Sourced from spotipy's releases.

2.22.1: CVE-2023-23608

Fixed

• CVE-2023-23608: fixed path traversal vulnerability that may lead to type confusion in URI handling code. Can prevent a potential XSS attack.
  • Upgrade if your app is user-facing and it allows user inputs for any type of Spotify IDs/URIs/URLs that may be forwarded to the Spotify API. Thanks to @​Shaderbug for finding and fixing this bug spotipy-dev/spotipy@b1db0b6

Changed

• Modified docstring for deprecated playlist_add_items() to accept "only URIs or URLs", with intended fix for IDs in v3.
  • The bug still exists for developers dealing with episodes IDs rather than just track IDs. However it is recommended to use the new playlist_add_tracks() or playlist_add_episodes() if dealing with episodes or simply to avoid confusion. See spotipy-dev/spotipy#919 by @​oliveraw for context

2.22: Get queue endpoint

Added

• Integration tests via GHA (non-user endpoints)
• Unit tests for new releases, passing limit parameter with minimum and maximum values of 1 and 50
• Unit tests for categories, omitting country code to test global releases
• Added CODE_OF_CONDUCT.md

Fixed

• Incorrect category_id input for test_category
• Assertion value for test_categories_limit_low and test_categories_limit_high
• Pin Github Actions Runner to Ubuntu 20 for Py27
• Fixed potential error where found variable in test_artist_related_artists is undefined if for loop never evaluates to true
• Fixed false positive test test_new_releases which looks up the wrong property of the JSON response object and always evaluates to true

2.21: Flask cache handler

Added

• Added market parameter to album and albums to address #753 by @​ivyadam
• Added 'show_featured_artists.py' to 'examples'.
• Expanded contribution and license sections of the documentation.
• Added FlaskSessionCacheHandler, a cache handler that stores the token info in a flask session.
• Added Python 3.10 in GitHub Actions

Fixed

• Updated the documentation to specify ISO-639-1 language codes.
• Fix AttributeError for text attribute of the Response object
• Require redis v3 if python2.7 (fixes readthedocs)

2.20: Redis cache handler

Added

• Added RedisCacheHandler, a cache handler that stores the token info in Redis.
• Changed URI handling in client.Spotify._get_id() to remove qureies if provided by error.
• Added a new parameter to RedisCacheHandler to allow custom keys (instead of the default token_info key)
• Simplify check for existing token in RedisCacheHandler

Changed

... (truncated)

Sourced from spotipy's changelog.

[2.22.1] - 2023-01-23

Added

• Add alternative module installation instruction to README
• Added Comment to README - Getting Started for user to add URI to app in Spotify Developer Dashboard.
• Added playlist_add_tracks.py to example folder

Changed

• Modified docstring for playlist_add_items() to accept "only URIs or URLs", with intended deprecation for IDs in v3

Fixed

• Path traversal vulnerability that may lead to type confusion in URI handling code
• Update contributing.md

[2.22.0] - 2022-12-10

Added

• Integration tests via GHA (non-user endpoints)
• Unit tests for new releases, passing limit parameter with minimum and maximum values of 1 and 50
• Unit tests for categories, omitting country code to test global releases
• Added CODE_OF_CONDUCT.md

Fixed

• Incorrect category_id input for test_category
• Assertion value for test_categories_limit_low and test_categories_limit_high
• Pin Github Actions Runner to Ubuntu 20 for Py27
• Fixed potential error where found variable in test_artist_related_artists is undefined if for loop never evaluates to true
• Fixed false positive test test_new_releases which looks up the wrong property of the JSON response object and always evaluates to true

[2.21.0] - 2022-09-26

Added

• Added market parameter to album and albums to address (#753
• Added show_featured_artists.py to /examples.
• Expanded contribution and license sections of the documentation.
• Added FlaskSessionCacheHandler, a cache handler that stores the token info in a flask session.
• Added Python 3.10 in GitHub Actions

Fixed

• Updated the documentation to specify ISO-639-1 language codes.
• Fix AttributeError for text attribute of the Response object
• Require redis v3 if python2.7 (fixes readthedocs)

... (truncated)

• c53511b Bump to 2.22.1
• beec3da Fix flake8
• b1db0b6 Merge pull request from GHSA-q764-g6fm-555v
• 262e7a0 Rename simple files (#933)
• d884ae1 Fix typo in start_playback function (#930)
• f669966 Update SECURITY.md
• 0b90627 Create SECURITY.md
• d0bbe67 Add additional video tutorial reference to documentation. (#921)
• 922d51d modified docstring for playlist_add_items to no longer accept IDs
• edd3f29 Getting Started Clarifications and Example Code File (#904)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.