Eve

Latest version: v2.1.0

Safety actively analyzes 629855 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 5 of 9

0.7.5

Not secure
~~~~~~~~~~~~~

Released on 4 December, 2017

- Fix: A query was not fully traversed in the sanitization. Therefore the
blacklist for mongo wueries could be bypassed, allowing for dangerous
``$where`` queries (Moritz Schneider).

0.7.4

Not secure
~~~~~~~~~~~~~

Released on 24 May, 2017

- Fix: ``post_internal`` fails when using ``URL_PREFIX`` or ``API_VERSION``.
Closes 810.

0.7.3

Not secure
~~~~~~~~~~~~~

Released on 3 May, 2017

- Eve and Cerberus are now collaboratively funded projects, see:
https://nicolaiarocci.com/eve-and-cerberus-funding-campaign/
- Fix: Internal resource, oplog enabled: a ``*_internal`` method defined in
``OPLOG_METHODS`` triggers keyerror (Einar Huseby).
- Dev: use official Alabaster theme instead of custom fork.
- Fix: docstrings typos (Martin Fous).
- Docs: explain that ``ALLOW_UNKNOWN`` can also be used to expose the whole
document as found in the database, with no explicit validation schema.
Addresses 995.
- Docs: add Eve-Healthcheck to extensions list (Luis Fernando Gomes).

0.7.2

Not secure
~~~~~~~~~~~~~

Released on 6 March, 2017

- Fix: Validation exceptions are returned in ``doc_issues['validator
exception']`` across all edit methods (POST, PUT, PATCH). Closes 994.
- Fix: When there is ``MONGO_URI`` defined it will be used no matter if the
resource is using a prefix or not (Petr Jašek).
- Docs: Add code snippet with an example of how to implement a simple list of
items that supports both list-level and item-level CRUD operations (John
Chang).

0.7.1

Not secure
~~~~~~~~~~~~~

Released on 14 February, 2017

- Fix: "Cannot create a consistent method resolution order" on Python 3.5.2 and
3.6 since Eve 0.7. Closes 984.

- Docs: update README with svg bade (Sobolev Nikita).
- Docs: fix typo and dead link to Nicola's website (Dominik Kellner).

- ``develop`` branch has been dropped. ``master`` is now the default project
branch.

0.7

Not secure
~~~~~~~~~~~

Released on 6 February, 2017

- New: Add Python 3.6 as a supported interpreter.

- New: ``OPTIMIZE_PAGINATION_FOR_SPEED``. Set this to ``True`` to improve
pagination performance. When optimization is active no count operation, which
can be slow on large collections, is performed on the database. This does
have a few consequences. Firstly, no document count is returned. Secondly,
``HATEOAS`` is less accurate: no last page link is available, and next page
link is always included, even on last page. On big collections, switching
this feature on can greatly improve performance. Defaults to ``False``
(slower performance; document count included; accurate ``HATEOAS``). Closes
944 and 853.


- New: ``Location`` header is returned on ``201 Created`` POST responses. If
will contain the URI to the created document. If bulk inserts are enabled,
only the first document URI is returned. Closes 795.

- New: Pretty printing.You can pretty print the response by specifying a query
parameter named ``?pretty`` (Hasan Pekdemir).

- New: ``AUTO_COLLAPSE_MULTI_KEYS``. If set to ``True``, multiple values sent
with the same key, submitted using the ``application/x-www-form-urlencoded``
or ``multipart/form-data`` content types, will automatically be converted to
a list of values. When using this together with ``AUTO_CREATE_LISTS`` it
becomes possible to use lists of media fields. Defaults to ``False``. Closes
932 (Conrad Burchert).

- New: ``AUTO_CREATE_LISTS``. When submitting a non ``list`` type value for
a field with type ``list``, automatically create a one element list before
running the validators. Defaults to ``False`` (Conrad Burchert).

- New: Flask-PyMongo compatibility for for ``MONGO_CONNECT`` config setting
(Massimo Scamarcia).

- New: Add Python 3.5 as a supported interpreter (Mattias Lundberg).

- New: ``MONGO_OPTIONS`` allows MongoDB arguments to be passed to the
MongoClient object. Defaults to ``{}`` (Massimo Scamarcia).

- New: Regexes are allowed by setting ``X_DOMAINS_RE`` values. This allows CORS
to support websites with dynamic ranges of subdomains. Closes 660 and 974.

- New: If ``ENFORCE_IF_MATCH`` option is active, then all requests are expected
to include the ``If-Match`` or they will be rejected (same as old behavior).
However, if ``ENFORCE_IF_MATCH`` is disabled, then client determines whether
request is conditional. When ``If-Match`` is included, then request is
conditional, otherwise the request is processed with no conditional checks.
Closes 657 (Arthur Burkart).

- New: Allow old document versions to be cache validated using ETags (Nick
Park).

- New: Support weak ETags, commonly applied by servers transmitting gzipped
content (Nick Park).

- New: ``on_oplog_push`` event is fired when OPLOG is about to be updated.
Callbacks receive two arguments: ``resource`` (resource name) and ``entries``
(list of oplog entries which are about to be written).

- New: optional ``extra`` field is available for OPLOG entries. Can be updated
by callbacks hooked to the new ``on_oplog_push`` event.

- New: OPLOG audit now include the username or token when available. Closes
846.

- New ``get_internal`` and ``getitem_internal`` functions can be used for
internal GET calls. These methods are not rate limited, authentication is not
checked and pre-request events are not raised.

- New: Add support for MongoDB ``DBRef`` fields (Roman Gavrilov).

- New: ``MULTIPART_FORM_FIELDS_AS_JSON``. In case you are submitting your
resource as ``multipart/form-data`` all form data fields will be submitted as
strings, breaking any validation rules you might have on the resource fields.
If you want to treat all submitted form data as JSON strings you will have to
activate this setting. Closes 806 (Stratos Gerakakis).

- New: Support for MongoDB Aggregation Framework. Endpoints can respond with
aggregation results. Clients can optionally influence aggregation
results by using the new ``aggregate`` option: ``aggregate={"$year": 2015}``.

- New: Flask views (``app.route``) can now set ``mongo_prefix`` via Flask's
``g`` object: ``g.mongo_prefix = 'MONGO2'`` (Gustavo Vargas).

- New: Query parameters not recognised by Eve are now returned in HATEOAS URLs
(Mugur Rus).

- New: ``OPLOG_CHANGE_METHODS`` is a list of HTTP methods which operations will
include changes into the OpLog (mmizotin).

- Change: Return ``428 Precondition Required`` instead of a generic ``403
Forbidden`` when the ``If-Match`` request header is missing (Arnau Orriols).

- Change: ETag response header now conforms to RFC 7232/2.3 and is surrounded
by double quotes. Closes 794.

- Fix: Better locating of ``settings.py``. On startup, if settings flag is
omitted in constructor, Eve will try to locate file named settings.py, first
in the application folder and then in one of the application's subfolders.
You can choose an alternative filename/path, just pass it as an argument when
you instantiate the application. If the file path is relative, Eve will try
to locate it recursively in one of the folders in your sys.path, therefore
you have to be sure that your application root is appended to it. This is
useful, for example, in testing environments, when settings file is not
necessarily located in the root of your application. Closes 820 (Mario
Kralj).

- Fix: Versioning does not work with User Restricted Resource Access. Closes
967 (Kris Lambrechts)

- Fix: ``test_create_indexes()`` typo. Closes 960.

- Fix: fix crash when attempting to modify a document ``_id`` on MongoDB 3.4
(Giorgos Margaritis)

- Fix: improve serialization of boolean values. Closes 947 (NotSpecial).

- Fix: fix intermittently failing test. Closes 934 (Conrad Burchert).

- Fix: Multiple, fast (within a 1 second window) and neutral (no actual
changes) PATCH requests should not raise ``412 Precondition Failed``.
Closes 920.

- Fix: Resource titles are not properly escaped during the XML rendering of the
root document (Kris Lambrechts).

- Fix: ETag request headers which conform to RFC 7232/2.3 (double quoted value)
are now properly processed. Addresses 794.

- Fix: Deprecation warning from Flask. Closes 898 (George Lestaris).

- Fix: add Support serialization on lists using anyof, oneof, allof, noneof.
Closes 876 (Carles Bruguera).

- Fix: update security example snippets to match with current API (Stanislav
Filin).

- Fix: ``notifications.py`` example snippet crashes due to lack of ``DOMAIN``
setting (Stanislav Filin).

- Docs: clarify documentation for custom validators: Cerberus dependency is
still pinned to version 0.9.2. Upgrade to Cerberus 1.0+ is planned with v0.8.
Closes 796.
- Docs: remove the deprecated ``--ditribute`` virtualenv option (Eugene
Prikazchikov).
- Docs: add date and subdocument fields filtering examples. Closes 924.
- Docs: add Eve-Neo4j to the extensions page (Rodrigo Rodriguez).
- Docs: stress that alternate backends are supported via community extensions.
- Docs: clarify that Redis is an optional dependency (Mateusz Łoskot).

- Update license to 2017. Closes 955.
- Update: Flask 0.12. Closes 945, 904 and 963.
- Update: PyMongo 3.4 is now required. Closes 964.

Page 5 of 9

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.