Release 2.9.5

CEDAR 2.9.5 Release

We’re pleased to announce CEDAR 2.9.5.

This release focuses on data integrity, recovery, and reproducible delivery, and moves the Java backend to Dropwizard 5. It prevents concurrent editors from silently overwriting one another, keeps CEDAR’s services and asynchronous work safer through dependency outages, hardens DOI and API-key workflows, and introduces a verified build-train path from source commits to release artifacts.

The CEDAR user interfaces now embed the CEDAR Embeddable Editor 2.0.4, built with the CEDAR Model TypeScript Library 1.0.5.

What’s New

Backend Platform Upgrade to Dropwizard 5

CEDAR’s Java services now run on Dropwizard 5.0.2, up from 4.0.17, which brings Jetty 12 to every backend server. The shared server bootstrap was adapted to the new platform, impex and submission uploads moved to Jakarta Servlet 6, and messaging identity upserts were made safe under Hibernate 6.6.

Safe Concurrent Artifact Editing

Artifact updates now use optimistic concurrency control throughout the stack.

Every successful artifact create, single-artifact read, and update returns a strong revision ETag. Updating an existing template, element, field, or instance requires that value in If-Match. A request without it returns 428 Precondition Required; a request carrying a stale value returns 412 Precondition Failed.

The replacement is conditional in MongoDB itself, so two requests that race cannot both overwrite the same revision. The internal revision remains storage metadata and is never exposed in artifact JSON.

The Workbench, Workspace, and internal resource operations preserve and forward the revision they actually read, protecting edits across both the legacy and embeddable-editor paths.

Resilience and Data Integrity

CEDAR now fails more consistently and recovers more safely when a dependency is unavailable:

• Transport and datastore outages across inter-service HTTP, Neo4j, MongoDB, OpenSearch, SQL, Redis, and external authorities return a sanitized 503 Service Unavailable instead of leaking implementation details or producing ambiguous failures.
• Health checks now cover the dependencies that make each service useful, including artifact MongoDB readiness and worker queue consumers.
• Resource create, update, publish, draft, copy, move, and delete workflows have stronger compensation and retry behavior, reducing partial state when graph, artifact, search, or terminology operations fail.
• Permission changes are persisted to a durable Neo4j outbox before Redis delivery. A managed relay resumes delivery after Redis or producer restarts, while idempotent search projection makes repeated delivery safe.
• Queue consumers use claim/acknowledge recovery, bounded batches, retries, and dead-letter queues. Worker health reports stopped consumers, failed processing, dependency failures, and outstanding dead-letter work.
• Permission projection updates and value-set snapshot publication are atomic, and unknown Cypher sort fields are rejected rather than interpolated into graph queries.

Hardened DataCite DOI Publication

DOI creation now enforces the source artifact’s authorization and lifecycle requirements on the mutation itself. The caller must have write access and the source must be open and published.

The workflow also:

• Refuses invalid CEDAR instance metadata before contacting DataCite.
• Accepts only explicit draft and publish states.
• Uses configured connection and request deadlines.
• Distinguishes upstream DataCite failures from local annotation failures.
• Returns the minted DOI with reconciliation details when DataCite succeeds but attaching the DOI to the CEDAR artifact does not, so operators can recover without losing the external identifier.

Frontend and CEE Updates

CEE 2.0.4 carries the model library from the public npm registry and adds field-level detail to required-value validation. Each unsatisfied required declaration now contributes a problem with its path, field identity, and input type, while the existing report shape and counters remain compatible.

Production frontend bundles are now content-hashed and tied to their source revisions. Release checks reject development hosts in production assets and verify that generated frontend output is the exact output selected for publication, reducing stale-browser-cache and source/artifact drift.

Reproducible Builds and Releases

CEDAR can now publish immutable Maven, npm, frontend, and Docker build trains from exact source commits. Train manifests record the selected revisions, artifact inventories, package provenance, and image digests; Docker startup verifies those digests before running a selected train.

The new train-backed release workflow:

• Verifies source, Maven, npm, frontend, Docker, and CEE provenance before mutation.
• Builds and tests release and next-development variants in isolated workspaces.
• Pins the public CEE release across all frontend consumers.
• Writes release integration commits from the prepared trees and refuses remote drift.
• Verifies immutable Nexus and npm artifacts after publication.
• Can resume safely from its recorded manifest after interruption.

Builds now run Java tests by default, backend-free test execution is faster, committed OpenAPI contracts are verified, and the retired REST library has been removed from build and release trains.

Docker images also receive a security and operability pass: Java services and frontend nginx containers run unprivileged, frontend package contents are pinned, runtime images are separated from build tooling, base images are refreshed, and Keycloak realm seed material no longer contains signing keys.

Important Notes for Integrators

• Existing-artifact PUT requests must now send the ETag returned by the corresponding read in If-Match. CORS permits If-Match and exposes ETag to browser clients.
• API-key regeneration and deletion routes now take the non-secret key id, not the credential value.
• Dependency connection failures are generally reported as sanitized 503 Service Unavailable responses.
• Applications embedding CEE should update to 2.0.4. The model library is compiled into CEE’s browser bundle and is not an additional runtime dependency for host applications.
• Operators should monitor queue dead-letter depths. Permission events survive temporary Redis outages automatically, but dead-lettered work still requires inspection and replay after its cause is fixed.

For the complete technical change history, see the comparison between CEDAR 2.9.3 and 2.9.5.