v26.8.0-rc.0

What's Changed (v26.7.3 -> v26.8.0-rc.0)

✨ Features

RBAC Permission Management

Expanded the RBAC surface with per-scope permission tables, a dedicated edit modal replacing the old creation flow, and multi-scope bulk editing that preserves unchanged values. Project admin assignment is now a one-click action, and role lists gained filters for assigned users and mapped scopes.

• FR-3271: add detailed permissions tab with per-scope-type tables and grant-state tags by @ironAiken2 in #8191, FR-3272: add scope-level permission edit modal replacing CreatePermissionModal by @ironAiken2 in #8192, FR-3273: add multi-scope bulk permission edit with keep-as-is semantics by @ironAiken2 in #8194
• FR-3317: add one-click project admin assignment action on project page by @ironAiken2 in #8264, FR-3320: add RBAC role detail shortcut on project admin setting modal and block direct assignment for system roles by @ironAiken2 in #8268
• FR-3355: show 'No changes made' message on no-op RBAC permission save by @ironAiken2 in #8360, FR-3357: surface failed users via bulk-error modal in RBAC user assignment by @ironAiken2 in #8363, FR-3377: add assignedUser and mappedScope filters to RBAC role list property filter by @ironAiken2 in #8393

URL-Aware Routing and Scoped Access Control

The current project and scope are now encoded in the URL, and route handles declare their own access requirements so permissions resolve from the URL itself. Query-param state moved from use-query-params to nuqs, with per-tab table state persisted in the URL for multi-tab pages.

• FR-3055: encode current project and scope into the URL routing scheme by @yomybaby in #7751, FR-3383: route-handle-declared access control with URL-aware roles by @yomybaby in #8408
• FR-1943: migrate from use-query-params to nuqs by @yomybaby in #5097, FR-3267: per-tab URL-persisted table state pattern for multi-tab pages by @nowgnuesLee in #8251

Configurable Auto-Refresh

BAIFetchKeyButton gained an opt-in interval dropdown with an animated countdown border, rolled out across polling consumers with per-consumer defaults chosen by how volatile each data source is.

• FR-3147: add opt-in auto-refresh interval dropdown to BAIFetchKeyButton by @agatha197 in #7927, FR-3147: enable auto-refresh interval dropdown on polling consumers by @agatha197 in #7928
• FR-3300: add animated countdown border to BAIFetchKeyButton auto-refresh by @agatha197 in #8233, FR-3300: set per-consumer auto-refresh defaults by data volatility by @yomybaby in #8265, FR-3324: unify container log auto-refresh on AutoUpdateFetchKeyButton by @yomybaby in #8287

Terminology Governance

A terminology gate now runs as part of verify.sh and CI, covering approved verbs, near-duplicate detection, non-English locales, and user-manual prose. Terminology drift that previously produced warnings now fails the build.

• FR-3052: terminology governance — approved verbs, unknown-term checker, precedence & rename rules by @yomybaby in #7748, FR-3050: redesign CHECK 2 into a high-signal near-duplicate check by @yomybaby in #8245, FR-3302: register CHECK 3 candidate terms + tune ignoreNouns by @yomybaby in #8244
• FR-3051: non-English terminology avoid rows + precision self-test harness by @yomybaby in #8349, FR-3049: i18n terminology drift fails verify.sh by @yomybaby in #8358, FR-3373: extend the terminology gate to user-manual prose by @yomybaby in #8386
• FR-3374: block context-free terminology drift in every language by @yomybaby in #8391, FR-3375: gate i18n terminology drift in CI on a path filter by @yomybaby in #8398

Administration

System announcements can now be authored and managed directly from the WebUI, SFTP settings moved onto the Resource Group page, and credential management gained bulk deactivation plus a shared modal for reporting partial bulk failures.

• FR-3223: allow editing the system announcement from the WebUI by @agatha197 in #8067, FR-3224: add system announcement management to the Maintenance page by @agatha197 in #8070
• FR-3243: add SFTP resource group settings from the Resource Group page by @agatha197 in #8119, FR-3222: migrate User Resource Policy page to Strawberry V2 GraphQL by @nowgnuesLee in #8062
• FR-2403: add bulk deactivate action for credential user list by @yomybaby in #6244, FR-3348: pick user via v2 select and validate rate-limit max in credential modal by @yomybaby in #8342, FR-3334: add common bulk-error modal and preserve form state on partial bulk failure by @ironAiken2 in #8302

Sessions and UI Components

The session list surfaces idle-checker reclamation status and v2 image metadata, the theme selector was reworked around product-owned built-in families, and a tabbed Downloads modal covers CLI download and pip onboarding.

• FR-3318: add idle-checker reclamation status column to session list by @nowgnuesLee in #8260, FR-2948: render image metadata in BAISessionNodesV2 and add v2 session tag components by @ironAiken2 in #7552
• FR-3239: refine user theme selector — product-owned built-in families and design-spec simplifications by @ironAiken2 in #8104, FR-3226: add tabbed Downloads modal with CLI download & pip get-started by @agatha197 in #8081, FR-3053: add text/hover overflow variant to BAITagList and adopt for table cells by @yomybaby in #7747

Developer Experience

Dev-environment work focused on file-descriptor pressure from TypeScript watchers, plus opt-in dev-only aids: login pre-fill with a backend-mismatch banner, a review overlay, and registry-aware post-boot auto-registration.

• FR-3214: exclude pnpm store from the dev type-check watcher by @nowgnuesLee in #8357, FR-3214: coalesce TS dev watchers onto parent directories by @yomybaby in #8394, FR-3214: make the resident dev type checker opt-in by @yomybaby in #8395
• FR-3352: dev-only login pre-fill and backend-mismatch banner by @yomybaby in #8352, FR-3307: post-boot auto-register hooks + registry-aware connection info by @yomybaby in #8247, FR-3309: review overlay walking skeleton — pin-to-Teams round trip by @yomybaby in #8248
• feat(docs-toolkit): configurable PDF fonts via pdfFontFaces and theme overrides by @rapsealk in #8279

🐛 Bug Fixes

Routing and Navigation

Follow-up fixes for the scope-aware routing work: 404 handling and help-doc anchors became scope-aware, URL project validation was unified on the header project selector, and a nuqs render-phase update loss was patched.

• FR-3057: scope-aware 404, help-doc anchors, and invalid-project fallback by @yomybaby in #7755, FR-3388: unify URL project validation on the header project selector source by @yomybaby in #8423
• FR-3358: patch nuqs to recover render-phase updates lost in discarded renders by @yomybaby in #8365, FR-3386: keep dashboard visible during interval refetch and isolate card suspensions by @ironAiken2 in #8421

Model Service and Chat

Chat endpoints stay visible while a new revision rolls out, the recovery form renders immediately instead of blocking on the model fetch, and the token selector was reworked.

• FR-3303: keep chat endpoint visible while a new revision rolls out by @agatha197 in #8236, FR-3341: rework Chat endpoint token selector by @agatha197 in #8328, FR-3340: render Chat recovery form immediately and show model fetch as button loading by @agatha197 in #8329
• FR-3323: unify model mount label in custom runtime revision form by @agatha197 in #8278, FR-3347: give deployment preset startup command its own description by @nowgnuesLee in #8335, FR-3384: add bottom padding to reasoning-only chat message bubbles by @yomybaby in #8412

Sessions, Connections, and Table Actions

App launch settings now propagate correctly to TensorBoard, TCP connection failures surface a real error instead of a misleading 127.0.0.1 dialog, and several list/modal state bugs were corrected.

• FR-3343: pass open-to-public and preferred-port settings through to TensorBoard and confirmation app launches by @nowgnuesLee in #8327, FR-3359: surface TCP connection info failures instead of bogus 127.0.0.1 SSH/SFTP dialog by @ironAiken2 in #8367
• FR-3328: refetch user list after bulk purge by @yomybaby in #8290, FR-3326: reset Prometheus query preset modal on reopen by @agatha197 in #8285, FR-3354: pause and re-anchor BAIFetchKeyButton countdown border during in-flight refresh by @agatha197 in #8356
• FR-3333: replace RBAC shortcut icon and add revoke warning alert in ProjectAdminSettingModal by @ironAiken2 in #8301, FR-3331: align row-action tooltips with the Edit icon by @ironAiken2 in #8315, fix: use token-based color for provisioning/warming-up replica tags by @yomybaby in #7879

Internationalization

The login screen now respects the browser locale because language detection runs at i18n init, and the group → project rename was propagated to remaining locale strings.

• FR-2981: detect browser language at i18n init so login screen respects locale by @yomybaby in #7606, FR-3356: retranslate error.UserHasNoGroup group→project in 20 locales by @yomybaby in #8402, FR-3376: clear the CHECK 2 near-duplicate backlog and promote it to default-on by @yomybaby in #8403

Build, Tooling, and Security

Hardened asset writing against path traversal, repaired the docs-toolkit publish and PDF rendering paths, and addressed dev-server file-descriptor exhaustion caused by orphaned watch processes.

• fix: guard writeHashedAsset against path traversal via logicalName by @yomybaby in #8293, FR-3214: kill the whole dev process group on shutdown so leaked watch orphans don't exhaust file descriptors by @nowgnuesLee in #8156, FR-3319: add opt-in polling watcher to survive macOS fseventsd stream drops by @yomybaby in #8262
• FR-3321: make docs-toolkit npm publish workable from CI by @yomybaby in #8273, FR-3321: publish docs-toolkit with pnpm, matching backend.ai-ui by @yomybaby in #8305, FR-3322: resolve release tag from env so PDF upload survives the Playwright container by @yomybaby in #8275, fix(docs-toolkit): repair PDF stamp glyphs, one-page cover, and reader outline by @rapsealk in #8271
• FR-3338: resolve eslint-plugin-react-hooks 7.1.1 compiler diagnostics by @nowgnuesLee in #8316, FR-3360: bump sharp to ^0.35.1 to restore docs-toolkit type resolution by @yomybaby in #8370, fix: raise Node heap limit for the React production build by @rapsealk in #7955

🔨 Refactoring

Ownership of 404 handling moved into the router, resource slot metadata was centralized into a single provider, and PDF stamp fonts are now subset through upstream fontkit.

• FR-3279: make the router own 404 via scoped catch-alls and a route error boundary by @yomybaby in #8208, FR-2493: centralize resource slot metadata into BAIMetaDataProvider by @nowgnuesLee in #6668, FR-3329: subset PDF stamp fonts via upstream fontkit by @yomybaby in #8292

🎨 Style

Edit terminology and icons were unified across edit flows, bulk action buttons in table selection toolbars now share a single style, and a few chart/column details were adjusted.

• FR-3331: unify edit terminology and edit-action icons, switch edit-form submits to Save by @ironAiken2 in #8303, FR-3379: unify bulk action button styles in table selection toolbars by @ironAiken2 in #8397
• FR-3325: use token.colorError for used stroke in session statistics chart by @nowgnuesLee in #8281, FR-3339: hide the Invalidated At column on the login sessions page by @nowgnuesLee in #8319

🧪 E2E Tests

Targeted regression coverage for the folder explorer URL desync and the scope-aware routing redesign, plus repaired vfolder delete locators and self-provisioning fixtures for deployment revision specs.

• FR-3358: deterministic e2e regression for folder explorer URL desync by @agatha197 in #8366, FR-3358: trim redundant waits from e2e vfolder cleanup path by @yomybaby in #8371, FR-3358: extend skipTrashVerify to remaining e2e vfolder cleanup call sites by @agatha197 in #8372
• FR-3383: heal e2e specs broken by the scope-aware routing and route-error redesign by @yomybaby in #8409, FR-3361: repair vfolder E2E delete locators and replace dead waits with refetch polling by @ironAiken2 in #8376, FR-3294: make deployment revision e2e specs self-provision their fixtures by @lizable in #8226
• Scheduled e2e auto-heal runs by @nowgnuesLee and @lablup-octodog in #8216, #8237, #8252, #8288, #8309, #8317, #8320, #8332, #8337, #8347, #8390, #8410

📝 Documentation

• FR-3312: document BAIUncontrolledInput purpose in Storybook by @ironAiken2 in #8242, docs(agents): require gt submit and a stack check when opening PRs by @yomybaby in #8396

🛠 Chores

CI gained full-package type checking and path-based reviewer routing, agent commands migrated to skills, and nuqs was upgraded to 2.9.2 so the local lost-update patch could be dropped.

• FR-3214: type-check every package in CI by @nowgnuesLee in #8407, FR-2933: disable vitest cache in CI by @nowgnuesLee in #7512, chore: introduce CODEOWNERS for path-based reviewer routing by @rapsealk in #7214
• FR-3292: migrate .claude commands to skills with disable-model-invocation by @yomybaby in #8218, FR-3335: make dev review overlay opt-in via VITE_DEV_REVIEW_OVERLAY by @yomybaby in #8308, FR-3321: allow manual dispatch of the docs-toolkit publish workflow by @yomybaby in #8306
• FR-3371: upgrade nuqs to 2.9.2 and drop the local lost-update patch by @nowgnuesLee in #8383, FR-3330: bump to 26.8.0-alpha.0 and update dependencies by @yomybaby in #8295, chore(docs): bump 26.7 pdfTag to v26.7.1 by @github-actions[bot] in #8163
• Dependency bumps by @dependabot[bot]: ws 8.19.0 → 8.21.0 in #8304, sharp 0.34.5 → 0.35.0 in #8339, dompurify 3.4.11 → 3.4.12 in #8338, actions/checkout 4 → 7 in #8124, actions/setup-node 4.4.0 → 6.4.0 in #8125, actions/download-artifact 5 → 8 in #8123

🙌 New Contributors

• @lablup-octodog made their first contribution in #8337

Full Changelog: v26.7.3...v26.8.0-rc.0