Zuar Portal v1.20.0

Notes

External JavaScript Libraries

  • Load external JavaScript libraries directly on an HTML block, with per-library Sync/Async loading and drag-to-reorder. Sync libraries are de-duplicated and ready before the block's own script runs. See External libraries.

Writeback API

Login and Authentication

  • New Admin > Login Page editor to edit the Login, Forgot Password, and Reset Password pages, with Portal Assets integration. See Edit the login page from Admin.
  • Always-on local admin login: keep a local administrator sign-in available even when single sign-on is enabled, as a recovery path during an identity-provider outage or SSO misconfiguration. See Local login fallback.
  • SAML deep links: query-string parameters such as page filters are now preserved through SAML login and applied after you sign in.
  • When your Portal is paired with Zuar Runner, a Runner link appears in the admin navigation.

Platform and Security

  • Upgraded the bundled PostgreSQL database engine from PostgreSQL 10 to PostgreSQL 18. See the 1.20.0 upgrade guide.
  • Upgrades now remove superseded interface files instead of letting them accumulate, and a backup no longer includes earlier backups.
  • The interactive API documentation endpoints (/api/docs, /api/redoc) are now disabled by default and can be enabled per instance.
  • Faster, more secure dependency management: pnpm across the UI subrepositories and a dependency-update cooldown policy.
  • Security updates and fixes: this release includes a range of security hardening across authentication, authorization, and service endpoints.

Breaking Changes

  • Upgrading to 1.20.0 upgrades the bundled database from PostgreSQL 10 to PostgreSQL 18. The upgrade runs automatically as part of the standard upgrade: it exports the database, restores it into the new version, and reverts to PostgreSQL 10 if any step fails. The Portal is unavailable while it runs, and it needs free disk space of at least three times the current database size. Self-managed deployments should review the 1.20.0 upgrade guide before upgrading.

Issues Resolved in this Release

New Features

Issue Summary Resolution
POR-2525 zPortal.writeback JS API (wrap /db_modifications/run) Done
POR-2524 Per-block external JS library loading (HTML block) Done
POR-2498 Runner login page in Portal Done
POR-2477 Always-on local login Done
POR-2459 Feature: Toggle to isolate Tableau blocks from portal filters bi directionally Done
POR-2446 Feature flag REST API docs Done
POR-2373 Portal Writeback UI Done
POR-1123 Ability to customize/edit login page via Portal admin area Done

Improvements

Issue Summary Resolution
POR-2519 Please log the content pack repo URI in ELK for an upload or publish event Done
POR-2501 Add 7-day PyPI dependency cooldown to uv config (portal, auth) Done
POR-2478 FE// Content packs: pagination Done
POR-2441 Content packs: pagination and sorting Done
POR-2430 Help text on chatbot config elements Done
POR-2404 Switch to pnpm Closed
POR-2396 Add hover state to login button Done
POR-2339 Update all Portal instances in licensing to default to the most recent Portal release Done
POR-2338 Scope effort necessary to allow customer-controlled upgrades Closed

Bug Fixes

Issue Summary Resolution
POR-2550 FE// Page created (or duplicated) via context menu stays in edit mode after Save Done
POR-2549 BE// S3 asset manager serves files with no Content-Type — images render as raw text Done
POR-2544 FE// Tableau block echoes portal-applied filters back to the portal - user's filter is overwritten or erased Done
POR-2543 FE// Range filters are written to the URL in a form the portal cannot read back - lost on reload and when shared Done
POR-2542 FE// Tableau block does not sync date filters in either direction Done
POR-2534 BE// SSO login loops when initiated at /login — post-login redirect targets /login itself, over http Done
POR-2531 FE// Chatbot block: links in assistant replies open in the same tab Done
POR-2520 1.19 BUG Theme colors not updating Done
POR-2510 SEC// Account enumeration on /forgot-password (existing user → 500, non-existent → 200); reset is also broken Done
POR-2507 SEC// Experience Assistant /admin/config requires authentication but not admin — any non-admin reads and rewrites the agent config Done
POR-2503 SEC// Chatbot service has no authentication — unauthenticated use of the AI (real LLM + data tools) and config tampering Done
POR-2502 SEC// Missing authorization on PUT /auth/config — any authenticated non-admin can rewrite the runtime configuration Done
POR-2516 Ensure EA links open in new page Done
POR-2515 Not able to upload assets in "js" folder Done
POR-2488 FE// Experience Assistant → LLM: newly created credentials don't appear in the dropdown until page reload Done
POR-2480 SEC// Information disclosure: non-admin user can read full datasource definitions (SQL text, schema) via GET /api/datasources Closed
POR-2479 SEC// Broken access control: non-admin user can execute DB modifications via POST /api/db_modifications/run Closed
POR-2460 Ensure qs params pass through SAML login and are honored by Portal Done
POR-2458 FE// Improve PowerBI auth payload logic Done
POR-2448 Security: Local-auth login writes plaintext user password to HashiCorp Vault Done
POR-2447 Security: OIDC `state` and `nonce` parameters are never verified Done
POR-2425 BE// Content Pack Objects picker: Queries shown as Query <8-char-id> regardless of actual name Done
POR-2518 1.17.4 Portal themes not saving PNGs in theme favicon/logo Done

Tasks

Issue Summary Resolution
POR-2530 Decouple OpenAPI JSON spec config from Swagger/ReDoc UI Closed
POR-2527 Prune non-current UI static bundles and source maps during make.sh upgrade Done
POR-2523 AQA// Automated regression coverage for 1.18.x patch bug fixes Done
POR-2521 AQA// Write automated tests for 1.19 release - new functionality and bug fixes Done
POR-2529 Upgrade Postgres version used Done