It's been a while since we didn't issue a major release. So here we go! This contains a lot of improvements, new features and fixes.

Thanks to everyone involved! 🥳

Breaking changes

Include project code into project authentication token. This invalidates all existing API tokens and invitation links from previous versions (#802 #843)
Drop support for Python 2 (#483)
Drop support for Python 3.5 (#571)
Drop support for MySQL (#743)
Require MariaDB version 10.3.2 or above (#632)
Enable session cookie security by default (#845)
Change token path authentication to /{project}/join/{token} (#843)

The minimum supported version is now Python 3.6, and the project is tested with up to Python 3.9

See the upgrade instructions to make sure the upgrade goes smoothly.

Security

Add CSRF validation on destructive actions (#796)
Ask for private code to delete project or project history (#796)
Add headers to mitigate Clickjacking, XSS, and other attacks: X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy, Referrer-Policy (#845)
Add URL validation to external link to prevent XSS (#846)

Allow to import previously exported json data (#518)
Add new optional field "external link" in bill form (#429)
Add optional currencies to project and bills (#541, #864)
Add new statistics showing monthly expenses (#526)
Add pagination to the list of bills (#480)
Add sorting, pagination, and searching to the admin dashboard (#538)
Add Project History page that records all changes (#553)
Add token-based authentication to the API (#504)
Add illustrations as a showcase, currently only for French (#544)
Add a page for downloading mobile application (#688)
Add optional support for a simple CAPTCHA (#844)
Add translations for Greek, Esperanto, Italian, Japanese, Portuguese and Swedish
Publish an official docker image

Use the external debts lib to solve settlements (#476)
Remove balance column in statistics view (#323)
Make language choice persistent (#547)
Localize date strings in the current language (#590)
Differentiate "flash alerts" notifications (#594)
Display "flash messages" persistently instead of making them disappear (#856)
Improve menu bar spacing, put history and settings in a submenu (#739)
Change Dockerfile to install python dependencies at build time (#793)
Updating project settings doesn't require to enter or update project code (#774)
Bump dependencies: WTForms (#768) jinja2 (#753) itsdangerous (#756) flask (#755 #757 #764)
Remove requirements files in favor of setup.cfg pinning (#558)
Make language choice persistent (#547)
Flash messages must be dismissed manually (#856)
Increased the font size of the logo (#828)

Reorganize "Contributing" documentation to be more accessible to new contributors
Improve documentation regarding database migrations (#569)
Added a page about the security model (#858)