Release of v0.9.8.0

[anonymoususer72041]

When do we want to release v0.9.8.0?

I suggest to create a new release after merging up to #706 or #724.

Keep in mind that current version 0.9.7.4 still is vulnerable to CSRF and XSS.

[RussH]

yep, good to get a Security release out sooner rather than later, then move to a php 8.x release for subsequent releases

[anonymoususer72041]

Do you want to merge up to #706 or #724 so we can release v0.9.8.0?

[RussH]

yes, lets have a target. I'm a bit hectic elsewhere so happy to work to your recommendations here. Lets get to 706 or we'll never release

[anonymoususer72041]

Then I would suggest to go on with #704 and not to wait for @spcaeo to finish his work in #703 for now so we can release as soon as possible.

[anonymoususer72041]

Current roadmap to release v0.9.8.0:

• Merging fix: preserve job order regarding when editing #704
• Merging refactor: migrate MyISAM tables to InnoDB #705
• Merging security: restrict AJAX during upgrade and escape installer config writes #706
• Merging refactor: stop persisting inline HTML for status change activity notes #713
• Merging feat: standardize status change activity logging #741
• Merging fix: add file-based cache busting for JavaScript and stylesheet assets #749
• Merging security: escape activity notes before applying nl2br #751
• Merging fix: normalize candidate activity note escaping #757
• Merging security: harden template output escaping #761

Optional for a PHP 7.4 minimum-version upgrade:

• Merging chore: remove legacy testing infrastructure #754
• Merging refactor: migrate bundled lib dependencies to Composer #755
• Merging chore: modernize PHPUnit 8 test setup and deprecated APIs #756
• (Merging chore: remove legacy lib files #778)
• Merging chore: upgrade to PHP 7.4 #787

[anonymoususer72041]

Issues #735, #739 and #740 aren't relevant anymore but instead I would like to merge #749 before creating a release.

[anonymoususer72041]

@RussH what do you think about adding a merge of #741 to our to do list so #737 standalone is not just noise for v0.9.8.0?

[RussH]

I have no issues with this feature being added

[RussH]

#704 is failing CI/CD tests, will comment on the PR - can't merge until it's passing

#704 Merged

[anonymoususer72041]

Based on your feedback under #749, @RussH, I've just added #751 to the roadmap.

[RussH]

@anonymoususer72041 you want to merge #750 first to improve testing?

[anonymoususer72041]

Done

[anonymoususer72041]

@RussH are you okay if we set a deadline to release v0.9.8.0 no later than April 27, 2026?

[anonymoususer72041]

//push

[anonymoususer72041]

@RussH any new deadline to release v0.9.8.0?

[anonymoususer72041]

@RussH I am currently working on a PHP 7.4 branch, which should also serve as a useful preparatory step toward PHP 8.

I think it would make sense to include this branch in the v0.9.8.0 release as well.

Would it be possible to merge PRs #754 and #755 in the near term so I can continue working on the PHP 7.4 branch on a clean basis?

[anonymoususer72041]

Additionally #756 needs to be merged

[anonymoususer72041]

It would also remove diff noise, if we could merge #778.

[anonymoususer72041]

@RussH if you are currently unable to review #756, #778 and #787, I can send you a changelog or create a draft release without changes regarding PHP 7.4, so we can finally release v0.9.8.0. Please let me know.

[anonymoususer72041]

@RussH since I've now merged #756 and #778, only #787 is leftover for review.

Please take a look if you are okay with the changes, otherwise I will merge them on my own on 1st of June.

[RussH]

based on where we are I'll tag and generate a new 0.9.8 release, hopefully today.

[anonymoususer72041]

Please take a look onto #791 as this could mess things up if we do not include it into this release.

[RussH]

#791 merged.. Anything else before 0.9.8?

[anonymoususer72041]

Seems fine for me to release now, if you include the additional security fix provided via mail after reviewing it.

Do we want to release as version v0.9.8.0 or v0.10.0? I would suggest to switch to consistent semantic versioning, so I would prefer v0.10.0.

[anonymoususer72041]

@RussH can you verify if upgrading and running migrations works for you on current master?