v2.19.0

Highlights

• Introduced a comprehensive model lifecycle and review workflow, including lifecycle reviews, review responses, notifications, status tracking, required state enforcement, and compliance role support.
• Enhanced model and registry management with untrusted model improvements, model card import/export capabilities, container (Docker) image mirroring updates, and lifecycle/release email notifications.
• Delivered significant UI/UX improvements, including a new admin panel, improved dashboards and filtering, clickable analytics charts, documentation refreshes, and numerous usability & a11y fixes.
• Improved platform reliability and maintainability through error handling enhancements, email service refactoring, UTC date handling, CI/CD workflow updates, and extensive dependency upgrades (including major version bumps to Node.js, MUI and ESLint).

What's Changed

🏕 Features

• Add new review kind for model lifecycle by @ARADDCC002 in #3606
• Add filename adjustments by @GB907762 in #3635
• Fix build by removing extra arg in test by @PE39806 in #3641
• fixed an issue where the metrics item widget was not parsing decimal … by @ARADDCC002 in #3640
• Statically host swagger docs on GitHub pages by @PE39806 in #3626
• Feature/bai 2372 create webhook export complete by @IR96334 in #3601
• Add compliance role by @JR40159 in #3619
• Remove unused dir by @PE39806 in #3646
• Fix static docs relative path resolution by @PE39806 in #3644
• Add infra config for compliance role by @JR40159 in #3648
• Add fat manifest support for mirroring by @GB907762 in #3645
• Dev/UI ux changes by @ARADDCC002 in #3604
• Move isUntrustedModelsLoading inside the entry list by @GB907762 in #3685
• UI changes for review lifecyle by @ARADDCC002 in #3617
• Remove NodeCache maxKeys by @PE39806 in #3686
• side nav spelling by @IR96334 in #3698
• Backend changes for required fields for states by @JR40159 in #3634
• Remove manifest digest upload for single platform images by @GB907762 in #3700
• Feature/bai 2389 frontend model status by @IR96334 in #3699
• Add lifecycle emails by @GB907762 in #3688
• Added previous model card review details to overview panel by @ARADDCC002 in #3701
• Correct static docs triangle colour by @PE39806 in #3704
• Scheduled review notifications for lifecycle reviews deleted when mod… by @ARADDCC002 in #3711
• Fix possible frontend turbopack error by @PE39806 in #3712
• Update assorted deprecated function calls by @JRB66955 in #3709
• Various async await issues by @PE39806 in #3710
• Added review responses to model cards by @ARADDCC002 in #3713
• Freeze Registry by @GB907762 in #3720
• Remove redundant token and manifest calls to the registry by @JR40159 in #3702
• Add timeout to artifact scanning by @jason-d337 in #3717
• All reviewers of items are notified of review responses by @ARADDCC002 in #3719
• Enforce model states and clean up user experience of states and organisations by @GB907762 in #3716
• Fix mirrored model filter by @GB907762 in #3744
• Rewrite in-app documentation by @PE39806 in #3599
• Handle empty container layers list by @PE39806 in #3741
• Update model card label text by @PE39806 in #3729
• Refactor email service by @JR40159 in #3703
• Added retention docs by @ON93754 in #3743
• Use model kinds filter by @GB907762 in #3753
• Configure dayjs to enforce UTC usage throughout by @JRB66955 in #3742
• Fix a few python docstrings by @PE39806 in #3752
• Added button for additional reviews by @ARADDCC002 in #3728
• Remove "Create from a template" option for Untrusted Models by @JRB66955 in #3766
• Add email on release approval by @GB907762 in #3768
• Add required by model state docs by @GB907762 in #3770
• Add nvmrc by @GB907762 in #3774
• Remove images entry from release form for untrusted models by @JRB66955 in #3773
• Fix docs broken relative links by @PE39806 in #3780
• Fix trailing slash for API docs by @PE39806 in #3782
• Fix bad semver lookup type breaking file exports by @PE39806 in #3781
• Improve python error handling for backend failures by @PE39806 in #3767
• changes to model details by @ARADDCC002 in #3775
• Updated frontend to eslint 10 by @ARADDCC002 in #3786
• Feature/bai 2554 add argon2 support by @ON93754 in #3776
• MUI v9 by @ARADDCC002 in #3570
• Add new eslint deprecation rule by @JRB66955 in #3785
• Allow Untrusted Models to have a chosen state by @PE39806 in #3800
• Fix kind chips by @GB907762 in #3798
• Re-add attachments to smtp after refactor by @PE39806 in #3818
• Update marketplace filter docs by @PE39806 in #3821
• Replace hardcoded python docs copyright year with current year by @PE39806 in #3823
• Untrusted model file upload guidance by @JR40159 in #3820
• Fix bad back navigation for schema select on data cards by @PE39806 in #3778
• Update style guide for relative URLs and regular characters by @PE39806 in #3824
• remove outdated tsconfig baseUrl config and update for typescript6 by @JRB66955 in #3784
• Fix mocks in tests by @JR40159 in #3816
• Feature/import model card text by @M422110 in #3750
• Create simple markdown style checker for docs pages by @PE39806 in #3834
• fixed issue where removing entry tags would not update ui by @ARADDCC002 in #3837
• Optimise GitHub workflow on conditions by @PE39806 in #3838
• remove outdated tsconfig baseUrl config and update for ts6 by @PE39806 in #3839
• Correct GitHub workflow skip logic for required by @PE39806 in #3840
• Fixed an issue whereby filtering by popular tags would not change the… by @ARADDCC002 in #3841
• Feature/bai 2520 make pie charts clickable by @ON93754 in #3825
• Fixed an issue with datacard selector not working by @ARADDCC002 in #3833
• Added a new end point for models with no releases metrics by @ARADDCC002 in #3819
• Feature/bai 2511 view all question states by @IR96334 in #3740
• Add new job for GitHub matrix jobs required success check by @PE39806 in #3843
• Refactor mjml template string to handlebars template file by @PE39806 in #3842
• Correct docs capitalisation by @PE39806 in #3850
• Use UI Config Context in the Frontend by @JR40159 in #3822
• Added a new admin panel by @ARADDCC002 in #3787
• Fix mirrored model card import from templated model by @PE39806 in #3851
• fix mirrored/untrusted model search navigation by @JRB66955 in #3852
• Improve error message by @GB907762 in #3853

👒 Dependencies

• Bump nginx image version by @PE39806 in #3638
• Bump qs and @cypress/request in /frontend by @dependabot[bot] in #3647
• Correct OS specific npm package by @PE39806 in #3643
• Bump @types/node from 24.12.2 to 24.12.4 in /frontend by @dependabot[bot] in #3679
• Bump semver from 7.8.0 to 7.8.1 in /frontend by @dependabot[bot] in #3678
• Bump js-cookie from 3.0.6 to 3.0.8 in /frontend by @dependabot[bot] in #3677
• Bump axe-core from 4.11.4 to 4.12.0 in /frontend by @dependabot[bot] in #3676
• Bump dayjs from 1.11.20 to 1.11.21 in /frontend by @dependabot[bot] in #3675
• Bump the markdown-stack group in /frontend with 3 updates by @dependabot[bot] in #3674
• Bump @types/node from 24.12.2 to 24.12.4 in /backend by @dependabot[bot] in #3673
• Bump eslint-plugin-prettier from 5.5.5 to 5.5.6 in /frontend in the formatting-stack group by @dependabot[bot] in #3671
• Bump p-queue from 9.2.0 to 9.3.0 in /backend by @dependabot[bot] in #3669
• Bump the rjsf-stack group in /frontend with 4 updates by @dependabot[bot] in #3670
• Bump tsx from 4.21.0 to 4.22.4 in /backend by @dependabot[bot] in #3668
• Bump nodemailer from 8.0.7 to 8.0.10 in /backend by @dependabot[bot] in #3664
• Bump semver from 7.7.4 to 7.8.1 in /backend by @dependabot[bot] in #3661
• Bump @agendajs/mongo-backend from 4.0.1 to 4.0.2 in /backend by @dependabot[bot] in #3663
• Bump the opentelemetry-stack group in /backend with 3 updates by @dependabot[bot] in #3655
• Bump eslint-plugin-prettier from 5.5.5 to 5.5.6 in /backend in the formatting-stack group across 1 directory by @dependabot[bot] in #3656
• Bump the testing-stack group in /backend with 2 updates by @dependabot[bot] in #3651
• Bump lint-staged from 16.4.0 to 17.0.7 by @dependabot[bot] in #3649
• Bump undici from 8.2.0 to 8.3.0 in /backend by @dependabot[bot] in #3667
• Bump mjml from 5.1.0 to 5.3.0 in /backend by @dependabot[bot] in #3672
• Bump the testing-stack group across 1 directory with 2 updates by @dependabot[bot] in #3666
• Bump myst-parser from 5.0.0 to 5.1.0 in /backend/docs by @dependabot[bot] in #3610
• Bump the react-stack group across 1 directory with 14 updates by @dependabot[bot] in #3652
• Bump content-disposition from 1.1.0 to 2.0.1 in /backend by @dependabot[bot] in #3657
• Bump the aws-sdk-stack group across 1 directory with 6 updates by @dependabot[bot] in #3653
• Bump the eslint-stack group across 1 directory with 3 updates by @dependabot[bot] in #3650
• Bump agenda from 6.2.4 to 6.2.5 in /backend by @dependabot[bot] in #3665
• Bump the eslint-stack group in /lib/landing with 2 updates by @dependabot[bot] in #3682
• Bump @huggingface/hub from 2.11.0 to 2.13.0 in /backend by @dependabot[bot] in #3658
• Bump @types/node from 24.12.2 to 24.12.4 in /lib/landing by @dependabot[bot] in #3684
• Bump swiper from 12.1.4 to 12.2.0 in /lib/landing by @dependabot[bot] in #3683
• Bump the react-stack group across 1 directory with 4 updates by @dependabot[bot] in #3680
• Bump filelock from 3.29.0 to 3.29.1 in /lib/artefactscan_api by @dependabot[bot] in #3696
• Bump python-multipart from 0.0.29 to 0.0.30 in /lib/artefactscan_api by @dependabot[bot] in #3695
• Bump ipython from 9.13.0 to 9.14.0 in /backend/docs by @dependabot[bot] in #3691
• Bump uvicorn from 0.48.0 to 0.49.0 in /lib/artefactscan_api by @dependabot[bot] in #3697
• Bump aquasec/trivy from 0.70.0 to 0.71.0 in /lib/artefactscan_api by @dependabot[bot] in #3694
• Bump mlflow-skinny from 3.10.1 to 3.13.0 in /lib/python by @dependabot[bot] in #3690
• Bump mongodb from 18.7.1 to 19.1.0 in /infrastructure/helm/bailo by @dependabot[bot] in #3689
• Bump ipython from 9.14.0 to 9.14.1 in /backend/docs by @dependabot[bot] in #3705
• Bump python-multipart from 0.0.30 to 0.0.32 in /lib/artefactscan_api by @dependabot[bot] in #3706
• Bump tqdm from 4.67.3 to 4.68.1 in /lib/python by @dependabot[bot] in #3707
• Bump mongodb from 19.1.0 to 19.1.4 in /infrastructure/helm/bailo by @dependabot[bot] in #3708
• Bump @grpc/grpc-js from 1.14.3 to 1.14.4 in /backend by @dependabot[bot] in #3715
• Bump protobufjs and otlp-logger in /backend by @dependabot[bot] in #3718
• Bump tmp from 0.2.6 to 0.2.7 in /frontend by @dependabot[bot] in #3721
• Bump js-yaml from 4.1.1 to 4.2.0 in /frontend by @dependabot[bot] in #3725
• Bump form-data from 4.0.5 to 4.0.6 in /frontend by @dependabot[bot] in #3722
• Bump form-data from 4.0.5 to 4.0.6 in /backend by @dependabot[bot] in #3723
• Bump @opentelemetry/core, @opentelemetry/resources, @opentelemetry/sdk-logs, @opentelemetry/sdk-metrics and @opentelemetry/sdk-trace-base in /frontend by @dependabot[bot] in #3724
• Bump js-yaml from 4.1.1 to 4.2.0 in /backend by @dependabot[bot] in #3727
• Bump vite from 8.0.13 to 8.0.16 in /frontend by @dependabot[bot] in #3726
• Bump tqdm from 4.68.1 to 4.68.2 in /lib/python by @dependabot[bot] in #3737
• Bump pylint from 4.0.5 to 4.0.6 in /lib/python by @dependabot[bot] in #3731
• Bump pytest from 9.0.3 to 9.1.0 in /lib/artefactscan_api by @dependabot[bot] in #3732
• Bump mongodb/mongodb-community-server from 8.3.2-ubi9 to 8.3.4-ubi9 by @dependabot[bot] in #3733
• Bump fastapi from 0.136.3 to 0.137.1 in /lib/artefactscan_api by @dependabot[bot] in #3735
• Bump pytest from 9.0.3 to 9.1.0 in /lib/python by @dependabot[bot] in #3734
• Bump mongodb from 19.1.4 to 19.1.11 in /infrastructure/helm/bailo by @dependabot[bot] in #3739
• Bump aquasec/trivy from 0.71.0 to 0.71.1 in /lib/artefactscan_api by @dependabot[bot] in #3738
• Bump filelock from 3.29.1 to 3.29.4 in /lib/artefactscan_api by @dependabot[bot] in #3736
• Bump mongoose to 9.4.x and fix typing/build issues by @PE39806 in #3687
• Bump undici from 8.3.0 to 8.5.0 in /backend by @dependabot[bot] in #3747
• Bump nodemailer from 8.0.10 to 9.0.1 in /backend by @dependabot[bot] in #3745
• Bump undici from 7.25.0 to 7.28.0 in /frontend by @dependabot[bot] in #3746
• Bump pydantic-settings from 2.14.1 to 2.14.2 in /lib/artefactscan_api by @dependabot[bot] in #3751
• Bump mongodb from 19.1.11 to 19.1.14 in /infrastructure/helm/bailo by @dependabot[bot] in #3765
• Bump nginxinc/nginx-unprivileged from 1.31.1-alpine3.23-slim to 1.31.2-alpine3.23-slim by @dependabot[bot] in #3764
• Bump pytest from 9.1.0 to 9.1.1 in /lib/python by @dependabot[bot] in #3763
• Bump tqdm from 4.68.2 to 4.68.3 in /lib/python by @dependabot[bot] in #3762
• Bump pytest-github-actions-annotate-failures from 0.4.0 to 0.4.2 in /lib/artefactscan_api by @dependabot[bot] in #3756
• Bump fastapi from 0.137.1 to 0.138.0 in /lib/artefactscan_api by @dependabot[bot] in #3754
• Bump mlflow-skinny from 3.13.0 to 3.14.0 in /lib/python by @dependabot[bot] in #3761
• Bump pytest from 9.1.0 to 9.1.1 in /lib/artefactscan_api by @dependabot[bot] in #3755
• Bump pytest-github-actions-annotate-failures from 0.4.0 to 0.4.2 in /lib/python by @dependabot[bot] in #3760
• Bump aquasec/trivy from 0.71.1 to 0.71.2 in /lib/artefactscan_api by @dependabot[bot] in #3759
• Update to Node v26.3.1 by @jason-d337 in #3771
• Bump mongoose version by @PE39806 in #3783
• Bump actions/cache from 5 to 6 by @dependabot[bot] in #3788
• Bump node from 26.3.1-alpine to 26.4.0-alpine by @dependabot[bot] in #3790
• Bump node from 26.3.1-alpine to 26.4.0-alpine in /frontend by @dependabot[bot] in #3792
• Bump node from 26.3.1-alpine to 26.4.0-alpine in /backend by @dependabot[bot] in #3791
• Bump mongodb from 19.1.14 to 19.1.15 in /infrastructure/helm/bailo by @dependabot[bot] in #3793
• Bump actions/checkout from 6 to 7 by @dependabot[bot] in #3789
• Bump mongodb from 19.1.15 to 19.1.16 in /infrastructure/helm/bailo by @dependabot[bot] in #3797
• Bump fastapi from 0.138.0 to 0.138.2 in /lib/artefactscan_api by @dependabot[bot] in #3794
• Bump ipython from 9.14.1 to 9.15.0 in /backend/docs by @dependabot[bot] in #3796
• Bump aquasec/trivy from 0.71.2 to 0.72.0 in /lib/artefactscan_api by @dependabot[bot] in #3795
• Bump @types/node from 26.0.0 to 26.0.1 in /frontend by @dependabot[bot] in #3815
• Bump the rjsf-stack group in /frontend with 4 updates by @dependabot[bot] in #3812
• Bump @types/react from 19.2.16 to 19.2.17 in /lib/landing by @dependabot[bot] in #3808
• Bump the react-stack group across 1 directory with 2 updates by @dependabot[bot] in #3805
• Bump @types/react from 19.2.16 to 19.2.17 in /frontend by @dependabot[bot] in #3814
• Bump lint-staged from 17.0.7 to 17.0.8 by @dependabot[bot] in #3802
• Bump next from 16.2.7 to 16.2.9 in /lib/landing in the react-stack group by @dependabot[bot] in #3803
• Bump the eslint-stack group in /lib/landing with 2 updates by @dependabot[bot] in #3806
• Bump prettier from 3.8.4 to 3.9.4 in /frontend in the formatting-stack group by @dependabot[bot] in #3813
• Bump the eslint-stack group in /frontend with 5 updates by @dependabot[bot] in #3811
• Bump swiper from 12.2.0 to 14.0.1 in /lib/landing by @dependabot[bot] in #3807
• Bump the mui-stack group across 1 directory with 2 updates by @dependabot[bot] in #3804
• Bump the mui-stack group across 1 directory with 4 updates by @dependabot[bot] in #3810
• Bump @types/node from 26.0.0 to 26.1.0 in /lib/landing by @dependabot[bot] in #3809
• Bump prettier from 3.8.3 to 3.9.4 in the formatting-stack group across 1 directory by @dependabot[bot] in #3801
• Bump mongodb from 19.1.16 to 19.1.17 in /infrastructure/helm/bailo by @dependabot[bot] in #3831
• Bump tqdm from 4.68.3 to 4.68.4 in /lib/python by @dependabot[bot] in #3830
• Bump filelock from 3.29.4 to 3.29.6 in /lib/artefactscan_api by @dependabot[bot] in #3827
• Bump marlonb/mailcrab from v1.7.0 to v1.8.0 by @dependabot[bot] in #3829
• Bump uvicorn from 0.49.0 to 0.50.2 in /lib/artefactscan_api by @dependabot[bot] in #3826
• Bump fastapi from 0.138.2 to 0.139.0 in /lib/artefactscan_api by @dependabot[bot] in #3828
• Bump morgan from 1.10.1 to 1.11.0 in /backend by @dependabot[bot] in #3836
• Bump node from 26.4.0-alpine to 26.5.0-alpine by @dependabot[bot] in #3844
• Bump node from 26.4.0-alpine to 26.5.0-alpine in /backend by @dependabot[bot] in #3846
• Bump filelock from 3.29.6 to 3.29.7 in /lib/artefactscan_api by @dependabot[bot] in #3845
• Bump uvicorn from 0.50.2 to 0.51.0 in /lib/artefactscan_api by @dependabot[bot] in #3847
• Bump node from 26.4.0-alpine to 26.5.0-alpine in /frontend by @dependabot[bot] in #3848
• backend prettier version update by @JRB66955 in #3849

New Contributors

• @jason-d337 made their first contribution in #3717
• @M422110 made their first contribution in #3750

Full Changelog: 2.18.1...2.19.0