Plone 6.2.2 released

Announcements
1

Release notes for Plone 6.2.2

If you want to jump straight in, here are some important links:

Highlights

These are the main changes compared to 6.2.1:

  • Plone security advisory 20260831:
    • plone.restapi:
      • Security: in summary serializer only allow access to metadata that is available in the catalog.
      • Fix the security check when a wrong permission is specified.
      • Add support for the RESTAPI_ADDITIONAL_NON_METADATA_ATTRIBUTES environment variable, a comma-separated list of extra attribute names appended to the summary serializer's non_metadata_attributes.
    • plone.autoform: Secure a field when a wrong permission is specified. Not really a vulnerability, just hardening.
  • Zope 6.2: Disable XML-RPC request support by default. The protocol is rarely used and disabling it reduces the potential for abuse. Set enable-xmlrpc to on in the Zope configuration if you really need XML-RPC support.
    In older Plone and Zope versions, when using Buildout and plone.recipe.zope2instance, you can set zope-conf-additional = enable-xmlrpc off to disable XML-RPC.
  • plone.testing: Explicitly enable XML-RPC in the WSGIServer layer.
    Otherwise all robot tests fail, because they actually use XML-RPC to communicate with the server.
  • plone.base: Add area to default valid_tags so HTML image maps work out of the box.
  • plone.batching and others: Move package metadata from setup.py to pyproject.toml.
    This will happen to most Plone packages in the near future. You should not notice any difference in practice.
  • plone.scale:
    Add scale name and scale mode to the scale info data structure.
    This can be used in the scaling adapter to handle handle scales differently.
  • plone.exportimport: Make it easy to customize which content gets exported.

Volto frontend

The default frontend for new Plone 6 sites is Volto.
Note that this is a JavaScript frontend that you need to run in a separate process with NodeJS.

Plone 6.2 is meant to be used with Volto 19.
Latest release is 19.4.0. See the changelog.

Please have a look at the upgrade guide for migration from Volto 18 to 19.

Volto related changes in the Python backend since 6.2.1:

  • nothing

Classic UI

The HTML based and server side rendered UI that was present in Plone 5.2 and earlier major Plone releases is still available and has also been updated and improved upon in Plone 6. Our documentation now refers to this frontend as 'Classic UI'.
It is being renamed to Blicca.

Classic UI related changes since 6.2.1:

  • plone.staticresources: Update mockup from 5.6.7 to 5.6.10. See also mockup 5.6.8 changelog, mockup 5.6.9 changelog, and mockup 5.6.10 changelog.
  • plonetheme.barceloneta: barceloneta-toolbar.css: Scope CSS declarations.
    Scope the CSS for the barceloneta-toolbar.css file, so that its styles do not pollute the rest of the site.
    This way you can use barceloneta-toolbar.css in a site without Bootstrap or with a Bootstrap version other than 5 without breaking your site's design.

Python compatibility

This release supports Python 3.10, 3.11, 3.12, 3.13, and 3.14.

pip, buildout, setuptools

In Plone core we use these versions to install Plone:

horse-with-no-namespace==20260202.0
pip==26.2.1
setuptools==81.0.0
wheel==0.48.0
zc.buildout==5.2.0

In general you are free to use whatever versions work for you, but these worked for us.
If you don't use buildout, it should be fine to use setuptools 82+.

You can also try zc.buildout 6.0.0a1.
This includes its own copy of the deprecated pkg_resources module, so it works with the latest setuptools version.
And it fixes support for PEP 660 develop packages, so pyproject.toml only, made with setuptools or with newer build systems like hatchling, flit, pdm.
See the major changes for details information.

Installation

For installation instructions, see the documentation.

Issues

If you find any issues, please report them in the main issue tracker.

4 Likes