- Released: Monday November 6, 2023
- Check the release schedule.
- Read the upgrade guide, explaining the biggest changes compared to 5.2.
- Canonical place for these release notes and the full packages changelog.
If you want to jump straight in, here are two important links:
- With pip you can use the constraints file at https://dist.plone.org/release/6.0.8/constraints.txt
- With Buildout you can use the versions file at https://dist.plone.org/release/6.0.8/versions.cfg, plus optionally
Major changes since 6.0.7:
plone.scale: Keep scaled WEBP images in WEBP format instead of converting to JPEG.
dos_protectionconfig. See "Error when uploading large files" below.
- Make sure the object title in the ZMI breadcrumbs is quoted to prevent a cross-site scripting issue.
- Base the inline/attachment logic developed for CVE-2023-42458 on the media type proper (ignore parameters and whitespace and normalize to lowercase).
- Remove deprecated @unlock, @refresh-lock endpoints
- Change the @linkintegrity endpoint to add
items_total, the number of contained items which would be deleted.
- The default branch was renamed from
- Add support for getting the
/@querystringendpoint in a specific context.
- Temporarily disable form memory limit checking for files and images. This fixes upload of files and images larger than 1MB. See below.
plone.base: Move interface
This helps avoiding a circular dependency between
plone.app.querystring: Add a way to specify a context for getting vocabularies in the QuerystringRegistryReader.
See PR 137.
With Zope 5.8.4+ (included in Plone 6.0.7) you may get
zExceptions.BadRequest: data exceeds memory limit when uploading an image or file of more than 1 MB. This is at least true when you have
plone.restapi installed, which is the case if you use the default frontend (Volto).
plone.restapi 9.1.2 (included in Plone 6.0.8) we have effectively disabled this check, because it had a bad effect on a central part of the restapi code. The limit is still used, but in less conditions.
We intend to fix this in a better way, but that needs more work and testing.
Regardless of which plone.restapi version is used, you can change this and other limits defined in Zope.
dos_protection in the Zope configuration reference for explanation of this and other options.
If you use Buildout, you can add this in your instance/zeoclient recipe, and choose your own limit:
zope-conf-additional = <dos_protection> form-memory-limit 4MB </dos_protection>
<dos_protection> form-memory-limit 4MB </dos_protection>
Of course you are free to choose a higher or lower limit.
Most content types have the "name from title" behavior: when you create a page "Hello World" this will get the id "hello-world". The
INameFromTitle interface that does this, was moved from
plone.base here. This move helps in avoiding a circular dependency between two core packages.
There have always been two ways to refer to this behavior: by interface (
plone.app.content.interfaces.INameFromTitle) and by name (
plone.namefromtitle). But with the first version of this move, we saw that if you specify the interface, it no longer worked. We fixed this, as this is not the kind of thing we want to break in a Plone bugfix release.
But the advice is to specify all behaviors by name, not by interface. This will continue to work in all Plone versions, no matter if we move interfaces around or not. In fact, in Plone 5.2 there is already an upgrade that automatically changes this for all types, but of course we cannot control what add-on packages do when you install them fresh.
Also, existing Plone sites need some or more extensive changes to be upgraded before they can use the Volto Frontend. Please read the guide on migrating from Plone Classic UI to Volto.
Note that Volto 17 is also available, and you can use it on Plone 6.0, but we will keep recommending Volto 16 by default.
The HTML based and server side rendered UI that was present in Plone 5.2 and earlier major Plone releases is still available and has also been updated and improved upon in Plone 6. Our documentation now refers to this frontend as 'Classic UI'. Support for Classic UI is especially relevant for existing Plone sites which for whatever reason or requirements are not yet ready to be upgraded to the Volto frontend.
This release supports Python 3.8, 3.9, 3.10, and 3.11.
There is preliminary support for Python 3.12, but this is not officially recommended yet. Especially some changes in
RestrictedPython may need to happen still.
In Plone core we use these versions to install Plone:
pip==23.3.1 setuptools==68.2.2 wheel==0.41.2 zc.buildout==3.0.1
In general you are free to use whatever versions work for you, but these worked for us.
For installation instructions, see the documentation.
If you find any issues, please report them in the main issue tracker.