This release includes 1 security fix for security teams reviewing exposed deployments.
Published 27d
Productivity & Wikis
✓ No known CVEs patched
This release patches 1 known CVE
Affected surfaces
deps
Summary
AI summaryBroad release touches events, accounts, billing, and questionnaires.
Full changelog
Fixed
- Recurring events now honor the recurrence rule's timezone, generating DST-correct occurrences; a data migration re-anchors existing non-UTC series so their times no longer drift across daylight-saving boundaries.
- The dashboard RSVP list can now be filtered by multiple statuses at once.
- Telegram: banned users are blocked from interacting with the bot, and the bot's
/unsubscribenow actually stops notifications instead of leaving per-type settings still delivering. - Financial documents are no longer silently lost: payout statements and attendee invoices record when their email was sent, surface delivery errors in the admin, retry undelivered emails via a sweep, and mark documents with no possible recipient as terminally undeliverable instead of re-sending forever.
- A failure sending one referrer's payout statement or email no longer aborts the rest of the payout batch.
Security
- Bumped
python-engineioandpython-socketioto clear newly disclosed CVEs.
What's Changed
- docs(whats-new): list editions in sidebar nav like ADR by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/589
- docs: refresh docs/ against recent changes (1.53.0 → 1.66.0) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/590
- refactor(controllers): hoist repeated endpoint permissions to class level (#595) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/596
- docs: add AI_USAGE.md, AI Disclousre and update README by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/597
- fix(docs): correct per-event revenue endpoint path in 1.64.0 CHANGELOG (#592) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/598
- fix(telegram): block banned users in bot & fix /unsubscribe no-op (#583, #584) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/599
- fix(tooling): correct bootstrap-tests target and dedup seed blacklist entries (#591) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/600
- fix(events): honor RecurrenceRule.timezone with DST-aware occurrences (#594) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/601
- chore(cleanup): remove dead code & redundant user() overrides (#574) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/603
- refactor(common): split god modules models.py and fields.py (#581) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/604
- refactor(accounts): extract RevelUserAdmin display logic into formatters (#576) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/605
- refactor(events): split events/tasks.py into a per-domain package (#575) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/606
- refactor(tasks): package the accounts/events task modules + enforce explicit Celery task names (#607) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/609
- refactor(events): split organization_service god module into a package (#578) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/612
- fix(payouts): isolate statement/email failures from the payout batch (#611) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/615
- fix(billing): track email delivery so financial documents aren't silently lost (#616) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/617
- fix(billing): persist a terminal undeliverable state so no-recipient documents aren't re-swept forever (#618) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/619
- refactor: eliminate cross-module private imports + enforce all/import hygiene (#613, #614) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/620
- refactor(accounts): consolidate 8 email-send wrappers into one template-driven task (#608) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/622
- fix(deps): bump python-engineio/socketio to clear new CVEs by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/624
- refactor(events): decompose the three longest event-service functions (#579) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/625
- refactor(questionnaires): extract SubmissionService before questionnaire_service.py crosses the 1000-line gate (#621) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/626
- fix(events): allow filtering dashboard RSVPs by multiple statuses (#627) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/628
- refactor(questionnaires): split QuestionnaireController into per-resource mixins (#577) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/629
- feat: PR-driven releases + /release command by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/630
- chore(release): v1.66.1 by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/631
Full Changelog: https://github.com/letsrevel/revel-backend/compare/v1.66.0...v1.66.1
Security Fixes
- Bumped python-engineio and python-socketio to clear newly disclosed CVEs
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Earlier breaking changes
- v1.72.1 Makes payment base fields (`amount`, `currency`, `platform_fee`) read-only
- v1.72.1 Restricts organization ownership transfer to superusers only
- v1.71.0 Checkout flow now uses a two-step reserve then session creation process.
- v1.68.0 check-in endpoint path renamed to use ticket code (UUID or series:<uuid>) instead of ticket ID.
Beta — feedback welcome: [email protected]