Skip to content

Changelog

All notable changes to djehuty are documented in this file. Newest releases appear first; this file is the source of truth for release notes.

Commit links point to https://github.com/4TUResearchData/djehuty.

[v26.8.2]

This patch release consists of 14 commits made by 5 authors.

It resolves a security advisory on collaborative article-metadata authorization, aligns the v3 article search API with the legacy behaviour, fixes several UI issues around Preview expiry dates, notifications and the mobile viewport, writes a collection's dataset list only once, refreshes dependencies, extends Ruff enforcement to the web validator, stabilises the end-to-end tests, and documents the djehuty Community.

Security

See the published advisories for details, impact and remediation.

  • Missing authorization on collaborative article metadata operations across 13 /v2/account/articles routes. (GHSA-3gh2-4q87-wcjx)

Documentation

  • Add information about the djehuty Community to the README and CONTRIBUTING. (95bd036)

Bugfixes

  • Match the v3 article search API to the legacy behaviour for partial queries. (d745e2f)
  • Roll over month and year ends when a Preview sets an expiry date. (10db53f)
  • Stack notifications and keep the previous colour. (0a87f26)
  • Write a collection's dataset list only once. (af3d6af)
  • Pin the viewport and banner, and make the help icons touchable. (fc8b3f0)

Incremental improvements

Technical debt

  • Lint and format the web validator with Ruff, and add it to the enforced scope. (780a469)
  • Fix four flaky or failing end-to-end tests. (ea83b16)

[v26.8.1]

This patch release consists of 12 commits made by 3 authors.

It corrects the homepage subject-tile links, keeps apostrophes readable in text, refines the storage-maintenance mode, speeds up dataset search, relabels the dataset deposit type, and refreshes dependencies.

Bugfixes

  • Rename the metadata deposit type label from 'File deposit' to 'Dataset deposit'. (9c4907e)
  • Point the homepage subject tiles at the right category. (cead808)
  • Keep apostrophes literal in text instead of showing their HTML entity. (526cffb)
  • Skip the filesystem checks while storage-maintenance mode is active. (a9c578c)

Incremental improvements

  • Show the expected end date in the storage-maintenance banner. (96b624a)
  • Only join the tags list when a dataset search filter needs it, avoiding unnecessary work on every dataset query. (723f5f3)
  • Update the Python dependencies. (1ff0fcf, 4a4a759)

Technical debt

  • Serve the /review/ pages from the new HTTP stack. (cc1b491)
  • Lint and format the web formatter with Ruff, and add it to the enforced scope. (74683fc)

[v26.8]

This release consists of 7 commits made by 3 authors.

It adds an optional shared Valkey cache backend and an optional storage-maintenance mode, adds a COLLECT button to the physical samples page, lets depositors clear the 'Derived From' metadata field again, and extends Ruff enforcement to the XML formatter.

New features

  • Add a COLLECT button to the physical samples page. (554eefc)
  • Add an optional shared Valkey cache backend, so several instances can share one cache instead of each keeping its own on disk. (5ef3478)
  • Add an optional storage-maintenance mode, which answers file requests with 503 while browsing and editing metadata stay available. (71739c0)

Bugfixes

  • Allow the 'Derived From' metadata field to be cleared. (435521b)
  • Avoid an error when publishing a dataset that has a Git repository. (TBD)

Incremental improvements

Technical debt

  • Lint and format the XML formatter with Ruff, and add it to the enforced scope. (5b75957)

[v26.7.2]

This patch release makes maintenance mode work without any external resource, and refreshes the Docker base image.

Bugfixes

  • Serve maintenance mode without reaching the database or storage, so the maintenance page is shown even while the back-ends are offline. (e91d106)

Incremental improvements

  • Update the Python base image used for the Docker image. (06f7400)

[v26.7.1]

This patch release resolves five coordinated-disclosure security advisories in the shared djehuty codebase, alongside documentation, a bugfix and dependency updates.

Security

See the published advisories for details, impact and remediation.

  • Privilege escalation to administrator via unverified e-mail change in PUT /v3/profile. (GHSA-jj2h-4p8q-v53g)
  • Session-token disclosure via file upload_token enabling account takeover. (GHSA-j7qm-mfj9-7hvh)
  • Missing authorization on collaborative file operations (list/read/add/delete). (GHSA-p9rx-3rr4-xm8r)
  • Account e-mail enumeration via /v3/accounts/search. (GHSA-mc23-9g93-mxmh)
  • Restricted file disclosure through version-ambiguous download authorization. (GHSA-p325-q859-8h8w)

After upgrading, operators should invalidate all existing sessions (/admin/maintenance/clear-sessions), because the upload_token issue exposed live session tokens. A server restart alone does not revoke them.

Documentation

  • Add IGSN API documentation. (2902512)

Bugfixes

  • Add missing edit_author functions in edit-collection.js. (1dad77f)

Incremental improvements

[v26.7]

This release consists of 5 commits made by 2 authors.

It lets administrators remove files from a version of a published dataset, and includes IGSN and documentation improvements.

New features

  • Allow administrators to remove files from a version of a published dataset. (3420599)

Bugfixes

  • Allow e-mail subdomains to use IGSN. (50ec548)
  • Point the API documentation link to the repository's own OpenAPI docs. (7fb0805)

Documentation

  • Add a reference to the template used to create the community website. (209ceb3)
  • Add a clause about commercial solicitation to the Code of Conduct. (4411b77)

[v26.6]

This release consists of 29 commits made by 7 authors.

We're happy to announce that this release includes IGSN support for physical samples and a new HTTP stack built upon fastapi, along with other incremental improvements and better documentation.

New features

  • Add a new HTTP implementation, starting with the foundation. (9d2424d)
  • Add the v2 API to the new HTTP implementation. (f04c472)
  • Add the v3 API to the new HTTP implementation. (16469f8)
  • Introduce physical objects with metadata editing. (cb241eb)
  • Add IGSN support for physical samples. (6bdee58)

Documentation

  • Publish the community site together with the documentation. (97b3341)
  • Align the documentation styling with the community site. (df0321a)
  • Remove the duplicate Community navigation entry. (d013044)
  • Remove a superfluous section from the community hour page. (2614214)
  • Add API documentation pages. (aaa6cb4)
  • Add a deployment guide and restructure the README file. (8c560ee)
  • Improve CONTRIBUTING.md. (1fea1c8)
  • Update RELEASE.md. (a7803ef)

Incremental improvements

  • Reuse active authors matching an email address or ORCID. (4485d8a)
  • Replace the Figshare API notice with a link to the new API reference. (50f960c)

Technical debt

  • Lint and format the web cache and I/O helpers with Ruff, and enforce it. (78ff956)
  • Test downloads from S3. (bc93bf5)

[v26.5]

This release consists of 17 commits made by 3 authors.

This release includes new features, bugfixes, documentation updates, and incremental improvements.

New features

  • Add custom-style support to Djehuty. (0823985)

Documentation

  • Add documentation sections explaining custom-style loading. (86d503b)

Bugfixes

  • Fix duplicate "collect" UI on dataset pages, and improve the UI flow. (e05528c)
  • Use a consistent cite-button label. (d4a768e)

Incremental improvements

  • Add a minimum keyword count to the metadata form. (a294fbf)

[v26.4.1]

This patch release consists of 9 commits made by 3 authors.

This patch release includes bugfixes, minor updates in documentation and improvements.

Documentation

  • Update documentation with new email addresses for information and security reporting. (61228d4)

Bugfixes

  • Remove netid username from author's name. (2d5428c)
  • Allow correct collection when selected using COLLECT button. (e7dd5c9)
  • Remove ROR link from institution name (only link on icon remains). (0dda062)

Incremental Improvements

  • Improved downloads of large files allowing to resume started downloads in case of failure. (9a6af80)
  • Update Python, GitHub Actions and Docker dependencies for security and performance. (ad56ce4, 329335b, 0418d2e)

[v26.4]

The fourth release of 2026 consists of 12 commits made by 3 authors.

This release gives administrators two new tools for correcting the record after publication.

New features

  • Add an administrative dashboard action to retract a published dataset. (a358518)
  • Add an administrative action to merge user accounts and transfer their ownership. (83cbe0d)
  • Show the djehuty version in the page footer. (ed9f9c8)

Incremental improvements

Documentation

  • Migrate the documentation to Markdown and publish it with MkDocs. (3f28684)
  • Remove the documentation section from README.md now that it lives in the docs site. (dd8f54b)
  • Add a documentation issue template. (5a2e2b5)

[v26.3.3]

This patch release fixes the Djehuty container image, which failed to start because the published wheel shipped none of the bundled resources. Both the container image and the Python wheel are now complete.

Bugfixes

  • Fix the djehuty container image and improves the python whells. (e53aa4a)

[v26.3.2]

This patch release includes 5 commits focused on security, maintenance and dependencies.

Incremental improvements

  • Create a support for database migrations. (dee251c)
  • Update Python dependencies for security and performance. (70fbb8b, 11ce5e8)

Bugfixes

  • Restrict search order to an allow-list. (897c915)
  • Escape the session name field before templating. (f9f3e47)

[v26.3.1]

This patch release includes 12 commits focused on maintenance and bug fixes. It updates multiple Python, Docker, and GitHub Actions dependencies, improves the image build process, deprecates Python 3.9 support, and fixes an issue that could generate duplicate groups in the database.

Incremental improvements

  • Deprecate Python 3.9 support. (6b25918)
  • Make the production Docker image build the same way as the development image. (b651c96)
  • Update the Docker base image to the latest patched python version.(60ce009)
  • Update GitHub Actions dependencies.(4995863, 0aef7c8)
  • Update Python dependencies for security and performance. (bc89ceb, 64a0ef5, ee4ef99, b30a44c)

Bugfixes

  • Fix an issue where start could generate duplicate groups in the database. (2ffafde)

[v26.3]

The third release of 2026 consists of 21 commits made by 3 authors.

We’ve kicked off a new phase of improvements focused on reliability, usability, and long-term sustainability. This release expand automated testing and automated process and quality assurance efforts, helping make Djehuty more robust, efficient, and easier to evolve for both users and developers.

New features

  • Add JSON as a supported Djehuty config format alongside XML to support future cloud-native deployments. (6ace7fe)
  • Add dashboard for administrative changes in published datasets allowing embargo dates updates. (e14c93d)
  • Add dashboard for administrative changes in published datasets allowing licenses updates. (34a9909)
  • Add ROR link to the landing page of the publications. (68aa989)

Incremental improvements

  • Add E2E testing setup using Playwright. (0f587a2
  • Add code coverage using codecov. (d50761a)
  • Add container image and python build workflow for automate release and test process. (75cad1e)
  • Add process to do easy restore of the database for the development environment. (c66cb30)
  • Add configuration to support sub-submenus in the layout. (d54d2d5)
  • Add image support for non-font awesome icons. (7e8e0b0)
  • Update python dependencies for security and performance. (2ec35fd)

Bugfixes

  • Implement S3 factory for reusable clients to lower memory footprint. (4dbc4ca)

Documentation

  • Documents the full release process and add a CHANGELOG.md file as single source of historical changes. (58f075e)

[v26.2]

The second release of 2026 consists of 9 commits made by 2 authors.

Documentation

  • Add SECURITY.md with coordinated disclosure policy. (9076560)
  • Update GOVERNANCE.md Diagram as a code. (f1108ed)

Bugfixes

  • Fix documentation build issues and make debugging it easier. (d0f3f95)
  • Fix new author fields not displaying in collections. (60ec8bf)

Incremental improvements

  • Add option to disable “Full content embargo”. (42b6eb1)
  • Add custom message to dataset file deposit. (5f42855)
  • Make primary menu layout dynamic and flexible. (0f3f8d9)
  • Implement easy development start process with djehuty. (c8635b4)
  • Create dependabot.yml file to monitors dependencies. (fdbeee7)

[v26.1]

The first release of 2026 consists of 10 commits made by 4 authors.

New features

Documentation

  • Add contributing guidelines, code of conduct, and governance document. (4e66a99, afd028d, 7b10467)
  • Update contact information and copyright license. (4c5de37, 53bf4e0)
  • Add issue and pull request templates. (568f94d)

Bugfixes

  • Fix rendering of DOI in private viewing. (d93ff4b)

Incremental improvements

  • Add support for symbolic links in generated zip files. (2bc0e4e)

[v25.6]

The June release of 2025 consists of 15 commits made by 3 authors.

New features

  • Add initial support to display a CodeWorks badge. (4b3d521)
  • Add auto-completion support for keywords. (0324453)

Bugfixes

  • Return empty list upon error in /v3/datasets/<uuid>.git/contributors. (5a7c70c)
  • Avoid duplicating entries in the funding autocompletion. (a538873)

Incremental improvements

[v25.5]

The May release of 2025 consists of 14 commits made by 3 authors. This release contains a security fix for a SPARQL injection found by Thomas Thelen and a a security fix for a HTML injection found by Anass Ksiber. Many thanks to both for reporting and assisting in resolving these vulnerabilities.

UI revisions

  • Introduce an "Interoperability" section with links to the RO-Crate metadata API and the IIIF manifest. (2a49687)

Security

  • Properly escape session cookie value. (da1cbf2)
  • Avoid possibility of HTML injection in the search page. (4f479f6)

Bugfixes

  • Avoid re-creating the Handle configuration. (80f1f2e)
  • Ensure the v2 API respects the depositing-domains property. (45941d2)
  • Don't show file metadata for restricted datasets in RO-Crate output. (b81c730)
  • Improve render quality of PDF files in the IIIF Image API. (6556bf2, ffb3596)
  • Document acceptable parameters for various API endpoints. (b5dea01)
  • Distribute missing files in the release tarball. (76b2951)

Technical debt

  • Simplify the dist-docker target. (7b08aae)

[v25.4]

The April release of 2025 consists of 51 commits made by 4 authors.

New features

Security

Bugfixes

  • Ensure ZIP files of Git repositories are bit-reproducible. (586c304)
  • Fix alignment of search results when viewed as a list. (2463ebb)
  • Document the institution API endpoints. (fc27ddf)
  • Show reviews for institutional reviewers based on the group rather than accounts. (6ef0eca)

Technical debt

[v25.3]

The March release of 2025 consists of 57 commits made by 2 authors. This release contains various bugfixes, minor UI revisions, minor feature updates, and contains the foundation for an extra security layer to prevent cross-site scripting vulnerabilities. The release date slipped a couple of days because yours truly wanted to give last-minute changes a little bit of time to make sure no regressions occurred before formalizing the release.

New features

  • Implement API endpoints for reviewers. (1de7f68, 038e931, 2f59635)
  • Report number of search results in the /v2/articles/search endpoint. (a8917a8)
  • Add SoftwareSourceCode to RO-Crate output. (79cf0b3)

UI revisions

  • Revise the "Cite" and "Collect" buttons on landing pages. (b0b9dbd)
  • Remove the need for a "save URL" button in the dataset metadata form. (a853085)
  • Revise the versions drop-down menu on landing pages. (e5b89ce)
  • Fix tile scaling on the main page for different zoom levels. (7a30bfa)

Security

  • Addressed a Cross-Site-Scripting vulnerability in the search functionality. (40b12a5)
  • Only display e-mail address of authors to the creators of such records. (05a56fa)

Bugfixes

  • Fix author ordering for collections. (244017a)
  • Fix bug in cached responses in the IIIF Image API implementation. (88d68c7)
  • Fix bug with proportional scaling in the IIIF Image API implementation. (05d5c7a)
  • Fix various bugs with rendering HTML entities and tags. (d3667ed, 3b19d7d, 08e4fc7, 3a1f3dd)
  • Avoid a divide-by-zero situation with quota usage calculation. (cefde15)
  • Fix creating datasets with repeated fields using the v2 API. (74fe025, 87127c1)
  • Fix setting default fields when creating a dataset using the API. (7f18338)
  • Fix returning Git statistics for empty Git repositories. (be3630a, 2cffe95, c3227a7)

Technical debt

  • Work towards a stricter Content-Security-Policy by avoiding inline use of style attributes, script elements, and event handlers. (b862fdf, 18b3bbe, f08542e, 1c248a1, 99cf348, 7524bbb, 4d66963)
  • Avoid hard-coded versions in the documentation for the RPM download links. (21be87d)
  • Avoid repetitive text in the documentation by using macros. (088f8a1, f3dc9c8)
  • Build Docker images with C development libraries to work around "xmlsec" build issues. (2c03cb3)

[v25.2]

The February release of 2025 consists of 75 commits made by 2 authors. The major new features in this release are initial support for RO-Crate and direct support for S3 buckets. The release was delayed to include an important security fix for a Cross-Site-Scripting vulnerability found by Aaron Liebig. Many thanks for reporting and assisting in resolving this vulnerability.

New features

Security

  • Addressed a Cross-Site-Scripting vulnerability. (38e89a0)

Bugfixes

Technical debt

  • Remove urllib3 as explicit dependency. (672eaff)
  • Prevent comments in query templates from being sent to the SPARQL endpoint. (9ac7035)

[v25.1]

The January release of 2025 consists of 85 commits made by 3 authors. In this release we included an RPM package for Enterprise Linux 9. This RPM depends on packages in the Extra Packages for Enterprise Linux (EPEL) repository.

New features

Bugfixes

  • Related versions of a dataset are communicated to DataCite. (1539117)
  • HTML output of the documentation is responsive to browser widths. (934ed93)
  • Restore ability to create new collection versions. (545de47)
  • Display embargoed datasets in the search results. (c86dcf8)
  • Fixed building RPM packages. (1f629fa, e4c1057)
  • Fixed HTTP PUT behavior for /v2/account/collections/<id>/articles. (107ea69)

Technical debt

  • Unified the development environment instructions between GNU/Linux, Windows and macOS. (8921d35, ca9b583)
  • Run-time configurable properties are stored in a separate module. (a8e353d)
  • Improve error handling. (bdf77ed, 23c3b53, 609c986)
  • Embed simplified 'zipfly'. (0fe0904)

[v24.12]

New features

  • Add specific logging for when the server would respond an HTTP 500 error. (1dcd141)

Bugfixes

  • Fix a problem with downloading Git repositories as ZIP. (a8c2da4)
  • Avoid returning an internal server error when using paging in the API. (2629ef5)
  • Fix lay-out bug on the landing pages. (a3ff6a5)
  • Fix bug when filtering on groups in the API. (187f434)

Technical debt