mher/flower v2.2.0

on GitHub

Security

• Added CSRF protection for cookie-authenticated sessions
• Added protection against cross-site state-changing requests
• Added an OAuth state check to all login handlers
• Restricted the post-login redirect to local paths
• Enabled TLS certificate validation for the RabbitMQ management API
• Escaped all table cells on the tasks and workers pages
• Escaped load average values in the workers grid
• Added HttpOnly and SameSite to session cookies
• Added the X-Content-Type-Options: nosniff header
• Limited CORS headers to the unauthenticated API
• Served API error messages as plain text

Features

• Added a logout link for OAuth sessions #1074
• Added a timeout option to the task apply API
• Added a page size selector to the tasks page #1518
• Linked task names to a list of all tasks with that name
• Linked the task counts on the workers page to the matching tasks
• Honored the column order of the tasks_columns option #1262
• Added thousands separators to task counts #1374
• Formatted durations and showed a dash for missing values
• Added search examples as placeholder text
• Made wide tables scroll sideways and shortened UUIDs on mobile
• Limited worker page task lists to 50 entries by default #1087
• Removed the Retried column from the workers page
• Named browser tabs by page

Performance and reliability

• Made persistent state saves atomic #1403
• Fixed startup failing on a corrupt persistent state database #1398
• Added a warning when state saving dominates the save interval
• Reapplied --max-tasks to restored persistent state #1380
• Honored the --purge-offline-workers grace period after worker-offline events #1190
• Inspected a worker lazily on its first page visit #1388
• Fetched worker task lists only when inspecting a single worker
• Validated the --broker-api URL at startup
• Required both --certfile and --keyfile when either is set
• Validated task API query parameters and publish payloads

Bug fixes

• Fixed worker task table column widths #1521 by @ShubhAtWork
• Fixed the default RabbitMQ management API URL to use the management port #1232
• Fixed the theme dropdown not closing and stuck navbar tooltips
• Fixed a server error on the task page for tasks without a name
• Fixed search queries containing quotes or brackets
• Fixed Redis Sentinel authentication with a username #1386
• Fixed GitHub OAuth login on GitHub Enterprise Server #1308
• Fixed a raw HTTP 400 error after a failed OAuth login #1404
• Fixed a 404 on the login route with a trailing slash #1322
• Fixed error messages containing percent signs
• Fixed the prefetched tasks gauge drifting up for tasks that never start #1364
• Fixed restoring persistent state that reads options during unpickling #1328

Documentation

• Documented how to require basic auth for /metrics #1342
• Documented how to disable /metrics #1379
• Documented option precedence
• Documented the rules for --auth email patterns
• Fixed the --broker-api example #1425
• Fixed the format_task example

Compatibility and packaging

• Built Docker images from source and rebuilt them weekly #1423
• Upgraded all base packages in the Docker image
• Removed pip from the Docker image
• Fixed the documentation build
• Removed the stale Swagger spec

Full changelog: v2.1.0...v2.2.0