diff --git a/.mailmap b/.mailmap index 81e31ea2a1..42f74158ab 100644 --- a/.mailmap +++ b/.mailmap @@ -8,7 +8,10 @@ # For any emails that show up in the shortlog that aren't in one of # these lists, figure out their GitHub username and add them. +GITHUB: aldeed GITHUB: AlexeyMK +GITHUB: apendua +GITHUB: arbesfeld GITHUB: DenisGorbachev GITHUB: EOT GITHUB: FooBarWidget @@ -17,13 +20,17 @@ GITHUB: OyoKooN GITHUB: RobertLowe GITHUB: ansman GITHUB: awwx +GITHUB: cmather GITHUB: codeinthehole GITHUB: dandv +GITHUB: davegonzalez GITHUB: emgee3 GITHUB: icellan GITHUB: jacott GITHUB: jfhamlin +GITHUB: justinsb GITHUB: marcandre +GITHUB: mart-jansink GITHUB: meawoppl GITHUB: michaelbishop GITHUB: mitar @@ -31,7 +38,9 @@ GITHUB: mitar GITHUB: mizzao GITHUB: mquandalle GITHUB: nathan-muir +GITHUB: Neftedollar GITHUB: paulswartz +GITHUB: Pent GITHUB: queso GITHUB: rdickert GITHUB: rgould @@ -48,6 +57,7 @@ METEOR: dgreensp METEOR: estark37 METEOR: estark37 METEOR: glasser +METEOR: glasser METEOR: gschmidt METEOR: karayu METEOR: n1mmy @@ -55,3 +65,4 @@ METEOR: sixolet METEOR: Slava METEOR: stubailo METEOR: ekatek + diff --git a/History.md b/History.md index a067d9aec4..8338651266 100644 --- a/History.md +++ b/History.md @@ -1,7 +1,190 @@ ## v.NEXT +#### Meteor Accounts + * Log out a user's other sessions when they change their password. +* Store pending OAuth login results in the database instead of + in-memory, so that an OAuth flow succeeds even if different requests + go to different server processes. + +* When validateLoginAttempt callbacks return false, don't override a more + specific error message. + +* Add `Random.secret()` for generating security-critical secrets like + login tokens. + +* `Meteor.logoutOtherClients` now calls the user callback when other + login tokens have actually been removed from the database, not when + they have been marked for eventual removal. Fixes #1915. + +* Rename `Oauth` to `OAuth`. `Oauth` is now an alias for backwards + compatibility. + +* Add `oauth-encryption` package for encrypting sensitive account + credentials in the database. + +* A validate login hook can now override the exception thrown from + `beginPasswordExchange` like it can for other login methods. + +* Remove an expensive observe over all users in the `accounts-base` + package. + + +#### Blaze + +* Blaze no longer renders javascript: URLs in attribute values by + default, to help prevent cross-site scripting bugs. Use + `UI._allowJavascriptUrls()` to allow them. + +* Fix `UI.toHTML` on templates containing `{{#with}}` + +* Fix {{#with}} over a data context that is mutated + +* Properly clean up autoruns on `UI.toHTML` + +* Add support for `{{!-- block comments --}}` in Spacebars. Block comments may + contain `}}`, so they are more useful than `{{! normal comments}}` for + commenting out sections of Spacebars templates. + XXX shouldn't this be in spacebars/README.md? + +* Kill TBODY special case in DomRange (XXX 45ac9b1a6d needs a better + description) + +* Do not ignore jquery-event extra parameters (? XXX b2193f5) + + +#### DDP and Mongo + +* DDP heartbeats XXX + +* Generalize the mechanism by which client-side inserts generated IDs to support + latency compensation of generation of multiple random values. For example, + calling `insert` inside a method body will now return consistent IDs on the + client and the server. Code that wants a random stream that is consistent + between method stub and real method execution can get one with + `DDP.randomStream`. + +* The oplog observe driver handles errors communicating with Mongo better and + knows to re-poll all queries during Mongo failovers. + +* Fix bugs involving mutating DDP method arguments. + + +#### meteor command-line tool + +* Move boilerplate HTML from tools to webapp. Changes internal + Webapp.addHtmlAttributeHook API incompatibly. + +* Add `meteor list-sites` command for listing the sites that you have + deployed to meteor.com with your Meteor developer account. + +* Third-party template languages can request that their generated source loads + before other JavaScript files, just like *.html files, by passing the + isTemplate option to Plugin.registerSourceHandler. + +* You can specify a particular interface for the dev mode runner to bind to with + `meteor -p host:port`. + +* Don't include proprietary tar tags in bundle tarballs. + +* Convert relative urls to absolute url when merging CSS files + + +#### Upgraded dependencies + +* Node.js from 0.10.25 to 0.10.26. +* MongoDB driver from 1.3.19 to 1.4.1 +* stylus: 0.42.3 (from 0.42.2) +* showdown: XXX (from XXX) +* css-parse: an unreleased version (from 1.7.0) +* css-stringify: an unreleased version (from 1.4.1) + + +Patches contributed by GitHub users aldeed, apendua, arbesfeld, awwx, dandv, +davegonzalez, emgee3, justinsb, mquandalle, Neftedollar, Pent, sdarnell, +and timhaines. + + +## v0.8.0.1 + +* Fix security flaw in OAuth1 implementation. Clients can no longer + choose the callback_url for OAuth1 logins. + + +## v0.8.0 + +Meteor 0.8.0 introduces Blaze, a total rewrite of our live templating engine, +replacing Spark. Advantages of Blaze include: + + * Better interoperability with jQuery plugins and other techniques which + directly manipulate the DOM + * More fine-grained updates: only the specific elements or attributes that + change are touched rather than the entire template + * A fully documented templating language + * No need for the confusing `{{#constant}}`, `{{#isolate}}`, and `preserve` + directives + * Uses standard jQuery delegation (`.on`) instead of our custom implementation + * Blaze supports live SVG templates that work just like HTML templates + +See +[the Using Blaze wiki page](https://github.com/meteor/meteor/wiki/Using-Blaze) +for full details on upgrading your app to 0.8.0. This includes: + +* The `Template.foo.rendered` callback is now only called once when the template + is rendered, rather than repeatedly as it is "re-rendered", because templates + now directly update changed data instead of fully re-rendering. + +* The `accounts-ui` login buttons are now invoked as a `{{> loginButtons}}` + rather than as `{{loginButtons}}`. + +* Previous versions of Meteor used a heavily modified version of the Handlebars + templating language. In 0.8.0, we've given it its own name: Spacebars! + Spacebars has an + [explicit specification](https://github.com/meteor/meteor/blob/devel/packages/spacebars/README.md) + instead of being defined as a series of changes to Handlebars. There are some + incompatibilities with our previous Handlebars fork, such as a + [different way of specifying dynamic element attributes](https://github.com/meteor/meteor/blob/devel/packages/spacebars/README.md#in-attribute-values) + and a + [new way of defining custom block helpers](https://github.com/meteor/meteor/blob/devel/packages/spacebars/README.md#custom-block-helpers). + +* Your template files must consist of + [well-formed HTML](https://github.com/meteor/meteor/blob/devel/packages/spacebars/README.md#html-dialect). Invalid + HTML is now a compilation failure. (There is a current limitation in our HTML + parser such that it does not support + [omitting end tags](http://www.w3.org/TR/html5/syntax.html#syntax-tag-omission) + on elements such as `

` and `

  • `.) + +* `Template.foo` is no longer a function. It is instead a + "component". Components render to an intermediate representation of an HTML + tree, not a string, so there is no longer an easy way to render a component to + a static HTML string. + +* `Meteor.render` and `Spark.render` have been removed. Use `UI.render` and + `UI.insert` instead. + +* The `` tag now defines a template just like the `