Security updates
- Upgrade django to 4.2.17
Bugfixes/QOL
- Change
LOG_STDOUT
default value to True - Re-add separate
CELERY_LOGLEVEL
configuration setting
New Features
- Add
SESSION_COOKIE_AGE
configurable setting - Add user session management admin
Note
SessionProfile admin should be added to admin index and its fixture.
Bugfixes/QOL
- fix runtime configuration for django-log-outgoing-requests
Bugfixes/QOL
- Change SESSION_COOKIE_SAMESITE to "Lax" to fix OIDC (#72)
- Remove url from SECRET_KEY help text (#76)
- Change CSP headers to support API schema page
New features
- Add Django CSP with configurable settings
- Add SECURE_HSTS_SECONDS and CSRF_COOKIE_HTTPONLY settings
Warning
SECURE_HSTS_SECONDS has been added with a default of 31536000 seconds, ensure that before upgrading to this version of open-api-framework, your entire application is served over HTTPS, otherwise this setting can break parts of your application (see https://docs.djangoproject.com/en/4.2/ref/middleware/#http-strict-transport-security)
Bugfixes/QOL
- Fix rendering for envvar defaults (previously quotes were escaped)
- Move
CACHE_DEFAULT
,CACHE_AXES
,EMAIL_HOST
envvars to Required group (because they are required for Docker) - Add CI job to check if all envvars are either documented or excluded from documentation
Bugfixes
- Add missing help_text for SESSION_COOKIE_SAMESITE and CSRF_COOKIE_SAMESITE envvars
New features
- Management command to generate documentation for environment variables
- Made SESSION_COOKIE_SAMESITE and CSRF_COOKIE_SAMESITE configurable via environment variables (default
Strict
)
Project maintenance and QOL
- Updated dependencies:
- django
4.2.11+
to4.2.14+
- django-axes
6.3.0+
to6.5.1+
- django-cors-headers
4.3.1+
to4.4.0+
- django-jsonform
2.21.4+
to2.22.0+
- djangorestframework
3.12.4+
to3.15.2+
- django-filter
23.2+
to24.2+
- drf-spectacular
0.27.0+
to0.27.2+
- mozilla-django-oidc-db
0.14.1+
to0.19.0+
- requests
2.31.0+
to2.32.3+
- sentry-sdk
1.39.2+
to2.11.0+
- elastic-apm
6.20.0+
to6.22.0+
- celery
5.2.7+
to5.4.0+
- maykin-2fa
1.0.0+
to1.0.1+
- django
New features
- Use the callback class from mozilla-django-oidc-db to allow for a custom error view
New features
- Add password to
AXES_SENSITIVE_PARAMETERS
- Use stricter
django-axes
settings AXES_FAILURE_LIMIT
changed from10
to5
AXES_COOLOFF_TIME
changed from1
to5
minutes
- Use stricter
- Make more
log-outgoing-requests
settings configurable LOG_OUTGOING_REQUESTS_EMIT_BODY
(defaultTrue
)LOG_OUTGOING_REQUESTS_DB_SAVE_BODY
(defaultTrue
)
- Make more
- Add base template to display current version in admin
Bugfixes
- Remove FIXTURE_DIRS setting and add root level app to INSTALLED_APPS
Other
- Move documentation to readthedocs
Bugfixes
- Add missing settings for
TWO_FACTOR_WEBAUTHN
Bugfixes
- Add
ordered_model
toINSTALLED_APPS
(required fordjango-admin-index
) - Add
two_factor.plugins.webauthn
toINSTALLED_APPS
(required formaykin_2fa
)
New features
- Add django-setup-configuration to deps
- Add ELASTIC_APM_TRANSACTION_SAMPLE_RATE
New features
- [#14] Add django-log-outgoing-requests to deps
- [open-zaak/open-zaak#1629] Add generic base settings file
New features
- Add support for python 3.10
- Upgrade to Django 4.2
- Add maykin-2fa
- Initial release as a metapackage to pin several dependencies