What's New in Review Board

Our focus for this release was to get a few crucial bug fixes backported from Review Board 2.0.x, and to also help in your migration to Review Board 2.0.x.

First, security fixes. Django just announced new security releases today, which may affect your server, especially if it's publicly accessible.

There are fixes for SVN keyword handling, broken file attachment mimetypes, and the ability to close another user's review requests (if you're an administrator).

We've also backported our optimized diff migration code from 2.0. Now, when you view older diffs, we'll flag them to be de-duplicated, helping to reduce your database size. If you view two revisions of a change and the diff content for a file is the same between both, we'll end up only storing that content once.

You can also run the following to go through and de-duplicate all your diffs, which will help reduce the migration time to 2.0.x:

sudo rb-site manage /path/to/site condensediffs

To upgrade to Review Board 1.7.28, run:

sudo easy_install ReviewBoard==1.7.28

See the release notes for more information on this release.

We've just released a new build of Power Pack, our premium set of features for Review Board. Power Pack includes support for GitHub Enterprise, PDF review, and more.

Power Pack 1.0.4 makes it easier to install a trial license for the first time, or to purchase a full license, removing one of the pains of getting up-and-running with Power Pack.

It also enhances PDF support by fixing several bugs, better handling edge cases, and improving performance.

There are also improvements to Review Board 2.0.x compatibility, and other assorted bug fixes.

See the release notes for more information.

To install or upgrade Power Pack, simply run:

sudo easy_install -U ReviewBoardPowerPack

Just a reminder, we're still taking sign-ups for the new Power Pack Reports beta!

Over the past few days, we noticed that some upgrades from pre-2.0 to 2.0.4 were failing. This was due to a bug in Django Evolution, a sister project that helps with our database upgrades. We since temporarily pulled the release to prevent any major problems from occurring.

We have since fixed the problem in Django Evolution, have restored 2.0.4, and are now bringing you 2.0.5.

2.0.5 requires the new Django Evolution, fixing the upgrade woes. It also fixes issues reported to us over the past few days with multi-line text fields, re-opening closed review requests as an administrator, and more. We've also added commit IDs/revisions to the list of commits in the New Review Request page.

See the release notes for the full list of changes.

We have two new Review Board releases for you tonight. Both fix a couple security vulnerabilities that came to our attention, as well as several other bugs. There are also a few new feature additions.

One of the security vulnerabilities allowed an attacker to construct a URL that would inject custom JavaScript into the page, which could then be passed to a user, allowing the custom code to run in their session.

The other vulnerability allowed users without access to a private review request to construct a URL for accessing original or patched files from the repository, if they knew the right series of database IDs.

Feature-wise, 1.7.27 gained a few of the recent additions to review UIs, support pages, and API that were introduced in 2.0.3.

2.0.4 gained support for uploading parent diffs in the New Review Request page.

If you're upgrading to 1.7.27, you'll need to run:

sudo easy_install ReviewBoard==1.7.27

For the full list of changes, see the 1.7.27 and 2.0.4 release notes.

We have two exciting announcements for you today!

Review Board 2.0.3

The first, which you've already guessed, is a brand-new Review Board release. In 2.0.3, you'll find a number of long-requested bug fixes, and some new features.

The highlights include:

• Empty files can now be posted for review.
• Users can now log in with their e-mail addresses instead of their usernames.
• Long, unbreakable lines in the diff viewer now wrap properly in all cases.
• GitLab v6.8+ servers with over 100 repositories now work.
• Far more useful sample crontab files, which are now auto-generated when upgrading your site.
• Counters in the dashboard should finally be fixed!
• Interdiffs are more reliable.
• Lots of Unicode-related bug fixes for diffs and Subversion have been squashed.

All-in-all, there are 23 bugs fixed in this release, and a few more new features we didn't even mention.

See the release notes for the full details.

Oh, and it also links to the new Package Store. And that brings us to:

The Review Board Package Store!

Today, we're happy to introduce the all-new Review Board Package Store, the new home for extensions and software that work with Review Board.

Administrators and end-users can browse the store for software to see what's out there to improve their Review Board experience.

Developers can post what they've made, show it off with screenshots, and let users know what's new with new release announcements.

The store is brand new, so we only have a few things up there right now. If you're a developer writing software that integrates with Review Board on any level, we'd like to encourage you to add it to the store.

We welcome any feedback on the new store. Bug reports, category suggestions, new features, or anything else that would make your life easier.

This evening's release of RBTools 0.6.2 fixes several bugs throughout rbt post and rbt patch.

Mercurial users will find that rbt patch now behaves as expected especially for Git diffs. No need to manually fetch and patch by hand anymore.

We've fixed some breakages that users hit with error messages coming from Review Board under certain conditions, and some compatibility issues with Perforce, ClearCase, and Git.

See the release notes for the full list of changes.

Today's release of Review Board 2.0.2 brings a couple new features, some performance improvements, and several important bug fixes.

Earlier this week, we introduced per-user e-mail options in 1.7.26, which has now made its way into the 2.0 series. You can also now upgrade from a 1.7.26 release to 2.0.2 (sorry about that!).

We made some improvements to the API response times, which will benefit RBTools and much of the Review Board website. Along with this, we've done a lot of work to massively reduce the time it takes to update the search index.

The stars of this release, though, are the bug fixes:

• Clicking links and selecting text in editors now works as you'd expect.
• Replying twice to a review no longer keeps that draft banner sticking around.
• Solved some issues with fetching files on Mercurial repositories.
• Added some bullet-proofing for repository encodings.
• Attempting to reset user passwords no longer results in expired links.
• Lots of fixes to the administration UI.
• Much more!

Subversion in particular got a lot of love in this release:

• Verifying SSL certificates for HTTPS-based repositories now works again.
• The New Review Request page has been updated to properly filter commits based on the selected branch.
• PySVN is now the default backend again, but it's possible to choose your preferred backend.

See the release notes for the full list of changes.

Today's release of Review Board 1.7.26 fixes an important security vulnerability allowing attackers to craft very small JavaScript snippets in the diff viewer. If you're running 1.7.x, we recommend that you upgrade to this release immediately.

Along with that important fix, we have a new feature for you, and a small handful of bug fixes.

We adde a per-user setting that allows users to choose whether to receive e-mail from Review Board. This includes new and updated review requests, and discussions on review requests. If you're in the habit of checking the dashboard, and don't want to clutter your Inbox, this may be useful to you. Please note though that you'll still receive e-mail going to any mailing lists you're subscribed to.

There's also some bug fixes for CVS compatibility, API fixes for repository creation, encoding fixes for non-ASCII diffs, and more.

To upgrade to this release, run:

sudo easy_install ReviewBoard==1.7.26

See the release notes for more information.

Today's release of RBTools 0.6.1 fixes a number of bugs found in 0.6. These range from Review Board compatibility fixes and improved repository support to better error handling and fewer crashes.

There's also a few new additions:

• You can now set the "Depends On" list on a review request by passing --depends-on to rbt post.
• When running against the in-development Review Board 2.1 release, you'll be able to reliably post empty files (such as Python's __init__.py) for review, and apply them locally using rbt patch.
• rbt setup-repo is quite a bit smarter about finding your repository, especially when the paths differ in some way.

There's something for everyone in this release. If you've been running 0.6, you'll want to grab this one.

See the release notes for the full list of improvements.

Today, put out two new security releases of Djblets, our utility library for Review Board. These are versions 0.7.30 and 0.8.3, and fix a couple XSS vulnerabilities that were discovered in our Gravatar support and JSON serialization code.

We are strongly recommending that everyone upgrade to these releases, particularly if you're running a public Review Board server.

If you're running Review Board 2.0.x, you can upgrade by typing:

sudo easy_install -u Djblets

If you're running Review Board 1.7.x, you will need to upgrade by typing:

sudo easy_install Djblets==0.7.30

The Djblets 0.7.30 release has only been tested with Review Board 1.7.25. If you're on an older version, we recommend upgrading Review Board as well, to ensure better compatibility, and to benefit from the additional fixes in that release.

See the 0.7.30 release notes and 0.8.3 release notes for more information.