New non-Docker installations still use deprecated BlockedApi* database settings

[ofahimIQSS]

Summary

As of PR #11454 and the related upgrade guidance, :BlockedApiEndpoints, :BlockedApiPolicy, :BlockedApiKey, and :AllowCors are now deprecated and replaced by JVM settings (e.g. -Ddataverse.api.blocked.endpoints, etc.).

However, fresh non-Docker installations using the dvinstall script still initialize the deprecated database settings instead of the new JVM-based equivalents.

This leads to inconsistency:

• Upgraded instances will be encouraged to use JVM options
• Fresh installs will continue using deprecated DB settings
• Leads to potential confusion and maintenance overhead

Steps to Reproduce

1. Spin up a fresh, non-Docker Dataverse installation from develop
2. Run curl commands:

   curl http://localhost:8080/api/admin/settings/:BlockedApiEndpoints
   curl http://localhost:8080/api/admin/settings/:BlockedApiPolicy

3. Observe that deprecated DB settings are set, and JVM settings are not present.

[cmbz]

2026-02-11: @pdurbin will add this issue to discuss during the next containerization meeting.

[pdurbin]

Yes, added to the agenda: https://docs.google.com/document/d/1mCgLpIP00BkDr1VFtD-2OgDSmi3We2BGpgiKYrZbRpM/edit?usp=sharing

I also started this topic: #containers > deprecated BlockedApi* database settings #11553 @ 💬

Like I said there, while the title is currently "New non-Docker installations still use deprecated BlockedApi* database settings" it looks like a deprecated setting is used here:

modules/container-configbaker/scripts/bootstrap/demo/init.sh
47:curl -sS -X PUT -d 'admin,builtin-users' "${DATAVERSE_URL}/api/admin/settings/:BlockedApiEndpoints"

So it seems like at least that demo Docker installation is using that deprecated setting. 🤷