admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4690 - changelog for 8.3.0 finalised; two-factor wording on the password page

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-26 17:46:19 -07:00
parent d37688494a
commit 15094275af
2 changed files with 11 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
docs/8.0/ayanova/docs/changelog.md
View File

@@ -10,38 +10,36 @@ See the [upgrade instructions](ops-upgrade.md) section of this manual for detail
### AyaNova 8.3.0
IN PROGRESS
**WARNING:** this release contains changes that will require a **pre upgrade step** on all Windows and Linux network platforms from the normal upgrade process you may be accustomed to. Be sure to follow our [upgrade instructions](ops-upgrade.md) and the **pre upgrade step** for your platform for this particular upgrade from version 8.2.4 (or older) to version 8.3.0 (or newer).
**IMPORTANT:** this release includes important security improvements along with the move to .NET 10. We recommend upgrading self-hosted installations to 8.3.0 promptly.
**IMPORTANT:** this release includes important security improvements along with the move to .NET 10. We recommend upgrading to 8.3.0 promptly.
**Changed**
- Server: significant performance improvements.
- Server: after several incorrect two-factor authentication codes, the password must be entered again before another code can be tried.
- Server: the `AYANOVA_JWT_SECRET` setting is no longer used. AyaNova now generates its own [sign-in key](ops-config-jwt-secret.md) once and keeps it in its data folder, so users stay logged in when the server restarts. The setting can be removed from `config.json`.
- Server: the `AYANOVA_JWT_SECRET` setting is no longer used. AyaNova now generates its own [sign-in key](ops-config-jwt-secret.md) once and keeps it in its data folder, so users stay logged in when the server restarts. The setting can be removed from `config.json` if desired.
- Server: updated to use .NET 10.x LTS from previously used .NET 8.x LTS. .NET 8.x reaches end of support in November 2026. With this update to .NET 10.x come performance and security gains.
- Server: all 3rd party components used by the AyaNova server have been upgraded to their most recent release versions to use with .NET 10.x. This improves performance, stability and security for each component used.
- Server: the report rendering system now uses the smaller and faster "Chrome headless shell" browser instead of the full Chrome browser. It is downloaded into a `report-browser` folder under the AyaNova data folder instead of the program folder, so it is no longer removed by an upgrade. There will be a longer than normal delay the _first time_ a report is rendered after upgrading while AyaNova automatically downloads the new report rendering browser. Any old `Chrome` and `ChromeHeadlessShell` folders in the AyaNova program folder are no longer used and can be removed.
- Server: the automatic internal backup now runs the database backup utility directly instead of through a command shell, so the database password can contain any characters and the [backup utility path](ops-config-backup-pgdump-path.md) can contain spaces, and a failed backup is now reported as an error instead of appearing to succeed. See [backup](ops-form-backup.md).
- Server: the automatic internal backup now runs the database backup utility directly instead of through a command shell, so the database password can contain any characters and the [backup utility path](ops-config-backup-pgdump-path.md) can contain spaces, and a failed backup is now reported as an error instead of appearing to succeed in some cases. See [backup](ops-form-backup.md).
- Server: log files are now named with an increasing number when they are archived; the [server log](ops-log.md) form lists them newest first.
- Server: removed an unused internal performance profiling component.
- Server: AyaNova now checks the email (SMTP) server's security certificate when sending email. If your mail server uses a self-signed or internal certificate and email notifications stop after upgrading, see [SMTP certificate check](ops-config-smtp-accept-any-certificate.md).
- Server: after repeated failed login attempts, further attempts for that login, or from that address, are refused for a few minutes.
- Server: new [trusted reverse proxies](ops-config-trusted-proxies.md) setting for a reverse proxy that runs on a different computer from the AyaNova server, so AyaNova sees each user's own address.
- Server: while a report renders, its template no longer holds the User's actual access token or download key; the AyaNova server adds the User's access only to the report's requests to the `ayApiUrl` address. Templates that call the AyaNova API through any other address need to be changed. See [API usage in reports](ay-report-edit.md#api-usage).
- Server: users with the "Business administration - restricted" role can view [report templates](adm-report-templates.md) but no longer create, edit or import them, as described for that [role](ay-biz-admin-roles.md). Give the full "Business administration" role to users who edit report templates.
- Server: relative date filters such as "today" or "last month" (in lists and dashboard widgets) now start and end the period at midnight in the user's own [time zone](ay-start-form-data-tables.md#filtering-dates-and-time-zones). Previously, for a user in a different time zone from the server, records close to the start or end of the period could be included or left out by mistake.
- Server: users with the "Business administration - restricted" role can view [report templates](adm-report-templates.md) but no longer create, edit or import them, as described for that [role](ay-biz-admin-roles.md). The full "Business administration" role is required for users who need to edit report templates.
- Server: relative date filters such as "today" or "last month" (in lists and dashboard widgets) now start and end the period at midnight in the user's own [time zone](ay-start-form-data-tables.md#filtering-dates-and-time-zones). Previously, for a user in a different time zone from the server, records close to the start or end of the period could be included or left out in some cases.
- Server: when a report fails to render, objects and errors a report script passes to `console.error` are now shown with their contents and stack (line numbers within the script) in the error message, to help with [writing report scripts](ay-report-edit.md#script-errors).
- Server: on servers in a time zone with daylight saving time, the automatic backup could run an hour earlier or later than the chosen [backup time](ops-form-backup.md#backup-time) for part of the year; it now always runs at the chosen time on the server's clock.
- Server: a work order created from a [customer service request](svc-csr.md#accept-to-new-work-order) can now be deleted; the request goes back to Open. Previously the delete failed with a server error.
- Server: the SuperUser account can no longer be deleted.
- Server: the SuperUser account can no longer be deleted. Previously it could be deleted on a new installation before it had any activity.
- Server: role rights corrected to match the documentation: "Service technician - restricted" users can view tax codes, projects, unit models and meter readings; "Business administration" users can view server metrics; Accounting users can no longer enter unit meter readings; only "Business administration" users can switch an [integrated application](api-integrated-applications.md) on or off or delete it.
- Server: fixed direct notification messages to a user: only the first one within 12 hours was delivered, now every message is.
- Server: fixed direct notification messages to a user: in some cases only the first one within 12 hours was delivered, now every message is.
- Server: the server information page at `/api/v8/` no longer shows license details.
- Server: business logo uploads must be PNG, JPEG, GIF, WebP or SVG images, and need full rights to global settings. See [business logos](adm-global-logo.md).
- Server: business logo uploads must be PNG, JPEG, GIF, WebP or SVG images, and require full rights to global settings. See [business logos](adm-global-logo.md).
- Server: when a user's password is reset or set by an administrator, or their login is disabled, they are signed out and must sign in again.
- Server: on a server with a purchased license, the SuperUser account can only be used to change its password while it still has the default password, and the login form no longer offers the default SuperUser login. See [SuperUser login](ay-start-login.md).
- Server: on a server with a purchased license, the SuperUser account can only be used to change its password if it still has the default password, and the login form no longer offers the default SuperUser login. See [SuperUser login](ay-start-login.md).
- Server: the SMTP server password is no longer shown in the [notification settings](ops-notification-system.md) form; it shows `********` when a password is set. Type a new password to change it.
- Linux: Ubuntu 24.04 and 26.04 are now tested and supported. On Ubuntu 24.04 and newer the .NET runtime is installed from Ubuntu's own package archive.
- Docs: updated the [Linux server](ops-install-linux-server.md), [Linux desktop](ops-install-linux-desktop.md), [Windows local network](ops-install-windows-lan.md) and [Windows IIS](ops-install-windows-iis.md) installation and upgrade instructions for .NET 10 and Ubuntu 24.04 / 26.04.
@@ -64,7 +62,6 @@ IN PROGRESS
- Server: if the report rendering browser cannot be downloaded or started, a specific error is now shown and logged instead of a generic job failure.
- Docs: fixed several links in the manual that opened the wrong section or page.
## 2025
### AyaNova 8.2.4

2
docs/8.0/ayanova/docs/home-password.md
View File

@@ -39,7 +39,7 @@ In the current climate of hacking and malware we recommend you do _not_ enter yo
#### Backed up by Two factor authentication
AyaNova has [built in support](home-tfa.md) for the current most secure form of Two factor authentication and we encourage you to use it for all users.
AyaNova has [built in support](home-tfa.md) for Two factor authentication and we encourage you to use it for all users.
In particular any User account that has the Business administration role (such as the built in SuperUser account) should be backed up with with two factor authentication codes as these roles are extremely powerful and can be used to easily circumvent security by assigning roles to other Users or creating entirely new Users.