v8.2.0 — Opt-in per-deployment session timeout, plus advanced tag filtering & UI polish

Highlights

Configurable session timeout (opt-in)

Set the HttpSession inactivity timeout per deployment with the new
LIMELIGHT_SESSION_TIMEOUT_MINUTES environment variable — a positive integer number of
minutes, applied to each new session without rebuilding the WAR (Tomcat has no native
env-var/system-property for this; it otherwise only reads <session-timeout> from web.xml).
Strictly opt-in: if the variable is unset, blank, or non-positive, the container's default
timeout is used unchanged. Plumbed through docker-compose.yml and documented in
docker/env-sample.

Advanced (grouped) tag filtering on the Project page

Build boolean tag-filter expressions with independent per-group and between-groups
AND/OR operators, an inline "Add a group" control, and clearer empty/zero-count handling.

Search & folder counts

Per-tag search counts now show in tag tooltips throughout; per-folder search counts on the
project-page folder list; and the filtering box shows the passed-search count.

Protein structure widget

Right-pane UI polish and layout consistency; shows "Loading…" until chains are parsed
(fixes a brief no-chains flash).

Other changes

• Bugfix: when creating an experiment, fixed compute default matched-protein annotation
  display. Matched-protein annotations are uncommon, so this affected few searches.
• Ops: added an ERROR-only rolling log file (log4j2);
  dependency updates (npm security/version + Gradle).

v8.1.0 — Protein structure viewer: correct residue mapping & ChimeraX export - Add Project Page Tag Filtering Advanced

Highlights — Protein structure viewer

Two related fixes correct structure annotations that could be placed on the wrong residues.

Which files were affected? Standard PDB files — the most common structure format, and the
only type used on the public server — already produced correct output in v8.0.1. These fixes
address structures in mmCIF format (and any structure whose observed residue numbering is
gapped or offset rather than a simple 1..N run), where a PDB file's linear numbering had masked
the problem.

• Residue mapping fixed (viewer). For mmCIF / non-linearly-numbered structures, trypsin
  cut-point disks, modification spheres, and residue coloring could land on the wrong residues —
  and log spurious "CA not found" warnings. The cause was using an alignment ordinal as a structure
  residue number; placement is now anchored to the actual residue.

• ChimeraX export fixed. The "download ChimeraX script" output could mis-place coloring,
  modification symbols, and cut-point disks — and silently drop some — for any structure whose
  author numbering (auth_seq_id) differs from the internal sequence numbering (label_seq_id).
  The export now resolves and addresses the correct residues.

Other structure-file improvements

• Clearer upload rejection when a structure file parses but has no alignable (polymer) chains,
  instead of a misleading "failed to parse" or a silent no-op.
• Graceful display failures: a saved structure that can no longer be rendered shows a clear
  "could not be displayed" message (with the page address to report) rather than the generic error page.
• Recovery when an alignment no longer applies: the viewer explains the situation and offers a
  delete-alignment action to project editors, instead of silently mis-placing markers.
• Cleaner auth handling on data load: losing access to a project while viewing it (e.g. it is made
  non-public) now reloads to the standard login/no-access flow instead of an outdated alert.
• Chain display shows auth_asym_id alongside the label when they differ; fixes a crash rendering
  chain-select for a newly-uploaded file.

Also in this release

• Security hardening: Content-Security-Policy tightening (frame-ancestors, base-uri,
  narrowed gstatic), a URL sanitizer gating javascript:/open-redirect sinks with server-side
  web-link validation, and rel="noopener noreferrer" on target="_blank" links.
• Structure-file uploads: chunked upload v2 (boundary/in-order/size fixes), a submit-import
  version handshake, and Base64-encoded JSON in upload headers (backward compatible).
• Project page: advanced (grouped AND/OR) tag filter.
• Dependencies & build: grouped Gradle/npm/GitHub-Actions updates and the JAXB Java-8/Java-25
  split handling.

v8.0.1 - Protein Structure Viewer - Fix Export to Chimerax

Bug fix for the Single Protein Protein Structure Viewer ChimeraX export .

ChimeraX color commands were generated using mmCIF label residue numbering, but ChimeraX resolves residue specifiers in auth
numbering. On structures where the two differ (offset residue numbers, mismatched chain IDs, or insertion codes), residues were
silently colored on the wrong positions. Color commands now emit auth chain/residue/insertion-code identity. Symbol and disk output
was coordinate-based and unaffected.

v8.0.0 — Protein Structure Viewer & Coverage Bar, Spring Boot 4 / Java 25 Platform Upgrade / Database upgrade required

▎ ⚠️ Database upgrade required. This release includes schema changes.
▎ Back up database before updating it.
▎ Run database_scripts/version_upgrades/8/version_upgrade.sql against your Limelight database before deploying.
▎ (New structure‑file tables, file‑object‑storage table changes, and removal of an unused lookup table.)

🧬 Highlights

Protein Structure Viewer (Single Protein page)

A new interactive 3D structure viewer on the Single Protein page. Structure files (PDB‑like) are stored in the database with
their chain entries and sequence alignments, backed by new file‑object‑storage support, so a protein's experimental coverage
can be explored directly against its structure.

Protein Coverage Bar (Single Protein page)

A new protein‑coverage bar visualization showing peptide/PSM coverage across the protein sequence, including:

• Coloring and opacity scaled by PSM count
• Tooltips showing adjacent residues with the protein position highlighted
• Consistent hover and click‑to‑select positioning
• "No adjacent peptides" display option
• Variable‑mod rounding consistent with the rest of Limelight

🚀 Platform & Build Modernization

• Upgraded to Spring Boot 4, Jakarta Servlet 6.1, and Java 25
• Migrated javax → Jakarta (JAXB 3/4) across the importer and submit tools
• Moved to MySQL Connector/J 8 (com.mysql.cj.jdbc.Driver)
• Front‑end build switched from webpack to esbuild, with tsc TypeScript validation
• Web app now serves pre‑compressed .js.gz static bundles
• Docker images updated to Temurin 25 JRE

🔒 Security & Dependencies

• Numerous dependency upgrades and npm audit fixes clearing Dependabot security alerts

🛠️ UI & Analysis Improvements

• Mod page: added "[Download PSMs]"; fixed unlocalized‑residue display when max localized
• Data tables: search‑id tooltips and hover outlining on cells
• PSM list: graceful handling when no MS1 scan is found
• Lorikeet: peaks now sorted ascending by m/z

📦 Importer & Submit

• Submit Import: added test‑only (no‑submit) mode, HTTP connect/read timeouts, de‑duplicated upload code, and file‑hash
  compute fixes
• Improved Spectr upload handling and Database Cleanup routines

Limelight v7.1.11

A maintenance release with internal hardening and consistency improvements in the web application's data layer.

Notes

• No database schema changes — a drop-in replacement for the prior v7 WAR.
• No feature or behavior changes for users acting within their existing project permissions.
• Built and verified on the v7 line.

See the commit history for specifics.

Fix limelightSubmitImport.jar

Fix limelightSubmitImport.jar

Release to add limelightSubmitImport.jar to release assets Release contents same as previous v7.1.8 release This release is a branch off the last commit before start version 8 for database change.

Release to add limelightSubmitImport.jar to release assets

Release contents same as previous v7.1.8 release

This release is a branch off the last commit before start version 8 for database change.

Version 7.1.8 Last 7.X release of Limelight

Last release of Limelight before change database for version 8.

Release in part to update release with latest base image for Docker for security update.

Version 7.1.6

The following has been fixed:

Fix bug in v7.1.5
Mod page: User selection "Exclude unlocalized mods:" was not used.

Version 7.1.5

Fix Javascript validation that it can change browser url