v1.24.0

v1.24.0 (2026-09-29)

This release is published under the AGPL-3.0-or-later License.

Bug Fixes

• Add missing contents:read permission to publish_to_pypi job (#371, 8f2f2a4)

• Add sphinx-jsonschema to doc dependency group (#371, 8f2f2a4)

• Align importlib.metadata.version aliasing with sample-plugin (#371, 8f2f2a4)

• Create GitHub release with assets attached, not after publish (#371, 8f2f2a4)

• Disable python-semantic-release changelog generation (#371, 8f2f2a4)

• Drop unneeded fetch-depth: 0 from ci.yml checkout (#371, 8f2f2a4)

• Drop uv run from Makefile per feanil's review feedback (#371, 8f2f2a4)

• Exclude tests packages from wheel (#371, 8f2f2a4)

• Pin release.yml actions to sample-plugin gold-standard SHAs (#371, 8f2f2a4)

• Prefix i18n and atlas Makefile targets with uv run (#371, 8f2f2a4)

• Remove fail-fast: false (not present pre-migration) (#371, 8f2f2a4)

• Remove obsolete version-bump/changelog checklist items from PR template (#371, 8f2f2a4)

• Remove unnecessary try/except around version (not present pre-migration) (#371, 8f2f2a4)

• Remove unnecessary try/except around VERSION in docs/conf.py (#371, 8f2f2a4)

• Restore version via importlib.metadata in init.py (#371, 8f2f2a4)

• Use secrets.GITHUB_TOKEN instead of custom org secret for release job (#371, 8f2f2a4)

• Use static 'tests' job name in ci.yml to match pre-migration checks (#371, 8f2f2a4)

Build System

• deps: Bump codecov/codecov-action from 7.0.0 to 7.1.1 (d4af082)

Chores

• Regenerate pylintrc for pylint 4.0.8 (#458, c3ef094)

• Upgrade Python requirements (#458, c3ef094)

Documentation

• Add ADR 0016/0017 and update ADR 0015 with the deprecation timeline (#390, 2438729)

• Add ADR 0018 and revise ADR 0016 for cross-domain filtering (#390, 2438729)

• Add ADR for authorization schema source tracking (#444, 8e500d7)

• Add authorization schema reference (#431, 1207ffe)

• Add schema entry point example (#423, 4f802e7)

• Address PR review (#420, 9d9f3b9)

• Address PR reviews (#390, 2438729)

• Align reference priority behavior (#431, 1207ffe)

• Clarify authorization filtering ADR sequence (#390, 2438729)

• Clarify authorization schema discovery (#423, 4f802e7)

• Clarify authz schema terminology (#420, 9d9f3b9)

• Clarify lifecycle conflicts and removals (#422, 7602d1a)

• Clarify Paragon icon validation (#421, d4c4e1b)

• Clarify role management access (#420, 9d9f3b9)

• Clarify role naming scope (#422, 7602d1a)

• Clarify schema discovery failures (#423, 4f802e7)

• Clarify schema entry point discovery (#423, 4f802e7)

• Clarify schema migration and extension validation (#421, d4c4e1b)

• Clarify schema validation rules (#421, d4c4e1b)

• Clarify static role extensions (#430, a294b6d)

• Correct and tighten the ADR 0015 CSRF/exposure note (#390, 2438729)

• Defer authorization implication semantics (#426, 563e586)

• Define api contract for Team Members tab (#437, 26c69a3)

• Define authorization schema discovery (#423, 4f802e7)

• Define REST API ownership and visibility extension (#390, 2438729)

• Define separate authorization filters for each operation (#390, 2438729)

• Define static role extensions (#430, a294b6d)

• Define the authorization catalog API (#425, a1ad6d4)

• Define the authorization schema lifecycle (#422, 7602d1a)

• Define the static authorization schema (#421, d4c4e1b)

• Define translation of authorization metadata (#424, 67b4654)

• Describe directory-based schema discovery (#431, 1207ffe)

• Discover schema files from directories (#423, 4f802e7)

• Distinguish operators from administrators (#420, 9d9f3b9)

• Document application and Tutor schema discovery (#423, 4f802e7)

• Document the waffle-flag-states consumption contract in ADR 0015 (#390, 2438729)

• Expand authorization lifecycle phases (#422, 7602d1a)

• Explain schema entry point discovery (#423, 4f802e7)

• Improve authorization schema reference (#431, 1207ffe)

• Keep reference index in its owning PR (#421, d4c4e1b)

• Link implication decision to schema v1 (#426, 563e586)

• Link lifecycle naming conventions (#431, 1207ffe)

• Move authorization schema reference to its own PR (#421, d4c4e1b)

• Move schema reference links to their own PR (#430, a294b6d)

• Narrow authorization filter scope (#390, 2438729)

• Reference role extension decision (#421, d4c4e1b)

• Refine role extension examples (#430, a294b6d)

• Remove actor bypass from authorization filters (#390, 2438729)

• Remove API editability field (#425, a1ad6d4)

• Render authorization schema reference (#431, 1207ffe)

• Render decision section numbers (#430, a294b6d)

• Render decision section numbers (#426, 563e586)

• Render decision section numbers (#425, a1ad6d4)

• Render decision section numbers (#424, 67b4654)

• Render decision section numbers (#423, 4f802e7)

• Render decision section numbers (#422, 7602d1a)

• Render decision section numbers (#421, d4c4e1b)

• Renumber domain ownership ADRs (#390, 2438729)

• Revise application schema layout example (#431, 1207ffe)

• Separate static and dynamic roles (#420, 9d9f3b9)

• Update schema resource path example (#422, 7602d1a)

• Use block lists for schema scopes (#421, d4c4e1b)

• Use Python Tutor patch example (#423, 4f802e7)

• Use Python Tutor plugin in schema reference (#431, 1207ffe)

Features

• Add assignments array to GET /api/authz/v1/users/ endpoint (#451, 85da7fd)

• Add authz schema definition files (#445, a910842)

• Add semantic-release and OIDC PyPI publish workflow (#371, 8f2f2a4)

• Consolidate package metadata into pyproject.toml (#371, 8f2f2a4)

• Enable semantic-release changelog generation (#371, 8f2f2a4)

• Modernize openedx-authz to uv + pyproject.toml + semantic-release (#371, 8f2f2a4)

• Switch dependency management from pip-compile to uv (#371, 8f2f2a4)

Refactoring

• Move package to src/ layout (#371, 8f2f2a4)

---

Detailed Changes: v1.23.0...v1.24.0