diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index a13037402f8..19c076242f8 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -115,12 +115,14 @@ Also, some code changes need a prior approbation:
Once a PR has been submitted, you may need to wait for its integration. It is common that the project leader let the PR open for a long delay to allow every developer discuss about the PR.
+If the label of PR start with "WIP" (Work In Progress), it will not be analyzed (until you change the label of PR).
+
If your PR has errors reported by the Continuous Integration Platform, it means your PR is not valid and nothing will be done with it. It will be kept open to allow developers to fix this, or it may be closed several month later. Don't expect anything on your PR if you have such errors, you MUST first fix the Continuous Integration error to have it taken into consideration.
If the PR is valid, and is kept open for a long time, a tag will also be added on the PR to describe the status of your PR and why the PR is kept open. By putting your mouse on the tag, you will get a full explanation of the tag/status that explain why your PR has not been integrated yet.
-In most cases, it give you information of things you have to do to have the PR taken into consideration (for example a change is requested, a conflict is expected to be solved, some questions were asked). If you have a yellow, red flag of purple flag, don't expect to have your PR validated. You must first provide the answer the flag ask you. The majority of PR are waiting a developer action.
+In most cases, it gives you information of things you have to do to have the PR taken into consideration (for example a change is requested, a conflict is expected to be solved, some questions were asked). If you have a yellow, red flag of purple flag, don't expect to have your PR validated. You must first provide the answer the flag ask you. The majority of PR are waiting an action of the developer/author.
-Around 95% of submitted PR are reviewed and tagged. Even if this is one of the most important ratio of answered PR in Open Source world, don't expect the core team to reach the 100%. With the increasing popularity of Dolibarr, this ratio will probably decrease in future.
+Statistics on Dolibarr project shows that around 95% of submitted PR are reviewed and tagged. This is one of the most important ratio of answered PR in Open Source world. Don't expect the core team to reach the 100%. With the increasing popularity of Dolibarr, this ratio will probably decrease in future.
### Resources
diff --git a/.travis.yml b/.travis.yml
index b710e17c773..1521035578b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -288,7 +288,7 @@ script:
# Ensure we catch errors
set -e
#parallel-lint --exclude htdocs/includes --blame .
- parallel-lint --exclude htdocs/includes/sabre --exclude htdocs/includes/phpoffice/phpexcel/Classes/PHPExcel/Shared --exclude htdocs/includes/phpoffice/PhpSpreadsheet --exclude htdocs/includes/sebastian --exclude htdocs/includes/squizlabs/php_codesniffer/tests --exclude htdocs/includes/jakub-onderka/php-parallel-lint/tests --exclude htdocs/includes/mike42/escpos-php/example --exclude htdocs/includes/phpunit/php-token-stream/tests --exclude htdocs/includes/composer/autoload_static.php --blame .
+ parallel-lint --exclude dev/namespacemig --exclude htdocs/includes/sabre --exclude htdocs/includes/phpoffice/phpexcel/Classes/PHPExcel/Shared --exclude htdocs/includes/phpoffice/PhpSpreadsheet --exclude htdocs/includes/sebastian --exclude htdocs/includes/squizlabs/php_codesniffer/tests --exclude htdocs/includes/jakub-onderka/php-parallel-lint/tests --exclude htdocs/includes/mike42/escpos-php/example --exclude htdocs/includes/phpunit/php-token-stream/tests --exclude htdocs/includes/composer/autoload_static.php --blame .
set +e
echo
diff --git a/ChangeLog b/ChangeLog
index 0839fd77e95..6ca4df10d38 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -16,6 +16,116 @@ Following changes may create regressions for some external modules, but were nec
* Properties ->libelle_incoterms were renamed into ->label_incoterms
* Removed the method liste_array() of project class. It was not used by core code.
* The function show_theme() hase been renamed into showSkins()
+* Rename 'module_part' parameter into 'modulepart' into document APIs, for consistency.
+
+
+***** ChangeLog for 10.0.1 compared to 10.0.0 *****
+FIX: #10930
+FIX: #10984
+FIX: reposition on "Build backup" button
+FIX: #11400
+FIX: #11412
+FIX: #11460
+FIX: #11463
+FIX: #11466
+FIX: #11492
+FIX: #11498
+FIX: #11505
+FIX: #11506
+FIX: #11507
+FIX: #11509
+FIX: #11537
+FIX: #11543
+FIX: #11553
+FIX: #11576
+FIX: #11584
+FIX: #11590
+FIX: accounting mode must be taken from global conf, because there's no way to choose a mode with interface
+FIX: Add message from public interface
+FIX: add missing hook calls
+FIX: Add warning when setup is strange
+FIX: ajax call for line positioning when CSRFCHECK_WITH_TOKEN is on
+FIX: API return 404 sometimes even if API exists
+FIX: Attachment was lost when we validate an expense report
+FIX: avoid conflict with "$classname" in card.php
+FIX: Bad sql request
+FIX: better compatibility with multicompany transverse mode
+FIX: Better PHP compatibility
+FIX: Block to link with tickets
+FIX: Can't submit a ticket from public interface
+FIX: categories import: prevent mismatch between category type and object type
+FIX: Closing ticket from public interface
+FIX: Column 'paid' missing in expense report
+FIX: compatibility mysql 8. rank is reserved
+FIX: Computed field were not calculated into lists.
+FIX: Content of email for subscription
+FIX: correct error in files with multiple spaces
+FIX: CVE-2019-11199
+FIX: delete of links between objects
+FIX: div not balanced
+FIX: do not return formatted prices in json string
+FIX: duplicate on the check (TODO field $onetrtd not used ?)
+FIX: element name in update_price
+FIX: empty product_use_units in product configuration
+FIX: expedition card: infinite loop for printObjectLine hook if return > 0
+FIX: extrafield loading bug due to assumption that an object is a third party while it may be a contact if MAIN_USE_COMPANY_NAME_OF_CONTACT is set.
+FIX: Fatal error on dol_htmloutput_mesg with corrupted array
+FIX: Fatal situation if payment removed on expense report. Action
+FIX: FEC Format - Missing date_creation in general ledger when you add a new transaction
+FIX: FEC Format - Save translation of the journal label in database & nowrap on amount
+FIX: floating point precision errors in the triggers of the workflow module
+FIX: for #11232
+FIX: format of field with type timestamp
+FIX: fournrprice log for insert
+FIX: help text
+FIX: import filter error
+FIX: __INFOS__ tag not exists
+FIX: issue #9300: install error with PostgreSQL when using custom table prefix
+FIX: Language key
+FIX: Limit of uploaded files (max_post_size was not used)
+FIX: list of balance of leaves
+FIX: minor spelling issues
+FIX: missing "dropdown-icon" replacement
+FIX: Missing field "Conciliated" into bank transaction export
+FIX: missing filter by current contact
+FIX: missing token
+FIX: Missing where on entity
+FIX: move sql request in INNER JOIN
+FIX: name was able to be in field but went back to new line
+FIX: Nowrap on amount
+FIX: Online payment
+FIX: on shipment delete confirm dialog, a new checkbox allows the user to choose if they want their stock re-incremented after the deletion.
+FIX: option EXPORT_LABEL_FOR_SELECT to restore compatibility in export
+FIX: Option THIRDPARTY_SUGGEST_ALSO_ADDRESS_CREATION
+FIX: outdated phpdoc
+FIX: Permission for BOM menu
+FIX: permission to delete a draft purchase order
+FIX: phpcs
+FIX: Position was lost when we edit the line of template invoice
+FIX: product_use_units was set to 0 each time a conf in block other was set
+FIX: propal createFrom hook: undefined parameter attached
+FIX: Responsive of public interface of ticket
+FIX: search by phone pro
+FIX: Setup of TakePos was not possible after a clean install
+FIX: Show list of events on tickets
+FIX: socpeople assigned list in action com list
+FIX: SQL problem on donation & nowrap on amount
+FIX: stock increase on shipment deletion if STOCK_CALCULATE_ON_SHIPMENT_NEW: is set
+FIX: stripe webhook ID constant set
+FIX: summary of time spent in preview tab of projects
+FIX: the feature to bill time spent was not enabled.
+FIX: The new feature to attach document on lines was not correclty
+FIX: The proposed new supplier code does not work
+FIX: this function can not be private
+FIX: tk9877 - PDF rouget requires product.lib.php (otherwise measuring_units_string() is not defined)
+FIX: Update the file index table when we validate/rename a ref.
+FIX: use rounding to compare the amounts
+FIX: We must save code instead of value in database for template invoice modelpdf
+FIX: we need to be able to add freeline with qty between 0 & 1 in supplierorder line
+FIX: We should remove property comments only for project and task api.
+FIX: When saving an action it didn't save the label based on the type of event if the label is empty and the type is customized
+FIX: when STOCK_CALCULATE_ON_SHIPMENT_NEW: is set, deleting a "closed" shipment now increases stock as expected
+FIX: wrong path sociales/index.php doesnt exist anymore
***** ChangeLog for 10.0.1 compared to 10.0.0 *****
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000000..e5493805733
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,13 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+| -------- | ------------------ |
+| <= 8.0.* | :x: |
+| >= 9.0.* | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+To report a vulnerability, please send an email to security@dolibarr.org
+In most cases, after fixing the security, we make an answer by email to say the issue has been fixed.
diff --git a/build/exe/doliwamp/php.ini.install b/build/exe/doliwamp/php.ini.install
index 04191a71f5a..af8ef607112 100644
--- a/build/exe/doliwamp/php.ini.install
+++ b/build/exe/doliwamp/php.ini.install
@@ -458,16 +458,6 @@ variables_order = "GPCS"
; with user data. This makes most sense when coupled with track_vars - in which
; case you can access all of the GPC variables through the $HTTP_*_VARS[],
; variables.
-;
-; You should do your best to write your scripts so that they do not require
-; register_globals to be on; Using form variables as globals can easily lead
-; to possible security problems, if the code is not very well thought of.
-register_globals = Off
-
-; Whether or not to register the old-style input arrays, HTTP_GET_VARS
-; and friends. If you're not using them, it's recommended to turn them off,
-; for performance reasons.
-register_long_arrays = Off
; This directive tells PHP whether to declare the argv&argc variables (that
; would contain the GET information). If you don't use these variables, you
@@ -477,8 +467,7 @@ register_argc_argv = Off
; When enabled, the SERVER and ENV variables are created when they're first
; used (Just In Time) instead of when the script starts. If these variables
; are not used within a script, having this directive on will result in a
-; performance gain. The PHP directives register_globals, register_long_arrays,
-; and register_argc_argv must be disabled for this directive to have any affect.
+; performance gain.
auto_globals_jit = On
; Maximum size of POST data that PHP will accept.
@@ -1101,14 +1090,6 @@ session.gc_maxlifetime = 1800
; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes):
; cd /path/to/sessions; find -cmin +24 | xargs rm
-; PHP 4.2 and less have an undocumented feature/bug that allows you to
-; to initialize a session variable in the global scope, albeit register_globals
-; is disabled. PHP 4.3 and later will warn you, if this feature is used.
-; You can disable the feature and the warning separately. At this time,
-; the warning is only displayed, if bug_compat_42 is enabled.
-
-session.bug_compat_42 = 0
-session.bug_compat_warn = 1
; Check HTTP Referer to invalidate externally stored URLs containing ids.
; HTTP_REFERER has to contain this substring for the session to be
diff --git a/build/rpm/httpd-dolibarr.conf b/build/rpm/httpd-dolibarr.conf
index 1126d4fe442..ebda2b3ddfc 100644
--- a/build/rpm/httpd-dolibarr.conf
+++ b/build/rpm/httpd-dolibarr.conf
@@ -29,16 +29,6 @@ Alias /dolibarr /usr/share/dolibarr/htdocs
ErrorDocument 401 /public/error-401.php
ErrorDocument 404 /public/error-404.php
-
| ' . $langs->trans("Label") . ' | '; -print '' . $langs->trans("JanuaryMin") . ' | '; -print '' . $langs->trans("FebruaryMin") . ' | '; -print '' . $langs->trans("MarchMin") . ' | '; -print '' . $langs->trans("AprilMin") . ' | '; -print '' . $langs->trans("MayMin") . ' | '; -print '' . $langs->trans("JuneMin") . ' | '; -print '' . $langs->trans("JulyMin") . ' | '; -print '' . $langs->trans("AugustMin") . ' | '; -print '' . $langs->trans("SeptemberMin") . ' | '; -print '' . $langs->trans("OctoberMin") . ' | '; -print '' . $langs->trans("NovemberMin") . ' | '; -print '' . $langs->trans("DecemberMin") . ' | '; -print 'Total | '; +for($i = 1; $i <= 12; $i++) +{ + print '' . $langs->trans("MonthShort".sprintf("%02s", $i)) . ' | '; +} +print ''.$langs->trans("Total").' | '; print '