Wiki: Hub Release Notes

Release 2026-11-06 12:25

🐛 Fixes

• Exchanges: entries are shown as soon as the Exchanges feature is available. Before, they were only published with the conference, so the list stayed empty while the conference wasn't published yet (!1759).
• Tag order: an object's tags are listed by name again, in the export, APIv2 and the c3nav integration. Since tags switched to UUID keys, their order had been random (!1747).
• Dark mode in the backoffice and account pages (!1757):
  • autofilled login fields no longer keep the browser's light background
  • the assembly team's action buttons and the export's select button are visible in dark mode
  • badges (decision by, token validity, superuser) use theme-aware colours
  • the moderation card headers are readable in light mode again
  • the assembly phase stepper has enough contrast in dark mode
  • border colours follow the theme

Release 2026-11-03 22:50

🔒 Security

Fixes from a private security report (!1756)

• Event permissions: plain event participants could manage events. Managing now requires the manage right, and the event overview is open to everyone who can access the event, without the publication and delete controls.
• Invitations can only be decided once. Before, an accepted, rejected or withdrawn invitation could be accepted again, so a removed member could rejoin.
• Management teams are linked directly instead of being looked up by name. A team named like an assembly's management team could gain management rights over that assembly.
• Widget pages are escaped. The start and "under construction" pages are stored in a protected wiki namespace (hub) that only staff and the Hub Team can edit.
• APIv2:
  • blocked users can no longer use the API, and blocking deletes their API and OIDC tokens
  • session cookie authentication requires the CSRF token for unsafe methods
  • read_private no longer lists objects before publication
  • sending messages requires a ticket, as on the website
  • the hidden POST /api/assemblies/ endpoint is removed
• Backoffice:
  • stricter permission checks for management and staff pages
  • badges and their tokens are limited to the assembly's own
  • assemblies only see their own OIDC clients
  • creating an assembly checks the registration window
• Assembly import is limited and validated. Remote images are only downloaded from public addresses.
• Public schedule exports only public attachments.
• Ticket redemption logs the user in through allauth first.

✨ Features

Case-insensitive Unicode tags (!1744, !1752)

• Tags keep the spelling they were entered with, and may use any script (iOS, C++, Löten). iOS, IOS and ios are one tag, while café and cafe stay two.
• Allowed are letters, digits and - _ . + # & ', up to 50 characters. Spaces become hyphens.
• Tag changes on events, projects and assemblies are logged in the activity log.
• Tag moderation in the backoffice

Tag picker (!1743)

• The tag fields of events, projects and assemblies show the selected tags as pills, with a combobox that suggests existing public tags: the 10 most used ones when empty, otherwise the matches while typing.
• Unknown tags are offered as "Create new tag". Commas and pasting work as before.
• Additions and removals are announced to screen readers.
• Without JavaScript, the comma-separated text field remains.

OIDC consent and scopes (!1742)

• The consent screen groups the scopes and offers quick choices.
• OIDC clients can require scopes. Only reading scopes can be default scopes, and only superusers can set others. openid is always allowed and is always a default.
• OIDC clients are created on their own page, which keeps the assembly authentication page readable.

SVG banners (!1703, closes #1052)

• Assemblies, events, rooms, projects and tracks accept SVG banners.
• All SVGs (banners, the conference logo, branding assets) go through one sanitizer, based on py-svg-hush. This also closes a gap where HTML elements in the SVG namespace got through the logo sanitizer.
• SVGs must have a positive size.

Event lists (!1749, closes #1010)

• The frontend event lists show speakers and languages.

🐛 Fixes

• Timezones (!1753, !1754): users can no longer set their own timezone. All times are shown in the conference's timezone. Before, Django templates used the server's TIME_ZONE.
• Assembly import: event times are converted correctly (!1750, closes #957).
• Settings (!1746):
  • MFA recovery codes work again (the setting had a typo)
  • the uffd configuration check now covers UFFD_API_USER
  • DJANGO_SECRET_KEY_FILE is read outside DEBUG too
  • avatars follow USER_AVATAR_FILE_SIZE_LIMIT
• Backoffice: the event lists show all events the user can access, not only those they manage (!1756).
• Docker: fixed the path for render_error_pages in app.sh (!1741).\

Release 2026-10-29 19:50

✨ Features

BCP47 languages for events (!1679)

• Events have an ordered list of languages instead of a free-text field. The first one is the primary language.
• Languages come from a curated list:
  • a short preselection (de, en, DGS, International Sign, …)
  • all current ISO 639-1 languages, regional variants and sign languages
  • further regional languages such as nds, gsw and yue
• Tags are normalized against the IANA registry: only deprecated subtags are replaced (iw → he, sgn-DE → gsg). Display names follow the active UI language.
• Backoffice: event languages are edited as ordered rows with a combobox that searches by name or tag. Every change is logged in the activity log. Without JavaScript, a full select and empty extra rows work instead.
• Schedule import and c3lingo parse language tags or names. Valid tags from external sources are stored as inactive languages.
• APIv2:
  • new GET /languages/ and GET /languages/{tag}/, filterable by tag, sign language and search
  • events have a new languages list
  • the language filter takes BCP47 tags and matches events that have at least one of them
• Schedule2 exports the languages as BCP47 tags, as agreed with the app developers.
• Assembly export and import use the new languages. Older exports with the free-text language can still be imported.

Unified navigation across the platform (!1686, !1724)

• The frontend, backoffice and account pages share the same header menus in the same order: account, language, a service switcher (website, backoffice, account, API docs) and messages.
• The account pages use the backoffice layout. On phones, their navigation turns into a scrolling tab bar.
• The backoffice and account pages follow the frontend's dark theme, with higher-contrast sidebar colours that meet WCAG AA.
• In the mobile drawer, the header buttons become labelled tiles with touch targets of at least 44px.

Error pages (!1736)

• New built-in 400 and 429 pages, plus a custom page for CSRF failures that shows the reason.
• nginx serves the error pages that the backoffice renders for 403, 404, 413 and 502–504, and falls back to the built-in ones.

Unread conversations (!1735)

• Unread conversations get a red badge in the backoffice, like unread messages.
• The personal messages inbox lists the managed assemblies that have unread conversations, and the header badge counts them too.

Link forms (!1679)

• Link rows get a delete toggle button and use the full width. The link type help text moved into a tooltip.

🐛 Fixes

• Backoffice: the dynamic formsets (links, languages) work without JavaScript. Before, "Add link" did nothing (!1679).
• Accessibility (!1686, !1724):
  • the account sidebar and the service switcher mark the current page
  • duplicate IDs between the header and the mobile drawer are removed
  • the user menu is a proper, translated <nav>
  • decorative icons are hidden from screen readers
• Legal footer: it's translated now (it was hard-coded in German), and no longer covers the login button on short screens (!1686).
• Theme colours: the navigation editor, the ticket redeem page and the assembly progress bar now work in dark themes (!1724).