Release of v0.10.0

[anonymoususer72041]

When do we want to release v0.10.0?

I suggest to create a new release after merging up to #706 or #724.

Keep in mind that current version 0.9.7.4 still is vulnerable to CSRF and XSS.

[RussH]

yep, good to get a Security release out sooner rather than later, then move to a php 8.x release for subsequent releases

[anonymoususer72041]

Do you want to merge up to #706 or #724 so we can release v0.10.0?

[RussH]

yes, lets have a target. I'm a bit hectic elsewhere so happy to work to your recommendations here. Lets get to 706 or we'll never release

[anonymoususer72041]

Then I would suggest to go on with #704 and not to wait for @spcaeo to finish his work in #703 for now so we can release as soon as possible.

[anonymoususer72041]

Current roadmap to release v0.10.0:

• Merging fix: preserve job order regarding when editing #704
• Merging refactor: migrate MyISAM tables to InnoDB #705
• Merging security: restrict AJAX during upgrade and escape installer config writes #706
• Merging refactor: stop persisting inline HTML for status change activity notes #713
• Merging feat: standardize status change activity logging #741
• Merging fix: add file-based cache busting for JavaScript and stylesheet assets #749
• Merging security: escape activity notes before applying nl2br #751
• Merging fix: normalize candidate activity note escaping #757
• Merging security: harden template output escaping #761
• Merging fix: correct migration 377 regex escaping #804

Optional for a PHP 7.4 minimum-version upgrade:

• Merging chore: remove legacy testing infrastructure #754
• Merging refactor: migrate bundled lib dependencies to Composer #755
• Merging chore: modernize PHPUnit 8 test setup and deprecated APIs #756
• (Merging chore: remove legacy lib files #778)
• Merging chore: upgrade to PHP 7.4 #787

[anonymoususer72041]

Issues #735, #739 and #740 aren't relevant anymore but instead I would like to merge #749 before creating a release.

[anonymoususer72041]

@RussH what do you think about adding a merge of #741 to our to do list so #737 standalone is not just noise for v0.10.0?

[RussH]

I have no issues with this feature being added

[RussH]

#704 is failing CI/CD tests, will comment on the PR - can't merge until it's passing

#704 Merged

[anonymoususer72041]

Based on your feedback under #749, @RussH, I've just added #751 to the roadmap.

[RussH]

@anonymoususer72041 you want to merge #750 first to improve testing?

[anonymoususer72041]

Done

[anonymoususer72041]

@RussH are you okay if we set a deadline to release v0.10.0 no later than April 27, 2026?

[anonymoususer72041]

//push

[anonymoususer72041]

@RussH any new deadline to release v0.10.0?

[anonymoususer72041]

@RussH I am currently working on a PHP 7.4 branch, which should also serve as a useful preparatory step toward PHP 8.

I think it would make sense to include this branch in the v0.10.0 release as well.

Would it be possible to merge PRs #754 and #755 in the near term so I can continue working on the PHP 7.4 branch on a clean basis?

[anonymoususer72041]

Additionally #756 needs to be merged

[anonymoususer72041]

It would also remove diff noise, if we could merge #778.

[anonymoususer72041]

@RussH if you are currently unable to review #756, #778 and #787, I can send you a changelog or create a draft release without changes regarding PHP 7.4, so we can finally release v0.10.0. Please let me know.

[anonymoususer72041]

@RussH since I've now merged #756 and #778, only #787 is leftover for review.

Please take a look if you are okay with the changes, otherwise I will merge them on my own on 1st of June.

[RussH]

based on where we are I'll tag and generate a new 0.9.8 release, hopefully today.

[anonymoususer72041]

Please take a look onto #791 as this could mess things up if we do not include it into this release.

[RussH]

#791 merged.. Anything else before 0.9.8?

[anonymoususer72041]

Seems fine for me to release now, if you include the additional security fix provided via mail after reviewing it.

Do we want to release as version v0.9.8.0 or v0.10.0? I would suggest to switch to consistent semantic versioning, so I would prefer v0.10.0.

[anonymoususer72041]

@RussH answer via email regarding v0.9.8.0/v0.10.0:

My current thinking is that, once the outstanding PRs have been reviewed and merged, we'll proceed with a v0.10.0 release.

[anonymoususer72041]

@RussH from my side we are now ready to release v0.10.0. Can you create the release, please?

After release we need to remember updating the fixed versions of the last published security advisories.