Detail panels exist for Slurm > Nodes, Slurm > Partitions, Miscellaneous > External SFTP and Service VMs, where View used to open a page reading Not Implemented :( or was not offered. Past VMs and Worker VMs open the full VM panel. See Slurm Nodes, External SFTP Servers and Service VMs.
Every Management detail panel shows what its table shows (owners, IDs with a copy button, resources, quotas, usage, expiry, last login and state) and links to related items, such as a user's teams, a realm's hosts, or the hardware setups that mount an NFS drive. See Management Overview.
The VM image panel shows the operating system, the drive formats the image supports, its capabilities, its boot mode and its maximum number of instances. See VM Images.
Files inside a tiArchive (.tia) open in the file preview, as files inside ZIP archives already did. See View Files.
Add users on a VM marks users with no active membership in the VM's project with "No active membership in this VM's project", and warns how many members of selected teams or groups lack one. They can still be added, but cannot reach the VM until they join the project. See Add Users to a Virtual Machine.
Permission names in the permissions editor and in user profile details say in plain words what each permission allows, and for whose items: "Create file metadata" is now "Create files (needed to upload)", and the seven "Basic … Interaction" categories are now Teams, Key Escrow, Vault Files and Directories, Groups, Inboxes, Projects and Virtual Machines. Only the names on screen changed: saved profiles, user permissions, permission IDs and exported profile files are unaffected. The new Permissions page lists every permission with its earlier name.
Ten wrong passwords wipe the cached key file from the browser, on the login page and on the lock screen, and the user needs their key file to log in again. This limits password guessing on a shared or lost computer. The wipe was intended before, but never happened. See Private Keys.
Key files written from now on, at registration, password change and escrow recovery, use at least 300,000 PBKDF2 iterations instead of about 20,000, which slows each guess against a stolen key file. Existing key files keep working unchanged.
Before a key is escrowed, or an escrow officer shares a recovery fragment, each escrow key must be signed by this deployment's site key, which must be signed by the vendor key. If a check fails, nothing is sent and the reason is shown.
The inbox upload page checks the inbox owner's public key against the fingerprint in the upload link, and refuses to upload if they do not match, so files are only ever encrypted for the person who sent the link. See Inboxes.
Notifications are plain text: links, images and other HTML in a message are shown as typed.
A file with no viewer shows "This file type cannot be previewed." with a Download button for Vault files that respects download restrictions, instead of being handed to the browser. The External File Preview (open in new tab) system setting is removed.
PDF previews use pdf.js 6.0.227 (was 2.2.171), with the PDF's own scripts turned off. The old version was affected by CVE-2024-4367.
A Content-Security-Policy on the app's pages allows only the app's own scripts.
The XSS check covers every JSON response, including lists and nested values. Text that would create script-running markup is still replaced with XSS WARNING-content deleted, but this is logged instead of locking the app, and ordinary text with angle brackets or {{ }} is no longer removed.
In table CSV exports and VM log CSV and TSV exports, a value that starts with =, +, - or @ (other than a plain negative number) is saved with a ' in front, so a spreadsheet opens it as text.
The browser console no longer gives access to the signed-in session unless the deployment has debug mode on.
Markdown text, file SHA-256 checksums and the VM terminal use current, supported libraries, and unused third-party packages are removed. Checksums are the same as before.
A page that stays locked for as long as the Session Timeout ends its session, and unlocking signs in again with a new one. Before, a locked page kept its session alive until it was reloaded. See Edit the User Inactivity Period.
An open VNC console counts as activity only while you use it, so an idle console locks and logs out on the normal schedule.
While the session is locked, the task tray is hidden and the lock screen stays above every dialog.
Saving a VM configuration checks that every co-owner has a key to every drive. If not, tiCrypt lists who would get which drive and offers Share and save. See Create and Configure VMs.
A new drive is shared with co-owners when it is formatted, on launch, Mount all drives, Remount or attach.
A read-only key counts as missing when the configuration attaches the drive read-write.
Removing a co-owner offers to remove their keys to the configuration's drives that you own, checked by default.
In the drive Share dialog, removing someone's key or making it read-only asks first when that person co-owns a VM configuration that uses the drive, and the Unshare from everyone else confirmation names the users and VM configurations affected. See Share Drives.
Registering a licensing server takes a single required Server field instead of a list, and at least one port. Ports accepts lists and ranges such as 80, 8000-8010. See Create a New Licensing Server.
In System Settings > External Servers and XSS headers, device tags and libvirt host MAC addresses, a valid typed entry counts without clicking Add, and invalid text blocks Save and says why.
External Servers entries must be URLs, such as https://sftp.example.com. Entries already saved are kept.
The CUI Disclosure setting no longer offers "Display a banner on the bottom of the page", which never showed a banner. See Enable CUI Disclosure On-Screen.
Manage access for several hardware setups is renamed Replace allowlist, says that it replaces each setup's list, and asks before making the setups public. See Manage User Access in VM Hardware Setups.
A Restricted Slurm partition must name at least one team, project or VM configuration before it can be saved, and a partition that still lists hardware setups shows a warning with a button to remove them.
Max Instances on a VM image must be a whole number from 1 to 1,000,000, and an existing limit can be changed but not cleared. See Add VM Creation Limit in a VM Image.
Group folder uploads no longer ask for expiry and restrictions, which were ignored. A confirmation says the files are shared permanently with all members of the group. See Groups.
Moving an inbox folder to the trash or to another tree asks first, because it stops the folder's upload links working.
Power up and Boot from ISO open each service VM's VNC terminal once it has started. See Power Up a Service VM.
Uploaded files get a random initialization vector (IV) for every encrypted chunk. Before, each chunk's IV was derived from the previous one, so all of them could be predicted from the first. Files uploaded before this change still open.
Failed requests no longer write request bodies, passwords or session secrets to the browser console or to the downloadable logs.
With debug mode on, VM messages in the browser console hide secrets: passwords, API keys, drive and file keys, session tokens and terminal input. Before, only a few top-level key fields were hidden.
The password you typed is cleared when you leave the sign-in or escrow sign-in page, for example for Register or Site key. No copy is kept in memory after a failed sign-in, unlock or key password change.
Copied SFTP commands are safe to paste. The lftp and Mac/Linux SSHFS commands quote every value, and control characters are removed from all copied SFTP values, so a VM name or credentials cannot run commands in your terminal. See Remote File System.
User and group names in File History are shown as plain text. Before, they were rendered as HTML.
The confirmation dialogs for recovering a drive, user or file from a backup, and for removing users or profiles from a VM or users from a VM group, show names exactly as written. Before, they showed link, image or HTML syntax, web addresses and email addresses as links or images.
The VNC console shows VM names with characters such as & or # in full, and a VM name can no longer change the console's settings, such as which VM it connects to.
The changed-key warning names the user. When a user's pinned public key has changed, the warning shows their name and email instead of [unknown-user:[object Object]].
The login page shows the last failed and last successful login again.
Logging in to another account in the same tab after a failed login no longer keeps the first account's public key.
A warning or MFA prompt that opens while the session is locked no longer unlocks it.
Unlocking a session that needs MFA again finishes after MFA. Previously the MFA step stayed open until the page was reloaded.
Log out always closes the session in the browser, even when the server cannot be reached.
Self-registration saves the private key file as soon as the account is created, and a double click on Register no longer reloads the page.
Dialogs that cannot be dismissed, such as the terms of service, no longer drop your accept, confirm or save after you press Esc or click outside them.
The Login ID Regular Expression setting saves again. Previously the field then showed [object Object] and self-registration rejected every Login ID. Values saved that way by earlier versions are read correctly. See Set Pre-Defined Login IDs.
Editing a user's permissions, or applying a role, keeps permissions the web UI has no description for, such as AddUser, SendMessages and ReadVMConfig. They are listed under Discovered from Server.
A category checkbox changes only the permissions the editing admin holds.
A collapsed category shows as checked or partly checked when some of its permissions are checked. Before, Project Administration could look unchecked even though some of its permissions were checked.
Editing a user profile's rank or key escrow policy and applying it updates its users.
Onboarding several users at once with a profile that restricts a project keeps the restriction for every user.
Management > Users > Onboard waits until every list is loaded, so a template's VM configurations, teams, projects and certifications are no longer skipped. See Onboard Users with a Template.
Escrow sharing tasks finish only when every key is shared. On the escrow page, the tasks started by Share all key parts with user in my group and by a user's Share keys with other Escrow users show an error when sharing fails.
Adding co-owners to a VM shares each drive with its own key. Previously every drive was shared with the last drive's key, so co-owners could not mount the other drives.
Launching a VM configuration with co-owners and a new drive no longer warns that co-owners are missing drive keys.
Attaching drives to a running VM with "Add drive(s) to the VM configuration and share drive(s) with co-owners" checked now shares them with the co-owners.
The Repair card for co-owners' missing drive keys updates when drive keys are shared or removed.
Remove from VM on a co-owner also removes them from the VM configuration's owners, so the next start no longer gives them access again.
Saving a co-owner in Update permissions without changes no longer demotes them, and choosing a Co-owner profile makes the user a co-owner. See Edit Permissions in a Virtual Machine.
On constellation VMs, Update permissions shows Manage VPN and VM Orchestrator as checked when the user has them, no longer removes them on save, and lists SFTP Access once.
Sync user permissions removes a VM user only when the server reports the user as deleted. Previously active users from other teams could be removed.
Switching someone between Read-only and Full access to a drive no longer leaves them without a key when the change fails.
Opening the Terminal Hub closes the tabs of VMs that have shut down, instead of showing VM not found or no longer accessible. See Open a Virtual Machine's Terminal Hub.
Downloading a VM's logs always finishes. A page that keeps failing ends the download with the VM's error instead of freezing the tab.
The VM Logs panel no longer loads forever when the VM has no logs or its logs cannot be loaded. It shows the empty list, or an error such as Failed to load the logs.
The VM list keeps updating after a VM of a project that is not active in your session stops.
The Runtime column of VM tables shows how long the VM has been running instead of "3 hours ago".
Editing a VM image saves only what was changed and reports No changes made when nothing was, and Slurm > VM Accounts shows capability changes.
Dragging a folder onto itself or one of its subfolders in the VM file explorer is refused with Cannot move ... into itself or one of its subfolders. Before, the move was offered and then failed.
Configure transfer and Edit open the transfer form again in a VM's Avicenna transfers. Before, clicking them did nothing.
Manage access on a hardware setup starts from the setup's current teams and users, so saving no longer drops entries or makes the setup public.
A Slurm partition's Allowed VM Configurations lists VM configurations. Previously it listed hardware setups, which matched no VM.
Saving a Slurm partition as Unrestricted no longer makes every job fail with VM is not whitelisted for the specified partition.
Extracting a tiArchive keeps its folder structure. Previously files were placed side by side and the task failed.
Moving or copying a folder into one of its own subfolders is refused. Previously the folder disappeared or was copied over and over.
Moving an inbox folder within the same tree keeps its upload links. Previously every move deleted them.
Files opened from ZIP archives preview again instead of showing an endless spinner.
The file preview frees the memory of a decrypted file when you move to another file or close the preview.
File History shows the whole history with Load Older. Previously only the 50 newest events were shown. See View File History.
In the Share dialog, changing a group's expiration keeps its restrictions, such as Cannot download.
A manager's edit no longer makes them the owner of someone else's annotation; Set pins the player's exact time, typed start and end times are applied, and annotations can start at 0:00.
Failed saves and imports are reported and your annotation is kept; imports keep tags and annotation types, and time points and global annotations are drawn correctly on the timeline.
Templates apply only to their own drive and folder, a closed video stops checking for annotation changes, and a video plays even when its template cannot be loaded.
The template page refuses a category name that is already used (previously that wiped the existing category's tags), removes deleted tags and shows an error when saving fails. The annotation table filters by the user and tag names it shows. See Video Annotation Templates.
Management detail panels show correct values. An API key's expiry is no longer labelled Last modified, Slurm job durations are no longer shown as milliseconds, stopped VMs are no longer labelled running, libvirt host state is no longer always green, and a missing size on disk is no longer shown as 0 B.
Management detail panels show current data. The user panel refreshes, a stopped VM keeps its host and MAC address, and names no longer stay [unknown-...] after they load.
Detail panels with only a few actions show them again, along with the state button, such as Connect.
A request that fails once no longer makes an item look deleted for the rest of the session, for example during a backend restart. Detail panels show Could not load with a Retry button.
Screens update as soon as data arrives, instead of on the next one-second refresh.
Tables with totals update when only a total changes, such as Teams, Resources by user or by project, and Libvirt hosts.
CSV and TSV exports no longer shift columns when a value contains quotes, commas or a list.
A task for a single item shows as failed with its error when it fails, such as removing one VM user. Before, it showed as finished and closed by itself. Successful single-item tasks still close by themselves.
When a window fails to open, a Failed to open this window error is shown and no empty dialog is left over the page. Before, the click seemed to do nothing.
The notification panel no longer goes blank after you leave a group that received a share of 4 or more files.
Connect runs the latest front-end version by default, and picks it up from the Update URL in System Settings unless a user has chosen a specific version. See Specify a Front-End URL for Automatic Updates.
To install it by hand, upload the .szip file, or paste its link, in the Manage versions dialog of the Connect Application.
There is no configuration change and no migration.
Tell your help desk that ten wrong passwords now wipe the cached key file, so users who reach the limit need their key file to log in again.
Update internal guides and screenshots that quote permission names.
Some settings forms are stricter: Restricted Slurm partitions, External Servers entries, licensing servers and Max Instances. Existing entries are kept.
