Summary of changes from February 24, 2018 to March 2, 2018.
| Codebase | Repository | {icon lock} | HEAD | Activity |
|----------|------------|--|------|----------|
| Phabricator | rP | | rP42e5b8a04 | 39 commits |
| Arcanist | rARC | | rARCbe1dd7e2 | 0 commits |
| libphutil | rPHU | | rPHUdedf260 | 1 commit |
| Instances (SAAS) | rSAAS | {icon lock} | rSAASa71d20f | 0 commits |
| Services (SAAS) | rSERVICES | {icon lock} | rSERVICESedd96db | 0 commits |
| Core (SAAS) | rCORE | {icon lock} | rCOREc937d90 | 0 commits |
- These changes were promoted to `stable`.
General
=======
[{icon tint, color=sky}] **Content-Security-Policy**: We now emit a `Content-Security-Policy` header. See T4340 for discussion.
[{icon tint, color=sky}] **Harbormaster Build Logs**: This release includes an prototype version of upgraded build logs. See T13088 for discussion. If you have a large volume of build logs, the migrations in this release may take a significant amount of time to apply.
Security
========
The `Content-Security-Policy` header (see above) is a significant general security hardening measure. (It does not defuse any specific known vulnerability today.)
Migrations
==========
| Migration | Risk | Duration | Notes |
|-----------|------|----------|-------|
| 20180222.log.01.filephid.sql | | 702 ms |
| 20180223.log.01.bytelength.sql | | 652 ms |
| 20180223.log.02.chunkformat.sql | | 749 ms |
| 20180223.log.03.chunkdefault.sql | | 482 ms |
| 20180223.log.04.linemap.sql | | 682 ms |
| 20180223.log.05.linemapdefault.sql | | 431 ms |
| 20180228.log.01.offset.sql | | 7,176 ms |
//"Duration" is the duration for this install, and may not be representative.//
Upgrading / Compatibility
=========================
The `Content-Security-Policy` header may break custom code which does unusual things, particularly if you've written custom code which directly inlines external Javascript from third-party services (this might be external Javascript libraries like jQuery served from a public CDN).
Custom code which handles static resources (CSS and Javascript) using the standard Phabricator toolchain (Celerity) should largely be unaffected. Other applications either need to be converted to use Celerity or explicitly add CSP exceptions.
When browsers block scripts, images, CSS, frames, requests, etc., because of `Content-Security-Policy`, they show a helpful error message in the browser console. You can use this error to identify where your application violates the policy.
Minor
=====
- [{icon tint, color=sky}] Herald now supports "Committer's projects" and "Author's projects" fields for "Commit" and "Commit Hook: Commit Content" rules.
- Phriction documents should no longer send mail to the //previous// editor.
- [{icon tint, color=sky}] Default profile images now generate more quickly.
- [{icon tint, color=sky}] Fixed a bug where creating a project with a "Members of project" Edit Policy and simultaneously adding several members would generate a perplexing policy exception.
//The [{icon tint, color=sky}] icon indicates a change backed by support mana.//