v3.20.0

Single sign-on

Most of this release fixes single sign-on (OpenID Connect). If you sign in through an external identity provider:

• Logging in no longer fails with "No OIDC tokens found in cookies" when Gramps Web is served over plain HTTP (#889)
• Users are no longer reset to the guest role on every login when the provider sends no group information, as Google does
• Logging in no longer fails when the e-mail address from the provider is already in use by another account
• Microsoft Entra logins work again

Three things were removed at the same time. The GitHub login provider has been dropped because it never worked: GitHub speaks OAuth 2.0 rather than OpenID Connect. The /oidc/backchannel-logout/ endpoint is gone, since it only ever revoked tokens on whichever worker happened to receive the notification and left them valid everywhere else. The OIDC_REDIRECT_URI setting is gone too; nothing ever
read it.

All of the above is #907.

Other changes

• Failed background tasks report their error again. A failed GEDCOM import on a new installation used to show a ValueError when the task status was polled (#908, #910)
• New trees are initialised as soon as they are created, fixing the lock timeouts and occasional permanent corruption that occurred when several workers opened a brand-new tree at the same time (#909 by @DavidMStraub, #923 by @dsblank)
• Site admins no longer need a tree assigned, so a multi-tree instance can be administered before the first tree exists (#904)
• LOG_FORMAT=json now covers gunicorn's own logs as well, instead of mixing JSON and plain-text lines (#919)
• Errors can optionally be reported to Sentry by setting SENTRY_DSN (#922). Note: this is off by default and, even when enabled, defaults to not sending personally identifiable information
• Browsing is faster for users who are not allowed to see private records, on shared PostgreSQL databases (#912)
• Gramps Web API can be installed and started without the packages needed for S3 media storage, video and PDF thumbnails, OCR and the database repair tools. They are now imported only when those features are actually used (#920 by @dsblank)