🎉 Improvements

• Use more verbose page titles in management/admin areas (#6300)
• Prioritize exact matches when searching for users (#6254)
• Show document templates from non-parent categories and other events for cloning as long as the user has management access (#6232)
• Warn about conflicts from concurrent edits of minutes (#3410, #6193)
• Include up to two months (up from one week) of past events in dashboard iCal export (#6304)

🐛 Bugfixes

• Fix adding additional event keywords when some keywords have already been set (#6264, thanks @SegiNyn)
• Fix overlapping times in some room booking timelines when using a locale with a 12-hour time format (#6263)
• Fix error when printing badges referencing a linked regform picture field that contains no picture (#6276)
• Fix error when creating a reminder for exactly one week before the event (#6283)
• Fix error when unassigning the editor of an editable that has no editor (#6284)
• Fix error when judging an editable from the list of editables (#6284)
• Fix validation error when using a mailto: link in an email body (#6286)
• Clear the flags indicating that registrations or a registration form field have been purged when cloning an event (#6288)
• Use English locale when formatting dates for room booking log entries (#6295)
• Fix date validation in room booking failing in certain timezones

🔧 Internal Changes

• Allow plugins to fully replace the data in a ticket QR code with a custom string instead of just modifying/extending the JSON dict (#6266)
• Replace deprecated pkg_resources with importlib from standard library (#6272, #6273, thanks @maxnoe)

🐛 Bugfixes

• Fix sending emails when using TLS (SMTP_USE_TLS) (#6261)

⚠️ Linux versions & Python 3.12 🐍

This release moves from Python 3.9 to Python 3.12. 🐍
It also drops support for legacy (and nearly end-of-life) operating systems, in particular CentOS 7.

Because of this, make sure to read the 3.x to 3.3 upgrade guide if you plan to upgrade an existing instance.

If you need any help with the upgrade after reading the docs, don't hesitate to ask in our forum.

🏆 Major Features

• A new "Document Templates" module was added which supports the generation of fully customizable PDF documents for event participants such as receipts and certificates of attendance.
• The Room Booking module now supports recurring bookings that repeat on specific weekdays. For example, a room can be booked every Monday and Wednesday over a set period of time.
• Badge and ticket templates can now be linked to a registration form. This makes it possible to reference custom registration fields when creating the template.
• The existing Indico Check-in app has been completely rewritten as a PWA (Progressive Web App). Please note that the old Check-in app has been deprecated and is not compatible with the new version of Indico. The new app can be found here.
• A new badge/ticket setting has been added which, when enabled, makes it possible to print badges and/or tickets for accompanying persons in addition to the main registrant.
• Users can now export all their data stored in Indico. This includes personal data and any data they are linked to such as registrations, minutes and files uploaded to Indico.
• Users can now be anonymized in Indico; this means that all personal identifiers associated with a user will be removed from Indico, whilst only keeping the data that is required for Indico to function properly, in an anonymized manner. This operation can only be performed by Indico system administrators through the indico command-line interface.
• Administrators now have the option to require users to accept the Terms of Use during signup and after the terms have been updated.
• Event managers can require participants to accept the event's Privacy Policy when registering.
• Event tickets can now be added to Google Wallet using the new experimental Google Wallet integration. You can enable this feature using the ENABLE_GOOGLE_WALLET config setting and then configure it on the category level.
• The category calendar view has been improved with new week/day views and new filtering options for category, venue, room or keywords.
• Managers can now change the registration fee for selected registrations in bulk.
• Lots of new accessibility improvements, including improved keyboard navigation, better color contrast, and better screen reader support.

🎏 Internationalization

• New locale: English (Canada) (#6063, thanks @omegak)

🎉 Improvements

• Invalidate password reset links once the password has been changed (#5878)
• Add full ACLs for custom conference menu items, instead of just being able to restrict them to speakers or registrants (#5670, thanks @kewisch)
• Make editing timeline display much more straightforward (#5674)
• Allow event managers to delete editables from contributions (#5778, #5892)
• Allow room managers to add internal notes to bookings (#5746, #5791)
• Support generating tickets and badges for each of the registrant's accompanying persons (#5424)
• Add keyboard shortcut (CTRL-SHIFT-A) to toggle room booking admin override (#5909)
• Improve login page UI, allow overriding the logo URL (LOGIN_LOGO_URL config option) and using custom logos for auth providers (logo_url in the auth provider settings) (#5936, thanks @openprojects)
• Show only active registration counts on the registration form management dashboard, and add an inactive registration count to the registration list (#5990)
• Store creation date of users and show it to admins (#5957, thanks @vasantvohra)
• Add option to hide links to Room Booking system for users who lack access (#5981, thanks @SegiNyn)
• Support weekly room bookings that take place on multiple weekdays (#5829, #6000, #5806)
• Hide events marked as invisible from builtin search results unless the user is a manager (#5947, thanks @openprojects)
• Support sessions that expire at a certain date (specified by the used flask-multipass provider) regardless of activity when using an external login method (#5907, thanks @cbartz)
• Allow configuring future months threshold for categories (#2984, #5928, thanks @kewisch)
• Allow editors to edit their review comments on editables (#6008)
• Auto-linking of patterns in minutes (e.g. issue trackers, Github repos...) (#5998)
• Log editor actions in the Editing module (#6015)
• Grant subcontribution speakers submission privileges by default in newly created events (#5905, #6025)
• Stop overwhelmingly showing past events in the 'Events at hand' section in the user dashboard (#6049)
• Add document templates to generate PDF receipts, certificates, and similar documents for event participants (#751, #5060, #6246, #5123, #6078, #6250)
• Show which persons are external in the user search dialog (#6074)
• Add feature for users to export all data linked to them (#5757)
• Add Outlook online calendar button to share widget (#6075, #6077)
• Remove Facebook and Google+ share widgets and make Twitter share button privacy-friendly (#6077)
• Do not bother people registering using an invitation link with a CAPTCHA (#6095)
• Add option to allow people to register using an invitation link even if the event is restricted (#6094)
• Improve editing notifications emails (#6027, #6042, #6154)
• Add a picture field for registration forms which can use the local webcam to take a picture in addition to uploading one, and also supports cropping/rotating the picture (#5922, thanks @SegiNyn)
• Use a more compact registration ticket QR code format which is faster to scan and less likely to fail in poor lighting conditions (#6123)
• Add a legend to the category calendar, allowing to filter events either by category, venue, room or keywords (#6105, #6106, #6128, #6148, #6149, #6127, #6110, #6158, #6183, thanks @Moliholy, @unconventionaldotdev)
• Allow to configure a restrictive set of allowed keywords (#6127, #6183, thanks @Moliholy, @unconventionaldotdev).
• Add week and day views in the category calendar and improve navigation controls (#6108, #6129, #6107, #6110, thanks @Moliholy, @unconventionaldotdev).
• Add the ability to clone privacy settings (#6156, thanks @SegiNyn)
• Add option for managers to change the registration fee of a set of registrations (#6132, #6138)
• Add setting to configure whether room bookings require a reason (#6150, #6155, thanks @Moliholy, @unconventionaldotdev)
• Add a "Picture" personal data field to registrations. When used, it allows including the picture provided by the user on badges/tickets (#6160, thanks @vtran99)
• Support ~~text~~ to strike-out text in markdown (#6166)
• Add experimental support for creating Google Wallet tickets (opt-in via ENABLE_GOOGLE_WALLET indico.conf setting) (#6028, thanks @openprojects)
• Add option to exceptionally grant registration modification privileges to some registrants (#5264, #6152, thanks @Thanhphan1147)
• Add option to require users to agree to terms during signup or after they have been updated (#5923, #5925, thanks @kewisch)
• Add indico user delete CLI to attempt to permanently delete a user (#5838)
• Add indico user anonymize CLI to permanently anonymize a user (#5838)
• Add possibility to link room reservations to multiple events, session blocks and contributions (#6113, #6114, thanks @omegak, @unconventionaldotdev)
• Store editable list filters in the browser's local storage (#6192)
• Take visibility restrictions into account in the atom feed (#5472, thanks @bpedersen2)
• Allow linking badge templates to registration forms in order to use custom fields in them (#6088)
• Allow filtering the list of editables by tags (#6195, #6197)
• Warn users with a dialog before their session expires and let them extend it (#6026, thanks @SegiNyn)

🐛 Bugfixes

• Prevent room booking sidebar menu from overlapping with the user dropdown menu (#5910)
• Allow cancelling pending bookings even if they have already "started" (#5995)
• Disallow switching the repeat frequency of an existing room booking from weekly to monthly or vice versa (#5999)
• Ignore deleted fields when computing the number of occupied slots for a registration (#6035)
• Show the description of a subcontribution in conference events (#5946, #6056)
• Only block templates containing a QR code via is_ticket_blocked (#6062)
• Use custom map URL in event API if one is set (#6111, thanks @stine-fohrmann)
• Use the event timezone when scheduling call for abstracts/papers (#6139)
• Allow setting registration fees larger than 999999.99 (#6172)
• Populate fields such as first and last name from the multipass login provider (e.g. LDAP) during sign-up regardless of synchronization settings (#6182)
• Hide redundant affiliations tooltip on the Participant Roles list (#6201)
• Correctly highlight required "yes/no" registration form field as invalid (#6109, #6242)
• Include comments in the Paper Peer Reviewing JSON export (#6253)
• Fail with a nicer error message when trying to upload a non-UTF8 CSV file (#6085, #6259)
• Do not include unnecessary user data in JSON exports (#6260)

♿ Accessibility

• Include current language in page metadata (#5894, thanks @foxbunny)
• Make language list accessible (#5899, #5903, thanks @foxbunny)
• Add accessible label to the main page link (#5934, #5935, thanks @foxbunny)
• Add bypass block links (#5932, #5939, thanks @foxbunny)
• Make search fields more accessible (#5948, #5950, thanks @foxbunny)
• Make search result status messages more accessible (#5949, #5950, thanks @foxbunny)
• Make search results tabs accessible (:issues:5964, #5965, thanks @foxbunny)
• Make timezone list accessible (#5908, #5914, thanks @foxbunny)
• Make "Skip access checks" checkbox in search keyboard-accessible (#5952, #5953, thanks @foxbunny)
• Prevent icons from being announced to screen readers as random characters (#5985, #5986, thanks @foxbunny)
• Add proper labels to the captcha play and reload buttons (#6064, #6080, :thanks:foxbunny)
• Associate form labels with form controls in the registration form (#6059, #6073, #6076, thanks @foxbunny)
• Make dropdown menu fully accessible (#5896, #5897, thanks @foxbunny)
• Improve registration form color contrast and font sizes (#6098, thanks @foxbunny)

🔧 Internal Changes

• Support and require Python 3.12 - older Python versions are no longer supported (#5978, #6249)
• Use (dart-)sass instead of the deprecated node-sass/libsass for CSS compilation (#5734)
• Add event.is_field_data_locked signal, allowing plugins to lock registration form fields on a per-registration basis (#5424)
• Replace WYSIWYG (rich-text) editor with TinyMCE, due to the license and branding requirements of the previous editor (#5938)
• Add a new Indico design system (#5914, thanks @foxbunny)
• Add event.registration_form_field_deleted signal, allowing plugins to handle the removal of registration form fields (#5924)
• Add a tool bin/managemnent/icons_generate.py to generate CSS for icomoon icons based on selection.json (#5986, thanks @foxbunny)
• Pass form class arguments to core.add_form_fields signal handlers (#6020, thanks @vtran99)
• Remove watchman reloader support, use watchfiles instead (#5978)
• Improve indico i18n CLI to support plugin-related i18n operations (#5906, #5961, thanks @SegiNyn)
• Use ruff for linting Python code (#6037)
• Add <ind-menu> custom element for managing drop-down menus (#5896, #5897, thanks @foxbunny)
• Allow plugins to add extra fields to the room booking form (#6126, thanks @VojtechPetru)

⚠️ Security fixes

• Update Werkzeug library due to a DoS vulnerability while parsing certain file uploads (CVE-2023-46136)
• Fix registration form CAPTCHA not being fully validated (#6096)

🎉 Improvements

• Add placeholders for accompanying persons to the badge/ticket designer (#6033)

🐛 Bugfixes

• Fix meeting timetable not showing custom locations when all top-level timetable entries are session blocks inheriting the custom location from its session (#6014)
• Always show exact matches when searching for existing videoconference rooms to attach to an event (#6022)
• Include materials linked to sessions in the material package (#6024)
• Use the correct locale when sending sending email notifications to others in an event (#5987, #6021)
• Fix the author/speaker selector (e.g. for abstracts) breaking when submitting the form and getting a validation error (#6043, #6053)
• Do not cancel past linked room bookings when deleting an event (#6032, #6051)
• Fix contribution list filters being obscured by the action dialog (#6055)
• Fix emailing Paper Peer Reviewing and Editing teams (#6145)

⚠️ Security fixes

• Update Pillow library due to vulnerabilities in libwebp (CVE-2023-4863)

🎏 Internationalization

• New translation: Italian

🐛 Bugfixes

• Fix error when sending registration invitation reminders (#5879, #5880, thanks @bpedersen2)
• Fix accessing the conference overview page when the default conference home page is set to a custom page (#5882)
• Show percentages for multi-choice survey answers based on number of answers instead of total number of choices selected (#5930)

🐛 Bugfixes

• Fix not being able to remove the last entry from a room ACL (#5863, thanks @SegiNyn)
• Fix conditional fields remaining hidden in abstract judgment form (#5873)

⚠️ Security fixes

• Fix an XSS vulnerability in various confirmation prompts commonly used when deleting things. Exploitation requires someone with at least submission privileges (such as a speaker) and then rely on someone else to attempt to delete this content. However, considering that event organizers may indeed delete suspicious-looking content when encountering it, there is a non-negligible risk of such an attack to succeed. Because of this it is strongly recommended to upgrade as soon as possible (#5862, CVE-2023-37901, GHSA-fmqq-25x9-c6hm)

🎏 Internationalization

• New translation: Czech

🎉 Improvements

• Show which files were added or modified on each editing timeline revision (#5802)
• Support rendering Japanese, Chinese & Korean letters in PDFs (#3120, #5842, thanks @adamjenkins)
• Add button to adapt columns widths on the reviewing area's abstracts list (#5837)
• Allow cloning category-level badge/poster templates into another category (#5775, thanks @SegiNyn)
• Allow using a custom link text in the {event_link} email placeholder, using the {event_link:something-else-here} syntax (#5858, #5860)
• Add option to add "event cancelled" semantics for event labels, which will disable reminders for events having this label (#5285, #5861)

🐛 Bugfixes

• Use correct name formatting in person link fields (#5835)

🔧 Internal Changes

• Support Python 3.11

⚠️ Security fixes

• Fix an XSS vulnerability in the LaTeX \href macro when rendering it client-side. Previously, it was possible to embed arbitrary JavaScript there using the javascript: protocol. The underlying MathJax library has now been updated to version 3 which allows blacklisting certain protocols, thus allowing only http, https and mailto links in \href macros (#5818)

🎉 Improvements

• Show actual recipient data in the email preview instead of the that of the event creator (#5794)
• Add an option to set a maximum number of choices in a multi-choice field (#5800)

🐛 Bugfixes

• Fix width of time column in PDF timetable when using 12-hour time format (#5788)
• Fix wrong date in email subject for room booking occurrence cancellations (#5790)
• Fix excessive queries being sent in meetings that have registration form with limited places and many registrants (#5799)
• Fix extremely slow query when retrieving list of registration forms in conferences with many registrants while not logged in (#5799)
• Fix title of session conveners being always empty in HTTP API with XML serialization (#5813)
• Fix editable filters not working simultaneously with editable search (#5796)
• Fix missing icons in Abstract Markdown editor (#5815)
• Fix text overflow in event manage button (#5816)
• Fix undone revisions being used instead of the latest valid one when downloading revision files as a ZIP archive (#5820)
• Fix custom actions not showing on revisions if the latest revision has been undone (#5820)

⚠️ Security fixes

• Set Vary: Cookie header when session data is present and used. This ensures that data linked to a (logged-in) session cannot leak between requests even in case of a poorly-configured caching proxy in front of Indico (#5753)

🎉 Improvements

• Use the revision's timestamp when downloading its files as a ZIP archive (#5686)
• Use more consistent colors on the editing judgment button (#5687, #5697)
• Keep history when undoing judgments on editables (#5630)
• Add search field to the abstracts list for reviewers (#5698, #5703)
• Align status box colors with judgment dropdown (#5699, #5706)
• Use a gender-neutral chairperson icon (#5710)
• Add option to set the abstracts' primary authors as the default submitters for the corresponding contributions (#5711)
• Allow commenting on accepted/rejected editables (#5712, #5722)
• Hide deleted sections and fields from registration summary (#5716)
• Add support for authorized submitters in Call for Papers (#5728)
• Display abstract submission comment in the list of abstracts (#5733)
• Allow searching for contributions by author in the management area (#5742)
• Include start/end dates of the whole booking in the timeline tooltip of recurring room bookings (#5730, #5740)
• Add day of the week to room booking details modal and timeline (#5718, #5743)
• Allow acceptance and rejection of editables in the editable list (#5721)
• Email verification attempts during signup now trigger rate limiting to prevent spamming large amounts of confirmation emails (#5727)
• Allow bulk-commenting editables in the editable list (#5747)
• Allow emailing contribution persons that have not yet made any submissions to a given editable type (#5755)
• Show only "ready to review" editables on the "get next editable" list (#5765)
• Disallow uploading empty files (#5767)
• Include non-speaker authors in the timetable export API (#5412, #5738)
• Add setting to force track selection when accepting abstracts (#5771)
• Log detailed changes when editing contributions (#5777)
• Allow managers to ignore required field restrictions in registration forms (#5644, #5682, thanks @kewisch)
• Allow selecting the global noreply address as the sender for event reminders (#5784)

🐛 Bugfixes

• Fix creating invited abstracts (#5696)
• Fix error on contribution page when there is no paper but the peer reviewing module is enabled and configured to hide accepted papers
• Clone all protection settings (in particular submitter privileges) when cloning events (#5702)
• Fix searching in single-choice dropdown fields in registration forms (#5709)
• Fix uploading files in registration forms where the user only has access through the registration's token (#5719)
• Fix being unable to set the "speakers and authors" as the default contribution submitter type (#5711)
• Check server-side if Call for Papers is open when submitting a paper (#5725)
• Fix room notification email list showing up empty when editing it (#5729, #5731)
• Fix performance issues in paper assignment list (#5736)
• Fix performance issues in event export API with large events when including contributions (#5736)
• Fix error when a search query matches content from unlisted events (#5759, #5761)
• Fix ToS and Privacy Policy links in room booking module not working when using an external URL (#5774)
• Do not apply default values to new registration form fields when editing an existing registration (#5781)
• Allow 0 for a required registration form numbe field (unless a higher minimum value is set) (#5781)

🔧 Internal Changes

• Update Python & JavaScript dependencies (#5726, #5752)
• Add support for the watchfiles live reloader (#5732)
• Add an endpoint to allow resetting the state of an accepted editable to "ready to review" (#5758)
• Add RESTful endpoints for custom contribution fields (#5768)

⚠️ Security fixes

• Sanitize HTML in global announcement messages
• Update cryptography library due to vulnerabilities in OpenSSL (CVE-2023-0286)
• Update werkzeug library due to a potential Denial of Service vulnerability (CVE-2023-25577)

Note: The risk of malicious HTML (e.g. scripts) in the global announcement is minimal as only Indico administrators can set such an announcement anyway. However, in the unlikely case that an administrator becomes malicious or is compromised, they would have been be able to perform XSS against their Indico instance.

🎉 Improvements

• Include co-authors in abstract list columns and spreadsheet exports (#5605)
• Include speakers in abstract list columns and spreadsheet exports (#5615)
• Add an option to export all events in a series to ical at once (#5617, #5620)
• Make it possible to load more events in series management (#5629)
• Check manually entered email addresses of speakers/authors/chairpersons to avoid collisions and inconsistencies (#5478)
• Add option to use review track as accepted track when bulk-accepting abstracts (#5608)
• Add setting to only allow managers to upload attachments to events and contributions (#5597)
• Support Markdown when writing global announcement and apply standard HTML sanitization to the message (#5640)
• Add BCC field on contribution email dialogs (#5637)
• Allow filtering by location in room booking (#4291, #5622, thanks @mindouro)
• Add button to adapt column widths in paper & contribution lists (#5642)
• Add event language settings to set default and additional languages (#5606, #5607, thanks @vasantvohra)
• Fail nicely when trying to import an event from another Indico instance (#5619, #5653)
• Add option to send reminders to invited registrants who have not yet responded (#5579, #5654)
• Hide the top box with the latest files of an editable until it has been accepted and published (#5660, #5665)
• Allow uploading files when requesting changes on the editing timeline (#5612)
• Add locked_fields to the identity provider settings in indico.conf to prevent non-admin users from turning off their profile's personal data synchronization (#5648)
• Add an option to sync event persons with users (#5677)
• Disallow repeated filenames in editing revisions (#5681)
• Add setting to hide peer-reviewed papers from participants even after they have been accepted (#5666, #5671)
• Prevent concurrent assignment of editors to editables (#5684)
• Add color labels to the filter dropdown (#5675, #5680)

🐛 Bugfixes

• Correctly show contribution authors in participant roles list (#5603)
• Disable Sentry trace propagation to outgoing HTTP requests (#5604)
• Include token in notification emails for private surveys (#5618)
• Fix some API calls not working with personal access tokens (#5627)
• Correctly handle paragraphs and linebreaks in plaintext conversion (#5623)
• Send manager notifications and email participant if they withdraw from an event (#5633, #5638, thanks @kewisch)
• Do not break registrations with purged accommodation fields (#5641, #5643)
• Do not show blocked rooms as available on the very last day of the blocking (#5663)
• Do not show blocked rooms as available for admins unles they have admin override mode enabled (#5663)
• Fix roles resetting to the default ones when editing person data in an abstract or contribution (#5664)
• Correctly show paragraphs in CKEditor fields (#5624, #5656, thanks @kewisch)
• Fix empty iCal file being attached when registering for a protected event (#5688)

🔧 Internal Changes

• Add rh.before-check-access signal (#5639, thanks @omegak)
• Add indico celery --watchman ... to run Celery with the Watchman reloader (#5667)
• Allow overriding the cache TTL for remote group membership checks (#5672)
• Allow a custom editing workflow service to mark new editables as ready-for-review without creating a new replacement revision (#5668)
• Update Python dependencies (#5689)

🎉 Improvements

• Display program codes in 'My contributions' (#5573)
• Warn when a user cannot create an event in the current category (#5572)
• Display all contributions in 'My contributions' and not just those with submitter privileges (#5575)
• Apply stronger sanitization on rich-text content pasted into CKEditor (#5560, #5571)
• Allow raw HTML snippets when editing custom conference pages and event descriptions (#5584, #5587)
• Warn more clearly that link attachments are just a link and do not copy the file (#5551, #5593)
• Add option to email people with specific roles about their contributions or abstracts (#5598)
• Add setting to allow submitters to edit custom fields in their contributions (#5599)

🐛 Bugfixes

• Fix broken links in some notification emails (#5567)
• Fix always-disabled submit button when submitting an agreement response on someone's behalf (#5574)
• Disallow nonsensical retention periods and visibility durations (#5576)
• Fix sorting by program code in editable list (#5582)
• Do not strip custom CSS classes from HTML in CKEditor (#5584, #5585)
• Use the instance's default locale instead of "no locale" (US-English) in places where no better information is known for email recipients (#5586)

🔧 Internal Changes

• Refactor email-sending dialog using React (#5547)

⚠️ Security fixes

• Update cryptography library due to vulnerabilities in OpenSSL (CVE-2022-3602, CVE-2022-3786)

Note: We do not think that Indico is affected by those vulnerabilities as it does not use the cryptography library itself, and the dependency that uses it is only used during SSO (OAuth) logins and most likely in a way that is not vulnerable. It is nonetheless recommended to update as soon as possible.

🎏 Internationalization

• Make email templates translatable (#5263, #5488, thanks @Leats)

🎉 Improvements

• Enable better image linking UI in CKEditor (#5492)
• Restore the "fullscreen view" option in CKEditor (#5505)
• Display & enforce judging deadline (#5506)
• Add a setting to disable entering persons in person link fields manually (#5499)
• Allow taking minutes in markdown (#3386, #5500, thanks @Leats)
• Add setting to preselect "Include users with no Indico account" when adding authors/speakers (#5553)
• Include event label in email reminders (#5554, #5556, thanks @omegak)
• Include emails of submitters, speakers and authors in abstract/contribution Excel/CSV exports (#5565)

🐛 Bugfixes

• Fix meeting minutes being shown when they are expected to be hidden (#5475)
• Force default locale when generating Book of Abstracts (#5477)
• Fix width and height calculation when printing badges (#5479)
• Parse escaped quotes (") in ckeditor output correctly (#5487)
• Fix entering room name if room booking is enabled but has no locations (#5495)
• Fix privacy information dropdown not opening on Safari (#5507)
• Only let explicitly assigned reviewers review papers (#5527)
• Never count participants from a registration forms with a fully hidden participant list for the total count on the participant page (#5532)
• Fix "Session Legend" not working in all-days timetable view (#5539)
• Fix exporting unlisted events via API (#5555)

🔧 Internal Changes

• Require at least Postgres 13 during new installations. This check can be forced on older Postgres versions (11+ should work), but we make no guarantees that nothing is broken (the latest version we test with is 12) (#5503)
• Refactor service request email generation so plugins can override sender and reply-to addresses for these emails (#5501)
• Deleting a session no longer leaves orphaned session blocks (#5533, thanks @omegak)
• Indicate in the registration_deleted signal whether it's a permanent deletion from the database or just a soft-deletion (#5559)

💡 Blog Post

We published a blog post summarizing the most relevant changes for end users.

🏆 Major Features

• The registration form frontend has been completely rewritten using modern web technology.
• Registrations can now have a retention period for the whole registration and individual fields, after which their data is permanently deleted.
• The participant list of an event can now use consent to determine whether a participant should be displayed, and its visibility can be different for the general public and other registered participants.
• An event can now have one or more privacy notices and it's possible to set the name and contact information of the "Data controller" (useful where GDPR or similar legislation applies).

🎏 Internationalization

• New translation: German

🎉 Improvements

• Add a new event management permission that grants access only to the abstracts module (#5212)
• Add a link to quickly view the current stylesheet on the conference layout customization page (#5239, #5259)
• Add more powerful filters to "get next editable" and the list of editables (#5188, #5224, #5241)
• Add the ability to create speaker-only menu entries for conferences (#5261, #5268)
• Highlight changed fields in notification emails about modified registrations (#5265, #5269)
• Add an option to send notifications of new abstract comments (#5266, #5284)
• Badge/poster templates can have additional images besides the background image (#5273, thanks @SegiNyn)
• Add ability to add alerts to iCal exports (#5318, #5320, thanks @PerilousApricot)
• Show affiliations of submitters and authors in abstract/contribution lists and add an extra column with this information to Excel/CSV exports (#5330)
• Add option to delete persons from the event if they have no roles or other ties to the event anymore (#5294, #5313)
• Allow events to be favorited (#1662, #5338, thanks @Leats)
• Include abstract content in CSV/Excel export if enabled in the abstract list (#5356, #5372, thanks @rppt)
• Add the ability to include an optional static javascript file when defining custom conference themes from within a plugin (#5414, thanks @brittyazel)
• Add option to make the 'Affiliation' and 'Comment' fields mandatory in the account request form (#4819, #5389, thanks @elsbethe)
• Include tags in registrant API (#5441)
• Subcontribution speakers can now be granted submission privileges in the event's protection settings (#2363, #5444)
• Registration forms can now require a CAPTCHA when the user is not logged in (#4698, #5400)
• Account creation now requires a CAPTCHA by default to prevent spam account creation (#4698, #5446)
• Add contribution's program code to revision's "Download ZIP" filename (#5449)
• Add UI to manage series of events (#4048, #5436, thanks @Leats)
• Event series can now specify a title pattern to use when cloning an event in the series (#5456)
• Insert new categories into the correct position if the list is already sorted (#5455)
• Images can now be uploaded by pasting or dropping them into the editor for minutes or the event description (#5458)
• Add JSON export for contribution details (#5460)

🐛 Bugfixes

• Fix selected state filters not showing up as selected in abstract list customization (#5363)
• Do not propose an impossible date/time in the Room Booking module when accessing it shortly before midnight (#5371)
• Do not fail when viewing an abstract that has been reviewed in a track which has been deleted in the meantime (#5386)
• Fix error when editing a room's nonbookable periods (#5390)
• Fix incorrect access check when directly accessing a registration form (#5406)
• Fix error in rate limiter when using Redis with a UNIX socket connection (#5391)
• Ensure that submitters with contribution edit privileges can only edit basic fields (#5425)
• Do not return the whole contribution list when editing a contribution from elsewhere (#5425)
• Fix session blocks not being sorted properly in a timetable PDF export when they have the same start time (#5426)
• Fix printing badges containing text elements with malformed HTML (#5437, thanks @omegak)
• Fix misleading start and end times for Poster contributions in the timetable HTTP API and the contributions placeholder in emails (#5443)
• Do not mark persons as registered if the registration form has been deleted (#5448)
• Fix error when a room owner who is not an admin edits their room (#5457)

🔧 Internal Changes

• Add new regform-container-attrs template hook to pass additional (data-)attributes to the React registration form containers (#5271)
• Add support for JavaScript plugin hooks to register objects or react components for use by JS code that's in the core (#5271)
• Plugins can now define custom registration form fields (#5282)
• Add EMAIL_BACKEND configuration variable to support different email sending backends e.g. during development (#5375, #5376, thanks @Moist-Cat)
• Make model attrs to clone interceptable by plugins (#5403, thanks @omegak)
• Add signal_query method in the IndicoBaseQuery class and the db_query signal, allowing to intercept and modify queries by signal handlers (#4981, thanks @omegak).
• Update WYSIWYG editor to CKEditor 5, resulting in a slightly different look for the editor controls and removal of some uncommon format options (#5345)

🐍 Python 3.10 supported

Indico 3.2 supports both Python 3.9 and 3.10

🎉 Improvements

• Prompt before leaving the event protection page without saving changes (#5222)
• Add the ability to clone abstracts (#5217)
• Add setting to allow submitters to edit their own contributions (#5213)
• Update the editing state color scheme (#5236)
• Include program codes in export API (#5246)
• Add abstract rating scores grouped by track (#5298)
• Allow uploading revisions when an editor hasn't been assigned (#5289)

🐛 Bugfixes

• Fix published editable files only being visible to users with access to the editing timeline (#5218)
• Fix incorrect date in multi-day meeting date selector dropdown in certain timezones (#5223)
• Remove excessive padding around category titles (#5225)
• Fix error when exporting registrations to PDFs that contained certain invalid HTML-like sequences (#5233)
• Restore logical order of registration list columns (#5240)
• Fix a performance issue in the HTTP API when exporting events from a specific category while specifying a limit (only affected large databases) (#5260)
• Correctly specify charset in iCalendar files attached to emails (#5228, #5258, thanks @imranyusuff)
• Fix very long map URLs breaking out of the event management settings box (#5275)
• Fix missing abstract withdrawal notification (#5281)
• Fix downloading files from editables without a published revision (#5290)
• Do not mark participants with deleted/inactive registrations as registered in participant roles list (#5308)
• Do not enforce personal token name uniqueness across different users (#5317)
• Fix last modification date not updating when an abstract is edited (#5325)
• Fix a bug with poster and badge printing in unlisted events (#5322)

🔧 Internal Changes

• Add category-sidebar template hook and blocks around category sidebar sections (#5237, thanks @omegak)
• Add event.reminder.before_reminder_make_email signal (#5242, thanks @vasantvohra)
• Add plugin.interceptable_function signal to intercept selected function calls (#5254)

💡 Blog Post

We published a blog post summarizing the most relevant changes for end users.

🏆 Major Features

• Category managers now see a log of all changes made to their category in a category log (similar to the event log). This log includes information about all events being created, deleted or moved in the category (#2809, #5029)
• Besides letting everyone create events in a category or restricting it to specific users, categories now also support a moderation workflow which allows event managers to request moving an event to a category. Only once a category manager approves this request, the event is actually moved (#2057, #5013)
• Admins now have the option to enable "Unlisted events", which are events that are not (yet) assigned to a category. Such events are only accessible to its creator and other users who have been granted access explicitly, and do not show up in any category's event listing (#4294, #5055, #5023, #5095)

🎉 Improvements

• Send event reminders as individual emails with the recipient in the To field instead of using BCC (#2318, #5088)
• Let event managers assign custom tags to registrations and filter the list of registrations by the presence or absence of specific tags (#4948, #5091)
• Allow importing registration invitations from a CSV file (#3673, #5108)
• Show event label on category overviews and in iCal event titles (#5140, #5143)
• Let event managers view the final timetable even while in draft mode (#5141, #5145)
• Add option to export role members as CSV (#5147, #5156)
• Include attachment checksums in API responses (#5084, #5169, thanks @avivace)
• iCalendar invites now render nicely in Outlook (#5178)
• Envelope senders for emails can now be restricted to specific addresses/domains using the SMTP_ALLOWED_SENDERS and SMTP_SENDER_FALLBACK config settings (#4837, #2224, #1877, #5179)
• Allow filtering the contribution list based on whether any person (speaker or author) has registered for the event or not (#5192, #5193)
• Add background color option and layer order to badge/poster designer items (#5139, thanks @SegiNyn)
• Allow external users in event/category ACLs (#5146)

🐛 Bugfixes

• Fix CUSTOM_COUNTRIES not overriding names of existing countries (#5183)
• Fix error dialog when submitting an invited abstract without being logger in (#5200)
• Fix category picker search displaying deleted categories (#5197, #5203)
• Fix editing service API calls using the service token (#5170)
• Fix excessive retries for Celery tasks with a retry wait time longer than 1 hour (#5172)

⚠️ Security fixes

• Protect authentication endpoints against CSRF login attacks (#5099, thanks @omegak)

🎉 Improvements

• Support TLS certificates for SMTP authentication (#5100, thanks @dweinholz)
• Add CSV/Excel contribution list exports containing affiliations (#5114, #5118)
• Include program codes in contribution PDFs and spreadsheets (#5126)
• Add an API for bulk-assigning contribution program codes programmatically (#5115, #5120)
• Add layout setting to show videoconferences on the main conference page (#5124)

🐛 Bugfixes

• Fix certain registration list filters (checkin status & state) being combined with OR instead of AND (#5101)
• Fix translations not being taken into account in some places (#5073, #5105)
• Use correct/consistent field order for personal data fields in newly created registration forms
• Remove deleted registration forms from ACLs (#5130, #5131, thanks @jbtwist)

🔧 Internal Changes

• Truncate file names to 150 characters to avoid hitting file system path limits (#5116, thanks @vasantvohra)

🐛 Bugfixes

• Fix JavaScript errors on the login page which caused problems when using multiple form-based login methods (e.g. LDAP and local Indico accounts)

🎉 Improvements

• Allow filtering abstracts by custom fields having no value (#5033, #5034)
• Add support for syncing email addresses when logging in using external accounts (#5035)
• Use more space-efficient QR code version in registration tickets (#5052)
• Improve user experience when accessing an event restricted to registered participants while not logged in (#5053)
• When searching external users, prefer results with a name in case of multiple matches with the same email address (#5066)
• Show program codes in additional places (#5075)
• Display localized country names (#5070, #5076)

🐛 Bugfixes

• Show correct placeholders in date picker fields (#5022)
• Correctly preselect the default currency when creating a registration form
• Do not notify registrants when a payment transaction is created in "pending" state
• Keep the order of multi-choice options in registration summary (#5020, #5032)
• Correctly handle relative URLs in PDF generation (#5042, #5044)
• Render markdown in track descriptions in PDF generation (#5043, #5044)
• Fix error when importing chairpersons from an existing event (#5047)
• Fix broken timetable entry permalinks when query string args are present (#5049)
• Do not show "Payments" event management menu entry for registration managers (#5072)
• Replace some hardcoded date formats with locale-aware ones (#5059, #5071)
• Clone the scientific program description together with tracks (#5077)
• Fix database error when importing registrations to an event that already contains a deleted registration form with registrations (#5078)

🔧 Internal Changes

• Add event.before_check_registration_email signal (#5021, thanks @omegak)
• Do not strip image maps in places where HTML is allowed (#5026, thanks @bpedersen2)
• Add event.registration.after_registration_form_clone signal (#5037, thanks @vasantvohra)
• Add registration-invite-options template hook (#5045, thanks @vasantvohra)
• Fix Typeahead widget not working with extra validators (#5048, #5050, thanks @jbtwist)

Note that we only list the changes since 3.0rc2 here. Please make sure to also check the changelogs for 3.0rc1 and 3.0rc2.

🏆 Major Features

• Add system notices which inform administrators about important things such as security problems or outdated Python/Postgres versions. These notices are retrieved once a day without sending any data related to the Indico instance, but if necessary, this feature can be disabled by setting SYSTEM_NOTICES_URL = None in indico.conf (#5004)
• It is now possible to use SAML SSO for authentication without the need for Shibboleth and Apache (#5014)

🐛 Bugfixes

• Fix formatting and datetime localization in various PDF exports and timetable tab headers (#5009)
• Show lecture speakers as speakers instead of chairpersons on the participant roles page (#5008)

🔧 Internal Changes

• Signals previously exposed directly via signals.foo now need to be accessed using their explicit name, i.e. signals.core.foo (#5007)
• Add category.extra_events signal (#5005, thanks @omegak)

Since this is a prerelease, you need to use pip's --pre switch to install it, ie pip install --pre indico (same for indico-plugins)

🏆 Major Features

• Add support for personal tokens. These tokens act like OAuth tokens, but are associated with a specific user and generated manually without the need of doing the OAuth flow. They can be used like API keys but with better granularity using the same scopes OAuth applications have, and a single user can have multiple tokens using various scopes. By default any user can create such tokens, but admins can restrict their creation. (#1934, #4976)

🎉 Improvements

• Add abstract content to the abstract list customization options (#4968)
• Add CLI option to create a series (#4969)
• Users cannot submit multiple anonymous surveys anymore by logging out and in again (#4693, #4970)
• Improve reviewing state display for paper reviewers (#4979, #4984)
• Make it clearer if the contributions/timetable of a conference are still in draft mode (#4977, #4986)
• Add "send to speakers" option in event reminders (#4958, #4966, thanks @Naveenaidu)
• Allow displaying all events descending from a category (#4982, #4983, thanks @omegak and @openprojects).
• Add an option to allow non-judge conveners to update an abstract track (#4989)

🐛 Bugfixes

• Fix errors when importing events containing abstracts or event roles from a YAML dump (#4995)
• Fix sorting abstract notification rules (#4998)
• No longer silently fall back to the first event contact email address when sending registration emails where no explicit sender address has been configured (#4992, #4996, thanks @vasantvohra)
• Do not check for event access when using a registration link with a registration token (#4991, #4997, thanks @vasantvohra)