Zope

Latest version: v5.11.1

Safety actively analyzes 693883 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 5 of 16

5.6

Not secure
----------------

- Make Products.PageTemplate engine compatible with Chameleon 3.10.

- Update to newest compatible versions of dependencies.

- Start work on Python 3.11 support, which will arrive in a later release.

- Fix cookie path parameter handling:
If the cookie path value contains ``%`` it is assumed to be
fully quoted and used as is;
if it contains only characters allowed (unquoted)
in an URL path (with the exception of ``;``),
it is used as is; otherwise, it is quoted using Python's
``urllib.parse.quote``
(`1052 <https://github.com/zopefoundation/Zope/issues/1052>`_).

5.5.2

Not secure
------------------

- Update ``waitress`` to version 2.1.2.

- Improvements on find_bad_templates(): check Filesystem Page
Templates too and show html tags in web report
(`1042 <https://github.com/zopefoundation/Zope/issues/1042>`_)

- Fix version pin specifications for Python 3.6 compatibility.
(`1036 <https://github.com/zopefoundation/Zope/issues/1036>`_)

- Quote all components of a redirect URL (not only the path component)
(`1027 <https://github.com/zopefoundation/Zope/issues/1027>`_)

- Drop the convenience script generation from the buildout configuration
in order to get rid of a lot of dependency version pins.
These were only needed for maintainers who can install them manually.
(`1019 <https://github.com/zopefoundation/Zope/issues/1019>`_)

- Update to newest compatible versions of dependencies.

- Modify "manage_access" to allow users to switch from the compact view
to the complete matrix view when more than 30 roles are defined.
(`1039 <https://github.com/zopefoundation/Zope/pull/1039>`_)

- Strip leading ``.`` in cookie domain names.
(`1041 <https://github.com/zopefoundation/Zope/pull/1041>`_)

5.5.1

Not secure
------------------

- Update to newest compatible versions of dependencies.

- Update ``waitress`` to version 2.1.1 to mitigate a vulnerability in that
package. As ``waitress`` no longer supports Python 3.6 it is not advised
to run Zope on Python 3.6 any longer even though it still supports Python
3.6. **Due to this security issue support for Python 3.6 is now officially
deprecated. It will be removed with Zope version 5.7.**

- To run ``bin/buildout`` inside the Zope project now ``zc.buildout >= 2.13.7``
or ``zc.buildout >= 3.0.0b1`` is required.

5.5

Not secure
----------------

- Fix several exceptions when calling ``ZPublisher.utils.fix_properties``.

- Update to newest compatible versions of dependencies.

- Enhance cookie support. For details, see
`1010 <https://github.com/zopefoundation/Zope/issues/1010>`_

- Use intermediate ``str`` representation for non-bytelike response data unless
indicated differently by the content type.
(`1006 <https://github.com/zopefoundation/Zope/issues/1006>`_)

- Use ``zc.buildout 3.0rc2`` to install Zope to run its tests.

5.4

Not secure
----------------

- Audit and fix all hyperlinks in code and documentation

- Change zope.org references to zope.dev due to ongoing domain ownership
issues. zope.dev is owned by the Plone Foundation and thus safe from
interference. XML/ZCML namespace URLs remain unchanged.
- Remove all links that are completely dead, such as the old zope.org
Collectors issue trackers.
- Update all other miscellaneous links to make them work again or remove if
the information is gone.

- Improve type guessing for the default WebDAV PUT factory
(`997 <https://github.com/zopefoundation/Zope/issues/997>`_)

- Enable WebDAV PUT factories to change a newly created object's ID
(`997 <https://github.com/zopefoundation/Zope/issues/997>`_)

- Fix potential race condition in ``App.version_txt.getZopeVersion``
(`999 <https://github.com/zopefoundation/Zope/issues/999>`_)

- Don't coerce file upload fields for adding DTML Documents/Methods to string.
This makes the Add forms work again with the ZPublisher converter code
changes.

- Remove deprecated ulines, utext, utokens, ustring from more code.
In the properties form, show a deprecation warning.

- Add function ``ZPublisher.utils.fix_properties``.
You can call this to fix lines properties to only contain strings, not bytes.
It also replaces the deprecated property types ulines, utext, utoken, and
ustring with their non-unicode variants.
(`987 <https://github.com/zopefoundation/Zope/issues/987>`_)

- Add support for Python 3.10.

- Update to newest compatible versions of dependencies.

5.3.1

------------------

- Prevent race condition in guarded_import
(`123 <https://github.com/zopefoundation/AccessControl/issues/123>`_)

Page 5 of 16

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.