Stability#
What you can build against today, and what may change before 1.0.0.
The two packages#
Backend |
|
Frontend |
|
They are versioned and released together. See How to install the backend and How to install the frontend.
What alpha means here#
There are no GenericSetup upgrade steps.
Both installable profiles are at version 1000, and upgrades/configure.zcml declares nothing.
A change to a registry record or a content type between alpha releases reaches an existing site only if you reinstall the add-on.
Plan for that: treat an alpha site as one you can rebuild, and read How to upgrade before taking a new release.
Settled#
These are covered by tests that fail loudly if they change.
Area |
What holds |
Enforced by |
|---|---|---|
Layer boundaries |
Core imports nothing from the |
three import-linter contracts, run in CI |
No-extras install |
The package installs and imports with no extras |
the |
Uninstall |
Every profile has a matching uninstall profile that leaves nothing behind |
uninstall tests per profile |
Account data |
Uninstalling removes types, catalog and workflows, and no |
uninstall tests |
Security properties |
The list in Security guarantees |
the test suite |
Python and Plone |
Plone 6.2 on Python 3.12, 3.13 and 3.14 |
the CI matrix |
Not settled#
Expect these to change without a migration path before 1.0.0.
Area |
Why it may move |
|---|---|
REST endpoint names and payloads |
Named in Endpoints; no deprecation cycle yet |
Registry keys and defaults |
Named in Settings; a rename means a reinstall |
The driver contract |
Driver contract is the current shape; a third-party driver may need edits |
Frontend routes and component names |
Named in Frontend; shadowed components especially |
The |
One table today, and no migration tooling for it |
Event interfaces |
Named in Events |
Classic UI#
Sign-in requires the Volto frontend. The add-on registers no Classic UI login view, viewlet or form, so a site without Volto has no way to start a sign-in.
Classic UI support is intended, and is not in this release.
One part already works without Volto: the authorization server's consent screen is a server-rendered page template, so a site running the server layer can be an identity provider for other applications regardless of which frontend it uses itself.
Reporting#
Report a security vulnerability privately, following SECURITY.md. Report anything else as a GitHub issue.