The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.
Improvements
The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.
Permission not properly determined and respected - CUR-3834 (Hotfix)
It was noted that in some cases a users permission set was not correctly determined in case the user has roles both on faculty and study. It took some detailed analysis, but luckily the cause was found and solved.
The option to select assessment on the assessment-report should not require an additional permission - CUR-3734
On report pages the 'download' option is offered and also the option to select all or a limited number of items to be downloaded. It was noted that the behaviour of the select options shown was not the same on the different pages. Some pages required a specific permission to enable the select option, causing the dilemma of assigning too high permissions to enable selection, or less functionality by lacking the permission.
This has been fixed and report pages having the option to select one or more items will standard show the select option if the user of course has the right to view the report.
Dropdown menu's should show the correct label in all languages - CUR-3471
The dropdown menu's used for selection of reference values by a user was not showing the defined label for all languages. In some languages (Danish, French) the label was not shown, but only the code. This has been fixed and independent of the configured language the correct label will be shown, instead of the code.
Changing year should only change the year and not introduce a period - CUR-3471
In the structure tree, when changing year, a periodId was introduced in the URL. This caused the validation of the modules in the structure tree to use this 'non-existing' year/periodId combination and thus showing all modules strike through. This has been fixed and the 'free' periodId is no longer added.
The availability report should work - CUR-3856
The availability report was broken. When opening the report, it was loading forever, and no results were shown. This has been fixed and the availability report works again. This means that the manager can report on the 'ad-hoc' defined unavailabilities as part of the generic weekly availability pattern.
The language switcher should not show the ISO code - CUR-3554
The language switcher shows the available language options in the system, allowing the users to switch languages. Not all ISO-codes used in this language picker are intuitive, e.g. ZH or ZH_HK, where others are EN, NL. In this release a change is made for the non-intuitive codes to show them in the appropriate language set, in this case the ZH and ZH_HK are shown as 繁體 and 简体.
UI components seem to be a little off - CUR-3853
Due to an update of the TimeEdit share UI component library some visualisation were not 100% perfect. Buttons were slightly off, tooltip (information) having lots of white and strange colouring, dropdown icons not correctly aligned. Just a few smaller issues that affected the user experience. These have been fixed in this release.
Integration
The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.
Activities sent to Data Manager should exchange their type - CUR-3845 (Hotfix)
An error was introduced that caused activities to be sent to Data Manager without their activity type. This caused error while sending, and the activities were not processes. This has been hotfixed and the data exchange with Data Manager is working again like it should do.
Security
An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.
Implemented security fixes - CUR-3863
It has been a while, but our automated security validation process reported a vulnerability. The reported vulnerabilities were investigated and fixed:
- CVE-2026-53633 (9.8): False positive, not vulnerable
- CVE-2025-66516 (XXE): Image service fix
Improve security based on extensive code analysis - CUR-3860
As stated in the previous release notes: on a regular base an extensive security audit is performed using black box testing. During this sprint an in-depth white box testing is done. White box testing is testing with access to the actual code, allowing not only to find vulnerabilities via API or other 'external' touch points, but in-depth analysis of the code for possible vulnerabilities.
Some minor issues have been identified, that are fixed in this release, by updating a package used for logging that fixes the following CVE's:
- CVE-2022-23302 (CVSS 8.8),
- CVE-2022-23303 (CVSS 8.1)
- CVE-2022-23305 (CVSS 9.8)
- CVE-2019-17571 (CVSS 9.8)
Refer to the Workload Management manual for configuration guidance.