From Newsgroup: comp.lang.python.announce

This release is a security, bugfix and feature release (49 changes),
so make sure to read the upgrade documentation: https://www.roundup-tracker.org/docs/upgrading.html to bring your
tracker up to date or patch an older release.

Version 2.6.0 requires Python version 3.10 or newer.

Among the significant enhancements in version 2.6.0 compared to
the 2.5.0 release are:

* Filter history entries where permissions are handled by check function
When a property's permission uses a check command, the history
of changes for that property were shown. The permissions are now
properly checked using the check function. (security)

* Fix old CSRF prevention for PATCH method when using REST
The PATCH method was not covered by the old CSRF protection method.
(security)

* Modern CSRF prevention method available
This release implements CSRF protection using Cross-Site Request
Forgery by Filippo Valsorda https://words.filippo.io/csrf/. This
is an effective method for CSRF protection and is much simpler as
well. There are no configurable options unlike the 8 options for the
older method. This can be opted into using config.ini.

* Require reauthentication when making changes to sensitive fields
You can trigger a reauthentication when the user changes particular
fields. For example you can require a password be entered before the
user changes their password.

* Classic UI interface modernization.

The classic tracker has basic responsive support for mobile. The
table based layout was removed and HTML 5 landmarks (main, nav ...)
are used along with flex and grid layouts. The left hand menu now
collapses to a grid layout in a single column when on a smaller
display. This can be retrofitted to existing classic trackers.

The file CHANGES.txt (https://sourceforge.net/p/roundup/code/ci/default/tree/CHANGES.txt)
has a detailed list of feature additions and bug fixes for each release.
--- Synchronet 3.22a-Linux NewsLink 1.2