<commit_before>CHANGES
*******

0.14 (unreleased)
===================

- **Breaking change**: Move the basic auth policy to
  ``more.basicauth`` extension extension. Basic auth is just one of
  the authentication choices you have and not the default. To update
  code, make your project depend on ``more.basicauth`` and import
  ``BasicAuthIdentityPolicy`` from ``more.basicauth``.

- **Breaking change**: Remove some exception classes that weren't
  used: ``morepath.error.ViewError``, ``morepath.error.ResolveError``.
  If you try to catch them in your code, just remove the whole
  ``except`` statement as they were never raised.

- **Deprecated** We moved a few things into the public API:
  ``enable_implicit``, ``disable_implicit``, ``remember_identity``,
  ``forget_identity``, ``Identity``, ``IdentityPolicy``,
  ``NO_IDENTITY``. Some of these were already documented as importable
  from ``morepath.security``.  Although importing from
  ``morepath.security`` won't break yet, you should stop importing
  from it and import directly from ``morepath`` instead.

- **Breaking change** Extensions that imported ``RegRegistry`` directly
  from ``morepath.app`` are going to be broken. This kind of import::

    from morepath.app import RegRegistry

  needs to become::

    from morepath.directive import RegRegistry

  This change was made to avoid circular imports in Morepath, and
  because ``App`` did not directly depend on ``RegRegistry`` anymore.

- **New** We have a new chat channel available. You can join us by clicking
  this link:

  https://discord.gg/0xRQrJnOPiRsEANa

  Please join and hang out! We are retiring the (empty) Freenode
  #morepath channel.

- Introduce a new ``commit`` method on ``App`` that commits the App
  and also recursively commits all mounted apps. This is more explicit
  than ``autocommit`` and less verbose than using the lower-level
  ``dectate.commit``.

- Automatic commit of the app is done during the first request if the
  app wasn't committed previously. See issue #392.

- Introduce a deprecation warnings (for ``morepath.security``) and
  document how a user can deal with such warnings.

- Adds host header validation to protect against header poisoning attacks.

  See https://github.com/morepath/morepath/issues/271

  You can use ``morepath.HOST_HEADER_PROTECTION`` in your own tween
  factory to wrap before or under it.

- Refactor internals of publishing/view engine. Reg is used more
  effectively for view lookup, order of some parameters is reversed
  for consistency with public APIs.

- Document the internals of Morepath, see implementation document.
  This includes docstrings for all the internal APIs.

- The framehack module was merged into ``autosetup``. Increased
  the coverage to this module to 100%.

- New cookiecutter template for Morepath, and added references in the
  documentation for it.

  See https://github.com/morepath/morepath-cookiecutter

- Test cleanup; scan in many tests turns out to be superfluous. Issue
  #379

- Add a test that verifies we can instantiate an app before configuration
  is done. See issue #378 for discussion.

- Started doctesting some of the docs.

- Renamed ``RegRegistry.lookup`` to ``RegRegistry.caching_lookup`` as
  the ``lookup`` property was shadowing a lookup property on
  ``reg.Registry``.  This wasn't causing bugs but made debugging
  harder.

- Introduce a new ``defer_class_links`` directive that lets you defer
  link generation using ``Request.class_link()`` in addition to
  ``Request.link()``.  This is an alternative to ``defer_links``,
  which cannot support ``Request.class_link``.

0.13.2 (2016-04-13)
===================

- Undid change in 0.13.1 where ``App`` could not be instantiated if
  not committed, as ran into real-world code where this assumption
  was broken.

0.13.1 (2016-04-13)
===================

- Enable queries by the Dectate query tool.

- Document ``scan`` function in API docs.

- Work around an issue in Python where ``~`` (tilde) is quoted by
  ``urllib.quote`` & ``urllib.encode``, even though it should not be
  according to the RFC, as ``~`` is considered unreserved.<commit_msg>Note about extension API.<commit_after>CHANGES
*******

0.14 (unreleased)
===================

- **Breaking change**: Move the basic auth policy to
  ``more.basicauth`` extension extension. Basic auth is just one of
  the authentication choices you have and not the default. To update
  code, make your project depend on ``more.basicauth`` and import
  ``BasicAuthIdentityPolicy`` from ``more.basicauth``.

- **Breaking change**: Remove some exception classes that weren't
  used: ``morepath.error.ViewError``, ``morepath.error.ResolveError``.
  If you try to catch them in your code, just remove the whole
  ``except`` statement as they were never raised.

- **Deprecated** We moved a few things into the public API:
  ``enable_implicit``, ``disable_implicit``, ``remember_identity``,
  ``forget_identity``, ``Identity``, ``IdentityPolicy``,
  ``NO_IDENTITY``. Some of these were already documented as importable
  from ``morepath.security``.  Although importing from
  ``morepath.security`` won't break yet, you should stop importing
  from it and import directly from ``morepath`` instead.

- **Breaking change** Extensions that imported ``RegRegistry`` directly
  from ``morepath.app`` are going to be broken. This kind of import::

    from morepath.app import RegRegistry

  needs to become::

    from morepath.directive import RegRegistry

  This change was made to avoid circular imports in Morepath, and
  because ``App`` did not directly depend on ``RegRegistry`` anymore.

- **New** We have a new chat channel available. You can join us by clicking
  this link:

  https://discord.gg/0xRQrJnOPiRsEANa

  Please join and hang out! We are retiring the (empty) Freenode
  #morepath channel.

- Introduce a new ``commit`` method on ``App`` that commits the App
  and also recursively commits all mounted apps. This is more explicit
  than ``autocommit`` and less verbose than using the lower-level
  ``dectate.commit``.

- Automatic commit of the app is done during the first request if the
  app wasn't committed previously. See issue #392.

- Introduce a deprecation warnings (for ``morepath.security``) and
  document how a user can deal with such warnings.

- Adds host header validation to protect against header poisoning attacks.

  See https://github.com/morepath/morepath/issues/271

  You can use ``morepath.HOST_HEADER_PROTECTION`` in your own tween
  factory to wrap before or under it.

- Refactor internals of publishing/view engine. Reg is used more
  effectively for view lookup, order of some parameters is reversed
  for consistency with public APIs.

- Document the internals of Morepath, see implementation document.
  This includes docstrings for all the internal APIs.

- The framehack module was merged into ``autosetup``. Increased
  the coverage to this module to 100%.

- New cookiecutter template for Morepath, and added references in the
  documentation for it.

  See https://github.com/morepath/morepath-cookiecutter

- Test cleanup; scan in many tests turns out to be superfluous. Issue
  #379

- Add a test that verifies we can instantiate an app before configuration
  is done. See issue #378 for discussion.

- Started doctesting some of the docs.

- Renamed ``RegRegistry.lookup`` to ``RegRegistry.caching_lookup`` as
  the ``lookup`` property was shadowing a lookup property on
  ``reg.Registry``.  This wasn't causing bugs but made debugging
  harder.

- Introduce a new ``defer_class_links`` directive that lets you defer
  link generation using ``Request.class_link()`` in addition to
  ``Request.link()``.  This is an alternative to ``defer_links``,
  which cannot support ``Request.class_link``.

- Morepath now has extension API docs that are useful when you want to
  create your own directive and build on one of Morepath's registries
  or directives.

0.13.2 (2016-04-13)
===================

- Undid change in 0.13.1 where ``App`` could not be instantiated if
  not committed, as ran into real-world code where this assumption
  was broken.

0.13.1 (2016-04-13)
===================

- Enable queries by the Dectate query tool.

- Document ``scan`` function in API docs.

- Work around an issue in Python where ``~`` (tilde) is quoted by
  ``urllib.quote`` & ``urllib.encode``, even though it should not be
  according to the RFC, as ``~`` is considered unreserved.
{'fraction_non_alphanumeric': 0.10277613703484938, 'fraction_numerical': 0.011104548139397518, 'mean_word_length': 4.165344722391702, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2035268', 'n_tokens_mistral': 2444, 'n_tokens_neox': 2296, 'n_words': 1068}