Package Health Score

87 / 100

security
No known security issues
popularity
Recognized
maintenance
Healthy
community
Active

Explore Similar Packages

Popularity

Recognized

GitHub Stars: 356
Forks: 101
Contributors: 110

Direct Usage Popularity

Based on project statistics from the GitHub repository for the PyPI package Zope, we found that it has been starred 356 times.

Security

No known security issues

Security and license risk for latest version

Release Date: Oct 11, 2024
Direct Vulnerabilities: 0
C
0
H
0
M
0
L
Indirect Vulnerabilities: 0
C
0
H
0
M
0
L
License Risk: 0
H
0
M
0
L

All security vulnerabilities belong to production dependencies of direct and indirect packages.

License

ZPL-2.1

Security Policy

We found a way for you to contribute to the project! Looks like Zope is missing a security policy.

You can connect your project's repository to Snyk to stay up to date on security alerts and receive automatic fix pull requests.

Keep your project free of vulnerabilities with Snyk

Maintenance

Healthy

Commit Frequency

Open Issues: 30
Open PR: 4
Last Release: 23 days ago
Last Commit: 4 days ago

Further analysis of the maintenance status of Zope based on released PyPI versions cadence, the repository activity, and other data points determined that its maintenance is Healthy.

We found that Zope demonstrates a positive version release cadence with at least one new version released in the past 3 months.

As a healthy sign for on-going project maintenance, we found that the GitHub repository had at least 1 pull request or issue interacted with by the community.

Community

Active

Readme: Yes
Contributing.md: Yes
Code of Conduct: No
Contributors: 110
Funding: No

A good and healthy external contribution signal for Zope project, which invites more than one hundred open source maintainers to collaborate on the repository.

We found a way for you to contribute to the project! Looks like Zope is missing a Code of Conduct.

Embed Package Health Score Badge

Keep your project healthy

Check your requirements.txt

Ensure all the packages you're using are healthy and well-maintained

Snyk Vulnerability Scanner

Get health score & security insights directly in your IDE

Package

Python Versions Compatibility: >=3.8

Age: 7 years
Latest Release: 23 days ago
Dependencies: 41 Direct
Versions: 74
Maintainers: 3
Wheels: OS Independent

Not sure how to use Zope?

To help you get started, we've collected the most common ways that Zope is being used within popular public projects.

tmoravec / fastjsonrpc / tests / test_server.py View on Github

class ReceiverProtocol(Protocol):
            def __init__(self, finished):
                self.finished = finished
                self.body = []

            def dataReceived(self, bytes):
                self.body.append(bytes)

            def connectionLost(self, reason):
                self.finished.callback(''.join(self.body))


        class StringProducer(object):
            implements(IBodyProducer)

            def __init__(self, body):
                self.body = body
                self.length = len(body)

            def startProducing(self, consumer):
                consumer.write(self.body)
                return defer.succeed(None)

            def pauseProducing(self):
                pass

            def stopProducing(self):
                pass

View more ways to use Zope

Zope is an open-source web application server.

This document provides some general information about Zope and provides links to other documents. The full documentation can be found at .

Installation

Please visit the installation documentation at for detailed installation guidance.

License

Zope is licensed under the OSI-approved Zope Public License (ZPL), version 2.1. The full license text is included in LICENSE.txt.

Bug tracker

Bugs reports should be made through the Zope bugtracker at . A bug report should contain detailed information about how to reproduce the bug.

Change log

These are all the changes for Zope 5, starting with the alpha releases, since the branch point at Zope 4.1.2.

The change log for the previous version, Zope 4, is at

5.11 (2024-10-11)

Add support for Python 3.13.
Drop support for Python 3.7.
Update to newest compatible versions of dependencies.
Added CC-BY 4.0 license to the Zope logo.
Fix IndexError on traversal past the root using ... (#1218)

5.10 (2024-05-18)

Recognize Page Templates by file extension for WebDAV. (#1212)
Clean up and fix installation documentation.
Officially support Python 3.12.1. (#1188)
Fix redirections to URLs with host given as IP-literal with brackets. Fixes #1191.
Introduce the decorator ZPublisher.zpublish to explicitly control publication by ZPublisher. For details see #1197.
Fix Content-Disposition filename for clients without rfc6266 support. (#1198)
Support Chameleon structure expression type. Fixes #1077.
Fix authentication error viewing ZMI with a user defined outside of zope root. Fixes #1195 and #1203.
Work around Products.CMFCore and Products.CMFPlone design bug (registering non callable constructors). For details, see #1202.

5.9 (2023-11-24)

Support form data in PUT requests (following the multipart example). Fixes #1182.
Separate ZODB connection information into new ZODB Connections view.
Move the cache detail links to the individual database pages.
Fix the auto refresh functionality on the Reference Count page
Update the Ace editor in the ZMI.
Restrict access to static ZMI resources.
Update to newest compatible versions of dependencies.
Add paste.filter_app_factory entry point content_length. This WSGI middleware component can be used with WSGI servers which do not follow the PEP 3333 recommendation regarding input handling for requests with Content-Length header. Allows administrators to fix #1171.
Officially support Python 3.12.

5.8.6 (2023-10-04)

Make sure the object title in the ZMI breadcrumbs is quoted to prevent a cross-site scripting issue.
Update to newest compatible versions of dependencies.
Base the inline/attachment logic developed for CVE-2023-42458 on the media type proper (ignore parameters and whitespace and normalize to lowercase) (#1167).

5.8.5 (2023-09-21)

Allow only some image types to be displayed inline. Force download for others, especially SVG images. By default we use a list of allowed types. You can switch a to a list of denied types by setting OS environment variable OFS_IMAGE_USE_DENYLIST=1. You can override the allowed list with environment variable ALLOWED_INLINE_MIMETYPES and the disallowed list with DISALLOWED_INLINE_MIMETYPES. Separate multiple entries by either comma or space. This change only affects direct URL access. <img src="image.svg"> works the same as before. (CVE-2023-42458) See security advisory.
Tighten down the ZMI frame source logic to only allow site-local sources. Problem reported by Miguel Segovia Gil.
Added image dimensions to SVG file properties #1146.
Fix username not in access log for error requests, see issue #1155.
Update to newest compatible versions of dependencies.
Add preliminary support for Python 3.12rc3.

5.8.4 (2023-09-06)

Disable a ZCatalog (more precisly: Products.PluginIndexes) performance test which occasionally fails on GitHub. For details, see #1136.
Restore filename on code objects of objects returned from App.Extensions.getObject(). This got lost in 4.0a6.
Update to newest compatible versions of dependencies.
Add preliminary support for Python 3.12rc1.
Make mapply __signature__ aware. This allows to publish methods decorated via a decorator which sets __signature__ on the wrapper to specify the signature to use. For details, see #1134. Note: mapply still does not support keyword only, var positional and var keyword parameters.
Make Zope's parameters for denial of service protection configurable #1141.
Update RestrictedPython to version 6.2 to mitigate a security problem. (CVE-2023-41039)
Update AccessControl to version 6.2 to mitigate a security problem. (CVE-2023-41050)

5.8.3 (2023-06-15)

Fix handling of a request parameter of type file if no value has been specified; fixes #1132.
Fix adding Page Templates without valid file input from the ZMI (#1130)
Update to newest compatible versions of dependencies.

5.8.2 (2023-05-22)

Allow ZPublisher to handle both a query string and a request body; the request parameters from the query string are made available in the request attribute form (a dict), the request body can be accessed via the request keys BODY (a bytes object) or BODYFILE (a file like object). Fixes #1122.
Support access to the request's BODY key for WSGI servers which hand over an unseekable request body (such as e.g. Gunicorn). Fixes #1125.
Do not break on GET requests that pass a query string and a Content-Type header. For details see #1117.
Implement code change suggestions from CodeQL scanning.
Added Japanese translations for some Sphinx docs (#1109)
Update to newest compatible versions of dependencies.
Update zope.ini.in skel to support log paths that use backslashes. (#1106)

5.8.1 (2023-03-17)

Sanitize tainting fixing #1095
Replace cgi.FieldStorage by multipart avoiding the cgi module deprecated by Python 3.11.

Mark binary converters with a true binary attribute.

Fix encoding handling and :bytes converter.

See #1094.
Clean out and refactor dependency configuration files.
Update to newest compatible versions of dependencies.
Support the (non standard) charset parameter for content type application/x-www-form-urlencoded. This is required (e.g. for Plone) because jquery constructs content types of the form `application/x-www-form-urlencoded; charset=utf-8. For details see plone/buildout.coredev#844.

5.8 (2023-01-10)

Only set response header Content-Type as text/html on exception views when the response has content. (#1089)
Drop support for Python 3.6, it has been in end-of-life status for a while.
Update to newest compatible versions of dependencies.
Fix history page for classes modifying instances in __setstate__, such as Products.PythonScripts.PythonScript instances. See launchpad issue 735999.

5.7.3 (2022-12-19)

Explicitly serve App.Dialogs.MessageDialog and exception views as HTML due to the changed default content type from #1075.

5.7.2 (2022-12-17)

Fix some broken ZMI pages due to the changed default content type from PR (#1078)
Update to newest compatible versions of dependencies.

5.7.1 (2022-12-16)

Set the published default Content-Type header to text/plain if none has been set explicitly to prevent a cross-site scripting attack. Also remove the old behavior of constructing an HTML page for published methods returning a two-item tuple.
Update to newest compatible versions of dependencies.

5.7 (2022-11-17)

Script addzopeuser accepts now parameter '-c' or '--configuration'. This allows passing in a custom location for the zope.conf file to use. If not specified, behavior is not altered.
Update to newest compatible versions of dependencies.
Change functional testing utilities to support percent encoded and unicode paths (#1058).
Decode basic authentication header as utf-8, not latin1 anymore (#1061).
Use UTF-8 charset for WWW-Authenticate headers in challenge responses, as described in RFC7617 ( #1065).
Added :json converter in ZPublisher.Converters. (#957)
Support Python 3.11.

5.6 (2022-09-09)

Make Products.PageTemplate engine compatible with Chameleon 3.10.
Update to newest compatible versions of dependencies.
Start work on Python 3.11 support, which will arrive in a later release.
Fix cookie path parameter handling: If the cookie path value contains % it is assumed to be fully quoted and used as is; if it contains only characters allowed (unquoted) in an URL path (with the exception of ;), it is used as is; otherwise, it is quoted using Python's urllib.parse.quote (#1052).

5.5.2 (2022-06-28)

Update waitress to version 2.1.2.
Improvements on find_bad_templates(): check Filesystem Page Templates too and show html tags in web report (#1042)
Fix version pin specifications for Python 3.6 compatibility. (#1036)
Quote all components of a redirect URL (not only the path component) (#1027)
Drop the convenience script generation from the buildout configuration in order to get rid of a lot of dependency version pins. These were only needed for maintainers who can install them manually. (#1019)
Update to newest compatible versions of dependencies.
Modify "manage_access" to allow users to switch from the compact view to the complete matrix view when more than 30 roles are defined. (#1039)
Strip leading . in cookie domain names. (#1041)

5.5.1 (2022-04-05)

Update to newest compatible versions of dependencies.
Update waitress to version 2.1.1 to mitigate a vulnerability in that package. As waitress no longer supports Python 3.6 it is not advised to run Zope on Python 3.6 any longer even though it still supports Python 3.6. Due to this security issue support for Python 3.6 is now officially deprecated. It will be removed with Zope version 5.7.
To run bin/buildout inside the Zope project now zc.buildout >= 2.13.7 or zc.buildout >= 3.0.0b1 is required.

5.5 (2022-03-10)

Fix several exceptions when calling ZPublisher.utils.fix_properties.
Update to newest compatible versions of dependencies.
Enhance cookie support. For details, see #1010
Use intermediate str representation for non-bytelike response data unless indicated differently by the content type. (#1006)
Use zc.buildout 3.0rc2 to install Zope to run its tests.

5.4 (2022-01-09)

Audit and fix all hyperlinks in code and documentation
- Change zope.org references to zope.dev due to ongoing domain ownership issues. zope.dev is owned by the Plone Foundation and thus safe from interference. XML/ZCML namespace URLs remain unchanged.
- Remove all links that are completely dead, such as the old zope.org Collectors issue trackers.
- Update all other miscellaneous links to make them work again or remove if the information is gone.
Improve type guessing for the default WebDAV PUT factory (#997)
Enable WebDAV PUT factories to change a newly created object's ID (#997)
Fix potential race condition in App.version_txt.getZopeVersion (#999)
Don't coerce file upload fields for adding DTML Documents/Methods to string. This makes the Add forms work again with the ZPublisher converter code changes.
Remove deprecated ulines, utext, utokens, ustring from more code. In the properties form, show a deprecation warning.
Add function ZPublisher.utils.fix_properties. You can call this to fix lines properties to only contain strings, not bytes. It also replaces the deprecated property types ulines, utext, utoken, and ustring with their non-unicode variants. (#987)
Add support for Python 3.10.
Update to newest compatible versions of dependencies.

5.3 (2021-07-31)

Reinstate simple sessioning with Products.TemporaryFolder because the underlying issues with tempstorage have been fixed. (#985)
Update the AccessControl version pin to fix a remote code execution issue (see AccessControl security advisory GHSA-qcx9-j53g-ccgf)
Prevent DeprecationWarnings from moved imports in AccessControl
make sure "Manager" users can always modify proxy roles (see Products.PythonScripts#50)
Deprecate usage of "unicode" converters. Also, the behavior of field2lines is now aligned to the other converters and returns a list of strings instead of a list of bytes. (#962)
Update to newest compatible versions of dependencies.

5.2.1 (2021-06-08)

Prevent unauthorized traversal through authorized Python modules in TAL expressions
Facelift the Zope logo. (#973)
Update to newest compatible versions of dependencies.

5.2 (2021-05-21)

Prevent traversal to names starting with _ in TAL expressions and fix path expressions for the chameleon.tales expression engine.
Provide friendlier ZMI error message for the Transaction Undo form (#964)
Updated/fixed the poll application tutorial in the Zope Developers Guide (#958)
Update to newest versions of dependencies.
Depend on zope.datetime for the functions iso8601_date, rfc850_date, and rfc1123_date which used to be in App.Common keeping backwards-compatibility imports in place.

Backwards incompatible changes

With the exception of field2bytes, field converters do no longer try to read file like objects (#558)

5.1.2 (2021-03-02)

Enforce Zope permissions during recursive XML-RPC data dumps (#954)
The compute_size method properly returns None if the content does not have a get_size method but the parent has. (#948)
Fix control panel tab links on all control panel pages
Update to newest versions of dependencies.

5.1.1 (2021-02-10)

Replace (in OFS) the deprecated direct id access by getId calls. (#903)
Update ZMI dependencies for Font Awesome, jQuery and bootstrap.
Revise debug info GUI (#937)
Convert bytes HTTPResponse header value to str via ISO-8859-1 (the default encoding of HTTP/1.1).
Fix rendering of not found resources. (#933)
Update to newest versions of dependencies.

5.1 (2020-11-12)

Backwards incompatible changes

Exclude characters special for chameleon's interpolation syntax (i.e. ${}) from use in TALES path expressions to reduce the failure risk for the chameleon interpolation heuristics (#925)

Features

Restore the ZMI Debug Information control panel page (#898)

Fixes

Fix ZMI visibility of pre elements in error log (Products.SiteErrorLog#26)
Fix length for page template repeat variables (#913)
Update isort to version 5. (#892)
Update to newest versions of dependencies.

5.0 (2020-10-08)

Backwards incompatible changes

Drop support for Python 3.5 as it will run out of support soon. (#841)

Features

HTTP header encoding support (#905)
Add support for Python 3.9.
New interface Products.PageTemplates.interfaces.IZopeAwareEngine. It can be used as the "provides" of an adapter registration to adapt a non Zope tales engine to an engine to be used by Zope page templates (#864). Currently, the adaptation is used only when the template is rendered with chameleon; with zope.pagetemplate, the engine is used as is - this may change in the future.
Allow (some) builtins as first element of a (TALES) path expression: in an untrusted context, the builtins from AccessControl.safe_builtins are allowed; in a trusted context, all Python builtins are allowed in addition (and take precedence) (zope.tales#23).
Support the attrs predefined template variable again (as far as chameleon allows it) (#860).
Use Chameleon (>= 3.7.2) configuration to get better information for errors detected during template execution (#837).

Fixes

Provide a more senseful OFS.SimpleItem.Item_w__name__.id to avoid bugs by use of deprecated direct id access (as e.g. (#903).
Update to zope.interface > 5.1.0 to fix a memory leak.
Fix export of files with non-latin-1 compatible names (#890)
Avoid unsolicited translations (#876)
Make "chameleon-zope context wrapping" more faithful. (#873)
Let "unicode conflict resolution" work for all templates (not just ZopePageTemplate). (#872)
Make "Unicode Conflict Resolution" available for templates rendered with chameleon (Products.CMFPlone#3145).
Improve documentation of CONTEXTS in the "Zope Book".
Decrease cookie size for copy/paste clipboard cookie (#854)
Fix default keyword handling in page templates (#846)
Fix parsing of package version and show correct major version in the ZMI
Improve solidity of the debugError method. (#829)
Fix that ZTUtils.LazyFilter could not be imported inside a restricted Python script. (#901)

Other changes

Add pyupgrade via pre-commit (#859)
Add tal:switch test

5.0a2 (2020-04-24)

Bug fixes

Pin AccessControl 4.2 for the Manage WebDAV Locks permission
Fix HEAD requests on registered views (#816)
Improve chameleon --> zope.tales context wrapper (support for template variable injection) (#812).
Require zope.tales>=5.0.2
Fix issue 717 by fully honoring the engine returned by PageTemplate.pt_getEngine (#717). The engine also decides about the use of zope.tales (engine is an instance of zope.pagetemplate.engine.ZopeBaseEngine) or chameleon.tales (otherwise) TALES expressions.
Fixed encoding issue of displayname WebDAV property (#797)
Fixed fallback implementation of manage_DAVget (#799)

Other changes

Update to newest versions of dependencies.

5.0a1 (2020-02-28)

Backwards incompatible changes

Drop support for Python 2.7 aka Zope 5 cannot be run on Python 2 any more. If you are still running on Python 2.7 upgrade to the latest Zope 4 version first, migrate to Python 3 and than switch to Zope 5. (#692)
Remove all backwards-compatibility code marked to go away in Zope 5 (#478)
Drop support for running Zope with ZServer as it is Python 2 only. (#592)
Remove deprecated postProcessInputs request method. (#782)
Remove deprecated module ZPublisher.maybe_lock. (#758)
Remove Help System methods from the product context. (#756)
Remove more deprecated code. (#757)
Updated Zope documentation sources for Zope 5. (#659)

New features

Restore WebDAV support in Zope. (#744)
Enable WebDAV support independent of ZServer. (#787)
Clean up and sanitize permissions used for WebDAV-related methods.
Add wsgi.file_wrapper implementation

(#719)

Bug fixes

Only use wsgi.file_wrapper for response bodies with a read method. (#763)
Improve detection of HTTPS requests. (#680)
Fix several ZMI links so they respect virtual hosting. (#788)
Fix sort link URLs on manage_main (#748)
More tests to make sure all __str__ implementations return native strings. (#692)
Fix longstanding test bug by forcing the page template engine. Many tests in Products.PageTemplates used the old Zope page template engine because the correct one was not registered during setup.
Close opened db during shutdown (as ZServer is already doing). (#740)
The method unrestrictedTraverse raises an error when the argument path is not something it can work with. (#674)
Improve ZMI Security Tab usability for high numbers of roles. (#730)
Some small ZMI rendering fixes. (#729)
Fix error when using database minimize in the ZMI. (#726)
Fix __getattr__ signature in UnauthorizedBinding. (#703)
Fix VirtualHostMonster not being able to set mappings under Python 3. (#708)
Reduce the danger of acquiring built-in names on the ZMI Find tab. (#712)
Restore the mistakenly removed Properties ZMI tab on Image objects (#706)
Fix OFS.Image.File.__str__ for Pdata contents (#711)
Set REMOTE_USER in wsgi environ using Zope user authentication (#713)
Add Paste as extras_require dependency to pull in Paste when installing with pip and constraints.txt to prevent startup errors. This requires adding the [wsgi] extra in the egg specification. (#734)

Other changes

Move retried request delay handling out of supports_retry (#474)
Improve documentation for Zope's error logging services.

FAQs

What is Zope?

Zope application server / web framework. Visit Snyk Advisor to see a full health score report for Zope, including popularity, security, maintenance & community analysis.

Is Zope popular?

The python package Zope receives a total of 16,599 weekly downloads. As such, Zope popularity was classified as a recognized. Visit the popularity section on Snyk Advisor to see the full health analysis.

Is Zope well maintained?

We found that Zope demonstrated a healthy version release cadence and project activity. It has a community of 110 open source contributors collaborating on the project. See the full package health analysis to learn more about the package maintenance status.

Is Zope safe to use?

The python package Zope was scanned for known vulnerabilities and missing license, and no issues were found. Thus the package was deemed as safe to use. See the full health analysis review.

Last updated on 2 November-2024, at 22:36 (UTC).

Build a secure application checklist

Select a recommended open source package

Minimize your risk by selecting secure & well maintained open source packages

DONE

Scan your app for vulnerabilities

Scan your application to find vulnerabilities in your: source code, open source dependencies, containers and configuration files

SCAN NOW

Fix identified vulnerabilities

Easily fix your code by leveraging automatically generated PRs

AUTO FIX

Monitor for new issues

New vulnerabilities are discovered every day. Get notified if your application is affected

MONITOR APP

Package Health Score

Explore Similar Packages

Direct Usage Popularity

Security and license risk for latest version

Commit Frequency

Embed Package Health Score Badge

Keep your project healthy

Check your requirements.txt

Snyk Vulnerability Scanner

Not sure how to use Zope?

Installation

License

Bug tracker

Change log

5.11 (2024-10-11)

5.10 (2024-05-18)

5.9 (2023-11-24)

5.8.6 (2023-10-04)

5.8.5 (2023-09-21)

5.8.4 (2023-09-06)

5.8.3 (2023-06-15)

5.8.2 (2023-05-22)

5.8.1 (2023-03-17)

5.8 (2023-01-10)

5.7.3 (2022-12-19)

5.7.2 (2022-12-17)

5.7.1 (2022-12-16)

5.7 (2022-11-17)

5.6 (2022-09-09)

5.5.2 (2022-06-28)

5.5.1 (2022-04-05)

5.5 (2022-03-10)

5.4 (2022-01-09)

5.3 (2021-07-31)

5.2.1 (2021-06-08)

5.2 (2021-05-21)

Backwards incompatible changes

5.1.2 (2021-03-02)

5.1.1 (2021-02-10)

5.1 (2020-11-12)

Backwards incompatible changes

Features

Fixes

5.0 (2020-10-08)

Backwards incompatible changes

Features

Fixes

Other changes

5.0a2 (2020-04-24)

Bug fixes

Other changes

5.0a1 (2020-02-28)

Backwards incompatible changes

New features

Bug fixes

Other changes

Zope dependencies

FAQs

What is Zope?

Is Zope popular?

Is Zope well maintained?

Is Zope safe to use?

Build a secure application checklist

Select a recommended open source package

Scan your app for vulnerabilities

Source Code

Open Source

Container

Config

Fix identified vulnerabilities

Monitor for new issues