Release 26.9.0 – SSO and Multi-Instance WorkflowHub

This release adds single sign-on and multi-instance WorkflowHub support. Users can configure multiple WorkflowHub endpoints, choose where to publish workflow versions, and decide whether annotations should be kept when deriving samples from specimens.

---

UI

Repository: labid-ui

Highlights

Single Sign-On

LabID now supports single sign-on (SSO) when enabled by the server. The login page shows the institution’s SSO option while retaining username and password login, and provides clear feedback when SSO fails or a login link has expired. (c4659f5c)

Multi-Instance WorkflowHub

Users can configure API keys for multiple WorkflowHub instances and select the destination instance and team when publishing a workflow version. (6f10d109, 6a2d07c2)

Optional Annotation Inheritance

When deriving a sample from a specimen, users can now choose whether to keep the specimen’s annotations. (8783111c)

Improvements

• Workflow imports now accept GitHub and GitLab page URLs and automatically use the repository root, with a notice when the URL is adjusted. (68baaf42)
• Galaxy synchronization now explains invalid API keys and links directly to Galaxy and LabID settings for replacement. (9d7b79e4)
• Annotation Types are now grouped under Vocabularies, and breadcrumbs have been completed across workflow, ontology, search, and dataset-import pages. (10d6ef30, 2c50cf73, 8596330f)
• Workflow RO-Crate imports now use one repository selector instead of separate WorkflowHub and Galaxy menu entries. (ba862750)

Bug Fixes

• Fixed bulk deletion of selected records and clarified confirmation-dialog actions. (c1069eb2)
• Fixed incorrect active-menu highlighting for entries with similar labels. (7c5910bc)
• Prevented duplicate requests when browsing dropbox folders. (811ce87f)
• Prevented an empty Galaxy-instance selection and improved the configuration layout. (052907d5)

---

Server

Repository: labid-server

Highlights

Single Sign-On

The server now supports single sign-on and can provision users and group memberships from the institution’s identity provider. (5e6ce633)

Safer Galaxy Imports

Galaxy workflow and workflow-run imports now verify that pasted URLs belong to the selected Galaxy instance and return clearer messages for missing records, access problems, invalid API keys, and upstream errors. Galaxy hostnames without a scheme are normalized automatically. (d64b9d33, 6040625e)

Features and Improvements

• Workflow versions can now be published to a selected configured WorkflowHub instance. (0e4fe1c4)
• Workflow-related model labels and the electron-microscopy Grid Model field now display clearer names. (468d3a9c)
• Training deployments include richer light-microscopy data and a Galaxy workflow-run RO-Crate example. See Technical Notes.

Bug Fixes

• Fixed bulk deletion of selected records. (3ad2003c)
• Workflow files can be updated when their existing file path is submitted unchanged. (5e4ae2d2)
• Successful data registrations are no longer reported as failed when a follow-up dma-registration task encounters an error. (eacbdc4c)

---

CLI

Repository: labid-cli

Highlights

Faster CLI Startup

The CLI now caches server model metadata between commands and loads heavy dependencies and sniffer plugins only when needed, reducing startup time. (716494bb)

Features and Improvements

• Workflow-run registrations now record the CLI and sniffer versions used, and labid get sniffers displays each sniffer’s version. (d7569d24)

Bug Fixes

• --log-file now redirects logs exclusively to the selected file instead of also duplicating them in the console. (d3e051b0)

---

Lib

Repository: labid-lib

Highlights

Faster and More Reliable API Access

The client now reuses HTTP connections, applies request timeouts, and loads pandas only when required, improving startup and preventing stalled requests from hanging indefinitely. (25e4d76f)

Better Workflow-Run Provenance

Workflow runs registered through the Lib are marked as imported and receive a note identifying the Lib version used. Sniffers can now report their own versions as well. (5dca674e, 6dbe0b13)

Features and Improvements

• LabidManager.list_annotation_types() now returns fully initialized AnnotationType objects. (66962e90)

Bug Fixes

• Preserve the assay instrument when creating or updating assays from an instrument run. (66962e90)
• Galaxy workflow-run RO-Crates now tolerate null entities and preserve dataset names for flat collections. (35b89819, 6355efe6)

---

Upgrade Guide for System Administrators

• Docker Compose installations with existing PostgreSQL 11 data must migrate it before using the new PostgreSQL 14 image. See Technical Notes.
• Integrations using LabidManager.save_note() must remove the deprecated stocks_model_type argument. See Technical Notes.

Known Upgrade Issues

No additional upgrade issues are known.

Technical Notes

Server

Single Sign-On Configuration

• SSO supports OIDC and SAML2 and is configured through environment variables. Identity-provider attributes can be mapped to LabID usernames, email addresses, full names, and groups. (5e6ce633)
• New users without a mapped group are created as inactive for administrator review. Existing users retain their current memberships while newly supplied groups are added. (5e6ce633)

Container and Setup Changes

• Docker Compose now uses PostgreSQL 14 and supports Podman through the --podman option. Existing PostgreSQL 11 Compose data must be migrated before it can be used with the new image. (6cc3cc80)
• Setup markers, logs, and generated training credentials can now be stored in a persistent runtime directory through LABID_RUNTIME_DIR. Startup also restores a missing default timestamp authority when loading older training databases. (6cc3cc80)

Training Environment

• The generated training data now includes a light-microscopy assay template, microscope and instrument run, imaging channels, a mouse-brain extraction protocol, and CZI/OME-Zarr example data. (20d7615b, 887480c5, 6098e3a2)
• An example Galaxy workflow-run RO-Crate is included for training exercises. (15a63556)
• Training deployments use a dedicated CLI-enabled image and refresh certificate-revocation lists before generating timestamped fixtures. (86d44718, ca5b09ed, e8ce5b44, db1d90f8)

CLI

Model Metadata Cache

• Model metadata is cached per server and user for three hours by default. The lifetime can be configured under [modelmeta] in labidcli.ini or overridden per command. Use --modelmeta-cache refresh to force an update or --modelmeta-cache off to bypass the cache. (716494bb)

Lib

API Change

• LabidManager.save_note() no longer accepts the unused stocks_model_type argument. Integrations calling this method directly must use save_note(note_text, item_id). (6fbf9ccf)

View release page