diff --git a/doc/release-notes/10103-rm-qa-guide.md b/doc/release-notes/10103-rm-qa-guide.md deleted file mode 100644 index 1258814cd97..00000000000 --- a/doc/release-notes/10103-rm-qa-guide.md +++ /dev/null @@ -1 +0,0 @@ -The QA Guide was added as an experiment in #10103 but has been removed because it has proved less useful than imagined. diff --git a/doc/release-notes/11161-do-not-assume-default-license.md b/doc/release-notes/11161-do-not-assume-default-license.md deleted file mode 100644 index 5ac23b11584..00000000000 --- a/doc/release-notes/11161-do-not-assume-default-license.md +++ /dev/null @@ -1,8 +0,0 @@ -### New Feature Flag: do-not-assume-default-license - -A new feature flag `do-not-assume-default-license` has been added. This flag controls the behavior when creating a dataset via API without providing a license or terms of use. - -- By default (flag disabled), the default license will be automatically assigned if no license and no terms are provided in the input JSON, regardless of whether custom terms are allowed. -- When enabled, no license (and no terms) will be assigned if none are provided. - -**Note:** Previously, if custom terms were allowed, the system would not assign a default license in this case. To retain that behavior, you must now enable this feature flag. diff --git a/doc/release-notes/11397-support-html-in-file-level-description.md b/doc/release-notes/11397-support-html-in-file-level-description.md deleted file mode 100644 index c0d6b597ce3..00000000000 --- a/doc/release-notes/11397-support-html-in-file-level-description.md +++ /dev/null @@ -1,2 +0,0 @@ -## Feature Request -File metadata description will now support html in JSF UI. Is already supported in SPA. diff --git a/doc/release-notes/11405-export-improvements.md b/doc/release-notes/11405-export-improvements.md deleted file mode 100644 index 39b4aafccc8..00000000000 --- a/doc/release-notes/11405-export-improvements.md +++ /dev/null @@ -1,24 +0,0 @@ -## Highlights - -### Export improvements - -- More reliable and memory-efficient DDI export -- Ability to force re-export of only selected formats - - -## API updates - -### Ability to export only selected formats - -An optional query parameter ``formats`` has been added to the ``reExportAll`` and ``reExportDataset``, allowing an administrator to force re-export of only the formats specified. - -For example: - -`curl "http://localhost:8080/api/admin/metadata/reExportAll?formats=Datacite,croissant"` -`curl "http://localhost:8080/api/admin/metadata/:persistentId/reExportDataset?persistentId=doi:XXXXXX&formats=ddi"` - -Please see [Admin Guide](https://guides.dataverse.org/en/latest/admin/metadataexport.html) for more information about the metadata export and re-export APIs. - -## Updates for developers - -We have refactored the metadata export code to use the new and improved Data Export framework. Note also that the relevant interface and the accompanying classes have been moved out of the main Dataverse repository and into the dedicated [GDCC project](https://github.com/gdcc/dataverse-spi)). In this release this will result in a measurable improvement in exporting of the DDI format. It should be possible to take advantage of this refactoring to improve the exports of other data-rich formats in future releases. diff --git a/doc/release-notes/11537-featured-items-retrieve-image-bug.md b/doc/release-notes/11537-featured-items-retrieve-image-bug.md deleted file mode 100644 index 48d75a8b0b8..00000000000 --- a/doc/release-notes/11537-featured-items-retrieve-image-bug.md +++ /dev/null @@ -1,3 +0,0 @@ -## BUG - -Featured Item creator can now view/download images when a dataverse is not published. ViewUnpublishedDataverse is not required for the featured item creator. diff --git a/doc/release-notes/11594-release-time-inconsistency-api.md b/doc/release-notes/11594-release-time-inconsistency-api.md deleted file mode 100644 index 2b4b9f89295..00000000000 --- a/doc/release-notes/11594-release-time-inconsistency-api.md +++ /dev/null @@ -1,2 +0,0 @@ -## Bug -API inconsistency for release time between JsonParser/JsonPrinter has been addressed. For backward compatibility new "releaseTime" and original "releaseDate" will be allowed in the Json giving preference to the new "releaseTime" field. Also, "releaseTime" field will populate the db with date/time. The original "releaseDate" field will continue to be truncated to the date only. diff --git a/doc/release-notes/12096-fix-ok-message-nested-object.md b/doc/release-notes/12096-fix-ok-message-nested-object.md deleted file mode 100644 index c918f5b61bd..00000000000 --- a/doc/release-notes/12096-fix-ok-message-nested-object.md +++ /dev/null @@ -1,27 +0,0 @@ -### API Response Format Fix for `message` Field - -The `message` field in API responses from certain endpoints was incorrectly returned as a nested object (`{"message": {"message": "..."}}`) instead of a plain string (`{"message": "..."}`). - -This has been fixed. The following endpoints now return the `message` field as a string, consistent with all other API responses: - -- `POST /api/datasets/{id}/add` (when uploading duplicate files) -- `PUT /api/admin/settings` -- `PUT /api/dataverses/{id}` -- `PUT /api/dataverses/{id}/inputLevels` -- `POST /api/admin/savedsearches` -- `PUT /api/harvest/clients/{nickName}` -- `PUT /api/harvest/server/oaisets/{specname}` - -**Note:** If you have integrations that implemented workarounds for the nested `message` object, you may need to update your code to expect a plain string instead. -If you need time to update your integrations, you can temporarily revert to the legacy behavior by setting this JVM option: - -``` -dataverse.legacy.api-response-message-style=true -``` - -This flag will be removed in a future version. - -**Note:** As of this version, there is also an experimental opt-in feature that will align API responses on about 230 more occasions. -In these responses, the message is embedded into the "data" field as a nested object. -If you want to test your integrations and clients, please enable the `dataverse.feature.unify-api-response-message-style` feature flag. -In a future version of Dataverse, this now experimental style is going to become the supported default. diff --git a/doc/release-notes/12132-dataset-creation-with-template.md b/doc/release-notes/12132-dataset-creation-with-template.md deleted file mode 100644 index 79bf72017e7..00000000000 --- a/doc/release-notes/12132-dataset-creation-with-template.md +++ /dev/null @@ -1,3 +0,0 @@ -## Feature ## - -POST /dataverses/{identifier}/datasets payload JSON now allows for "templateId":$templateId to be included to set the Template on the new Dataset. diff --git a/doc/release-notes/12190-previewers-for-public-aux-files.md b/doc/release-notes/12190-previewers-for-public-aux-files.md deleted file mode 100644 index cb32b0de59f..00000000000 --- a/doc/release-notes/12190-previewers-for-public-aux-files.md +++ /dev/null @@ -1,12 +0,0 @@ -## Allow unrestricted preview of public auxiliary files - -In Dataverse, restricted datafiles can have public auxiliary files -(e.g. ones that only contain metadata or a less sensitive subset of the data). -Public NcML auxiliary files are automatically generated from NetCDF and HDF5 files, for example, even if they are restricted. -With this Dataverse release it is now possible to create previewers for this case, i.e. ones -that allow users who cannot view the restricted file to still see a preview -based on the auxiliary file. (The only known examples of this to date are -the previewers for qualitative data analysis files (conforming to the -[REFI-QDAS standard](https://www.qdasoftware.org/)) which were -[presented by QDR at the 2026 Dataverse Community meeting in Barcelona](https://docs.google.com/presentation/d/1CF9wdJncwFSqqnsDjQ4ktxSei4cFD2Q-glW7dKxoKxM/edit?usp=sharing) -that support creation and viewing of redacted QDAS files.) diff --git a/doc/release-notes/12200-async-reindexing-permissions.md b/doc/release-notes/12200-async-reindexing-permissions.md deleted file mode 100644 index 4ca976b3331..00000000000 --- a/doc/release-notes/12200-async-reindexing-permissions.md +++ /dev/null @@ -1,9 +0,0 @@ -# Asynchronous Permissions Reindexing - -The previously undocumented Solr permissions reindexing API endpoints have been improved. - -- The endpoints are `/api/admin/index/perms` (asynchronous, all objects) and `/api/admin/index/perms/{id}` (synchronous, single object) now use POST instead of GET -- Both endpoints require superuser access. -- For the asynchronous reindex all endpoint, if an indexing process is already in progress, the API will return a 409 Conflict status. -- The asynchronous reindex all endpoint no longer runs as a single transaction. This avoids potential timeouts in larger installations. -- These endpoints are now documented in the Solr Search Index section of the Admin Guide. diff --git a/doc/release-notes/12218-allow-perm-mgmt-without-edit.md b/doc/release-notes/12218-allow-perm-mgmt-without-edit.md deleted file mode 100644 index cef0ef56044..00000000000 --- a/doc/release-notes/12218-allow-perm-mgmt-without-edit.md +++ /dev/null @@ -1,3 +0,0 @@ -Users without permission to edit a dataset or dataverse were not able to access the permission and group management pages via the dataset/dataverse page menus even if they had the relevant ManagePermissions permission. See #3981 and #12218 for details. - -With this change, users with a custom role granting some/all of the ManagePermissions permissions without the Edit permission, which used to be required to see the menu on the Dataverse/Dataset page, can now use the user interface to change permissions (only API changes worked previously) - for the Dataverse on the Dataverse page and for the Dataset and/or Files on the Dataset page. diff --git a/doc/release-notes/12232-block-api-endpoints.md b/doc/release-notes/12232-block-api-endpoints.md deleted file mode 100644 index 8937090737b..00000000000 --- a/doc/release-notes/12232-block-api-endpoints.md +++ /dev/null @@ -1,17 +0,0 @@ -## Upgrade Instructions - -1. Ensure API endpoints are blocked - -It is very important for the "admin" API endpoint to be blocked. Additionally, we recommend blocking the "builtin-users" endpoint. See [the guides](https://guides.dataverse.org/en/6.12/installation/config.html#blocking-api-endpoints) for details. - -In the command below, replace "demo.dataverse.org" with the name of your server. Do the check remotely, not from the server itself. - -`curl https://demo.dataverse.org/api/admin/settings` - -If you can see your settings, follow the instructions in [the guides](https://guides.dataverse.org/en/6.12/installation/config.html#blocking-api-endpoints) to block API endpoints. - -Please note that as reported in #12232, versions of the guides from 6.7 through 6.11 incorrectly described how to configure the setting `dataverse.api.blocked.endpoints`. This was fixed in pull request #12636 for the 6.12 guides. The following is the correct command to use: - -`asadmin create-jvm-options '-Ddataverse.api.blocked.endpoints=admin,builtin-users'` - -That is, the comma-separated list should be "admin,builtin-users" and not "api/admin,api/builtin-users" as described in previous versions of the guides. \ No newline at end of file diff --git a/doc/release-notes/12331-multi-PID-support-in-external-vocabs.md b/doc/release-notes/12331-multi-PID-support-in-external-vocabs.md deleted file mode 100644 index fb528197d59..00000000000 --- a/doc/release-notes/12331-multi-PID-support-in-external-vocabs.md +++ /dev/null @@ -1,2 +0,0 @@ -Dataverse now allows use of multiple PIDs/PID services per field when using external vocabulary scripts. -One example of this is allowing ORCID and ROR values in the author or contact field. \ No newline at end of file diff --git a/doc/release-notes/12346-DataCite-xml-updates.md b/doc/release-notes/12346-DataCite-xml-updates.md deleted file mode 100644 index 4ad541925ee..00000000000 --- a/doc/release-notes/12346-DataCite-xml-updates.md +++ /dev/null @@ -1,9 +0,0 @@ -This release updates the DataCite XML metadata format to -- indicate compliance with the version 4.7 schema, -- add support for specifying a 'Translator' contributor, -- add a valueURI attribute to a subject element when a value exists in the keywordTermURI field, -- add a language element when a dataset has one language defined in its Citation block metadata, -- accept dates of the form YYYY or YYYY-MM in the timePeriodCovered and dateOfCollection fields, and -- avoids sending the word 'null' as part of a date range when the start or end date is unspecified. - -As it adds Translator to the contributorTypes allowed in the citation block, people would have to reload the block to get the new option. \ No newline at end of file diff --git a/doc/release-notes/12362-factory-method-for-JSONbuilders.md b/doc/release-notes/12362-factory-method-for-JSONbuilders.md deleted file mode 100644 index 0a3cdfdf5a8..00000000000 --- a/doc/release-notes/12362-factory-method-for-JSONbuilders.md +++ /dev/null @@ -1,4 +0,0 @@ -# Improved JSON Performance - -A Jakarta JSON-P provider is now reused for every builder or value creation. -This improves the performance of large JSON operations, especially large exports and API responses, without changing the existing behavior or the JSON output. diff --git a/doc/release-notes/12412-fixed-license-acceptance-popup-for-archival-format.md b/doc/release-notes/12412-fixed-license-acceptance-popup-for-archival-format.md deleted file mode 100644 index 71a3cba4d59..00000000000 --- a/doc/release-notes/12412-fixed-license-acceptance-popup-for-archival-format.md +++ /dev/null @@ -1 +0,0 @@ -Fixed an issue where, in some cases, the license acceptance pop-up for the archival format option did not display correctly when downloading a complete dataset. \ No newline at end of file diff --git a/doc/release-notes/12413-disable-multipart-download-for-indirect-download.md b/doc/release-notes/12413-disable-multipart-download-for-indirect-download.md deleted file mode 100644 index d2ac372335a..00000000000 --- a/doc/release-notes/12413-disable-multipart-download-for-indirect-download.md +++ /dev/null @@ -1,5 +0,0 @@ -A new configuration setting has been introduced for S3 compatible storage drivers that addresses an incompatibility between the AWS S3 library used in Dataverse and certain S3 implementations such as the Ceph Object Gateway: -`dataverse.files..disable-multipart-download-for-indirect-download` (default: `false`). - -When set to `true`, multipart download is disabled for the specified S3 driver, forcing the server to handle part reassembly and avoiding the incompatible -headers. This is recommended for Ceph-backed S3 storage if `412` errors are encountered during download when `dataverse.files..download-redirect` is set to `false`. diff --git a/doc/release-notes/12433-NPE-draft-prefiew b/doc/release-notes/12433-NPE-draft-prefiew deleted file mode 100644 index 76b71932887..00000000000 --- a/doc/release-notes/12433-NPE-draft-prefiew +++ /dev/null @@ -1 +0,0 @@ -This release fixes a null pointer exception when previewing a draft file with a retention period. \ No newline at end of file diff --git a/doc/release-notes/12439-openapi.md b/doc/release-notes/12439-openapi.md deleted file mode 100644 index ab921de2483..00000000000 --- a/doc/release-notes/12439-openapi.md +++ /dev/null @@ -1,7 +0,0 @@ -## Updates for API Users - -- The quality of the OpenAPI document has been greatly improved, increasing from 10/100 to 98/100 according [vacuum](https://quobix.com/vacuum/). See [the guides](https://dataverse-guide--12439.org.readthedocs.build/en/12439/api/getting-started.html#getting-the-openapi-document) and #12439. - -## Updates for Developers - -- If you are adding or updating Dataverse APIs you are now required to add OpenAPI annotations. See [the guides](https://dataverse-guide--12439.org.readthedocs.build/en/12439/developers/api-design.html#openapi) and #12439. diff --git a/doc/release-notes/12450-expose-collection-guestbook-root-setting.md b/doc/release-notes/12450-expose-collection-guestbook-root-setting.md deleted file mode 100644 index bcd5e9dc10d..00000000000 --- a/doc/release-notes/12450-expose-collection-guestbook-root-setting.md +++ /dev/null @@ -1,6 +0,0 @@ -Added the ability to set and view the guestbookRoot setting of a collection via these APIs - -Any GET call that returns a Collection or List of Collections will include "guestbookRoot": true or false -`Create Dataverse: POST /api/dataverse/{id}` -`Update Dataverse: PUT /api/dataverse/{id}` -(by adding "guestbookRoot" the Json body) diff --git a/doc/release-notes/12468-prov-fixes.md b/doc/release-notes/12468-prov-fixes.md deleted file mode 100644 index 3235ecb7203..00000000000 --- a/doc/release-notes/12468-prov-fixes.md +++ /dev/null @@ -1,6 +0,0 @@ -This release resolves two older issues about provenance files and improves the related documentation. - -When uploading a wrong provenance JSON, the user was still able to click on the preview button which caused an exception. -From now on, this button will not be available. Also, the error message about the wrong JSON now includes information about what the error actually is. - -The user guide and the GUI now explicitly state that Dataverse only accepts the PROV-JSON format. diff --git a/doc/release-notes/12479-write-guestbook-improvements.md b/doc/release-notes/12479-write-guestbook-improvements.md deleted file mode 100644 index 709240fba20..00000000000 --- a/doc/release-notes/12479-write-guestbook-improvements.md +++ /dev/null @@ -1 +0,0 @@ -The performance when saving counts/guestbook responses has been improved (particularly for datasets with large numbers of files). diff --git a/doc/release-notes/12483-gbr-req-question-fix.md b/doc/release-notes/12483-gbr-req-question-fix.md deleted file mode 100644 index 1353fb93683..00000000000 --- a/doc/release-notes/12483-gbr-req-question-fix.md +++ /dev/null @@ -1 +0,0 @@ -A bug that caused any required custom questions in guestbooks to still be optional has been fixed in the current UI. \ No newline at end of file diff --git a/doc/release-notes/12493-payara7-2026.7plus.md b/doc/release-notes/12493-payara7-2026.7plus.md deleted file mode 100644 index dbace2a054a..00000000000 --- a/doc/release-notes/12493-payara7-2026.7plus.md +++ /dev/null @@ -1,89 +0,0 @@ -This release updates to the recommended Payara-7.2026.8 release and updates many of the third-party libraries Dataverse uses. See #12498. - -### Upgrade from Payara 7.2026.2 to Payara 7.2026.8 - -The instructions below describe the upgrade procedure based on moving your existing Payara 7.2026.2 domain directory into the new Payara 7.2026.8 distribution. We recommend this method because it is the easiest way to recreate your current configuration and preserve your data. - -1. Undeploy Dataverse, if deployed, using the unprivileged service account ("dataverse", by default). - - The new version of Payara is not compatible with previous versions of Dataverse so you must undeploy the running Dataverse 6.11 war file. - - ```shell - sudo -u dataverse /usr/local/payara7/bin/asadmin list-applications - - sudo -u dataverse /usr/local/payara7/bin/asadmin undeploy dataverse-6.11 - ``` - -1. Stop Payara. - - ```shell - sudo systemctl start payara - ``` - -1. Move the current Payara 7.2026.2 directory out of the way. - - ```shell - sudo mv /usr/local/payara7 /usr/local/payara7-2026.2 - ``` - -1. Download the new Payara version 7.2026.8, and unzip it. - - ```shell - curl -L -O https://nexus.payara.fish/repository/payara-community/fish/payara/distributions/payara/7.2026.8/payara-7.2026.8.zip - - sudo unzip payara-7.2026.8.zip -d /usr/local/ - ``` -1. Set permission for the service account ("dataverse" by default). - - ```shell - sudo chown -R root:root /usr/local/payara7 - - sudo chown dataverse /usr/local/payara7/glassfish/lib - - sudo chown -R dataverse:dataverse /usr/local/payara7/glassfish/domains/domain1 - ``` - -1. Replace the brand new `payara7/glassfish/domains/domain1` with your old, preserved domain1. - - ```shell - sudo mv /usr/local/payara7/glassfish/domains/domain1 /usr/local/payara7/glassfish/domains/domain1_DIST - - sudo cp -ar /usr/local/payara7-2026.2/glassfish/domains/domain1 /usr/local/payara7/glassfish/domains/ - ``` - -1. Remove the cache directories. - - ```shell - sudo rm -rf /usr/local/payara7/glassfish/domains/domain1/generated/ - - sudo rm -rf /usr/local/payara7/glassfish/domains/domain1/osgi-cache/ - ``` - -1. Update configuration files in the moved domain. - - The file `glassfish-acc.xml` is replaced with the new `payara-acc.xml`, and `default-logging.properties` has been updated in the new Payara distribution. We recommend copying these new files from the distribution domain into your reused domain. - - ```shell - sudo rm /usr/local/payara7/glassfish/domains/domain1/config/glassfish-acc.xml - - sudo cp /usr/local/payara7/glassfish/domains/domain1_DIST/config/payara-acc.xml /usr/local/payara7/glassfish/domains/domain1/config/ - - sudo cp /usr/local/payara7/glassfish/domains/domain1_DIST/config/default-logging.properties /usr/local/payara7/glassfish/domains/domain1/config/ - ``` - -1. Start Payara. - - ```shell - sudo systemctl start payara - ``` - -1. Deploy the Dataverse 6.12 war file. - - ```shell - wget https://github.com/IQSS/dataverse/releases/download/v6.12/dataverse-6.12.war - - sudo -u dataverse /usr/local/payara7/bin/asadmin deploy dataverse-6.12.war - ``` - - - diff --git a/doc/release-notes/12513-podman.md b/doc/release-notes/12513-podman.md deleted file mode 100644 index aecca6cfa9d..00000000000 --- a/doc/release-notes/12513-podman.md +++ /dev/null @@ -1 +0,0 @@ -Preliminary support for Podman, an alternative to Docker, has been added. See #12513. diff --git a/doc/release-notes/12523-guestbook-responses-page-stats-fix.md b/doc/release-notes/12523-guestbook-responses-page-stats-fix.md deleted file mode 100644 index 53971c323cb..00000000000 --- a/doc/release-notes/12523-guestbook-responses-page-stats-fix.md +++ /dev/null @@ -1,2 +0,0 @@ -## Bug ## -API /api/guestbooks/{id}/responses was returning incorrect stats in the pagination block. This corrects the counts by including the full hierarchy of parent collections. diff --git a/doc/release-notes/12535-download-without-guestbook-response-for-preview-user2.md b/doc/release-notes/12535-download-without-guestbook-response-for-preview-user2.md deleted file mode 100644 index aabee9de5f1..00000000000 --- a/doc/release-notes/12535-download-without-guestbook-response-for-preview-user2.md +++ /dev/null @@ -1,2 +0,0 @@ -## Bug ## -Preview URL users could not download files from the dataset being previewed if a guestbook was assigned to that dataset. This is now fixed. A similar issue with Locally FAIR content is also fixed. diff --git a/doc/release-notes/12536-password-reset-internationalization.md b/doc/release-notes/12536-password-reset-internationalization.md deleted file mode 100644 index a82b863779a..00000000000 --- a/doc/release-notes/12536-password-reset-internationalization.md +++ /dev/null @@ -1 +0,0 @@ -Migrate all the hardcoded message and email strings to properties file for password reset service. See #12536. diff --git a/doc/release-notes/12543-request-timeout.md b/doc/release-notes/12543-request-timeout.md deleted file mode 100644 index dd8b8e1e049..00000000000 --- a/doc/release-notes/12543-request-timeout.md +++ /dev/null @@ -1,9 +0,0 @@ -## Upgrade Instructions - -(Put this near the end.) - -1. The [Dataverse 6.10 release notes](https://github.com/IQSS/dataverse/releases/tag/v6.10) explained how to upgrade from Payara 6 to 7 and mentioned that any other settings that were customized also need to be migrated. Several examples were given but they did not originally include the commonly edited setting for the number of seconds before a request times out. The 6.10 and 6.11 release notes have been updated to now include this example. As described in [the guides](https://guides.dataverse.org/en/6.12/installation/config.html#http-request-timeout-seconds) you might want to shorten or lengthen this value. The default is 900 seconds (15 minutes). If you set it to an hour using the command from the guides (`asadmin set server-config.network-config.protocols.protocol.http-listener-1.http.request-timeout-seconds=3600`) you should see a line like this in your domain.xml file: - - `` - - See also #12543 and #12606. diff --git a/doc/release-notes/12556-can-not-set-guestbook-with-id-over-127.md b/doc/release-notes/12556-can-not-set-guestbook-with-id-over-127.md deleted file mode 100644 index 694fc234cac..00000000000 --- a/doc/release-notes/12556-can-not-set-guestbook-with-id-over-127.md +++ /dev/null @@ -1,3 +0,0 @@ -## Bug ## -Fixed bug when calling PUT api/datasets/{datsetId}/guestbook body = {id over 127}. Values for Guestbook IDs over 127 are no longer failing. - diff --git a/doc/release-notes/6.12-release-notes.md b/doc/release-notes/6.12-release-notes.md new file mode 100644 index 00000000000..b50a5be5ebf --- /dev/null +++ b/doc/release-notes/6.12-release-notes.md @@ -0,0 +1,290 @@ +# Dataverse 6.12 + +Please note: To read these instructions in full, please go to https://github.com/IQSS/dataverse/releases/tag/v6.12 rather than the [list of releases](https://github.com/IQSS/dataverse/releases), which will cut them off. + +This release brings new features, enhancements, and bug fixes to Dataverse. Thank you to all of the community members who contributed code, suggestions, bug reports, and other assistance across the project! + +## Release Highlights + +Highlights for Dataverse 6.12 include: + +- HTML is now supported in the description of files. See #11397 and #12318. +- "Translator" is now available as a "Type" under the "Contributor" field. See #12346. +- External vocabulary scripts now support the use of multiple PID services per field. For example, the Author field can allow both an ORCID value and a ROR value. See #12331. +- New and improved APIs +- Bug fixes +- Security fixes +- Performance improvements + +## Features Added + +These are features that weren't already mentioned under "highlights" above. + +- The performance when saving counts/guestbook responses has been improved (particularly for datasets with large numbers of files). See #12479. +- A public auxiliary file can now be previewed even its associated data file is restricted. An example use case is a previewer for redacted [REFI-QDAS](https://www.qdasoftware.org) files, as [presented](https://docs.google.com/presentation/d/1CF9wdJncwFSqqnsDjQ4ktxSei4cFD2Q-glW7dKxoKxM/edit?usp=sharing) by QDR at the 2026 Dataverse Community Meeting. See #12190. +- When users edit a dataset that has missing required metadata, the page scrolls to the first case of missing metadata, making it easier for users to see what fields they need to fill in order to save and publish their datasets. See #2190 and #12634. + +## Bug Fixes + +- A bug that allowed required custom questions in guestbooks to be optional has been fixed. See #12483 and #12501. +- Preview URL users could not download files from the dataset being previewed if a guestbook was assigned to that dataset. This is now fixed. A similar issue with Locally FAIR content is also fixed. See #12535, #12579, and #12479. +- Fixed an issue where, in some cases, the license acceptance popup for the archival format option did not display correctly when downloading a complete dataset. See #12411 and #12412. +- Previewing a draft file with a retention period was failing but has been fixed. See #12433 and #12434. +- When uploading a provenance JSON file, it was not clear in the user interface or the guides that only PROV-JSON is accepted. Error handling has been improved to explain this, the preview button has been disabled for invalid formats, and the guides have been updated. See [the guides](https://guides.dataverse.org/en/6.12/user/dataset-management.html#data-provenance), #8613, #9342, and #12468. +- Users without permission to edit a dataset or collection were not able to access the permission and group management pages via the dataset or collection page menus even if they had the relevant "manage permissions" permission, set up via a custom role. Previously, the equivalent "edit" dataset or collection permission was required. See #3981, #12218, and #12503. +- The guides have explained how public NcML auxiliary files are automatically generated from NetCDF and HDF5 files since the feature was introduced in #9239 but now they [explicitly state](https://guides.dataverse.org/en/6.12/user/dataset-management.html#ncml) that this happens for restricted files as well. See #12190. +- The creator of a featured item can now view and download images when the collection has not yet been published. (The `ViewUnpublishedDataverse` permission is not required for the creator. Being the creator is enough.) See #11537 and #12381. +- PUT `/api/datasets/{datsetId}/{guestbookBody}` was failing for guestbook IDs over 127. This has been fixed. See #12556 and #12592. +- In the context of creating or importing datasets via API, it was not possible to serialize a dataset as JSON and then recreate it due to a mismatch between `releaseTime` and `releaseDate` fields. For backward compatibility, on create or import, the original `releaseDate` field will continue to be allowed and will continue to be truncated to date only. On create and import, `releaseTime` is now supported and preferred and no truncation occurs. See #11594 and #12320. +- `/api/guestbooks/{id}/responses` was returning incorrect stats in the pagination block. The counts now include the full hierarchy of parent collections. See #12523 and #12557. +- The `/api/admin/requestSignedUrl` API works again for URLs containing special characters such as the `:` in `persistentId` query parameters. This restores functionality accidentally broken in Dataverse 6.10. See #12435. + +## Other Changes + +- Payara 7.2026.8 is now the supported and recommended version. See upgrade instructions below and #12498. +- Database indexes were added to the guestbookresponse table to speed up queries. See #12616. +- The QA Guide was added as an experiment in #10103 but has been removed because it has proved less useful than imagined. It can still be [viewed](https://guides.dataverse.org/en/6.11/qa/index.html) as it existed as of Dataverse 6.11. See #12582. + +## API Updates + +- The quality of the OpenAPI document has been greatly improved. See [the guides](https://guides.dataverse.org/en/6.12/api/getting-started.html#getting-the-openapi-document) and #12439. +- Added the ability to set and view the guestbookRoot setting of a collection. See [the guides](https://guides.dataverse.org/en/6.12/api/native-api.html#create-a-dataverse-collection), #12459, and #12611. +- POST /dataverses/{identifier}/datasets payload JSON now allows for "templateId":$templateId to be included to set the template on the new dataset. See #12132 and #12405. + +## Security Updates + +This release contains important security updates. If you are not receiving security advisories, please sign up by following [the steps](https://guides.dataverse.org/en/latest/installation/config.html#security-advisories) in the guides (email support@dataverse.org to ask for an invite). These advisories are sent through the dataverse-security Google Group, as [announced](https://groups.google.com/g/dataverse-community/c/VQ-D0tIxVP4/m/whFIqm4HAgAJ) on the mailing list. + +We would like to thank Huynh Kien Minh and Santosh Kumar Puppala for notifying us about vulnerabilities that were fixed in this release. + +## Backward Incompatible Changes + +Generally speaking, see the [API Changelog](https://guides.dataverse.org/en/latest/api/changelog.html) for a list of backward-incompatible API changes. + +- The `message` field in API responses from certain endpoints (see the [API Changelog](https://guides.dataverse.org/en/6.12/api/changelog.html#v6-12) for a list) was incorrectly returned as a nested object (`{"message": {"message": "..."}}`) instead of a plain string (`{"message": "..."}`). This has been fixed. To preserve backward compatibility, you can set [dataverse.legacy.api-response-message-style](https://guides.dataverse.org/en/6.12/installation/config.html#dataverse-legacy-api-response-message-style) to true for now, but we plan to remove this flag in a future version. You can also preview a potential new format where the message is nested in the "data" object by enabling [dataverse.feature.unify-api-response-message-style](https://guides.dataverse.org/en/6.12/installation/config.html#dataverse-feature-unify-api-response-message-style). See #12096 and #12097. +- The default license will automatically be applied when datasets are created via API and do not contain a license. You can opt-out of this new behavior by setting `dataverse.feature.do-not-assume-default-license` to true. See [the guides](https://guides.dataverse.org/en/6.12/installation/config.html#dataverse-feature-do-not-assume-default-license), #11161, and #12551. +- The `/api/datafile/{fileId}/metadata/ddi` API endpoint now returns 403/Forbidden rather than 400/Bad Request when the caller can't access the file due to permissions, embargo, or retention period (consistent with other file access APIs). See #12642. +- Whether file extensions are included in the "Content-disposition" header returned when downloading auxiliary files depends on whether the relevant format is one of the content types supported in Tika. A recent update to the version of Tika has added new content types, including "text/markdown", and auxiliary files with these types now have a a file extension included (e.g. ".md" in this case) in the header. See #12498. +- Permissions reindexing was undocumented, as described below, but now requires POST and superuser access. See #12200. + +## Notes for Dataverse Installation Administrators + +### Export Improvements + +An optional query parameter `formats` has been added to the `reExportAll` and `reExportDataset`, allowing an administrator to force re-export of only the formats specified (e.g. `formats=Datacite,croissant`). See [the guides](https://guides.dataverse.org/en/6.12/admin/metadataexport.html#batch-exports-through-the-api) and #11799. + +In addition, DDI export should be more reliable and memory-efficient. See #11405, #11767, #11799 and #12642. + +The DataCite XML metadata format was updated to: + +- indicate compliance with the version 4.7 schema, +- add support for specifying a "Translator" contributor, +- add a valueURI attribute to a subject element when a value exists in the keywordTermURI field, +- add a language element when a dataset has one language defined in its Citation block metadata, +- accept dates of the form YYYY or YYYY-MM in the timePeriodCovered and dateOfCollection fields, and +- avoids sending the word "null" as part of a date range when the start or end date is unspecified. + +See #12346. + +### Permissions Reindexing + +The previously undocumented Solr permissions reindexing API endpoints have been improved. + +- The endpoints are `/api/admin/index/perms` (asynchronous, all objects) and `/api/admin/index/perms/{id}` (synchronous, single object) now use POST instead of GET. +- Both endpoints require superuser access. +- For the asynchronous reindex all endpoint, if an indexing process is already in progress, the API will return a 409 Conflict status. +- The asynchronous reindex all endpoint no longer runs as a single transaction. This avoids potential timeouts in larger installations. +- These endpoints are now documented. + +See the [guides](https://guides.dataverse.org/en/6.12/admin/solr-search-index.html#reindexing-permissions) and #12200. + +### Improved JSON Performance + +A Jakarta JSON-P provider is now reused for every builder or value creation. This improves the performance of large JSON operations, especially large exports and API responses, without changing the existing behavior or the JSON output. See #12362 and #12541. + +### Ceph Object Gateway Support + +A new configuration setting has been introduced for S3 compatible storage drivers that addresses an incompatibility between the AWS S3 library used in Dataverse and certain S3 implementations such as the Ceph Object Gateway: +`dataverse.files..disable-multipart-download-for-indirect-download` (default: `false`). + +When set to `true`, multipart download is disabled for the specified S3 driver, forcing the server to handle part reassembly and avoiding the incompatible headers. This is recommended for Ceph-backed S3 storage if `412` errors are encountered during download when `dataverse.files..download-redirect` is set to `false`. + +See [the guides](https://guides.dataverse.org/en/6.12/installation/config.html#reported-working-s3-compatible-storage), #12413, and #12660. + +### Signed URLs Across Multiple App Servers + +A new, optional `dataverse.api.signing-secret` setting has been added for installations that run multiple app servers. When enabled, the signing secret is persisted to disk rather than only existing in memory on a particular app server. This solves the problem of a user getting an error when trying to make use of a signed URL that was generated on the "wrong" app server. See [dataverse.api.signing-secret](https://guides.dataverse.org/en/6.12/installation/config.html#dataverse-api-signing-secret) in the guides and #12435. + +## New Settings + +### New JVM Options (MicroProfile Config Settings) + +- dataverse.api.signing-secret +- dataverse.feature.do-not-assume-default-license +- dataverse.feature.unify-api-response-message-style +- dataverse.files.``.disable-multipart-download-for-indirect-download +- dataverse.legacy.api-response-message-style + +### New Database Settings + +## Updates for Translators + +- It is now possible to translate password reset email messages. See #12536 and #12544. + +## Updates for Developers + +- For external tools, an `allowedApiCalls` `urlTemplate` should not use any of Dataverse's reserved authentication-related query parameters `until`, `user`, `method`, `token`, `key` or `signed`: launching a tool whose manifest includes them will be rejected with an error naming the parameter. See [the guides](https://guides.dataverse.org/en/6.12/api/external-tools.html#signed-urls) and #12435. +- If you are adding or updating Dataverse APIs you are now required to add OpenAPI annotations. See [the guides](https://guides.dataverse.org/en/6.12/developers/api-design.html#openapi) and #12439. +- We have refactored the metadata export code to use a new and improved Data Export framework. The relevant interface and the accompanying classes have been moved out of the main Dataverse repository and into a dedicated [dataverse-spi](https://github.com/gdcc/dataverse-spi) project. As mentioned above, this will result in a measurable improvement when exporting the DDI format, including unnecessary database queries. It should be possible to take advantage of this refactoring to improve the exports of other data-rich formats in future releases. See #11405, #11767, #11799 and #12642. +- Preliminary support for Podman, an alternative to Docker, has been added. See #12513. + +## Complete List of Changes + +For the complete list of code changes in this release, see the [6.12 milestone](https://github.com/IQSS/dataverse/issues?q=milestone%3A6.12+is%3Aclosed) in GitHub. + +## Getting Help + +For help with upgrading, installing, or general questions please see [getting help](https://guides.dataverse.org/en/latest/installation/intro.html#getting-help) in the Installation Guide. + +## Installation + +If this is a new installation, please follow our [Installation Guide](https://guides.dataverse.org/en/latest/installation/). Please don't be shy about [asking for help](https://guides.dataverse.org/en/latest/installation/intro.html#getting-help) if you need it! + +Once you are in production, we would be delighted to update our [map of Dataverse installations around the world](https://dataverse.org/installations) to include yours! Please [create an issue](https://github.com/IQSS/dataverse-installations/issues) or email us at support@dataverse.org to join the club! + +You are also very welcome to join the [Global Dataverse Community Consortium](https://www.gdcc.io) (GDCC). + +## Upgrade Instructions + +Upgrading requires a maintenance window and downtime. Please plan accordingly, create backups of your database, etc. + +Note: These instructions assume that you are upgrading from the immediate previous version. That is to say, you've already upgraded through all the 6.x releases and are now running Dataverse 6.11. See [tags on GitHub](https://github.com/IQSS/dataverse/tags) for a list of versions. If you are running an earlier version, the only supported way to upgrade is to progress through the upgrades to all the releases in between before attempting the upgrade to this version. + +If you are running Payara as a non-root user (and you should be!), **remember not to execute the commands below as root**. By default, Payara runs as the `dataverse` user. In the commands below, we use sudo to run the commands as a non-root user. + +Also, we assume that Payara is installed in `/usr/local/payara7`. If not, adjust as needed. + +The instructions below describe the upgrade procedure based on moving your existing Payara 7.2026.2 domain directory into the new Payara 7.2026.8 distribution. We recommend this method because it is the easiest way to recreate your current configuration and preserve your data. + +1. Undeploy Dataverse, if deployed, using the unprivileged service account ("dataverse", by default). + + The new version of Payara is not compatible with previous versions of Dataverse so you must undeploy the running Dataverse 6.11 war file. + + ```shell + sudo -u dataverse /usr/local/payara7/bin/asadmin list-applications + + sudo -u dataverse /usr/local/payara7/bin/asadmin undeploy dataverse-6.11 + ``` + +1. Stop Payara. + + ```shell + sudo systemctl stop payara + ``` + +1. Move the current Payara 7.2026.2 directory out of the way. + + ```shell + sudo mv /usr/local/payara7 /usr/local/payara7-2026.2 + ``` + +1. Download the new Payara version 7.2026.8, and unzip it. + + ```shell + curl -L -O https://nexus.payara.fish/repository/payara-community/fish/payara/distributions/payara/7.2026.8/payara-7.2026.8.zip + + sudo unzip payara-7.2026.8.zip -d /usr/local/ + ``` +1. Set permission for the service account ("dataverse" by default). + + ```shell + sudo chown -R root:root /usr/local/payara7 + + sudo chown dataverse /usr/local/payara7/glassfish/lib + + sudo chown -R dataverse:dataverse /usr/local/payara7/glassfish/domains/domain1 + ``` + +1. Replace the brand new `payara7/glassfish/domains/domain1` with your old, preserved domain1. + + ```shell + sudo mv /usr/local/payara7/glassfish/domains/domain1 /usr/local/payara7/glassfish/domains/domain1_DIST + + sudo cp -ar /usr/local/payara7-2026.2/glassfish/domains/domain1 /usr/local/payara7/glassfish/domains/ + ``` + +1. Remove the cache directories. + + ```shell + sudo rm -rf /usr/local/payara7/glassfish/domains/domain1/generated/ + + sudo rm -rf /usr/local/payara7/glassfish/domains/domain1/osgi-cache/ + ``` + +1. Update configuration files in the moved domain. + + The file `glassfish-acc.xml` from Payara 7.2026.2 has been renamed to `payara-acc.xml` in Payara 7.2026.8. Also `default-logging.properties` has been updated in the Payara 7.2026.8. We recommend copying these new files from the Payara 7.2026.8 distribution domain into the domain you copied over from your Payara 7.2026.2 installation. + + ```shell + sudo rm /usr/local/payara7/glassfish/domains/domain1/config/glassfish-acc.xml + + sudo cp /usr/local/payara7/glassfish/domains/domain1_DIST/config/payara-acc.xml /usr/local/payara7/glassfish/domains/domain1/config/ + + sudo cp /usr/local/payara7/glassfish/domains/domain1_DIST/config/default-logging.properties /usr/local/payara7/glassfish/domains/domain1/config/ + ``` + +1. Double check `request-timeout-seconds` setting. + + The [Dataverse 6.10 release notes](https://github.com/IQSS/dataverse/releases/tag/v6.10) explained how to upgrade from Payara 6 to 7 and mentioned that any other settings that were customized also need to be migrated. Several examples were given but they did not originally include the commonly-edited "request-timeout-seconds" setting for the number of seconds before a request times out. The 6.10 and 6.11 release notes have been updated to now include this example. + + As described in [the guides](https://guides.dataverse.org/en/6.12/installation/config.html#http-request-timeout-seconds) you might want to shorten or lengthen this value. The default is 900 seconds (15 minutes). If you set it to an hour using the command from the guides (`asadmin set server-config.network-config.protocols.protocol.http-listener-1.http.request-timeout-seconds=3600`) you should see a line like this in your domain.xml file: + + `` + + See also #12543 and #12606. + +1. Start Payara. + + ```shell + sudo systemctl start payara + ``` + +1. Deploy the Dataverse 6.12 war file. + + ```shell + wget https://github.com/IQSS/dataverse/releases/download/v6.12/dataverse-6.12.war + + sudo -u dataverse /usr/local/payara7/bin/asadmin deploy dataverse-6.12.war + ``` + +1. Update metadata blocks. + + In #12346 we added the value "Translator" under "contributorType" field and we need to reload the citation.tsv file because of this. + + Expect the loading of the citation block to take several seconds because of its size (especially due to the number of languages). + + ```shell + wget https://raw.githubusercontent.com/IQSS/dataverse/v6.12/scripts/api/data/metadatablocks/citation.tsv + + curl http://localhost:8080/api/admin/datasetfield/load -H "Content-type: text/tab-separated-values" -X POST --upload-file citation.tsv + ``` + +1. Ensure API endpoints are blocked. + + It is very important for the "admin" API endpoint to be blocked. Additionally, we recommend blocking the "builtin-users" endpoint. See [the guides](https://guides.dataverse.org/en/6.12/installation/config.html#blocking-api-endpoints) for details. + + In the command below, replace "demo.dataverse.org" with the name of your server. Do the check remotely, not from the server itself. + + ```shell + curl https://demo.dataverse.org/api/admin/settings + ``` + + If you can see your settings, follow the instructions in [the guides](https://guides.dataverse.org/en/6.12/installation/config.html#blocking-api-endpoints) to block API endpoints. + + Please note that as reported in #12232, versions of the guides from 6.7 through 6.11 incorrectly described how to configure the setting `dataverse.api.blocked.endpoints`. This was fixed in pull request #12636 for the 6.12 guides. The following is the correct command to use: + + ```shell + asadmin create-jvm-options '-Ddataverse.api.blocked.endpoints=admin,builtin-users' + ``` + + That is, the comma-separated list should be "admin,builtin-users" and not "api/admin,api/builtin-users" as described in previous versions of the guides. diff --git a/doc/release-notes/fix-indexes-for-guestbook-response.md b/doc/release-notes/fix-indexes-for-guestbook-response.md deleted file mode 100644 index 4becb2ae734..00000000000 --- a/doc/release-notes/fix-indexes-for-guestbook-response.md +++ /dev/null @@ -1,3 +0,0 @@ -## Bug ## - -New indexes added to GustbookResponse to speed up db queries diff --git a/doc/release-notes/fix-url-signing-special-characters.md b/doc/release-notes/fix-url-signing-special-characters.md deleted file mode 100644 index a96e42ff8c1..00000000000 --- a/doc/release-notes/fix-url-signing-special-characters.md +++ /dev/null @@ -1,7 +0,0 @@ -### URL signing API fixed and URL Signing hardened - -The `/api/admin/requestSignedUrl` API works again for URLs containing special characters such as the `:` in `persistentId` query parameters. This restores functionality accidentally broken in Dataverse 6.10. - -URL Signing has also been improved. When the optional `dataverse.api.signing-secret` JVM option is not set, a strong signing secret is generated automatically at startup (kept only in memory and never stored on disk). - -There are limitations to using a generated secret - signed URLs cannot be validated after a server restart, and, on a multi-server installation, signed URLs created on one server cannot be validated on another, resulting in failures if a user's activities cross servers. Installations running multiple servers or that want signed URLs to be valid across server restarts should set `dataverse.api.signing-secret` (a minimum of 36 characters is now required, shorter values are ignored with a warning in the Payara `server.log`). See [dataverse.api.signing-secret](https://guides.dataverse.org/en/latest/installation/config.html#dataverse-api-signing-secret) in the Configuration Guide. diff --git a/doc/release-notes/refactorddiexport.md b/doc/release-notes/refactorddiexport.md deleted file mode 100644 index 09dfa7dc0ea..00000000000 --- a/doc/release-notes/refactorddiexport.md +++ /dev/null @@ -1 +0,0 @@ -The DDI metadata export for tabular files has been changed to avoid unnecessary database queries, remove unused methods, and add consistency checks.