NEWS

Apache CouchDB NEWS
===================

For details about backwards incompatible changes, see:

  http://wiki.apache.org/couchdb/Breaking_changes

Each release section notes when backwards incompatible changes have been made.

# Version 1.4.0
# -------------
#
# This version has not been released yet.

Version 1.3.0
-------------

 * Added view request duration to Futon.
 * Removed the Futon test suite in favour of the CLI test suite.
 * Fixed unnecessary conflict when deleting and creating a document in the same
   batch.
 * New and updated passwords are hashed using PBKDF2.
 * Fix various bugs in the URL rewriter when recursion is involved.
 * Added Server-Sent Events protocol to db changes API.
 * Moved the JS test suite to the CLI.
 * Make password hashing synchronous when using the /_config/admins API.
 * Added utc_id UUID algorithm.
 * Encode database name during URL rewriting.
 * Include user name in show/list ETags.
 * Per module log levels.
 * Server-wide UUID in some replication ids.
 * E4X support in views is now deprecated and will be removed in a future
   version.
 * Experimental support for Cross-Origin Resource Sharing (CORS).

Version 1.2.2
-------------

 * Fixed rewrite counter bug.

Version 1.2.1
-------------

 * Fixed CVE-2012-5641: Apache CouchDB Information disclosure via unescaped
   backslashes in URLs on Windows
 * Fixed CVE-2012-5649: Apache CouchDB JSONP arbitrary code execution with Adobe
   Flash
 * Fixed CVE-2012-5650: Apache CouchDB DOM based Cross-Site Scripting via Futon
   UI
 * Fix various bugs in the URL rewriter when recursion is involved.
 * Fix couchdb start script.
 * Futon: Disable buttons that aren't available for the logged-in user.
 * Fix potential replication timeouts.
 * Change use of signals to avoid broken view groups.

Version 1.2.0
-------------

This release contains backwards incompatible changes.

 * Updated bundled erlang_oauth library to the latest version.
 * cURL is no longer required to build CouchDB as it is only
   required by the command line JS test runner.
 * Added a native JSON parser.
 * Optional file compression (database and view index files). This feature
   is enabled by default.
 * Several performance improvements, especially regarding database
   writes and view indexing.
 * Added a `data_size` property to database and view group
   information URIs.
 * Added support for automatic compaction. This feature is disabled
   by default, but it can be enabled via the .ini configuration.
 * A new replicator implementation that offers more performance
   and configuration options.
 * Added optional field `since_seq` to replication objects/documents.
 * Simpler replication cancelation.
 * The _active_tasks API now exposes more granular fields for each
   task type.
 * Futon's `Status` screen (active tasks) now displays two new task
   status fields: `Started on` and `Updated on`.
 * Added built-in changes feed filter `_view`.
 * Fixed old index file descriptor leaks after a view cleanup.
 * Performance improvements for the built-in changes feed filters
   `_doc_ids` and `_design`.
 * Fixes to the `_changes` feed heartbeat option when combined with
   a filter. It affected continuous pull replications with a filter.
 * Fix use of OAuth with VHosts and URL rewriting.
 * OAuth secrets can now be stored in the users system database.
 * Documents in the _users database can no longer be read by everyone.
 * Confidential information in the _replication database can no longer
   be read by everyone.
 * Password hashes are now calculated by CouchDB instead of the client.
 * Allow persistent authentication cookies.
 * The requested_path property of query server request objects now has
   the path requested by clients before VHosts and rewriting.
 * Fixed incorrect reduce query results when using pagination parameters.
 * Made icu_driver work with Erlang R15B and later.
 * Improvements to the build system and etap test suite.
 * Improvements to log messages for file-related errors.
 * Avoid invalidating view indexes when running out of file descriptors.
 * Log correct stacktrace in all cases.

Version 1.1.2
-------------

 * Fixed CVE-2012-5641: Apache CouchDB Information disclosure via unescaped
   backslashes in URLs on Windows
 * Fixed CVE-2012-5649: Apache CouchDB JSONP arbitrary code execution with
   Adobe Flash
 * Fixed CVE-2012-5650: Apache CouchDB DOM based Cross-Site Scripting via Futon
   UI
 * ETag of attachment changes only when the attachment changes, not
   the document.
 * Fix pull replication of documents with many revisions.
 * Fix replication with an HTTP source and target
 * Avoid invalidating view indexes when running out of file descriptors.
 * Improvements to log messages for file-related errors.
 * Fix retrieval of headers larger than 4k.
 * Allow OPTIONS HTTP method for list requests.
 * Don't attempt to encode invalid json.
 * Improve SpiderMonkey version detection.

Version 1.1.1
-------------

 * Support SpiderMonkey 1.8.5
 * Add configurable maximum to the number of bytes returned by _log.
 * Allow CommonJS modules to be an empty string.
 * Bump minimum Erlang version to R13B02.
 * Do not run deleted validate_doc_update functions.
 * ETags for views include current sequence if include_docs=true.
 * Fix bug where duplicates can appear in _changes feed.
 * Fix bug where update handlers break after conflict resolution.
 * Fix bug with _replicator where include "filter" could crash couch.
 * Fix crashes when compacting large views.
 * Fix file descriptor leak in _log
 * Fix missing revisions in _changes?style=all_docs.
 * Improve handling of compaction at max_dbs_open limit.
 * JSONP responses now send "text/javascript" for Content-Type.
 * Link to ICU 4.2 on Windows.
 * Permit forward slashes in path to update functions.
 * Reap couchjs processes that hit reduce_overflow error.
 * Status code can be specified in update handlers.
 * Support provides() in show functions.
 * _view_cleanup when ddoc has no views now removes all index files.
 * max_replication_retry_count now supports "infinity".
 * Fix replication crash when source database has a document with empty ID.
 * Fix deadlock when assigning couchjs processes to serve requests.
 * Fixes to the document multipart PUT API.
 * Fixes regarding file descriptor leaks for databases with views.

Version 1.1.0
-------------

All NEWS for 1.0.2 also apply to 1.1.0.

This release contains backwards incompatible changes.

 * Native SSL support.
 * Added support for HTTP range requests for attachments.
 * Added built-in filters for `_changes`: `_doc_ids` and `_design`.
 * Added configuration option for TCP_NODELAY aka "Nagle".
 * Allow wildcards in vhosts definitions.
 * More granular ETag support for views.
 * More flexible URL rewriter.
 * Added OS Process module to manage daemons outside of CouchDB.
 * Added HTTP Proxy handler for more scalable externals.
 * Added `_replicator` database to manage replications.
 * Multiple micro-optimizations when reading data.
 * Added CommonJS support to map functions.
 * Added `stale=update_after` query option that triggers a view update after
   returning a `stale=ok` response.
 * More explicit error messages when it's not possible to access a file due
   to lack of permissions.
 * Added a "change password"-feature to Futon.

Version 1.0.4
-------------

 * Fixed CVE-2012-5641: Apache CouchDB Information disclosure via unescaped
   backslashes in URLs on Windows
 * Fixed CVE-2012-5649: Apache CouchDB JSONP arbitrary code execution with
   Adobe Flash
 * Fixed CVE-2012-5650: Apache CouchDB DOM based Cross-Site Scripting via Futon
   UI
 * Fix file descriptor leak in _log.
 * Fix missing revisions in _changes?style=all_docs.
 * Fix validation of attachment names.
 * Avoid invalidating view indexes when running out of file descriptors.
 * Fix a race condition where replications can go stale

Version 1.0.3
-------------

 * Fixed compatibility issues with Erlang R14B02.
 * Fix bug that allows invalid UTF-8 after valid escapes.
 * Enabled replication over IPv6.
 * Fixed for crashes in continuous and filtered changes feeds.
 * Changes feeds now honor conflicts=true parameter.
 * Fixed error when restarting replications in OTP R14B02.
 * Fixed error with filter replication with a limit of 1.
 * Upgrade ibrowse to version 2.2.0.
 * Fixed OAuth signature computation in OTP R14B02.
 * Handle passwords with : in them.
 * Made compatible with jQuery 1.5.x.
 * Added support for inclusive_end with reduce views.
 * Etap tests no longer require use of port 5984.
 * Windows builds now require ICU >= 4.4.0 and Erlang >= R14B03.

Version 1.0.2
-------------

 * Fixed CVE-2010-3854: Apache CouchDB Cross Site Scripting Issue
 * Make test suite work with Safari and Chrome.
 * Fix leaking file handles after compacting databases and views.
 * Fix databases forgetting their validation function after compaction.
 * Fix occasional timeout errors.
 * Reduce lengthy stack traces.
 * Allow logging of native <xml> types.
 * Updated ibrowse library to 2.1.2 fixing numerous replication issues.
 * Fix authenticated replication of design documents with attachments.
 * Fix multipart GET APIs by always sending attachments in compressed
   form when the source attachment is compressed on disk. Fixes a possible
   edge case when an attachment underwent local-local replication.
 * Various fixes to make replicated more resilient for edge-cases.
 * Don't trigger a view update when requesting `_design/doc/_info`.
 * Fix for circular references in CommonJS requires.
 * Fix for frequently edited documents in multi-master deployments being
   duplicated in _changes and _all_docs.
 * Fix spurious conflict generation during attachment uploads.
 * Fix for various bugs in Futon.

Version 1.0.1
-------------

 * Fixed CVE-2010-2234: Apache CouchDB Cross Site Request Forgery Attack
 * Fix data corruption bug COUCHDB-844. Please see
   http://couchdb.apache.org/notice/1.0.1.html for details.
 * Added support for replication via an HTTP/HTTPS proxy.
 * Fixed various replicator bugs for interop with older CouchDB versions.
 * Show fields saved along with _deleted=true. Allows for auditing of deletes.
 * Enable basic-auth popup when required to access the server, to prevent
   people from getting locked out.
 * User interface element for querying stale (cached) views.

Version 1.0.0
-------------

 * More efficient header commits.
 * Use O_APPEND to save lseeks.
 * Faster implementation of pread_iolist(). Further improves performance on
   concurrent reads.
 * Added authentication caching
 * Faster default view collation.
 * Added option to include update_seq in view responses.

Version 0.11.2
--------------

 * Fixed CVE-2010-2234: Apache CouchDB Cross Site Request Forgery Attack
 * Avoid potential DOS attack by guarding all creation of atoms.
 * Replicator buxfixes for replicating design documents from secured databases.
 * Better error messages on invalid URL requests.
 * User documents can now be deleted by admins or the user.
 * Some Futon and JavaScript library bugfixes.

Version 0.11.1
--------------

 * Mask passwords in active tasks and logging.
 * Update mochijson2 to allow output of BigNums not in float form.
 * Added support for X-HTTP-METHOD-OVERRIDE.
 * Disable jsonp by default.
 * Accept gzip encoded standalone attachments.
 * Made max_concurrent_connections configurable.
 * Added continuous replication option to Futon.
 * Added option to replicating test results anonymously to a community
   CouchDB instance.
 * Allow creation and deletion of config entries in Futon.
 * Fixed various UI issues in Futon.
 * Fixed compatibility with the Erlang R14 series.
 * Fixed warnings on Linux builds.
 * Fixed build error when aclocal needs to be called during the build.
 * Require ICU 4.3.1.
 * Fixed compatibility with Solaris.
 * Added authentication redirect URL to log in clients.
 * Added authentication caching, to avoid repeated opening and closing of the
   users database for each request requiring authentication.
 * Made authentication timeout configurable.
 * Temporary views are now admin-only resources.
 * Don't require a revpos for attachment stubs.
 * Make file deletions async to avoid pauses during compaction and db
   deletion.
 * Fixed for wrong offset when writing headers and converting them to blocks,
   only triggered when header is larger than 4k.
 * Preserve _revs_limit and instance_start_time after compaction.
 * Fixed timeout with large .ini files.
 * Added tests for couch.js and jquery.couch.js
 * Added various API features to jquery.couch.js
 * Faster default view collation.
 * Upgrade CommonJS modules support to 1.1.1.
 * Added option to include update_seq in view responses.
 * Fixed erlang filter funs and normalize filter fun API.
 * Fixed hang in view shutdown.
 * Refactored various internal APIs related to attachment streaming.
 * Fixed hanging replication.
 * Fixed keepalive issue.
 * Allow global rewrites so system defaults are available in vhosts.
 * Allow isolation of databases with vhosts.
 * Made the test suite overall more reliable.

Version 0.11.0
--------------

This version is a feature-freeze release candidate for Apache CouchDB 1.0.

 * Fixed CVE-2010-0009: Apache CouchDB Timing Attack Vulnerability.
 * Added support for building a Windows installer as part of 'make dist'.
 * Added optional 'raw' binary collation for faster view builds where Unicode
   collation is not important.
 * Improved view index build time by reducing ICU collation callouts.
 * Added option to implicitly create replication target databases.
 * Improved view information objects.
 * Bug fix for partial updates during view builds.
 * Bug fix for building couch.app's module list.
 * Fixed a problem with statistics timers and system sleep.
 * Improved the statistics calculations to use an online moving window
   algorithm.
 * Adds batching of multiple updating requests, to improve throughput with many
   writers.
 * Removed the now redundant couch_batch_save module.
 * Bug fix for premature termination of chunked responses.
 * Improved speed and concurrency of config lookups.
 * Fixed an edge case for HTTP redirects during replication.
 * Fixed HTTP timeout handling for replication.
 * Fixed query parameter handling in OAuth'd replication.
 * Fixed a bug preventing mixing languages with lists and views.
 * Avoid OS process leaks in lists.
 * Avoid leaking file descriptors on automatic replication restarts.
 * Various improvements to the Futon UI.
 * Provide Content-MD5 header support for attachments.
 * Adds configurable compression of attachments.
 * Added default cookie-authentication and users db.
 * Added per-db reader access control lists.
 * Added per-db security object for configuration data in validation functions.
 * Added URL Rewriter handler.
 * Added proxy authentication handler.
 * Added ability to replicate documents by id.
 * Added virtual host handling.
 * Uses json2.js for JSON serialization compatiblity with native JSON.
 * Fixed CVE-2010-0009: Apache CouchDB Timing Attack Vulnerability.

Version 0.10.2
--------------

 * Fixed CVE-2010-0009: Apache CouchDB Timing Attack Vulnerability.

Version 0.10.1
--------------

 * Fixed test suite to work with build system.
 * Fixed a problem with statistics timers and system sleep.
 * Fixed an edge case for HTTP redirects during replication.
 * Fixed HTTP timeout handling for replication.
 * Fixed query parameter handling in OAuth'd replication.
 * Fixed a bug preventing mixing languages with lists and views.
 * Avoid OS process leaks in lists.

Version 0.10.0
--------------

This release contains backwards incompatible changes.

 * General performance improvements.
 * View index generation speedups.
 * Even more robust storage format.
 * Native Erlang Views for high-performance applications.
 * More robust push and pull replication.
 * Two-legged OAuth support for applications and replication (three-legged in
   preparation).
 * Cookie authentication.
 * API detail improvements.
 * Better RFC 2616 (HTTP 1.1) compliance.
 * Added modular configuration file directories.
 * Miscellaneous improvements to build, system integration, and portability.

Version 0.9.2
-------------

 * Remove branch callbacks to allow building couchjs against newer versions of
   Spidermonkey.
 * Fix replication with 0.10 servers initiated by an 0.9 server.

Version 0.9.1
-------------

 * Various bug fixes for the build system, configuration, statistics reporting,
   database core, external handlers, Futon interface, HTTP interface,
   JavaScript View Server and replicator.

Version 0.9.0
-------------

This release contains backwards incompatible changes.

 * Modular configuration.
 * Performance enhancements for document and view access.
 * More resilient replication process.
 * Replication streams binary attachments.
 * Administrator role and basic authentication.
 * Document validation functions in design documents.
 * Show and list functions for rendering documents and views as developer
   controlled content-types.
 * External process server module.
 * Attachment uploading from Futon.
 * Etags for views, lists, shows, document and attachment requests.
 * Miscellaneous improvements to build, system integration, and portability.

Version 0.8.1-incubating
------------------------

 * Various bug fixes for replication, compaction, the HTTP interface and the
   JavaScript View Server.

Version 0.8.0-incubating
------------------------

This release contains backwards incompatible changes.

 * Changed core licensing to the Apache Software License 2.0.
 * Refactoring of the core view and storage engines.
 * Added support for incremental map/reduce views.
 * Changed database file format.
 * Many improvements to Futon, the web administration interface.
 * Miscellaneous improvements to build, system integration, and portability.
 * Swapped out Erlang's inets HTTP server for the Mochiweb HTTP server.
 * SpiderMonkey is no longer included with CouchDB, but rather treated as an
   external dependency.
 * Added bits of awesome.

Version 0.7.2
-------------

 * Small changes to build process and `couchdb` command.
 * Database server official port is now 5984 TCP/UDP instead of 8888.

Version 0.7.1
-------------

 * Small compatibility issue with Firefox 3 fixed.

Version 0.7.0
-------------

 * Infrastructure rewritten to use the GNU build system for portability.
 * The built-in database browsing tool has been rewritten to provide a much
   nicer interface for interacting directly with CouchDB from your web browser.
 * XML and Fabric have been replaced with JSON and JavaScript for data
   transport and View definitions.

Version 0.6.0
-------------

 * A replication facility is now available.
 * CouchPeek can now create, delete and view documents.
 * Building from source is easier and less error prone.

Version 0.5.0
-------------

 * A built-in CouchPeek utility.
 * A full install kit buildable from a single command.
 * A new GNU/Linux version is available. An OS X version is coming soon.

Version 0.4.0
-------------

 * Non-existent variables are now nil lists.
 * Couch error codes and messages are no longer sent in the HTTP fields,
   instead they are exclusively returned in the XML body. This is to avoid HTTP
   header parsing problems with oddly formed error messages.
 * Returned error messages are now logged at the server at the `info` level to
   make general debugging easier.
 * Fixed a problem where big table builds caused timeout errors.
 * Lots of changes in the low level machinery. Most formulas will continue to
   function the same.
 * Added full compiler support for extended characters in formula source.
 * Support for Perl/Ruby like regular expressions.
 * Added `total_rows` and `result_start` attributes to tables.

Version 0.3.0
-------------

 * CouchDB now fully supports Unicode and locale specific collation via the ICU
   library, both in the Fabric engine and computed tables.
 * The `in` operator has been added to Fabric.
 * The `startdoc` query string variable specifies the starting document to use
   if there are multiple rows with identical startkeys.
 * The `skip` query string variable specifies the number of rows to skip before
   returning results. The `skip` value must be a positive integer. If used with
   a `count` variable the skipped rows aren't counted as output.
 * Various changes to the output XML format.