revel-backend

v1.63.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Productivity & Wikis

✓ No known CVEs patched

This release patches 1 known CVE

Affected surfaces

deps

ReleasePort's take

Moderate signal

editorial:auto 1mo

The release bumps tornado to version 6.5.7, which fixes CVE‑2026‑49854.

Why it matters: CVE severity is high (score 90); upgrade tornado to 6.5.7 immediately if you use it.

AI summary

Updates scripts, deps, and ci across a mixed release.

Type	Severity	Summary	CVE
Security	Critical	Bump tornado to 6.5.7 fixing CVE-2026-49854 Bump tornado to 6.5.7 fixing CVE-2026-49854 Source: llm_adapter@2026-06-13 Confidence: high	—
Feature	Low	Add --ip and --user-agent filters to loki_logs.py script Add --ip and --user-agent filters to loki_logs.py script Source: llm_adapter@2026-06-13 Confidence: high	—
Performance	Medium	Cache Django‑Solo singletons to eliminate SiteSettings N+1 queries Cache Django‑Solo singletons to eliminate SiteSettings N+1 queries Source: llm_adapter@2026-06-13 Confidence: high	—

Full changelog

feat(scripts): add --ip and --user-agent filters to loki_logs.py by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/497
docs: add postmortem 0003 by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/499
fix(deps): bump tornado to 6.5.7 for CVE-2026-49854 by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/500
chore(ci): bump GitHub Actions to Node 24 runtimes by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/501
fix(perf): cache django-solo singletons to kill SiteSettings N+1 by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/502

Full Changelog: https://github.com/letsrevel/revel-backend/compare/v1.63.0...v1.63.1

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track revel-backend

Get notified when new releases ship.

About revel-backend

The Django backend of the Revel event platform project

v1.72.1 Makes payment base fields (`amount`, `currency`, `platform_fee`) read-only
v1.72.1 Restricts organization ownership transfer to superusers only
v1.71.0 Checkout flow now uses a two-step reserve then session creation process.
v1.68.0 check-in endpoint path renamed to use ticket code (UUID or series:<uuid>) instead of ticket ID.