1 files changed, 66 insertions, 0 deletions
diff --git a/CHANGES.txt b/CHANGES.txt
index 85dd3be2a..86257cc22 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,3 +1,69 @@
+next release
+============
+
+Features
+--------
+
+- ``ACLAuthorizationPolicy`` supports ``__acl__`` as a callable. This
+  removes the ambiguity between the potential ``AttributeError`` that would
+  be raised on the ``context`` when the property was not defined and the
+  ``AttributeError`` that could be raised from any user-defined code within
+  a dynamic property. It is recommended to define a dynamic ACL as a callable
+  to avoid this ambiguity. See https://github.com/Pylons/pyramid/issues/735.
+
+- Allow a protocol-relative URL (e.g. ``//example.com/images``) to be passed to
+  ``pyramid.config.Configurator.add_static_view``. This allows
+  externally-hosted static URLs to be generated based on the current protocol.
+
+- The ``AuthTktAuthenticationPolicy`` now supports IPv6 addresses when using
+  the ``include_ip=True`` option. This is possibly incompatible with
+  alternative ``auth_tkt`` implementations, as the specification does not
+  define how to properly handle IPv6. See
+  https://github.com/Pylons/pyramid/issues/831.
+
+Bug Fixes
+---------
+
+- View lookup will now search for valid views based on the inheritance
+  hierarchy of the context. It tries to find views based on the most
+  specific context first, and upon predicate failure, will move up the
+  inheritance chain to test views found by the super-type of the context.
+  In the past, only the most specific type containing views would be checked
+  and if no matching view could be found then a PredicateMismatch would be
+  raised. Now predicate mismatches don't hide valid views registered on
+  super-types. Here's an example that now works::
+
+  .. code-block:: python
+
+     class IResource(Interface):
+         ...
+
+     @view_config(context=IResource)
+     def get(context, request):
+         ...
+
+     @view_config(context=IResource, request_method='POST')
+     def post(context, request):
+         ...
+
+     @view_config(context=IResource, request_method='DELETE')
+     def delete(context, request):
+         ...
+
+     @implementor(IResource)
+     class MyResource:
+         ...
+
+     @view_config(context=MyResource, request_method='POST')
+     def override_post(context, request):
+         ...
+
+  Previously the override_post view registration would hide the get
+  and delete views in the context of MyResource -- leading to a
+  predicate mismatch error when trying to use GET or DELETE
+  methods. Now the views are found and no predicate mismatch is
+  raised.
+
 1.4 (2012-12-18)
 ================