Skip to content

revel-backend

v1.66.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 27d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Affected surfaces

deps

Summary

AI summary

Broad release touches events, accounts, billing, and questionnaires.

Full changelog

Fixed

  • Recurring events now honor the recurrence rule's timezone, generating DST-correct occurrences; a data migration re-anchors existing non-UTC series so their times no longer drift across daylight-saving boundaries.
  • The dashboard RSVP list can now be filtered by multiple statuses at once.
  • Telegram: banned users are blocked from interacting with the bot, and the bot's /unsubscribe now actually stops notifications instead of leaving per-type settings still delivering.
  • Financial documents are no longer silently lost: payout statements and attendee invoices record when their email was sent, surface delivery errors in the admin, retry undelivered emails via a sweep, and mark documents with no possible recipient as terminally undeliverable instead of re-sending forever.
  • A failure sending one referrer's payout statement or email no longer aborts the rest of the payout batch.

Security

  • Bumped python-engineio and python-socketio to clear newly disclosed CVEs.

What's Changed

  • docs(whats-new): list editions in sidebar nav like ADR by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/589
  • docs: refresh docs/ against recent changes (1.53.0 → 1.66.0) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/590
  • refactor(controllers): hoist repeated endpoint permissions to class level (#595) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/596
  • docs: add AI_USAGE.md, AI Disclousre and update README by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/597
  • fix(docs): correct per-event revenue endpoint path in 1.64.0 CHANGELOG (#592) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/598
  • fix(telegram): block banned users in bot & fix /unsubscribe no-op (#583, #584) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/599
  • fix(tooling): correct bootstrap-tests target and dedup seed blacklist entries (#591) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/600
  • fix(events): honor RecurrenceRule.timezone with DST-aware occurrences (#594) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/601
  • chore(cleanup): remove dead code & redundant user() overrides (#574) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/603
  • refactor(common): split god modules models.py and fields.py (#581) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/604
  • refactor(accounts): extract RevelUserAdmin display logic into formatters (#576) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/605
  • refactor(events): split events/tasks.py into a per-domain package (#575) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/606
  • refactor(tasks): package the accounts/events task modules + enforce explicit Celery task names (#607) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/609
  • refactor(events): split organization_service god module into a package (#578) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/612
  • fix(payouts): isolate statement/email failures from the payout batch (#611) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/615
  • fix(billing): track email delivery so financial documents aren't silently lost (#616) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/617
  • fix(billing): persist a terminal undeliverable state so no-recipient documents aren't re-swept forever (#618) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/619
  • refactor: eliminate cross-module private imports + enforce all/import hygiene (#613, #614) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/620
  • refactor(accounts): consolidate 8 email-send wrappers into one template-driven task (#608) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/622
  • fix(deps): bump python-engineio/socketio to clear new CVEs by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/624
  • refactor(events): decompose the three longest event-service functions (#579) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/625
  • refactor(questionnaires): extract SubmissionService before questionnaire_service.py crosses the 1000-line gate (#621) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/626
  • fix(events): allow filtering dashboard RSVPs by multiple statuses (#627) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/628
  • refactor(questionnaires): split QuestionnaireController into per-resource mixins (#577) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/629
  • feat: PR-driven releases + /release command by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/630
  • chore(release): v1.66.1 by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/631

Full Changelog: https://github.com/letsrevel/revel-backend/compare/v1.66.0...v1.66.1

Security Fixes

  • Bumped python-engineio and python-socketio to clear newly disclosed CVEs

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track revel-backend

Get notified when new releases ship.

Sign up free

About revel-backend

The Django backend of the Revel event platform project

All releases →

Related context

Earlier breaking changes

  • v1.72.1 Makes payment base fields (`amount`, `currency`, `platform_fee`) read-only
  • v1.72.1 Restricts organization ownership transfer to superusers only
  • v1.71.0 Checkout flow now uses a two-step reserve then session creation process.
  • v1.68.0 check-in endpoint path renamed to use ticket code (UUID or series:<uuid>) instead of ticket ID.

Beta — feedback welcome: [email protected]