Morepath

Latest version: v0.19

Safety actively analyzes 630254 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 3 of 5

0.13

Not secure
=================

- **Breaking change**. Morepath has a new, extensively refactored
configuration system based on dectate_ and importscan_. Dectate is
an extracted, and heavily refactored version of Morepath's
configuration system that used to be in ``morepath.config``
module. It's finally documented too!

.. _dectate: http://dectate.readthedocs.org

.. _importscan: http://importscan.readthedocs.org

Dectate and thus Morepath does not use Venusian (or Venusifork)
anymore so that dependency is gone.

Code that uses ``morepath.autosetup`` should still work.

Code that uses ``morepath.setup`` and scans and commits manually
needs to change. Change this::

from morepath import setup

config = morepath.setup()
config.scan(package)
config.commit()

into this::

import morepath

morepath.scan(package)
morepath.autocommit()

Similarly ``config.scan()`` without arguments to scan its own
package needs to be rewritten to use ``morepath.scan()`` without
arguments.

Anything you import directly now does not need to be scanned
anymore; the act of importing a module directly registers the
directives with Morepath, though as before they won't be active
until you commit. But scanning something you've imported before
won't do any harm.

The signature for ``morepath.scan`` is somewhat different than that
of the old ``config.scan``. There is no third argument
``recursive=True`` anymore. The ``onerror`` argument has been
renamed to ``handle_error`` and has different behavior; the
importscan_ documentation describes the details.

If you were writing tests that involve Morepath, the old structure of
the test was::

import morepath

def test_foo():
config = morepath.setup()

class App(morepath.App):
testing_config = config

... use directives on App ...

config.commit()

... do asserts ...

This now needs to change to::

import morepath

def test_foo():
class App(morepath.App):
pass

... use directives on App ...

morepath.commit([App])

... do asserts ...

So, you need to use the ``morepath.commit()`` function and give it a
list of the application objects you want to commit,
explicitly. ``morepath.autocommit()`` won't work in the context of a
test.

If you used a test that scanned code you need to adjust it too, from::

import morepath
import some_package

def test_foo():
config = morepath.setup()

config.scan(some_package)

config.commit()

... do asserts ...

to this::

import morepath
import some_package

def test_foo():
morepath.scan(some_package)
morepath.commit([some_package.App])

... do asserts ...

Again you need to be explicit and use ``morepath.commit`` to commit
those apps you want to test.

If you had a low-level reference to ``app.registry`` in your code it
will break; the registry has been split up and is now under
``app.config``. If you want access to ``lookup`` you can use
``app.lookup``.

If you created custom directives, the way to create directives
is now documented as part of the dectate_ project. The main updates you
need to do are:

* subclass from `dectate.Action` instead of `morepath.Directive`.

* no more ``app`` first argument.

* no ``super`` call is needed anymore in ``__init__``.

* add a ``config`` class variable to declare the registries
you want to affect. Until we break up the main registry this
is::

from morepath.app import Registry

...
config = { 'registry': Registry }


* reverse the arguments to ``perform``, so that the object
being registered comes first. So change::

def perform(self, registry, obj):
...

into::

def perform(self, obj, registry):
...

But instead of ``registry`` use the registry you set up in your
action's ``config``.

* no more ``prepare``. Do error checking inside the ``perform``
method and raise a ``DirectiveError`` if something is wrong.

If you created sub-actions from ``prepare``, subclass from
`dectate.Composite` instead and implement an ``actions`` method.

* ``group_key`` method has changed to ``group_class`` class variable.

If you were using ``morepath.sphinxext`` to document directives
using Sphinx autodoc, use ``dectate.sphinxext`` instead.

- **Breaking change** If you want to use Morepath directives on
``staticmethod``, you need to change the order in which these are
applied. In the past::

App.path(model=Foo, path='bar')
staticmethod
def get_foo():
....

But now you need to write::

staticmethod
App.path(model=Foo, path='bar')
def get_foo():
....

- **Breaking change** You cannot use a Morepath ``path`` directive on
a ``classmethod`` directly anymore. Instead you can do this::

class Foo(object):
classmethod
def get_something():
pass

App.path('/', model=Something)(Foo.get_something)

- **Breaking change**. Brought `app.settings` back, a shortcut to the
settings registry. If you use settings, you need to replace any
references to ``app.registry.settings`` to ``app.settings``.

- Add `request.class_link`. This lets you link using classes instead
of instances as an optimization. In some cases instantiating an
object just so you can generate a link to it is relatively
expensive. In that case you can use `request.class_link`
instead. This lets you link to a model class and supply a
`variables` dictionary manually.

- **Breaking change**. In Morepath versions before this there was an
class attribute on ``App`` subclasses called ``registry``. This was
a giant mixed registry which subclassed a lot of different
registries used by Morepath (reg registry, converter registry,
traject registry, etc). The Dectate configuration system allows us
to break this registry into a lot of smaller interdependent registries
that are configured in the ``config`` of the directives.

While normally you shouldn't be, if you were somehow relying on
``App.registry`` in your code you should now rewrite it to use
``App.config.reg_registry``, ``App.config.setting_registry``,
``App.config.path_registry`` etc.

0.12

Not secure
=================

- **Breaking change**. The ``request.after`` function is now called even if
the response was directly created by the view (as opposed to the view
returning a value to be rendered by morepath). Basically, ``request.after``
is now guaranteed to be called if the response's HTTP status code lies within
the 2XX-3XX range.

See https://github.com/morepath/morepath/issues/346

- Fixed a typo in the `defer_link` documentation.

- Morepath's link generation wasn't properly quoting paths and
parameters in all circumstances where non-ascii characters or
URL-quoted characters were used. See issue 337.

- Morepath could not handle varargs or keyword arguments properly
in path functions. Now bails out with an error early during
configuration time. To fix existing code, get rid of any ``*args`` or
``**kw``.

- Morepath could not properly generate links if a path directive
defines a path variable for the path but does not actually use it in
the path function. Now we complain during configuration time. To fix
existing code, add all variables that are defined in the path
(i.e. ``{id}``) to the function signature.

- Certain errors (``ConfigError``) were not reporting directive line number
information. They now do.

- Better ``ConfigError`` reporting when ``setting_section`` is in use.

- Removed the unused ``request`` parameter from the ``link`` method in
``morepath.request``. See issue 351.

- Require venusifork 2.0a3. This is a hacked version which works around
some unusual compatibility issues with ``six``.

0.11.1

Not secure
===================

- setuptools has the nasty habit to change underscores in project
names to minus characters. This broke the new autoscan machinery for
packages with an underscore in their name (such as
`morepath_sqlalchemy`). This was fixed.

0.11

Not secure
=================

- **Breaking change**. The ``morepath.autoconfig`` and ``morepath.autosetup``
methods had to be rewritten. Before, Morepath was unable to autoload packages
installed using ``pip``.

As a result, Morepath won't be able to autoload packages if the setup.py
name differs from the name of the distributed package or module.

For example: A package named ``my-app`` containing a module named ``myapp``
won't be automatically loaded anymore.

Packages like this need to be loaded manually now::

import morepath
import myapp

config = morepath.setup()
config.scan(myapp)
config.commit()

See https://github.com/morepath/morepath/issues/319

- The ``config.scan`` method now excludes 'test' and 'tests' directories
by default.

See https://github.com/morepath/morepath/issues/326

- The ``template_directory`` directive will no longer inspect the current
module if the template directory refers to an absolute path. This makes it
easier to write tests where the current module might not be available.

Fixes https://github.com/morepath/morepath/issues/299

- The ``identity_policy`` passes ``settings`` to the function if it
defines such an argument. This way an identity policy can be created
that takes settings into account.

See https://github.com/morepath/morepath/issues/309

- Dots in the request path are now always normalized away. Before, Morepath
basically relied on the client to do this, which was a potential security
issue.

See https://github.com/morepath/morepath/issues/329

- Additional documentation on the Morepath config system:
http://morepath.readthedocs.org/en/latest/configuration.html

- Additional documentation on how to serve static images in
https://morepath.readthedocs.org/en/latest/more.static.html

- Move undocumented ``pdb`` out of ``__init__.py`` as it could
sometimes trip up things. Instead documented it in the API docs in
the special `morepath.pdbsupport` module.

https://github.com/morepath/morepath/issues/328

0.10

Not secure
=================

- Server-side templating language support: there is now a ``template``
argument for the ``html`` directive (and ``view`` and ``json``).
You need to use a plugin to add particular template languages to
your project, such as ``more.chameleon`` and ``more.jinja2``, but
you can also add your own.

See http://morepath.readthedocs.org/en/latest/templates.html

- Add a new "A Review of the Web" document to the docs to show how
Morepath fits within the web.

http://morepath.readthedocs.org/en/latest/web.html

- The publisher does not respond to a ``None`` render function
anymore. Instead, the ``view`` directive now uses a default
``render_view`` if ``None`` is configured. This simplifies the
publisher guaranteeing a ``render`` function always exists.

Fixes https://github.com/morepath/morepath/issues/283

- Introduce a ``request.resolve_path`` method that allows you to resolve
paths to objects programmatically.

- Modify ``setup.py`` to use ``io.open`` instead of ``open`` to
include the README and the CHANGELOG and hardcode UTF-8 so it works
on all versions of Python with all default encodings.

- Various documentation fixes.

0.9

Not secure
================

- **Breaking change**. In previous releases of Morepath, Morepath did
not include the full hostname in generated links (so ``/a`` instead
of ``http://example.com/a``). Morepath 0.9 does include the full
hostname in generated links by default. This to support the
non-browser client use case better. In the previous system without
fully qualified URLs, client code needs to manually add the base of
links itself in order to be able to access them. That makes client
code more complicated than it should be. To make writing such client
code as easy as possible Morepath now generates complete URLs.

This should not break any code, though it can break tests that rely
on the previous behavior. To fix ``webtest`` style tests, prefix
the expected links with ``http://localhost/``.

If for some reason you want the old behavior back in an application,
you can use the ``link_prefix`` directive::

App.link_prefix()
def my_link_prefix(request):
return '' prefix nothing again

- Directives are now logged to the ``morepath.directive`` log, which
is using the standard Python ``logging`` infrastructure. See
http://morepath.readthedocs.org/en/latest/logging.html

- Document ``more.forwarded`` proxy support in
http://morepath.readthedocs.org/en/latest/paths_and_linking.html

- Document behavior of ``request.after`` in combination with directly
returning a response object from a view.

- Expose ``body_model_predicate`` to the public Morepath API. You
can now say your predicate comes after it.

- Expose ``LAST_VIEW_PREDICATE`` to the Morepath API. This is the last
predicate defined by the Morepath core.

- Update the predicate documentation.

- Updated the more.static doc to reflect changes in it.

- Fix doc for grouping views with the ``with`` statement.

- Suggest a few things to try when your code doesn't appear to be
scanned properly.

- A new view predicate without a fallback resulted in an internal
server error if the predicate did not match. Now it results in a 404
Not Found by default. To override this default, define a predicate
fallback.

Page 3 of 5

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.