revel-backend

v1.67.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 20d Productivity & Wikis

✓ No known CVEs patched

This release patches 1 known CVE

Summary

AI summary

Updates accounts, fix, and weasyprint across a mixed release.

Full changelog

IP-based geolocation no longer returns garbage results or logs parser warnings under concurrent requests: each worker thread now gets its own IP2Location database handle instead of sharing one non-thread-safe file cursor.
Admins are no longer pinged on Discord when a guest account is created — the new-user notification now fires only for real user signups.

fix(accounts): skip admin Discord notification for guest signups by @florimond-collette in https://github.com/letsrevel/revel-backend/pull/636
fix: make IP2Location handle thread-safe under gthread workers (#637) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/638
chore(deps): suppress CVE-2026-49452 (weasyprint), drop stale aiohttp suppressions by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/640
ci: add no-op twin for path-filtered dependency checks by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/641
chore(release): v1.67.1 by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/642

Full Changelog: https://github.com/letsrevel/revel-backend/compare/v1.67.0...v1.67.1

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track revel-backend

Get notified when new releases ship.

About revel-backend

The Django backend of the Revel event platform project

v1.72.1 Makes payment base fields (`amount`, `currency`, `platform_fee`) read-only
v1.72.1 Restricts organization ownership transfer to superusers only
v1.71.0 Checkout flow now uses a two-step reserve then session creation process.
v1.68.0 check-in endpoint path renamed to use ticket code (UUID or series:<uuid>) instead of ticket ID.