This release includes 1 security fix for security teams reviewing exposed deployments.
Affected surfaces
ReleasePort's take
Moderate signalThe checkout API now requires a two‑step reserve then session creation workflow. The PATCH endpoint for attendee invoices will coerce null buyer fields to an empty string, preventing 500 errors.
Why it matters: Checkout integrations must be updated to the new two‑step flow; otherwise requests fail. Invoices endpoints will no longer error on null buyer values after upgrade.
Summary
AI summaryUpdates invoices, checkout, and deps across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Upgraded httplib2 from 0.22.0 to 0.32.0 via django-google-sso to patch PYSEC-2026-3444. Upgraded httplib2 from 0.22.0 to 0.32.0 via django-google-sso to patch PYSEC-2026-3444. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Breaking | High |
Checkout flow now uses a two-step reserve then session creation process. Checkout flow now uses a two-step reserve then session creation process. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Bugfix | Medium |
PATCH /organization-admin/{slug}/attendee-invoices/{invoice_id} now coerces null buyer fields to empty string, avoiding 500 errors. PATCH /organization-admin/{slug}/attendee-invoices/{invoice_id} now coerces null buyer fields to empty string, avoiding 500 errors. Source: llm_adapter@2026-07-14 Confidence: high |
— |
Full changelog
Changed
- Online checkout is now a two-step flow that no longer serializes concurrent buyers of the same ticket tier: the checkout call reserves (creates the PENDING tickets/
Paymentrows and returnsreservation_id+requires_payment: true), and the client then POSTs/reservations/{id}/checkout-sessionto obtain the Stripe URL. The ticket-tier/series-pass lock is released before the ~2.5s Stripe call, unblocking same-tier purchases during an on-sale rush. Applies to batch tickets (authenticated and guest, fixed-price and pay-what-you-want) and series passes; session creation is idempotent per reservation, and abandoned reservations are reclaimed by the existing expired-payment cleanup.
Fixed
- Clearing an optional buyer field (e.g. VAT ID), the currency, or the discount-code text on a draft invoice via
PATCH /organization-admin/{slug}/attendee-invoices/{invoice_id}no longer fails with a 500 — anullvalue is now coerced to an empty string, so organizers can save the edit instead of seeing "Failed to update invoice".
Security
- Upgraded httplib2 0.22.0 → 0.32.0 (transitive via
django-google-sso) to patchPYSEC-2026-3444.
What's Changed
- fix(invoices): coerce null buyer fields to "" on draft PATCH (#700) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/701
- feat(checkout): release tier lock before Stripe — reserve/session split (#632) by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/702
- fix(deps): pin httplib2>=0.32.0 to patch PYSEC-2026-3444 by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/704
- chore(release): v1.71.0 by @biagiodistefano in https://github.com/letsrevel/revel-backend/pull/703
Full Changelog: https://github.com/letsrevel/revel-backend/compare/v1.70.0...v1.71.0
Security Fixes
- dep: PYSEC-2026-3444 — upgraded httplib2 from 0.22.0 to >=0.32.0 via django-google-sso
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Beta — feedback welcome: [email protected]