RhodeCode 5.15.0 is released: What’s new
RhodeCode 5.15.0 is now available with improvements to repository navigation, pull request workflows, security, and platform reliability. This scheduled feature release makes it easier to work with repository files and manage more complex pull request workflows, while also introducing important security and infrastructure updates.
What’s new in RhodeCode 5.15.0
Faster repository file navigation
Repository file browsing now includes a collapsible file-tree sidebar with lazy directory loading.
The new layout makes it easier to move through larger repositories, switch repository refs, and quickly navigate between files. The directory tree and file content can also be scrolled independently, helping users stay oriented when working with deeper project structures.
Repository navigation has also been improved to preserve multi-line and list-based line anchors, including links such as #L10-20 and #L5,8.
More flexible pull request workflows
RhodeCode 5.15.0 introduces several improvements for teams working with pull requests.
Pull requests can now have explicit dependencies. If a required pull request is still open, merging is blocked until that dependency has been resolved. Automatically detected stacked pull requests also respect repository permissions, so users only see dependencies they are authorized to access.
Target branches can now be changed directly from the pull request edit flow. When the target branch changes, RhodeCode recalculates reviewer rules and approvals for the new target while preserving manually assigned reviewer reasons.
Pull requests can also now be created as Draft and switched between Draft and Ready states. Draft status is displayed across pull request pages and lists, and Draft pull requests cannot be merged until they are marked Ready.
Full-text search improvements
RhodeCode Tools 4.7.0 introduces safer Elasticsearch cleanup options.
Administrators can now use --prune-dry-run to review which repository data would be removed before running --prune. Repository removal also verifies that indexed documents have been deleted and safely stops pruning if the live repository inventory is incomplete.
For production environments, reviewing the dry-run result before pruning an Elasticsearch index is recommended.
Security improvements
RhodeCode 5.15.0 includes several updates focused on access control and data privacy.
Draft comments are now visible only to their authors through both single-comment and repository-comment API endpoints, and draft ownership is enforced when editing, deleting, resolving, or viewing comment history.
Repository comparisons now require explicit read permission on the target repository before comparison processing or VCS object transfer begins.
Pull request dependency detection has also been updated to prevent users from discovering pull requests or repositories they do not have permission to read.
VCS and platform updates
The VCS Server no longer depends on dulwich at runtime. Remaining Git transport and protocol functionality has been moved to pygit2 and native implementations.
RhodeCode 5.15.0 upgrades pygit2 to 1.20.1 with libgit2 1.9.7 compatibility and now requires Python 3.11 or newer for the VCS Server.
RhodeCode Tools has also been updated to 4.7.0, including safer index-lock handling and compatibility improvements.
Several core dependencies have been upgraded as part of this release, including aiohttp, cryptography, mistune, tornado, and WebOb.
Reliability and bug fixes
RhodeCode 5.15.0 also addresses several issues across repository management and background processing:
- clone URL protocol switching on Tags, Branches, and Bookmarks pages
- Mercurial repository strip branch detection
- handling of raw non-UTF-8 Git paths
- Elasticsearch repository cleanup
- Celery database session cleanup
- database health-check behavior
Celery database sessions are now cleaned up across successful, failed, retried, and revoked task paths, improving connection lifecycle management for background workloads.
Upgrade notes for RhodeCode 5.15.0
Administrators should review several important changes before upgrading.
Install RhodeCode Tools 4.7.0 together with RhodeCode 5.15.0.
The VCS Server now requires Python 3.11 or newer and uses pygit2 1.20.1 with libgit2 1.9.7. Custom VCS Server environments should be rebuilt rather than reusing binary dependencies from older installations.
Pull request dependency support includes a database migration, so the standard RhodeCode database migration must be completed before starting the upgraded application.
If you use rcstack, upgrade rcstack together with the RhodeCode 5.15.0 application image.
Teams should also make sure database capacity, Gunicorn workers and threads, Celery concurrency, and SQLAlchemy connection pools are sized together as part of the overall database connection budget.
For the complete changelog and technical upgrade details, see the official RhodeCode 5.15.0 release notes: RhodeCode 5.15.0 release notes