frappe/frappe v16.35.0

on GitHub

Features

• Adds the never_skip_patches setting so designated critical updates stop a migration when they fail, even when --skip-failing is used. (#42963)

Bug Fixes

• Keeps long chart legend labels truncated, including after circular charts refresh, and reduces legend size so more entries fit. (#42898)
• On mobile list views, Subject appears in bold only for unread rows, while read rows use regular text. (#42865)
• The File upload check compares Allowed File Extensions with the extension in the actual filename, so files with unrecognized types are rejected when their extension is not listed; extensions match literally, so JPEG and JPG are treated separately. Query parameters are removed when the filename is taken from a remote URL. (#42929)
• Requires From Document Type and Field in the “Add Column” dialog for query reports and displays the missing fields when users submit without selecting them, instead of failing silently. (#42953)
• Keeps saved values when editing a Web Form submission instead of replacing them with field defaults. (#42959)
• Requires write access to Connected App before retrieving its OpenID Configuration, so users with read-only access cannot trigger requests to the configured URL. (#42972)
• Updates File list access checks to consider ownership, shared access, and user permissions on attached documents. (#42884)
• Users can only see a document’s print settings when they have permission to view that document. (#42976)
• Allows users with read access to User to filter searches by User Type, so the "Assign" and "Share" dialogs can list matching users without displaying the field value when it is not permitted. (#42997)
• Updates report exports to Excel to write hierarchy indentation as whole numbers, preserving the correct display when report levels are provided as decimal values. (#43011)
• Removes surrounding single quotes from linked labels in Excel and CSV report exports, matching how those labels appear in the desk. (#43014)
• Allows date and time values with fractional seconds or single-digit hours, so these values are not cleared when an existing record opens in a Web Form. (#42932)
• Fixes errors in Link field searches when Link Filters and additional filters are used together, while retaining filters that apply to other record types. (#43035)
• Uses the label In Standard Filter for the in_standard_filter option in the DocType field editor, matching Customize Form, custom fields, and DocType Layout. (#43056)
• Restricts cached table counts and column lookups to the current site's own database or schema, preventing information from other sites from being mixed in multi-site setups. (#43067)
• Prevents Single DocTypes from being renamed by disabling Allow Rename automatically and hiding the "Rename" action. Attempts to rename one now show a validation message instead of a database error. (#43072)
• Allows documents submitted through the background queue to be deleted after processing finishes and removes the related Submission Queue record. Documents with submissions still waiting in the queue remain protected from normal deletion. (#43077)
• Checks text-field lengths after HTML content is cleaned in records and child records, so values that grow during cleanup are rejected before saving instead of causing a database error. (#43075)
• Keeps link and autocomplete option lists in child tables next to their fields when a Web Form is scrolled, instead of displaying them far above the table. (#42645)
• Allows desktop icons to be dragged and reordered when their displayed names are translated. (#43116)
• Allows hierarchy filters such as Descendants Of and Ancestors Of to work regardless of capitalization, instead of returning an error. (#43118)
• Rejects File URL values in File records that use .. path segments or point outside the appropriate files directory. (#43124)
• Adds a write-permission check before Network Printer Settings retrieves available printers, preventing users without edit access from running the printer lookup. (#43122)
• Fixes outgoing Email Account selection so using the default account earlier in a request no longer overrides a more specific account matched by the sender address or reference document. (#43120)
• Removes the OAuth password grant, so applications can no longer obtain access tokens by submitting a user’s username and password directly; authorization code and refresh token grants remain available. (#43126)
• Allows custom reports to resolve added columns that depend on other added columns, so the dependent values appear when the report runs. (#43136)
• Allows users to open their own Prepared Report from the report-ready notification without the Prepared Report User role; opening someone else’s prepared report still requires that role. (#43142)

Authors: @Shllokkk, @kaulith, @sokumon, @AarDG10, @aryadharmadhikari, @krishna-254, @rohitwaghchaure, @asmitahase, @mainshivam
Reviewers: @iamejaaz, @kaulith, @NagariaHussain, @AarDG10, @rohitwaghchaure