
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
.. image:: https://github.com/zopefoundation/Products.DCWorkflow/workflows/tests/badge.svg :target: https://github.com/zopefoundation/Products.DCWorkflow/actions?query=workflow%3Atests
.. image:: https://coveralls.io/repos/github/zopefoundation/Products.DCWorkflow/badge.svg :target: https://coveralls.io/github/zopefoundation/Products.DCWorkflow
.. image:: https://img.shields.io/pypi/v/Products.DCWorkflow.svg :target: https://pypi.org/project/Products.DCWorkflow/ :alt: Current version on PyPI
.. image:: https://img.shields.io/pypi/pyversions/Products.DCWorkflow.svg :target: https://pypi.org/project/Products.DCWorkflow/ :alt: Supported Python versions
This product provides fully customizable workflows for the CMF portal_workflow tool.
Fix insidious buildout configuration bug for tests against Zope 4.
Add support for Python 3.11.
New features:
New features:
Bug fixes:
Avoid a deprecation warning when importing gather_permissions
(#20 <https://github.com/zopefoundation/Products.DCWorkflow/issues/20>
_)
Avoid a TypeError when adding a managed group to a workflow
(#18 <https://github.com/zopefoundation/Products.DCWorkflow/issues/18>
_)
Add support for Python 3.8.
Fix import of scripts.
Prepare for Python 2 / 3 compatibility
Import permissions directly from CMFCore and deprecate the permissions module in Products.DCWorkflow
Use decorators for ZCA and to declare security.
Removed string exceptions. (https://bugs.launchpad.net/zope-cmf/+bug/952301)
Made sure converted tools are used as utilities.
StateChangeInfo: Removed support for deprecated '_isPortalRoot' marker.
Hardened XML import parsing against missing boolean attributes. (https://bugs.launchpad.net/zope-cmf/+bug/707927)
Ensured that emitted XML export has a valid encoding, even when passed 'None'. (https://bugs.launchpad.net/zope-cmf/+bug/707927)
Change default encoding of exports from None to utf-8.
Require at least Zope 2.13.12.
Fixed issue with non-ascii chars in workflow definitions
Don't crash worklist's manage_main
if variables are Expression objects.
(https://bugs.launchpad.net/zope-cmf/+bug/731394)
Allow renaming of states, transitions, variables and worklists
Fixed Chameleon compatibility in state_groups.pt
.
Workflow states cannot be renamed through the ZMI. (https://bugs.launchpad.net/zope-cmf/+bug/625722)
moved the Zope dependency to version 2.12.0b3dev
Worklists: The catalog variable match setting can now be a formatted string (as before), but also a qualified TAL expression, meaning it has a prefix like "string:", "python:". (https://bugs.launchpad.net/zope-cmf/+bug/378292)
exportimport: Support for instance creation guards and manager bypass added. (https://bugs.launchpad.net/zope-cmf/+bug/308947)
Cleaned up / normalized imports:
o Don't import from Globals; instead, use real locations.
o Make other imports use the actual source module, rather than an intermediate (e.g., prefer importing 'ClassSecurityInfo' from 'AccessControl.SecurityInfo' rather than from 'AccessControl').
o Avoid relative imports, which will break in later versions of Python.
Strip trailing newlines in order to properly match with a msgid when translating transition descriptions.
Workflow UI: Remove ancient cruft to accommodate the proprietary (and long dead) base_cms product.
Worklists and Transitions: Add icon expression properties to worklist and transition actions and their GenericSetup profiles.
Fixed an import error (Products.PageTemplates.TALES is gone on Zope trunk). Because we require Zope >= 2.10, we don't need a BBB conditional import.
Testing: Derive test layers from ZopeLite layer if available.
exportimport: Scripts with invalid types imported after scripts with valid types will no longer place the valid script twice. Scripts can also now be specified with meta_types other than the hard-coded meta_types.
AfterTransitionEvent now passes along the new status of the object, just as StateChangeInfo passes on the new status to after-transition scripts. (http://www.zope.org/Collectors/CMF/490)
moved the Zope dependency to version 2.10.4
Remove antique usage of marker attributes in favor of interfaces, leaving BBB behind for places potentially affecting third-party code. (http://www.zope.org/Collectors/CMF/440)
Add POST-only protections to security critical methods. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0240)
Workflow definition instances now have a description field (http://www.zope.org/Collectors/CMF/480)
moved the Zope dependency to verson 2.10.2
Tool lookup and registration is now done "the Zope 3 way" as utilities, see http://svn.zope.org/CMF/branches/2.1/docs/ToolsAreUtilities.stx?view=auto
Merged patches from Martin Aspeli to enable generating events before and after DCWorkflow transitions, and in the 'notify' methods of the workflow tool (http://www.zope.org/Collectors/CMF/461).
moved the Zope dependency to version 2.10.1
Fixed test breakage induced by use of Z3 pagetemplates in Zope 2.10+.
browser views: Added some zope.formlib based forms.
testing: Added test layers for setting up ZCML.
skins: Changed encoding of translated portal_status_messages. Now getBrowserCharset is used to play nice with Five forms. Customized setRedirect and getMainGlobals scripts have to be updated.
Profiles: All profiles are now registered by ZCML.
ZClasses: Removed unmaintained support for ZClasses. Marked the 'initializeBases*' methods as deprecated.
Content: Added IFactory utilities for all content classes. They are now used by default instead of the old constructor methods.
Content: All content classes are now registered by ZCML. ContentInit is still used to register oldstyle constructors.
setup handlers: Removed support for CMF 1.5 CMFSetup profiles.
For a complete list of changes before version 2.1.0-alpha, see the HISTORY.txt file on the CMF-2.1 branch: http://svn.zope.org/CMF/branches/2.1/HISTORY.txt?view=auto
FAQs
DCWorkflow product for the Zope Content Management Framework
We found that Products.DCWorkflow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.