The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.
Versioning update
In the previous releases we made some steps towards full support of versioning. This was even-though we analysed and detailed it till great detail a challenge. Since the Curriculum foundation is using an academic-year based versioning. A new versioning mechanism that would allow for instance to have 6 parallel versions of the same module, plan 3 years ahead with module being limited only by the end-date, have multiple versions of programs, etc. was pretty challenging and touches the basic foundation.
Next to the improvements listed in the release notes, we're working on the new versioning system. As said it is challenging, but we're making great progress. If the pace will stay as it is now, we plan for a specific release for interested institutions that want to be part of the beta test team in 2-4 weeks. We hope in 2, but it might be extended a little. A detailed description of the use cases, supported features, configuration, etc. will follow in a next phase. For now this is just a short heads-up we're making good progress.
Improvements
The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.
Fields configured as HTML-field should show the HTML editor - CUR-3838 (Hotfix on Acceptance)
It was noted that in some cases when a field was configured as string that should be displayed using the HTML-editor there was either a plain textbox or even no box shown. Two cases were reported on Acceptance that helped us finding the cause, and release a hotfix to solve this issue prior to a Production release
Permission not properly determined and respected - CUR-3834 (Hotfix)
It was noted that in some cases a users permission set was not correctly determined in case the user has roles both on faculty and study. It took some detailed analysis, but luckily the cause was found and solved.
The option to select assessment on the assessment-report should not require an additional permission - CUR-3734
On report pages the 'download' option is offered and also the option to select all or a limited number of items to be downloaded. It was noted that the behaviour of the select options shown was not the same on the different pages. Some pages required a specific permission to enable the select option, causing the dilemma of assigning too high permissions to enable selection, or less functionality by lacking the permission.
This has been fixed and report pages having the option to select one or more items will standard show the select option if the user of course has the right to view the report.
When saving a workflow description it should not add extra blank lines - CUR-3804
When changing the workflow description, shown at the top of the workflow to the users, blank lines were duplicated and thus causing the text to have double blank lines. This has been fixed, and saving will no longer introduce 'free' blank lines.
Dropdown menu's should show the correct label in all languages - CUR-3471
The dropdown menu's used for selection of reference values by a user was not showing the defined label for all languages. In some languages (Danish, French) the label was not shown, but only the code. This has been fixed and independent of the configured language the correct label will be shown, instead of the code.
Changing year should only change the year and not introduce a period - CUR-3471
In the structure tree, when changing year, a periodId was introduced in the URL. This caused the validation of the modules in the structure tree to use this 'non-existing' year/periodId combination and thus showing all modules strike through. This has been fixed and the 'free' periodId is no longer added.
The availability report should work - CUR-3856
The availability report was broken. When opening the report, it was loading forever, and no results were shown. This has been fixed and the availability report works again.
This means that the manager can report on the 'ad-hoc' defined unavailabilities as part of the generic weekly availability pattern.
The language switcher should not show the ISO code - CUR-3554
The language switcher shows the available language options in the system, allowing the users to switch languages. Not all ISO-codes used in this language picker are intuitive, e.g. ZH or ZH_HK, where others are EN, NL. In this release a change is made for the non-intuitive codes to show them in the appropriate language set, in this case the ZH and ZH_HK are shown as 繁體 and 简体.
The dashboard performance feels slow - CUR-3841
A report on a felt slowness of the dashboard loading lead to the identification of the Export widget to be the cause of the problem. Users having an export list (to be approved and exported pending changes) for the active year of over 5000 changes were affected.
The database guru found it a challenge, since 'this should not cause delays'. And he delivered with a change to the retrieval of the data the measured response was 300x faster.
The inward and outward links should be shown different - CUR-3493
Links between educational objects are shown on the link page. It was noted that the visualisation wether the link was inbound or outbound was not always the same. This has been fixed an the title for outbound links (e.g., Requires) is shown in bold and the title for inward links (e.g. is required by) are shown in bold-italic.
UI components seem to be a little off - CUR-3853
Due to an update of the TimeEdit share UI component library some visualisation were not 100% perfect. Buttons were slightly off, tooltip (information) having lots of white and strange colouring, dropdown icons not correctly aligned. Just a few smaller issues that affected the user experience. These have been fixed in this release.
Integration
The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.
OEAPI eduXchange should only return offerings for the active OEAPI year - CUR-3813
The OEAPI has is used for two generic products in the Netherlands. The first is the central Dutch registry of all programs and their offerings, called RIO. The second is a central Dutch course catalog where students can enrol in a minor or module at another institution with just one click.
The exchange of the offering information has been modelled to meet the 'RIO requirements', where the active OEAPI year and offerings from the previous x years were exchanged. eduXchange only expects the offerings that are related to the active OEAPI year, but also got the 'historic' ones.
A fix is applied that distinct the selection of the offerings based on the fact if the data exchange is with RIO or eduXchange.
OEAPI eduXchange should skip empty objects - CUR-3775
The defined standard pattern for OEAPI is that attributes that are not filled will not be exchanged in the message. This was implemented for attributes, but not for objects having no child attributes. This could lead to an empty object, if all the underlying attributes were empty and thus skipped.
A change is applied to validate if the object has no attributes, and if so the object itself will be skipped.
The practical implementation is the source object that can contain collaboration information or no information.
OEAPI should support the exchange of a videoUrl for eduXchange- CUR-3551
The OEAPI eduXchange consumer defines a specific extension (consumer) containing information especially for ecuXchange. The API definition has been extended with support for exchange of a videoURL to be shown with the minor or module in the central course catalog.
The consumer has been extended to support the object 'supplementaryInformation' to be defined per alliance and provide multiple language dependant URL's to the video.
Configuration
The definition has been made generic, to support the definition of the role, support multiple types and support the various language dependant URL's.
The configuration is done by adding a new object allianceSupplementaryInformation to the custom-fields on the course (or study).
The setup is shown in the image below:
- alliance: this field uses the already configured Alliance reference list to distinct video's between alliances
- role: in the specification the role is 'promo', in the configuration the role is bound to a reference list. The reference list is only populated with promo with a default selection of this single value. This setup allows for further extension by adding different roles to the reference list.
- type: in the specification the type is 'video', in the configuration the type is bound to a reference list. The reference list is only populated with video with a default selection of this single value. This setup allows for further extension by adding different types to the reference list.
- language: this field uses the language element list to select the language the video is in.
- value: the field containing the URL to the video. The label should probably say Video URL to make it clearer to the users.
And of course a new item page should be defined that is bound to this new object allianceSupplementaryInformation.
Please use the names shown, only change the labels shown to the user!
Activities sent to Data Manager should exchange their type - CUR-3845 (Hotfix)
An error was introduced that caused activities to be sent to Data Manager without their activity type. This caused error while sending, and the activities were not processes. This has been hotfixed and the data exchange with Data Manager is working again like it should do.
Security
An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.
Implemented security fixes - CUR-3863
It has been a while, but our automated security validation process reported a vulnerability. The reported vulnerabilities were investigated and fixed:
- CVE-2026-53633 (9.8): False positive, not vulnerable
- CVE-2025-66516 (XXE): Image service fix
Improve security based on extensive code analysis - CUR-3860
As stated in the previous release notes: on a regular base an extensive security audit is performed using black box testing. During this sprint an in-depth white box testing is done. White box testing is testing with access to the actual code, allowing not only to find vulnerabilities via API or other 'external' touch points, but in-depth analysis of the code for possible vulnerabilities.
Some minor issues have been identified, that are fixed in this release, by updating a package used for logging that fixes the following CVE's:
- CVE-2022-23302 (CVSS 8.8),
- CVE-2022-23303 (CVSS 8.1)
- CVE-2022-23305 (CVSS 9.8)
- CVE-2019-17571 (CVSS 9.8)
Refer to the Curriculum manual for configuration guidance.