docs: added changelog for 4.7.0

docs/release-notes/release-notes-4.7.0.rst

@@ -0,0 +1,162 @@
+|RCE| 4.7.0 |RNS|
+-----------------
+
+Release Date
+^^^^^^^^^^^^
+
+- 2017-04-08
+
+
+New Features
+^^^^^^^^^^^^
+
+- Git: added support for Git LFS v2 protocol. RhodeCode now supports both
+  Mercurial Largefiles, and Git LFS for storing large binaries.
+- Largefiles: detect Git LFS or Mercurial Largefiles objects in UI.
+  Those are now available for downloading together with showing their size.
+- Files: Jupyter notebooks will be now rendered inside the file view. Including
+  MatJax support, and relative images.
+- Files: render images inside the file view.
+  Instead of displaying binary message, render images icons and gifs
+  inside the file view page.
+- Files: relative ULR support inside rendered files. It's now possible to
+  write Markup files and relative links will be handled from the RhodeCode
+  instance itself. Adds basic wiki functionality.
+- Files: allow to show inline pdf in browser using embedded files from source code.
+- Annotation: added shortcut links to browse the annotation view with previous
+  commits. Allows browsing history for each line from annotation view.
+- Pull Requests: add explicit close action instead of close with status from
+  status selector. This allows closing of approved or rejected
+  pull requests, without performing a merge action.
+- Authentication: LDAP now has an option to sync LDA groups using two
+  distinct ways. Either using rfc2307 or rfc2307bis. Increases compatibility
+  with different OpenLDAP and AD servers.
+- Slack: updated slack integration to use the attachments for nicer formatting.
+  Added number of commits inside the message, changed UI for all Slack events.
+- Authentication (EE edition only): added repository scope for VCS type auth
+  tokens. Each token can be now bound to particular repository for added security.
+- User administration: added audit page to allow showing single user actions.
+- API: implemented `get_user_audit_logs` method to fetch audit logs via API endpoint.
+- User administration: It's now possible to edit user group membership from
+  user view.
+- User groups administration: added managing and showing the group
+  synchronization in UI. It's now possible to enable manual group syncing on
+  already existing user groups from external sources such as LDAP/AD.
+- Repositories: added new strip view allowing removing commits from repositories
+  via web interface for repository administrators.
+- System Info: added info about workers and worker type.
+  Added more details about CPU. Expose workers of VCSServer in system info data.
+  Detect database migration errors.
+
+
+General
+^^^^^^^
+
+- Core: ported many views into pure pyramid code with python3.6 compatibility.
+- Core: removed deprecated Pyro4 backend from Enterprise code.
+- Maintenance: implemented maintenance view for Mercurial and GIT repositories.
+  For HG it will run `hg verify`, and for GIT a `git gc` command.
+- Notifications: different approach with fixed/standard container. Floating
+  notifications no longer hide the menu when browsed on top of the page.
+  Also added option to remove single elements from stacked notifications.
+- VCS server: exception-handling: better handling of remote exception and logging.
+- VCS server: propagate hooks tracebacks to VCS server for easier debugging.
+- Core: prevent `httplib3` logs to spam internal RhodeCode logs.
+  It often confuses people looking at those entries, misleading during debug.
+- Mercurial: allow editing Largefiles store location from web interface.
+- Git: allow editing GIT LFS store location from web interface.
+- API: add get_method API call. This allows showing the method and it's parameter
+  from the CLI without reading the documentation.
+  In addition use it's mechanics to propose users other methods with close names
+  if the calling method is not found.
+- UI: add timezone info into tooltips.
+- Dependencies: bumped pyramid to 1.7.4
+- Dependencies: bumped Mercurial version to 4.1.2
+
+
+Security
+^^^^^^^^
+
+- Hooks: added changes to propagate commit metadata on pre-push.
+  This allows easier implementation of checking hooks such as branch protection.
+- Hooks: added new pretx hook to allow mercurial checks such as protected
+  branches, or force push.
+- Auth: give owner of user group proper admin permissions to the user group.
+  This makes the behaviour consistent with repositories and repository groups.
+  And allows delegation of administration of those to other users.
+- Password reset: strengthen security on password reset logic.
+  Generate token that has special password reset role.
+  Set 10 minute expiration for the token.
+  Add some logic to prevent brute forcing attacks.
+  Use more implicit messages to prevent user email discovery attacks.
+- Core: added checks for password change for authenticated users in pure
+  Pyramid views. 2 views were still available and not forcing users to change
+  their passwords.
+- Auth tokens: removed builtin auth-token for users.
+  Builtin token were non-removable, and always generated for new users. This
+  wasn't best practice for security as some users are strictly not allowed to
+  use tokens. From now on new users needs a new token generation in case they
+  want to use token based authentication.
+- Auth tokens: don't generate builtin token for new users.
+  Also don't change them when password reset is made.
+- Api: added last-activity into returned data of get_user api.
+
+
+Performance
+^^^^^^^^^^^
+
+- Mercurial: enabled new `Zstandard` compression algorithm available with
+  Mercurial 4.1.X. This allows faster, more CPU efficient clones when used
+  with new Mercurial clients.
+
+- Users Admin: moved user admin to pyramid, and made it load users in chunks.
+  Fixed loading data to be lazy fetched, drastically improves speed of user
+  administration page in case of large amount of users.
+
+
+Fixes
+^^^^^
+
+- Search: goto commit search will now use a safe search option and never
+  throw any exceptions even if search is misconfigured
+  e.g. Elastic Search cluster is down.
+- Events: fix a case for events called from API that couldn't fetch
+  registered user object.
+- Comments: unlock submit if we use slash commands to set status.
+- UI: fixed an issue with date of last change was not displayed correctly.
+- Emails: added comment types (TODO/NOTE) into emails.
+- Events: fix wrongly returned author data.
+- Error middleware: read the instance title from cached object.
+  Reading from settings inside error handler can cause error hiding when
+  error_handler was caused by database errors.
+- Pull requests: show version age component should use local dates instead of UTC.
+- Pull requests: lock button when updating reviewers to forbid multi-submit
+  problems. Additionally fixed some small UI issues found in that view.
+- Pull requests: forbid browsing versions on closed pull request.
+- Pull requests: allow super-admins to delete pull requests instead of only owners.
+- Diffs: support mercurial copy operation in diffs details.
+- SVN: escape special chars to allow interactions with non-standard svn paths.
+  Path with special characters such as '#' will no longer trigger 404 errors.
+- Data grids: fix some styling and processing text display.
+- API: use consistent way to extract users, repos, repo groups and user groups
+  by id or name. Makes usage of Number vs String to differentiate if we pick
+  object ID or it's name this will allow editing of objects by either id or
+  it's name, including numeric string names.
+- API: validate commit_id when using commit_comment API
+- API: cleanup sessions enforce older_then must be a valid INT.
+
+
+Upgrade notes
+^^^^^^^^^^^^^
+
+- Auth-tokens: a builtin token will be migrated for all users into a custom
+  external token. We advise to inform users that the current builtin tokens
+  will now show as external ones. Builtin tokens were removed to allow expiring
+  ,or removing them. It's now possible to create users without any tokens.
+
+  From now on new users needs a new token generation in case they want to use
+  token based authentication.
+
+- Hooks: we added via migration a pre transaction hook for Mercurial. If you're
+  using a custom code inside pre-push function of rcextensions make sure it
+  will not block your pushes.

docs/release-notes/release-notes.rst

@@ -9,6 +9,7 @@ Release Notes
 .. toctree::
    :maxdepth: 1
 
+   release-notes-4.7.0.rst
    release-notes-4.6.1.rst
    release-notes-4.6.0.rst
    release-notes-4.5.2.rst