v2.39 "Jätkäsaarenlaituri"

[pikariop]

NB: This release contains migrations!

Additions

• Use :oidc-use-state and value :csrf-tokento configure REMS to send a CSRF token in state parameter to the login server and then check its value in the callback. (Adding 'state' parameter into the OIDC flow #3367)
• REMS now includes user simulator, which is a developer tool intended for load testing REMS. The initial version is fairly basic and does not have a lot of features, but it can be used to test system performance and stability. See docs/development.md for more details.

Changes

• Create license admin page:
  • When creating attachment license, the save button no longer activates until all attachments have been successfully uploaded. (Reset attachment field after error #3292)
  • Attachment upload error is indicated by small icon next to the upload button (detailed error is still shown in top of the page).
  • Pending attachment upload is indicated by spinner next to the upload button.
• Edit buttons on the administration detail pages are hidden when the user is not permitted to edit, like they are hidden on the list pages already (Hide invalid edit button #2814)
• Update the Docker image and CircleCI build image to latest available Java version (25 and 21, respectively). (Update supported JVMs and CircleCI to Java 25 #3395)
• Handler can now join an application as a member, and be added as a member. This is to facilitate demos in certain situations rather than a suggested way of using REMS in production. The earlier behaviour where handlers are not permitted to accept invitations can be switched back on under Workflow settings. (Allow handler to accept invitation and join application as member #3100)

Fixes

• Resolved issue where workflow voting could not be removed, which caused UI to display raw translation keys due to nil voting values. (When you select "No voting" for a workflow, the voting block displays incorrectly. It could be entirely hidden. #3357)
• Fixed an issue with the application page where the 'Add member' dropdown menu displayed members that already exist in the application. (Adding members shows users already belonging to the application in the list #1412)
• Document title no longer shows an extra em dash when the localized application title is empty. (Remove en dash if title is empty #3398)
• Fix audit log API. Technical error from incorrect response. (api/audit-log endpoint => 500 server error #3380)
• Fixes to enable JVM 25 support (Java 25 incompatibility tolitius/cprop#60, https://clojure.atlassian.net/browse/CLJ-2764)
• Catalogue table had the add/remove cart commands even when not logged in. (Catalogue items "Add to cart" buttons are active when logged out. #3408)
• Fixed an issue causing the fix-userid administration script to break in some edge cases. Additionally, all fixes are now attempted even if one or more fails. (Fix user id script fails #3383)

---

This discussion was created from the release v2.39 "Jätkäsaarenlaituri".

[brunopacheco1]

Dear @pikariop , if I understood correct, a migration from 2.38 to 2.39 does not require database migration, and does not include any breaking changes. Can you please confirm that?

[pikariop]

Hello!

Sorry, I think we forgot to add a note that the release does require database migrations. There should be no breaking changes that would need special attention post-upgrade, as far as I'm aware. The migration has to do with an error in the fix userid script and it adds an identifier to the database, which the rest of the code will assume to exist. #3403 is the relevant pull request in case you would like to have a closer look.