💡 Blog Post

We published a blog post summarizing the most relevant changes for end users.

⚠️ Python 3 🐍

This major release starts the new Python-3-only era of Indico. 🐍

Due to the massive changes that come with this, make sure to read the 2.x to 3.0 upgrade guide if you plan to upgrade an existing instance. Also, keep in mind that this is a prerelease, and things may be broken. 💥

While we consider it very stable (it's running in production on the main CERN Indico instance for about a month now), we do not officially encourage you to upgrade your production instances yet.
But if you are going to do it anyway (we know you want to!), please read that guide and have a backup. 💾

Since this is a prerelease, you need to use pip's --pre switch to install it, ie pip install --pre indico (same for indico-plugins)

🏆 Major Features

• There is a new built-in search module which provides basic search functionality out of the box, and for more advanced needs (such as full text search in uploaded files) plugins can provide their own search functionality (e.g. using ElasticSearch). (#4841)
• Categories may now contain both events and subcategories at the same time. During the upgrade to 3.0 event creation is automatically set to restricted in all categories containing subcategories in order to avoid any negative surprises which would suddenly allow random Indico users to create events in places where they couldn't do so previously. (#4679, #4725, #4757)
• The OAuth provider module has been re-implemented based on a more modern library (authlib). Support for the somewhat insecure implicit flow has been removed in favor of the code-with-PKCE flow. Tokens are now stored more securely as a hash instead of plaintext. For a given user/app/scope combination, only a certain amount of tokens are stored; once the limit has been reached older tokens will be discarded. The OAuth provider now exposes its metadata via a well-known URI (RFC 8414) and also has endpoints to introspect or revoke a token. (#4685, #4798)
• User profile pictures (avatars) are now shown in many more places throughout Indico, such as user search results, meeting participant lists and reviewing timelines. (#4625, #4747, #4939)

🎏 Internationalization

• New locale: English (United States) 🇺🇸
• New translation: Turkish 🇹🇷

🎉 Improvements

• Use a more modern search dialog when searching for users (#4674, #4743)
• Add an option to refresh event person data from the underlying user when cloning an event (#4750, #4760)
• Add options for attaching iCal files to complete registration and event reminder emails (#1158, #4780)
• Use the new token-based URLs instead of API keys for persistent ical links and replace the calendar link widgets in category, event, session and contribution views with the more modern ones used in dashboard (#4776, #4801)
• Add an option to export editables to JSON (#4767, #4810)
• Add an option to export paper peer reviewing data to JSON (#4767, #4818)
• Passwords are now checked against a list of breached passwords ("Have I Been Pwned") in a secure and anonymous way that does not disclose any data. If a user logs in with an insecure password, they are forced to change it before they can continue using Indico (#4817)
• Failed login attempts now trigger rate limiting to prevent brute-force attacks (#1550, #4817)
• Allow filtering the "Participant Roles" page by users who have not registered for the event (#4763, #4822)
• iCalendar exports now include contact data, event logo URL and, when exporting sessions/contributions, the UID of the related event. Also, only non-empty fields are exported. (#4785, #4586, #4587, #4791, #4820)
• Allow adding groups/roles as "authorized abstract submitters" (#4834)
• Direct links to (sub-)contributions in meetings using the URLs usually meant for conferences now redirect to the meeting view page (#4847)
• Use a more compact setup QR code for the mobile Indico check-in app; the latest version of the app is now required. (#4844)
• Contribution duration fields now use a widget similar to the time picker that makes selecting durations easier. (#2462, #4873)
• Add new meeting themes that show sequential numbers instead of start times for contributions (#4899)
• Remove the very outdated "Compact style" theme (it's still available via the themes_legacy plugin) (#4900, #4899)
• Support cloning surveys when cloning events (#2045, #4910)
• Show external contribution references in conferences (#4928, #4933)
• Allow changing the rating scale in abstract/paper reviewing even after reviewing started (#4942)
• Allow blacklisting email addresses for user registrations (#4644, #4946)

🐛 Bugfixes

• Take registrations of users who are only members of a custom event role into account on the "Participant Roles" page (#4822)
• Fail gracefully during registration import when two rows have different emails that belong to the same user (#4823)
• Restore the ability to see who's inheriting access from a parent object (#4833)
• Fix misleading message when cancelling a booking that already started and has past occurrences that won't be cancelled (#4719, #4861)
• Correctly count line breaks in length-limited abstracts (#4918)
• Fix error when trying to access subcontributions while event is in draft mode
• Update the user link in registrations when merging two users (#4936)
• Fix error when exporting a conference timetable PDF with the option "Print abstract content of all contributions" and one of the abstracts is too big to fit in a page (#4881, #4955)
• Emails sent via the Editing module are now logged to the event log (#4960)
• Fix error when importing event notes from another event while the target event already has a deleted note (#4959)

🔧 Internal Changes

• Require Python 3.9 🐍 - older Python versions (especially Python 2.7) are no longer supported
• confId has been changed to event_id and the corresponding URL path segments now enforce numeric data (and thus pass the id as a number instead of string)
• CACHE_BACKEND has been removed; Indico now always uses Redis for caching
• The integration with flower (celery monitoring tool) has been removed as it was not widely used, did not provide much benefit, and it is no longer compatible with the latest Celery version
• session.user now returns the user related to the current request, regardless of whether it's coming from OAuth, a signed url or the actual session (#4803)
• Add a new check_password_secure signal that can be used to implement additional password security checks (#4817)
• Add an endpoint to let external applications stage the creation of an event with some data to be pre-filled when the user then opens the link returned by that endpoint (#4628, thanks @adl1995)

⚠️ Security fixes

• Fix XSS vulnerabilities in the category picker (via category titles), location widget (via room and venue names defined by an Indico administrator) and the "Indico Weeks View" timetable theme (via contribution/break titles defined by an event organizer). As neither of these objects can be created by untrusted users (on a properly configured instance) we consider the severity of this vulnerability "minor" (#4897)

🎏 Internationalization

• New translation: Polish 🇵🇱
• New translation: Mongolian 🇲🇳

🎉 Improvements

• Add an option to not disclose the names of editors and commenters to submitters in the Paper Editing module (#4829, #4865)

🐛 Bugfixes

• Do not show soft-deleted long-lasting events in category calendar (#4824)
• Do not show management-related links in editing hybrid view unless the user has access to them (#4830)
• Fix error when assigning paper reviewer roles with notifications enabled and one of the reviewing types disabled (#4838)
• Fix viewing timetable entries if you cannot access the event but a specific session inside it (#4857)
• Fix viewing contributions if you cannot access the event but have explicit access to the contribution (#4860)
• Hide registration menu item if you cannot access the event and registrations are not exempt from event access checks (#4860)
• Fix inadvertently deleting a file uploaded during the "make changes" Editing action, resulting in the revision sometimes still referencing the file even though it has been deleted from storage (#4866)
• Fix sorting abstracts by date (#4877)

🔧 Internal Changes

• Add before_notification_send signal (#4874, thanks @omegak)

⚠️ Security fixes

• Fix some open redirects which could help making harmful URLs look more trustworthy by linking to Indico and having it redirect the user to a malicious site (#4814, #4815)
• The BASE_URL is now always enforced and requests whose Host header does not match are rejected. This prevents malicious actors from tricking Indico into sending e.g. a password reset link to a user that points to a host controlled by the attacker instead of the actual Indico host (#4815, GHSA-wgpj-7c2j-vfjm, CVE-2021-30185)

Note: If the webserver is already configured to enforce a canonical host name and redirects or rejects such requests, this cannot be exploited. Additionally, exploiting this problem requires user interaction: they would need to click on a password reset link which they never requested, and which points to a domain that does not match the one where Indico is running.

🎉 Improvements

• Fail more gracefully is a user has an invalid locale set and fall back to the default locale or English in case the default locale is invalid as well
• Log an error if the configured default locale does not exist
• Add ID-1 page size for badge printing (#4774, thanks @omegak)
• Allow managers to specify a reason when rejecting registrants and add a new placeholder for the rejection reason when emailing registrants (#4769, thanks @vasantvohra)

🐛 Bugfixes

• Fix the "Videoconference Rooms" page in conference events when there are any VC rooms attached but the corresponding plugin is no longer installed
• Fix deleting events which have a videoconference room attached which has its VC plugin no longer installed
• Do not auto-redirect to SSO when an MS office user agent is detected (#4720, #4731)
• Allow Editing team to view editables of unpublished contributions (#4811, #4812)

🔧 Internal Changes

• Also trigger the ical-export metadata signal when exporting events for a whole category
• Add primary_email_changed signal (#4802, thanks @openprojects)

⚠️ Security fixes

• JSON locale data for invalid locales is no longer cached on disk; instead a 404 error is triggered. This avoids creating small files in the cache folder for each invalid locale that is requested. (#4766)

🎏 Internationalization

• New translation: Ukrainian 🇺🇦

🎉 Improvements

• Add a new "Until approved" option for a registration form's "Modification allowed" setting (#4740, thanks @vasantvohra)
• Show last login time in dashboard (#4735, thanks @vasantvohra)
• Allow Markdown in the "Message for complete registrations" option of a registration form (#4741)
• Improve video conference linking dropdown for contributions/sessions (hide unscheduled, show start time) (#4753)
• Show timetable filter button in conferences with a meeting-like timetable

🐛 Bugfixes

• Fix error when converting malformed HTML links to LaTeX
• Hide inactive contribution/abstract fields in submit/edit forms (#4755)
• Fix adding registrants to a session ACL

🔧 Internal Changes

• Videoconference plugins may now display a custom message for the prompt when deleting a videoconference room (#4733)
• Videoconference plugins may now override the behavior when cloning an event with attached videoconference rooms (#4732)

🎉 Improvements

• Disable title field by default in new registration forms (#4688, #4692)
• Add gender-neutral "Mx" title (#4688, #4692)
• Add contributions placeholder for emails (#4716, thanks @bpedersen2)
• Show program codes in contribution list (#4713)
• Display the target URL of link materials if the user can access them (#2599, #4718)
• Show the revision number for all revisions in the Editing timeline (#4708)

🐛 Bugfixes

• Only consider actual speakers in the "has registered speakers" contribution list filter (#4712, thanks @bpedersen2)
• Correctly filter events in "Sync with your calendar" links (this fix only applies to newly generated links) (#4717)
• Correctly grant access to attachments inside public sessions/contribs even if the event is more restricted (#4721)
• Fix missing filename pattern check when suggesting files from Paper Peer Reviewing to submit for Editing (#4715)
• Fix filename pattern check in Editing when a filename contains dots (#4715)
• Require explicit admin override (or being whitelisted) to override blockings (#4706)
• Clone custom abstract/contribution fields when cloning abstract settings (#4724, thanks @bpedersen2)
• Fix error when rescheduling a survey that already has submissions (#4730)

⚠️ Security fixes

• Fix potential data leakage between OAuth-authenticated and unauthenticated HTTP API requests for the same resource (#4663)
  Note: Due to OAuth access to the HTTP API having been broken until this version, we do not believe this was actually exploitable on any Indico instance. In addition, only Indico administrators can create OAuth applications, so regardless of the bug there is no risk for any instance which does not have OAuth applications with the read:legacy_api scope.

🎉 Improvements

• Generate material packages in a background task to avoid timeouts or using excessive amounts of disk space in case of people submitting several times (#4630)
• Add new EXPERIMENTAL_EDITING_SERVICE setting to enable extending an event's Editing workflow through an OpenReferee server (#4659)

🐛 Bugfixes

• Only show the warning about draft mode in a conference if it actually has any contributions or timetable entries
• Do not show incorrect modification deadline in abstract management area if no such deadline has been set (#4650)
• Fix layout problem when minutes contain overly large embedded images (#4653, #4654)
• Prevent pending registrations from being marked as checked-in (#4646, thanks @omegak)
• Fix OAuth access to HTTP API (#4663)
• Fix ICS export of events with draft timetable and contribution detail level (#4666)
• Fix paper revision submission field being displayed for judges/reviewers (#4667)
• Fix managers not being able to submit paper revisions on behalf of the user (#4667)

🔧 Internal Changes

• Add registration_form_wtform_created signal and send form data in registration_created and registration_updated signals (#4642, thanks @omegak)
• Add logged_in signal

💡 Blog Post

We published a blog post summarizing the most relevant changes for end users.

🏆 Major Features

• Add category roles, which are similar to local groups but within the scope of a category and its subcategories. They can be used for assigning permissions in any of these categories and events within such categories.
• Events marked as "Invisible" are now hidden from the category's event list for everyone except managers (#4419, thanks @openprojects)
• Introduce profile picture, which is for now only visible on the user dashboard (#4431, thanks @omegak)
• Registrants can now be added to event ACLs. This can be used to easily restrict parts of an event to registered participants. If registration is open and a registration form is in the ACL, people will be able to access the registration form even if they would otherwise not have access to the event itself. It is also possible to restrict individual event materials and custom page/link menu items to registered participants. (#4477, #4528, #4505, #4507)
• Add a new Editing module for papers, slides and posters which provides a workflow for having a team review the layout/formatting of such proceedings and then publish the final version on the page of the corresponding contribution. The Editing module can also be connected to an external microservice to handle more advanced workflows beyond what is supported natively by Indico.

🎏 Internationalization

• New translation: Chinese (Simplified) 🇨🇳

🎉 Improvements

• Sort survey list by title (#3802)
• Hide "External IDs" field if none are defined (#3857)
• Add LaTeX source export for book of abstracts (#4035, thanks @bpedersen2)
• Tracks can now be categorized in track groups (#4052)
• Program codes for sessions, session blocks, contributions and subcontributions can now be auto-generated (#4026)
• Add draft mode for the contribution list of conference events which hides pages like the contribution list and timetable until the event organizers publish the contribution list. (#4095)
• Add ICS export for information in the user dashboard (#4057)
• Allow data syncing with multipass providers which do not support refreshing identity information
• Show more verbose error when email validation fails during event registration (#4177)
• Add link to external map in room details view (#4146)
• Allow up to 9 digits (instead of 6) before the decimal point in registration fees
• Add button to booking details modal to copy direct link (#4230)
• Do not require new room manager approval when simply shortening a booking (#4214)
• Make root category description/title customizable using the normal category settings form (#4231)
• Added new LOCAL_GROUPS setting that can be used to fully disable local groups (#4260)
• Log bulk event category changes in the event log (#4241)
• Add CLI commands to block and unblock users (#3845)
• Show warning when trying to merge a blocked user (#3845)
• Allow importing event role members from a CSV file (#4301)
• Allow optional comment when accepting a pre-booking (#4086)
• Log event restores in event log (#4309)
• Warn about cancelling/rejecting whole recurring bookings instead of just specific occurrences (#4092)
• Add "quick cancel" link to room booking reminder emails (#4324)
• Add visual information and filtering options for participants' registration status to the contribution list (#4318)
• Add warning when accepting a pre-booking in case there are concurrent bookings (#4129)
• Add event logging to opening/closing registration forms, approval/rejection of registrations, and updates to event layout (#4360, thanks @giusedb & @omegak)
• Add category navigation dialog on category display page (#4282, thanks @omegak)
• Add UI for admins to block/unblock users (#3243)
• Show labels indicating whether a user is an admin, blocked or soft-deleted (#4363)
• Add map URL to events, allowing also to override room map URL (#4402, thanks @omegak)
• Use custom time picker for time input fields taking into account the 12h/24h format of the user's locale (#4399)
• Refactor the room edit modal to a tabbed layout and improve error handling (#4408)
• Preserve non-ascii characters in file names (#4465)
• Allow resetting moderation state from registration management view (#4498, thanks @omegak)
• Allow filtering event log by related entries (#4503, thanks @omegak)
• Do not automatically show the browser's print dialog in a meeting's print view (#4513)
• Add "Add myself" button to person list fields (e.g. for abstract authors) (#4411, thanks @jgrigera)
• Subcontributions can now be managed from the meeting display view (#2679, #4520)
• Add CfA setting to control whether authors can edit abstracts (#3431)
• Add CfA setting to control whether only speakers or also authors should get submission rights once the abstract gets accepted (#3431)
• Show the Indico version in the footer again (#4558)
• Event managers can upload a custom Book of Abstract PDF (#3039, #4577)
• Display each news item on a separate page instead of together with all the other news items (#4587)
• Allow registrants to withdraw their application (#2715, #4585, thanks @brabemi & @omegak)
• Allow choosing a default badge in categories (#4574, thanks @omegak)
• Display event labels on the user's dashboard as well (#4592)
• Event modules can now be imported from another event (#4518, thanks @meluru)
• Event modules can now be imported from another event (#4518, #4533, thanks @meluru)
• Include the event keywords in the event API data (#4598, #4599, thanks @chernals)
• Allow registrants to check details for non-active registrations and prevent them from registering twice with the same registration form (#4594, #4595, thanks @omegak)
• Add a new CUSTOM_LANGUAGES setting to indico.conf to override the name/territory of a language or disable it altogether (#4620)

🐛 Bugfixes

• Hide Book of Abstracts menu item if LaTeX is disabled and no custom Book of Abstracts has been uploaded
• Use a more consistent order when cloning the timetable (#4227)
• Do not show unrelated rooms with similar names when booking room from an event (#4089)
• Stop icons from overlapping in the datetime widget (#4342)
• Fix alignment of materials in events (#4344)
• Fix misleading wording in protection info message (#4410)
• Allow guests to access public notes (#4436)
• Allow width of weekly event overview table to adjust to window size (#4429)
• Fix whitespace before punctuation in Book of Abstracts (#4604)
• Fix empty entries in corresponding authors (#4604)
• Actually prevent users from editing registrations if modification is disabled
• Handle LaTeX images with broken redirects (#4623, thanks @bcc)

🔧 Internal Changes

• Make React and SemanticUI usable everywhere (#3955)
• Add before-regform template hook (#4171, thanks @giusedb)
• Add registrations kwarg to the event.designer.print_badge_template signal (#4297, thanks @giusedb)
• Add registration_form_edited signal (#4421, thanks @omegak)
• Make PyIntEnum freeze enums in Alembic revisions (#4425, thanks @omegak)
• Add before-registration-summary template hook (#4495, thanks @omegak)
• Add extra-registration-actions template hook (#4500, thanks @omegak)
• Add event-management-after-title template hook (#4504, thanks @meluru)
• Save registration id in related event log entries (#4503, thanks @omegak)
• Add before-registration-actions template hook (#4524, thanks @omegak)
• Add LinkedDate and DateRange form field validators (#4535, thanks @omegak)
• Add extra-regform-settings template hook (#4553, thanks @meluru)
• Add filter_selectable_badges signal (#4557, thanks @omegak)
• Add user ID in every log record logged in a request context (#4570, thanks @omegak)
• Add extra-registration-settings template hook (#4596, thanks @meluru)
• Allow extending polymorphic models in plugins (#4608, thanks @omegak)
• Wrap registration form AngularJS directive in jinja block for more easily overriding arguments passed to the app in plugins (#4624, thanks @omegak)

⚠️ Security fixes

• Update bleach to fix a regular expression denial of service vulnerability
• Update Pillow to fix a buffer overflow vulnerability

🎉 Improvements

• Add support for event labels to indicate e.g. postponed or cancelled events (#3199)

🐛 Bugfixes

• Allow slashes in roomName export API
• Show names instead of IDs of local groups in ACLs (#3700)

🐛 Bugfixes

• Fix some email fields (error report contact, agreement cc address) being required even though they should be optional
• Avoid browsers prefilling stored passwords in togglable password fields such as the event access key
• Make sure that tickets are not attached to emails sent to registrants for whom tickets are blocked (#4242)
• Fix event access key prompt not showing when accessing an attachment link (#4255)
• Include event title in OpenGraph metadata (#4288)
• Fix error when viewing abstract with reviews that have no scores
• Update requests and pin idna to avoid installing incompatible dependency versions (#4327)

🎉 Improvements

• Sort posters in timetable PDF export by board number (#4147, thanks @bpedersen2)
• Use lat/lng field order instead of lng/lat when editing rooms (#4150, thanks @bpedersen2)
• Add additional fields to the contribution csv/xlsx export (authors and board number) (#4148, thanks @bpedersen2)

🐛 Bugfixes

• Update the Pillow library to 6.2.1. This fixes an issue where some malformed images could result in high memory usage or slow processing.
• Truncate long speaker names in the timetable instead of hiding them (#4110)
• Fix an issue causing errors when using translations for languages with no plural forms (like Chinese).
• Fix creating rooms without touching the longitude/latitude fields (#4115)
• Fix error in HTTP API when Basic auth headers are present (#4123, thanks @uxmaster)
• Fix incorrect font size in some room booking dropdowns (#4156)
• Add missing email validation in some places (#4158)
• Reject requests containing NUL bytes in the POST data (#4159)
• Fix truncated timetable PDF when using "Print each session on a separate page" in an event where the last timetable entry of the day is a top-level contribution or break (#4134, thanks @bpedersen2)
• Only show public contribution fields in PDF exports (#4165)
• Allow single arrival/departure date in accommodation field (#4164, thanks @bpedersen2)

⚠️ Security fixes

• Fix more places where LaTeX input was not correctly sanitized.

While the biggest security impact (reading local files) has already been mitigated when fixing the initial vulnerability in the previous release, it is still strongly recommended to update.

⚠️ Security fixes

• Fix more places where LaTeX input was not correctly sanitized.

While the biggest security impact (reading local files) has already been mitigated when fixing the initial vulnerability in the previous release, it is still strongly recommended to update.

⚠️ Security fixes (GHSA-67cx-rhhq-mfhq)

• Strip @, +, - and = from the beginning of strings when exporting CSV files to avoid security issues when opening the CSV file in Excel
• Use 027 instead of 000 umask when temporarily changing it to get the current umask
• Fix LaTeX sanitization to prevent malicious users from running unsafe LaTeX commands through specially crafted abstracts or contribution descriptions, which could lead to the disclosure of local file contents

🎉 Improvements

• Improve room booking interface on small-screen devices (#4013)
• Add user preference for room owners/manager to select if they want to receive notification emails for their rooms (#4096, #4098)
• Show family name field first in user search dialog (#4099)
• Make date headers clickable in room booking calendar (#4099)
• Show times in room booking log entries (#4099)
• Support disabling server-side LaTeX altogether and hide anything that requires it (such as contribution PDF export or the Book of Abstracts). LaTeX is now disabled by default, unless the XELATEX_PATH is explicitly set in indico.conf.

🐛 Bugfixes

• Remove 30s timeout from dropzone file uploads
• Fix bug affecting room booking from an event in another timezone (#4072)
• Fix error when commenting on papers (#4081)
• Fix performance issue in conferences with public registration count and a high amount of registrations
• Fix confirmation prompt when disabling conference menu customizations (#4085)
• Fix incorrect days shown as weekend in room booking for some locales
• Fix ACL entries referencing event roles from the old event when cloning an event with event roles in the ACL. Run indico maint fix-event-role-acls after updating to fix any affected ACLs (#4090)
• Fix validation issues in coordinates fields when editing rooms (#4103)

This release is just backporting important security fixes from v2.2.3 in case you are still on v2.1 and cannot upgrade to v2.2.3 quickly.

⚠️ Security fixes

• Strip @, +, - and = from the beginning of strings when exporting CSV files to avoid security issues when opening the CSV file in Excel
• Use 027 instead of 000 umask when temporarily changing it to get the current umask
• Fix LaTeX sanitization to prevent malicious users from running unsafe LaTeX commands through specially crafted abstracts or contribution descriptions, which could lead to the disclosure of local file contents

Bugfixes

• Fix bug in calendar view, due to timezones (#3903)
• Remove dependency on pyatom, which has vanished from PyPI (#4045)

Bug fixes

• Remove pyatom from the project's dependencies. It seems to have vanished from PyPI (maybe discontinued?) but luckily werkzeug already includes it as a contrib module (see #4045).

Improvements

• Make list of event room bookings sortable (#4022)
• Log when a booking is split during editing (#4031)
• Improve "Book" button in multi-day events (#4021)

Bugfixes

• Add missing slash to the template_prefix of the designer module
• Always use HH:MM time format in book-from-event link
• Fix timetable theme when set to "indico weeks view" before 2.2 (#4027)
• Avoid flickering of booking edit details tooltip
• Fix outdated browser check on iOS (#4033)

Major Changes

• ⚠️ Drop support for Internet Explorer 11 and other outdated or discontinued browser versions. Indico shows a warning message when accessed using such a browser. The latest list of supported browsers can be found in the README, but generally Indico now supports the last two versions of each major browser (determined at release time), plus the current Firefox ESR.
• Rewrite the room booking frontend to be more straightforward and user-friendly. Check the blog for details.

Improvements

• Rework the event log viewer to be more responsive and not freeze the whole browser when there are thousands of log entries
• Add shortcut to next upcoming event in a category (#3388)
• Make registration period display less confusing (#3359)
• Add edit button to custom conference pages (#3284)
• Support markdown in survey questions (#3366)
• Improve event list in case of long event titles (#3607, thanks @nop33)
• Include event page title in the page's <title> (#3285, thanks @bpedersen2)
• Add option to include subcategories in upcoming events (#3449)
• Allow event managers to override the name format used in the event (#2455)
• Add option to not clone venue/room of an event
• Show territory/country next to the language name (#3968)
• Add more sorting options to book of abstracts (#3429, thanks @bpedersen2)
• Add more formatting options to book of abstracts (#3335, thanks @bpedersen2)
• Improve message when the call for abstracts is scheduled to open but hasn't started yet
• Make link color handling for LaTeX pdfs configurable (#3283, thanks @bpedersen2)
• Preserve displayed order in contribution exports that do not apply any specific sorting (#4005)
• Add author list button to list of papers (#3978)

Bugfixes

• Fix incorrect order of session blocks inside timetable (#2999)
• Add missing email validation to contribution CSV import (#3568, thanks @Kush22)
• Do not show border after last item in badge designer toolbar (#3607, thanks @nop33)
• Correctly align centered footer links (#3599, thanks @nop33)
• Fix top/right alignment of session bar in event display view (#3599, thanks @nop33)
• Fix error when trying to create a user with a mixed-case email address in the admin area
• Fix event import if a user in the exported data has multiple email addresses and they match different users
• Fix paper reviewers getting notifications even if their type of reviewing has been disabled (#3852)
• Correctly handle merging users in the paper reviewing module (#3895)
• Show correct number of registrations in management area (#3935)
• Fix sorting book of abstracts by board number (#3429, thanks @bpedersen2)
• Enforce survey submission limit (#3256)
• Do not show "Mark as paid" button and checkout link while a transaction is pending (#3361, thanks @driehle)
• Fix 404 error on custom conference pages that do not have any ascii chars in the title (#3998)
• Do not show pending registrants in public participant lists (#4017)

Internal Changes

• Use webpack to build static assets
• Add React+Redux for new frontend modules
• Enable modern ES201x features

Improvements

• Add A6 to page size options (#3793)

Bugfixes

• Fix celery/redis dependency issue (#3809)