v2.20.0

Release Summary

• Added revision comparison for model cards and data cards, including local and mirrored card diffs, selectable history snapshots, and adjacent field-level differences (#3817)
• Expanded metrics with clickable overview cards/charts, month-based uploads drill-downs, richer entry filtering, CSV export, and unapproved release compliance reporting (#3859, #3872, #3904)
• Delivered broad user-visible UI improvements: dark mode (beta), responsive navigation, mobile marketplace filters, improved wrapping/layout, and clearer entry/template messaging (#3860, #3862, #3916)
• Improved mirrored model and mirrored data card handling, including editable source model IDs before import and validation against combined local/source card state (#3861, #3884, #3906)
• Extended Python client API coverage for multipart uploads, file metadata updates, webhooks, roles, file scanning info, tags, and entry settings (#3881)

Breaking Changes

• Audit connector delete callbacks now receive full document objects rather than raw IDs for several entities; custom audit connector implementations may need updates (#3877)

New Features

• Added compare pages and history workflow for model/data card revisions, supporting comparison across local and mirrored revisions with schema compatibility checks (#3817)
• Added reusable inline diff rendering across rich text, tags, dropdowns, metrics, and data-card selectors, improving visibility of changes between revisions and mirrored content (#3817)
• Added unapproved release compliance metrics, including organisation-level aggregation and release review approval status tracking (#3904)
• Added richer entry metrics filtering by organisation, state, schema, release presence, access request presence, and upload month range, with CSV export support (#3859, #3872)
• Added clickable metrics overview panels, pie charts, and bar charts that deep-link into filtered entry breakdowns (#3859)
• Added provisional mirrored data card types and improved mirrored model source ID management before import (#3861, #3884)
• Added dark mode and responsive UI/navigation improvements, including top-nav search/create actions and mobile-friendly side navigation (#3860, #3862)
• Added collapsible marketplace filters on smaller screens and improved marketplace row wrapping/readability (#3916)
• Added entry descriptions and improved template/help text for entry creation flows (#3886)
• Added Python client support for multipart file uploads, file metadata patching, webhook CRUD, model tags, file scanning info, model settings, and broader entry kind handling (#3881)

Bug Fixes

• Fixed model/entry count mismatches in metrics and marketplace-related filtering behaviour (#3880, #3916)
• Fixed validation of mirrored model state by validating against the combined local/source card with local values preferred (#3906)
• Fixed access to template/schema setup for users without edit permissions (#3905)
• Fixed import/export handling for empty model card revisions (#3894)
• Fixed broken paths and manifest list type-guard behaviour affecting image/container workflows (#3910, #3918)
• Fixed release/document export authorisation gaps and improved audit logging fidelity for delete/view events (#3857, #3877)
• Fixed empty field handling in forms (#3858)

API Changes

• Added release compliance metrics API capability for entries with unapproved releases, including global and organisation-scoped results (#3904)
• Expanded entry/model breakdown filtering to include entry kinds, release presence, access request presence, and start/end upload months, with validation for invalid month ranges (#3859, #3904)

Security Changes

• Restricted template/schema setup UI to users with edit permissions, preventing non-owners from accessing edit-oriented setup flows (#3905)
• Added/fixed authorisation checks around document export functionality (#3857)
• Improved audit logging for delete operations by logging IDs from full persisted objects, reducing ambiguity in audit records (#3877)
• Hardened CI push-target determination by moving release/image decision logic into environment-driven workflow steps to reduce shell-injection risk (#3908)

Dependency Changes

• Upgraded major frontend framework stacks, including Next.js, React-related packages, and MUI-related packages, with potential behavioural and compatibility impact (#3888, #3935, #3936)
• Upgraded backend Mongoose to a new major version, requiring compatibility verification around MongoDB models/queries (#3970)
• Upgraded FastAPI in the artefact scanning service, which may affect API/runtime behaviour and compatibility (#3898)
• Upgraded GitHub Actions runtime actions such as setup-node/setup-python and CodeQL/action versions, affecting CI execution environment (#3937, #3938, #3939)

What's Changed

🏕 Features

• Add new python quick start notebook by @PE39806 in #3854
• Add _checkAuths() functionality to DocumentExporter by @JRB66955 in #3857
• Removed empty objects/fields from from by @ARADDCC002 in #3858
• Feature/bai 2524 make summary cards clickable by @ON93754 in #3859
• Migrate from next/legacy/image to next/image by @PE39806 in #3863
• Edit mirrored model source id before import by @PE39806 in #3861
• Speed up ESLint by @PE39806 in #3868
• Add diff to history by @GB907762 in #3817
• Fix eslint build path by @PE39806 in #3870
• Improve logs by @JR40159 in #3878
• Add AGENTS.md by @PE39806 in #3883
• Bugfix/bai fix number of entries mismatch by @ON93754 in #3880
• Add model diff user docs by @GB907762 in #3876
• Implemented CSV download by @ON93754 in #3872
• added the new property of mirrored data card to the entrykind type by @ARADDCC002 in #3884
• Add missing frontend entry descriptions by @PE39806 in #3886
• Update audit delete functions to pass full doc rather than just id by @PE39806 in #3877
• Add stroom script by @JR40159 in #3885
• Various resolution scaling improvements by @ARADDCC002 in #3860
• Rework backend scripts approach by @PE39806 in #3887
• Extend Python package API endpoint coverage by @PE39806 in #3881
• Import & export empty model card revision by @PE39806 in #3894
• Add docs for importModel webhook by @GB907762 in #3903
• Hidden the template page from non model owners by @ARADDCC002 in #3905
• docs(root): add further installation instructions by @evenstensberg in #3892
• Fix pushed image manifest mangling by @PE39806 in #3908
• Dark mode by @ARADDCC002 in #3862
• move tsx into regular dependency, not devDependency by @JRB66955 in #3911
• Correct manifest list typeguard by @PE39806 in #3910
• Add docker streaming to docs by @PE39806 in #3909
• Validate mirrored model state from combined cards by @PE39806 in #3906
• Fix various paths by @GB907762 in #3918
• Fix filter collapse by @GB907762 in #3916
• Feature/bai 2563 new endpoint entries unapproved releases by @ON93754 in #3904

👒 Dependencies

• Bump fastapi from 0.139.0 to 0.139.2 in /lib/artefactscan_api by @dependabot[bot] in #3866
• Bump tqdm from 4.68.4 to 4.69.0 in /lib/python by @dependabot[bot] in #3865
• Bump filelock from 3.29.7 to 3.31.2 in /lib/artefactscan_api by @dependabot[bot] in #3867
• Bump body-parser from 2.2.2 to 2.3.0 in /backend by @dependabot[bot] in #3869
• Bump svgo from 4.0.1 to 4.0.2 in /backend by @dependabot[bot] in #3875
• Bump fast-uri from 3.1.3 to 3.1.4 in /frontend by @dependabot[bot] in #3873
• Bump @opentelemetry/propagator-jaeger and @opentelemetry/auto-instrumentations-node in /backend by @dependabot[bot] in #3874
• Bump @opentelemetry/core, @opentelemetry/resources, @opentelemetry/exporter-logs-otlp-proto, @opentelemetry/exporter-metrics-otlp-proto, @opentelemetry/sdk-metrics and pino-opentelemetry-transport in /backend by @dependabot[bot] in #3879
• Move sharp install to package.json by @PE39806 in #3871
• Bump postcss from 8.5.14 to 8.5.23 in /backend by @dependabot[bot] in #3890
• Bump next from 16.2.9 to 16.2.11 in /lib/landing by @dependabot[bot] in #3889
• Bump next from 16.2.9 to 16.2.11 in /frontend by @dependabot[bot] in #3888
• Bump mongodb from 19.1.17 to 19.1.21 in /infrastructure/helm/bailo by @dependabot[bot] in #3901
• Bump mongodb/mongodb-community-server from 8.3.4-ubi9 to 8.3.7-ubi9 by @dependabot[bot] in #3900
• Bump filelock from 3.31.2 to 3.32.0 in /lib/artefactscan_api by @dependabot[bot] in #3899
• Bump pre-commit from 4.6.0 to 4.6.1 in /lib/python by @dependabot[bot] in #3897
• Bump pre-commit from 4.6.0 to 4.6.1 in /lib/artefactscan_api by @dependabot[bot] in #3896
• Bump tqdm from 4.69.0 to 4.70.0 in /lib/python by @dependabot[bot] in #3895
• Bump fastapi from 0.139.2 to 0.140.8 in /lib/artefactscan_api by @dependabot[bot] in #3898
• Bump pre-commit from 4.6.0 to 4.6.1 in /backend/docs by @dependabot[bot] in #3902
• Bump proxy-agent from 8.0.1 to 8.0.2 in /backend by @dependabot[bot] in #3968
• Bump nodemailer from 9.0.1 to 9.0.3 in /backend by @dependabot[bot] in #3966
• Bump nanoid from 5.1.11 to 6.0.0 in /backend by @dependabot[bot] in #3969
• Bump pretty-bytes from 7.1.0 to 7.1.1 in /frontend by @dependabot[bot] in #3947
• Bump dorny/paths-filter from 3 to 4 by @dependabot[bot] in #3934
• Bump swiper from 14.0.1 to 14.0.7 in /lib/landing by @dependabot[bot] in #3933
• Bump @types/node from 26.1.0 to 26.1.2 in /lib/landing by @dependabot[bot] in #3931
• Bump prettier from 3.9.4 to 3.9.6 in /frontend in the formatting-stack group by @dependabot[bot] in #3944
• Bump @vitejs/plugin-react from 6.0.3 to 6.0.4 in /frontend by @dependabot[bot] in #3946
• Bump sanitize-html from 2.17.4 to 2.17.5 in /backend by @dependabot[bot] in #3922
• Bump express-rate-limit from 8.5.2 to 8.6.1 in /backend by @dependabot[bot] in #3972
• Bump @types/supertest from 7.2.0 to 7.2.1 in /backend by @dependabot[bot] in #3964
• Bump @types/mjml-core from 5.0.0 to 5.1.0 in /backend by @dependabot[bot] in #3967
• Bump tsx from 4.22.4 to 4.23.1 in /backend by @dependabot[bot] in #3962
• Bump uuid from 14.0.0 to 14.0.1 in /backend by @dependabot[bot] in #3959
• Bump @agendajs/mongo-backend from 4.0.2 to 4.0.3 in /backend by @dependabot[bot] in #3957
• Bump p-queue from 9.3.0 to 9.3.3 in /backend by @dependabot[bot] in #3955
• Bump the eslint-stack group in /lib/landing with 2 updates by @dependabot[bot] in #3928
• Bump lint-staged from 17.0.8 to 17.2.0 by @dependabot[bot] in #3924
• Bump actions/setup-python from 6 to 7 by @dependabot[bot] in #3939
• Bump @fontsource/pacifico from 5.2.7 to 5.3.0 in /frontend by @dependabot[bot] in #3949
• Bump qs from 6.15.2 to 6.15.3 in /backend by @dependabot[bot] in #3963
• Bump @types/node from 26.0.0 to 26.1.2 in /backend by @dependabot[bot] in #3960
• Bump @types/node from 26.0.1 to 26.1.2 in /frontend by @dependabot[bot] in #3950
• Bump markdown-to-jsx from 9.8.2 to 9.10.1 in /frontend in the markdown-stack group across 1 directory by @dependabot[bot] in #3945
• Bump the testing-stack group across 1 directory with 2 updates by @dependabot[bot] in #3951
• Bump the opentelemetry-stack group in /backend with 2 updates by @dependabot[bot] in #3953
• Bump actions/setup-node from 6 to 7 by @dependabot[bot] in #3938
• Bump swagger-ui-dist from 5.32.8 to 5.32.11 in /lib/landing by @dependabot[bot] in #3932
• Bump react-diff-viewer-continued from 4.2.2 to 4.4.0 in /frontend by @dependabot[bot] in #3948
• Bump sanitize-html from 2.17.5 to 2.17.6 in /backend by @dependabot[bot] in #3961
• Bump the rjsf-stack group in /frontend with 4 updates by @dependabot[bot] in #3943
• Bump prettier from 3.9.4 to 3.9.6 in /backend in the formatting-stack group across 1 directory by @dependabot[bot] in #3954
• Bump the mui-stack group across 1 directory with 3 updates by @dependabot[bot] in #3927
• Bump @huggingface/hub from 2.13.0 to 2.14.4 in /backend by @dependabot[bot] in #3956
• Bump undici from 8.5.0 to 8.9.0 in /backend by @dependabot[bot] in #3965
• Bump actions/labeler from 6 to 7 by @dependabot[bot] in #3930
• Bump prettier from 3.9.4 to 3.9.6 in the formatting-stack group across 1 directory by @dependabot[bot] in #3923
• Bump github/codeql-action from 4 to 4.37.3 by @dependabot[bot] in #3937
• Bump mongoose from 9.7.2 to 9.9.0 in /backend by @dependabot[bot] in #3970
• Bump the testing-stack group across 1 directory with 3 updates by @dependabot[bot] in #3942
• Bump mjml from 5.3.0 to 5.4.0 in /backend by @dependabot[bot] in #3958
• Bump the react-stack group across 1 directory with 4 updates by @dependabot[bot] in #3926
• Bump the react-stack group across 1 directory with 14 updates by @dependabot[bot] in #3935
• Bump the eslint-stack group across 1 directory with 2 updates by @dependabot[bot] in #3925
• Bump the mui-stack group across 1 directory with 4 updates by @dependabot[bot] in #3936
• Bump the eslint-stack group across 1 directory with 6 updates by @dependabot[bot] in #3940
• Bump the aws-sdk-stack group across 1 directory with 6 updates by @dependabot[bot] in #3952

New Contributors

• @evenstensberg made their first contribution in #3892

Full Changelog: 2.19.0...2.20.0