Release Notes

The following has been released to the Test environments on Oct 28th, but will not be released to production next week. We will let this feature sit in Test for a while before enabling it in Production, since it affects how you work with activities in Data Manager/Activity Manager

General improvement

Show all activities in Data Manager. All activities are now visible in Data Manager, even if they are sent to Activity Manager for scheduling or have been scheduled.

The reason behind this is simple. You should always have the full picture of all activities, regardless of where they are in the process.

So what has changed? 

In simple terms, it is no longer a "sending" that takes place, only a status change.

When sending activities to AM, it will receive a new status in DM called "Ready for scheduling". This means it will also be visible in AM with the status "Not scheduled". Once an activity has been scheduled, it will get the status "Scheduled" both in AM and DM.

When an activity is "Ready for scheduling" (and visible in AM), it can still be changed in DM like normal. The changes are of course reflected in AM, since they are the same activities.

When autoscheduling, and an activity fails to schedule, it will receive the "Failed" status both in AM and DM. Failure messages will be also be visible in DM

When activities are in "Ready for scheduling", they can be "sent back" to DM, either from the Activity series view in AM, or in DM, by selecting them and clicking "Send back to DM". The activities will then get the status they had before

We are also changing the behaviour on which activities that can be sent back and forth between DM and AM. We have previously included all activities for each primary object when sending, but now a single Activity Series can be set to "Ready for scheduling" without it affecting other series for the same primary object.

What's coming soon?

We are going to change the way we manage statuses in Data Manager, to make it clearer what is actually happening. This will be released to Test environments in good time before releasing the whole feature to production.

These actions will become status transitions instead. More info will come when it is released to Test environments

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

‍

Improvements

New functionality, user experience improvements and bug fixes. Issues marked as Hotfix were developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

The process configuration has been revamped - CUR-2733

As part of the migration done for all screens, one of the screens (functions) migrated this release is the process configuration screen. The focus has been on usability and a weekend-hobby project of Joris ended up as a new feature in the configuration screen.

The process screen has been split into 3 different tabs, that each focus at a part of the process definition.

At the bottom of the Process tab a new feature is added that shows the Process as a diagram with all statuses, the workflow and its pages used, notifications, transition, hooks, etc. Changes can be made directly in the process diagram, but it is not feature complete and is merely added to provide a visual representation of the defined flow and support to alter details of a defined status / transition.

The Admin tab should not fail when a required reference field has an empty default value - CUR-4564

When a required reference custom field had an empty default value configured accidentally (this is not supported for references from here), the Admin tab of the object showed error messages and could not be used. This has been fixed, and the Admin tab opens normally. The custom field form no longer stores an empty default value, and empty default values that were stored earlier are cleared during the upgrade.

‍

A finished process can no longer be reopened after its period has ended - CUR-4529

When a faculty in a process period had no dates, the period was treated as never ending, so a finished process could be reopened after the period had ended. Reopening left a status with no participants. Reopen is now refused after the period has ended, and an empty faculty date falls back to the date of the process period. A faculty set to be ignored no longer takes part in the process.

‍

Calculate of an effort list should be faster - CUR-4560

Calculate on the effort list of a study recalculated every module group and module below it as well, which could take about a minute. Calculate on an effort list now recalculates only the object of that list, dramatically reducing the time it takes..

The calculate on the effort report still recalculates everything below its starting point.

‍

Approving a deviating availability shows the tasks and hours again - CUR-4609

In the availability request report, approving a request with the option to automatically create a task for unavailability showed no tasks and no hours, and the close button of the window did not work. This has been fixed, and the task list and the amount of hours are filled again. Only task templates without a role and with Correctable on are offered.

‍

A role type decides whether it can be given to persons, teams or both - CUR-4480

Since the role type administration was rebuilt, every role could be given to a team as well as to a person. A role type now again has a setting that decides whether it can be assigned to persons, to teams, or to both. Both is the default and matches the behaviour until now.

Needs action: settings made for this before the role type administration was rebuilt could not be restored. If roles should only be given to persons or only to teams, set this again on each role type.

^

Filtered fields on the Admin tab should show their options - CUR-4345 (Hotfix)

On the Admin tab of an object, a select field whose filter refers to the object itself, for example a department filtered by the object's faculty, showed no options and showed the saved value as a number. This has been fixed, and the field now offers only the allowed options and shows the saved value by its name. Changing the faculty clears a department that the new faculty does not offer. Saving on the Admin tab after saving on a form page can no longer empty the department. Reports and the General tab also show the filtered value by its name.

‍

Versioning

Versioning has been available on the test environments and on dedicated additional versioning test environments for almost 3  months. The functionality is constantly extended and improved during this period and has reached the status to make it publicly available.

‍

A versioned module must be exportable to TE Server - CUR-4493

Exporting a versioned module failed with Academic year is required and stayed on Waiting for response. This has been fixed, and the module is exported for the year the export was started in. Offerings in the module, study, route and broker data now include their year, so the module offering mapping can use year.code.

‍

Rollover copies offerings and related data of versioned objects - CUR-4386

On an environment with versioning enabled, the rollover copied no offerings for year-less modules and studies, because offerings were matched to their object by year and a versioned object has no year. The rollover now copies, for every year-less module, module group, study, method and assessment that is active in the new year: its resources, its offerings with their blocks and custom values, group offerings, and efforts. Tasks keep their module. Running the rollover again does not create duplicates of these. The Migrate to versioning script now leaves the current version of each object without an end date, so the first rollover after migrating copies it.

Needs action: environments that ran Migrate to versioning before this version are not repaired automatically. Clear the end date of the current versions before the next rollover.

‍

Versioned objects should only be listed in the years they are active - CUR-4439

A versioned study, module group, module, method or assessment was listed in reports, pickers and study lists in years before its start date. These objects are now only shown in the years their start and end dates overlap. This also applies to the search. Advanced search gets a checkbox to include inactive objects (expired or not yet started), which is off by default. An expired year-based method or assessment is also no longer listed in its year.

‍

Integration

Extensions, improvements and fixes to the integrations: the Curriculum API, OOAPI, CSV import, and the data exchange with Data Manager, Core and the broker.

‍

Invalid requests get a clear error instead of a server error - CUR-3987, CUR-3980, CUR-2733, CUR-4485

Several kinds of invalid input to the API returned a server error (500). They now return a client error with a short, fixed message, and error responses no longer contain internal details:

• An invalid request body on the standard create and update endpoints returns 422 with the field errors.
• A malformed request body returns 400, also on the OEAPI endpoints.
• An invalid parameter on the OEAPI endpoints returns 422 with the name of the parameter.
• A malformed identifier or filter on the canonical API returns 400. In a bulk update, only that object is rejected.
• A missing path variable or unknown request parameter returns 404.

Integrations that read the text of an error response may see different text.

‍

The related objects API should be able to return direct memberships only - CUR-4313

The related objects endpoint of the canonical API returned the module groups a module belongs to directly as well as the groups above them. It now has an optional parameter recursive. It defaults to true, which keeps the current behaviour; with recursive set to false, only direct module and module group memberships are returned, in both directions. Study relations are not affected.

‍

Versioned studies, module groups, modules and rules can be imported without a year - CUR-4522

With versioning enabled, the study, module group, module and rule imports through the API and CSV now accept records without a year. Offerings still need a year. An offering or activity in a year-less module without a year is skipped with the message Offering requires a year or Activity requires a year, and the module itself is still saved. Without versioning, a missing year is now reported as Year is required instead of causing an error.

‍

Security

Our build process scans continuously for known vulnerabilities. Fixes are prioritised by impact: some go out as an immediate hotfix, others in the current or next sprint. See the central database of vulnerabilities for details.

Addressed security vulnerabilities - CUR-4569, CUR-4572, CUR-4575

Based on the in-depth vulnerability analysis the 'High' marked issues have been addressed:

• Any user could gain access to other persons' information,  e.g. competence, availability. This has been addressed and fixed.
• Security tokens could reach more functionality then they should. The validation is made more strict to limit only access to authorised functionality.

‍

Node.js -  Brotli RCE (CVE-2026-111497, 9.2 Node2Shell) - CUR-4568

One of the major vulnerabilities reported in the last 2 weeks has been analysed against the code base, addressed and hotfixed on test and production where applicable.

‍

Check the Workload Management Manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

‍

Improvements

New functionality, user experience improvements and bug fixes. Issues marked as Hotfix were developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

The process configuration has been revamped - CUR-2733

As part of the migration done for all screens, one of the screens (functions) migrated this release is the process configuration screen. The focus has been on usability and a weekend-hobby project of Joris ended up as a new feature in the configuration screen.

The process screen has been split into 3 different tabs, that each focus at a part of the process definition.

At the bottom of the Process tab a new feature is added that shows the Process as a diagram with all statuses, the workflow and its pages used, notifications, transition, hooks, etc. Changes can be made directly in the process diagram, but it is not feature complete and is merely added to provide a visual representation of the defined flow and support to alter details of a defined status / transition.

The maximum number of characters can be set up to 50.000 - CUR-4485

The Maximum number of characters setting on description types and custom fields can now be set up to 50.000 instead of 10.000.

‍

The Admin tab should not fail when a required reference field has an empty default value - CUR-4564

When a required reference custom field had an empty default value configured accidentally (this is not supported for references from here), the Admin tab of the object showed error messages and could not be used. This has been fixed, and the Admin tab opens normally. The custom field form no longer stores an empty default value, and empty default values that were stored earlier are cleared during the upgrade.

‍

The removed module popup  from the study structure should show the offering names - CUR-4477

In the remove module window on a study's programme structure the different removal options are shown. The option to only remove offerings of a module showed them by period, for example Term 1, even when the offering type has a name pattern. It now lists each offering by its name.

A finished process can no longer be reopened after its period has ended - CUR-4529

When a faculty in a process period had no dates, the period was treated as never ending, so a finished process could be reopened after the period had ended. Reopening left a status with no participants. Reopen is now refused after the period has ended, and an empty faculty date falls back to the date of the process period. A faculty set to be ignored no longer takes part in the process.

‍

Calculate of an effort list should be faster - CUR-4560

Calculate on the effort list of a study recalculated every module group and module below it as well, which could take about a minute. Calculate on an effort list now recalculates only the object of that list, dramatically reducing the time it takes..

The calculate on the effort report still recalculates everything below its starting point.

‍

Approving a deviating availability shows the tasks and hours again - CUR-4609

In the availability request report, approving a request with the option to automatically create a task for unavailability showed no tasks and no hours, and the close button of the window did not work. This has been fixed, and the task list and the amount of hours are filled again. Only task templates without a role and with Correctable on are offered.

‍

The subject matrix should not fail on untyped assessments - CUR-4576

The subject matrix showed a server error when assessments were selected and an objective was linked to an assessment without an assessment type. This has been fixed, and the matrix is shown. Assessments without a type are left out of the cells.

‍

A role type decides whether it can be given to persons, teams or both - CUR-4480

Since the role type administration was rebuilt, every role could be given to a team as well as to a person. A role type now again has a setting that decides whether it can be assigned to persons, to teams, or to both. Both is the default and matches the behaviour until now.

Needs action: settings made for this before the role type administration was rebuilt could not be restored. If roles should only be given to persons or only to teams, set this again on each role type.

Filtered fields on the Admin tab should show their options - CUR-4345 (Hotfix)

On the Admin tab of an object, a select field whose filter refers to the object itself, for example a department filtered by the object's faculty, showed no options and showed the saved value as a number. This has been fixed, and the field now offers only the allowed options and shows the saved value by its name. Changing the faculty clears a department that the new faculty does not offer. Saving on the Admin tab after saving on a form page can no longer empty the department. Reports and the General tab also show the filtered value by its name.

‍

Versioning

Versioning has been available on the test environments and on dedicated additional versioning test environments for almost 3  months. The functionality is constantly extended and improved during this period and has reached the status to make it publicly available.

‍

The modules and studies reports work again after a rollover on a versioning environment - CUR-4514

On an environment that was migrated to versioning before version 12.22 and then rolled over, the modules and studies reports failed with an error, and the module groups report showed rows more than once. The rollover no longer copies extra fields, capacity and descriptions onto versions, and the upgrade cleans up the copies already made, so every version has one set again. Values that were hidden since the migration are shown again. A field that was deliberately emptied after the migration gets its value from before the migration back. No manual step is needed.

‍

Send to broker on a versioning environment sends every active year of an object - CUR-4448

On an environment with versioning enabled, running Send to broker for one year marked year-less objects as sent, so their other years never reached the broker. The Send to broker and Delete from broker scripts no longer take an academic year as the selection filter. Each run sends every object for every published year it is active in, and only marks it as sent once all those years have gone out. Delete from broker always removes all years.

A year that is excluded from publication will not be sent.

‍

Rules of migrated objects should become year-less - CUR-4388

Migrate to versioning did not change the rules owned by the migrated objects, so they stayed tied to one year. The script now makes these rules year-less as well, so they are shown in every year their owner is active. If two copies of a rule share a code or external ID, the older copies get the year added to it. Running the script again also repairs environments that were migrated earlier.

‍

A versioned module must be exportable to TE Server - CUR-4493

Exporting a versioned module failed with Academic year is required and stayed on Waiting for response. This has been fixed, and the module is exported for the year the export was started in. Offerings in the module, study, route and broker data now include their year, so the module offering mapping can use year.code.

‍

Rollover copies offerings and related data of versioned objects - CUR-4386

On an environment with versioning enabled, the rollover copied no offerings for year-less modules and studies, because offerings were matched to their object by year and a versioned object has no year. The rollover now copies, for every year-less module, module group, study, method and assessment that is active in the new year: its resources, its offerings with their blocks and custom values, group offerings, and efforts. Tasks keep their module. Running the rollover again does not create duplicates of these. The Migrate to versioning script now leaves the current version of each object without an end date, so the first rollover after migrating copies it.

Needs action: environments that ran Migrate to versioning before this version are not repaired automatically. Clear the end date of the current versions before the next rollover.

‍

Versioned objects should only be listed in the years they are active - CUR-4439

A versioned study, module group, module, method or assessment was listed in reports, pickers and study lists in years before its start date. These objects are now only shown in the years their start and end dates overlap. This also applies to the search. Advanced search gets a checkbox to include inactive objects (expired or not yet started), which is off by default. An expired year-based method or assessment is also no longer listed in its year.

‍

Integration

Extensions, improvements and fixes to the integrations: the Curriculum API, OOAPI, CSV import, and the data exchange with Data Manager, Core and the broker.

‍

Subjects should be removable via the SUBJECT CSV import - CUR-4231

The SUBJECT CSV import has a new optional column remove. When set to true, the subject is removed from the faculty, study, module group or module on that row. The column must come after the description columns and before the custom field columns.

‍

Invalid requests get a clear error instead of a server error - CUR-3987, CUR-3980, CUR-2733, CUR-4485

Several kinds of invalid input to the API returned a server error (500). They now return a client error with a short, fixed message, and error responses no longer contain internal details:

• An invalid request body on the standard create and update endpoints returns 422 with the field errors.
• A malformed request body returns 400, also on the OEAPI endpoints.
• An invalid parameter on the OEAPI endpoints returns 422 with the name of the parameter.
• A malformed identifier or filter on the canonical API returns 400. In a bulk update, only that object is rejected.
• A missing path variable or unknown request parameter returns 404.

Integrations that read the text of an error response may see different text.

‍

The related objects API should be able to return direct memberships only - CUR-4313

The related objects endpoint of the canonical API returned the module groups a module belongs to directly as well as the groups above them. It now has an optional parameter recursive. It defaults to true, which keeps the current behaviour; with recursive set to false, only direct module and module group memberships are returned, in both directions. Study relations are not affected.

‍

Versioned studies, module groups, modules and rules can be imported without a year - CUR-4522

With versioning enabled, the study, module group, module and rule imports through the API and CSV now accept records without a year. Offerings still need a year. An offering or activity in a year-less module without a year is skipped with the message Offering requires a year or Activity requires a year, and the module itself is still saved. Without versioning, a missing year is now reported as Year is required instead of causing an error.

‍

Security

Our build process scans continuously for known vulnerabilities. Fixes are prioritised by impact: some go out as an immediate hotfix, others in the current or next sprint. See the central database of vulnerabilities for details.

‍

Addressed security vulnerabilities - CUR-4569, CUR-4572, CUR-4575

Based on the in-depth vulnerability analysis the 'High' marked issues have been addressed:

• Any user could gain access to other persons' information,  e.g. competence, availability. This has been addressed and fixed.
• Security tokens could reach more functionality then they should. The validation is made more strict to limit only access to authorised functionality.
• ‍

Node.js -  Brotli RCE (CVE-2026-111497, 9.2 Node2Shell) - CUR-4568

One of the major vulnerabilities reported in the last 2 weeks has been analysed against the code base and addressed and hotfixed on test and production where applicable.

‍

See the Curriculum manual for configuration guidance.

Welcome to the Hub release notes — this is the first one.

Hub release notes cover updates to the Hub itself and its configuration, as well as updates to its widgets. They also include updates to the new Schedule Viewer.

Updates to the underlying products continue to be provided by those products' own release notes.

This release lets administrators customise the descriptive text shown in the Registration widget and brings a set of accessibility improvements across the Hub, including more descriptive page titles. It also fixes an issue when editing text widgets that contain links.

This release is pushed to test on the release date and to production one week later.

New

• Editable Registration widget text
• What changed: Administrators can now set their own plain-text description on the Registration widget (Admin → App settings → Hub), with a 160-character limit, to better explain to students what they need to do in Registration.
• Note: This is a temporary solution. In the longer term this text will be replaced with dynamic, higher-level information, such as whether the registration period is open and whether the student has any selections left to make.

Improvements

• Accessibility improvements
  • Descriptive page titles: each page now has a browser tab title that describes the current page including the institution name.
  • Additional navigation and accessibility work, including Hub breadcrumb and title-block updates and an error-page heading-level fix.

Bug fixes

• Editing text widget titles that contain links
  • In Admin → App settings → Hub, you can now edit the Title field of a text widget that contains a link. Previously the link popup blocked editing the title, and removing the popup also removed the link.

This will be release on Test 29 October and on production one week later

Bug fixes Fixed incorrect sort order in object lists

The following was released to Test environments on October 22 and will be available on Production next week

Bug fixes

• Resolved an issue where sometimes text length counters and max limits would not be properly visible in the tables
• Resolved an issue where editing events with a right-click in a calendar section, would sometimes change multiple events without the user knowing it. Now, right clicking will change only the clicked event.

The following was released to Test environments on Oct 22 and will be available on production next week

New feature (edit: not included in this release. Will be released to test next week)

Show original preferences in Core. It is now possible to view Activity information directly on Reservations in Core. In the Reservation info panel, there is a new section that shows information from the Activity. This is very useful when comparing the scheduled outcome with the requested activity. Simply expand the new section to see the data. (Some values, like Constraints are not yet visible)

Re-apply filter from Activity. If a Room filter was used when scheduling, the filter is shown as it was configured. From here it is also possible to re-use that filter when changing a reservation. Simply click the filter icon next to the filter to apply the filter in the object list.

Bug fixes

• Resolved an issue where clicking a reservation in a reservation list changed the visible hours of the time axis. The visible hours now only change when the reservation is completely outside them.
• Resolved an issue where the year selector in the calendar’s date-picker popup didn’t show years that were only partly inside the calendar’s date range.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Study guide release schedule.

‍

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes.  Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

As a user I want an even faster Study guide - SG-717

The Study Guide response and usability is improved, focusing on the underlying subjects:

• Pages arrive complete and ready to read; Every page, both the public study guide and the administration pages, now arrives with its content already in place. Students no longer see an empty frame or loading placeholders while the page fetches its data. Forwards, such as opening the root address, a tab that is hidden or unknown, or the login page while already signed in, now happens before the page is shown, so readers land directly on the right page.
• Switching between tabs and pages is much faster; Switching tabs or opening a study or course page could take up to three seconds in our measurements. It now takes around a third of a second, and returning to a page you visited before it is even faster.
• Lighter pages and quicker administration screens;The overview pages now loads about a fifth less code, the editor, the date picker and formatted text are only loaded when a page needs them, and your institution's logo is loaded first so the page appears sooner. The administration pages for tabs, filters, widgets and parameters now need far fewer database queries to load.

‍

Import filters should be respected on every import - SG-794

The parameters import.studyFilter and import.moduleFilter limit which studies and courses are imported. A customer reported that the filters seemed to work only in the nightly import. When an import was started by hand, studies and courses that the filter no longer selected were not removed if they had been imported in the last few hours. Depending on the time zone this was up to 2 hours in Europe and up to 11 hours in Australia. The Import button on a study or course page also ignored the filter completely. This has been fixed:

• After an import of a year, every study and course the filter no longer selects is removed, however recently it was imported.
• The Import button on a study or course page now applies the filter as well. If the filter no longer selects that study or course, it is removed. Other studies and courses that no longer match are removed with the next import of the whole year.

‍

As an administrator I want more information on the Parameters page options - SG-794

Under Administration, Parameters, each parameter now has a question mark that explains what it does, with an example and where you will see the effect. When you edit a parameter, the explanation and its default value are shown above the fields.

‍

Switching off search engine indexing works again - SG-794

Setting the parameter analytics.indexing to false is meant to ask search engines not to index the study guide, but it had no effect. This has been fixed. If analytics.indexing is set to false in your environment, search engines will be asked not to index your study guide from this release on.

‍

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. ‍

For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

In this release no vulnerabilities have been reported.

‍

For more guidance on configuration and setup of Study Guide, use the relevant Study Guide manual.

‍

These release notes describe the improvements to the TimeEdit SOAP API. The changes were released to Test environments on October 22 and will be available in Production on November 3.

Integration

Extensions, improvements or fixes for the TimeEdit SOAP API.

Technical details are available in the developer changelog.

More stable response times during high load

When an integration sends many requests at the same time, the SOAP API now spreads the load more evenly so that the service stays responsive for everyone. If an integration sends more requests than can be handled at the moment, the extra requests get the response HTTP 429 Too Many Requests with a Retry-After time. The request has not been carried out and can safely be sent again.

Most integrations will not notice any difference. We still recommend checking that your integration retries after the given time and waits a bit longer between each new attempt (retry with backoff). 

If someone else maintains your integration, please pass this on to them.

Security

The SOAP API has been upgraded to newer versions of Java and the underlying libraries. There are no changes to the API itself.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

Improvements

New functionality, user experience improvements and bug fixes. Issues marked as Hotfix were developed in this sprint but applied to the previous release or directly to production, depending on impact.

The availability report should be accessible via the organisation - CUR-3774

In case availability-preference is collected on person level, and the person has a relation with an organisation, there was no option to report the person availability from organisation perspective. This has been added and the person availability can be reported from organisation level. In case an organisation has sub-organisation, the persons from the sub-organisations are also in the report.

A user requires the permission to view the schedule preference report, else an unauthorized message will be shown.

Assessments from a terminated module should not be rolled-over to a new year - CUR-4161

In case a module is terminated, the assessments were still copied to the new year. Since the assessments were actively filtered in the active year based on the 'terminated flag' of their owning module the didn't show up in that year. Since the owning module was not copied over and the assessments were, they suddenly popped up in the new year, because there was no owning module anymore,

A fix is applied to the roll-over and not only filter the terminated module, but also its assessments. Next to that the assessment report is extended with two new columns, the assessment's own Terminated and its (owning) module Terminated. This will allow in the active year to report the assessments from terminated modules and if needed move them to a new owning module.

Extend the usage of faculty fields in person related formulas - CUR-4201

There was no support for using formulas in person fields based on fields (and their values) defined on the person-related faculty. This has been added, and person fields can use faculty fields in their formulas.

As a user I want to enter the Other duration without fallback to preset options - CUR-3474

After choosing Other in a duration dropdown, typing a value considered a preset option, the duration switched the field back to this preset option. This has been adjusted and typing 1 will no longer switch back to the preset option, but allow the user to continue typing and define for instance12 hours. This defined value in Other will save 12 hours.

A preset is only matched against the value when the field first loads, until the user picks an option or types a duration. Clearing both hours and minutes on a required field also no longer refills the default preset.

As an administrator I want to exclude method and assessment types per faculty - CUR-1893

Via method-parameter page, an administrator can already exclude certain method-types within a faculty. However, the defined value were not respected in all pages offering a 'method selection'. The following changes are made to improve and extend the support:

• Next to the method type, also the excluded assessment type(s) can be defined per faculty
• The assessment and method type restrictions are applied to all pages offering a select option. This covers adding a method via the method tree or the methods list, the method and assessment forms, editing an activity, and adding an activity.

As an administrator I want to use hook to set values based on reference lists - CUR-4224

A hook has been added to enable setting a field value based on a reference list. The Set field value hook can set both reference-list and element fields using the code or external id. It also support usage of expressions that read another reference field, such as :studyId.city.

Time fields should be displayed as time (hh:mm) in reports - CUR-4356

The report pages showed time fields as a date-time instead of only the time. This has been adjusted and time fields are displayed as time in the format hh:mm.

As a user I want an organisation report - CUR-4208

It was found that there was no organisation report, something we completely missed. Luckily the question was asked, to make us realise and add the organisation report to the system. The organisation report has similar options to all other report pages (filter, add fields to report, export, etc.).

Integration

Extensions, improvements and fixes to the integrations: the Curriculum API, OOAPI, CSV import, and the data exchange with Data Manager, Core and the broker.

CSV should support definition of start and end date for version based objects - CUR-4378

The CSV upload doesn't provide the option to specify start and/or end date for versions objects. This causes the objects to appear in every defined year.

The change made is to add optional start_date / end_date columns (yyyy-mm-dd) to the method, assessment, module, module group, study, qualification, organisation and faculty CSVs, directly after version (or after the names where there is no version). 

The method and assessment importers now store the dates similar to the other objects. A blank cell will keep the existing date.

Specification already had support for start and end date, and is therefor not mentioned in the objects that are extended.

CSV import of specification and organisation should show errors - CUR-4436

When importing specifications or organisations using the CSV import, they always show a success. In case rows in the import fail, they are not shown as error / warning in the result report. The change applied makes sure specification and organisation CSV imports now report row errors. A row with an invalid value, such as two values in a single-valued field or an unknown reference, is counted as failed. The errors are shown as import result to the user and logged in the job log, similar to the other imports.

Security

Our build process scans continuously for known vulnerabilities. Fixes are prioritised by impact: some go out as an immediate hotfix, others in the current or next sprint. See the central database of vulnerabilities for details.

Overarching roles should not be able to proceed the workflow - CUR-4275

Maybe not really a security issue, but it's different then a functional change. It was found that a user that is in a role against a workflow but is not the owner was able to send the workflow to the next step. A typical use case could be a “teacher” and “coordinator” that both perform a data collection task for a module. The teachers can put in their data but are not allowed to submit the module, only the coordinator is.

This has been fixed and only a participant who holds the owner role on the object the workflow runs for, can now send it to the next step.

Check the Workload Management Manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

Improvements

New functionality, user experience improvements and bug fixes. Issues marked as Hotfix were developed in this sprint but applied to the previous release or directly to production, depending on impact.

The availability report should be accessible via the organisation - CUR-3774

In case availability-preference is collected on person level, and the person has a relation with an organisation, there was no option to report the person availability from organisation perspective. This has been added and the person availability can be reported from organisation level. In case an organisation has sub-organisation, the persons from the sub-organisations are also in the report.

A user requires the permission to view the schedule preference report, else an unauthorized message will be shown.

Assessments from a terminated module should not be rolled-over to a new year - CUR-4161

In case a module is terminated, the assessments were still copied to the new year. Since the assessments were actively filtered in the active year based on the 'terminated flag' of their owning module the didn't show up in that year. Since the owning module was not copied over and the assessments were, they suddenly popped up in the new year, because there was no owning module anymore,

A fix is applied to the roll-over and not only filter the terminated module, but also its assessments. Next to that the assessment report is extended with two new columns, the assessment's own Terminated and its (owning) module Terminated. This will allow in the active year to report the assessments from terminated modules and if needed move them to a new owning module.

Assessment matrix sorting should be consistent with other matrix reports - CUR-4421

The standard sorting order for the matrix reports should be first sorting on phase, then period, like in the other matrix reports. Next to that it was found the sorting of the structure (study -> group) was not equal to the default sorting used in structure view.

Both have been changed and all matrix reports will follow the standard phase, period sorting and the study->module-group ordering

Extend the usage of faculty fields in person related formulas - CUR-4201

There was no support for using formulas in person fields based on fields (and their values) defined on the person-related faculty. This has been added, and person fields can use faculty fields in their formulas.

Improve usability of the version-based module-group and module creation - CUR-4143

When creating a new module-group or module the context the 'create' was initiated was not used. The changes made are:

• Copy from an selected object prefills the version as the source and the definition as both the source and destination.
• Create a new module/module-group will also show the option 'copy of', to not only allow to create one from scratch, but also use an existing module/module-group and version combination.

The advised route-planner overview should show the time blocks - CUR-4201, CUR-4445

The migration to the new look and feel had accidentally removed the display of the advised route with the relevant time-blocks. In this release this view has been added and the display shows the modules again in a grid-view using the time-blocks.

Modules without an active offering should not be shown strike-through - CUR-4374

The strike-through of modules in the structure view was used both for terminated modules and modules with no active offering. This causes issues for users to distinct the two variations. A change is made to use the strikethrough only for terminated modules. The module with no offering in the selected year are shown without strike-through and can be identified since they have no offering information.

In case there is a requirement to show both strike-through, the configuration option to show modules without offering as strike-through can be set.

Specification subjects page should filter on specification related categories - CUR-4218

The filter for specification subjects was incorrect and has been adjusted to only retrieve the specification own subject categories, instead of every subject category in the environment.

As a user I want an overview of unused offerings - CUR-4346

There was no option to get an overview of all unused offerings in the offering report. This option has been added with the following underlying logic to determine if the offering is unused:

1. Is the module linked to a study, if not the offering is considered unused.
2. If linked, does it have the setting 'no alternative offering' (default) or 'alternative offering AND the offering is selected as alternative). If one of the two settings is matched, the module is considered used.

As a user I want to see the changes made on form pages (experimental) - CUR-2140

As part of the improvements on the audit trail, and an outstanding feature request, a new option for form pages is introduced.

This option adds support to configure a form page to show 'read-only', 'edit' and/or 'history' information. In case multiple options are selected, the 'default' option can be defined and the other selected options will be shown as buttons to switch between the views.

The added option is the 'history' option. In this case the new value and the old value are shown in the form, so the user can easily identify the changed information. E.g. in a validation process. The way of working is more or less similar to the description pages that already offer support for visualising the 'changes' in context of the description page.

The image below shows the different options as buttons, with the Change view selected. The new values are highlighted. In case an 'old' value is replaced, both the old and new value are shown.

An additional change is made to the form page where fields were shown as 'read-only'. During save these read-only fields were validated, and in case the field was filled incorrect the save would fail with no reference to the incorrect field. The save is adjusted to only validate and save the 'editable' fields on the pag.

Configuration:

• Use the modes option to define the supported mode(s) offered to the user
• Use the default mode to specify the standard selected mode in case multiple modes are selected.

Experimental feature:

This change is for the upcoming 2 releases marked as 'experimental feature'. This means that the standard used form pages are using the 'old' way of working. When toggling the 'experimental feature', the new way of working is used. This choice is made, since it's not only an extension of the options but also a complete technical rebuild of the form page. This allow admins to test specific form pages and play around with the options.

As a user I want to export a program changes report to PDF - CUR-2692

As part of the audit trail related changes, the reports in the user interface have been changed and extended with new options. In this release the function the Download menu of the reports is extended with a PDF option, next to CSV and Excel. 

The PDF holds the selected rows in landscape, with the column headings repeated on every page, the page title and object at the top, your logo, and the print date and page numbers in the footer.

Moved to the next release

A PDF of a report that has textual changes other than Western-European script, e.g. Chinese, are not yet displayed correctly. This will be picked up as a remaining issue.

As a user I want to enter the Other duration without fallback to preset options - CUR-3474

After choosing Other in a duration dropdown, typing a value considered a preset option, the duration switched the field back to this preset option. This has been adjusted and typing 1 will no longer switch back to the preset option, but allow the user to continue typing and define for instance12 hours. This defined value in Other will save 12 hours.

A preset is only matched against the value when the field first loads, until the user picks an option or types a duration. Clearing both hours and minutes on a required field also no longer refills the default preset.

As an administrator I want to exclude method and assessment types per faculty - CUR-1893

Via method-parameter page, an administrator can already exclude certain method-types within a faculty. However, the defined value were not respected in all pages offering a 'method selection'. The following changes are made to improve and extend the support:

• Next to the method type, also the excluded assessment type(s) can be defined per faculty
• The assessment and method type restrictions are applied to all pages offering a select option. This covers adding a method via the method tree or the methods list, the method and assessment forms, editing an activity, and adding an activity.

As an administrator I want to use hook to set values based on reference lists - CUR-4224

A hook has been added to enable setting a field value based on a reference list. The Set field value hook can set both reference-list and element fields using the code or external id. It also support usage of expressions that read another reference field, such as :studyId.city.

As a user I want to report on specifications from organisation and faculty - CUR-4340

With the change in previous release to support to define the relation between a specification an the organisation, the option was opened to report the specifications for a specific organisation. In this release a new report page is added 'specification-report' that can be used both from a faculty and organisation perspective. The report will list the related specifications to the selected faculty / organisation with similar options to all other report pages (filter, add fields to report, export, etc.).

Time fields should be displayed as time (hh:mm) in reports - CUR-4356

The report pages showed time fields as a date-time instead of only the time. This has been adjusted and time fields are displayed as time in the format hh:mm.

As a user I want an organisation report - CUR-4208

It was found that there was no organisation report, something we completely missed. Luckily the question was asked, to make us realise and add the organisation report to the system. The organisation report has similar options to all other report pages (filter, add fields to report, export, etc.).

Integration

Extensions, improvements and fixes to the integrations: the Curriculum API, OOAPI, CSV import, and the data exchange with Data Manager, Core and the broker.

Asset CSV import should import unit cost columns- CUR-4446

In case the asset CSV was used to upload the unit cost columns (amount, duration, occurrences), these were not saved. This has been fixed and the uploaded fields are now correctly stored.

CSV should support definition of start and end date for version based objects - CUR-4378

The CSV upload doesn't provide the option to specify start and/or end date for versions objects. This causes the objects to appear in every defined year.

The change made is to add optional start_date / end_date columns (yyyy-mm-dd) to the method, assessment, module, module group, study, qualification, organisation and faculty CSVs, directly after version (or after the names where there is no version). 

The method and assessment importers now store the dates similar to the other objects. A blank cell will keep the existing date.

Specification already had support for start and end date, and is therefor not mentioned in the objects that are extended.

CSV import of specification and organisation should show errors - CUR-4436

When importing specifications or organisations using the CSV import, they always show a success. In case rows in the import fail, they are not shown as error / warning in the result report. The change applied makes sure specification and organisation CSV imports now report row errors. A row with an invalid value, such as two values in a single-valued field or an unknown reference, is counted as failed. The errors are shown as import result to the user and logged in the job log, similar to the other imports.

Security

Our build process scans continuously for known vulnerabilities. Fixes are prioritised by impact: some go out as an immediate hotfix, others in the current or next sprint. See the central database of vulnerabilities for details.

Overarching roles should not be able to proceed the workflow - CUR-4275

Maybe not really a security issue, but it's different then a functional change. It was found that a user that is in a role against a workflow but is not the owner was able to send the workflow to the next step. A typical use case could be a “teacher” and “coordinator” that both perform a data collection task for a module. The teachers can put in their data but are not allowed to submit the module, only the coordinator is.

This has been fixed and only a participant who holds the owner role on the object the workflow runs for, can now send it to the next step.

See the Curriculum manual for configuration guidance.

The following has been released to the Test environments on Oct 13th and will reach production next week.

Core

• Resolved an issue where the app could crash when the sidebar showed an order whose creator or last editor had been deleted.
• Resolved an issue where reservations dragged as a group could land in unexpected places if they moved outside the visible calendar while being dragged.
• Resolved an issue where size and capacity reservations in a calendar with object headers were shown underneath gray obstacles, which made them hard to see.

Activity Manager

• Resolved an issue where sending activities to the scheduling selection list could cause major slowdowns.

The following has been released to the Production environments on Oct 14th.

General improvements

Performance improvements to the Activities table. A new table has been introduced in order to achieve some massive performance improvements when having lots of columns and rows. Scrolling should now be more smooth and a better experience in general. Column headers also behave much better now, not jumping around when changing size.

While we have spent lots of effort to make this a non intrusive release, of course it could mean that some things don't look or behave exactly like before

Available on Test for all regions on 13 October and 20 October on Production

‍

Customers can now import object data directly in Admin, without going through TimeEdit. You can create and update objects in bulk from a spreadsheet, including field values, relations and memberships.

To help you get started, we’ve published step-by-step guides on TimeEdit Academy.

• Create an import template
• System fields reference
• Prepare the import file
• Import of objects

We strongly recommend going through them before your first import.

‍

Activation: required before you can use Import of objects

Object Import is not enabled by default. An authorized customer representative must request activation for their databases. Instructions in form.

To request activation, submit the form Object Import - Activation Request & Customer Agreement in Zendesk and accept the terms below.

Object Import - terms and conditions
Object Import in Admin provides direct write access to objects, field values, relations, and memberships, including those used in conflict control.

Before Object Import can be activated for your environment, an authorized customer representative must review and accept the terms below.

1. Acknowledgment of risks

By requesting activation of Object Import, you acknowledge the following:

1.1 Bulk changes and data overwriting

Object Import can create, update, and overwrite objects, field values, relations, and memberships in bulk. An error in the source file is repeated across every row it affects, so its impact scales with the size of the file.

1.2 Import validation limitations

A successful import status confirms that the file meets the system’s structural and field-level rules. It does not confirm that the values, relations, or memberships are correct for your configuration, or that scheduling conflict control will behave as intended afterward.

1.3 Impact on conflict control

Memberships used in conflict control, including those supporting cross-module subgroup conflicts, depend on correct configuration beyond the import itself. An import that completes with no reported errors can still leave conflict detection incomplete.

1.4 No automated rollback

TimeEdit does not provide an automated way to reverse a completed import. Correcting the effects of an incorrect import requires manual correction or a further corrective import.

1.5 Customer responsibility

It is your organization’s responsibility to prepare and review import files before running an import, and to verify the result afterward, including spot-checking affected objects, relations, and memberships.

2. Billable corrective work

Work performed by TimeEdit to identify, diagnose, or correct the effects of an import performed by your organization, including data corrections, conflict-control repairs, or relation rebuilding, is billed as support or professional services time at the rate set out in your organization’s agreement.

This does not apply if TimeEdit confirms that the issue results from a defect in TimeEdit’s software rather than the content of the imported file.

Permissions

TE_ADMIN::admin - has access to import objects

TE_ADMIN::user - needs app permission(s) to export and import

TE_ADMIN::manageObjects (to handle objects)

TE_ADMIN::exportObjects (export objects, use only this to prevent importing)

TE_ADMIN::importObjects (import objects)

‍

‍

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Study guide release schedule.

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

It should be possible to remove a filter value - SG-739

When removing a filter value, an error was thrown. The error was consistent and prevented the admin to save the configuration, and thus remove the filter from the configuration. This has been fixed, and filters can be cleared and saved again.

Due to Assistant feature released in the previous sprint, the 'filters' are not direct visible in the first tab. The enabling of the 'submit' validated the filters for correctness. A 'red' marker with the error was shown underneath the filter, but since this could be a non-selected page, the reason of a non-clickable submit buton was not clear. A second fix is made to show the 'reason' why the submit is not selectable. In the filter example the button will show an information message on 'hover' that the filter is incorrect and thus the submit is not accessible.

AI student coach improvements - SG-788

Some improvements have been made to the AI student coach:

• The AI engine (Google Gemini) used is using the region specific engine
• The AI engine integration is made more robust. The connection of the AI engine to the data, required to provide answers, could get disconnected. This has been made more robust.
• Migrated to use the latest AI engine
• Extended the AI prompting, with highly increased resultsThe engine respects the selected academic year, the different objects in the response will have proper links to direct navigate to the detail pages, the AI will not standard prompt for more information in case the information provided is sufficient, deleted information is no longer used as 'input' by the AI.

The study guide should not show the same year twice - SG-741

It could happen an imported year appeared twice in the study guide, where only on has data and the other would not synchronise. It required some investigation to find the cause, but we succeeded to find and fix it. In case the 'import' was defined as '2026 ' (with a leading or trailing space), this causes to create and import the year with a space. The year was then imported and the space was removed by the import routine, creating the year without a space. The change made is that the year creation routine uses the same 'cleaning algorithm' as Curriculum, preventing to create a code without a space.

Part of the fix is the automatic cleaning of the 'undesired' year with the space, only keeping the year with the code matching the curriculum academic year.

The system should support a product filter per tab - SG-793

The tab definition consists of the page to be shown and the relevant filter. In this release the usage of the filter is extended to manage the 'product filter' for a specific page/tab. The 'product filter' is used to filter the result on faculty or organisation. The extension is the ability to define the product filter values, for instance define a filter for only 3 of the 8 faculties. This change will limit the search results to meet the selected faculties and can be used to define different tabs that provide search and detailpages focussing on different faculties or organisations.

Below an example configuration is shown, where the faculties are filtered to only show 3 out of the 8 available faculties.

The configuration starts by adding a filter to the Filter configuration page.

After selecting Add filter, of selecting an existing filter, the filter configuration is shown.

In this case the filter option is used define the supported faculties (using the code or externalId of the faculties). The filter can be selected to be applied in the Tab configuration.

When opening the Tab and opening the Faculty filter, the available options are shown. Based on the configuration not all faculties are available for filtering, but only the 3 defined options in the filter can be selected.

Filters should be usable as overarching select option - SG-792

A requirement received the option to define a kind of 'virtual' sections in the study guide. In this case a virtual section only provides a slice of the study guide related to tabs, pages and data. Multiple slices can be defined, to allow the student toggling between the different virtual sections. This could allow to separate the information based on faculty.

The image below shows an example of two virtual sections, filtering on faculty. The selected 'virtual section' (tab group) is the faculty Abstract Sciences. The information shown in the different underlying tabs will always apply the defined filter, and in this case only provide data that is defined in the context of the faculty Abstract Sciences.

Configuration and behaviour:

An administrator can define the virtual sections called tab groups in the study guide. Using the menu Administration → Tab groups the tab groups can be defined providing a name, a label and a sequence.

In case two or more tab groups are defined, the switch to navigate the tab groups (virtual sections) is shown next to the customer logo. On mobile the switch option is available via the top of the menu.

The user can now toggle between the virtual sections by selecting the relevant tab group.

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. ‍

For more information on reported vulnerabilities, see the central database of vulnerabilities.

Security improvements - SG-756

AI can be a blessing. We read information about AI bots hacking their way into systems. This has bad things, but we decided to use this to our advantage and perform a indepth security audit using the power of AI. If they can hack the FBI, why not check if they can hack our software. We could have used a brute-force attack, but we decided to give the AI access to the code base, to provide as much information as possible enabling finding any security issues. It was also because we want to exploit the power and check if the AI would find issues that were not found by our regular security audits.

And it must be said, the AI found some issues. Luckily all identified as minor, but still a good result to even improve our security further. Since the issues were deep-down technically and marked as minor, they will not be individually listed. But it is still worthwhile sharing we fixed the 'minor' marked security vulnerabilities.

‍

For more guidance on configuration and setup of Study Guide, use the relevant Study Guide manual.

‍

This release note lists the features, improvements and fixes in this version. Release dates per version are published in the Evaluation release schedule.

‍

Security

An integral part of our development and build process is the automatic scanning for known security vulnerabilities. Fixes are prioritised based on impact: some may require an immediate hot-fix, while others are addressed in the current or next Sprint (release). For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

Security hotfix PHP vulnerability in SPSS export  - EV-457

The SPSS export in Evaluation runs in a separate component, and is the only part of Evaluation built on PHP.

On October 21, 2026, PHP reported and published fixes for two critical vulnerabilities (CVE-2026-109618 (9.2) and CVE-2026-109619 (9.2)), which can allow remote code execution on servers running PHP.  As a precaution, we made the SPSS export unavailable on October 21 on all systems.

The component has been updated with the fixes for both vulnerabilities. In addition, the component now ignores uploads and form data it never uses, which further limits the reach of an incoming request. The SPSS export has been made available again as of October 22.

An analysis of the available logs showed no signs the vulnerabilities were used. The risk was already limited since the SPSS exporter (and thus the PHP code) could only be reached from within the TimeEdit platform, not directly from the internet.

While the SPSS export was unavailable, users who tried to export to SPSS received an error message.

Security improvement - EV-474

An analysis of all API services and their API calls learned the Evaluation detail endpoint was exposing too much details. This conflicts with the Principle of Least Privilege (PoLP), and the not really necessary information is no longer exposed. The information exposed will based on PoLP adjust itself to the requesting service.

‍

Improvements

New functionality, user experience refinements, and bug fixes. Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

As an administrator I want to search on question code in question management - EV-456

The search for questions in the question management (administrator) menu was using full-text search on the question title. There was no support for direct searching for a specific question on the unique question code. The search is enriched with support for question code, and searching on code or a term in the title is both supported.

‍

As an administrator I should be able to delete Report templates - EV-470

On the Report templates page a Report template could not be deleted, in case reports had been made with the template. A change is made to enable deleting such a template, where the delete also includes the exports that were made with it, together with their generated files offered for download.

In case one of its exports is still waiting or running, the template is not deleted and a message asks you to try again once the export has finished.

‍

The Downloads list and the Exports page load faster - EV-460

For institutions with many downloads, the Downloads list and the Exports page now load noticeably faster. Downloads keep their place in the list, so a list that was open while the new version was installed still points at the right files.

‍

Survey settings should be respected for External Examiner in Curriculum - EV-463, EV-415 (Hotfix)

An evaluation type has several settings that change how its survey looks and works for participants. You can find them under Admin, Evaluation types: Sidebar navigation, Hide submit page, Show answers after completion, Show question breadcrumbs extended, and the type's own Style. These settings were applied in the admin preview and evaluations directly run from Evaluation.

However, for evaluations run within Curriculum (External Examiner) the settings were not correctly used for participants filling in the survey. In fact, they always saw the default survey. This has been fixed, and participants now get the survey as the evaluation type is configured.

For the evaluations using an evaluation type using one or more of these setting, the participants will see the survey change with this release. E.g. if sidebar navigation is set, participants can move between the question blocks by clicking them in the sidebar, as intended for External Examiner evaluations.

Next to this change, a few smaller improvements are applied:

• On the Check and submit page, Show my answers now lists only the questions the participant answered. Before, it also listed unanswered questions, information texts and images, and blocks that did not apply to the participant, such as a lecturer they had not selected, and number answers were shown empty.
• With Hide submit page switched on, the survey could stay empty for a participant who reloaded it after the number of pages had changed, for example because the setting was switched on while they were filling it in, or when none of the question blocks applied to them. The survey now opens on the last available page.
• In the sidebar, the number of unanswered required and optional questions on a page now also appears when you reach the page with the keyboard, and Escape closes it.
• On small screens, the button that opens and closes the sidebar is now read out by screen readers in the language of the survey.

See the Evaluation manual for configuration guidance.

This release note lists the features, improvements and fixes in this version. Release dates per version are published in the Evaluation release schedule.

Improvements

New functionality, user experience refinements, and bug fixes. Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

Downloadable reports should be removable - EV-431

Reports that are generated and appear as 'downloadable' reports in the report section (right bottom widget) could not be deleted. The button was shown, but the action was not always executed properly, causing a cluttered list with downloadable reports. The behaviour of the button is fixed, and reports no longer required to be downloaded can be removed again.

Next to this fix, a new option is added to support deletion of all downloadable reports. Especially handy for the users that have a cluttered list due to the bug and don't have the desire to delete the reports one-by-one.

Sorting order in period/year selector should show newest year on top - EV-458

A small fix has been made to the period/year selector. The standard order of the list was showing the 'oldest' year first. The order has been reversed, to show the latest year on top. Since the latest year is in most cases the active year, this will reduce navigating/scrolling through the historic years first.

A combined participant report should not lock the system - EV-455

An issue was found where a combined participant report with over 50 participants could lock the system. Investigation learned this was caused by partial recursive loop that caused the retrieval of data not to be 50 (number of participants), but 50*50. For smaller this will cause the report generated in the background to run a little longer, but with a large number this could lock all database session and causing the system to stop responding till sessions start being free again. This has been fixed, so in the example the call is executed the expected number of 50 times, one for each participant.

Accessibility improvements - EV-421, EV-423, EV-424

Several minor accessibility improvements have been made based on the WCAG usability and accessibility validation findings:

• Add alternative texts when icons are used (this will help screen readers)
• Make the survey full accessible by keyboard only. We found some items were not reachable using only keyboard, and fixed this incorrect behaviour
• Extend visual elements with no information for screen readers with ARIA information to make sure all visual information provides information for screen readers.

Security

An integral part of our development and build process is the automatic scanning for known security vulnerabilities. Fixes are prioritised based on impact: some may require an immediate hot-fix, while others are addressed in the current or next Sprint (release). For more information on reported vulnerabilities, see the central database of vulnerabilities.

Security improvements - EV-454, EV-453, EV-452, EV-435

AI can be a blessing. We read information about AI bots hacking their way into systems. This has bad things, but we decided to use this to our advantage and perform a indepth security audit using the power of AI. If they can hack the FBI, why not check if they can hack our software. We could have used a brute-force attack, but we decided to give the AI access to the code base, to provide as much information as possible enabling finding any security issues. It was also because we want to exploit the power and check if the AI would find issues that were not found by our regular security audits.

And it must be said, the AI found some issues. Luckily all identified as medium or minor, but still a good result to even improve our security further. The issues found and solved in this release are:

• The generated security-tokens should be more complexThe finding was that they could be determined using a brute-force attack, and change the length could prevent this
•  Extend the SFTP connectivity with a host-key validationThis to extend the security from standard SFTP authentication with a check on the host accessing the SFTP server.
• Reports without a defined evaluation type could access all evaluationsA theoretical case, since reports require a type. But better safe than sorry, so we extended the check on evaluation type. If no type is specified the report will not show. 
• The participate API endpoint exposes information not really neededThis conflicts with the Principle of Least Privilege (PoLP), and the not really necessary information is no longer exposed
• The mail logging logs the mail subject as 'INFO' and can expose recipient informationLogging uses the 'INFO' marked messages and could in this case cause that recipient info in the mail subject is visible in the logging. E.g. in case a recipient was used as a 'fill-in' field and while sending is replaced by the actual recipient information. This has be changed to only log the subject in 'DEBUG' to meet the  Principle of Least Privilege (PoLP).

See the Evaluation manual for configuration guidance.

You can now include direct links to your schedule and reservation details in calendar subscriptions. This makes it easier to access the full reservation details, even when only limited information is included in the subscription.

Three new fields are available:

• Link to Viewer reservation — Opens the reservation directly in Viewer.
• Link to Viewer schedule — Opens the Viewer page used for the subscription.
• Link to Hub — Opens the reservation in the new schedule viewer in Hub.

Note: The new schedule viewer in Hub will soon be available in your test environment.

The following was released to the Test environment on Oct 7th and will be available on Production next week

Bug fixes:

• Fixed a layout issue in the reservation summary popover.
• Reservation tags that differ only by capitalisation ("tag", "Tag", "tAg") are now treated as the same tag. Before, each version could be added and shown separately.

The following was released to Test environments on Oct 7th and will be available on Production next week

Bug fixes:

• Resolved an issue where the column headers width would not be persisted through different sessions
• The recipient overview has new filters for status and for who last edited.
• Auto-sized text areas no longer disappear in activity tables.
• Fixed lag when using the Form Builder.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

Improvements

New functionality, user experience improvements and bug fixes. Issues marked as Hotfix were developed in this sprint but applied to the previous release or directly to production, depending on impact.

Calculated fields no longer skip values after an empty field - CUR-4235

A field defined by a formula using a calculation (e.g. sum) several fields could store a wrong total when one of those fields was empty. Every value after the empty field was left out, so a report could show a different value than the form. This has been fixed, and an empty field now counts as 0 wherever it appears in the formula.

Needs action: stored values are not corrected automatically.

Fields set to generate Always or On save are corrected the next time the object is saved. For other fields, the advise is to run the Generate value hook after the release.

The hook has been extended with support for fields on relations, and can accept multiple fields to be regenerated by separating the fields by commas.

Ignored offerings are left out of activities and planning - CUR-4344

Offerings marked Ignore no longer appear where activities and teachers are collected per offering in the activity list, grid and card, the teacher pages, the reservation list and the activity groups page.

Ad hoc offerings should follow the defined ad-hoc code pattern - CUR-4200

The automated code generation based on a formula for ad hoc offerings was using the defined pattern for the standard offerings. This has been fixed, and the generated code A pattern configured on the ad hoc offering type therefore had no effect in the structure view or in the offerings on the general tab of a module. This has been fixed, and ad hoc offerings use their own pattern there and on the planboard. A name entered on an offering still takes precedence over the pattern, now on the planboard as well.

Integration

Extensions, improvements and fixes to the integrations: the Curriculum API, OOAPI, CSV import, and the data exchange with Data Manager, Core and the broker.

Bulk import endpoints accept up to 100 objects - CUR-4338

The bulk import endpoint implemented in a previous release was limited to 25 objects. This has been altered and it will accept up to 100 objects per request. See developer.timeedit.com for the endpoints.

Extend Person endpoint with support for items - CUR-3989

The person API returns the items object(s) stored on a person, such as professional development or qualification records. Items are always returned, irrespective of the requested academic year. Expired records will be returned with the end date rather than being left out.

• Items sent with a person are saved, so they can be added and updated through the API. An import does not remove items created in the application.
• The start and end date of an item are now included for each endpoint that exports items, for example on modules and studies.

CSV import extended with version for teaching methods and assessments - CUR-4296

The teaching method and assessment CSV imports have two new columns, definition and version. Both values are also included in the import and export API for teaching methods and assessments, as they are for modules.

Security

Our build process scans continuously for known vulnerabilities. Fixes are prioritised by impact: some go out as an immediate hotfix, others in the current or next sprint. See the central database of vulnerabilities for details.

Implemented security fixes - CUR-4214

Based on our standard constant security validation some medium and minor vulnerabilities were identified that have been fixed. This includes update of a number of CVE's, improvement of Token handling and enhanced shielding the monitoring endpoints.

Refer to the Workload Manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

‍

Improvements

New functionality, user experience improvements and bug fixes. Issues marked as Hotfix were developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

Calculated fields no longer skip values after an empty field - CUR-4235

A field defined by a formula using a calculation (e.g. sum) several fields could store a wrong total when one of those fields was empty. Every value after the empty field was left out, so a report could show a different value than the form. This has been fixed, and an empty field now counts as 0 wherever it appears in the formula.

Needs action: stored values are not corrected automatically.

Fields set to generate Always or On save are corrected the next time the object is saved. For other fields, the advise is to run the Generate value hook after the release.

The hook has been extended with support for fields on relations, and can accept multiple fields to be regenerated by separating the fields by commas.

‍

A changes report can be limited to specific change categories - CUR-2687, CUR-2383

Support for Change categories is added to the changes page template. Earlier releases added support for the administrator to define change categories, and for instance create a category focussing on specific changes. E.g. only relation changes, relevant study changes with respect to accreditation, etc.

The option is added to create a changes (change report) page with a defined the change category. This allows using a specific, context based overview of changes per workflow.  

Next to the configuration of a specific change report page, the changes report is extended with a Change categories selection. This allows for manual selecting a preconfigured category and apply that as a filter.

‍

The Changes report should default to the selected year - CUR-2689

The Changes report will default opens with the selected year, instead of showing all year information.

‍

Versioning: teaching methods, assessments and new definitions - CUR-4296, CUR-4142, CUR-4143

The versioning has been extended with support for teaching methods and assessments. The behaviour is equal to studies, module groups and modules, with a teaching method or assessment with an external ID is grouped into versions under a definition. The pagea show the version selector and Create new version next to the year selector.

See Curriculum: versioning configuration and usage for the full configuration.

‍

Terminated modules should not be considered in the studyability validation - CUR-3886

A terminated module was still considered in the studyability validation. This has been corrected and the module and its credits will no longer be add to any period total, and it is no longer listed among the modules of the period.

‍

Ignored offerings are left out of activities and planning - CUR-4344

Offerings marked Ignore no longer appear where activities and teachers are collected per offering in the activity list, grid and card, the teacher pages, the reservation list and the activity groups page.:

• In case the the number of groups of an offering goes down, e.g. the number of students is reduced, the excess of groups are removed, and the user is informed. The removed activity groups page are added to the change history.
• The group manager screen used in a workflow cannot be closed in case the groups don't match up the calculated number of groups.
• When the number of groups is increased, e.g. number of students is increased, earlier removed groups are not added. They must be added manually in this case.

‍

Offering based activity group handling optimised - CUR-4289, CUR-4326, CUR-4322

In the previous release (12.22) the option has been added to define activity groups per offering, using the setting schedule.generate_method_groups. A few changes are applied to optimise the group management.

‍

Annual rollover should copy the related objects of subjects - CUR-4164

The rollover did not copy the Related objects of the subjects of a module to the new academic year. This has been fixed.

‍

Ad hoc offerings should follow the defined ad-hoc code pattern - CUR-4200

The automated code generation based on a formula for ad hoc offerings was using the defined pattern for the standard offerings. This has been fixed, and the generated code A pattern configured on the ad hoc offering type therefore had no effect in the structure view or in the offerings on the general tab of a module. This has been fixed, and ad hoc offerings use their own pattern there and on the planboard. A name entered on an offering still takes precedence over the pattern, now on the planboard as well.

‍

Faculty and organisation added to the specifications report - CUR-4196

The specifications report is extended with support for the Faculty and Organisation column, offering support to show the related Faculty / Organisation in the report.

‍

Integration

Extensions, improvements and fixes to the integrations: the Curriculum API, OOAPI, CSV import, and the data exchange with Data Manager, Core and the broker.

‍

Publishing to the curriculum broker should be simplified - CUR-4307, CUR-4256, CUR-4323

The publishing of information to the broker required setting a publication date and then publishing the information in two different steps (hooks). This has been changed by adding two hooks:  Publish object and Unpublish object. The hook will respectively set the publication data and publish to the broker or unset the publication date and 'unpublish' from the broker in one go. Not requiring separate hooks anymore.

‍

Bulk import endpoints accept up to 100 objects - CUR-4338

The bulk import endpoint implemented in a previous release was limited to 25 objects. This has been altered and it will accept up to 100 objects per request. See developer.timeedit.com for the endpoints.

‍

Ignored offerings are not exported and not changed by imports - CUR-4344

The import and export API no longer sends offerings marked Ignore. An import leaves an ignored offering as it is: it is not updated or removed, and incoming data that matches it does not create a duplicate. Deleting an ignored offering through the API is refused.

‍

Extend Person endpoint with support for items - CUR-3989

The person API returns the items object(s) stored on a person, such as professional development or qualification records. Items are always returned, irrespective of the requested academic year. Expired records will be returned with the end date rather than being left out.

• Items sent with a person are saved, so they can be added and updated through the API. An import does not remove items created in the application.
• The start and end date of an item are now included for each endpoint that exports items, for example on modules and studies.

‍

‍CSV import extended with version for teaching methods and assessments - CUR-4296

The teaching method and assessment CSV imports have two new columns, definition and version. Both values are also included in the import and export API for teaching methods and assessments, as they are for modules.

‍

Add support for  calendar periods to Reference endpoint - CUR-4355

A request for periods in the reference import API can now include calendar, with the external ID or code of a calendar. This will return the periods of that calendar. Executing the call with only calendar will return a list of all calendars.

‍

Reference import externalId handling improved - CUR-4306

• A type created earlier without an external ID can be updated again. The import recognises it by its code and fills in the external ID, instead of failing.
• A reference type import no longer replaces the external ID of an existing type. A row whose ID conflicts with the external ID already stored for that code is rejected with a clear message, and the existing type is left unchanged.

‍

Security

Our build process scans continuously for known vulnerabilities. Fixes are prioritised by impact: some go out as an immediate hotfix, others in the current or next sprint. See the central database of vulnerabilities for details.

‍

Implemented security fixes - CUR-4214

Based on our standard constant security validation some medium and minor vulnerabilities were identified that have been fixed. This includes update of a number of CVE's, improvement of Token handling and enhanced shielding the monitoring endpoints.

‍

See the Curriculum manual for configuration guidance.

This release note lists the features, improvements and fixes in this version. Release dates per version are published in the Evaluation release schedule.

On Tuesday 29 September we will deploy a maintenance release with updated third-party libraries and other improvements from our continuous security work. This is in addition to our regular release schedule. No action is required on your part.

See the Evaluation manual for configuration guidance.

This release note lists the features, improvements and fixes in this version. Release dates per version are published in the Study Guide release schedule.

‍

A new approach to tabs and filters

Tabs and filters look simple, but they are tricky to get right. We took the time to look at how they worked, how they should work, and which approach would let us add more to them in a stable way later. Thank you for the many feature requests and bug reports on this topic.

The principle is simple: the tab now leads. A tab has its own address, applies its own filter wherever a visitor comes from, and chooses its sidebar filters the same way it chooses its widgets. Until now, much of this was decided by the technical product type behind the tab.

‍

Each main tab has its own address - SG-711

An overview page is now reached at the name of its tab, such as /master, instead of a technical address such as /studies?mainTab=Master. This solves several problems with links to a tab, and gives visitors an address that makes sense to them. Existing links with the old mainTab parameter are redirected automatically.

Action recommended: because the name of a tab is now its address, the upgrade automatically makes tab names lowercase and unique across the catalogue. Review the names under Administration, Tabs, and rename any that do not read well for students.

‍

Each tab chooses its own sidebar filters - SG-740, SG-711,  SG-739, SG-737, SG-743

Until now, sidebar filters were configured per product type. Two tabs listing the same type, such as a Bachelor and a Master tab, always showed the same filters, and a tab could offer options that did not apply to it, such as a minors tab offering every study type. Filters now work like widgets: you define a filter once under Administration, Filters, and choose which filters each tab shows on the Filters pane of the tab under Administration, Tabs. A filter can be used by several tabs.

On upgrade, every main tab starts with the filters its product type had.

• A filter whose value the tab already fixes, such as the type on a minors tab, is no longer shown in the sidebar. The tab still applies it.
• Two filters of the same product type can now share a name, so a minor tab and a major tab can each offer their own version of a filter with different options. A tab still holds only one filter of a given name.
• Under Administration, Filters, a Tabs column shows which tabs use each filter, and clicking a tab name opens its settings. A toggle shows the filters no tab uses, so they can be found and removed. A filter whose product type has no main tab starts out unused.

‍

A tab's own filter always applies - SG-711

A tab's own filter, such as the qualification type of a Bachelor tab, is now applied wherever a visitor arrives from: the home page, a bookmark or a link, and not only after clicking the tab. It no longer appears in the address or as a filter tag, so a visitor cannot remove it.

• Filters a visitor chooses narrow the tab's results and never switch to another tab.
• Filters are remembered per tab for the session, so returning through the back link or the browser's back button shows the list as it was left.

‍

A study or module opens under the tab it belongs to - SG-711

When two main tabs had tab filters that differed only after the first condition, such as a Bachelor and a Master tab that differ in qualification type, a study could open under the wrong tab. A master's programme followed from a module, for example, opened under the Bachelor tab, with that tab's header widgets and back link. Only the first condition of a tab filter was checked; every condition is now checked. When no single tab is a clear match, no tab is highlighted, rather than one being guessed.

‍

What comes next

We are not done yet. Study and module detail pages, for example, are still reached at an address based on the technical product type, such as /studies/ followed by the code, and we are still deciding what suits them best. The filters could still work more intuitively as well. The changes we've made so far will allow us to iterate more easily. We would love to hear how the new tabs and filters work for you, so your feedback can shape the next steps.

‍

More improvements

Modules and groups can be filtered by study - SG-735

A module or group tab can now offer a filter on study. Choosing a study shows the modules and groups in that study's structure, including those shared with other studies. So the filter checks for usages in the structure, not owners. Choosing several studies shows what any of them include, and the filter can be combined with the other filters in the sidebar.

Create the filter under Administration, Filters with value type Product and sub type Study, and add it to the tab on its Filters pane.

‍

The administration pages have a new look and a new address - SG-743, SG-711,

We are working towards one consistent experience across the TimeEdit products, using the same components in more and more places. This release brings the administration pages of the Study Guide in line and improves the user experience in various ways.

• Adding or editing an item now opens a drawer that slides in from the right, instead of a window in the middle of the screen. Save sits at the top, so a long form no longer has to be scrolled to be saved, and closing with unsaved changes asks whether to save or discard them.
• The pages use the full width of the screen, and the row being edited is highlighted.
• A tab's settings are divided into General, Widgets and Filters panes. A widget's fields have their own Fields tab, and editing a field opens a second drawer on top.
• Widgets can be searched by name and by label, the label in any language.
• The windows visitors see, such as print and the filter popup, are unchanged.

The administration pages have also moved under /admin, for example /admin/tabs. Now that tab names are addresses, this keeps them from clashing with a tab and lets them be secured together. Bookmarks to the old addresses are not redirected, as the old name could now belong to a tab, so update them.

We also fixed a couple of bugs in the process, such as required asterisks missing and being incorrectly shown, and some options sometimes not saving correctly.

‍

The Study Guide can be shown in French - SG-745

French is now available as a language. The Study Guide offers French in the language switcher, shows the French labels, and follows French conventions for dates and form controls.

To offer French, add FR to the languages parameter under Administration, Parameters, then click Synchronize under Administration, Labels to load the French labels.

‍

Integration

Imports from Curriculum are more robust - SG-741, SG-742

• An academic year could appear twice in the list of years. When a year's identifier arrived with a leading or trailing space, the next import with the clean identifier did not recognise it as the same year and created a second one. Identifiers of years, references and products are now trimmed on import, and the upgrade trims those already stored. A year that was duplicated before this version is not merged, so the change applies from this version onwards.
• An import could stop with an error when the data from Curriculum left out a list entirely, such as a study without groups or an organisation without names. A missing list is now read as an empty one, and the import continues.

‍

Security

Our build process scans continuously for known vulnerabilities. Fixes are prioritised by impact: some go out as an immediate hotfix, others in the current or next sprint. See the central database of vulnerabilities for details.

Continued investment in tooling and quality

Ongoing improvements to our automated testing, build pipeline and dependency scanning, so errors and security issues are caught earlier.

‍

See the Study Guide manual for configuration guidance.

The following has been released to the Test environments on Sep 24th and will reach production next week.

Bug fixes

• Resolved an issue where sometimes Activity Templates would still be editable, even though “Don’t allow editing” was turned on
• Resolved an issue where scrolling in the All activities page would sometimes misalign the rows
• Resolved an issue where sometimes Declined forms could not be Unlocked from the Recipients table
• Resolved an issue where sometimes week picker elements would show the incorrect weeks
• Resolved an issue where the Week picker column would be shown in the Activities table even if it was hidden from submitters
• Resolved an issue where it was possible to design a form where a data source element of the same type as the Primary Object type was mapped as filters on the Activity mapping. This is not a compatible mapping and is now caught in validation when saving the form

The following has been released to the Production and Test environments on Sep 24st

Bug fixes

• Resolved an issue where the search text field for the object list would sometimes not gain focus as objects are added or removed and the selected type changes.
• Resolved an issue where the waiting list would sometimes display the error message "The search matches too many objects" as the user was changing the search settings for the list.

The release notes provide information on the features and improvements in the specified version.

New

iOS Chippo Configurator - DEV-9367

We're pleased to announce that Chippo Configurator is now also available for iOS devices. Previously available only on Android, Chippo Configurator can now be used on both major mobile platforms.

Configure Chippos from the app - DEV-9520 & DEV-9583

It is now possible to provision Chippos without going through a separate configuration tool. It works identically to scanning any other Chippo. Tap the scan button, scan the Chippo and give it a name. Afterwards, the card is registered and ready to be used.

Improvements

More consistent Chippo scanning - DEV-9518

Chippo scanning now behaves more reliably across different conditions and devices. On iOS, the scan prompt is also now fully translated and refers to Chippo by name rather than showing a generic system message.

Security improvements - DEV-9543

This release includes security improvements to the Chippo provisioning flow.

Fixes

Unassigned button always visible when unassigned Chippos are present - DEV-9582

The button for viewing unassigned Chippos was sometimes hidden even when unassigned cards existed. It now remains visible whenever there is at least one unassigned Chippo.

Assign button badge count fixed for more than 10 unassigned Chippos - DEV-9582

The assign button could display an incorrect count when more than 10 Chippos were unassigned.

The following has been released to the Test environments on Sep 21th and will reach production next week.

New functionality - Not same day constraint

• Applying the “Not same day” constraint to two or more Activity Series (or Tracks) will instruct the autopilot to not place the included Activities on the same day. This works on a week by week basis.

General improvements

• In the Select Object dialog, it is now possible to filter on Related objects. Toggling this will show only objects related to other objects on the Activity. Note: Field relations are not supported.

Bug fixes:

• Resolved an issue where it was sometimes not possible to clear the value of the Start time field on an Activity in Data Manager

The following has been released to the Production and Test environments on Sep 21st

Bug fixes:

• Resolved an issue where the exam plugin would create exams with incorrect start and end times (i.e. two hours off from the actual time of the reservation in Core)
• Resolved an issue which caused the track list in Core to not properly display custom week names in its weeks column, while scheduling Activity Series from AM.
• Resolved an issue where drag and drop from the object list to the selection list would not work when multiple objects had been selected.
• Resolved an issue where Support information descriptions were not shown in the help menu. It is now visible as a tooltip

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

‍

Improved object admin tabs - CUR-3912

The /admin tab of fourteen objects — study, module, module group, faculty, organisation, specification, qualification, assessment, method, assignment, person, team, rule and definition — now all look and work the same way.

Each object used to carry its own hard-coded list on top of the fields you configured: team and organisation showed a fixed set and nothing else, person left out every field an institution had added, and the other objects forced a handful of fields out of sight. The Admin tab now shows all the visible fields configured on the object type, in the order and with the visibility you set on them. Four fields are the exception and are always shown here, whatever the configuration says, because they are what this page is for: the UID, the publication date, the import date and the dispatch date. Those four are now read-only, so they can be read and copied but not edited.

The actions moved into the header of the page - Import, Export, Invoke hook, Restore and Save, with Delete and Delete (+ History) under Actions beside them - and each is shown only where it applies.

‍

Creating and editing a team with custom fields - CUR-4279

The teams administration page at /admin/teams was rebuilt. Creating or editing a team now shows every field configured on the Team object type, now with custom fields included; the previous window listed a fixed set of eight fields, so anything else you added was never shown.

Creating a team goes through the same window as the other create actions, so a create page configured on the object type applies to it too, and editing asks for a motivation where the custom type requires one. The page gained a search box, an Active, Inactive and All filter, and a code that links through to the team.

The team's own tabs and the teams page that can be added to another object keep the previous window for now.

‍

Activity groups can be defined per offering - CUR-4192

Groups are how the students taking an activity are divided into parallel deliveries — practical session groups, for example, where a lecture normally has one group and a practical has several. Until now a group belonged to an activity serie, and the number of groups was a single number on the teaching method, so every offering of that method got the same groups. A method offered to 150 students in one semester and 20 in the next could not express that: with a maximum group size of 25 the first needs six groups and the second one.

Groups can now be defined on the teaching method while still differing per offering. The number is worked out for each offering separately, from a formula on the number-of-groups field that can read the offering's own figures — for example the number of students on the offering divided by the maximum group size, rounded up.

For instance, a formula like this can now be configured on the method's numberOfGroups field:

ceil(:offering.totalExpectedParticipants / :maxGroupSize)

Groups are worked out when the groups page is opened and whenever the offering changes, and a workflow step can generate them for every active offering in its period.

Turn it on under Administration -> Configuration by setting schedule.generate_method_groups to true. It is off by default.

• With the setting off nothing changes. Groups are generated on the activity serie exactly as before, with the same count, the same numbering and the same values, and existing groups keep the activity serie they belong to.
• Assessments are never affected. Assessment series keep owning their own groups.
• Groups defined per offering stay inside Curriculum. They appear on the groups page and in the activity group report, but they are not part (yet) of the CSV import and export or the export to Activity Manager, which can only carry a group that belongs to an activity serie. If you run one of those integrations, leave the setting off for now.

The activity groups page and the activity group report were rebuilt at the same time, and that part applies to everyone. Each group is now opened and saved on its own in a window, rather than every group being edited at once behind one save button, and the list is ordered by group number instead of in no particular order. Lowering the number of groups no longer removes what was entered: the groups above the new count are marked as removed and the change history keeps their values. Raising the number again brings back an empty group rather than one carrying values entered for something else — to the person looking at it, a group that reappears is a group nobody has filled in yet.

‍

Simulations - CUR-4111

My simulations at /simulations, Create simulation and Edit simulation were rebuilt. The Simulations group in the academic year menu no longer runs off the bottom of the screen when there are many simulations: it scrolls, and it opens upwards where there is not enough room below. New simulation and Manage simulations moved to the top of that menu, and in the simulation lists each row's edit and delete button now says which row it belongs to, which matters when working with the keyboard or a screen reader.

Working with a removed academic year was tightened up at the same time. Deleting an academic year now clears its default flag, so a deleted year is no longer the configured default and a restored one has to be chosen again. Every switch into a year refuses a year that has been removed, including Back to original on a simulation whose origin year no longer exists. Deleting the simulation you are working in returns you to the default academic year, and when the default year itself has been removed the application falls back to a year you can select instead of starting with no year at all.

‍

Saving could fail for a user who is not an administrator - CUR-4284, CUR-4294 (Hotfix)

On a page that creates a new additional, a user who is not an administrator could get an error on save, with no explanation and nothing stored. It happened only where that page holds fields the user is not allowed to edit: those fields are reset on save, and the reset collided with reading the same set of fields. An administrator may edit everything, so the problem never appeared for one. We've also fixed some other issues related to creating objects.

‍

‍

Copying activities from another offering - CUR-4221 (Hotfix)

The Method schema tab of a module shows its teaching methods and the activities attached to each, and Copy takes the activities of another offering. Three things went wrong. The Amount in the copy window counted the module's own activity series rather than the set about to be copied, so it could read 0 and block the button. A copy that met one row it could not create stopped there and silently left the rest uncopied. And the activity series of a method without a code were skipped altogether, while the copy reported success. All three are fixed, and the copy now reports how many activity series it created. The same Copy window is used on the appraisals tab and on the activity page templates.

‍

Form validation on a submit button is clearer and reachable with the keyboard - CUR-4221 (Hotfix)

On every form in the application, a submit button that cannot yet be used keeps its place in the keyboard order instead of dropping out of it. It still looks and behaves as unavailable, and it now explains which fields are blocking the submit, so the reason reaches anyone working with the keyboard or a screen reader and not only someone who can see the whole form.

‍

Advanced filters for new reports - CUR-4139

The Changes, Assignments, Competences and Applicants reports share one component, so this applies to all four. Each column now has its own filter beside its search box, offering Contains, Exact, Empty and Not empty. Not empty is new; the other three behave as they did. The search box suggests values that occur in that column, eight at a time, saying how many were left out, and boolean columns offer all four options again: Yes, No, No or undefined, and Undefined.

Two things work differently. The Search button in the toolbar is replaced by a Clear button, shown only while something is filtered: the old button cleared the filters when it hid them, so a report opened from a template with stored filters could come back short with nothing on screen to explain why. And because setting a filter has to load every page of the report, there is now a panel above the table showing how far it has got against the total, with a Cancel. The result is kept for five minutes, so typing does not start the loading again.

On the Assignments report the name search moved into a Name column. That one is answered by the server, so it is the first filter on these reports that does not have to load the whole report first. It matches the assignment's code and the person's name as well as the name in the column.

‍

‍

The Changes pages can be configured for consulting instead of reviewing - CUR-4264

The changes-list and changes-report page templates each take two new parameters. Set hide review buttons to true to remove Approve change and Reject change, the bulk toolbar and the selection boxes, while leaving the comments, the replies and the change status untouched. Set read only to true for that plus the reply action. This helps where the right to approve cannot be taken away by permission because an integration depends on it, and the page should still be open for discussion.

‍

The Changes pages are easier to read and to work with - CUR-4184

The Changes report, the change drawer and the changes list were reworked. The drawer now opens with General, then Revisions, then the revision you selected, with Approve change and Reject change directly under the properties of that revision and Comments before Statuses.

Selecting a revision moves the highlighted row in the report with it, so the two stay in step, and the status history uses the same row layout as the revisions.

Teacher remarks are shown in the Staff availability report and in the API - CUR-4031, CUR-4033, CUR-4114

On the availability preference page a teacher records when they are available to teach, and can add a remark. Schedulers could not see which teachers had left one, because the report showed only the day and time-block choices. Remarks is now a column in the details of the Staff availability report and on the Schedule preferences tab of a person, sortable like the other columns and shortened in the cell with the full text on hover. A remark is recorded once per person and period, so it is the same on every row for that person in that period. The Staff availability report is now also sorted by name by default, rather than by an internal identifier.

The same remark was added to the availability preference endpoint, so an integration receives what the report shows. It is optional: a preference without a remark leaves the field out rather than sending an empty value.

‍

Documents can be stored on a person, and stay visible when you switch academic year - CUR-4181

Adding a document through a competence or an applicant workflow failed. A document can now be stored on any object. A person's documents are also no longer filtered by academic year, so they stay visible when you switch year, which matches the way person and competence data already works.

Purging a deleted academic year now removes the documents that were uploaded on that year's objects as well. Before, the purge left them behind, and because they no longer belonged to a year they then appeared in every year.

‍

Saving a competence or an applicant no longer clears the fields the window does not show - CUR-4092

Editing one field on a competence or applicant record could empty the fields the window does not display: the external identifier, the code, the validity dates, and any custom field configured on the object type but not placed on that window. Those values are now sent back unchanged. The rebuilt Admin tabs described above use the same form and are covered by the same fix.

‍

An organisation can now be set on a specification and on a qualification - CUR-4072

A study and a module can be linked to a department through their organisation, and processes follow that link to find the related roles. A specification and a qualification had no such field, so a custom field had to stand in for one and processes at that level could not find the department. Both now carry an organisation next to the faculty they already had — organisationId on the object, an organisation reference in the canonical API, and a column in the CSV import and export that takes the organisation's external identifier or its code.

Worth knowing before you fill it in: access rules and role propagation follow the organisation, so setting one on a specification or qualification lets everyone holding a role on that organisation reach it. It only ever widens access, never restricts it, and the same field is used to resolve process notification recipients and the responsible person for a process. Check your role assignments on the organisation before populating the field across a catalogue.

‍

Integration

Extensions, improvements and fixes to the integrations: the Curriculum API, OOAPI, CSV import, and the data exchange with Data Manager, Core and the broker.

Sending teacher availability to Core no longer stops at the first failure - CUR-4233 (Hotfix)

Availability is sent to Core with Invoke hook, from the report of a process or from a process step. It failed for most rows while part of the data did arrive, which left the export impossible to repeat because Core already held what had been sent. Two separate defects caused it: a successful answer from Core could not be read at all, because it leaves a field empty where a number was expected, and a batch that met a failure stopped the batches behind it. Both are fixed — the remaining batches are now sent, and the failures are reported as one readable line rather than an unreadable error.

‍

Security

Our build process scans continuously for known vulnerabilities. Fixes are prioritised by impact: some go out as an immediate hotfix, others in the current or next sprint. See the central database of vulnerabilities for details.

Implemented security fixes - CUR-4214

Change and feedback data is now returned only to users who may view changes on the object concerned. Every remaining endpoint that reads it, including the report cells that render change content, refuses a user who has been denied access rather than answering with an empty result.

View feedback now includes view changes. A reviewer holding only View feedback sees the Changes tabs, the changes list and the Changes report together with the review discussion; a user holding only View changes sees what changed but not the discussion.

‍

Continued investment in tooling and quality

Ongoing improvements to our automated testing, build pipeline and dependency scanning, so errors and security issues are caught earlier.

Refer to the Workload Manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

A better look and feel

We are working through Curriculum page by page, improving the look and feel, the layout and the keyboard and screen reader support as we go. A rebuilt page keeps the configuration and the permissions of the page it replaces; what changes is that it is easier to read, easier to work in, and more consistent across our suite.

‍

Planning an advised route through a study - CUR-3196, CUR-3194

An advised route is a recommended path through a study programme — the route a student can follow without having to work out every choice for themselves. Institutions use them to distinguish a September intake from a February intake, or to lay out the paths that lead to different qualifications, and a study normally has several. A route is built from steps, each pointing at a module or a module group and placing it in a phase and an offering.

Two pages carry this. The Planner, at /study/{id}/planner, is where a route is built: it shows the study's module group tree, you switch groups and modules on or off, choose each module's offering and phase, and save the result as the route. The route overview is the read-only result, laid out across the academic calendar; it is a page template an administrator adds to a study. Both were reworked in this release, and the overview now follows the same plan layout as the TimeEdit Study Planner, so the two read the same way. This is where the advised routes themselves are defined: today they leave Curriculum through the API and the CSV import and export, and in time they will be available in the Study Planner as well.

On the Planner:

• Required groups and modules are preselected and locked, with a tooltip saying so, instead of only carrying an asterisk, so they can no longer fall out of a route by accident.
• A new Selection rules panel gathers the credits and the qualifications the selection reaches, with the module groups each qualification still requires and a met or not-met status beside it. The rules are stated in words rather than left to colour alone.
• Credit totals now match what is on screen. A group over its own maximum, or one whose children missed their rules, had its credits silently discarded, so a study could read 30 out of 60 with far more than that selected underneath. Totals now count everything selected, and a group can read as not satisfying its rule while its credits still count.
• Collapsing a group no longer empties its totals, a group can be opened to look at without selecting it, and there is a select all and deselect all per group plus expand and collapse all.
• A page can be configured to show extra module fields as columns, each of which also becomes a filter next to Period and Phase.
• Leaving with unsaved changes now asks properly, offering Cancel, Discard or Save.
• A custom field configured on a route is now stored. The edit window reported success and the value was gone on reopen; those values now also travel with the CSV import and export and the API.

On the route overview, the table of part of day against period is replaced by a card per phase, a column per period inside it, and a card per planned module showing its code, its name, its part of day and a link to it. Credits are now shown, per module and as a total in each period's heading; a module spanning several periods splits its credits evenly across them.

‍

Creating and editing a team with custom fields - CUR-4279

The teams administration page at /admin/teams was rebuilt. Creating or editing a team now shows every field configured on the Team object type, now with custom fields included; the previous window listed a fixed set of eight fields, so anything else you added was never shown.

Creating a team goes through the same window as the other create actions, so a create page configured on the object type applies to it too, and editing asks for a motivation where the custom type requires one. The page gained a search box, an Active, Inactive and All filter, and a code that links through to the team.

The team's own tabs and the teams page that can be added to another object keep the previous window for now.

‍

Activity groups can be defined per offering - CUR-4192

Groups are how the students taking an activity are divided into parallel deliveries — practical session groups, for example, where a lecture normally has one group and a practical has several. Until now a group belonged to an activity serie, and the number of groups was a single number on the teaching method, so every offering of that method got the same groups. A method offered to 150 students in one semester and 20 in the next could not express that: with a maximum group size of 25 the first needs six groups and the second one.

Groups can now be defined on the teaching method while still differing per offering. The number is worked out for each offering separately, from a formula on the number-of-groups field that can read the offering's own figures — for example the number of students on the offering divided by the maximum group size, rounded up.

For instance, a formula like this can now be configured on the method's numberOfGroups field:

ceil(:offering.totalExpectedParticipants / :maxGroupSize)

Groups are worked out when the groups page is opened and whenever the offering changes, and a workflow step can generate them for every active offering in its period.

Turn it on under Administration -> Configuration by setting schedule.generate_method_groups to true. It is off by default.

• With the setting off nothing changes. Groups are generated on the activity serie exactly as before, with the same count, the same numbering and the same values, and existing groups keep the activity serie they belong to.
• Assessments are never affected. Assessment series keep owning their own groups.
• Groups defined per offering stay inside Curriculum. They appear on the groups page and in the activity group report, but they are not part (yet) of the CSV import and export or the export to Activity Manager, which can only carry a group that belongs to an activity serie. If you run one of those integrations, leave the setting off for now.

The activity groups page and the activity group report were rebuilt at the same time, and that part applies to everyone. Each group is now opened and saved on its own in a window, rather than every group being edited at once behind one save button, and the list is ordered by group number instead of in no particular order. Lowering the number of groups no longer removes what was entered: the groups above the new count are marked as removed and the change history keeps their values. Raising the number again brings back an empty group rather than one carrying values entered for something else — to the person looking at it, a group that reappears is a group nobody has filled in yet.

‍

Improved object admin tabs - CUR-3912

The /admin tab of fourteen objects — study, module, module group, faculty, organisation, specification, qualification, assessment, method, assignment, person, team, rule and definition — now all look and work the same way.

Each object used to carry its own hard-coded list on top of the fields you configured: team and organisation showed a fixed set and nothing else, person left out every field an institution had added, and the other objects forced a handful of fields out of sight. The Admin tab now shows all the visible fields configured on the object type, in the order and with the visibility you set on them. Four fields are the exception and are always shown here, whatever the configuration says, because they are what this page is for: the UID, the publication date, the import date and the dispatch date. Those four are now read-only, so they can be read and copied but not edited.

The actions moved into the header of the page - Import, Export, Invoke hook, Restore and Save, with Delete and Delete (+ History) under Actions beside them - and each is shown only where it applies.

‍

Simulations - CUR-4111

My simulations at /simulations, Create simulation and Edit simulation were rebuilt. The Simulations group in the academic year menu no longer runs off the bottom of the screen when there are many simulations: it scrolls, and it opens upwards where there is not enough room below. New simulation and Manage simulations moved to the top of that menu, and in the simulation lists each row's edit and delete button now says which row it belongs to, which matters when working with the keyboard or a screen reader.

Working with a removed academic year was tightened up at the same time. Deleting an academic year now clears its default flag, so a deleted year is no longer the configured default and a restored one has to be chosen again. Every switch into a year refuses a year that has been removed, including Back to original on a simulation whose origin year no longer exists. Deleting the simulation you are working in returns you to the default academic year, and when the default year itself has been removed the application falls back to a year you can select instead of starting with no year at all.

‍

Improvements

New functionality, user experience improvements and bug fixes. Issues marked as Hotfix were developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

A read-only field with HTML text could not be read - CUR-4162 (Hotfix)

A field can be read only because of its own settings, or because a user does not have the permission to edit it. In the second case an HTML or Markdown field was drawn as a disabled input box one line high, so the text could not be read. It is now shown as formatted, read-only text that grows to fit. One consequence: a Markdown field a user may not edit now shows the formatted text rather than the Markdown source.

‍

Saving could fail for a user who is not an administrator - CUR-4284, CUR-4294, CUR-4251 (Hotfix)

On a page that creates a new additional, a user who is not an administrator could get an error on save, with no explanation and nothing stored. It happened only where that page holds fields the user is not allowed to edit: those fields are reset on save, and the reset collided with reading the same set of fields. An administrator may edit everything, so the problem never appeared for one. We've also fixed some other issues related to creating objects.

‍

The Save button stayed inactive on a create window with nothing left to fill in - CUR-4253 (Hotfix)

This happened only when every field on the window was already filled by the default values configured on the object type, so there was nothing for the user to change: the form counted as untouched and Save stayed disabled. Clearing a value and entering the same one again did enable it. A create window that is complete and valid can now be submitted without typing anything. One that is incomplete or invalid still cannot be submitted, as before.

‍

The create window did not close when it opened an edit workflow - CUR-4228 (Hotfix)

On an object type whose Action after create is set to Open popup, configured at Administration, Custom types, General, the edit workflow opened behind the create window and could not be reached. The create window now closes before the workflow opens.

‍

A cost page can be configured without the option to create modules - CUR-4239 (Hotfix)

On the study-cost page, the window for adding a module offers New and New version next to Existing. Institutions that add only existing modules there can now switch both create tabs off: set hideModuleCreate to true on the study-cost page template in the page editor. A version counts as a new module, so both tabs disappear together. The option is off by default.

‍

Copying activities from another offering - CUR-4221 (Hotfix)

The Method schema tab of a module shows its teaching methods and the activities attached to each, and Copy takes the activities of another offering. Three things went wrong. The Amount in the copy window counted the module's own activity series rather than the set about to be copied, so it could read 0 and block the button. A copy that met one row it could not create stopped there and silently left the rest uncopied. And the activity series of a method without a code were skipped altogether, while the copy reported success. All three are fixed, and the copy now reports how many activity series it created. The same Copy window is used on the appraisals tab and on the activity page templates.

‍

Form validation on a submit button is clearer and reachable with the keyboard - CUR-4221 (Hotfix)

On every form in the application, a submit button that cannot yet be used keeps its place in the keyboard order instead of dropping out of it. It still looks and behaves as unavailable, and it now explains which fields are blocking the submit, so the reason reaches anyone working with the keyboard or a screen reader and not only someone who can see the whole form.

‍

Advanced filters for new reports - CUR-4139

The Changes, Assignments, Competences and Applicants reports share one component, so this applies to all four. Each column now has its own filter beside its search box, offering Contains, Exact, Empty and Not empty. Not empty is new; the other three behave as they did. The search box suggests values that occur in that column, eight at a time, saying how many were left out, and boolean columns offer all four options again: Yes, No, No or undefined, and Undefined.

Two things work differently. The Search button in the toolbar is replaced by a Clear button, shown only while something is filtered: the old button cleared the filters when it hid them, so a report opened from a template with stored filters could come back short with nothing on screen to explain why. And because setting a filter has to load every page of the report, there is now a panel above the table showing how far it has got against the total, with a Cancel. The result is kept for five minutes, so typing does not start the loading again.

On the Assignments report the name search moved into the Name column itself. That one is answered by the server, so it is the first filter on these reports that does not have to load the whole report first. It matches the assignment's code and the person's name as well as the name in the column.

‍

The Changes pages can be configured for consulting instead of reviewing - CUR-4264

The changes-list and changes-report page templates each take two new parameters. Set hide review buttons to true to remove Approve change and Reject change, the bulk toolbar and the selection boxes, while leaving the comments, the replies and the change status untouched. Set read only to true for that plus the reply action. This helps where the right to approve cannot be taken away by permission because an integration depends on it, and the page should still be open for discussion.

‍

Changes recorded on a version are now shown in every academic year - CUR-2694

For institutions using versioning. A change recorded on a study or module that is not bound to an academic year kept the year it happened to be made in, so it appeared under that one year while the version itself belongs to every year. This has been fixed, and existing changes are corrected when this version is deployed. A change on an offering keeps its academic year, because an offering belongs to one.

The Changes report of such a study or module also opened empty, because it was limited to the selected academic year. The Limited to year switch now starts off there, and on for a faculty or an organisation, where every change carries a year and the year is the useful limit. The switch itself works as before.

The version switcher now always shows which academic year and which version you are looking at, instead of hiding the choice when there was only one to make, and the version selector appears only on the object types that can hold versions: study, module group and module. How a version is marked as active is unchanged — a version is active when its own start and end dates overlap the academic year you are viewing, not the date of today.

See Curriculum: versioning configuration and usage for the full configuration.

‍

Linking a module to a module group is now shown as a change - CUR-3999

Linking a module under a module group takes effect immediately, but the link never appeared among the pending changes on the Changes pages while Hide empty was set, and opening it showed nothing. A link carries no field values — it is the connection between two objects, not a value that went from one thing to another — and both the list and the detail treated "no values" as "nothing happened".

Adding a link and removing one are now changes in their own right and appear on both. Where there are no field values to show, the detail states that the object was created instead of reporting "No changes compared to the original". A change on the relation between a study and a module is now also named after the module it concerns, rather than carrying a generic heading.

‍

A new module could end up in no module group - CUR-4271

This happened on the Structure tab of a study or module group, and only where the module's object type has Action after create set to Open popup. Add module creates the module and then writes the link that puts it in the group; with that setting the edit workflow opens in between and waits for an answer, and the link was only written once the user had given one. A user who closed the tab or navigated away instead — reasonably, since the module was visibly created and reported as created — left the module in no group. The link is now written before the workflow opens.

‍

The roll over now copies the data on the relation between a study and a module - CUR-4265

A custom field can be configured on the relation between a study and a module inside a module group, for example to record whether a module is condonable. The copy script behind the roll over did not include that relation, so those values came out empty in the new academic year. It now copies them, and so does the script that clones a simulation. Roll overs performed before this version were made with the previous script, so values recorded on the study-module relation will be missing in the years they produced.

The same gap also made deleting fail: removing an academic year, a simulation, a module or a module group could be refused outright once these relations existed, because nothing removed them first. That is fixed as well.

‍

Credits of a module that is not offered are no longer counted - CUR-4160

On the Structure tab of a study or module group, a module that is part of a group but has no offering in the selected academic year — an alternating module taught every other year, for instance — still added its credits to the group total. One rule now decides whether a module counts: it does not when it is terminated, when it has no active offering at all, or, on pages that mark inactive offerings, when it has no offering left in the selected period. The same rule decides whether the module is struck through, so what is shown as not taught and what is counted now agree. The configurable structure page is covered too.

‍

The Changes pages are easier to read and to work with - CUR-4184

The Changes report, the change drawer and the changes list were reworked. The drawer now opens with General, then Revisions, then the revision you selected, with Approve change and Reject change directly under the properties of that revision and Comments before Statuses.

Selecting a revision moves the highlighted row in the report with it, so the two stay in step, and the status history uses the same row layout as the revisions.

‍

Saving a competence or an applicant no longer clears the fields the window does not show - CUR-4092

Editing one field on a competence or applicant record could empty the fields the window does not display: the external identifier, the code, the validity dates, and any custom field configured on the object type but not placed on that window. Those values are now sent back unchanged. The rebuilt Admin tabs described above use the same form and are covered by the same fix.

‍

Definitions can carry custom fields - CUR-4092

A definition groups the versions of a study, module group or module under one identifier. As part of the wider work on versioning, a definition can now carry a custom field of its own — an identifier from a source system, for example — kept on its Admin tab, through the reference API and through the reference CSV import. Before this a definition had nowhere to put one: the Admin tab reported a successful save and the value was dropped.

The Versions table on /definition/{id}/general now also marks the version that is active in the academic year you are viewing, rather than the one active today, which is how the version switcher has always read it.

‍

A cost report could fail for a study whose module groups have no description - CUR-4273

Module group descriptions were read under a name that had changed, so they were always empty, and the report failed outright for a study whose groups have no default description. This has been fixed, and the descriptions are read and shown again.

‍

Documents can be stored on a person, and stay visible when you switch academic year - CUR-4181

Adding a document through a competence or an applicant workflow failed. A document can now be stored on any object. A person's documents are also no longer filtered by academic year, so they stay visible when you switch year, which matches the way person and competence data already works.

Purging a deleted academic year now removes the documents that were uploaded on that year's objects as well. Before, the purge left them behind, and because they no longer belonged to a year they then appeared in every year.

‍

Teacher remarks are shown in the Staff availability report and in the API - CUR-4031, CUR-4033, CUR-4114

On the availability preference page a teacher records when they are available to teach, and can add a remark. Schedulers could not see which teachers had left one, because the report showed only the day and time-block choices. Remarks is now a column in the details of the Staff availability report and on the Schedule preferences tab of a person, sortable like the other columns and shortened in the cell with the full text on hover. A remark is recorded once per person and period, so it is the same on every row for that person in that period. The Staff availability report is now also sorted by name by default, rather than by an internal identifier.

The same remark was added to the availability preference endpoint, so an integration receives what the report shows. It is optional: a preference without a remark leaves the field out rather than sending an empty value.

‍

Integration

Extensions, improvements and fixes to the integrations: the Curriculum API, OOAPI, CSV import, and the data exchange with Data Manager, Core and the broker.

Loading studies, module groups, modules and reference data in bulk - CUR-4194

Loading a large set of objects meant one call per object. Four new endpoints accept a list instead — /import/v2/study/upsert, /import/v2/module-group/upsert, /import/v2/module/upsert and /import/v2/reference/upsert — taking up to 25 objects per request and answering with a result per object next to the totals, so a partial success can be acted on. Each object is created or updated as a whole, and a module group whose structure cannot be applied is no longer stored in part.

The Import permission is now also enough on its own to import any reference type. Four of them, among them the study type and the module type, additionally required administrator rights, so an integration account holding only Import was refused. See developer.timeedit.com for the endpoints.

‍

Group filters can be sent as a structured model - CUR-4246, CUR-4236

A module group can draw its modules from a filter rather than an explicit list. Over the API that filter was one line of expression syntax, which is awkward to build from an integration and cannot be described in the API documentation. It is now a list of filters under groupFilters and moduleFilters, each with a name, an operator and a value, so an integration works against fields instead of assembling syntax. Numbers are recognised as numbers, filters can be combined with and, or and not, and there are now in and not in operators for matching a value against a set.

This is groundwork for the TimeEdit Study Planner, which will resolve a group's modules from the same filter. The structured form is the API's only; in Curriculum the filter is still edited as an expression on the module group, and what is stored has not changed.

‍

An organisation can now be set on a specification and on a qualification - CUR-4072

A study and a module can be linked to a department through their organisation, and processes follow that link to find the related roles. A specification and a qualification had no such field, so a custom field had to stand in for one and processes at that level could not find the department. Both now carry an organisation next to the faculty they already had — organisationId on the object, an organisation reference in the canonical API, and a column in the CSV import and export that takes the organisation's external identifier or its code.

Worth knowing before you fill it in: access rules and role propagation follow the organisation, so setting one on a specification or qualification lets everyone holding a role on that organisation reach it. It only ever widens access, never restricts it, and the same field is used to resolve process notification recipients and the responsible person for a process. Check your role assignments on the organisation before populating the field across a catalogue.

‍

Sending teacher availability to Core no longer stops at the first failure - CUR-4233 (Hotfix)

Availability is sent to Core with Invoke hook, from the report of a process or from a process step. It failed for most rows while part of the data did arrive, which left the export impossible to repeat because Core already held what had been sent. Two separate defects caused it: a successful answer from Core could not be read at all, because it leaves a field empty where a number was expected, and a batch that met a failure stopped the batches behind it. Both are fixed — the remaining batches are now sent, and the failures are reported as one readable line rather than an unreadable error.

‍

Security

Our build process scans continuously for known vulnerabilities. Fixes are prioritised by impact: some go out as an immediate hotfix, others in the current or next sprint. See the central database of vulnerabilities for details.

‍

Implemented security fixes - CUR-4214

Change and feedback data is now returned only to users who may view changes on the object concerned. Every remaining endpoint that reads it, including the report cells that render change content, refuses a user who has been denied access rather than answering with an empty result.

View feedback now includes view changes. A reviewer holding only View feedback sees the Changes tabs, the changes list and the Changes report together with the review discussion; a user holding only View changes sees what changed but not the discussion.

‍

Continued investment in tooling and quality

Ongoing improvements to our automated testing, build pipeline and dependency scanning, so errors and security issues are caught earlier.

See the Curriculum manual for configuration guidance.

The following was released on the Test environments on Sept 10 and will be available on Production next week

Split Reservation

Splitting reservations in Core (available in the new Exam/Assessment workflow) has received som significant upgrades:

• Edit all fields on the new Group object that will be created
• Select individual members to move to the new Group. Filter and sort existing members to find the ones that satisfy some specific criteria and move only them. It's still possible to split the groups members based on desired group sizes only.
• It's now possible to create a new reservation with the newly created Group directly next to the existing one, so that you can move it to a new time or container at will.

Bug fixes

• Resolved an issue where the dialogs for adding and removing objects from multiple reservations would only add or remove one object, even if more than one was selected.

This release note lists the features, improvements and fixes in this version. Release dates per version are published in the Evaluation release schedule.

‍

Improvements

Participation graph not working - EV-447

The Participation page (#/participation-progress) shows a graph of how many participants started an evaluation per day, over a date range you choose. The graph was not drawn at all, even when there was data for the selected period. This has been fixed, and the graph is correctly shown again. The two date fields above it are now also laid out side by side rather than stacked.

Charts should follow the date filter on the Participation, Signed-in users and Participant sessions pages - EV-445

These three admin pages each show a chart above a list, with both driven by the same date range filter. When the date range was changed, the list below was updated but the chart sometimes kept showing the range that was loaded when the page was opened, so the two no longer described the same period. This has been fixed, and the chart is now redrawn together with the list whenever the filter changes.

Continued investment in tooling and quality - EV-445

We’ve updated and improved the tools we use to develop and maintain Evaluation and its services. This includes improvements to our automated quality checks and updates to the underlying technology, making it easier to keep the application reliable.

See the Evaluation manual for configuration guidance.

This release note lists the features, improvements and fixes in this version. Release dates per version are published in the Study Guide release schedule.

Improvements

The catalogue should open in the best language - SG-714

The catalogue can be offered in more than one language, with the available languages and the default set in the parameters. That configuration was not always correctly honored. This has been fixed, and the configured language should now be correctly served.

A reader's own choice now takes precedence over the institution's default: someone who picks English from the language switcher keeps English on later visits even where the default is Dutch, and clearing that choice returns them to Dutch in this case. Where no choice has been made the catalogue follows the reader's browser, as long as it asks for a single language the system offers: a browser set to accept only Dutch gets Dutch, even where the default is English. A browser that is configured to "accept" both English and Dutch will still respect the language.default setting as always.

As part of these improvements, the Swedish language pack has been improved as well.

The number of results per page should be kept when paging - SG-728

Choosing 50 results per page and then moving to the next page returned a page of 10, because the page size was dropped along the way and fell back to its default. This has been fixed, and the page size is kept as you move through the pages. Changing the number of results per page now also takes you back to the first page, since a different page size renumbers the results. The same cause also cleared a filter or a sort order that was re-selected at the value it already had, which is fixed too.

Selected filters should be shown as a label instead of a code - SG-666

The active filters listed above the results sometimes showed the stored code rather than the label, so a student saw "Period: S1" where the filter panel beside it said "Period: Semester 1". This has been fixed, and both now show the label.

Input validation on the values of a number filter - SG-327

Filters let students narrow a list of (for example) modules, and are configured under the admin settings. A number filter, credits being the usual example, takes a list of values that become the selectable options. To make it easier to configure this kind of filter, we've added more input validation and tooltips.

Layout improvements - SG-725

In the previous release, we made a couple of tweaks to layout and styling. Now, a round of spacing and alignment fixes across the catalogue: like increased padding of the search results when expanded, improved icon alignment and hover states, smoother animations when opening modules groups and optimizations for tablets.

Continued investment in tooling and quality - SG-729

We’ve updated and improved the tools we use to develop and maintain Study Guide. This includes improvements to our automated quality checks and updates to the underlying technology, making it easier to keep the application reliable.

See the Study Guide manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.

Changes report doesn't show the actual changes - CUR-4141 (Hotfix)

A role with permission to view changes could open the Changes report but didn't see the actual changes. This has been fixed, a user with the required permission now sees the changes again.

Link types now only offer objects matching the configured source and target type - CUR-3865

When configuring a link type, the object picker could in some specific scenario's offer objects of any type, regardless of the source and target type set on the link type. This has been fixed, so only matching objects are offered.

Faculty and Organization now expose the same Delete options as Study - CUR-4046, CUR-4060

The Delete and Delete (+ History) buttons available on for example Study were missing from the Faculty and Organization admin pages. On top of that, permanently deleting a Faculty or Organisation that was still referenced elsewhere (for example a module using that Organisation, or a Faculty with a configured process) failed with a server error, because the cleanup behind a permanent delete did not clear every reference. Both have been fixed: Faculty and Organization now show the same Delete and Delete (+ History) buttons as Study, and permanently deleting a referenced Faculty (including faculty parameters) or Organisation no longer fails.

Method-report now offers a facultyId column - CUR-4096

The method-report did not offer facultyId as a column, unlike the assessment-report. This has been added, and organisationId and studyId (already usable as filters) are now also available as report columns as well.

Some pages show an access-denied message instead of an empty page when a view permission is missing - CUR-4202

Several migrated pages (including the changes report, changes list, link list, assignments report, competences report, applicants report and workload study report) did not enforce the view permission, so a user without permission could see a blank page instead of a clear message. Each of these pages now requires the same permission and shows an access-denied message when that permission is missing.

It could happen pages showed an error when an assignment had no Organisation - CUR-4207

An assignment or vacancy could end up without an Organisation, which caused a server error on various pages, including on navigation between faculty pages. This has been fixed: the UI now rejects saving an assignment or vacancy without an Organisation, and existing data missing an Organisation no longer causes a crash.

Change report details now open in a drawer instead of a modal - CUR-4105 + CUR-3053

Clicking a row on the change report previously opened the change details in a modal. It now opens in a side drawer, matching the updated design, with general information, the change itself, comments and status transitions grouped into clearly titled sections, and review actions moved to the drawer header.

Migrated Reports: several changes - CUR-4137 + CUR-4152 + CUR-3195

Several reports have been migrated this sprint. Following the migration of the changes, assignment, competences and applicants reports to, the column selector was missing several capabilities the previous version had. Select all/deselect all (per column group), drag-and-drop reordering of selected columns (including full keyboard support), and an indicator for which group a selected column belongs to have all been added back. Sort direction now shows as an indicator on the sorted column itself instead of a separate row.

Person-report now offers an organisationId column - CUR-4095

The person-report did not offer organisationId as a column, even though the field is available as a custom field elsewhere. This has been fixed, and organisationId is now available as a report column, alongside facultyId.

Default result size for migrated forms increased to 250 - CUR-4155

Search results in the typ eahead pickers used throughout the migrated forms have been increased from the previous default to 250 results.

The Faculty.organisations route didn't give any results - CUR-4097

The faculty.organisations route returned a tab with no data, unlike the equivalent faculties.faculty.organisations route. This has been fixed.

Integration

The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.

Offering start and end dates were not applied when importing via the canonical integration - CUR-4193

An offering’s start and end dates sent through the canonical integration were read from the wrong place internally and were never applied — they stayed at their previous value regardless of what was sent. This has been fixed, and an imported offering’s start and end dates are now applied as sent.

Needs action: if your integration sends offering start and end dates, those dates will now actually be applied, where previously they were silently ignored. Please verify the dates you send are correct before this release reaches production, since previously-imported offerings will start picking up the sent values instead of keeping their existing ones.

New API endpoint for managing offerings independently of the parent module - CUR-4188

A new canonical endpoint (/api/import/v2/offering) is available to create, retrieve and delete offerings without having to resend the entire parent module.

Export log no longer shows a misleading error when activities send successfully - CUR-4082

Exporting a module to the Activity Manager / Data Manager integration could show an error message in the export log even though the data had already been sent successfully. Every offering with a configured template now sends a request as part of the export, including offerings with no activities, so previously-sent activities can be cleared from Data Manager on a resend. As a result, an offering with nothing to export now shows as a plain ‘Completed’ rather than the ‘No request’ status the previous integration showed for the same case.

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.

No updates this release.

Refer to the Workload Manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

Versioning update

Two releases ago we introduced the concept of versioning on beta. Since then a couple of customers tested the functionalities. Based on those we made several changes and improvements. We are at a stage we decided to make versioning part of the standard release process from now on. So as part of this release we’ll add versioning tot he main release. Does the mean versioning is completely ready? No, there are still a few more tickets we'll pick up in the coming sprints.

Based on the feedback received we made the following changes improvements related to versioning:

Create a new version while working in a study, module-group or module maintain process - CUR-4093

Previously, creating a new version of a study, module-group or module required leaving the maintain process for that object. A "create new version" option is now available directly from within the process. This can be enabled by using a new versions page template that lists all versions of an object and marks which ones are active. The example below shows all versions of a module and the + button to create a new version based on an existing one.

Copy activities from a previous version when creating a new module version - CUR-4010

When a new version of a module is created, the offering was copied to the new version but its activities were not. It is now possible to copy activities from a previous version’s offerings into the new version.

The copy can be made from the activity grid or the activity list page (that didn't change). The amount on the printscreen below shows the amount of activities you're about to copy.

Appraisal, assessment, method and method schema data now follows a versioned module correctly - CUR-4098

When a module uses versioning, its appraisal, assessment, method and method schema data isexpected to remain visible in every academic year the version is active in. This has been fixed,so this data is no longer tied to a single academic year when the parent module is version-based.

As an Admin I would like to use the definitionId to generate a code - CUR-4112

This work item involved defining and implementing a formula for generating study codes based on :definitionId. This is now made possible.

Add the field ‘definition’ to reports - CUR-4085

Reports on study, module-group and module can now include the definition as a column. The way to add the column work as it always works. The example below shows the definition column at module level (showing code and name of the definition):

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.

Changes report doesn't show the actual changes - CUR-4141 (Hotfix)

A role with permission to view changes could open the Changes report but didn't see the actual changes. This has been fixed, a user with the required permission now sees the changes again.

Link types now only offer objects matching the configured source and target type - CUR-3865

When configuring a link type, the object picker could in some specific scenario's offer objects of any type, regardless of the source and target type set on the link type. This has been fixed, so only matching objects are offered.

Faculty and Organization now expose the same Delete options as Study - CUR-4046, CUR-4060

The Delete and Delete (+ History) buttons available on for example Study were missing from the Faculty and Organization admin pages. On top of that, permanently deleting a Faculty or Organisation that was still referenced elsewhere (for example a module using that Organisation, or a Faculty with a configured process) failed with a server error, because the cleanup behind a permanent delete did not clear every reference. Both have been fixed: Faculty and Organization now show the same Delete and Delete (+ History) buttons as Study, and permanently deleting a referenced Faculty (including faculty parameters) or Organisation no longer fails.

Method-report now offers a facultyId column - CUR-4096

The method-report did not offer facultyId as a column, unlike the assessment-report. This has been added, and organisationId and studyId (already usable as filters) are now also available as report columns as well.

New module-groups now show the relational ‘required’ field on creation - CUR-4163

Adding a module-group or a module in the structure creates two things: the object itself, and the structure relation that places it under its parent. Those relations are study to module-group, module-group to module-group, module-group to module, and study to module, and they carry their own fields, such as Required, Phase and Cluster.

A create page is a page of route form, configured under Pages and selected as the create page on a custom type. It decides which fields a user is asked to fill in.

What it used to do. The modal showed the visible object fields or the create page fields, plus the relation field Required. That list lately drifted away from what was configured: institutions reported that Required was no longer offered on the New tab, and a create page on the module-group left the relation fields out altogether.

What it does now. There is no fixed field list anywhere. Each half of the modal resolves on its own, by the same rule:

the create page configured on that type — or, when there is none, every visible field of that type.

• No create page on either half: all visible object fields, plus all visible relation fields.

• A create page on the object type only: the fields on that page, plus all visible relation fields.

• A create page on the structure relation only: all visible object fields, plus the fields on that page.

• A create page on both: exactly what is configured, on both halves.

Each section is headed with the type and the create page its fields came from, this clarifies if a remark is for the object, or the relation. A section with nothing configured on it, neither a visible field nor a create page with fields on it, is left out rather than shown empty; for the study to module relation, the relation itself is then not created either!

The same modal is now used from the structure page, the study cost page, the planboard, the dashboard, and the module and group reports. The planboard does not offer the study to module section for now.

Adding a group from the structure page: one section for the group and one for the study to module-group relation, each named after the create page it came from

New in this release

• Create pages on structure relations, through the new Entity type setting on a form page, so the whole modal can be configured. Make sure to set the Page is usable for field too.

• The study to module relation is offered as a section of its own.

• Alternative, Sequence, Description and any custom field defined on a relation can now be shown in the create modal. The relation half used to be fixed to (if visible) Phase, Cluster and Required.

• Edit in structure on the study cost page. A new page option, showEditInStructure, off by default, adds it to the row menu and opens the same relation modal the structure page uses, just to align the pages a bit more.

• The Version tab appears on the dashboard and on the module and group reports when versioning is enabled.

The Entity type setting on a form page

Changes to be aware of

• Modules and module-groups show every visible field when no create page is configured, instead of the old five (code, local name, English name, type and Copy from). The modal can be considerably longer than before.

• Credits and additional fields are no longer offered automatically. Credits used to appear whether or not anyone had configured them, this is no longer the case. You must now configure these fields through a create page.

• Study, faculty, organisation, qualification, rule, specification and other types' behavior is out of scope of these changes.

Needs action

1. Configure a create page on the module and module-group types to control which fields are asked at create time, including if desired credits and additional fields. While you can also review on just the visible fields, this is intended as a fallback.

2. Add Copy from to the create page of every versioned type, or make it visible on the type where no create page is used. Without it, a new version cannot be created. Note that for now, the create page for New and Version are the same, so you might want to add a tooltip when to fill it in. We might revisit this later.

Extra fixes

• One comment covers the object and all its relations. Every type has its own Comment type setting and the strictest decides: optional on a relation makes the comment field appear, required makes it mandatory. This now also holds when placing an existing module-group or module, which previously saved without asking even where the relation was configured as required.

• A new version needs Copy from. Where that field was unavailable, the Version tab used to create an object that looked like a version but was related to nothing. It now refuses and says why: either Copy from is not enabled on the create page of the type, or it is not configured as visible on the type.

• The Existing tab matches the New tab. It resolves its relation fields in the same way and notes that the values entered apply to all selected objects. The selection is now first, then the relation fields. Alerts were added to explain that the relation fields apply to the full selection.

• Groups already on that level are left out. Selecting one again and saving cleared the relation data that had already been configured for that placement. Only the level being added to counts: a group can still be reused under year 1 and again under year 2, a group used deeper in the structure stays on offer, and a group whose placement was removed is available again.

• Alternative on a module saves. A spelling mistake in the field name meant it was never stored.

• The phase is saved from the study cost page. That page built its save without the phase, so a phase entered there was silently dropped; the same phase entered on the structure page was stored correctly.

• The planboard now saves descriptions again

This is a large change to a screen that is used every day, so we would very much like your feedback on it. Please reach out if something does not work as you expect, or if you feel it should be tweaked.

An example configured

At group level we linked create page:

Study - Module Group level we did the same:

This two pages are then combined as following:

Some pages show an access-denied message instead of an empty page when a view permission is missing - CUR-4202

Several migrated pages (including the changes report, changes list, link list, assignments report, competences report, applicants report and workload study report) did not enforce the view permission, so a user without permission could see a blank page instead of a clear message. Each of these pages now requires the same permission and shows an access-denied message when that permission is missing.

It could happen pages showed an error when an assignment had no Organisation - CUR-4207

An assignment or vacancy could end up without an Organisation, which caused a server error on various pages, including on navigation between faculty pages. This has been fixed: the UI now rejects saving an assignment or vacancy without an Organisation, and existing data missing an Organisation no longer causes a crash.

Change report details now open in a drawer instead of a modal - CUR-4105 + CUR-3053

Clicking a row on the change report previously opened the change details in a modal. It now opens in a side drawer, matching the updated design, with general information, the change itself, comments and status transitions grouped into clearly titled sections, and review actions moved to the drawer header.

Migrated Reports: several changes - CUR-4137 + CUR-4152 + CUR-3195

Several reports have been migrated this sprint. Following the migration of the changes, assignment, competences and applicants reports to, the column selector was missing several capabilities the previous version had. Select all/deselect all (per column group), drag-and-drop reordering of selected columns (including full keyboard support), and an indicator for which group a selected column belongs to have all been added back. Sort direction now shows as an indicator on the sorted column itself instead of a separate row.

Person-report now offers an organisationId column - CUR-4095

The person-report did not offer organisationId as a column, even though the field is available as a custom field elsewhere. This has been fixed, and organisationId is now available as a report column, alongside facultyId.

Default result size for migrated forms increased to 250 - CUR-4155

Search results in the typeahead pickers used throughout the migrated forms have been increased from the previous default to 250 results.

The Faculty.organisations route didn't give any results - CUR-4097

The faculty.organisations route returned a tab with no data, unlike the equivalent faculties.faculty.organisations route. This has been fixed.

Integration

The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.

Offering start and end dates were not applied when importing via the canonical integration - CUR-4193

An offering’s start and end dates sent through the canonical integration were read from the wrong place internally and were never applied — they stayed at their previous value regardless of what was sent. This has been fixed, and an imported offering’s start and end dates are now applied as sent.

Needs action: if your integration sends offering start and end dates, those dates will now actually be applied, where previously they were silently ignored. Please verify the dates you send are correct before this release reaches production, since previously-imported offerings will start picking up the sent values instead of keeping their existing ones.

New API endpoint for managing offerings independently of the parent module - CUR-4188

A new canonical endpoint (/api/import/v2/offering) is available to create, retrieve and delete offerings without having to resend the entire parent module.

Group type filter support added for study/module-group/module integration - CUR-4170

The integration for defining a group now supports a filter-based group type, in addition to the existing explicit lists of modules and groups (modulesFilter and groupsFilter).

Route endpoint can now be filtered by study - CUR-4088

The route endpoint (/api/import/v2/route) previously always returned routes from every study. It now accepts an optional study parameter to filter the results to a single study.

Export log no longer shows a misleading error when activities send successfully - CUR-4082

Exporting a module to the Activity Manager / Data Manager integration could show an error message in the export log even though the data had already been sent successfully. Every offering with a configured template now sends a request as part of the export, including offerings with no activities, so previously-sent activities can be cleared from Data Manager on a resend. As a result, an offering with nothing to export now shows as a plain ‘Completed’ rather than the ‘No request’ status the previous integration showed for the same case.

Next to generic tickets there are a few versioning related integration tickets:

New API endpoint for managing definitions - CUR-4191

Managing definitions can be done via the existing reference endpoint (/api/import/reference) . A newly created type 'DEFINITION' is available to create, retrieve and delete definitions directly, rather than relying only on automatic creation.

Version added to the canonical for study, module-group and module - CUR-4190

The canonical integration now exposes a version indicator (version) on study, module-group and module, alongside the existing definition field, for tenants using versioning. The previous metadata.versionNumber field remains available for existing integrations.

API support for delivering a plain string as definitionId - CUR-4169

Where an integration only has a definition identifier available as a string, rather than a full definition object, that identifier can now be passed through as-is.

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.

No updates this release.

Refer to the Curriculum manual for configuration guidance.

The following was released to all Test environments on Sept 2 and will be available on Production next week

General improvements

Activity Export has seen some updates, where only selected activities will be exported. This means that you can filter on a subset of activities, select all and export only those activities, rather than an entire form at a time. Another improvement here is that the export report is now secured behind the regular login, which means that only logged in users can download the report.

It is now possible (for the new assessment workflow) to split the group of an already scheduled activity, which will then create a new not scheduled track. Also, when splitting a group using this feature, or the similar feature in Core (Split Reservation), only the Student members will be kept. All other members will be removed from the new groups

The following was released on all Test environments on Sept 1 and will reach Production a week later.

General improvements

Activities are now marked as Not scheduled, when cancelled directly from Core. Any reservation that has been scheduled from Activity Manager will now sync back to AM whenever a user cancels it in Core. This will help users keep an up-to-date list of Activities in AM with the correct Scheduling status

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Study guide release schedule.

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

The with of module-group description should follow the standard - SG-706

Search typeahead (quick-search) should show a larger result - SG-704

From a design and usability perspective, the quick-search is a quick-search and not meant to perform a full search with all bells and whistles. That's where the standard search is meant for.

Based on the issue an the guideline, a change has been made to the behaviour of the quick-search to optimise the behaviour, but still being a quick-search:

• The quick-search will find the first 50 matches
• The quick-search will show an indicator if > 50 matches are found, e.g. 50 out of 267 found
• The quick-search will show the first 10 immediately and provide a scroll-bar to browse the other additional items found

This change doesn't mean that the sketched situation can no longer happen, but the change a part of a code or a vital part in the name of a name exists more than 50 times is slim. And if it happens, the student is actively informed that not all items are shown, and can choose to adjust the quick-search or use the standard search and browse through all results using the pagination options.

Search typeahead (quick-search) should respond 'near immediate'  - SG-719

Improve robustness of the organisation feed from Curriculum - SG-715 (Hotfix)

Last version the release delivered new functionality to show/filter on organisations. The automated log analyser noted that in some cases an organisation was not properly exchange from Curriculum. The cause has been found and fixed, so organisations will be fed without errors keeping our logs clean. And of course more important make sure all organisations are available in the Study guide.

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. ‍

For more information on reported vulnerabilities, see the central database of vulnerabilities.

During this release no security vulnerabilities were reported, requiring mitigation.

‍

For more guidance on configuration and setup of Study Guide, use the relevant Study Guide manual.

‍

The release notes provide information on the features and improvements in the specified version.  The release dates related to the versions are published in the Evaluation release schedule.

‍

Improvements

New functionality, user experience refinements, and bug fixes. Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

Usage of global and personal feedback in External Examiner should be consistent - EV-438

The External Examiner questionnaires offer two options to deliver feedback on the examined specification or programme. It was found that the different options, usage and related effects for delivering feedback were not clear for the users, not clear enough in the system.

Let's first start with a more in-depth clarification, and then define the change applied, and it's possible effect.

For a specification or programme-level evaluation, there can be one or more External Examiners as participants. Each EE completes their own questionnaire and only sees their own responses. The Programme Leader can then view these responses through the configured report, selecting the relevant participant where there is more than one EE.

An EE can provide two types of feedback:

• Participant feedback – feedback specifically intended for the selected EE.
• General feedback – feedback relating to the specification/programme evaluation as a whole, which should be the same regardless of which participant's report is being viewed.

What we have found (bug)

We have identified an issue with the general feedback field shown within the report.

Although this field is presented and intended as general feedback, feedback entered there has in fact been stored against the participant whose report was being viewed at the time. This means that, for an evaluation with multiple EEs, different "general" feedback may currently exist for each participant.

That is not the intended behaviour, and we are fixing this bug.

Depending on permissions/configuration, users may also have access to a separate Feedback tab, which contains the general feedback field. This means users could effectively encounter two places that appeared to be for general feedback, causing interpretation / usage issues.

What we are changing

We are making two changes so that the workflow is clearer and consistent going forward:

1. The general feedback field in the report will become genuinely general. It will no longer depend on which participant's report is being viewed.
2. In a next release an option will be added to hide the separate Feedback tab for users. This will allow the report itself to be the single place where EE responses are reviewed and provide both participant-specific and general feedback.

This should give us a much more straightforward workflow and a stable configuration to use going forward.

Action:

Due to the bugfix, it could be that feedback meant as 'generic', has been stored as 'participant'. The change will store and show the data in the correct location, which could mean that the 'generic' intended information is not shown on the report. The possible effected customers will get a message from Support team, to provide more information and a request if reports are effected and what we can do to assist.

Security

An integral part of our development and build process is the automatic scanning for known security vulnerabilities. Fixes are prioritised based on impact: some may require an immediate hot-fix, while others are addressed in the current or next Sprint (release). For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

Implemented security fixes - EV-437

Based on our daily running security validation, the used libraries with either a critical or high reported vulnerability have been evaluated for impact (false positive validation) and based on the result updated.  

Refer to the Evaluation manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

‍

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.

‍

As an administrator I want to define attributes for scripts - CUR-4064 (Hotfix)

The migration of the script page to the new look and feel, accidentally added a more strict validation on the input fields. This prevented for instance to type the cron execution timing of scripts. This has been fixed, and the input fields can be used as expected.

‍

As a admin I want to search faster for a role  - CUR-4066 (Hotfix)

When searching for a role in the admin tab, the search for the role when using code or externalId was executed after every character typed. This was causing some UX side-effects of waiting and annoyance. This has been fixed, and the search will now wait a little longer to allow for multiple characters to be typed before the search is executed.

‍

The workflow welcome page should respect the alignment - CUR-4068 (Hotfix)

The welcome page didn't respect the alignment set. This has been fixed, and the alignment set will be respected.

‍

The search for relations should be faster  - CUR-4065 (Hotfix)

When searching for relations previous results or no results could be shown. This could be caused due to the previous search was not yet finished. Fixes are applied to wait a number of milliseconds between the character typed and starting the search, giving the use a little more time to type more characters before hitting the search immediately after the typed character. The search has been optimised with a performance boost of up to 5 times.

‍

The assessment type should respect the field settings - CUR-4081

When creating or editing an assessment, the behaviour of the assessment type changeability was hard-coded. It should follow the defined configuration and enable the behaviour to only allow change of an assessment type at create time, and only show the assessment type at edit (or read-only) time. A change is applied and the assessment type behaviour will follow the defined configuration.

‍

UX and WCAG2.2 accessibility improvement update - CUR-3799, CUR-3116,  CUR-4117, CUR-3120

Reported earlier, but just a reminder this is still work in progress. The user interface will gradually be updated (page-by-page) with a new look and feel and user experience. The majority of the administrative pages are done, and the next step is migration of the user-facing pages. There will be a 'freeze' in the process, to prevent changes in the peek time of the different processes. The new pages are automatically and manually tested against WCAG2.2 compliancy.

‍

As a proces manager I should be able to copy the weekly availability to a new period - CUR-3548

The standard behaviour for the weekly availability pattern gathering is to start with an empty pattern, so the user can fill-out their availability for the requested period/semester. To support starting with a filled template based on the previous period/semester a hook is made available.

Configuration:

• Go to Administration / hooks
• Define (create) the new hook (select the generate availability preference and give it a description)
• Use the hook, e.g.:
  • At the first process status, so when starting the hook the availability will be pre-filled
  • From the process manager. his will allow to fill the availability at the end of the process cycle. For instance filter all availability request that have not reach the final status (or are still in the initial status. That means they are not picked-up by the staff member. For those fill the availability using the hook.

When searching a user should be informed the number of search result exceed the 'search limit' - CUR-3906

When using a search from a search box, the information found is shown immediately. The search results are capped at 10, which means a larger search result will stop at 10.  This was not clear for the users, resulting in not finding the information in the list. A change is made to the search results information where the user is informed about the  number of items found and the number of items shown (e.g. 10 of 3475 shown). The message only appears if the search result crosses the paginated search boundary (currently set at 10). The user is aware and can adjust the search to improve the search results.

‍

Integration

The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.

‍

Activities with no duration should not be sent to DM - CUR-3951

Activities can be defined with a no duration.  Since these activities need no scheduling, a choice is made to filter these activities from the DM integration. This means that activities with no or zero duration will not be exchanged to DM.

‍

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

Implemented security fixes - CUR-3083, CUR-3862

Based on our daily running security validation, the used libraries with a either a critical or high reported vulnerability have been updated.  

Next to that we solved some minor findings from the internal white box security test.

‍

Refer to the Workload Management manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

‍

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.

‍

As an administrator I want to define attributes for scripts - CUR-4064 (Hotfix)

The migration of the script page to the new look and feel, accidentally added a more strict validation on the input fields. This prevented for instance to type the cron execution timing of scripts. This has been fixed, and the input fields can be used as expected.

‍

As a admin I want to search faster for a roles  - CUR-4066 (Hotfix)

When searching for a role in the admin tab, the search for the role when using code or externalId was executed after every character typed. This was causing some UX side-effects of waiting and annoyance. This has been fixed, and the search will now wait a little longer to allow for multiple characters to be typed before the search is executed.

‍

Versioning information should only be shown in case versioning is enabled - CUR-4076 (Hotfix)

The implementation of the versioning introduced some new information and warning messages when manipulating module-groups. There should be validation to only show them in case versioning is enabled, but this was not the case. This has been adjusted, and versioning related messages will only show when versioning is enabled.

‍

The workflow welcome page should respect the alignment - CUR-4068 (Hotfix)

The welcome page didn't respect the alignment set. This has been fixed, and the alignment set will be respected.

‍

The search for relations should be faster  - CUR-4065 (Hotfix)

When searching for relations previous results or no results could be shown. This could be caused due to the previous search was not yet finished. Fixes are applied to wait a number of milliseconds between the character typed and starting the search, giving the use a little more time to type more characters before hitting the search immediately after the typed character. The search has been optimised with a performance boost of up to 5 times.

‍

The assessment matrix should show results - CUR-4026

In case an assessment was defined for a module with no offerings, and the assessment was part of the assessment tree of matrix, the page wouldn't show. In a production setting not likely to happen. A change is made to be more forgiving in this two pages for modules with no offerings, so the information will be shown instead of a blank page.

‍

The lexical editor should keep videos in edit mode - CUR-3978

The new lexical (text) editor was loosing a defined video in the text when switching to edit mode. A new text saved the text including video correctly, the preview shows the video, but the switch to edit lost the video. This has been adjusted and the video is kept when switching to edit mode.

‍

The assessment type should respect the field settings - CUR-4081

When creating or editing an assessment, the behaviour of the assessment type changeability was hard-coded. It should follow the defined configuration and enable the behaviour to only allow change of an assessment type at create time, and only show the assessment type at edit (or read-only) time. A change is applied and the assessment type behaviour will follow the defined configuration.

‍

Application change approval should logged in audit log instead of change log - CUR-3941

Administrator changes are registered and shown in the Administrator -> Audit log report. It was noted that some actions (e.g. checking a change as marked 'done') were registered in the standard audit log for curriculum changes. This has been fixed, and the standard audit / change log will solely be used for curriculum (data) related changes.

‍

UX and WCAG2.2 accessibility improvement update - CUR-3799, CUR-3116,  CUR-4117, CUR-3120

Reported earlier, but just a reminder this is still work in progress. The user interface will gradually be updated (page-by-page) with a new look and feel and user experience. The majority of the administrative pages are done, and the next step is migration of the user-facing pages. There will be a 'freeze' in the process, to prevent changes in the peek time of the different processes. The new pages are automatically and manually tested against WCAG2.2 compliancy.

‍

As a proces manager I should be able to copy the weekly availability to a new period - CUR-3548

The standard behaviour for the weekly availability pattern gathering is to start with an empty pattern, so the user can fill-out their availability for the requested period/semester. To support starting with a filled template based on the previous period/semester a hook is made available.

Configuration:

• Go to Administration / hooks
• Define (create) the new hook (select the generate availability preference and give it a description)
• Use the hook, e.g.:
  • At the first process status, so when starting the hook the availability will be pre-filled
  • From the process manager. his will allow to fill the availability at the end of the process cycle. For instance filter all availability request that have not reach the final status (or are still in the initial status. That means they are not picked-up by the staff member. For those fill the availability using the hook.

When searching a user should be informed the number of search result exceed the 'search limit' - CUR-3906

When using a search from a search box, the information found is shown immediately. The search results are capped at 10, which means a larger search result will stop at 10.  This was not clear for the users, resulting in not finding the information in the list. A change is made to the search results information where the user is informed about the  number of items found and the number of items shown (e.g. 10 of 3475 shown). The message only appears if the search result crosses the paginated search boundary (currently set at 10). The user is aware and can adjust the search to improve the search results.

‍

Audit trail improvements

During the upcoming sprints there will be a revamp of the audit trail reporting options. Based on feedback it is clear the audit trail in its current form requires some updates to make it more useful. The main issue is the fact the audit trail is showing too much information. The audit trail was not configurable and shows the audit log for a specific education object including all changes in the related child object. This means for a study, not only the changes at study level were shown, but also changes to the level of a number of group or room type change on an individual activity. Too much information for validating and approving a curriculum based on the vital changes.

The main change is the option for the administrator to configure so-called 'change categories', e,g. 'relevant study changes for approval'. A change category can be configured in such a way that the relevant educational objects and sub-objects can be selected, so only the changes made to the selection will be in the change report. The administrator can then configure the report to show a specific defined category and use the page in the relevant workflows. The user will have the option to switch between reports with meaningful names, focussing on specific change areas.

Next to this changes, the earlier already mentioned UX (UI) and WCAG2.3 compliancy will be picked up for the audit-trail and its related forms and reports.

‍

Move the change-report to the new UI components - CUR-3120

The first step is the migration of the change-report to the new look and feel using the standard TE UI components. There will be done some additional changes, e.g. to support the selection of the configured 'change category'.

As an administrator I want to define change categories - CUR-2686

As already mentioned above, the administrator will get the option to define so called 'change categories'. A  new menu-option is added to the Administration menu to define the Change/Audit categories.

The Administrator can create new categories, as is shown in the image below. Relevant information is:

• Code: required unique identifier
• Name: shown to the user in the 'select template' dropdown
• Overview of the selected change types
• Option to select more change types, based on the standard object structure and its sub-objects

The example show a 'relation changes' category. The selected reportable changes are bound to the relation for each of the educational object. The report will show only relation changes, based on the context the report is called and authorisation. Context means that if the 'Relation changes' template is used by a program director (study  level), only the relation changes from that study downwards will be shown (module-group, module).

The defined 'change categories' and their selected change types are listed when opening the administration menu.

As a bonus,  at object level the related 'change categories' are shown and clickable for direct navigation. 

‍

Integration

The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.

‍

The related api should report object-relation changes - CUR-3998

The related api provides information on the inner-object relations,  e.g. study -> module-group or study -> module. As part of the change to register the relation changes, the api related api is extended to provide the inner-object information,

‍

Activities with no duration should not be sent to DM - CUR-3951

Activities can be defined with a no duration.  Since these activities need no scheduling, a choice is made to filter these activities from the DM integration. This means that activities with no or zero duration will not be exchanged to DM.

‍

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

Implemented security fixes - CUR-3083, CUR-3862

Based on our daily running security validation, the used libraries with a either a critical or high reported vulnerability have been updated.  

Next to that we solved some minor findings from the internal white box security test.

‍

Refer to the Curriculum manual for configuration guidance.

The following has been released to the Test environments on Aug 19th and will reach production next week.

Bug fixes:

• Resolved an issue where selecting or deselecting weeks in calendar forms would sometimes not work
• Resolved an issue where the status of Activity generation for submissions would not update when Rejecting or Declining submissions
• Resolved an issue where the Primary object would sometimes be added as a Shared module

The following has been released to the Test environments on Aug 19th and will reach production next week.

Bug fixes:

• Resolved an issue where the Created by or Modified by fields of a reservation would sometimes be displayed incorrectly
• Resolved an issue where the Object list would sometimes display a duplicate row at the bottom when selecting objects.
• Resolved an issue where a placeholder in the selected list (type with no object selected) would be shown as 0 instead of -.
• Resolved an issue where the info-icon in Container reservations (Exam scheduling) would make it difficult to place reservations. The info icon is now removed from Container reservations when scheduling into them. (Right click → “View info” can be used instead)

This update was released to test 2026-08-17, and will be released to production 2026-08-24

• Viewer is now aligned with the TimeEdit authentication system. When a user signs out or switches profile, Viewer will reflect the change the next time the page is updated.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Study guide release schedule.

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes.  Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

Period view should show highlight the offering periods - SG-705 (Hotfix)

An issue was introduced, not highlighting the module offering period anymore. This has been fixed and the offered period is shown correctly again.

The display order of module-groups in the structure should follow the Curriculum order  - SG-703

The order the module-groups are shown in the structure overview of the study is different from the order shown in Curriculum. In case module-groups are assigned a sequence and one of them is not having a sequence, in Curriculum the 'empty' sequence is always shown last. In Study guide it was shown first. 

A change is made to use a standard (and same) ordering mechanism. The ordering in Study guide will follow the ordering used in Curriculum, and the module-groups with an 'empty' sequence will be positioned at the bottom of the structure.

‍

The amount of pages should be recalculated when adjusting a filter - SG-701

In case a filter is applied with result spanning multiple pages, the page navigation supports travelling the pages. When you are for instance at page 3, and apply an additional filter, the number of results is adjusted and could lead to having less results. Since the 'page' was kept, this could cause the situation that if the number of results was less than 3 pages, no results were shown.

A fix is made to 'reset' the page when adjusting the filter, and the user will start again on page 1 and more important see the results.

‍

As a user I want to filter on organisations - SG-561

The configuration of filter options didn't offer using the organisation as a filter. In case the organisation was used to relate educational objects (e.g. studies) to an organisation, these couldn't be filter. The option is added for the administrator to configure a new filter based on the organisation.

Configuration

The definition is similar to the definition of all other filters, define the filter and select the newly made available ORGANISATION entity type.

Additional action

When using the Broker to feed the Study guide the action to be performed is:

• Publish (via hook) the organisations to the Broker
• Synchronise (import) the data into the study guide so the organisations will be added to the data set. The advise is to wait for the next day to have them in the system based on the nightly synchronisation job.

‍

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. ‍

For more information on reported vulnerabilities, see the central database of vulnerabilities.

During this release no security vulnerabilities were reported, requiring mitigation.

‍

For more guidance on configuration and setup of Study Guide, use the relevant Study Guide manual.

‍

This release is pushed to test at release date and production 1 week later

Improvement

• The Copy reservations dialogue now supports custom week names.

• Improved the reservation flow so the view reloads only when the confirmation dialogue is closed. This prevents the view from jumping while a reservation is being created.
• Improved protection against malicious JavaScript injection by replacing ' characters with ʼ instead of removing them.

Bug fixes

• Fixed an issue where the configured field order under Search was sometimes not saved.
• Fixed an issue where an invalid username could create a broken entry in the Autocancel log.

Bug fixes (patched to test environment 10-08-2026)

• Fixed an issue where unavailability was not shown in the Copy to other dates dialogue
• Fixed an issue where wrong time was selected in the reservation dialogue when clicking on a time in the UI. Time zone information was also added to the dialogue to align with other parts of the UI and avoid confusion for users reserving resources in different timezones then their own setting.

‍

Improvements

• Improved the message shown when a search returns too many matching objects. The message now explains what happened and how the user can refine the search.

• Improved protection against malicious JavaScript injection by replacing ' characters with ʼ instead of removing them.

Bug fixes

• Fixed an issue where “About TimeEdit” could not be opened more than once.

• Support for alias email addresses, allowing rooms to be booked in Outlook with any of its addresses and still be recognized by the Outlook -> TimeEdit synchronization.
  • IMPORTANT: To allow fetching the alias email addresses, the new permission User.Read.All is required for the Microsoft Graph application.

Bug fixes

• Corrections to the Outlook event validation of the Outlook -> TimeEdit synchronization, which sometimes caused discarded events.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.

Notifications are duplicated when using teams - CUR-3956 (Hotfix)

In case notifications are sent from a process to a team with not generic team email, the email was sent to each of the team members. That was OK, but since the de-duplication was not implemented correctly, the number of notification sent to the each member was equal to the number of members in the team. E.g. 5 members ment that each individual member would get 5 notifications. This has been fixed, and each member will get one notification.

In case multiple offerings for a period, both should be shown in the workflow - CUR-3868 (Hotfix)

The case multiple offerings are defined for the same period, in the workflow activity-overview only the first offering was shown. This has been fixed, and activity-overview will show all offerings both in the structure page and the workflow page.

As a manager I want to have access to the uploaded proof for a user competence - CUR-3924 (Hotfix)

In the last version the upload of documents as proof of a person competence has been added. The competence-report was not yet updated (accidentally missed this), so the report was not accessible in the report. Several changes have been made to the competences report, that amongst others solves the reported issue:

• Add the option to configure the fields to be shown in the competence report by the admin. Using the standard drag and drop, the fields to be shown in the report can be configured.
• Add the option for users to create their own template definition.
• Document fields show the name of the document and are clickable to view the document content

As a user with a new HR role, delete of old WLM tasks must be supported - CUR-3770

When using tasks bound to HR/Contract roles, these tasks are automatically generated for the user. In case the user gets a new role, a change of contract is expected. Which means the old contract is ended and a new is started. In case the role change was made on the current contract, the generated tasks generated for the old role were not deleted. A change is made to cover for this case. The generated tasks are not automatically deleted, but can be deleted manually.

The reason for the manual delete is that automatic deletion feels like 'magic', for a use case not happing very often. By giving control to the responsible person to delete the task, this is less magical.

The process manager filter should respect the validity of roles and persons - CUR-3870

The role filter in the process manager returned not only results for the selected year, but also from previous years. A change is made to only return persons with that role in the selected academic year.

As a user I don't want to see the copy button for each person - CUR-3321

The relation page shows a copy button next to each person or role, to allow copy the person or full role person list. The button is cluttering the page and is not the best user experience. We decided to remove the button, but not the functionality. The copy function is still available, but only appears when hovering (mouse-over) a persons name or the role.

Integration

The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.

Publishing the staff availability to TE Server should be more verbose - CUR-3943

In case errors occurred when publishing availability to TE server, the error message was not very helpful. It showed the number of failures and the exceptions. In case of a list of errors, the majority is caused due to already existing availabilities that cannot be altered, or a non-existing user.

Several changes have been made to optimise the data exchange and the error reporting:

• The integration chopped the data exchange in blocks of 5 users and their availability. In case one in the block failed, the rest was skipped and all were marked as failed. A change is made that in case of an error of one, the rest will still be processed, limiting the amount of 'errors'.
• The error will show the names of the first 10 failing users, to easily identify the affected users and perform a cross-check in TE server for the user.

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.

Implemented security fixes - CUR-3972, CUR-3983, CUR-3861, CUR-3949, CUR-3922

Based on an audit performed a few weeks ago, the high issues were immediately fix. This sprint the majority of the medium and low issues have been solved.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

Versioning update

A first release of the versioning update has been made available to selected customers. Information on the versioning system (work in progress) can be found in the academy.

The versioning release is only available in the 'beta' environment and will be a separate system, next to the already existing systems. This means that technically the versioning is not part of the standard release, and will not affect acceptance and production environments.

The 'versioning' system in beta will allow customer to test the versioning in a closed environment. At request this system will be fed with production data, so real life scenarios on own production data and configuration can be tested. The test-cycle will be supported by an implementation manager, that is available for questions, will gather feedback (errors, UI-improvements, etc). These will be picked up in the next sprints. Once the versioning is stable, all known errors are solved, the function will be merged into the standard Curriculum version. From that moment the functionality is available for all, and will follow the standard release mechanism.

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.

Notifications are duplicated when using teams - CUR-3956 (Hotfix)

In case notifications are sent from a process to a team with not generic team email, the email was sent to each of the team members. That was OK, but since the de-duplication was not implemented correctly, the number of notification sent to the each member was equal to the number of members in the team. E.g. 5 members ment that each individual member would get 5 notifications. This has been fixed, and each member will get one notification.

As a user I want to edit items on an item-page - CUR-3931 (Hotfix)

The edit button on an item-page was shown greyed out, and was not accessible. This was limited to items having a field of type Time. The issue is solved, and the edit is now also accessible if there is a Time field defined for an item.

In case multiple offerings for a period, both should be shown in the workflow - CUR-3868 (Hotfix)

The case multiple offerings are defined for the same period, in the workflow activity-overview only the first offering was shown. This has been fixed, and activity-overview will show all offerings both in the structure page and the workflow page.

As a manager I want to have access to the uploaded proof for a user competence - CUR-3924 (Hotfix)

In the last version the upload of documents as proof of a person competence has been added. The competence-report was not yet updated (accidentally missed this), so the report was not accessible in the report. Several changes have been made to the competences report, that amongst others solves the reported issue:

• Add the option to configure the fields to be shown in the competence report by the admin. Using the standard drag and drop, the fields to be shown in the report can be configured.
• Add the option for users to create their own template definition.
• Document fields show the name of the document and are clickable to view the document content

As a user I want to add video to texts using the still experimental Lexical text editor - CUR-3923

It was found the still experimental text editor (Lexical) support for video was not as it should be. Some fixes are made and the adding, saving and displaying of videos in the new text editor are properly supported.

As a user with a new HR role, delete of old WLM tasks must be supported - CUR-3770

When using tasks bound to HR/Contract roles, these tasks are automatically generated for the user. In case the user gets a new role, a change of contract is expected. Which means the old contract is ended and a new is started. In case the role change was made on the current contract, the generated tasks generated for the old role were not deleted. A change is made to cover for this case. The generated tasks are not automatically deleted, but can be deleted manually.

The reason for the manual delete is that automatic deletion feels like 'magic', for a use case not happing very often. By giving control to the responsible person to delete the task, this is less magical.

The process manager filter should respect the validity of roles and persons - CUR-3870

The role filter in the process manager returned not only results for the selected year, but also from previous years. A change is made to only return persons with that role in the selected academic year.

Period factor should be copied in year copy - CUR-3443

When creating a new year, the academic calendar(s) of the original year are copied over to the new year. It was found the 'factor' defined on ribbon periods was not copied. This has been added to the year copy.

As a user I don't want to see the copy button for each person - CUR-3321

The relation page shows a copy button next to each person or role, to allow copy the person or full role person list. The button is cluttering the page and is not the best user experience. We decided to remove the button, but not the functionality. The copy function is still available, but only appears when hovering (mouse-over) a persons name or the role.

Integration

The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.

Using a hook and propagation should only sent the published objects - CUR-3948

A hook can be used to publish an educational object to a receiving system (integration layer). Propagation in this context can be used to publish child objects, e.g. a Study, including the underlying module-groups (childs). When publishing a study via a hook, all underlying children were published. A change was made to limit the publishing of the children to the onces that were already published (publication date set).

Publishing the staff availability to TE Server should be more verbose - CUR-3943

In case errors occurred when publishing availability to TE server, the error message was not very helpful. It showed the number of failures and the exceptions. In case of a list of errors, the majority is caused due to already existing availabilities that cannot be altered, or a non-existing user.

Several changes have been made to optimise the data exchange and the error reporting:

• The integration chopped the data exchange in blocks of 5 users and their availability. In case one in the block failed, the rest was skipped and all were marked as failed. A change is made that in case of an error of one, the rest will still be processed, limiting the amount of 'errors'.
• The error will show the names of the first 10 failing users, to easily identify the affected users and perform a cross-check in TE server for the user.

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.

Implemented security fixes - CUR-3972, CUR-3983, CUR-3861, CUR-3949, CUR-3922

Based on an audit performed a few weeks ago, the high issues were immediately fix. This sprint the majority of the medium and low issues have been solved.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Study guide release schedule.

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes.  Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

Usability: the load time of the landing page should be reduced - SG-698

Based on the logging we noted the initial opening of the study guide could take up to 2 seconds. We deep-dived into the cause and a fix is applied that builds up the page in a different way, optimising the display with an end-result the load time is drastically reduced (0.5 second).

‍

Usability: the filter should stay active using the back icon - SG-682

When opening one of the search results, and then navigating back to the module overview, the selected filters were not kept. This has been fixed, and when opening a detail page from the (filtered) search result and navigating back to the search result, the defined filters are kept.

‍

Accessibility: improve mobile menu usage - SG-670

On mobile, the hamburger menu shows the same content as the tabs, which is duplicate data and duplicate navigation. The tab option has been removed, and the navigation on mobile is now via the (top right-hand, marked red) hamburger menu.

Description management should be less magical - SG-693

The display of descriptions in the structure page had some 'hidden magic'. To reduce the magic a change is applied.

To understand the change applied, first let's look at the 'old' behaviour:

• The description with the lowest sequence is displayed in the structure.
• This is currently determined per group. The order and presence of descriptions on the group determine the result. If a group has no descriptions, nothing is displayed for that group. If a group has one or more descriptions, the first description is shown in the structure.
• If a group has more than one description, the "Show more" button is displayed.
• The popup opened on ‘Show more’ displays all descriptions belonging to that group.

The new behaviour will be:

• The sequence configured under Admin > References > Module Group Description will determine the display order. This sequence is imported from Curriculum > Elements > Module Group Description, but may be overridden in Study Catalogue.
• Descriptions with sequence 0 or with no sequence (empty) are never shown in either the structure or the popup.
• A description with sequence 1, if present on the group, is displayed in the structure.
• Descriptions with sequence 2 or higher, if present on the group, are displayed in the popup.
• The "Show more" button is displayed if the group contains one or more descriptions with sequence 2 or higher, regardless of whether a sequence 1 description is present.
• The "Show more" button is not displayed if there are no descriptions with sequence 2 or higher, or if the widget configuration is set to "Hide Show More".
• The popup does not display descriptions with sequence 1, 0, or no sequence (empty).

‍

The year dropdown should show the years in the correct order - SG-625 (Hotfix)

When having multiple years in the study guide, the year selector showed the years in  a random order. This has been fixed, and the years are shown in the correct order again.

‍

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. ‍

For more information on reported vulnerabilities, see the central database of vulnerabilities.

During this release no security vulnerabilities were reported, requiring mitigation.

‍

For more guidance on configuration and setup of Study Guide, use the relevant Study Guide manual.

‍

The release notes provide information on the features and improvements in the specified version.  The release dates related to the versions are published in the Evaluation release schedule.

‍

Improvements

New functionality, user experience refinements, and bug fixes. Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

Labels should not show the code, but the text - EV-429, EV-430 (hotfix)

An error was found causing the labels to be shown as codes. This was caused by a library update, that didn't handle the correct display of labels if no language was defined. The issue is hotfixed and the labels are shown correctly again.

‍

Labels should not show the code, but the text - EV-428 (hotfix)

The histogram used in reports was showing an incorrect order. This was caused by changing the order of the Likert scale values in the evaluation, and the changed order was not respected in the report. A change is applied that will respect the order both in the evaluation and the report.

‍

As an administrator I must be able to create a condensed report template - EV-433

After selecting the option to create a new condensed report template nothing happened. At least nothing visible for the administrator, but in our logging we got some exceptions. This helped finding the root cause and the issue has been fixed. The administrator can now create new condensed report templates.

‍

Security

An integral part of our development and build process is the automatic scanning for known security vulnerabilities. Fixes are prioritised based on impact: some may require an immediate hot-fix, while others are addressed in the current or next Sprint (release). For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

During this release no security vulnerabilities were reported, requiring mitigation.

‍

Refer to the Evaluation manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.

‍

The year switcher should only show configured years - CUR-3901 (Hotfix)

The year switcher showed not only the configured years, but also years created using simulation. This has been hotfixed, to show only the configured years.

‍

The search (typeahead) only shows the first 10 hits - CUR-3905 (Hotfix)

The typeahead (search) in selection fields, e.g. relation, element, reference matches the values in the list based on the typed characters. A fault was introduced that limited the search to only show the first 10 results. This has been hotfixed, and the typeahead (search) is showing also the matches that exceed the first 10.

‍

When clicking on a person I should be redirected to the person details - CUR-3868

The general page shows the roles and related persons. The option to click on the person and jump to the person details was broken. This has been fixed and the person details are again available by clicking the person on the general tab.

‍

As an administrator I want to use conditions that restrict using the users' role - CUR-3808

A requirement was raised to improve the filtering in processes by limiting it to role. Currently the limiting is supported on authorisation, but that is limited in flexibility.

An option is added to define a filter hasRole() to limit access to specific roles. This will allow to filter the page in the workflow on a role, and will extend the usage of the parallel processing of workflows by defining one page and filter the different pages on the role.

Use case:

Define a process to wait for different persons

• Add a workflow with 3 different teams (representing 3 parallel executors)
• Configure the workflow with the hasRole() filter to limit page view to the different teams (roles)
• Users can run their workflow in parallel, the process waits for the last to finish.
• Users will only see the pages relevant for their role.

Configuration:

• hasRole(<code of role>, <object type>) - :hasRole(modCoor, module) or :hasRole(modCoor)
  • The code of role is the code as configured for the role, e.g. Module coordinator = modCoor
  • The object type is optional, and can be used to specify the type in case the code is not unique, e.g. faculty, study, module

‍

Numeric fields should support pattern validation - CUR-3773

The configuration of fields offers the option to specify patterns to limit / standardise the input options. It was found the implementation for numeric fields was incorrect. This has been fixed and patters can be used.

Configuration advise:

If possible use the standard configuration options to specify number of decimals, minimum and maximum value to restrict input. Only in the rare cases these are not sufficient, use a pattern. 

‍

As a manager I want to force upload of prove for a competence  - CUR-889

Certain competences require the upload of a document providing evidence/proof. To support this requirement the option has been defined to enable both setting a field condition and the required checkbox. Once both are met, the document upload is shown and an upload is required. Otherwise, the download will not be shown. 

A new custom field type is added 'DOCUMENT', that allows the definition and configuration of the document upload. It also supports the upload of multiple document fields. As shown in the image below there is a required document upload (set by the competence required evidence setting) and an optional upload.

Configuration:

The screen above is configured using the setting shown below. The first three fields define the screen part shown above:

• type: defines the field to select the competence the user wants to add to its competence list
• evidence: a document upload that is configured to be required:
  
  • Condition used:  :competenceType.requiresEvidence = 'true'
• optionalEvidence: a document upload to optionally add evidence
  The optional evidence condition can be configured as the opposite of the requiresEvidence to support only showing one upload option. The required is the required evidence is set, otherwise the optional.
  In reporting both can be shown in the same document list.
  

As an administrator I want to manage the active experimental features - CUR-3764

Not all new features built are immediately ready for production on a large scale. In those situation we aim for developing the new feature as a 'experimental feature' first. This feature can be activated by the administrator, to allow additional testing and providing feedback. This release a change was made to the experimental feature that provides an overview of all available features and allows for more detailed configuring what feature(s) should be activated.

Experimental feature: Lexical rich text editor

A new feature is made available called the 'lexical rich text editor'. This will be the replacement of the current used HTML and Markdown text editor, offering a more stable, configurable options. In this release it is release as a feature complete substitution of the current editor. It is a feature flag option, to allow administrators to test drive. In the  near future the lexical editor will be activated as the standard editor.

Experimental feature: React forms

As part of staying technically up to date and a new, crisp, WCAG compliant interface we're constant working on migration parts of the system to the TimeEdit UX components using a new front end development framework. For specific changes that will eventually affect users, we decided to first implement them as feature flags that can be switched an tested. Forms shown to users are pretty complex, think about input validation, display types, labels, required or not, conditions, etc. The new 'forms' are feature complete with the current forms, and when toggling the feature flag two forms are shown in the new UI with the new logic:

• Study -> General page
• Module -> General page‍

‍

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

Implemented security fixes and checking mechanism - CUR-3918

We realised the number of security fixes had been pretty low. We did some manual checks in the central registry and found out we had missed quit some vulnerability updates in the last 6-8 weeks. There is a fully automated process reporting the vulnerabilities, but the process didn't report any. We found out the reachability of the central repository had been sub-optimal the last period, causing our automatic checks to fail.

Next to adding additional validation on execution of the automatic checking mechanism, we fixed all the vulnerabilities reported by the checker after fixing the failure situation. The reported vulnerabilities were investigated and fixed.

High

• CVE-2026-29062 (High)
• CVE-2026-22731 (High)
• CVE-2026-54512 (High)
• CVE-2026-54513 (High)
• CVE-2026-24880 (High)
• CVE-2026-34487 (High)
• CVE-2026-40988 (High)
• CVE-2026-41842 (High)
• CVE-2026-41850 (High)
• CVE-2026-54399 (High)
• CVE-2026-54428 (High)
• CVE-2026-54428 (High)

Medium

• CVE-2026-32990 (Medium)
• CVE-2026-54518 (Medium)
• CVE-2026-41706 (Medium)
• CVE-2026-41841 (Medium)
• CVE-2026-41843 (Medium)
• CVE-2026-22745 (Medium)
• CVE-2026-22748 (Medium)
• CVE-2026-41851 (Medium)
• CVE-2026-41853 (Medium)
• CVE-2026-54514 (Medium)
• CVE-2026-54515 (Medium)
• CVE-2026-54516 (Medium)
• CVE-2026-54517 (Medium)
• CVE-2026-40975 (Medium)
• CVE-2026-41854 (Medium)

 Low

• CVE-2026-22746 (Low)
• CVE-2026-41694 (Low)
• CVE-2026-41848 (Low)
• CVE-2026-41852 (Low)
• CVE-2026-22741 (Low) 

Refer to the Workload Management manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

‍

Versioning update

In the previous releases we made some steps towards full support of versioning. This was even-though we analysed and detailed it till great detail a challenge. Since the Curriculum foundation is using an academic-year based versioning. A new versioning  mechanism that would allow for instance to have 6 parallel versions of the same module, plan 3 years ahead with module being limited only by the end-date, have multiple versions of programs, etc. was pretty challenging and touches the basic foundation.

Next to the improvements listed in the release notes, we're working on the new versioning system. As said it is challenging, but we're making great progress.  If the pace will stay as it is now, we plan for a specific release for interested institutions that want to be part of the beta test team in 2-4 weeks. We hope in 2, but it might be extended a little. A detailed description of the use cases, supported features, configuration, etc. will follow in a next phase. For now this is just a short heads-up we're making good progress.

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.

‍

The year switcher should only show configured years - CUR-3901 (Hotfix)

The year switcher showed not only the configured years, but also years created using simulation. This has been hotfixed, to show only the configured years.

‍

The search (typeahead) only shows the first 10 hits - CUR-3905 (Hotfix)

The typeahead (search) in selection fields, e.g. relation, element, reference matches the values in the list based on the typed characters. A fault was introduced that limited the search to only show the first 10 results. This has been hotfixed, and the typeahead (search) is showing also the matches that exceed the first 10.

‍

When clicking on a person I should be redirected to the person details - CUR-3868

The general page shows the roles and related persons. The option to click on the person and jump to the person details was broken. This has been fixed and the person details are again available by clicking the person on the general tab.

‍

Button to add a new module directly from the dashboard should be shown - CUR-3850

The 'add module' button was not shown on the dashboard. The root cause is identified and fixed, so users can again create new modules directly from the dashboard.

‍

As an administrator I want to use conditions that restrict on the users role - CUR-3808

A requirement was raised to improve the filtering in processes by limiting it to role. Currently the limiting is supported on authorisation, but that is limited in flexibility.

An option is added to define a filter hasRole() to limit access to specific roles. This will allow to filter the page in the workflow on a role, and will extend the usage of the parallel processing of workflows by defining one page and filter the different pages on the role.

Use case:

Define a process to wait for different persons

• Add a workflow with 3 different teams (representing 3 parallel executors)
• Configure the workflow with the hasRole() filter to limit page view to the different teams (roles)
• Users can run their workflow in parallel, the process waits for the last to finish.
• Users will only see the pages relevant for their role.

Configuration:

• hasRole(<code of role>, <object type>) - :hasRole(modCoor, module) or :hasRole(modCoor)
  • The code of role is the code as configured for the role, e.g. Module coordinator = modCoor
  • The object type is optional, and can be used to specify the type in case the code is not unique, e.g. faculty, study, module

‍

As I user I'd like to have an option to change module objective using the subject matrix screen - CUR-889

Currently it’s not possible to make a change to a module objective directly from the subject matrix screen. From a generic management perspective direct access to the module objectives using an ‘edit’ option is desired. The subject-matrix and assessment-matrix screens have been extended with two configuration options:

• Edit Module: Toggle to enable the display of an Edit button for each module
• Module workflow: The workflow that should be opened when clicking the Edit button

The configuration will show the Edit button for each module, as shown below.

As part of this change a fix is to respect the objective sequence in the subject matrix .

‍

Numeric fields should support pattern validation - CUR-3773

The configuration of fields offers the option to specify patterns to limit / standardise the input options. It was found the implementation for numeric fields was incorrect. This has been fixed and patters can be used.

Configuration advise:
If possible use the standard configuration options to specify number of decimals, minimum and maximum value to restrict input. Only in the rare cases these are not sufficient, use a pattern.

As a manager I want to force upload of prove for a competence  - CUR-889

Certain competences require the upload of a document providing evidence/proof. To support this requirement the option has been defined to enable both setting a field condition and the required checkbox. Once both are met, the document upload is shown and an upload is required. Otherwise, the download will not be shown. 

A new custom field type is added 'DOCUMENT', that allows the definition and configuration of the document upload. It also supports the upload of multiple document fields. As shown in the image below there is a required document upload (set by the competence required evidence setting) and an optional upload.

Configuration:

The screen above is configured using the setting shown below. The first three fields define the screen part shown above:

• type: defines the field to select the competence the user wants to add to its competence list
• evidence: a document upload that is configured to be required:
  
  • Condition used:  :competenceType.requiresEvidence = 'true'
• optionalEvidence: a document upload to optionally add evidence
  The optional evidence condition can be configured as the opposite of the requiresEvidence to support only showing one upload option. The required is the required evidence is set, otherwise the optional.
  In reporting both can be shown in the same document list.
  

‍

As an administrator I want to manage the active experimental features - CUR-3764

Not all new features built are immediately ready for production on a large scale. In those situation we aim for developing the new feature as a 'experimental feature' first. This feature can be activated by the administrator, to allow additional testing and providing feedback. This release a change was made to the experimental feature that provides an overview of all available features and allows for more detailed configuring what feature(s) should be activated.

Experimental feature: Lexical rich text editor

A new feature is made available called the 'lexical rich text editor'. This will be the replacement of the current used HTML and Markdown text editor, offering a more stable, configurable options. In this release it is release as a feature complete substitution of the current editor. It is a feature flag option, to allow administrators to test drive. In the  near future the lexical editor will be activated as the standard editor.

‍

Experimental feature: React forms

As part of staying technically up to date and a new, crisp, WCAG compliant interface we're constant working on migration parts of the system to the TimeEdit UX components using a new front end development framework. For specific changes that will eventually affect users, we decided to first implement them as feature flags that can be switched an tested. Forms shown to users are pretty complex, think about input validation, display types, labels, required or not, conditions, etc. The new 'forms' are feature complete with the current forms, and when toggling the feature flag two forms are shown in the new UI with the new logic:

• Study -> General page
• Module -> General page

‍

Integration

The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.

‍

OEAPI expand and eduXchange alliance filter should work - CUR-3885

In the previous release the OEAPI has been extended with filtering support on alliances. It was found it was working correctly for courses, but not for programs. This has been fixed and the filter is working on both objects.

During the resolution of this issue it was noted the expand option defined in the OEAPI standard was not correctly implemented. This has been adjusted too, supporting multiple expands that are comma separated.

‍

The broker hook should be more informatieve - CUR-3864

In case an error occurred when sending multiple objects to the Broker and one of or more objects were not processed due to an error, they were not reported. The question arised in an actual situation where a module was causing an error, but it was not reported. The rout cause for this situation was identified and fixed, since in theory there should be no errors when sending to broker, and additional logging information was added.

Extend the integration information with information on integration messages, as shown below.

When performing an ad-hoc execution using script the execution result is shown.

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

Implemented security fixes and checking mechanism - CUR-3918

We realised the number of security fixes had been pretty low. We did some manual checks in the central registry and found out we had missed quit some vulnerability updates in the last 6-8 weeks. There is a fully automated process reporting the vulnerabilities, but the process didn't report any. We found out the reachability of the central repository had been sub-optimal the last period, causing our automatic checks to fail.

Next to adding additional validation on execution of the automatic checking mechanism, we fixed all the vulnerabilities reported by the checker after fixing the failure situation. The reported vulnerabilities were investigated and fixed.

High

• CVE-2026-29062 (High)
• CVE-2026-22731 (High)
• CVE-2026-54512 (High)
• CVE-2026-54513 (High)
• CVE-2026-24880 (High)
• CVE-2026-34487 (High)
• CVE-2026-40988 (High)
• CVE-2026-41842 (High)
• CVE-2026-41850 (High)
• CVE-2026-54399 (High)
• CVE-2026-54428 (High)
• CVE-2026-54428 (High)

Medium

• CVE-2026-32990 (Medium)
• CVE-2026-54518 (Medium)
• CVE-2026-41706 (Medium)
• CVE-2026-41841 (Medium)
• CVE-2026-41843 (Medium)
• CVE-2026-22745 (Medium)
• CVE-2026-22748 (Medium)
• CVE-2026-41851 (Medium)
• CVE-2026-41853 (Medium)
• CVE-2026-54514 (Medium)
• CVE-2026-54515 (Medium)
• CVE-2026-54516 (Medium)
• CVE-2026-54517 (Medium)
• CVE-2026-40975 (Medium)
• CVE-2026-41854 (Medium)

 Low

• CVE-2026-22746 (Low)
• CVE-2026-41694 (Low)
• CVE-2026-41848 (Low)
• CVE-2026-41852 (Low)
• CVE-2026-22741 (Low) 

Refer to the Curriculum manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Study guide release schedule.

T‍he release has been delayed on Acceptance due to an issue we loved to take along in this release. The release time was around 16:10 CET.

‍

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes.  Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

Accessibility analysis and improvements - SG-681, SG-507, SG-673, SG-506

An in-depth accessible analysis has been performed focusing on the WCAG-2.2. A short list of non-compliant issues has been defined to be picked up during the next 2 sprints.  During this release the next two issues have been addressed:

• The drawer (menu) on mobile applies to the WCAG standards
• Various layout and visualisation changes to detail pages
• All elements should be accessible using the Tab
• The tab order when using the Tab key should be correct
• Various layout and visualisation changes to search result/overview pages

‍

The filter on subjects should filter and show the label instead of the values - SG-659, SG-694

When filtering on a skill/competence (subject), there were no results reported and the selected filter showed the value (code) instead of the label. Both have been fixed, and results matching the selected filter are shown and the selected filter will show the value as displayed in the image below.

A filter option is added to restrict the filter not only on the subject type, but also on the subject category, e.g. category=Comms or categoryType=Skill or the combination category=Comms&categoryType=Skill. Similar to other widgets already using the type of the overarching group. This filter will first work after the next release of Curriculum, so 1 week after the release of this version.

‍

The inward link should not be shown as outward link - SG-695 (Hotfix)

The display of the link information was incorrect. The inward link was shown as outward link, and linked modules could also appear on the same line, instead of clearly separated at multiple lines. This has been fixed and the link information is shown correctly again.

‍

The Curriculum import should not fail - SG-585

Incidentally the nightly import of data from Curriculum / Broker fails with an Exception. The logging and failures of the last Month have been analysed and the synchronisation is made more robust to cover for the found issues.

‍

Multiple tabs using qualification should work - SG-697

When using multiple tabs in a Qualification, only the first tab showed content. Any other tab didn't show content, but redirected to the first tab. This was caused by a typo (a missing 's') in the standard URL detection, and is fixed. Multiple tabs in qualifications will work as they should do.

‍

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. ‍

For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

During this release no security vulnerabilities were reported, requiring mitigation.

‍

For more guidance on configuration and setup of Study Guide, use the relevant Study Guide manual.

‍

The following was released on July 2 and will be available in Production later this summer.

Sequence constraints can be applied to any Activity Series or Tracks within the same Module or across Modules. The specific sequences can contain a Min or Max padding, or a combination of the two, to allow for fine grained control of how the activities should be scheduled in relation to each other.

In addition to these specific sequence constraints, all Activity Series within the same Module always has a built in sequence. This built in sequence can now be changed within Data Manager and can also have the Min/Max padding. It is also possible to exclude one or more Activity Series from the built in sequence.

The UI in DM has been updated to provide a more unified and coherent view of all constraints.

Activity Manager will also show all Constraints and provide the ability to view them

For more information on Sequence constraints, please see this Academy article

Please note that Sequence constraints are not used outside of Automatic scheduling. There is currently no indication in Core when Activities are scheduled outside its sequence.

The following was released on June 30 and will be available in Production next week

General improvements:

Automatically include scheduled Activities in any job where it is relevant. In order for Sequence and Time constraints, as well as Deviation constraints to be considered, previously any relevant already scheduled Activity would have had to be manually added to any scheduling job. From now on, any previously scheduled Activity that is relevant for the Activities included in the job will be automatically added so that constraints can be considered.

The following was released to Test environments on June 26 and will be available in Production this week

General improvements:

Max concurrent tracks limit is now shown in the Activity Series table, in the Number of Tracks column. The limit is added after the number of tracks as "max X":

Additional object field value filters are now available when clocking "more filters". Previously, some fields from parent types were not included, but should now be available

The following was released to the Test environments on 26th of June and will reach production one week later.

Improvements

• Sync setting periods are now determined using the organisation's configured timezone, preventing incorrect time windows from being applied.
• Reference fields are now included when evaluating sync setting filters, resolving an issue where certain customers experienced very long sync times due to description fields changing back and forth.
• Administrators can now control whether automatic Outlook reminders are applied to outbound reservations at go-live.

Bug fixes

• Resolved an issue where reservations were synced to unintended objects due to membership edges being followed in both directions. Expansion now only follows edges downward.
• Resolved an issue where organisation ownership on incoming reservations could not be set. To prevent users from modifying or deleting incoming Outlook reservations they do not own, configuration by a TimeEdit consultant is required.
• Resolved an issue where dangling calendar events were incorrectly removed during sync.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.

Permission not properly determined and respected - CUR-3834 (Hotfix)

It was noted that in some cases a users permission set was not correctly determined in case the user has roles both on faculty and study. It took some detailed analysis, but luckily the cause was found and solved.

The option to select assessment on the assessment-report should not require an additional permission - CUR-3734

On report pages the 'download' option is offered and also the option to select all or a limited number of items to be downloaded. It was noted that the behaviour of the select options shown was not the same on the different pages. Some pages required a specific permission to enable the select option, causing the dilemma of assigning too high permissions to enable selection, or less functionality by lacking the permission.

This has been fixed and report pages having the option to select one or more items will standard show the select option if the user of course has the right to view the report.

Dropdown menu's should show the correct label in all languages - CUR-3471

The dropdown menu's used for selection of reference values by a user was not showing the defined label for all languages. In some languages (Danish, French) the label was not shown, but only the code. This has been fixed and independent of the configured language the correct label will be shown, instead of the code.

Changing year should only change the year and not introduce a period - CUR-3471

In the structure tree, when changing year, a periodId was introduced in the URL. This caused the validation of the modules in the structure tree to use this 'non-existing' year/periodId combination and thus showing all modules strike through. This has been fixed and the 'free' periodId is no longer added.

The availability report should work - CUR-3856

The availability report was broken. When opening the report, it was loading forever, and no results were shown. This has been fixed and the availability report works again. This means that the manager can report on the 'ad-hoc' defined unavailabilities as part of the generic weekly availability pattern.

The language switcher should not show the ISO code - CUR-3554

The language switcher shows the available language options in the system, allowing the users to switch languages. Not all ISO-codes used in this language picker are intuitive, e.g. ZH or ZH_HK, where others are EN, NL. In this release a change is made for the non-intuitive codes to show them in the appropriate language set, in this case the ZH and ZH_HK are shown as 繁體 and 简体.

UI components seem to be a little off - CUR-3853

Due to an update of the TimeEdit share UI component library some visualisation were not 100% perfect. Buttons were slightly off, tooltip (information) having lots of white and strange colouring, dropdown icons not correctly aligned. Just a few smaller issues that affected the user experience. These have been fixed in this release.

Integration

The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.

Activities sent to Data Manager should exchange their type - CUR-3845 (Hotfix)

An error was introduced that caused activities to be sent to Data Manager without their activity type. This caused error while sending, and the activities were not processes. This has been hotfixed and the data exchange with Data Manager is working again like it should do.

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.

Implemented security fixes - CUR-3863

It has been a while, but our automated security validation process reported a vulnerability. The reported vulnerabilities were investigated and fixed:

• CVE-2026-53633 (9.8): False positive, not vulnerable
• CVE-2025-66516 (XXE): Image service fix

Improve security based on extensive code analysis - CUR-3860

As stated in the previous release notes: on a regular base an extensive security audit is performed using black box testing. During this sprint an in-depth white box testing is done. White box testing is testing with access to the actual code, allowing not only to find vulnerabilities via API or other 'external' touch points, but in-depth analysis of the code for possible vulnerabilities.

Some minor issues have been identified, that are fixed in this release, by updating a package used for logging that fixes the following CVE's:

• CVE-2022-23302 (CVSS 8.8),
• CVE-2022-23303 (CVSS 8.1)
• CVE-2022-23305 (CVSS 9.8)
• CVE-2019-17571 (CVSS 9.8)

Refer to the Workload Management manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

‍

Versioning update

In the previous releases we made some steps towards full support of versioning. This was even-though we analysed and detailed it till great detail a challenge. Since the Curriculum foundation is using an academic-year based versioning. A new versioning  mechanism that would allow for instance to have 6 parallel versions of the same module, plan 3 years ahead with module being limited only by the end-date, have multiple versions of programs, etc. was pretty challenging and touches the basic foundation.

Next to the improvements listed in the release notes, we're working on the new versioning system. As said it is challenging, but we're making great progress.  If the pace will stay as it is now, we plan for a specific release for interested institutions that want to be part of the beta test team in 2-4 weeks. We hope in 2, but it might be extended a little. A detailed description of the use cases, supported features, configuration, etc. will follow in a next phase. For now this is just a short heads-up we're making good progress.

‍

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.

‍

Fields configured as HTML-field should show the HTML editor - CUR-3838 (Hotfix on Acceptance)

It was noted that in some cases when a field was configured as string that should be displayed using the HTML-editor there was either a plain textbox or even no box shown. Two cases were reported on Acceptance that helped us finding the cause, and release a hotfix to solve this issue prior to a Production release

‍

Permission not properly determined and respected - CUR-3834 (Hotfix)

It was noted that in some cases a users permission set was not correctly determined in case the user has roles both on faculty and study. It took some detailed analysis, but luckily the cause was found and solved.

‍

The option to select assessment on the assessment-report should not require an additional permission - CUR-3734

On report pages the 'download' option is offered and also the option to select all or a limited number of items to be downloaded. It was noted that the behaviour of the select options shown was not the same on the different pages. Some pages required a specific permission to enable the select option, causing the dilemma of assigning too high permissions to enable selection, or less functionality by lacking the permission.

This has been fixed and report pages having the option to select one or more items will standard show the select option if the user of course has the right to view the report.

‍

When saving a workflow description it should not add extra blank lines - CUR-3804

When changing the workflow description, shown at the top of the workflow to the users, blank lines were duplicated and thus causing the text to have double blank lines. This has been fixed, and saving will no longer introduce 'free' blank lines.

‍

Dropdown menu's should show the correct label in all languages - CUR-3471

The dropdown menu's used for selection of reference values by a user was  not showing the defined label for all languages. In some languages (Danish, French) the label was not shown, but only the code. This has been fixed and independent of the configured language the correct label will be shown, instead of the code.

‍

Changing year should only change the year and not introduce a period  - CUR-3471

In the structure tree, when changing year, a periodId was introduced in the URL. This caused the validation of the modules in the structure tree to use this 'non-existing' year/periodId combination and thus showing all modules strike through. This has been fixed and the 'free' periodId is no longer added.

‍

The availability report should work  - CUR-3856

The availability report was broken. When opening the report, it was loading forever, and no results were shown. This has been fixed and the availability report works again.
This means that the manager can report on the 'ad-hoc' defined unavailabilities as part of the generic weekly availability pattern.

‍

The language switcher should not show the ISO code  - CUR-3554

The language switcher shows the available language options in the system, allowing the users to switch languages. Not all ISO-codes used in this language picker are intuitive, e.g. ZH or ZH_HK, where others are EN, NL. In this release a change is made for the non-intuitive codes to show them in the appropriate language set, in this case the ZH and ZH_HK are shown as 繁體 and 简体.

‍

The dashboard performance feels slow  - CUR-3841

A report on a felt slowness of the dashboard loading lead to the identification of the Export widget to be the cause of the problem. Users having an export list (to be approved and exported pending changes) for the active year of over 5000 changes were affected.

The database guru found it a challenge, since 'this should not cause delays'. And he delivered with a change to the retrieval of the data the measured response was 300x faster.  

‍

The inward and outward links should be shown different   - CUR-3493

Links between educational objects are shown on the link page. It was noted that the visualisation wether the link was inbound or outbound was not always the same. This has been fixed an the title for outbound links (e.g., Requires) is shown in bold and the title for inward links (e.g. is required by) are shown in bold-italic.

‍

UI components seem to be a little off  - CUR-3853

Due to an update of the TimeEdit share UI component library some visualisation were not 100% perfect. Buttons were slightly off, tooltip (information) having lots of white and strange colouring, dropdown icons not correctly aligned. Just a few smaller issues that affected the user experience. These have been fixed in this release.

‍

Integration

The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.

‍

OEAPI eduXchange should only return offerings for the active OEAPI year - CUR-3813

The OEAPI has is used for two generic products in the Netherlands. The first is the central Dutch registry of all programs and their offerings, called RIO. The second is a central Dutch course catalog where students can enrol in a minor or module at another institution with just one click.

The exchange of the offering information has been modelled to meet the 'RIO requirements', where the active OEAPI year and offerings from the previous x years were exchanged. eduXchange only expects the offerings that are related to the active OEAPI year, but also got the 'historic' ones.

A fix is applied that distinct the selection of the offerings based on the fact if the data exchange is with RIO or eduXchange.

‍

OEAPI eduXchange should skip empty objects - CUR-3775

The defined standard pattern for OEAPI is that attributes that are not filled will not be exchanged in the message. This was implemented for attributes, but not for objects having no child attributes. This could lead to an empty object, if all the underlying attributes were empty and thus skipped.

A change is applied to validate if the object has no attributes, and if so the object itself will be skipped.
The practical implementation is the source object that can contain collaboration information or no information.

‍

OEAPI should support the exchange of a videoUrl for eduXchange- CUR-3551

The OEAPI eduXchange consumer defines a specific extension (consumer) containing information especially for ecuXchange. The API definition has been extended with support for exchange of a videoURL to be shown with the minor or module in the central course catalog.

The consumer has been extended to support the object 'supplementaryInformation' to be defined per alliance and provide multiple language dependant URL's to the video.

Configuration

The definition has been made generic, to support the definition of the role, support multiple types and support the various language dependant URL's.

The configuration is done by adding a new object allianceSupplementaryInformation to the custom-fields on the course (or study).

The setup is shown in the image below:

• alliance: this field uses the already configured Alliance reference list to distinct video's between alliances
• role: in the specification the role is 'promo', in the configuration the role is bound to a reference list. The reference list is only populated with promo with a default selection of this single value. This setup allows for further extension by adding different roles to the reference list.
• type: in the specification the type is 'video', in the configuration the type is bound to a reference list. The reference list is only populated with video with a default selection of this single value. This setup allows for further extension by adding different types to the reference list.
• language: this field uses the language element list to select the language the video is in.
• value: the field containing the URL to the video. The label should probably say Video URL to make it clearer to the users.

And of course a new item page should be defined that is bound to this new object allianceSupplementaryInformation.

Please use the names shown, only change the labels shown to the user!

‍

Activities sent to Data Manager should exchange their type - CUR-3845 (Hotfix)

An error was introduced that caused activities to be sent to Data Manager without their activity type. This caused error while sending, and the activities were not processes. This has been hotfixed and the data exchange with Data Manager is working again like it should do.

‍

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

Implemented security fixes - CUR-3863

It has been a while, but our automated security validation process reported a vulnerability.  The reported vulnerabilities were investigated and fixed:

• CVE-2026-53633 (9.8): False positive, not vulnerable
• CVE-2025-66516 (XXE): Image service fix

‍

Improve security based on extensive code analysis - CUR-3860

As stated in the previous release notes: on a regular base an extensive security audit is performed using black box testing. During this sprint an in-depth white box testing is done. White box testing is testing with access to the actual code, allowing not only to find vulnerabilities via API or other 'external' touch points, but in-depth analysis of the code for possible vulnerabilities.

Some minor issues have been identified, that are fixed in this release, by updating a package used for logging that fixes the following CVE's:

• CVE-2022-23302 (CVSS 8.8),
• CVE-2022-23303 (CVSS 8.1)
• CVE-2022-23305 (CVSS 9.8)
• CVE-2019-17571 (CVSS 9.8)

‍

Refer to the Curriculum manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates related to the versions are published in the Evaluation release schedule.

‍

Improvements

New functionality, user experience refinements, and bug fixes. Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

Accessibility analysis and improvements - EV-420

An in-depth accessible analysis has been performed focusing on the WCAG-2.2. A short list of non-compliant issues has been defined to be picked up during the next 2 sprints. Next to the analysis an automated validation of style and accessibility has been implemented to provide a continuous validation.

Security

An integral part of our development and build process is the automatic scanning for known security vulnerabilities. Fixes are prioritised based on impact: some may require an immediate hot-fix, while others are addressed in the current or next Sprint (release). For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

During this release no security vulnerabilities were reported, requiring mitigation.

Refer to the Evaluation manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Study guide release schedule.

‍

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

Accessibility analysis and improvements - SG-673, SG-674

An in-depth accessible analysis has been performed focusing on the WCAG-2.2. A short list of non-compliant issues has been defined to be picked up during the next 2 sprints. During this release the next two issues have been addressed:

• After selecting a search result (e.g. module, program), the focus should stay on the selected result.
• The keyboard TAB is not on all views navigating correctly to the next item

Navigating back to the overview page should show the search results - SG-679

In case a user has selected for instance the detailed page of bachelor program from the search result, and navigates back to the overview using the 'back to overview' button, no search results were displayed. This has been fixed and navigating back will show the initial search results.

Enhanced AI result using the Broker and a more intelligent LLM pattern - SG-689

The AI search has been adjusted to provide better results. A rather technical story, where the underlying implementation is changed from a relevance search that is attached to the context to using the broker that already standard supports direct lookups, filters and relevance search out of the box. The AI Large Language Model (LLM) has been adjusted and improved to use the new, extended options of the Broker. The LLM is now no longer depending on the context being built up in the search conversation, but can dynamically use the relevance searching of the broker, use the found similar objects to perform automatically a next search on the new 'learned' relevance and then find the best matching result(s). 

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. ‍

For more information on reported vulnerabilities, see the central database of vulnerabilities.

During this release no security vulnerabilities were reported, requiring mitigation.

‍

For more guidance on configuration and setup of Study Guide, use the relevant Study Guide manual.

‍

The following has been released to the Test environments on June 18th and will reach production next week.

Bug fixes:

• Resolved an issue where long read-only text would be incorrectly displayed in tables and overlap other columns
• Resolved an issue where sometimes the All Forms page would be unusable when navigating to it from a Form details page
• Resolved an issue where sometimes locked, mandatory and prefilled elements would not load the correct values when opening a form, making them impossible to submit

The following has been released to the Test environments on June 18th and will reach production next week.

Bug fixes:

• Resolved an issue where Container reservations would unnecessarily show the name of the room at the bottom of the reservation. Removing this leaves a less cluttered view and more space for more useful information
• Resolved an issue where sometimes the text shown for objects in the selection list would unexpectedly change (i.e. an object would suddenly be displayed using its code field, rather than the name field the user had selected).
• Resolved an issue where an activity is manually scheduled from activity manager and there are external ids on the activity that no longer match actual objects, fields, or types, an error message will be displayed. This doesn't prevent the remaining information from getting set, so users can still keep working with the incomplete information if appropriate.
• Resolved an issue where some columns would be aligned incorrectly in the Conflict List

The following was released on June 11 and will reach production this week

Bug fixes

• Resolved an issue where sometimes the Conflict list would get too many results, causing it to fail.
• Resolved an issue where sometimes the Conflict list would receive an error which was never shown to the user.
• Resolved an issue where the pinboard button in the conflict information popover in the calendar would be invisible if the object name was too long.
• Resolved an issue where the related button in the object list would be incorrectly unchecked after the object type was changed.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

‍

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.

‍

The duration field dropdown should show the duration - CUR-3806 (Hotfix)

In some cases the duration dropdown field was shown empty, even if a duration had been filled in an earlier phase. This causes the user to re-enter in order to proceed. This has been hotfixed, and the dropdown is properly filled with the earlier entered data.

‍

Order of notifications should be newest first - CUR-2458

The notification shown on the dashboard (bell icon) were shown with the oldest notification on top. The order has been changed, showing the last sent (newest) notification on top.

‍

As a user I should be able to assign a team to a role - CUR-3814

The assignment of the responsible person(s) to a role can be done either by assigning the individual person(s) and/or assigning a team. It was found the option to add a team was broken. This has been fixed, and teams can be assigned to roles again.

‍

As an admin I want to configure the option to create new activities - CUR-3482

If you click “+” on an activity in an activity-grid page, you can create a new activity within the same series in the same week. Since Data manager doesn’t support series with multiple activities in the same week the user should not be able to create these duplicates. This to prevent issues in the integration and 'loose' activities in Data Manager.

Configuration:

• Set the global configuration (administration/configuration) for schedule.prevent_duplicates to true

Below the two options are shown next to each other. Left the options with the prevent duplicates option set to true, right the default option (prevent duplicates is false).

Integration

The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.

‍

Enable sending activities to Data Manager via new 'internal' endpoint - CUR-3735

The data exchange to Data Manager is managed by configuring a hook using the standard defined integration. Since in the (near) future the used endpoint of DM will be replaced, the new endpoint is already implemented. During a transition period (until the end of life of the current endpoint) both options will be available. Once the current endpoint is no longer supported, the corresponding hook option is removed. In the meantime it is advised to change the configuration to the variant with 'new' in the name.

‍

The result of event-based data exchange should support the status 'QUEUED' - CUR-3766

When using the event-based data exchange, the supported responses from the receiving system (ESB) are SUCCESS or ERROR. Any other value will always be handled as ERROR. Since not all data will be executed immediately after reception in the ESB, a request was made to support the status QUEUED. This should be handled as a SUCCESS, but provides insight on the actual handling (synchronous or a-synchronous) to the administrator.

‍

Handling a module with a large(r) number of offerings should not give an error on status update - CUR-3796

In the end a highly technical issue, not immediately visible or affecting data. In case a module with a large(r) number of offerings was sent to Data Manager, the result of the processing was not always updated. This was caused by a timing error. Curriculum sends the package of offerings as a whole, and expected updates on the individual packages after that. But in practice the updates were processed immediately, and the results could come back before all offerings were sent. This caused the effect the activity update was done, but not marked correctly as processed in the Curriculum log. The mechanism is changed, and the updates can be processed while not all activities have been sent yet.

‍

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

Improve security based on extensive code analysis - CUR-3794

On a regular base an extensive security audit is performed using black box testing. During this sprint an in-depth white box testing is done. White box testing is testing with access to the actual code, allowing not only to find vulnerabilities via API or other 'external' touch points, but in-depth analysis of the code for possible vulnerabilities.

Some minor issues have been identified, that are fixed in this release.

‍

Refer to the Workload Management manual for configuration guidance.

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Curriculum/Workload Management release schedule.

‍

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as Hotfix have been developed during this Sprint release, but are hotfixed and technically added to the previous release or direct to production based on the impact of the issue.

‍

The duration field dropdown should show the duration - CUR-3806 (Hotfix)

In some cases the duration dropdown field was shown empty, even if a duration had been filled in an earlier phase. This causes the user to re-enter in order to proceed. This has been hotfixed, and the dropdown is properly filled with the earlier entered data.

‍

Order of notifications should be newest first - CUR-2458

The notification shown on the dashboard (bell icon) were shown with the oldest notification on top. The order has been changed, showing the last sent (newest) notification on top.

‍

As a user I should be able to assign a team to a role - CUR-3814

The assignment of the responsible person(s) to a role can be done either by assigning the individual person(s) and/or assigning a team. It was found the option to add a team was broken. This has been fixed, and teams can be assigned to roles again.

‍

As a user I want to save a description with controller in the text - CUR-3744

Sometimes you're surprised by a bug. It was found that using the word controllers in a descriptive text caused the save to fail completely. The issue is addressed, and it's now possible to save texts with the word controllers in it.

‍

As an admin I want to configure the option to create new activities - CUR-3482

If you click “+” on an activity in an activity-grid page, you can create a new activity within the same series in the same week. Since Data manager doesn’t support series with multiple activities in the same week the user should not be able to create these duplicates. This to prevent issues in the integration and 'loose' activities in Data Manager.

Configuration:

• Set the global configuration (administration/configuration) for schedule.prevent_duplicates to true

Below the two options are shown next to each other. Left the options with the prevent duplicates option set to true, right the default option (prevent duplicates is false).

Integration

The issues mentioned under the section integration are considered as extension, improvements or bug fixes related to the Curriculum API, OOAPI and/or CSV import functionality.

‍

OEAPI eduXchange published with the incorrect year - CUR-3813

In case the active year, used for the retrieval of course and/or minor information by eduXchange, was changed, the data was not updated to reflect the new year. The cause was that a change of the configuration parameter OOAPI.year was not immediately effectuated, since this is held in the application cache.  A more frequent refresh of the configuration cache is implemented to limit the time between the change and the effectuation.

‍

Enable sending activities to Data Manager via new 'internal' endpoint - CUR-3735

The data exchange to Data Manager is managed by configuring a hook using the standard defined integration. Since in the (near) future the used endpoint of DM will be replaced, the new endpoint is already implemented. During a transition period (until the end of life of the current endpoint) both options will be available. Once the current endpoint is no longer supported, the corresponding hook option is removed. In the meantime it is advised to change the configuration to the variant with 'new' in the name.

‍

The result of event-based data exchange should support the status 'QUEUED' - CUR-3766

When using the event-based data exchange, the supported responses from the receiving system (ESB) are SUCCESS or ERROR. Any other value will always be handled as ERROR. Since not all data will be executed immediately after reception in the ESB, a request was made to support the status QUEUED. This should be handled as a SUCCESS, but provides insight on the actual handling (synchronous or a-synchronous) to the administrator.

‍

Handling a module with a large(r) number of offerings should not give an error on status update - CUR-3796

In the end a highly technical issue, not immediately visible or affecting data. In case a module with a large(r) number of offerings was sent to Data Manager, the result of the processing was not always updated. This was caused by a timing error. Curriculum sends the package of offerings as a whole, and expected updates on the individual packages after that. But in practice the updates were processed immediately, and the results could come back before all offerings were sent. This caused the effect the activity update was done, but not marked correctly as processed in the Curriculum log. The mechanism is changed, and the updates can be processed while not all activities have been sent yet.

‍

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

Improve security based on extensive code analysis - CUR-3794

On a regular base an extensive security audit is performed using black box testing. During this sprint an in-depth white box testing is done. White box testing is testing with access to the actual code, allowing not only to find vulnerabilities via API or other 'external' touch points, but in-depth analysis of the code for possible vulnerabilities.

Some minor issues have been identified, that are fixed in this release.

‍

Refer to the Curriculum manual for configuration guidance.

This release is pushed to test at release date and production in 4 weeks.

Improvement

To improve the user flow for creating recurring reservations, several UX updates have been introduced:

Read the TE Academy article: How to set up a Reserve page to support recurring reservations

This release is pushed to test at release date and production in 4 weeks.

Improvement

If a user who is not signed in tries to download a Text or CSV export, the download will return HTTP 404 (previously the users was tasked to sign in).

The following was released to Test environments on May 4 and will reach Production next week

General improvements

The Activity Settings panel in the Form Designer for Scheduling forms, has been cleaned up and is now a little less messy. Since the Activity Settings are mandatory in the new Preferences to DM workflow, the ability to turn it off has been removed.

Bug fixes

• Resolved an issue where long texts would overlap in the Form Review page.
• Resolved an issue where sometimes the Forms page for submitters would time out due to large amounts of forms. This page is now quick to load 

The release notes provide information on the features and improvements in the specified version. The release dates that are related to the version of the release are published in the Study guide release schedule.

‍

Improvements

The issues in release mentioned under the section improvements are considered as new functionality, user experience improvements or bug fixes. Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

An URL (link) to another object should open a new Tab - SG-617

In case for instance a module is as a link, e.g. a required module for another module, and the module is clicked it opens in the same window. It is desired and more logical to open the details of this referenced module in a new tab and keep the original information in the initial tab. A change is applied to open referenced objects (study, module-group and module) in a new tab.

Improve the robustness of the matrix report - SG-671

In case a study with with an empty node (no module-group or module) was shown in the matrix report, this empty node generates and error and prevented the matrix report to be shown. This has been fixed and the rendering of the matrix report is more robust on these edge cases.

The flag 'only visible for administrator' should be respected - SG-580, SG-646

The option to flag fields as 'only visible for admins' for assessments and links didn't work as expected. The different combinations of 'visible' and 'visible for admins' showed the information not according to the setting. This has been fixed and the flags to steer / limit the display is working as it should do.

Next to this change it was found that the flag 'hide when empty' was not implemented correctly for links. This has been fixed too.

When using a reference field in the Assessment widget title, it should show the label - SG-581

The assessment widget supports the definition of the title, using the assessment fields. In case the title was defined using an assessment field AND the field was flagged as not visible in the assessment overview the title showed either the externalID or an N/A instead of the label. This has been fixed, and for an invisible marked field of type reference, used in the widget title, the reference label is shown.

Removing a filter on top of the search result should reset the filter too - SG-651

When using a filter (select an option in the filter area) in a search, the used filter is shown above the search results. The filter can be removed by clicking the 'x' of the filter to be removed. This only removed the display of the filter, but the actual filter in the filter area (the checked checkbox) was not cleared.

This has been fixed and when removing a filter at the top of the search, the corresponding filter in the filter area will be unchecked.

Changing a field configuration should not clear the reference type selected - SG-645

An error was introduced in the field configuration. Any change on the field using a reference type, cleared the reference type. This has been fixed and the selected reference type is kept and saved.

The matrix report should be visually correct - SG-620

The introduction of a new UI component caused some display issues in the matrix report. They have been addressed in this release and grid lines and multiple related subjects and their level are shown correctly again.

A print of a study guide page should show the institutes logo - SG-629

When printing a page, the defined logo for the UI is also shown on the left hand top corner of the print.

Security

An integral part of our development and build process is automatic scanning for known security vulnerabilities. The vulnerabilities will be fixed based on their impact, which means that in some cases an immediate hot-fix will be applied, and in other cases the vulnerability will be fixed in the current or next Sprint (release). The security section provides an overview of the vulnerabilities mitigated. ‍

For more information on reported vulnerabilities, see the central database of vulnerabilities.

No security vulnerabilities have been reported that require mitigation.

‍

For more guidance on configuration and setup of Study Guide, use the relevant Study Guide manual.

‍

The release notes provide information on the features and improvements in the specified version. The release dates related to the versions are published in the Evaluation release schedule.

‍

Improvements

New functionality, user experience refinements, and bug fixes. Issues marked as hotfix are developed in this sprint but applied to the previous release or directly to production, depending on impact.

‍

This release has no new functionality or any bug fixes.

Security

An integral part of our development and build process is the automatic scanning for known security vulnerabilities. Fixes are prioritised based on impact: some may require an immediate hot-fix, while others are addressed in the current or next Sprint (release). For more information on reported vulnerabilities, see the central database of vulnerabilities.

‍

Improve security based on extensive code analysis - EV-416, EV-418, EV-419

On a regular base an extensive security audit is performed. During this sprint an in-depth white box testing is done. White testing is testing with access to the actual code, allowing not only to find vulnerabilities via API or other 'external' touch points, but in-depth analysing the code for possible vulnerabilities.

Three minor issues have been identified, that are immediately fixed in this release.

Refer to the Evaluation manual for configuration guidance.

This release is pushed to test at release date and production a week later.

Improvement

Mail: Recipient privacy improvement

• Previously, emails sent from Core included all addresses in the To field. Now, Core sends individual emails per recipient, so each email has only one address in To. This change is also applied for Viewer, Reserve and Plan.
• Why this matters: Recipients will no longer be able to see other recipients’ email addresses, improving privacy and reducing unintended disclosure.

Bug fixes

• Resolved an issue where the object list would show objects even though a strict relation meant that there should be none.
• Small polish of the help popover for the reservation list search - adjusted the label for autopilot job ID and added a close button.
• Resolved an issue where the time indicator in the calendar would not accurately show the time where a reservation would be started when the mouse was clicked.
• Resolved an issue where fast clicking when removing members or related objects could also remove an object not clicked.
• Exam scheduling: Resolved an issue where Capacity reservations and Size reservations would overlap. Hovering on a Size reservation will now show it on top of the Capacity reservation text bar.