⬆ bump radicale from 3.7.5 to 3.8.0

[dependabot]

Bumps radicale from 3.7.5 to 3.8.0.

Release notes

Sourced from radicale's releases.

3.8.0 Features+Fixes+Improvements+Adjutments+Extensions

Features

• Feature: [sharing] add sharing-by-group/realm
• Feature: [group] with type "htgroup", "none", "from_auth" (NEW)
  • In case [auth] type=ldap and LDAP groups should be continued to be used, extend config with [group] type=from_auth

Fixes

• Fix: storage/multifilesystem: depth:1 PROPFIND no longer re-runs the filesystem collision check (path_to_filesystem) for every item in a collection; this made listing large collections O(n^2) on file systems not detected as collision-free
• Fix: pathutils: detect missing permission to create symbolic link on Microsoft Windows
• Fix: sharing-by-token: requests to dedicated items

Improvements

• Improve: storage/multifilesystem: avoid redundant stat() calls per item in get/upload when use_mtime_and_size_for_item_cache is enabled

Extensions

• Extension: [auth] type "pam": set groups of user to be used later
• Extension: [hook] add option for "smtp_password_file"
• Add: [group] group_collections_folder replacing hardcoded "GROUPS"

Adjustments

• Adjustment: reject usernames starting or ending with "@" or having more than one "@"
• Adjustment: reject usernames containing ":" or ","

3.7.8 Fixes+Improvements

Fixes

• Fix: time-range filter on a VTODO having DTSTART/DUE and also CREATED/COMPLETED used the CREATED->COMPLETED duration instead of the DTSTART->DUE one, so completed tasks were missing from (or wrongly returned by) calendar-query REPORT results
• Fix: sharing/proppatch: reject in case of write-access but 'p' is in permissions
• Fix: sharing/by-map: catch collection path without trailing / (supporting "pimsync")

Improvements

• Add: [report] max_expand_occurrence option to separate from max_freebusy_occurrence
• Add: [system] max_vevent_rrule_occurrence option to catch DoS by problematic RRULE early enough (workaround for missing protection in current vobject version)

[!NOTE]

• planned to be the last release of 3.7.x

[!WARNING]

• upcoming 3.8.0 will be enhanced with sharing-by-group/realm feature, internal technical limitations leads to required enhanced username syntax check, following (unusual) usernames will be no longer supported:
  • ⛔ username starts or ends with @
  • ⛔ username containing more than one @
  • ⛔ username containing :

3.7.7 Fixes

Fixes

• Fix: web plugin helpers httputils.serve_resource/serve_folder ignored their mimetypes and fallback_mimetype parameters and always used the built-in mapping, so custom web plugins could not serve additional file types with a correct Content-Type
• Fix: free-busy REPORT always failed with HTTP 400 ("FREEBUSY occurrences limit of 0 hit") when [reporting] max_freebusy_occurrence is set to 0 (limit disabled), because the limit check did not honor the disabled limit
• Fix: time-range filter treated a VEVENT with a whole-day DURATION (e.g. P1D, P2D) as zero-length (timedelta.seconds instead of total_seconds), so such events were missing from calendar-query REPORT results
• Fix: calendar-data expand (REPORT) left recurrence properties (e.g. RDATE) on the expanded single-occurrence VEVENTs; a single try/except around the sequential delattr() calls stopped at the first absent property (e.g. missing EXDATE), so later ones were never removed

... (truncated)

Changelog

Sourced from radicale's changelog.

3.8.0

• Fix: storage/multifilesystem: depth:1 PROPFIND no longer re-runs the filesystem collision check (path_to_filesystem) for every item in a collection; this made listing large collections O(n^2) on file systems not detected as collision-free
• Improve: storage/multifilesystem: avoid redundant stat() calls per item in get/upload when use_mtime_and_size_for_item_cache is enabled
• Feature: [sharing] add sharing-by-group/realm
• Feature: [group] with type "htgroup", "none", "from_auth" (NEW)
• Extension: [auth] type "pam": set groups of user to be used later
• Adjustment: reject usernames starting or ending with "@" or having more than one "@"
• Adjustment: reject usernames containing ":" or ","
• Add: [group] group_collections_folder replacing hardcoded "GROUPS"
• Fix: pathutils: detect missing permission to create symbolic link on Microsoft Windows
• Fix: sharing-by-token: requests to dedicated items
• Extension: [hook] add option for "smtp_password_file"

3.7.8

• Fix: time-range filter on a VTODO having DTSTART/DUE and also CREATED/COMPLETED used the CREATED->COMPLETED duration instead of the DTSTART->DUE one, so completed tasks were missing from (or wrongly returned by) calendar-query REPORT results
• Fix: sharing/proppatch: reject in case of write-access but 'p' is in permissions
• Fix: sharing/by-map: catch collection path without trailing / (supporting "pimsync")
• Add: [report] max_expand_occurrence option to separate from max_freebusy_occurrence
• Add: [system] max_vevent_rrule_occurrence option to catch DoS by problematic RRULE early enough (workaround for missing protection in current vobject version)

3.7.7

• Fix: web plugin helpers httputils.serve_resource/serve_folder ignored their mimetypes and fallback_mimetype parameters and always used the built-in mapping, so custom web plugins could not serve additional file types with a correct Content-Type
• Fix: free-busy REPORT always failed with HTTP 400 ("FREEBUSY occurrences limit of 0 hit") when [reporting] max_freebusy_occurrence is set to 0 (limit disabled), because the limit check did not honor the disabled limit
• Fix: time-range filter treated a VEVENT with a whole-day DURATION (e.g. P1D, P2D) as zero-length (timedelta.seconds instead of total_seconds), so such events were missing from calendar-query REPORT results
• Fix: calendar-data expand (REPORT) left recurrence properties (e.g. RDATE) on the expanded single-occurrence VEVENTs; a single try/except around the sequential delattr() calls stopped at the first absent property (e.g. missing EXDATE), so later ones were never removed
• Fix: text-match filter on a structured property (e.g. vCard N or ADR) crashed with HTTP 500 (AttributeError: 'Name'/'Address' object has no attribute 'lower') because vobject parses these into non-string objects; their text representation is now used
• Fix: sharing bday-to-ICS conversion assigned the empty-FN fallback marker to the {nickname} placeholder instead of {fn}, so a VCARD with an empty FN got its NICKNAME overwritten with "!fn!" in the generated SUMMARY/DESCRIPTION and the {fn} fallback never resolved
• Fix: sharing/delete: add forgotten backmap

3.7.6

• Extension: item verification on commandline
• Improvement: catch lack of support of PERIOD in vobject <= 0.9.9
• Fix: sharing: backmap of REPORT/PROPPATCH hrefs is now URL-encode-aware (edit of a shared collection failed when the principal contains '@')
• Workaround: remove trailing spaces on TZID and TZNAME appended by buggy Microsoft clients
• Extension: [auth] imap_append_domain option (optional)

Commits

• eff8027 Release 3.8.0
• a43bb0b Merge pull request #2223 from maxberger/master
• 06e6a3e Merge pull request #2222 from maxberger/groups
• ad5ba70 Integ tests: Increased rebustness
• 9ee5d07 Added missing de-duplication of incoming group shares
• 88339fe Merge pull request #2221 from pbiering/pr-2210-superseed
• c2789b7 clarifications
• 955b46d Clarify Permission denied errors for storage paths.
• fcc7536 Merge pull request #2220 from pbiering/pr-2209-superseed
• 1835cbf hook: extend/add copyright
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: internal. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.