Skip to content

Changelog

8.1.3-rc.18 - 2026-09-25

Highlights

Administrators can now follow Waldur releases from inside the portal. A new changelog page shows release notes, a banner flags security releases, and the footer shows a release badge. Team management is safer: the add-user and invitation dialogs now warn when someone already holds the role you're about to grant. The three role administration pages are now one tabbed page, and service providers can mark offerings that use robot-account identities.

What's New

  • In-portal changelog: A new administration page lets you browse Waldur release notes, pick a release, schedule an upgrade and view the upgrade commands. A security alert banner and a footer badge point staff to relevant releases.
  • Robot-account identity flag for offerings: Service providers can mark an offering as using robot accounts. The setting is in the offering's user management integration section.
  • Support access to calls: Support users now have read-only access to call-management data.

Improvements

  • Duplicate-role warnings: The add-user and invitation dialogs now warn when a user already holds the selected role. Invitation warnings are checked against each row's own project and shown only once.
  • Bulk invitation upload: Roles from a CSV bulk upload are now filled in correctly, even when roles finish loading after the invite dialog opens.
  • Unified roles administration: Role management, role availabilities and role hygiene now share one tabbed page instead of three separate pages.
  • Navigation: The tab a page opens on by default is now highlighted.
  • User profile editor: Removed the redundant nested "Details" card for a cleaner layout.
  • Cost policy processing: Cost policies are no longer re-evaluated when a resource save only updates its last-sync time, and their logging is quieter.

Bug Fixes

  • Fixed support order descriptions not rendering when the order has no plan.
  • Fixed scrolling in long dropdown menus in Administration Configuration and table actions.
  • Fixed table filter popovers being clipped by a height limit.

Core Component Activity

  • Waldur Mastermind: 4 commits - robot-account offering flag, support read access to calls, cost policy tuning, plan-less support order description fix
  • Waldur Homeport: 13 commits - changelog admin page and security banner, duplicate-role feedback in invitations, tabbed roles page, dropdown and navigation fixes

8.1.3-rc.17 - 2026-09-25

Highlights

The changelog system can now list releases, show what each one introduced, and build upgrade reports and announcements. Deployments running a release candidate are also offered newer candidates. Support comments can be edited and deleted by the person who wrote them, and support notification emails now arrive threaded. Keyboard accessibility improved across the interface, and SCIM, OpenStack and course-account integrations are more reliable.

What's New

  • Changelog browsing: The changelog API now lists releases and shows what any release introduced. Entries can be filtered by category and sorted by any column. The backend builds the upgrade report, announcement and commands itself, and deployments running a release candidate are now offered newer release candidates.
  • About us page: Administrators can set up an About us page in the branding settings using a Markdown editor. The page is linked from the footer.
  • Editable support comments: Authors can edit and delete their own support comments, and staff are notified when a comment is updated. The Edit and Delete buttons only appear where the user is allowed to use them.
  • Call order ownership: Call managers can choose who a call's resource orders are created by.
  • Reviews due soon: The proposal dashboard shows reviews that are due soon instead of the overdue reviews card.
  • Option validation: Service providers can set a pattern that free-form offering options are checked against.
  • Username filter: Offering users and provider accounts can be filtered by username.

Improvements

  • Support notification emails are threaded, so replies and updates for a ticket stay in one email conversation.
  • Every reviewer invitation now has a working link and sends an email.
  • The service provider comment on an offering user is cleared when the user becomes OK.
  • Course-account API calls have an explicit timeout, and the delete action shows that closing a course account happens in the background.
  • End date change request reasons are shown in an expandable row for resources and projects.
  • Accessibility:
  • Every focusable element, including tabs, now shows the brand focus ring.
  • The "Add filter" menu, breadcrumb dropdowns, the marketplace categories panel, search results and other controls that used to need a mouse now work with the keyboard.
  • The profile View/Edit controls now behave as buttons.
  • The OpenStack discovery wizard's Continue button now has an accessible name.
  • SCIM accounts are named after the match value exactly as it was sent, so logins can find them. A new management command reports username collisions.
  • The SRAM SCIM profile is advertised on its own discovery endpoints.

Bug Fixes

  • Keyboard navigation in global search works again.
  • The notifications drawer now opens on mobile, and the gap below the navbar is gone.
  • The profile page no longer crashes because of the recalculate user actions button.
  • Closing a dialog for an invitation that is no longer pending now clears the stored invitation token.
  • Parent tabs now link to the first entry their submenu actually shows.
  • The anonymous chat tab is hidden while anonymous chat is disabled.
  • The open calls link on the call management dashboard now applies the correct filter.
  • User avatars load without an authenticated request, and issue template files download using the API token.
  • Polling during OpenStack instance deletion is retried when Nova returns HTTP 429. Celery exception results are converted to text before being saved as error messages.
  • Fixed the offering options editor and number input fields used across several forms.

Core Component Activity

  • Waldur Mastermind: 20 commits - Changelog release browsing and reports, support comment editing and threaded emails, SCIM/SRAM fixes, proposal reviewer improvements, OpenStack and course-account reliability.
  • Waldur Homeport: 20 commits - About us page, comment action permissions, call order ownership setting, a broad keyboard accessibility pass and several UI fixes.

8.1.3-rc.16 - 2026-09-23

Highlights

Staff can now merge duplicate marketplace offerings. A guided wizard previews exactly which records will change, runs the merge in the background, checks the result afterwards and can undo it. Call-allocated orders are now attributed to a real person, and changes to role definitions are recorded in the audit log. The release also fixes many problems in the order form, drawers and menus, dark mode and keyboard accessibility.

What's New

  • Offering merges: staff can merge duplicate offerings using a new wizard with merge history and detail pages. The preview groups affected rows by area and lets you drill into them. Merges run in the background, and the invoice snapshot policy and post-merge verification results are shown in a dialog. Merges can also be undone.
  • Duplicate OpenStack tenant offerings: duplicate per-tenant OpenStack offerings are now resolved through the new offering merge engine, from both the API and the command line.
  • Role definition auditing: creating or changing a role definition now records an audit event, and these events appear in the audit feed.
  • Applicant eligibility for calls: call managers can configure who is eligible to apply directly from the call settings.
  • Outbound SCIM entitlements per offering: outbound SCIM entitlements are now controlled by an offering integration option, which can be switched on in the offering's user management settings.
  • Limits column in the orders list: the marketplace orders list now shows the limits requested in each order.
  • Context-aware changelog: a new backend serves release notes to the UI, and each change appears only once across a release-candidate cycle.
  • Editable language list: Docker Compose deployments now mount languages.yaml, so operators can change the list of available languages.

Improvements

  • Orders created from call allocations are now attributed to a real person instead of a system account.
  • Only staff and support users can create support requests on behalf of another user.
  • Requested resource amounts are shown in their measured units.
  • Prepaid limit changes are priced over the resource's actual remaining months.
  • Project chat room actions are grouped under one menu, and the room switcher that listed other projects' rooms has been removed.
  • Toast notifications have been rebuilt and share one notification system with the application shell.
  • Accessibility findings from a WCAG 2.2 AA scan have been fixed across tables, tabs, sidebars and forms. The My Access Requests view switch can now be operated with the keyboard.
  • Clicking a parent tab now opens its first child page.
  • Plan component price updates that changed nothing are no longer logged, and existing log entries of this kind are cleaned up.
  • The system now logs when a notification setting prevents an email from being sent.

Bug Fixes

  • A refused resource restore now returns the resource to the terminated state.
  • The order form keeps the offering's default limits when the form reloads, follows the offering when you switch it inside the form, and gives a single consistent reason when its steps are closed.
  • The usage values shown in the Change limits dialog are now correct.
  • Offering export keeps empty units and zero amounts, and offering import normalises null values and rejects invalid input.
  • Removing a project grant from the organisation team list now sends the correct project.
  • Permission checks now wait for the workspace to load, and a refused route keeps the address you were denied.
  • Header popovers appear above the toolbar, select menus can be clicked inside drawers, floating drawers stay under the header, and tall action menus stay inside the window.
  • Pressing Enter on links without a click handler, or on read-only avatar strips, no longer causes an error.
  • Dark mode has been fixed for Mermaid diagrams, login layouts and the provider ticket assignee picker. Login footer links are readable on gradient layouts.
  • AI assistant Mermaid diagrams fit inside the chat bubble, and the conversation marker stays on the assistant button.
  • VMware datastore sizes are stored in 64-bit columns, so large datastores no longer overflow.
  • Email diagnostics now handle sender addresses that include a display name.
  • Service desk setup now fixes a status with a mistyped value instead of skipping it.

Core Component Activity

  • Waldur Mastermind: 25 commits - offering merge engine and staff API, call order attribution, role definition auditing, changelog backend, SCIM entitlement option and several fixes
  • Waldur Homeport: 61 commits - offering merge wizard, call eligibility settings, accessibility fixes, rebuilt notifications, order form and drawer fixes, and ongoing design-token and style cleanup
  • Waldur Docker Compose: 2 commits - editable language list mount and smoke test tuning

8.1.3-rc.15 - 2026-09-17

Highlights

This release brings first-class support for SURF SRAM as an identity source: SCIM pushes from SRAM can now land directly in Waldur, map collaborations and groups onto organizations and roles, and grant project access through rules that staff configure and preview from a new administration page. Service providers get more control over what customers see and fill in when ordering — offering options can now be shown conditionally, Kubernetes topology and load balancer choices are configurable per offering, and offering managers can approve orders themselves. Team visibility is now driven by an explicit permission rather than "any role", so operators can decide precisely who sees project and organization membership.

What's New

  • SRAM integration: Waldur accepts SCIM pushes on a dedicated endpoint, matches incoming users to accounts by a configurable attribute pair, maps SRAM organisations to Waldur organizations, and creates a placeholder role per collaboration and group. Staff can define rules that turn placeholder membership into real project roles, and manage, preview and duplicate those rules from a new SRAM administration page with SRAM-aware badges across the UI.
  • Team visibility is now gated on an explicit view-team permission instead of any role, with a migration that preserves visibility for custom roles that already exist; the Team tab in the UI follows the same permission.
  • Offering options can be shown only when another option has a given value, configured in the offering editor and applied on order forms, resource option cards and provider approval dialogs.
  • Providers can set the Kubernetes cluster topology on the k8s user input and make the load balancer optional, so order forms only ask for what the offering actually supports.
  • Account settings can be configured once per service provider, with a page that previews what those settings produce for user accounts, POSIX ID pools and username conflicts.
  • Offering managers can now approve and reject orders placed with their offerings.
  • Call managers can activate a proposal workflow step directly from the dialog where they configure it, and calls can specify who support tickets are raised on behalf of.

Improvements

  • The invitation duplicate check now reports which roles an invited person already holds.
  • SRAM-sourced permission grants are recorded with their source, skip notification emails, and custom roles count toward user quotas.
  • SAF and SAP invoice report item texts no longer repeat the plan name.
  • The OpenStack create-subnet dialog supports IPv6 CIDRs and address modes, and instance fixed IPs are labelled "fixed" rather than "internal".
  • The deploy form can recover after an order is rejected instead of leaving the user stuck.
  • Badges across the interface were migrated to the shared design-token component for a consistent look, progress bars now use the live brand colour, and the offering Request button stays aligned with its neighbours.
  • The language list is seeded on boot instead of being overwritten, so whitelabeling customisations survive restarts.

Bug Fixes

  • Panels that stayed light grey in dark mode (Kubernetes order form cards, invoice tables, wizard steps) now follow the theme.
  • Logging configuration shipped in the container image is patched rather than replaced, so custom handlers are preserved; the docker-compose sample config documents the same behaviour.
  • Resource runtime state filtering now requires a scope, and the resource list filters were adjusted to match.
  • SCIM group sync applies the same grant validation as other permission paths.

Core Component Activity

  • Waldur Mastermind: 22 commits - SRAM/SCIM identity integration, view-team permission model, conditional offering options and Kubernetes configuration, order approval by offering managers.
  • Waldur Homeport: 21 commits - SRAM administration UI, permission-aware Team tab, provider account settings, Badge design-system migration, dark mode and OpenStack networking fixes.
  • Waldur Docker Compose: 1 commit - logging configuration sample updated to patch rather than replace.

8.1.3-rc.14 - 2026-09-16

Highlights

This release makes IPv6 and dual-stack OpenStack tenants work much better. Routers, subnets, security groups, load balancers and access URLs now handle IPv6 addresses correctly. Floating IP operations now refuse cases that can't work instead of failing partway through. Service providers can also set account settings once and have their offerings inherit them, and they can preview what those settings will produce.

What's New

  • Account settings shared by a service provider's offerings: offerings can now inherit account settings from their service provider, so operators no longer have to set them on each offering. A new view shows what a provider's account settings will produce.
  • IPv6 default subnet for tenants: giving a tenant an IPv6 subnet CIDR now creates an IPv6 default subnet.
  • IPv6 load balancers: load balancer virtual IP (VIP) addresses can now be IPv6 as well as IPv4.
  • IPv6 allowed address pairs: instances and ports now accept IPv6 allowed address pairs if the address is within a unique local address (ULA) range or one of the port's own subnets.
  • SCIM routing in Helm: the Helm chart's API ingress and HTTPRoute now send /scim requests to the Mastermind API, and the IP whitelisting docs cover the new route.

Improvements

  • IPv6 default security group rules are now created only for tenants that use IPv6.
  • Routers are now attached to IPv6 subnets by subnet, and every subnet of a dual-stack network is attached to the router.
  • IPv6 and dual-stack routers now show their IPv6 default routes.
  • External IP mapping now applies only to IPv4 addresses. IPv6 addresses are reported only on the external network.
  • External subnet records can now store IPv6 prefixes.
  • Resource state changes now save only the fields that the change affects.
  • Tooltips throughout the web interface now use a single shared tooltip component.

Bug Fixes

  • Floating IPs now keep their address when attached to or detached from a port.
  • Floating IP requests are now refused on IPv6-only external networks. Admins also can't allocate a floating IP unless the external network has an IPv4 subnet.
  • Changing a port's IP address is now refused where OpenStack networking (Neutron) sets the address automatically.
  • Tenant access and console URLs now keep the square brackets around IPv6 addresses.
  • The import_roles command now honors is_active: false in the permissions file.
  • Fixed several bugs in table filters, saved filters and the table loading indicator.

Core Component Activity

  • Waldur Mastermind: 21 commits - IPv6 and dual-stack support for OpenStack, floating IP fixes, account settings inherited from service providers, and a fix to role import.
  • Waldur Homeport: 5 commits - Switched to a single shared tooltip component, added component previews for tables and fixed the table bugs they revealed.
  • Waldur Helm: 1 commit - Added routing for /scim requests to the Mastermind API.

8.1.3-rc.13 - 2026-09-15

Highlights

This release makes several areas safer. Uploaded files can no longer run as web pages, expired SCIM tokens are now rejected, and protected call settings can only be changed by users allowed to update the call. OpenStack users can now create IPv6 subnets with SLAAC and DHCPv6 address modes. Administrators get a guided Atlassian service desk setup, a rule that allows one active affiliate per organization, and a way to define brand-new roles in Helm deployments.

What's New

  • IPv6 subnets: OpenStack subnets can now be created with SLAAC and DHCPv6 address modes.
  • One active affiliate per organization: Each organization can now have only one active affiliate. The affiliate link dialog greys out organizations that already have one.
  • Guided Atlassian service desk setup: The service desk admin screens now guide you through the Atlassian setup and group the advanced settings together. Direct Jira Service Management REST calls now use the same credentials as the Service Desk client.
  • HEAppE identifier for LEXIS offerings: LEXIS offerings have a new heappe_identifier option, which you can edit in the offering's LEXIS integration section. HEAppE option values can now be cleared, and the offering documentation lists every HEAppE option.
  • Custom roles in Helm: The new waldur.customRoles Helm value lets operators define brand-new roles.
  • Service desk offerings for site agents: Site agent identities now accept service desk offerings.

Improvements

  • SCIM behind the proxy: The /scim/v2/ endpoint is now served through the Helm and Docker Compose proxies.
  • Allowed address pairs: Address pairs are now checked before they are applied to an OpenStack instance, and changes are recorded in the port audit log.
  • Matrix chat: The appservice can now claim the room aliases it generates. Rooms now open through matrix.to links instead of matrix: URIs. The Helm chart updates LiveKit to v1.13.7 and lk-jwt to 0.7.0.
  • Order cost accuracy: When limits change, the cost of the old limits is now calculated up to the resource's real end date.
  • Proposal workflows: Workflow validation errors now name the dependency step that caused the problem.
  • Organization member roles: The role picker for organization and project members now works when roles are inactive or missing.

Bug Fixes

  • Media endpoint: Uploaded files are no longer run as pages when opened through the media endpoint.
  • SCIM tokens: Expired SCIM tokens are now rejected.
  • Call permissions: Changes to protected call settings now require the UPDATE_CALL permission.
  • Backend resource lists: Lists are now filtered by the user's role instead of crashing.
  • Service provider managers: Organization visibility and navigation now work correctly for service provider managers.
  • Monthly Revenue table: Expanding a row no longer crashes the table.

Core Component Activity

  • Waldur Mastermind: 15 commits - IPv6 subnet modes, SCIM and media security fixes, affiliate limit, Atlassian credentials, HEAppE options, Matrix alias claiming and order cost fixes
  • Waldur Homeport: 8 commits - Guided Atlassian setup, affiliate dialog, Matrix links, HEAppE identifier field, role picker and visibility fixes
  • Waldur Helm: 2 commits - Custom role definitions and LiveKit/lk-jwt updates
  • Waldur Docker Compose: 1 commit - Proxy /scim to the Mastermind API

8.1.3-rc.12 - 2026-09-15

Highlights

This release removes the built-in Azure integration. Existing Azure VMs are handed over to the site agent, and the retired Azure SQL Server offering is gone. Resource limit change requests are now an opt-in setting per offering, and email patterns now have to match the whole address before they grant access. Auto-provisioning rules also apply to existing accounts at login, and staff on development deployments can open a web shell in the browser.

What's New

  • Browser web shell for development deployments: Staff can open a web shell in the browser from a new entry in the user menu. It is off by default and can be turned on in Helm or through a new Docker Compose profile.
  • Role hygiene report panel: Staff can review role hygiene findings in a new administration panel that shows a summary, a table and details for each finding.
  • Matrix room reprovisioning: The new reprovision_matrix_rooms management command lets operators rebuild Matrix chat rooms.

Improvements

  • Limit change requests are opt-in per offering: Users can request resource limit changes only on offerings that enable this feature. The setting is in the offering's lifecycle policy section. A migration turns it on for offerings that already use limit change requests.
  • Auto-provisioning rules: Rule projects are now also created for existing accounts when they log in. Admins can edit a rule's project name template in the UI, and the dry-run shows what will happen to the project. If an email pattern is written as a wildcard, Waldur suggests the anchored regex instead.
  • Offering user accounts: Anonymized usernames are now based on the POSIX uid. A member who leaves and is granted access again gets their account back under the same name.
  • Project metadata answers: The API now returns only the latest checklist answer for each question. Each answer shows when it was last edited, and service providers see this time in the project metadata panel.
  • Fractional limit warning: Service providers see a warning in the offering component form when a fractional limit won't survive the site agent.
  • Offering state controls: The offering state split button is now a plain Activate/Pause/Resume button. Set to draft, Make unavailable and Archive moved into the Actions menu.
  • Customer manager access: Access handling was updated for users who hold only the customer manager role and no other organization roles, including access to service provider data.
  • OpenStack sync: Instance metadata is imported when its resource is linked, and provider accounting on volume-type components is kept across syncs.
  • Matrix calls: The LiveKit token exchange now goes to lk-jwt's /get_token. LiveKit is updated to v1.13.7 and lk-jwt to 0.7.0, and the development images are pinned.
  • Navigation and forms: The sidebar and select inputs were rebuilt on the new Tailwind-based UI components.
  • Event reliability: Real-time events for orders, resources and accounts are sent only after the database transaction commits. Member sync statuses are written only when they change.
  • Documentation: New guidance explains how to overwrite a built-in role's permissions using custom-roles.yaml.

Removed

  • Azure integration: The Azure plugin and its UI are removed, and existing Azure VMs are handed over to the site agent. The retired Azure SQL Server offering is also removed.

Bug Fixes

  • Email patterns now have to match the whole address wherever they grant access, including invitations, user restrictions, call eligibility and auto-provisioning.
  • In proposals, the allocated consumer step is approved only while it is still pending.
  • Call filters in proposal lists are no longer decoded twice.
  • The top navigation bar and toolbar now have the correct width when the sidebar is collapsed.
  • The email-pattern and project-name examples in the core concepts documentation are corrected.

Core Component Activity

  • Waldur Mastermind: 25 commits - Azure removal and hand-over to the site agent, opt-in limit change requests, auto-provisioning and email pattern fixes, offering user account restore, staff web shell
  • Waldur Homeport: 14 commits - Role hygiene panel, web shell menu entry, opt-in limit change request UI, auto-provisioning rule editing, sidebar and select rebuilt on Tailwind, Azure UI removal
  • Waldur Helm: 1 commit - Opt-in web shell for development deployments
  • Waldur Docker Compose: 2 commits - Opt-in web shell profile, LiveKit and lk-jwt version updates

8.1.3-rc.11 - 2026-09-12

Highlights

Organizations can now receive roles automatically from OIDC claims. Waldur keeps those grants in sync as claims change and shows where each role came from. OpenStack subnet management gets more flexible, and the built-in helpdesk behaves more like a real service desk, with read-only closed tickets, configurable ticket keys and tighter access scoping. Operators also get Gateway API support in the Helm chart, fractional component limits that bill correctly, and a large batch of VMware and UI reliability fixes.

What's New

  • Claim-based organization roles: auto-provisioning rules can assign organization roles from OIDC claims. Grants are kept in sync as claims change, and a management command can re-sync them on demand. The rule editor configures claim matching, reports claims that no identity provider passes through, and user affiliations show how each role was granted.
  • Shared service provider accounts: user accounts can be shared across all of a service provider's offerings instead of being created per offering.
  • OpenStack subnet routing: choose which router a new subnet attaches to, or create a subnet with no router at all. Consumers can also attach a subnet shared with them over RBAC to their own router.
  • Gateway API in Helm: the Helm chart can expose Waldur through Kubernetes Gateway API routes as an alternative to Ingress.
  • Fractional component limits: each offering component has a precision setting that controls whether fractional limits are allowed. Limit inputs follow that setting, and fractional limits are kept intact in billing.
  • Plan comparison and pricing: public offering pages compare plans side by side. Plan editors warn about unpriced plans and let you set prices when you create a plan. Accounting dialogs explain what each billing type charges.
  • Configurable helpdesk ticket prefix: the ticket key prefix of the built-in helpdesk can be configured, and it is validated in the admin as well. Service desk defaults are seeded on first start.
  • Custom roles on deployment: operator-defined custom roles are loaded automatically when Waldur is deployed. A new check reports malformed roles and roles that are unintentionally global.
  • Staff user deletion: staff can delete users from the row actions of the Users table.
  • Remote offering user sync: offering user state is now pulled from remote Waldur instances on a schedule.

Improvements

  • Helpdesk: resolved and canceled tickets no longer accept new comments. The helpdesk is notified when the reporter comments, and new tickets no longer also send an "updated" notification. Ticket access is limited to the project or organization the ticket was raised in, provider ticket lists and stats can be limited to a single helpdesk, and the Canceled status appears in lists and filters.
  • Roles and invitations: the INVITATION_DISABLE_MULTIPLE_ROLES setting now also applies to roles granted directly. Built-in system roles now carry descriptions. When no roles are available, the invite dialog explains why instead of showing an empty popup.
  • Offering components: accounting components can be managed for every offering type. Built-in components and components inherited by child offerings are protected from edits.
  • AI assistant: the assistant now sits in the page header and is labelled for anonymous visitors. The offering page no longer has a separate assistant button.
  • OpenStack: running instances can be terminated without a force destroy. Subnets keep the address pool that Neutron allocated, report their real connection state, and show a single clear error for an invalid gateway IP.
  • Event consumers: Waldur records how each event consumer was registered and on whose authority.
  • Interface modernization: menus, dropdowns, popovers, the sidebar and the content drawer now use a new component library. Many follow-up fixes cover positioning, focus rings, active-item highlighting and animations.
  • Deployment: RabbitMQ runs as a three-replica cluster in the reference Helm values. Docker Compose lets you set Celery worker concurrency through an environment variable. Both deployments bundle the Tuwunel Matrix server v1.9.0.

Bug Fixes

  • VMware: fixed gaps in the VMware marketplace integration and the vSphere order form, which now includes a plan step. Other VMware fixes:
  • The disk actions work correctly, and new network adapters use the selected network.
  • RAM and disk sizes are shown in GB, and dialogs say a disk or adapter is scheduled rather than created.
  • Synchronize is available on vSphere offering credentials.
  • Service provider managers: managers can again see their own provider's offerings, statistics and revenue.
  • OIDC and SAML: OIDC lookup claims that arrive as lists are now stored as plain values, and a migration corrects values already stored the wrong way. Returning OAuth users get their registration method updated, and SAML_ATTRIBUTE_MAPPING accepts list values.
  • Usage reports: fixed a crash in the usage report dialog, fixed its layout, and the usage tab now says why it is empty.
  • Other fixes:
  • Fixed the GLAuth TOML output for custom attributes.
  • The My Orders dashboard applies the order filters.
  • Plan forms now use the component units that match each billing mode.
  • Course account errors show the real status code and message.

Core Component Activity

  • Waldur Mastermind: 49 commits - claim-based role provisioning, shared provider accounts, OpenStack subnet routing, helpdesk behavior and fractional limits.
  • Waldur Homeport: 138 commits - migration to the new menu, drawer and sidebar components, plan pricing and comparison, VMware order and action fixes, and UI for the new backend features.
  • Waldur Helm: 3 commits - Gateway API support, a clustered RabbitMQ reference setup and Tuwunel v1.9.0.
  • Waldur Docker Compose: 2 commits - Celery concurrency set from the environment and Tuwunel v1.9.0.

8.1.3-rc.10 - 2026-09-07

Highlights

This release makes affiliated-organization reporting available as a configurable screen across the backend and web interface, so operators can switch it on for their deployment. Service and course account integrations become more predictable: account payloads now identify offerings by their backend identifier, and accounts without an assigned user are reported explicitly instead of silently omitting the field. Permission checks and the OpenStack event-group migration also received correctness fixes.

What's New

  • The affiliated-organization report screen can now be enabled and configured, with matching backend settings and web interface registration.

Improvements

  • Service and course account payloads now prefer the offering's backend identifier over its slug, giving integrations a stabler reference to match against.
  • Course account records always include the user field, returning an explicit empty value when no user is assigned, so clients no longer have to handle a missing key.
  • Select inputs across the web interface now take their colours from the shared design tokens, keeping dropdowns consistent with the rest of the theme and with custom branding.

Bug Fixes

  • User membership checks now account for organization-scoped role templates, so permissions on cloned organization roles are evaluated correctly for invitations, group invitations and support issues.
  • The migration that splits OpenStack resource event groups now processes all notification hooks, preventing hooks from being left with outdated event group references after upgrade.

Core Component Activity

  • Waldur Mastermind: 5 commits - account payload identifiers, organization-scoped permission checks, event-group migration fix, affiliated-organization report setting.
  • Waldur Homeport: 2 commits - design-token-driven select styling and affiliated-organization report screen registration.

8.1.3-rc.9 - 2026-09-07

Highlights

This release lets a single marketplace offering carry plans with different billing modes, including a new prepaid mode, so operators can offer limit-based, usage-based and prepaid plans side by side and the UI now explains what each plan's billing period actually bills. OpenStack VM termination no longer stalls on leftover backups and snapshots, VM creation keeps the system volume bootable and attached, and the Nova instance metadata is now supported. Operators get a much faster cold start of the web UI with a pre-bundled IdP redirect, a new default-IdP login endpoint, IPv6-only RabbitMQ support in the Helm chart, and generic Constance and feature-flag overrides in chart values.

What's New

  • Per-plan billing modes: one offering can now combine limit, usage and prepaid plans, with the API reporting whether a plan's billing period affects invoicing. The order form, plan editor, invoice rows and plan-switch dialogs show the billing mode and pin the period where it bills nothing.
  • New default-IdP login endpoint starts authentication with the configured default identity provider. It is safe and cheap to probe, and the web UI now takes a fast path when the stored token has already expired.
  • A configurable registration method for Bearer token introspection over OIDC.
  • OpenStack instances can carry Nova metadata, and the console log endpoint now accepts POST.
  • A new report lists projects, resources and cost by affiliated organization.
  • The maintenance announcement banner marks maintenance that has already completed.
  • The Helm chart accepts generic Constance and feature-flag overrides, brings up the bundled RabbitMQ on IPv6-only clusters, and only redirects to HTTPS when the deployment is actually served over HTTPS.

Improvements

  • OpenStack VM termination now automatically cleans up backups and snapshots that previously blocked deletion.
  • The VMware backend was rewritten on pyVmomi, validated against vcsim, and now caches vCenter sessions per process.
  • Offerings that are not charged refuse plans and pricing, and child offerings hide the accounting tab and plan guard.
  • Offering managers can now set resource end dates.
  • Pending user actions are folded into the dashboard feed, and the events filter only advertises event groups the deployment can emit.
  • Pub/sub, RabbitMQ and site-agent admin pages read queue kind and consumer from typed API fields instead of parsing names.
  • The create/edit role dialog was redesigned, organization-scoped role cloning is guarded for integrity, and the invitation dialog disables the project manager role when a project already has one.
  • Marketplace naming, search scope and category card content were unified, and selects and plan row actions now use library components in brand colours.
  • The web UI cold load is lighter with a pre-bundled IdP redirect and immutable assets.
  • Celery worker concurrency can be overridden from the environment, and the Docker image installs from the lock file.
  • Orphaned notification rows are reported and pruned by the notification management commands.
  • Migration squashes keep their data operations, and databases that skipped them are repaired automatically.
  • The country list is now vendored, and Django REST Framework and several JavaScript dependencies were bumped to clear known vulnerabilities.

Bug Fixes

  • Fixed OpenStack VM creation so the system volume stays bootable and attached.
  • A stored zero quota limit is now reported as zero instead of unlimited, and fractional limits are handled correctly in total-period billing.
  • Fixed the VM order form clearing entered data on tab switch.
  • Fixed the maintenance window picker calendar selection and Custom button.
  • Restored missing table row dividers, fixed dark-mode select states, and kept the HTTP status on API errors.
  • Closed terms-of-service consent filtering gaps in the compliance view and glauth.
  • The Helm whitelabeling job now waits for the database schema before applying settings.

Core Component Activity

  • Waldur Mastermind: 40 commits - per-plan billing modes, OpenStack termination and volume fixes, VMware backend rewrite, default-IdP login, migration squash repairs
  • Waldur Homeport: 21 commits - billing mode UI, faster cold load, affiliated organization report, role dialog redesign, styling fixes
  • Waldur Helm: 4 commits - Constance and feature-flag overrides, IPv6 RabbitMQ, conditional HTTPS redirect, whitelabeling job ordering

8.1.3-rc.8 - 2026-09-02

Highlights

Support teams get a much more capable built-in service desk in this release: staff can now change issue status directly from the issue page, receive email when a new ticket arrives, and see a support dashboard that only exposes statistics to the people entitled to them. Cost policies now report how many days remain before they trigger, with the estimate computed server-side so the project credit view no longer guesses from burn rate. Staff also gain a dedicated email configuration page that checks outgoing mail settings and sends a test message, making it far easier to diagnose "notifications never arrive" problems.

What's New

  • The built-in helpdesk supports changing issue status from the issue details page, with the available statuses reflecting how the issue was routed — provider-routed issues offer none.
  • Cost policies expose an estimated time to trigger (eta_days) through the API, and the project policy watch view now reads that value from the server instead of projecting it locally; thresholds that have already been reached are no longer hidden.
  • A new staff-only email configuration page reports on outgoing mail setup, surfaces findings, and can send a test email, backed by a new sanity-check API and an index on email log timestamps.
  • Staff are notified by email when a ticket arrives on the built-in service desk, and the previously dormant issue escalation notification now actually fires.
  • Role administration gained a comparison dialog showing how two roles differ and who an impending permission change would affect.
  • Marketplace provider resources now expose the project start date, and the offerings list gained customers and cost columns.
  • OpenStack security groups can be expanded to show the instances attached to them.

Improvements

  • The credit offering list now documents that leaving it empty applies the credit to every offering.
  • Creating auto-provisioning rules is restricted to staff, and support statistics are limited to support staff and providers.
  • Issue action dialogs (attach resource, reroute, route to provider) were made usable.
  • The de-emphasised local sign-in link is back on the login page.
  • django-dbtemplates was removed as a dependency; notification templates are now handled by Waldur's own template loading, with migrations to deduplicate and enforce unique template paths.
  • Helm charts dropped the legacy networking.k8s.io/v1beta1 Ingress fallback.
  • Front-end dependencies were bumped to clear two high-severity advisories.

Bug Fixes

  • Background Celery task locks are now released when the task completes, so recurring jobs no longer stall behind a stale lock.
  • An unconfigured Zammad backend no longer breaks the support module.
  • The auto-provisioning rule dialog's Confirm button is no longer inert, and the standalone-issue toggle no longer deadlocks the issue creation wizard.
  • Table string filters no longer crash on cyclic object values.
  • Expired tokens no longer send the UI through the login state twice.
  • Fixed warning bar margins, the collapsed "Add resource" plus icon, and sidebar hover overflow.

Core Component Activity

  • Waldur Mastermind: 16 commits - built-in helpdesk status handling and notifications, cost policy ETA, email diagnostics API, dbtemplates removal.
  • Waldur Homeport: 19 commits - issue status control and support dashboard, email configuration page, role comparison, plus several UI fixes.
  • Waldur Helm: 1 commit - removed the legacy Ingress API fallback from templates.

8.1.3-rc.7 - 2026-08-30

Highlights

This release introduces passkey (WebAuthn) authentication across the stack: users can register and sign in with passkeys, operators can require them for privileged accounts, and staff can revoke another user's passkeys with an audited reason. Call management gains configurable per-step notification rules, a panel chair role, and a cleaner proposal flow where project duration is derived from the call and prepaid subscription length is chosen where the resource is requested. Administrators also get new visibility into site-agent event queues and PubSub consumers, and the UI is now available in Croatian, Macedonian, and Albanian.

What's New

  • Passkey authentication: users can register, rename, and revoke passkeys from their profile and sign in with a passkey button on the login form. Operators can enable passkeys and passkey enforcement for privileged accounts via Helm chart values or Docker Compose configuration; when enforced, staff and support users are held at an enrollment page until they add a passkey, then resume the page they were on. The Django admin now prompts for a passkey step instead of denying access, and a rollout command reports and revokes privileged personal access tokens that were issued without passkey verification.
  • Staff can revoke another user's passkeys from the user management view, with a mandatory reason recorded in the event log.
  • Call managers can define per-call notification rules for workflow steps, see who evaluates each step, and flag a panel member as panel chair.
  • Applicants now choose the prepaid subscription length when requesting a resource, capped by the call's fixed duration; the project duration is derived from the call rather than entered separately.
  • New read-only API endpoint listing the service providers of an organisation, and service providers can be filtered by creation date.
  • OpenStack security groups now expose the instances attached to them.
  • Administration: the PubSub health page has an Event consumers card, the RabbitMQ page shows unified consumer queues, and each site agent shows its event queue and connection state. The legacy event subscriptions page is marked as deprecated.
  • Croatian, Macedonian, and Albanian added as UI languages, with role and category translation fields to match.
  • Reporting overview tiles show period-over-period growth.
  • Anonymous AI chat KPIs include a clarification-rate tile, severity is sortable by rank, and the assistant tools now see offering access-route metadata.

Improvements

  • Updating a call's fixed duration now propagates to all pending proposals, with a confirmation prompt in the UI.
  • Applicants no longer see call-management controls in their request view; the two profile request tabs are merged into one.
  • Offering extra fields are annotated when explicitly requested via the field parameter.
  • Proposal-scoped roles now report their organisation, and permission serialization returns the organisation directly when the scope is an organisation.
  • Internal plumbing terms and icons were removed from customer-facing copy; truncated breadcrumbs keep the full name for screen readers.
  • After login the app boots once and navigates directly to the target page.
  • Fresh database setup is faster thanks to regenerated migration squashes.
  • Demo preset now includes an offering with a mandatory purchase order.

Bug Fixes

  • File downloads work again with the new media permissions by sending authentication.
  • Offering managers can now use provider resource write-back actions.
  • Project cards show the real cost estimate.
  • Order form refreshes project options when the organisation changes.
  • Partially saving an issue template no longer creates duplicates.
  • Dark theme warning bar colours restored; an unmapped language code no longer crashes the app; a restored workspace scope that no longer resolves is dropped instead of breaking the sidebar.
  • Group invitation email patterns are anchored so partial matches no longer pass the uninvited-user gate.
  • Passkey RP name falls back to the site name when unset.

Core Component Activity

  • Waldur Mastermind: 33 commits - passkey backend and enforcement, workflow-step notification rules, prepaid duration validation, new languages, migration squashes
  • Waldur Homeport: 32 commits - passkey UI, proposal flow rework, panel chair, admin queue visibility, new locales, assorted fixes
  • Waldur Helm: 3 commits - passkey and passkey-enforcement chart values, updated chart icon
  • Waldur Docker Compose: 2 commits - passkey and passkey-enforcement configuration options

8.1.3-rc.6 - 2026-08-27

Highlights

This release tightens control over who can see what: attachments uploaded with marketplace orders, proposal documents, invoices and other media files are now served through a central access registry that checks the requester's permissions before handing over the file. Call applicants get their own state-change notification with wording tailored to them, and one-time fees are finally invoiced at the quantity the plan actually specifies. Users, call managers and reviewers each get purpose-built dashboard endpoints, so the landing pages they see reflect their role.

What's New

  • Marketplace order attachments, proposal and call documents, invoices, support files and other uploaded media are now protected by a per-module access registry that verifies the requester's permissions on every download.
  • New dashboard endpoints tailored to the user, call-manager and reviewer roles, surfacing the orders, providers and proposals relevant to each.
  • Organization and service provider project lists gained filters, making large project sets easier to narrow down.
  • The offering API now reports which fields the current caller is allowed to change, so the interface can present editable and read-only fields accurately.

Improvements

  • Applicants receive a dedicated notification when their call application changes state, controlled by a single administrator switch that covers both applicant and manager wordings; the older access-request notification has been retired.
  • Expired projects are now deleted in the background instead of blocking the request that triggers the cleanup, avoiding long waits and timeouts.
  • One-time plan components can carry an explicit amount, and invoices bill them at that quantity rather than assuming a single unit.
  • The database cache table size is now capped explicitly in both the Helm chart and Docker Compose configuration, keeping the cache table from growing without limit.
  • Administrator documentation for configuration, the CLI, notifications and templates has been refreshed.

Bug Fixes

  • The offering integration panel no longer breaks when an offering has no secret options configured.
  • Prepaid components are no longer offered in the plan quotas dialog, where they do not apply.
  • Read-only proposal views no longer display fields that the call did not ask for.
  • The application version is hidden from unauthenticated visitors in the footer.

Core Component Activity

  • Waldur Mastermind: 11 commits - media access controls, role dashboards, applicant notifications, one-time fee billing.
  • Waldur Homeport: 11 commits - project list filters, offering integration fixes, proposal view and footer corrections.
  • Waldur Helm: 1 commit - explicit database cache table cap.
  • Waldur Docker Compose: 1 commit - explicit database cache table cap.

8.1.3-rc.5 - 2026-08-26

Highlights

Call managers can now tailor the Project details step of a proposal form per call, deciding which fields applicants see and which are required — and the submission form renders exactly that configuration. Applicants get clearer guidance too: the reason Submit is unavailable is shown before they press it, and proposals now collect a science domain instead of an OECD code. On the billing side, one-time fees are quoted the way the invoice will actually charge them, and project credit reporting now reflects the cost a credit will really be drawn for.

What's New

  • Call managers can configure which Project details fields appear on a call's proposal form and which are mandatory, with the applicant-facing form rendering directly from that configuration.
  • Proposals now ask for a science domain rather than an OECD code, and two unused proposal flags were removed.
  • Service providers can offer an offering via a call and choose the call manager and review workflow as part of the same dialog.
  • Resource API keys can now be managed using provider-level scopes, not just project scopes.
  • Configured latitude and longitude are shown wherever a location is set, including on the map.
  • Deployments can point waldur.homeport.inferencePlaygroundURL at an inference playground and have it allowed by the content security policy.

Improvements

  • Applicants are told why Submit is refused before they press it, and the Project details step now opens expanded by default.
  • Project prepaid duration is derived from the requested length rather than a date, and the subscription starts when the allocation is scheduled.
  • The project credit pacing indicator and health view now measure the month against the cost a credit actually covers; three incorrect credit figures were corrected.
  • The round-closing email to call managers now describes what closing a round actually does, and the round details show the call's managing organisation.
  • Total offering quotas are no longer exposed in the public offering view.
  • Navigation links and menu entries for features a deployment has disabled are now hidden instead of leading to dead ends.
  • Dialog titles name the scope they act on, across marketplace, OpenStack, project, invoice and support dialogs.
  • Machine-translation errors were corrected across 23 locales.
  • Proposal lists load faster — the submit-eligibility check no longer issues a query per proposal.
  • The offering details dialog loads a smaller bundle by deferring the map library until the location tab is opened.

Bug Fixes

  • rebill_historical_usage now previews dry runs correctly and handles partial credit draws.
  • The anonymous chat panel no longer breaks the page when it hits an error.

Core Component Activity

  • Waldur Mastermind: 23 commits - per-call proposal field configuration, prepaid duration and credit cost reporting, offering quota visibility, plus CI test-selection work.
  • Waldur Homeport: 21 commits - configurable proposal form, credit pacing corrections, scope-aware dialog titles, locale fixes and shared UI package groundwork.
  • Waldur Helm: 2 commits - inference playground URL added to the CSP, dead ArgoCD sync job removed.

8.1.3-rc.4 - 2026-08-25

Highlights

Credit reporting is now visible to every project that actually has a credit, instead of hiding behind a staff-only toggle, so project members can finally see their own credit balance and usage. Staff and support users are no longer locked out of restricted offerings when placing orders, removing a long-standing friction point for support teams acting on behalf of customers. This release also modernises the messaging and deployment stack — Celery, RabbitMQ 4.3 compatibility, and a move from Bitnami to CloudPirates subcharts in the Helm chart — and cuts down log noise from resources that have disappeared at the backend.

What's New

  • Credit reports and credit blocks on the project dashboard now appear automatically for any project holding a credit, replacing the previous per-project display toggle.
  • A new management command lists resources that are missing at the backend, so operators can review them on demand rather than digging through logs.
  • Service providers can now see the creation_order field on resources they serve, giving them the ordering context behind a provisioned resource.

Improvements

  • Staff and support users are exempt from offering role restrictions, both in the API and in the order form, so restricted offerings remain usable for administrative and support work.
  • Resources that vanish from the backend are recorded once with a first-seen timestamp instead of being re-logged on every pull cycle, dramatically reducing repetitive event log entries.
  • The offering orders list no longer applies a default state filter, showing all orders straight away.
  • Provider-specific actions are hidden from users without a provider role, so resource action menus only show what the user can actually do.
  • The terms-of-service consent banner now checks whether an offering user exists for the resource before warning about it.
  • Long-running background jobs, migrations and admin queries walk large querysets in client-side chunks, so they no longer fail when a pooled database cursor is dropped mid-iteration.
  • Celery upgraded to 5.6.3 with kombu 5.6.2, control-plane queues declared as exclusive, and RabbitMQ 4.3 compatibility prepared across the server, Docker Compose and Helm deployments.
  • The Helm chart replaces Bitnami subcharts (PostgreSQL, PostgreSQL-HA, RabbitMQ, MinIO) with CloudPirates charts on officially maintained images, and CI test fixtures are excluded from the packaged chart.
  • Support ticket HTML-to-text conversion moved from the deprecated html2text to markdownify, producing cleaner comment and issue bodies.
  • The map component now uses direct Leaflet bindings instead of react-leaflet, and shared UI work continued on the dashboard micro-app with design-token and visual-parity coverage.

Bug Fixes

  • Fixed a crash in the VMware order form caused by composed form validators.
  • Fixed display issues in the service provider customers and organization project tables.
  • Fixed the call offering filter so its options render correctly in the proposal resource request step.
  • Credit ledger backfill now infers the floor-draw month in the deployment timezone, preventing off-by-one-month entries near month boundaries.

Core Component Activity

  • Waldur Mastermind: 11 commits - credit report visibility, offering role exemptions for staff/support, missing-resource logging, Celery/RabbitMQ upgrades.
  • Waldur Homeport: 11 commits - credit dashboard gating, order form and table fixes, Leaflet migration, shared UI component work.
  • Waldur Helm: 3 commits - migration from Bitnami to CloudPirates subcharts, RabbitMQ operator test coverage, leaner chart packaging.
  • Waldur Docker Compose: 1 commit - RabbitMQ 4.3 upgrade compatibility.

8.1.3-rc.3 - 2026-08-24

Highlights

This release makes order handling and provider identity management noticeably more workable. Providers can now nominate exactly who gets told about a new order — configured email addresses and provider roles — and the notification itself spells out what was ordered instead of just pointing at a link. A single user now keeps one POSIX identity across all of a provider's offerings, so account mapping on HPC and SLURM systems stops fragmenting per offering. Credit accounting moved onto a proper ledger, so what the UI shows as consumed credit is now read from recorded transactions rather than inferred. Deployments also gained IPv6 support end to end, across the API container, the Homeport nginx config and the Helm chart.

What's New

  • Providers can configure who receives new-order notifications: a list of email addresses plus selected provider roles, set from the offering's integration settings. The notification email now describes the ordered items rather than only linking to them.
  • Calls and proposals send their own dedicated invitation emails instead of reusing the generic invitation template.
  • Credit drawdown is recorded in a ledger per project and split by kind, with a backfill command for existing data; the project health view now reads consumption from the ledger. Credit expiry is dated to the month the balance was actually forfeited.
  • Offerings can declare a missing usage policy, replacing the old recurring-usage checkbox, and component usage can be filtered by it in reporting.
  • Service providers get a searchable POSIX ID pool list showing which identities are shared across offerings.
  • Accepted proposals now show what was allocated and where the allocation lives.
  • Reporting overview gained a period filter.

Improvements

  • One POSIX identity per user is now shared across all offerings of a provider, with a migration and a collapse_posix_identities command to consolidate existing per-offering identities.
  • Deployments work on IPv4-only, IPv6-only and dual-stack setups: gunicorn binds the IPv6 wildcard when available, the Homeport nginx config listens on both families, and the Helm chart picks IP families per service.
  • Outgoing email is now configurable in both the Helm chart (SMTP credentials delivered to pods) and the Docker Compose deployment.
  • Pooled Postgres deployments can disable server-side cursors via a new Helm toggle, and the user revision backfill migration no longer relies on them.
  • Paginated resource listings have a stable total ordering, so pages no longer repeat or skip records.
  • Offering fields visible only to providers, and offering secret options, are now gated on the same permission that allows writing them.
  • Auto-approval is respected consistently: disable_autoapprove now overrides owner self-approval, and auto-approving invitations no longer send a "request submitted" email.
  • Interface polish: visible keyboard focus rings restored on buttons and menus, a flatter offering pricing panel, resource state shown next to the resource name, tooltips on disabled navigation tabs, and a more robust login hero with an image fallback.
  • Django upgraded to 6.0.8, picking up a fix for a GeoDjango denial-of-service issue.

Bug Fixes

  • The terms-of-service reconsent filter now compares actual ToS versions, so users are only asked to re-consent when the terms really changed.
  • A plan component price of zero is accepted again, both when editing prices and when scheduling next month's price.
  • Configurable plan components are no longer displayed as an included quantity of zero.
  • The 404 page keeps the requested URL, and navigation blocked by the profile-completion gate now explains itself and resumes where the user left off.
  • Users are no longer prompted to complete their profile while profile editing is disabled.
  • Login redirects use the correct return_url query parameter.
  • Comma-separated list fields no longer emit a blank entry.
  • Conflicting invoice migration branches were merged into a single history.
  • Provider action visibility now follows one rule across all order surfaces.

Core Component Activity

  • Waldur Mastermind: 30 commits - order notifications, shared POSIX identities, credit ledger, permission gating and pagination ordering.
  • Waldur Homeport: 25 commits - notification recipient settings, POSIX identity views, credit ledger display, plus accessibility and navigation fixes.
  • Waldur Helm: 4 commits - IP family support, SMTP credential delivery and a server-side cursor toggle.
  • Waldur Docker Compose: 1 commit - configurable outgoing email.

8.1.3-rc.2 - 2026-08-19

Highlights

This release hardens how Waldur stores provider credentials: offering secret options and service settings credentials are now encrypted at rest, with a management command to rotate keys and audit-log scrubbing so secrets no longer leak into webhooks or revision history. Project managers gain finer control over what appears on project dashboards, and cost policies now report the evaluated cost directly instead of forcing clients to recompute it. Order handling in the web interface has been reworked around an in-drawer preview, making it faster to review and act on pending orders without leaving the page.

What's New

  • Offering secret options and service settings credentials are now encrypted at rest, with a reencrypt_fields management command for key rotation and scrubbing of previously stored plaintext from revision history and webhook logs. Deployment guidance for the encryption key has been corrected in both the Helm chart and Docker Compose setups.
  • Projects can now opt in or out of credit and usage dashboard reports individually, with the toggle available in project settings and the dashboard respecting the flag.
  • Cost policies expose the cost they evaluate as a dedicated field, so dashboards and integrations no longer have to derive it themselves.
  • The historical usage rebilling command now previews the impact of cost policies before changes are applied.
  • Provider resource lists show project and resource end dates in the detail view.

Improvements

  • Pending orders can be previewed directly in the confirmation drawer instead of navigating away to the order page; bulk approve and reject actions were removed from the drawer in favour of per-order review.
  • The orders table now surfaces the provider and customer message exchange, and order pages link back to the provider Orders table.
  • Approve and reject dialogs have a tighter layout, and order details load concurrently for faster page opens.
  • Conflict-of-interest settings prevent the same conflict type from being used in more than one rule.
  • Organization country mapping now uses the org_reg_country OIDC claim.
  • The legacy SLURM module has been removed; existing SLURM offerings are archived and their resources terminated during migration.
  • Dependency update: sqlparse bumped to 0.6.0 to address two known vulnerabilities.

Bug Fixes

  • Corrected focus-ring colour tokens and a width regression on the new Tailwind-based buttons.

Core Component Activity

  • Waldur Mastermind: 11 commits - field encryption for secrets, SLURM module removal, cost policy reporting, per-project report opt-in
  • Waldur Homeport: 13 commits - order review workflow rework, dashboard report gating, button styling fixes
  • Waldur Helm: 1 commit - corrected field encryption key guidance
  • Waldur Docker Compose: 1 commit - corrected field encryption key guidance

8.1.3-rc.1 - 2026-08-17

Highlights

This release candidate focuses on the Waldur Helm chart, making encrypted-field configuration a first-class deployment setting and improving the reliability of metrics monitoring. Operators can now supply the mastermind field-encryption key directly through chart values instead of managing it out of band, and the Prometheus exporter is monitored through dedicated health endpoints so restarts and readiness are reported accurately.

Improvements

  • The mastermind field encryption key (FIELD_ENCRYPTION_KEY) can now be configured through Helm chart values and is delivered to mastermind pods via a managed secret, with accompanying documentation and chart tests.
  • The Prometheus metrics exporter now uses dedicated healthz endpoints for its liveness and readiness probes, giving more accurate health reporting in Kubernetes.
  • The chart's default target Waldur version was updated.

Bug Fixes

  • Fixed the Helm chart release pipeline so version tags are pushed correctly when the job runs from a detached HEAD.

Core Component Activity

  • Waldur Helm: 5 commits - field encryption key wiring, Prometheus exporter health probes, and release pipeline fixes.

8.1.1-rc.1 - 2026-08-17

Highlights

This release candidate focuses on making OpenStack network port handling and role assignments behave predictably. Pinned IP addresses now actually take effect when ports are updated, failures to reclaim an address come with an explanation instead of an opaque error, and duplicate role assignment requests get a clear conflict response rather than silently proceeding. On the frontend, order approval and review screens are easier to work through, and the first groundwork for the new design system has landed.

What's New

  • Added a credit scenarios demo preset for the project dashboard, so credit history can be showcased with realistic data.
  • Added a full-screen toggle to the confirmation drawer for reviewing pending consumer and provider orders in a larger view.

Improvements

  • Approve and reject dialogs for provider orders now clearly identify which order is being acted on.
  • The Orders table hides low-signal columns by default, making the list easier to scan.
  • Confirmation drawer rows stay on a single line, keeping long lists readable.
  • Groundwork for the upcoming Tailwind/shadcn UI migration: shared design tokens and a first reusable button component, with no visible change to the current interface.
  • Removed leftover configuration for the retired legacy SLURM plugin from the Helm chart.

Bug Fixes

  • A changed pinned IP address is now correctly applied when updating instance ports.
  • Restored validation of the target tenant in OpenStack role assignments, and duplicate assignment requests now return a proper 409 conflict.
  • When a port address cannot be reclaimed, the reason is now reported instead of a generic failure.

Core Component Activity

  • Waldur Mastermind: 4 commits - OpenStack port and RBAC fixes, plus a credit scenarios demo preset.
  • Waldur Homeport: 4 commits - Order review and approval usability work, and design system foundations.
  • Waldur Helm: 1 commit - Dropped configuration for the removed legacy SLURM plugin.

8.1.2 - 2026-08-15

Highlights

This release focuses on deployment configuration and operational tuning for both the Helm chart and Docker Compose distributions. Operators can now supply a field encryption key through standard deployment configuration, tailor the country list shown in the marketplace without rebuilding images, and tune mastermind memory behaviour from values or environment variables. API responses are now compressed at the ingress layer, and the Matrix chat networking and CSP settings have been corrected so voice messages and homeserver traffic work as expected.

What's New

  • Field encryption key (FIELD_ENCRYPTION_KEY) can now be configured for mastermind services in both the Helm chart and Docker Compose, so encrypted fields no longer require manual wiring.
  • The list of countries offered in the marketplace can be customised directly from chart values, alongside the other whitelabeling options.
  • New memory tuning knobs for mastermind — the gunicorn preload toggle and the Celery per-child memory ceiling — are exposed as chart values and Compose environment variables, letting operators recycle worker children before they grow too large.

Improvements

  • API and web responses are now compressed at the edge (Traefik middleware for Helm, Caddy for Docker Compose), reducing bandwidth use and improving load times on large payloads.
  • Matrix and LiveKit network policies are now controlled by their own gate instead of the chart-wide networkPolicy switch, so chat networking can be managed independently; the behaviour is documented in the Matrix chat guide.
  • The Prometheus metrics exporter now uses dedicated health check endpoints for its readiness and liveness probes.
  • Prepared statements are disabled for psycopg3 connections, avoiding compatibility problems with connection poolers.

Bug Fixes

  • The ingress controller is now explicitly admitted by the Matrix homeserver and LiveKit JWT network policies, fixing blocked inbound traffic to Matrix chat.
  • Voice messages in chat now play correctly — blob: media sources are permitted by the content security policy in both deployment methods.

Core Component Activity

  • Waldur Helm: 38 commits - encryption key wiring, configurable country list, memory tuning values, network policy and ingress fixes.
  • Waldur Docker Compose: 32 commits - encryption key passthrough, memory tuning environment knobs, and Caddy compression and CSP updates.

Resources

8.1.0 - 2026-08-15

Highlights

This release makes the marketplace far more controllable for providers and operators. Offerings can now be restricted to specific roles, gated behind IP allow-lists, and made available through calls for proposals, while a new multi-tenant provider helpdesk lets service providers run their own support desks with SLA tracking and ticket routing. Billing gains volume discounts, an affiliate credit ledger and per-project credit attribution, so organizations can finally see where their credit actually goes. Operators also get POSIX UID/GID pool management, rotatable resource API keys with encrypted storage, network-restricted personal access tokens, and a substantially faster, lighter backend.

What's New

  • Service providers can run their own multi-tenant helpdesk: configure a desk per organization, route or re-route tickets to the offering's provider, track SLA and escalations, manage canned responses and a support team, with a full ticket workspace in the web UI.
  • Offerings can be restricted to specific user roles, hidden from users who cannot order them, and configured to skip consumer approval for chosen roles.
  • Access to resources can be limited by IP subnet: organizations manage one scoped allow-list, providers set defaults per offering, and consumers can add per-resource subnets when the offering opts in.
  • Marketplace offerings can now be requested through calls for proposals, with purchase-order requirements, requested subscription periods and cost previews carried through to the allocated resource.
  • Resource API keys can be rotated and revealed with encrypted storage at rest, including an inference service view and playground for LLM offerings.
  • Personal access tokens support network ACLs, so a token only works from approved subnets, with the changes recorded in the audit log.
  • New billing capabilities: volume-based component discounts, an affiliate program with a credit ledger and fee accrual, and credit compensation attributed per project.
  • POSIX UID/GID pools can be managed centrally and exposed through GLAuth, SCIM and offering user attributes, including per-project POSIX groups.
  • Providers can define SLURM Quality-of-Service levels per offering and allow-list them per partition; users choose a QoS when ordering.
  • Resource end dates can be requested and approved as a reviewable change request rather than edited directly, and terminated resources can be restored where the offering allows it.
  • Resources can be paused or downscaled automatically when reported usage reaches a component limit.
  • An AI assistant is now available to anonymous marketplace visitors, with full-text searchable conversation logs and a KPI dashboard for support staff.
  • New scope-aware event pub/sub lets agents and integrations subscribe to exactly the events they are entitled to, with an experimental realtime UI that refreshes views on push.
  • Organization-scoped custom roles let owners define and manage roles within their own organization.
  • Dun & Bradstreet is available as a company registry backend for onboarding organizations in Nordic countries; Khmer is available as an interface language.

Improvements

  • Maintenance announcements can be extended, ended early or cancelled, start and complete automatically on schedule, remain editable while scheduled, and record overrun metrics.
  • Call and proposal management was reworked: checklists per workflow step, technical assessments, conflict-of-interest confirmation, call-manager-driven step completion, and clearer read-only enforcement on archived calls.
  • Usage reporting is more forgiving: prepaid components accept usage, corrections can be re-billed after invoice finalization, and mid-month reports resolve the right plan period instead of being skipped.
  • Substantially reduced backend memory footprint and removed many N+1 queries across usage billing, cost policies, offering plans, user lists and site-agent tasks.
  • Table improvements in the web UI: pinnable columns, filters and sorting on offering resources, filter state scoped per table, and a fix for a multi-second refresh hang.
  • Sentry reporting now carries user context and API breadcrumbs, and events group by message instead of raw dictionaries; each deployment gets its own scheduled-job monitors.
  • API responses are compressed at the ingress in both Helm and Docker Compose deployments, and a field encryption key is wired through both for encrypted API key storage.
  • Numerous dependency upgrades to patch known CVEs across Python and JavaScript dependencies.

Bug Fixes

  • Credit consumption charts plotted net price rather than actual compensation, and the project credit dashboard was rebuilt around credit actually drawn.
  • OpenStack fixes: leaked instance ports are now reclaimed, tenant-linked images survive a global image pull, admin-created ports get the right tenant project, port security cannot be disabled while address pairs are set, and a tenant creation race with dependent provisioning was resolved.
  • Cost policies deducted credit twice from a policy's cost and reacted slowly when pausing resources; both are fixed, and gate evaluation now reads real invoice data.
  • Project and offering descriptions exceeding the length limit returned a server error instead of a validation message.
  • Concurrent token refresh no longer fails with an integrity error, and pre-existing accounts are adopted on OIDC login with an audit trail.
  • Order forms dropped OpenStack tenant and instance option values on submit, and preselected fields even when the choice was ambiguous.
  • Invitations are cancelled when a project is removed, expired invitations show proper details, and project-scoped invitations land on the project dashboard after joining.

Core Component Activity

  • Waldur Mastermind: 296 commits - provider helpdesk, access subnets, POSIX ID pools, affiliates and volume discounts, proposal workflow engine, performance and memory work
  • Waldur Homeport: 268 commits - helpdesk and AI assistant UIs, credit dashboards, call management redesign, table enhancements, extraction of shared packages
  • Waldur Helm: 38 commits - field encryption key wiring, API response compression, matrix network policies, memory tuning values
  • Waldur Docker Compose: 32 commits - field encryption key, response compression, memory tuning environment knobs

Resources

8.0.9 - 2026-06-21

Highlights

This release brings real-time team collaboration to Waldur with an integrated Matrix-based chat — including in-browser voice/video calls — available across projects. It also adds SCIM 2.0 identity provisioning, a structured proposal evaluation workflow, and substantially deeper OpenStack network management (topology views, router gateway control, effective routes, and RBAC sharing). Operators gain finer access control through per-user personal access token gating and entity-scoped tokens, while a broad security pass hardens authentication, webhooks, and API endpoints. The frontend completed a large-scale migration to a modern form and data-fetching architecture for better reliability and performance.

What's New

  • Team chat for projects — A new Matrix-based chat lets project members message each other and start fullscreen voice/video calls directly in the browser, with file uploads, drafts, reactions, and message history export. Deployable via the Helm chart and as an optional Docker Compose add-on (LiveKit + Tuwunel homeserver).
  • SCIM 2.0 identity management — Waldur can now act as a SCIM identity provider and pull users from external directories, enabling automated user lifecycle management with identity systems.
  • Proposal evaluation workflows — Calls can define multi-step evaluation workflows with manual and automatic transitions, responsible roles, per-step configuration, and a visual status stepper for applicants and reviewers.
  • Offering groups — Related offerings can be grouped together and managed from a dedicated provider tab.
  • Per-project order auto-approval — Projects can be configured to automatically approve marketplace orders, with a clear notice surfaced at checkout.
  • Resource limit change requests — Project members can request resource limit changes, with approval notifications and period-aware pricing shown in the UI.
  • OpenStack network tooling — New tenant network topology diagram (exportable as PNG), router effective-routes view, external gateway management, inbound RBAC share visibility, per-instance config-drive control, and connectivity diagnostics for instances.
  • Likert and rich-text checklist questions, plus support for file and multiple-file question types in checklists.
  • Personal access token controls — Per-user gating of token usage and entity-scoped token bindings that restrict tokens to specific resources.
  • Quick impersonate action from the global user search for staff.
  • Inference playground — Chat directly with a resource's vLLM endpoint from the resource view.

Improvements

  • Marketplace orders can require a purchase order on update, and offering descriptions support inline image upload.
  • OpenStack set_quotas now accepts network, subnet, port, floating-IP, and dynamic storage-type quotas; security group rules support custom IP protocol numbers.
  • Resource and project teams gained soft-delete with audit fields, batch end-date actions, and a "sync remote team members" staff action.
  • Site Agent diagnostics collection, offering-wide resource synchronization, and broker resilience/health-check tuning improve operational visibility.
  • TypeScript SDK generation was centralized with stronger typing across modules, and the frontend migrated forms, tables, and data fetching to react-final-form and React Query for fewer regressions.
  • Affiliation handling was redesigned with per-customer defaults and a mandatory-selection option.

Bug Fixes

  • Re-enabled CSRF protection on cookie-session authentication and blocked SSRF on OIDC discovery and webhook destinations; fixed an invoice-cost IDOR and restricted /api/query/ to staff.
  • Fixed OpenStack server-group operations against newer Nova APIs, floating-IP attach failures, and instance-creation race conditions.
  • Corrected component usage permissions so authenticated users no longer see all usage data, and fixed total-usage and invoice-period calculations.
  • Resolved numerous frontend crashes (floating-IP detach, contact panel, booking details, OIDC bootstrap) and client-side table pagination regressions.
  • Hardened auto-deactivation of role-less users and added an admin override.

Core Component Activity

  • Waldur Mastermind: 265 commits - Matrix chat, SCIM, proposal workflows, OpenStack networking, security hardening, and dependency upgrades.
  • Waldur Homeport: 300 commits - Matrix chat UI, workflow steppers, OpenStack topology/routing views, and a large form/data-fetching architecture migration.
  • Waldur Helm: 42 commits - Matrix chat stack, Traefik ingress support, Bitnami-style extension hooks, and worker health-probe fixes.
  • Waldur Docker Compose: 39 commits - Optional Matrix chat add-on with LiveKit calls and TURN relay.

Resources

8.0.8 - 2026-05-05

Highlights

This release introduces resource-level project management through a new ResourceProject system that lets service providers organize and invite users to projects directly on resources, alongside a major expansion of the AI Assistant with an agentic loop, new tools for proposals and reviews, and a public service-discovery chatbot. OpenStack support gets significant upgrades — instance rescue/unrescue, full load balancer (LBaaS) management in the UI, hypervisor capacity tracking via the Placement API, and router gateway management. Operators benefit from usage-based billing for OpenStack offerings, monthly component usage reporting, project affiliations with external organizations, and a science domain registry, while extensive serialization and pagination fixes resolve Go SDK compatibility issues and report performance.

What's New

  • Resource projects and unified permissions — Service providers can now create projects under a resource, invite users with specific roles, and apply per-project resource limits. Backed by a unified permission system that consolidates resource user roles (mastermind + homeport).
  • AI Assistant agentic loop and expanded tools — The AI assistant now runs an agentic loop with tools for marketplace search, proposal research, review workload management, and VM ordering. Includes user feedback collection, configurable system prompts, and a HomePort navigation block.
  • Anonymous service-discovery chatbot — A new public-facing chatbot for HPC Service Hub helps unauthenticated visitors discover offerings and calls, with rate limiting and PII protections.
  • OpenStack instance rescue/unrescue — Recover misconfigured instances by booting them from a rescue image without losing the original disk state. Available as a UI action.
  • OpenStack load balancer (LBaaS) management — Full UI for creating and managing load balancers, listeners, pools, members, and health monitors, with floating IP attachment, security group rules on VIP ports, and algorithm validation against provider capabilities.
  • OpenStack router external gateway management — New actions for setting and clearing external gateways and managing static routes from the UI.
  • Hypervisor capacity via Placement API — OpenStack capacity tracking migrated to the Nova Placement API with a new per-instance allocations diagnostic endpoint, allocation-candidates pre-flight check, and a hypervisor summary tab on the tenant page.
  • Usage-based billing for OpenStack offerings — Operators can now configure OpenStack offerings to bill by actual usage instead of upfront allocation [WAL-9841].
  • Monthly component usage reporting — Aggregated monthly usage records per offering component, with a new reporting page for service providers showing usage trends [WAL-9823].
  • Project affiliations with external organizations — Projects can now declare affiliations with external organizations, with admin UI and a project metadata editor [WAL-9846].
  • Science domain registry — New ScienceDomain/ScienceSubDomain registry with admin UI, preset loading, and editable per-project assignment [HPCMP-476].
  • Custom project slug templates — Customers and calls can now define project slug templates with live hint preview during project creation.
  • Resource grace period — Offerings can opt into a grace period before resources are downscaled or terminated; surfaced as a warning bar on projects and a flag on resources [HPCMP-477].
  • Project lifecycle badges — Projects show lifecycle state (active, ending soon, in grace period) in lists, cards, and resource flags.
  • GDPR-compliant address attribute on User — User profiles now include an address field that can be exposed selectively via offering attribute config.
  • AI Assistant message feedback collection — Users can rate assistant responses with a categorized feedback dialog [WAL-9486].
  • Reviewer invitation emails and rejection notifications — Reviewers receive emails when added to a call pool; requesters and Puhuri portal contacts receive notifications when permission requests or allocations are rejected.
  • Cross-organization notification isolation — Tests and behavior added to ensure notifications never leak across organization boundaries.
  • Restoring soft-deleted projects — Project recovery action graduated out of feature flag and available to staff.
  • Order timestamps in error and output logs — Orders now expose error_updated_at and output_updated_at for clearer troubleshooting [WAL-7982].
  • SET_CONSUMER_ORDER_INFO permission — Consumer-side users can respond to provider information requests on orders with a dedicated permission [WAL-9872].
  • ORDER.CREATE permission — Restricts order creation so customer readers cannot create orders.
  • Onboarding button on organization page — Direct access to organization onboarding from the organization list.
  • Usage-based pagination across reports — Server-side pagination added to offering cost reports, missing usage reports, and resources-by-offering tables for large dataset performance.

Improvements

  • Server-side pagination across reporting tables (offering costs, missing usage, resources-by-offering, usage monitoring) replaces client-side filtering for large datasets.
  • Marketplace landing page gets new layouts (carousel, sidebar, classic) with category sidebar, hero section, and configurable card styles.
  • AI Assistant drawer now supports expand/collapse, defers runtime mount until opened, and renders a richer resource list block with table data.
  • Plan details popup correctly shows the prepaid subscription period and remaining duration; resource change-limits dialog now shows remaining prepaid period instead of annual price.
  • Order summary and pending-confirmation drawer get UI polish: cleaner table headers, icon button consistency, hidden actions when empty, and avatar placeholder colors aligned with the design system.
  • OpenStack Octavia load balancer sync skips when the service is not in the catalog and is now part of TenantPullExecutor [WAL-9387].
  • Pending order tickets include prepaid total cost, slugs, and start/end dates in the description.
  • Pending order ticket created automatically when an order enters pending state.
  • Volume snapshot deletion cascades to delete the connected VM snapshot [WAL-9882].
  • Hypervisor summary tab added to OpenStack tenant management view, with capacity charts [WAL-7929].
  • Maintenance announcement template API now exposes affected_offerings.
  • Remaining group invitation tokens are removed when project details dialog is cancelled.
  • Resource end-date no longer enforces a 1-week minimum, giving operators full flexibility.
  • AI Assistant content saved to the chat history now matches what was displayed in the UI [WAL-9848].
  • AI Assistant for staff users can discuss generic, non-Waldur questions [WAL-9811].
  • AI Assistant uses keyword-based intent classification to load only relevant tools per query [WAL-9845].
  • Service provider chat offering filter correctly matches shared offerings [WAL-9799].
  • TOS management UI rewritten for consistency, with a pending TOS consent widget on the user dashboard [WAL-9874, WAL-9877].
  • Project slug template now applies when projects are created via API.
  • Identity bridge selection allows first/last name as user attribute choices.
  • Service desk request type management gets reorder validation and bulk activate/deactivate/delete actions.
  • Provider project list now has an expandable team subtable for service providers [WAL-9844].
  • Set consumer info action permission moved to the new SET_CONSUMER_ORDER_INFO permission [WAL-9872].
  • Retry order button now respects permission checks [WAL-9880].
  • Resource row actions correctly fetch project UUID for permission evaluation [WAL-9871].
  • Project team Details action restricted to staff/support [WAL-9875].
  • Apply action on calls table moved into the 3-dots dropdown for cleaner UX.
  • Reporting charts use lighter color palettes; summary widgets get improved spacing.
  • Pillow upgraded to 12.2.0 (CVE-2026-40192); lxml bumped to fix GHSA-vfmq-68hx-4jfw; dompurify upgraded to 3.4.0 (GHSA-39q2-94rc-95cp); xmldom upgraded to 0.8.13; Keycloak bumped to 26.6.1 (CVE-2026-4366, CVE-2026-4633); waldur-keycloak-mapper bumped to 1.4.0.
  • Python runtime upgraded to 3.13 on Debian Bookworm; Docker image switched from Alpine to Debian slim for fastembed/onnxruntime support.
  • Resource Add button hidden from users without CREATE_ORDER permission.

Bug Fixes

  • Numerous serializer fixes correct Go SDK unmarshal errors: minimal_price, plan prices, get_quotas return type, NestedPriceEstimateSerializer, scope_name field type, and access_url OpenAPI schema [PUHURI/SDK].
  • Fix IntegrityError on OpenStack image pull when duplicates are hidden, with regression test.
  • Fix N+1 queries in marketplace component usage list endpoint and avoid M2M JOIN + DISTINCT on offering-users endpoint [PUHURI-PORTALS-P52, Q1P].
  • Fix PlanComponent.DoesNotExist crash in set_limits for TOTAL limit components.
  • Fix quarterly SLURM policies broken by 0226 limit_period backfill, with repair migration [WAL-9907].
  • Fix prepaid field validation to allow null values on non-prepaid components [WAL-9908].
  • Fix volume discount applied to duration-multiplied quantity (frontend threshold check also corrected for prepaid components).
  • Fix prepaid duration calculation to use order start_date.
  • Fix CourseAccount serializer crash on null project dates.
  • Fix user_has_consent=false filter incorrectly excluding offerings with no consent records.
  • Fix IntegrityError and InvalidCursorName crash in sync_allocation_limits and SLURM periodic settings sync OOM.
  • Fix deactivated users unable to log in via OIDC with pending invitation; group invitations no longer blocked by OIDC_BLOCK_CREATION_OF_UNINVITED_USERS.
  • Fix UniqueViolation in constance key rename migration.
  • Fix verify_ssl not being passed to OctaviaClient connection [WAL-9388].
  • Fix user filter incorrectly including users with revoked project/organization roles.
  • Fix maintenance announcement affected_offerings missing from API response.
  • Fix scientific notation display in plan price editing.
  • Fix tool-call follow-up path crash and silent content drop in AI Assistant streamer.
  • Fix XSS vulnerabilities across markdown/HTML rendering components.
  • Fix dropdown pagination in cost policy, credit, issue project/resource, and move-to-project autocompletes [HPCMP-471].
  • Fix credit usage dialog showing wrong project name and incorrect filter.
  • Fix estimated total price value in plan section.
  • Fix permission request rejection notification to use full name as sender [WAL-9906].
  • Fix set_as_erred action exposure for orders in UI [WAL-9648].

Core Component Activity

  • Waldur Mastermind: 184 commits - Resource projects, AI assistant tools, OpenStack rescue/Placement API/LBaaS, usage-based billing, science domains, affiliated organizations, Python 3.13 upgrade.
  • Waldur Homeport: 160 commits - Resource projects UI, OpenStack LBaaS frontend, AI assistant agentic loop, marketplace layouts, server-side pagination for reports, useManagedMutation refactor, extensive UI polish.
  • Waldur Helm: 15 commits - Pull secret added to cleanup cronjob; release candidate version bumps.
  • Waldur Docker Compose: 16 commits - Keycloak 26.6.1 (CVE fixes), waldur-keycloak-mapper 1.4.0, release candidate bumps.

Resources

8.0.7 - 2026-04-09

Highlights

This release introduces Personal Access Tokens (PATs) for programmatic API access, upfront billing with prepaid components, and a fully redesigned reporting and analytics module. Policy enforcement is now more reliable with credit-aware evaluation, debounced month-boundary triggers, and clear attribution of automated actions. The AI Assistant gained VM creation capabilities, role-based access control, OpenAI API compatibility, and improved streaming reliability.

What's New

  • Personal Access Tokens (PATs): Users can now create, rotate, and revoke personal access tokens for programmatic API access, with a dedicated management UI and admin overview.
  • Upfront billing and prepaid components: Offerings can now use upfront billing with configurable prepaid durations, renewal constraints, and volume discount display in the order form.
  • Project end date change requests: Project members can request end date modifications through a formal approval workflow with notifications for approvals and rejections.
  • AI Assistant VM creation: The built-in AI Assistant can now create virtual machines through a guided multi-step flow with offering selection, inline streaming of tool results, and rendered UI blocks.
  • AI Assistant RBAC and customization: AI Assistant access can now be restricted by role, its name and organization are customizable, and it includes a disclosure statement for users.
  • Reporting and analytics overhaul: The reporting module has been completely redesigned with a new layout, toggleable report screens, chart export capabilities, proposal analytics, and user demographics dashboards.
  • Quota usage notifications: Automated email notifications are now sent when resource quota usage reaches 75% and 100%.
  • Batch project operations: Staff users can now batch-move and batch-delete projects, and batch-activate or batch-deactivate users.
  • Bulk article code updates: Staff users can find and replace article codes across offerings through a guided wizard.
  • Identity bridge allowed-fields endpoint: A new API endpoint exposes which identity bridge fields are available, and these fields are now shown on the user's own profile.

Improvements

  • Cost policy enhancements: Policies now account for available project/customer credits, include affected resource counts, debounce at month boundaries to prevent false triggers, and track actions with reversion history and event scopes.
  • OpenStack improvements: Load balancer management now uses the OpenStack SDK (Octavia), port security can be toggled during instance creation, fixed IPs are supported in port updates, and Nova microversion 2.47 is used for reliable flavor data.
  • Marketplace filters and API: Added resource attribute filters, slug filters on all slug-based endpoints, robot account search filters, and created_before/modified_before date filters.
  • Offering and resource management: Offerings now support helpdesk and documentation URLs, extensions lists on software packages, state counters for resource/user distribution, and a provider description field. Billing mode switching is generalized for all offering types.
  • Grace period visibility: Grace period information is now displayed in project cards, resource lists, resource details, and organization settings.
  • User management: Added deactivation reason tracking, gender field now uses string values, and OIDC claim parsing includes normalization. Staff can add deactivated users to teams.
  • Proposal system: Reviewers and proposal creators receive deadline approach notifications, staff can override COI blocks and reviewer invitations, and proposal analytics are available in reporting.
  • SCIM and site agent sync: SCIM sync now triggers on resource and user state transitions and offering endpoint changes. Site agent message deduplication can be bypassed for user-triggered updates.
  • Notifications default to disabled: All notifications are now disabled by default and must be explicitly enabled.
  • Marketplace layout customization: Admins can configure marketplace card style and layout mode, and select login page visual layouts through a preview selector.
  • Rebranded eduTEAMS to MyAccessID in the authentication UI.
  • E2E testing migrated from Cypress to Playwright.

Bug Fixes

  • Fixed price estimate fields returning numbers instead of strings.
  • Fixed renewal cost calculation not accounting for component factors.
  • Fixed ComponentUsage duplicates caused by plan period mismatches.
  • Fixed limit usage calculation consistency between panel display and policy enforcement.
  • Fixed credit deduction and policy evaluation race conditions.
  • Fixed policy actions bypassing Django signals, breaking STOMP notifications.
  • Fixed STOMP circuit breaker never recovering from OPEN state.
  • Fixed user deactivation sync for course accounts and inactive users.
  • Fixed internal comment flag not synced from Jira REST API.
  • Fixed N+1 queries on users, course accounts, and service provider users endpoints.
  • Fixed offering user creation race conditions and Gunicorn worker timeouts.
  • Fixed offering user usernames cleared on plugin options update.
  • Fixed duplicate key errors during structure import with existing offering users.
  • Fixed AI Assistant persisting full message instead of partial on stop and mid-stream disconnects.
  • Fixed resource panel showing stale usage when limit_usage is zero.
  • Fixed marketplace sidebar filter synchronization issues.
  • Fixed URLs with trailing slashes causing 404 errors.

Security

  • Bumped Django to address GHSA-5mf9-h53q-7mhq.
  • Bumped cryptography 46.0.6 to 46.0.7 to fix GHSA-p423-j2cm-9vmq.
  • Added osv-scanner dependency vulnerability scanning to CI pipelines.
  • Escaped user input in GLauth TOML config to prevent parse errors.
  • Added validation that security groups cannot be used with port security disabled.

Core Component Activity

  • Waldur Mastermind: 216 commits - PATs, upfront billing, policy improvements, AI Assistant enhancements, quota notifications, project end date requests, OpenStack SDK migration
  • Waldur Homeport: 180 commits - PAT management UI, prepaid billing forms, reporting overhaul, project end date requests, AI Assistant VM creation, Playwright migration
  • Waldur Helm: 31 commits - Configurable proxy buffer size, whitelabeling image pull secret, version bumps
  • Waldur Docker Compose: 28 commits - Keycloak upgrade with optional profile, removed deprecated FirecREST config, version bumps

Resources

8.0.6 - 2026-03-06

Highlights

This release delivers major API performance improvements by fixing numerous N+1 query issues across key endpoints, significantly reducing response times for large deployments. OpenStack gains Load Balancer as a Service (LBaaS) support and Application Credentials authentication, while the AI Assistant is hardened with sensitive data detection and injection prevention. Operators also get new feature flags for fine-grained UI visibility control and improved billing credit handling.

What's New

  • OpenStack Load Balancer as a Service (LBaaS). Backend support for managing load balancers via the OpenStack Octavia API.
  • OpenStack Application Credentials authentication. Operators can now connect OpenStack services using application credentials instead of username/password.
  • OpenStack instances reporting page. Staff users can view aggregate statistics and details for all OpenStack instances from a dedicated reporting page.
  • AI Assistant sensitive data detection. Chat input is now scanned for PII, credentials, and injection attempts before being sent to the AI model, with warnings displayed to users.
  • GPU architecture fields for software catalogs and partitions. Software targets and offering partitions now track GPU architectures, with filtering support in the UI.
  • Software catalog: multiple parent packages. Software extensions can now be linked to multiple parent packages instead of just one.
  • Staff user creation and password management. Staff users can now create and edit user accounts with password management through a step-by-step wizard.
  • SLURM policy force-period-reset. Staff can manually trigger a period reset for SLURM usage policies via a new API action.
  • SSH key change notifications. Optionally create support tickets when users add or remove SSH keys, configurable via Constance settings.
  • SSH key type restrictions. Operators can restrict which SSH key types (RSA, ED25519, etc.) are accepted, with the UI showing restrictions before import.
  • Feature flags for UI visibility. New toggles to conceal audit logs from end users, hide resource metadata, and restrict marketplace access to staff.
  • Quarterly usage aggregation. Resource usage can now be aggregated by quarter in addition to monthly and total periods.
  • Table growth monitoring UI. Administrators can view database table growth trends and trigger manual samples from a new settings page.
  • Visual login layout selector. Administrators can preview and select login page layouts from a visual picker in settings.
  • Offering user auto-deletion option. New plugin option to automatically delete offering users when they are removed, with sync restoration support.
  • Identity management improvements. ISD managers can create agent identities without offering users, and identity managers can list offering users scoped by ISD overlap.

Improvements

  • Extensive N+1 query fixes. Resolved N+1 queries on project list, project list_users, customer projects, robot accounts, service provider project_permissions, component usage, marketplace orders, and stats endpoints.
  • Django upgraded to 6.0.2. The backend framework has been updated from Django 5.2 to 6.0.2.
  • Structured logging migration. Mastermind now uses structlog for consistent JSON-formatted logs across API, Celery, and Django request loggers.
  • Bulk course account creation moved to background tasks. Large CSV uploads no longer time out — processing happens asynchronously.
  • Token refresh DB load reduced. An adaptive debounce interval prevents excessive database writes during token refreshes.
  • Migration squashing. 60 migration steps consolidated across 5 apps, speeding up fresh database setup and CI runs.
  • Locale-aware number formatting. Usage and quota displays now format numbers according to the user's locale.
  • Footer redesign. Application footer links have been consolidated and redesigned for better organization.
  • Table toolbar alignment. Search, filters, and action buttons are now consistently aligned in table toolbars.
  • Filter migration to generator. Multiple batches of hand-written table filters replaced with auto-generated versions for consistency.
  • Offering managers can set order states. Expanding self-service capabilities for service providers.
  • Invitation text extended to 2000 characters. Longer custom messages can now be included in invitations.
  • Marketplace resource pull action exposed. Users can now trigger resource sync from the UI for OpenStack instances, tenants, and volumes.
  • Helm chart supports image digest pulling. Deployments can now pin images by digest for reproducibility.
  • Dependencies bumped to address known security vulnerabilities in both Python and npm packages.

Bug Fixes

  • Fixed expired project credits not being zeroed and excluded from linear consumption calculations.
  • Fixed duplicate role creation when group invitations are auto-approved.
  • Fixed 500 error when X-Forwarded-For header contains a hostname instead of an IP address.
  • Fixed invalid auth state handling during social authentication flows.
  • Fixed resource duplication check incorrectly preventing all resource creation in remote marketplace.
  • Fixed corrupt NULL constance values crashing the settings endpoint.
  • Fixed GLAuth uidnumber generation to be scoped per offering instead of globally.
  • Fixed synchronous subtask call in SLURM policy evaluation causing Celery issues.
  • Fixed order unlink AttributeError by relocating get_order_scopes to the log module.
  • Fixed Atlassian support backend TypeError in pull_request_types.
  • Fixed image name parsing/grouping and increased flavor page size in instance deployment.
  • Fixed resource component quota display showing incorrect units and layout.
  • Fixed order details showing pricing when billing info is concealed.
  • Fixed stale "No association" warning after auto-approved group invitation.
  • Fixed various translation issues across Estonian, Lithuanian, and German locales.

Core Component Activity

  • Waldur Mastermind: 92 commits - LBaaS backend, N+1 fixes, AI assistant hardening, Django 6.0, structured logging, SLURM policy reset, SSH key management
  • Waldur Homeport: 56 commits - OpenStack reporting page, user management wizard, sensitive data detection UI, filter generator migration, footer redesign, feature flag support
  • Waldur Helm: 9 commits - Docker image digest support, helm-unittest migration
  • Waldur Docker Compose: 4 commits - Maintenance updates only

Resources

8.0.5 - 2026-02-23

This release strengthens AI Assistant security with prompt injection detection, introduces a hypervisor placement map for OpenStack instances, and adds configurable resource naming patterns for offerings. Operators benefit from several reliability fixes addressing webhook race conditions, Keycloak migration conflicts on upgrades, and billing calculation accuracy for total-period limits.

What's New

  • Prompt injection detection for AI Assistant. Incoming messages are now scanned against configurable regex patterns and scored for injection risk. Flagged messages are logged with severity and categories, and administrators can review detection events in the support logs.
  • Hypervisor placement map. OpenStack tenant instance lists now include a visual placement map showing VM-to-hypervisor distribution, with batch action support for selecting multiple instances.
  • Configurable resource naming patterns. Offering managers can define naming patterns for the suggest-name endpoint, and suggested names now use hyphens instead of underscores for consistency.
  • Cost breakdown dialog. Project dashboards now include a detailed cost breakdown dialog showing per-resource rates and usage for the current billing period.
  • Font family selection in branding. Administrators can choose a custom font family in the theme settings to match organizational branding.
  • Bulk user usage submission. A new API endpoint allows submitting usage data for multiple users in a single request.
  • OpenStack cloud demo preset. A new demo preset is available for quickly bootstrapping an OpenStack cloud offering with backend model support.

Improvements

  • Constance settings now support generic enum and multi-select field types in both the backend API and the administration UI.
  • Table filter components across the frontend have been migrated to auto-generated components based on the OpenAPI specification, improving consistency and reducing manual maintenance.
  • Resource action options are now sorted alphabetically by label.
  • Branding configuration modals have been adjusted to a more appropriate size.
  • Question mapping fields are now required when configuring onboarding checklists.
  • Resource component usage rendering has been refined with clearer limit-period display logic.
  • MQTT protocol support has been removed from the Helm chart RabbitMQ configuration, simplifying the messaging setup.

Bug Fixes

  • Fixed EESSI software catalog versions being incorrectly mixed across different catalogs.
  • Fixed a webhook dispatch race condition in the event emit handler that could cause missed or duplicate notifications.
  • Fixed Keycloak migration conflicts that caused InconsistentMigrationHistory errors on databases upgraded from older releases, and made the initial migration idempotent.
  • Fixed AI Assistant returning HTTP 400 errors when regenerating or editing responses with chat storage disabled.
  • Fixed billing calculation for TOTAL limit period resources that was incorrectly multiplied by the number of days.
  • Fixed N+1 query performance issues in course accounts and support comments endpoints.
  • Fixed pricing information showing in organization and project cards when the organization has cost display disabled.
  • Added missing Lithuanian translations for order metadata labels.
  • Fixed remote eduteams configuration and HAproxy redirect annotation in the Helm chart.

Core Component Activity

  • Waldur Mastermind: 23 commits - injection detection, configurable naming patterns, billing fixes, migration safety improvements.
  • Waldur Homeport: 24 commits - placement map, cost breakdown UI, filter generation migration, branding improvements.
  • Waldur Helm: 3 commits - MQTT removal, eduteams and HAproxy fixes.

Resources

8.0.4 - 2026-02-19

This release introduces Keycloak-based user role management for marketplace offerings, full OpenStack server group policy support, and a new system for auto-generating UI table filters from the OpenAPI schema. Several reliability fixes address invoice proration, resource state transitions, and mobile UI regressions.

What's New

  • Keycloak user role management. A new waldur_keycloak plugin enables service providers to manage Keycloak group memberships directly from offering settings, including importing remote groups, assigning memberships, and sending notification emails. The frontend provides a full management UI with bulk actions.
  • OpenStack server group policies. All OpenStack server group policies (affinity, anti-affinity, soft variants) are now supported. Users can create server groups and assign instances to them during deployment via a new scheduling step.
  • AI assistant chat logs. Support staff can now view AI assistant conversation logs in the support view, with expandable rows showing full chat history. Chat context retrieval has been moved server-side for better reliability.
  • OpenAPI-driven filter generation. Table filters can now be auto-generated from the OpenAPI specification, ensuring frontend filters stay in sync with backend query parameters. Several list views have been migrated to this approach.
  • User profile completeness tracking. Service providers can now filter offering users by profile attribute completeness and see field-level warnings. End users see a banner on resource pages when their profile is incomplete.

Improvements

  • Django upgraded from 4.2 to 5.2. The backend framework has been updated to the latest LTS release.
  • MQTT protocol support removed. Message delivery now uses STOMP exclusively, simplifying RabbitMQ configuration across Helm and Docker Compose deployments.
  • Configurable UI font family. Administrators can now select the portal font via a new FONT_FAMILY setting.
  • Sidebar "Match theme" style option. A new sidebar appearance option automatically matches the current theme colors.
  • Onboarding setup view redesigned. The admin onboarding question management interface has been refreshed with improved layout.
  • Permission deletion by type. User affiliation actions now support bulk and row-level permission removal based on permission type.
  • Software package API filters. New name_exact and is_extension filters added for more precise software package lookups.
  • OpenAPI schema quality improvements. View names and operation IDs are now exposed on UUID/URL filter fields, optional request bodies are marked correctly for SDK generators, and a naming collision detector prevents Go SDK build failures.
  • Resource limit validation. The update_limits endpoint now validates min/max bounds before accepting changes.
  • Auto-create default VM/Volume categories. OpenStack resource import automatically creates marketplace categories when they do not exist.
  • Disclaimer area reordered. The footer disclaimer now shows text before the logo with increased spacing.
  • Removed unused SITE_LOGO setting. The deprecated constance setting has been cleaned up from backend and frontend.
  • Header cleanup. Removed duplicate page title and extra search input from the navigation header.
  • Updated Lithuanian translation for the sign-in label.

Bug Fixes

  • Fixed MultipleObjectsReturned error in usage reporting caused by duplicate ComponentUsage records, including a migration to deduplicate existing data.
  • Fixed resources getting stuck in "Updating" state after a successful plan switch.
  • Fixed quarterly limit change invoice quantity proration calculating incorrect amounts.
  • Fixed Customer.get_owners raising AttributeError and deduplicated usage policy notifications.
  • Fixed OpenStack instance image name not being detected during resource pull.
  • Fixed mobile table filters not opening the sidebar drawer due to a missing context action.
  • Fixed pricing information being visible when billing info is configured to be concealed.
  • Fixed null date_created in the offering revision backfill migration.
  • Fixed remote eduteams configuration and HAProxy redirect annotation in Helm charts.
  • Fixed docker-logger permission denied error on docker.sock in Docker Compose setup.

Core Component Activity

  • Waldur Mastermind: 38 commits - Keycloak plugin, Django 5.2 upgrade, OpenAPI improvements, billing and state fixes
  • Waldur Homeport: 24 commits - Keycloak UI, server groups UI, filter generation, profile completeness, mobile fix
  • Waldur Helm: 3 commits - MQTT removal, eduteams and HAProxy fixes
  • Waldur Docker Compose: 3 commits - MQTT removal, docker-logger fix

Resources

8.0.3 - 2026-02-15

This release introduces two-way messaging between providers and consumers on pending orders, a new Identity Bridge API for push-based user attribute synchronization, and a system logs view for administrators. Multiple N+1 query fixes significantly improve API performance on key endpoints, and new feature toggles give operators finer control over marketplace visibility and offering lifecycle management.

What's New

  • Two-way provider-consumer messaging on pending orders. Providers and consumers can now exchange messages while an order is pending review, with email notifications for both sides. This allows clarifying order details without rejecting and re-submitting.
  • Identity Bridge API. A new push-based API enables external identity services to synchronize user profile attributes (organization, registry code) into Waldur without polling.
  • System logs view. Administrators can now view and filter recent Mastermind system logs directly from the admin panel and support view.
  • Order rejection comments. When rejecting an order, both providers and consumers can now include a reason, which is shown in the order details.
  • Provider approval with option modification. Service providers can review and modify resource options when approving an order via a dedicated approval dialog.
  • Renewal cost breakdown. The resource renewal flow now shows a detailed cost estimate via a new estimate_renewal API endpoint before the user confirms.
  • Offering-level backend_id validation rules. Operators can configure regex-based validation patterns for backend IDs on a per-offering basis.
  • Configurable disclaimer area. A new footer disclaimer area can display a custom logo and text, controlled via feature toggle and branding settings.
  • Group invitation custom text. Group invitations now support a custom welcome message, and the creator is hidden on public invitation pages.

Improvements

  • Service provider offering lifecycle controls. New configuration options allow operators to gate offering activation, pausing, and archival to service providers via feature flags, including restricting deletion of offerings with active resources.
  • Organization visibility controls. New feature toggles allow hiding organization-level information from project-level members and disabling the marketplace UI for end users.
  • Permission-aware resource actions. Frontend resource actions (terminate, change plan, change limits, etc.) are now hidden from users who lack the required permissions, with improved tooltips explaining why actions are unavailable.
  • OIDC email-based failover matching. When the primary OIDC identifier is missing, Waldur can fall back to email-based user matching.
  • Organization registry code on user profile. User profiles now include an organization registry code field, synced from identity providers and exposed in the Order API.
  • Duplicate invitation detection. The invitation form now warns creators when a duplicate invitation already exists for the same email.
  • Onboarding checklist setup. Administrators have an improved onboarding question management interface with predefined templates and better filtering.
  • Customer detail data scoped to visible projects. Customer API responses now only include projects visible to the requesting user, and GDPR name filtering now covers all name fields.
  • Service providers can set resource state to OK to manually recover resources, and SLURM policies are re-evaluated when limits increase on downscaled resources.
  • eduTEAMS refresh token rotation moved to Celery Beat for improved reliability as a periodic task.
  • Removed legacy django-admin-tools and django-fluent-dashboard dependencies.
  • Cache-based background task locking replaces equality-check deduplication for improved reliability.
  • Billing info concealment now respected in change limits, change plan, and renewal dialogs.
  • Helm chart improvements. Added secret support for kubeconfig and DataCite password, stomp ingress whitelist configuration, and invoice finalization grace period setting.
  • Lithuanian translations updated across user profile, invitations, terms of service, and organization fields.

Bug Fixes

  • Fixed N+1 query issues on public offerings, service provider, usage task, and users list endpoints by adding caching and optimized prefetching.
  • Fixed cost policy being bypassed for the first resource allocation.
  • Fixed Arrow vendor offering mapping serializer not accepting UUIDs, with updated frontend to match.
  • Fixed login redirect failing when the auth token is expired.
  • Fixed infinite re-render crash when opening drawers on the Resources tab.
  • Fixed offering filter not syncing correctly to the URL.
  • Fixed pricing display for daily-billed offerings showing incorrect amounts.
  • Fixed fractional values being rounded in resource component usage display.
  • Fixed ECharts crash when chart container is null after component unmount.
  • Fixed FreeIPA existing key handling and UVK ingress path type in Helm chart.

Core Component Activity

  • Waldur Mastermind: 59 commits - Provider-consumer messaging, Identity Bridge API, system logs, N+1 fixes, offering lifecycle controls
  • Waldur Homeport: 70 commits - Messaging UI, system logs view, rejection comments, permission-aware actions, billing display fixes
  • Waldur Helm: 10 commits - Secret support for kubeconfig and DataCite, FreeIPA fix, invoice finalization grace period
  • Waldur Docker Compose: 1 commit - Maintenance updates only

Resources

8.0.2 - 2026-02-05

Highlights

This release introduces an invoice finalization grace period, giving operators a configurable window to adjust invoices before they become final. Marketplace offering owners can now disable specific resource actions per offering, providing fine-grained control over what end users can do. OpenStack infrastructure discovery and software catalog management have been significantly improved with new admin tooling and a guided setup wizard.

What's New

  • Invoice finalization grace period. Invoices now enter a "pending finalization" state before becoming final, allowing operators a configurable window to make adjustments. Usage updates on already-finalized invoices are now properly rejected.
  • Disableable resource actions per offering. Offering owners can now selectively disable specific resource actions (e.g., terminate, change limits, move, synchronize, report usage, and more). Only staff users can modify these settings.
  • OpenStack infrastructure discovery. A new discovery wizard helps operators configure OpenStack offerings by auto-detecting available infrastructure, including external network support with dedicated models and API endpoints.
  • AI assistant chat session management. Backend support for logging, persisting, and managing AI assistant chat sessions, including role-based access control and automatic cleanup.
  • Software catalog administration. New admin UI for managing software catalogs with discovery capabilities, plus management commands for exporting, importing, and cleaning up software catalog structures. Catalog loading is now safer with improved validation.
  • Project move permissions expanded. Organization owners in both the source and target organizations can now move projects between them.
  • Separate customer contact update permission. A new CUSTOMER_CONTACT_UPDATE permission allows delegating contact information management without granting broader customer editing rights.
  • Event logs for deleted verifications. Verification deletion events are now logged for audit trail purposes.

Improvements

  • Version history API reliability. Fixed empty results for newly created objects and backfilled initial version history entries for existing resources.
  • SCIM entitlements refactored to use offering user usernames, improving compatibility with identity providers.
  • Customer list filtering extended with additional filter options.
  • Registration method is now exposed in the offering serializer by default.
  • Resource options validation now checks for pending orders before allowing updates.

Bug Fixes

  • Fixed SLURM QoS not updating correctly when downscaling allocations, with improved policy warning display when the site agent queue is misconfigured.
  • Fixed N+1 query performance issue on the marketplace orders list endpoint.
  • Fixed quarterly and annual billing limit changes creating duplicate invoice items.
  • Fixed invoice generation for annual billing periods.
  • Fixed TypeError when saving date values in offering plugin_options.
  • Fixed nullable partition field in software catalog serializer for SDK compatibility.
  • Fixed undefined variable exception in OpenStack backend.
  • Added debounce to global search to prevent rate limit errors on fast typing.
  • Fixed AI assistant token usage column showing in user list when the feature is disabled.
  • Fixed select field rendering in offering edit panel.
  • Fixed confirmation dialog input type for onboarding justification actions.
  • Fixed invitation translation strings.

Core Component Activity

  • Waldur Mastermind: 30 commits - Invoice grace period, disableable actions, OpenStack discovery, AI chat management, software catalog tooling, billing and permission fixes.
  • Waldur Homeport: 17 commits - Disableable actions UI, invoice state support, OpenStack discovery wizard, software catalog admin UI, search and rendering fixes.
  • Waldur Helm: 2 commits - Maintenance updates and CI fix for homeport tag setting.
  • Waldur Docker Compose: 1 commit - Maintenance updates only.

Resources

8.0.1 - 2026-02-03

Highlights

Waldur 8.0.1 is a major release that introduces Arrow accounting integration for automated license and consumption billing, a comprehensive analytics and reporting suite covering orders, users, provisioning, and resource geography, and a revamped SLURM policy management experience with visual previews and execution logging. Operators gain new tools for database growth monitoring, OIDC identity provider discovery, SCIM user synchronization, and event subscription queues for real-time integrations.

What's New

  • Arrow accounting integration. New module for syncing resources, consumption records, and billing data from Arrow, with a full management dashboard including customer mappings, vendor offering mappings, and import wizards.
  • Analytics and reporting suite. Added reporting pages for orders, user demographics, provisioning statistics, resource geography, usage trends, usage by organization type, project classification, offering costs, maintenance operations, and provider-level analytics.
  • SLURM policy visualization and logging. SLURM usage policies now include a visual preview, execution log viewer, status summary, and on-demand policy evaluation from the offering management page.
  • OIDC discovery. Administrators can now configure identity providers via OpenID Connect discovery, with a guided wizard that auto-discovers endpoints and claim mappings.
  • SCIM synchronization. Initial support for synchronizing user data to external systems via the SCIM protocol.
  • Event subscription queues. New SubscriptionQueue model enables external systems to subscribe to Waldur events and consume them via a pull-based API.
  • Resource version history. Resources now track changes via django-reversion, with a timeline UI showing diffs between versions.
  • Offering tag management. Offerings can be tagged and filtered by tags across the marketplace, with a dedicated admin interface for managing tags.
  • Database table growth monitoring. New scheduled task tracks table sizes over time with configurable alerts when growth exceeds thresholds, visible in the administration panel.
  • AI assistant usage accounting. Token consumption by the AI assistant is now tracked per user with configurable quotas, plus an LLM validation management command for quality assurance.
  • Storage folder manager. Initial skeleton for a new storage folder manager offering option type.
  • Project digest notifications. Project members can now receive periodic digest emails summarizing team activity, resource usage, and upcoming end dates.

Improvements

  • Extended user profile attributes. Users now have fields for country of residence, eduPerson assurance level, nationality, and affiliations parsed from AAI attributes. Administrators can define mandatory profile attributes that users must complete before accessing the platform.
  • Offering visibility modes. Marketplace offerings can be configured with visibility modes to control which users can see them.
  • Cross-field validators for offering options. Marketplace offering options now support greater-than, greater-than-or-equal, less-than, and less-than-or-equal validators with cross-field references.
  • Editable pending orders. Users with approval permissions can now update limits, attributes, and start date on pending orders.
  • Subscription renewal minimum set to 12 months. The minimum extension period for allocation renewals has been increased from 1 to 12 months.
  • Staff-only set_erred and set_ok actions. Staff users can now manually transition resources and routers to erred or OK states for troubleshooting.
  • Conditional checklist questions. Onboarding checklists now support conditional question logic based on previous answers.
  • Support users can manage announcements. The admin announcements feature is now accessible to support-role users.
  • OpenStack duplicate image handling. When duplicate image names are retrieved from OpenStack, only the most recently created image is used.
  • Service providers can update OpenStack quotas. OpenStack tenant quotas can now be updated by the service provider role.
  • Offering pricing tab toggle. A new feature flag allows hiding the pricing tab on offerings.
  • Unified wizard components. Wizard dialogs across the application now share a consistent step indicator and layout.
  • Improved pending invitations display. The user dashboard shows invitations in a more compact format with expiry badges.
  • Onboarding address fetching. Estonian and Austrian business registry validation now automatically fetches company address data.
  • Improved translations. Updated localization files for 23 languages.

Bug Fixes

  • Fixed a TransitionNotAllowed error when saving an OfferingUser in DELETED state.
  • Fixed RabbitMQ host resolution in the Docker Compose init script that was overwriting pre-set host values.
  • Fixed OpenStack network and subnet creation to use non-bulk API calls for better compatibility.
  • Fixed group invitation token handling during OAuth login flow.
  • Fixed one-time component price calculation returning incorrect values for zero quotas.
  • Fixed marketplace script pull and options handler in Kubernetes mode.
  • Fixed a 500 error when requesting specific fields via the API.
  • Fixed anonymous user filtering by organization in the marketplace.
  • Fixed missing pagination on the support page offering users list.
  • Fixed the Enter key triggering form submission in search filter bars.
  • Fixed the edit end date dialog sizing when many resources are affected.
  • Normalized country codes to uppercase when parsing schacPersonalUniqueID attributes.

Core Component Activity

  • Waldur Mastermind: 98 commits - Arrow integration, SLURM policy overhaul, extended user attributes, reporting endpoints, OIDC discovery, SCIM sync, event subscription queues, resource history API, offering tags, DB growth monitoring
  • Waldur Homeport: 83 commits - Arrow management dashboard, comprehensive reporting suite, SLURM policy visualization, OIDC discovery wizard, version history UI, offering tags UI, user profile rework, wizard unification
  • Waldur Helm: 2 commits - maintenance updates only
  • Waldur Docker Compose: 2 commits - maintenance updates only

Resources

7.9.8 - 2026-01-21

Release Summary

  • Release Impact: Minor release with configuration and documentation updates

Core Component Activity

  • Waldur Mastermind: No changes
  • Waldur Homeport: No changes
  • Waldur Helm: No changes
  • Waldur Docker Compose: No changes
  • Waldur Prometheus Exporter: No changes

Resources

7.9.7 - 2026-01-17

Release Summary

  • Release Impact: Minor release with configuration and documentation updates
  • SDK Updates: 3 auto-generated clients updated

Core Component Activity

  • Waldur Mastermind: No changes
  • Waldur Homeport: No changes
  • Waldur Helm: No changes
  • Waldur Docker Compose: No changes
  • Waldur Prometheus Exporter: No changes

SDK Updates (Auto-generated)

Py Client Highlights

  • Release: bump version to 7.9.7.
  • Update Waldur Python SDK.
  • Update Waldur Python SDK.

Js Client Highlights

  • Release: bump version to 7.9.7.
  • 7.9.7-dev.10.
  • Update Waldur TypeScript SDK.

Go Client Highlights

  • Update Waldur Go SDK.
  • Update Waldur Go SDK.
  • Update Waldur Go SDK.

7.9.6 - 2026-01-07

Release Summary

  • Release Impact: Minor release with configuration and documentation updates
  • SDK Updates: 3 auto-generated clients updated

Core Component Activity

  • Waldur Mastermind: No changes
  • Waldur Homeport: No changes
  • Waldur Helm: No changes
  • Waldur Docker Compose: No changes
  • Waldur Prometheus Exporter: No changes

SDK Updates (Auto-generated)

Py Client Highlights

  • Release: bump version to 7.9.6.
  • Update Waldur Python SDK.
  • Update Waldur Python SDK.

Js Client Highlights

  • Release: bump version to 7.9.6.
  • 7.9.6-dev.24.
  • Update Waldur TypeScript SDK.

Go Client Highlights

  • Update Waldur Go SDK.
  • Update Waldur Go SDK.
  • Update Waldur Go SDK.

Resources

7.9.5 - 2025-12-17

Release Summary

  • Release Impact: Minor release with configuration and documentation updates

Core Component Activity

  • Waldur Mastermind: No changes
  • Waldur Homeport: No changes
  • Waldur Helm: No changes
  • Waldur Docker Compose: No changes
  • Waldur Prometheus Exporter: No changes

Resources

7.9.4 - 2025-12-16

Release Summary

  • Release Impact: Minor release with configuration and documentation updates
  • SDK Updates: 3 auto-generated clients updated

Core Component Activity

  • Waldur Mastermind: No changes
  • Waldur Homeport: No changes
  • Waldur Helm: No changes
  • Waldur Docker Compose: No changes
  • Waldur Prometheus Exporter: No changes

SDK Updates (Auto-generated)

Js Client Highlights

  • Release: bump version to 7.9.4.
  • 7.9.4-dev.2.
  • Update Waldur TypeScript SDK.

Resources

7.9.3 - 2025-12-14

Release Summary

  • Release Impact: Minor release with configuration and documentation updates

Core Component Activity

  • Waldur Mastermind: No changes
  • Waldur Homeport: No changes
  • Waldur Helm: No changes
  • Waldur Docker Compose: No changes
  • Waldur Prometheus Exporter: No changes

Resources

7.9.2 - 2025-12-07

Release Summary

  • Release Impact: Minor release with configuration and documentation updates
  • SDK Updates: 3 auto-generated clients updated

Core Component Activity

  • Waldur Mastermind: No changes
  • Waldur Homeport: No changes
  • Waldur Helm: No changes
  • Waldur Docker Compose: No changes
  • Waldur Prometheus Exporter: No changes

SDK Updates (Auto-generated)

Py Client Highlights

  • Release: bump version to 7.9.2.
  • Update Waldur Python SDK.
  • Update Waldur Python SDK.

Js Client Highlights

  • Release: bump version to 7.9.2.
  • 7.9.2-dev.8.
  • Update Waldur TypeScript SDK.

Go Client Highlights

  • Update Waldur Go SDK.
  • Update Waldur Go SDK.
  • Update Waldur Go SDK.

Resources

7.9.1 - 2025-11-30

Release Summary

  • Release Impact: 23 commits across 4 core repositories
  • Functional Changes: 82 files changed with +4925/-1030 lines
  • SDK Updates: 3 auto-generated clients updated from OpenAPI schema

Statistics Note

Excludes tests, auto-generated files, and SDK client code for accurate development metrics.

Core Component Activity

  • Waldur Mastermind: 11 commits · 21 files changed (+2791/-557 lines)
  • Waldur Homeport: 9 commits · 54 files changed (+2125/-465 lines)
  • Waldur Helm: 2 commits · 7 files changed (+9/-8 lines)
  • Waldur Docker Compose: 1 commits
  • Waldur Prometheus Exporter: No changes

SDK Updates (Auto-generated)

Notable Changes

  • Check if WALDUR_OPENPORTAL during routes permission check. (349cad4 - Waldur Homeport)
  • Allow set of custom cluster issuer name for cert manager. (7ee2d14 - Waldur Helm)
  • Workarkound for changed API. (23c6904 - Waldur Mastermind)
  • Extend export/import of data. (9f50656 - Waldur Mastermind)
  • Set target version to 7.9.1. (7fc5104 - Waldur Helm)
  • Set target version to 7.9.1. (c7dc4e7 - Waldur Docker Compose)

Waldur Mastermind Highlights

  • Workarkound for changed API.
  • Extend export/import of data.
  • Add filter to exclude transitional resources with early pending orders.

Waldur Homeport Highlights

  • Fix bad error message when applying for a an available organization with already open request.
  • Migrate invitation form to react final form.
  • Reallocation limits UI changes.

Js Client Highlights

  • Release: bump version to 7.9.1.
  • 7.9.1-dev.2.
  • Update Waldur TypeScript SDK.

Resources

7.9.0 - 2025-11-30

Release Summary

  • Release Impact: 16 commits across 4 core repositories
  • Functional Changes: 114 files changed with +1405/-927 lines
  • SDK Updates: 3 auto-generated clients updated from OpenAPI schema

Statistics Note

Excludes tests, auto-generated files, and SDK client code for accurate development metrics.

Core Component Activity

  • Waldur Mastermind: 8 commits · 11 files changed (+377/-7 lines)
  • Waldur Homeport: 3 commits · 99 files changed (+1023/-915 lines)
  • Waldur Helm: 4 commits · 4 files changed (+5/-5 lines)
  • Waldur Docker Compose: 1 commits
  • Waldur Prometheus Exporter: No changes

SDK Updates (Auto-generated)

Notable Changes

  • [WAl-9443] Show review summary on in review proposals. (46b54e2 - Waldur Homeport)
  • Set target version to 7.9.0. (9d3756c - Waldur Helm)
  • Revert "Revert "Remove leftover path modifications"". (5ee8f11 - Waldur Helm)
  • Fix ingress condition. (63903a7 - Waldur Helm)
  • Revert "Remove leftover path modifications". (d8dd890 - Waldur Helm)
  • Set target version to 7.9.0. (58ceaa9 - Waldur Docker Compose)

Waldur Mastermind Highlights

  • Cleanup unused migration.
  • Add readonly viewset to list checklists for call organizers.
  • Expose additional fields for invoice items.

Resources

7.8.9 - 2025-11-30

Release Summary

  • Release Impact: 4 commits across 3 core repositories
  • Functional Changes: 8 files changed with +243/-38 lines
  • SDK Updates: 2 auto-generated clients updated from OpenAPI schema

Statistics Note

Excludes tests, auto-generated files, and SDK client code for accurate development metrics.

Core Component Activity

  • Waldur Mastermind: 2 commits · 6 files changed (+240/-35 lines)
  • Waldur Homeport: No changes
  • Waldur Helm: 1 commits · 2 files changed (+3/-3 lines)
  • Waldur Docker Compose: 1 commits
  • Waldur Prometheus Exporter: No changes

SDK Updates (Auto-generated)

Notable Changes

  • Request deletion of offeringuser upon removal from project. (9135636 - Waldur Mastermind)
  • Add validation that resources belong to the same offering for limit reallocation. (3c8adcd - Waldur Mastermind)
  • Set target version to 7.8.9. (39c5fea - Waldur Helm)
  • Set target version to 7.8.9. (fad7a57 - Waldur Docker Compose)

Resources