_zmi_logout (#107)
  • Fixed deprecation warning for AccessControl.AuthEncoding.
  • Pass the login name as updateCredentials's login parameter (not the user id) (#105). Fix docstring of PluggableAuthService._extractUserIds.

plone.app.debugtoolbar: 1.2.2 → 1.2.3

Bug fixes:

  • Fix missing zcml directive when plone.app.standardtiles is installed. [petschki] (#18)
  • Fix brackets in toolbar-help [djowett] (#25)
  • Fix a compatibility issue with Python 3.8 (#27)

plone.app.versioningbehavior: 1.4.4 → 1.4.5

Bug fixes:

  • Depend on plone.namedfile core instead of its empty [blobs] extra. [maurits] (#106)

z3c.jbot: 1.1.0 → 1.1.1

plone.app.tiles: 3.2.1 → 3.2.3

FormEncode: 1.3.1 → 2.0.1

Project resources

Learn about Plone