| Issue |
Summary |
Resolution |
| POR-2482 |
Add endpoint to read a datasource without creating Query |
Done |
| POR-2453 |
Sync creds from license service |
Done |
| POR-2436 |
Fix feature flagging in EA and Chatbot |
Done |
| POR-2434 |
Content pack thumbnail |
Done |
| POR-2433 |
FE// Import content pack modal -> Object label overflow |
Done |
| POR-2432 |
FE// Publish Content pack success message typo |
Closed |
| POR-2431 |
FE// Content pack repo label overflow |
Done |
| POR-2428 |
FE// Imported blocks with credential references fail at runtime without import-time warning |
Done |
| POR-2427 |
FE// Content Packs Refresh produces no positive feedback on success |
Done |
| POR-2424 |
periodic synchronization of content packs |
Done |
| POR-2421 |
FE// Import Preview right panel: per-item mode entered by row click, no affordance to exit, no visual cue for clickability or selection |
Done |
| POR-2413 |
BE// Refresh fails against a freshly-created empty GitHub repo (no initial commit) |
Closed |
| POR-2412 |
FE// Edit credential silently wipes other fields (Repository URL / PAT / read_only) |
Done |
| POR-2409 |
FE// Improve Content pack view |
Done |
| POR-2408 |
Add tag support to the auth credentials CLI |
Done |
| POR-2407 |
Data migration for adding default read-only credentials to the Zuar Content Pack repository |
Done |
| POR-2406 |
FE// Content pack settings page |
Done |
| POR-2403 |
EA can't get full block content |
Done |
| POR-2402 |
Fix EA/Chatbot compose config setup |
Done |
| POR-2361 |
add generic /services/<name> nginx routing with /_internal guard |
Done |
| POR-2350 |
Start Databricks SQL warehouse before running integration tests |
Done |
| POR-2348 |
Prevent deletion of the default data source connection credential (target_database_url) |
Done |
| POR-2347 |
Content Packs |
Done |
| POR-2343 |
Add remaining Docker images used by Portal to ECR |
Done |
| POR-2342 |
Upgrade certbot version |
Done |
| POR-2328 |
Ability to disable chatbot debug mode at the server level (non-customer facing) |
Done |
| POR-2270 |
Stop upgrade if specified version doesn't exist |
Done |
| POR-2242 |
FE// Parameter Control — add column selection for dropdown values and labels (Dynamic Values) |
Done |
| POR-2234 |
FE// Remove automatic API requests while typing SQL — trigger on blur or explicit action only |
Done |
| POR-2356 |
View password button on login form |
Done |
| POR-2205 |
Migrate apitoolbox to UV + Ruff |
Done |
| POR-2199 |
FE// Admin sidebar — group menu items into collapsible sections |
Done |
| POR-2198 |
FE// Queries page — add Name field, Block/Data Source mapping, and Data Source filter |
Done |
| POR-2197 |
Migrate zuar-config to UV + Ruff |
Done |
| POR-2196 |
Upgrade Pydantic and FastAPI in `custom-portal-api` |
Done |
| POR-2195 |
Upgrade Pydantic and FastAPI in `auth` |
Done |
| POR-2194 |
Upgrade Pydantic and FastAPI in `apitoolbox` |
Done |
| POR-2190 |
Upgrade Pydantic in zuar-config |
Done |
| POR-2184 |
FE// Add autocomplete for context parameters and datasource references in SQL Query editor |
Done |
| POR-2183 |
FE// Add confirmation modal when switching Form Query to SQL Query (Code Editor) |
Done |
| POR-2179 |
FE// Add documentation/hint about datasource alias usage in block query SQL editor |
Done |
| POR-2357 |
Ensure selected block is in Code Editor |
Done |
| POR-2061 |
Pull all zindex rules into single file |
Done |
| POR-2015 |
Add software version to metrics so that CS can easily see who is running which version |
Done |
| Issue |
Summary |
Resolution |
| POR-2517 |
FE// Query edit on admin panel throws an error |
Done |
| POR-2500 |
SEC// Authenticated SQLi via datasources[].alias in POST /api/queries/execute-datasources — cross-table read, bypasses all SQL-parser guards |
Done |
| POR-2461 |
BUG: Duplicated page/blocks share state with originals — edits to duplicates mutate the OG page |
Done |
| POR-2457 |
FE// Themes admin list shows raw JSON instead of font names in Fonts column |
Done |
| POR-2456 |
FE// Help button links to https://www.zuar.com/docs/portal — ERR_CONNECTION_REFUSED |
Closed |
| POR-2455 |
FE// Multiselect parameter block: selected value resets to default immediately after selection (query-based options) |
Closed |
| POR-2454 |
BUG: Tableau Dashbaord is forced refresh when portal picks up a filter |
Done |
| POR-2451 |
FE// Power BI block fails to load for datasets without RLS — frontend unconditionally sends identities in GenerateToken |
Done |
| POR-2450 |
certbot fails with "Could not find a suitable TLS CA certificate bundle" due to leaked env vars from portal.env |
Done |
| POR-2445 |
FE// Select Filter: [ngRepeat:dupes] Duplicate key: TX when auto-selected value matches an existing option |
Done |
| POR-2444 |
FE// Adding a block to a page triggers a flood of onBlockEdited events (38+) for unrelated blocks |
Done |
| POR-2443 |
FE// Cascading Filter Group: TypeError: Cannot read properties of undefined (reading 'isLastPage') on option select in Single / Multi select filters |
Done |
| POR-2442 |
FE// HTML Block editor: Mapbox GL JS throws ReferenceError: a / s is not defined while typing/pasting HTML content (edit mode, before save) |
Done |
| POR-2440 |
FE// Content Pack card: GIF thumbnail not rendered despite being accepted by upload and exported to Git |
Done |
| POR-2439 |
FE// Sidebar -> Theme editor → Fonts → UNIT dropdown (px) is not clickable |
Done |
| POR-2438 |
FE// SQL Form Query Block: group_by field sent with escaped quotes → Databricks treats column as string literal → 500 [MISSING_AGGREGATION] |
Done |
| POR-2437 |
FE// New Content Pack → Thumbnail: closing file picker without selecting a file throws TypeError: Cannot read properties of undefined (reading 'size') |
Done |
| POR-2435 |
FE// Stale DS credential resolution in Import Preview allows import with broken credential references → DS list page crashes |
Done |
| POR-2426 |
FE// Partial render TypeError "Cannot read properties of undefined (reading 'width')" after importing a content pack containing a partial with blocks |
Done |
| POR-2423 |
FE// Stale pack-list state after credential read_only toggle: Delete buttons stay enabled, 403 on click |
Done |
| POR-2422 |
FE// Duplicate packs in list when two credentials point at the same repo (ngRepeat:dupes console error + broken UI render) |
Done |
| POR-2420 |
FE// Multi-DataSource warning: credential assignment propagates to other DSes silently, but warning badges don't clear → Import stays blocked |
Done |
| POR-2419 |
BE// Page slug not prefixed on import → URL collision with existing same-slug page on target (silent shadowing) |
Done |
| POR-2418 |
BE// customProperties on Page → Theme override is lost end-to-end during Content Pack round-trip |
Closed |
| POR-2417 |
BE// Skip-resolution on a child entity drops the parent's reference instead of pointing at the existing one |
Done |
| POR-2416 |
FE// Export to a read-only credential returns 403 and silently logs the admin out |
Done |
| POR-2415 |
BE// Export to a previously-empty repo fails with 500 after Refresh "recovers"; local clone never gains origin/main tracking |
Done |
| POR-2414 |
FE// New Content pack → Objects: checkbox click does not select; row click selects but checkbox stays unchecked |
Done |
| POR-2411 |
BE// Credential with empty read_only causes 500 on GET /api/content-packs/packs |
Done |
| POR-2410 |
FE// Repository URL can be saved as null on a Git PAT credential |
Done |
| POR-2397 |
LLM credentials editor on EA admin page is broken |
Done |
| POR-2392 |
FE// Code editor popup can be dragged off-screen and gets stuck — no way to recover |
Done |
| POR-2391 |
FE// ngRepeat:dupes error in Group by / Order by dropdown when datasource returns duplicate column names |
Done |
| POR-2390 |
FE// Named Credentials page spams TypeError "Cannot read properties of undefined (reading 'replace')" on load |
Done |
| POR-2389 |
FE// Long parameter name in Name dropdown overflows sidebar and shifts page content |
Done |
| POR-2388 |
Upgrade to 1.18.2 fails due to Alembic session mismatch (amica.zuarbase.net) |
Done |
| POR-2386 |
FE// inputFilter block sends ILIKE on integer column without CAST — query fails on non-text columns |
Done |
| POR-2385 |
FE// Saving Datasource column changes does not refresh dependent UI — DS Column types and Filter blocks' Columns list remain stale |
Done |
| POR-2384 |
FE// Query editor — alias defined in current Columns leaks into Column dropdown, generates invalid SQL |
Done |
| POR-2383 |
FE// Dynamic Values (Option Values / Option Labels) not configurable for filter blocks — section present but cannot be set |
Done |
| POR-2382 |
FE// TypeError "drawImage" on every page save — orphaned block screenshot calls after screenshot refactor (a434164a) |
Done |
| POR-2380 |
FE// Parameter Name dropdown pushes sidebar content to the left, text labels are clipped |
Done |
| POR-2378 |
FE// New Block is created with width 100% |
Closed |
| POR-2377 |
/api/docs broken |
Done |
| POR-2375 |
BE// SQLAlchemy QueuePool connection leak under sustained load (1.18.0) |
Done |
| POR-2372 |
2026Q2 Portal CVE Scan: CVE-2022-2309 (zwaf) |
Closed |
| POR-2371 |
2026Q2 Portal CVE Scan: CVE-2026-27135 (portal) |
Closed |
| POR-2370 |
2026Q2 Portal CVE Scan: CVE-2026-27135 (auth) |
Closed |
| POR-2369 |
2026Q2 Portal CVE Scan: CVE-2026-27135 (chatbot) |
Closed |
| POR-2368 |
2026Q2 Portal CVE Scan: CVE-2024-6119 (portal) |
Done |
| POR-2367 |
2026Q2 Portal CVE Scan: CVE-2024-6119 (chatbot) |
Done |
| POR-2366 |
2026Q2 Portal CVE Scan: CVE-2023-44487 (zwaf) |
Done |
| POR-2365 |
2026Q2 Portal CVE Scan: CVE-2023-35945 (zwaf) |
Done |
| POR-2364 |
2026Q2 Portal CVE Scan: CVE-2022-37434 (zwaf) |
Done |
| POR-2363 |
2026Q2 Portal CVE Scan: CVE-2024-5535 - (chatbot) |
Done |
| POR-2362 |
2026Q2 Portal CVE Scan: CVE-2024-5535 (portal) |
Done |
| POR-2359 |
Duplicating block and editing - results not as expected |
Done |
| POR-2355 |
FE// Modals > When opening modal, background flashes with black for a moment |
Done |
| POR-2354 |
FE// TypeError "Cannot read properties of undefined (reading 'columns')" when query has no valid data source |
Done |
| POR-2353 |
FE// Data Source in Admin panel > Issue with Column Types |
Done |
| POR-2352 |
FE// Query Editor in Admin Panel > Duplicate of error |
Done |
| POR-2351 |
FE// Confirmation modal broken portal-wide after PR #1735 — TypeError on any destructive action |
Done |
| POR-2346 |
Fix PBI RLS |
Done |
| POR-2345 |
FE// "Loading Themes..." loader persists after themes are already rendered on Themes page |
Done |
| POR-2344 |
FE// Theme sidebar shows "Change image" on hover instead of "Upload Image" when no image is set |
Done |
| POR-2340 |
FE// Deleting search input in Access picker triggers Confirm Block Removal modal |
Done |
| POR-2334 |
FE// Datasource SQL > SQL is missing |
Done |
| POR-2330 |
FE// Data Table shows "NaN - NaN of 1086" pagination when page_size is empty (All Records) — limit/offset returned as null |
Done |
| POR-2327 |
Query Page Size of 0 not shown in input |
Done |
| POR-2326 |
FE// Queries from partial blocks (header, sidebar, footer) execute even when partials are not enabled on the page |
Done |
| POR-2325 |
FE// Hidden block queries are registered and executed on every page load and filter change |
Done |
| POR-2318 |
Typing in Query column name highlights entire field |
Done |
| POR-2317 |
BE// MSSQL sql_form queries fail with "does not use a simple integer value for limit" |
Done |
| POR-2307 |
FE// Block becomes immovable after save — "Cannot read properties of undefined (reading 'width')" |
Done |
| POR-2294 |
FE// Navigation block — menu item label shows "Pages(s)" typo instead of "Pages" |
Done |
| POR-2282 |
FE// ParameterControl multiselect — no scroll appears when page size is too small, remaining options inaccessible |
Done |
| POR-2279 |
FE// Date range presets use stale timestamp — NOW calculated once at module load instead of on each use |
Done |
| POR-2262 |
FE// Translation Picker block throws "Cannot read properties of null (reading 'code')" in editor |
Done |
| POR-2237 |
FE// Empty SQL field triggers API requests resulting in 422 error — no empty validation before sending |
Done |
| POR-2236 |
FE// AmChart4 GaugeChart throws error when editing config with hands in editor mode |
Done |
| POR-2232 |
FE// AmChart4 block throws error when changing Chart Type between incompatible types |
Done |
| POR-2231 |
FE// Clear-filters-button block doesn't clear Parameter Control values |
Done |
| POR-2228 |
FE// Theme shows "(Applied based on user's groups)" label after changing Chart Theme without any groups configured |
Done |
| POR-2213 |
BE// Hide duplicate underscore endpoints from Swagger documentation |
Done |
| POR-2210 |
FE// Data Source editor — ngRepeat:dupes error when SQL returns duplicate column names |
Done |
| POR-2113 |
FE// Existing block does not open in sidebar after being added to page |
Done |
| POR-2106 |
FE// Page Theme – fonts property cannot be removed from Code Editor |
Done |
| POR-2096 |
BUG 1.16.6 New page is creating a duplicate of last page updated? |
Closed |
| POR-2063 |
FE// Font Family selector is slow and does not reflect selected fonts |
Done |
| POR-2387 |
Prompt for Block deletion when not expected |
Closed |