v3.23.0

This release adds GEDCOM 7 export, GOQL in filters and per-device sync tokens, and fixes a security issue in the search index. We recommend all users to upgrade.

Security fix

Since v2.4.0, private records were included in the search index used for users who are not allowed to see them (the Guest role). Search results never contained them, but hit counts revealed whether a search term occurs in a private record. On trees where AI chat was enabled for guests, the chat assistant could also reveal the full text of private records, such as the body of a private note. Existing indexes are cleaned up by the next incremental reindex (#1035). Thanks to @dsblank for reporting the issue.

Breaking changes

• The oql query parameter is removed in favour of the new MatchesQuery filter rule (#1013)
• Objects with keys unknown to Gramps are rejected with 400 (#1004)
• Invalid report options are rejected with 422 instead of being silently coerced (#1007)

New features

• GEDCOM 7 export. Trees can now be exported to GEDCOM 7, the latest version of the GEDCOM standard, complementing the existing GEDCOM 7 import. The usual export options such as privacy, living people and filters apply, and the export reports anything it had to leave out (#1034).
• GEDCOM import report. GEDCOM imports now report the lines they could not parse, both for actual imports and dry runs. Previously, these messages were silently discarded (#995).
• GOQL in filters. The new MatchesQuery filter rule accepts a Gramps Object Query Language expression, so GOQL queries can be combined with any other filter rule and used in custom filters (#1013). Filter rule descriptions now also include the type of each parameter, so frontends can offer suitable inputs (#1014, #1019).
• Sync tokens. Desktop sync clients can authenticate with a long-lived sync token instead of a password, which also makes sync work for users who log in via single sign-on. Sync tokens can only access tree data, not the user account, by @scotCW (#1032). Each device gets its own labelled token that can be revoked individually (#1033).
• PKCE for single sign-on. OpenID Connect logins now support PKCE, fixing logins with providers that require it, such as Pocket ID. PKCE is enabled automatically if the provider supports it and can be turned off with OIDC_PKCE=false, by @scotCW (#1028).
• Faster map view. A new /places/coordinates/ endpoint returns only place names and coordinates, making the map load several times faster for large trees (#1016).
• Server administration. A new /metadata/server/ endpoint is accessible to site admins without a tree (#1015), and the user list can be filtered by tree and role (#1000).

Fixes and improvements

• Faster and more robust semantic indexing (#1020, #1021, #1023)
• Ollama model names with a tag, such as qwen2.5:7b, work again (#1018)
• Undoing a deletion no longer requires force, by @chase1124 (#1006)

New Contributors

• @chase1124 made their first contribution in #1006
• @scotCW made their first contribution in #1032

Full Changelog: v3.22.2...v3.23.0