| Issue |
Summary |
Resolution |
| POR-2519 |
Please log the content pack repo URI in ELK for an upload or publish event |
Done |
| POR-2501 |
Add 7-day PyPI dependency cooldown to uv config (portal, auth) |
Done |
| POR-2478 |
FE// Content packs: pagination |
Done |
| POR-2441 |
Content packs: pagination and sorting |
Done |
| POR-2430 |
Help text on chatbot config elements |
Done |
| POR-2404 |
Switch to pnpm |
Closed |
| POR-2396 |
Add hover state to login button |
Done |
| POR-2339 |
Update all Portal instances in licensing to default to the most recent Portal release |
Done |
| POR-2338 |
Scope effort necessary to allow customer-controlled upgrades |
Closed |
| Issue |
Summary |
Resolution |
| POR-2550 |
FE// Page created (or duplicated) via context menu stays in edit mode after Save |
Done |
| POR-2549 |
BE// S3 asset manager serves files with no Content-Type — images render as raw text |
Done |
| POR-2544 |
FE// Tableau block echoes portal-applied filters back to the portal - user's filter is overwritten or erased |
Done |
| POR-2543 |
FE// Range filters are written to the URL in a form the portal cannot read back - lost on reload and when shared |
Done |
| POR-2542 |
FE// Tableau block does not sync date filters in either direction |
Done |
| POR-2534 |
BE// SSO login loops when initiated at /login — post-login redirect targets /login itself, over http |
Done |
| POR-2531 |
FE// Chatbot block: links in assistant replies open in the same tab |
Done |
| POR-2520 |
1.19 BUG Theme colors not updating |
Done |
| POR-2510 |
SEC// Account enumeration on /forgot-password (existing user → 500, non-existent → 200); reset is also broken |
Done |
| POR-2507 |
SEC// Experience Assistant /admin/config requires authentication but not admin — any non-admin reads and rewrites the agent config |
Done |
| POR-2503 |
SEC// Chatbot service has no authentication — unauthenticated use of the AI (real LLM + data tools) and config tampering |
Done |
| POR-2502 |
SEC// Missing authorization on PUT /auth/config — any authenticated non-admin can rewrite the runtime configuration |
Done |
| POR-2516 |
Ensure EA links open in new page |
Done |
| POR-2515 |
Not able to upload assets in "js" folder |
Done |
| POR-2488 |
FE// Experience Assistant → LLM: newly created credentials don't appear in the dropdown until page reload |
Done |
| POR-2480 |
SEC// Information disclosure: non-admin user can read full datasource definitions (SQL text, schema) via GET /api/datasources |
Closed |
| POR-2479 |
SEC// Broken access control: non-admin user can execute DB modifications via POST /api/db_modifications/run |
Closed |
| POR-2460 |
Ensure qs params pass through SAML login and are honored by Portal |
Done |
| POR-2458 |
FE// Improve PowerBI auth payload logic |
Done |
| POR-2448 |
Security: Local-auth login writes plaintext user password to HashiCorp Vault |
Done |
| POR-2447 |
Security: OIDC `state` and `nonce` parameters are never verified |
Done |
| POR-2425 |
BE// Content Pack Objects picker: Queries shown as Query <8-char-id> regardless of actual name |
Done |
| POR-2518 |
1.17.4 Portal themes not saving PNGs in theme favicon/logo |
Done |