kobotoolbox / kpi

81%

master: 76%

LAST BUILD ON BRANCH release/2.026.27

branch: release/2.026.27

CHANGE BRANCH

x

Reset

• release/2.026.27
• 1086-simplify-service-usage
• 1332-migrate-member-data-to-org
• 1333-transaction-atomic-fix
• 1334-back-fill-asset-search-field-for-owner-label
• 1352-long-running-migration
• 1384-refactor-owner-label
• 1398-remove-outdated-mmo-email-line
• 1482-remove-nlp-addons-dropdown
• 1513-return-retry-after
• 2.025.29-synchronous-export-hotfix
• 590-update-signals-to-trigger-storage-counters-update
• 750-create-register-celery-tasks-mass-emails
• 862-reject_duplicate_submissions
• 945-issue
• 949-formpack-ordered-spreadsheets
• DEV-1180-media-url-are-not-updated-with-new-owner-after-joining-an-org-in
• DEV-139-fix-project-ownership-transfer-does-not-transfer-thumbnails
• DEV-1469-create-model-for-tag-trackers
• DEV-1607-migrate-object-id-to-char-field
• DEV-1636-uuid-constants-for-tests
• DEV-1728-improve-rest-services
• DEV-1987-fix-create-kobo-superuser
• DEV-2277-ensure-maximum-asr-language-support
• DEV-643-schema-validation
• HEAD
• INFRA-284-update-kpi-repo-to-use-oidc-for-aws-authentication
• UI-fixes-oct3
• UI-fixes-oct4
• add-form-uuid-to-asset-serializer
• add-hsts-comment
• add-mngnt-command-repostgres
• allow-ui-api-token-regeneration
• anji/dev-1083-refactor-addons
• anji/dev-1725-open-languages-endpoint
• anji/dev-999-update-sass
• anji/map-wrapper-component
• assetsnapshot-source-failing-test
• assetversion-historical-models
• auto-delete-attachments-clear-counter
• backport-59cdd01a2
• backport-kobotoolbox/kpi#5436
• backport-kobotoolbox/kpi#5524
• backport-kobotoolbox/kpi#7143-2.026.03
• backport-kpi-6409-to-2.025.37
• backport-permissions-project-fix-kpi-6308
• backport/dev-2349-to-2.026.03
• backport/dev-2349-to-2.026.12
• beccagraber/1151-rename-key-to-collector
• beccagraber/1953-one-time-mass-emails
• beccagraber/500-error-in-emails
• beccagraber/DEV-1560-cleanup-redis-delete-dcgs
• beccagraber/DEV-1763-yoke-params
• beccagraber/DEV-1982-migrate-bad-qaf
• beccagraber/DEV-1982-table-error-if-verification-missing
• beccagraber/DEV-799-retry-pending-tasks
• beccagraber/TASK-1693-turn-on-new-process
• beccagraber/TASK-1697-deprioritize-onetime-sends
• beccagraber/TASK-1763-configurable-send-interval
• beccagraber/TASK-1787-500-on-mass-email
• beccagraber/TASK-1835-send-when-live-emails-change
• beccagraber/access-log-pagination
• beccagraber/add-80-percent-threshold
• beccagraber/add-compose-url-to-builder
• beccagraber/add-debugging-libraries
• beccagraber/backport-1227
• beccagraber/backport-data-table-fix
• beccagraber/batch-language-imports
• beccagraber/bugfix-orgs-no-owners
• beccagraber/check-project-owner-in-sub-logs
• beccagraber/deactivate-reversion-vacuum
• beccagraber/dev-1005-email-address-on-sso
• beccagraber/dev-1005-no-email-update-for-sso
• beccagraber/dev-1040-update-usage-limits
• beccagraber/dev-1053-slow-export
• beccagraber/dev-109
• beccagraber/dev-1149-add-dcg-info-to-logs
• beccagraber/dev-1150-revoke-dc-access
• beccagraber/dev-1158-dc-ui-improvements
• beccagraber/dev-1159-fill-in-validation-status
• beccagraber/dev-1171-filter-out-inactive-users
• beccagraber/dev-1184-fix-manifest-renderer
• beccagraber/dev-1188-add-manifest-unit-test
• beccagraber/dev-1227-convert-to-migration
• beccagraber/dev-1229-add-model-and-endpoints
• beccagraber/dev-1229-use-advanced-actions
• beccagraber/dev-1231-port-unit-tests
• beccagraber/dev-1243-keep-user-extradetails
• beccagraber/dev-1357-nest-anon-exports
• beccagraber/dev-1359-limit-anon-exports
• beccagraber/dev-1362-fix-transform-data-for-output
• beccagraber/dev-138-hidden-disclaimers
• beccagraber/dev-1384-active-users-email-filter
• beccagraber/dev-1387-fix-analysis-from-json
• beccagraber/dev-1388-migrate-old-advanced-features
• beccagraber/dev-1441-cannot-create-bad-features
• beccagraber/dev-1452-dont-allow-failed-answers
• beccagraber/dev-1452-new_action
• beccagraber/dev-1453-run-external-process
• beccagraber/dev-1455-rename-qual
• beccagraber/dev-1461-update-list-endpoint
• beccagraber/dev-1462-filter-exports
• beccagraber/dev-1466-get-lookback-from-product
• beccagraber/dev-1497-show-most-recently-created-qual-answer
• beccagraber/dev-1543-handle-bad-select-one
• beccagraber/dev-1560-dc-fixes
• beccagraber/dev-1579-data-response-attachments
• beccagraber/dev-1582-accept-false
• beccagraber/dev-1585-exclude-submitters
• beccagraber/dev-1618-do-not-double-array
• beccagraber/dev-1619-default-string
• beccagraber/dev-1623-update-docs
• beccagraber/dev-1630-type-options
• beccagraber/dev-1651-documentation
• beccagraber/dev-1748-verification-docs
• beccagraber/dev-1752-500-in-asset-list
• beccagraber/dev-1764-error-message
• beccagraber/dev-1788-make-translations-syncronous
• beccagraber/dev-1800-fix-clear-qa
• beccagraber/dev-1814-fix-type-error
• beccagraber/dev-1817-count-endpoints
• beccagraber/dev-182-add-project-owner-to-permission-ph-logs
• beccagraber/dev-1821-remove-signal-handler
• beccagraber/dev-1836-update-formpack
• beccagraber/dev-185-nulls-in-kpi_assetsearch_field-cause-500-errors
• beccagraber/dev-1904-allow-empty-answers
• beccagraber/dev-1914-delete-all-choices
• beccagraber/dev-1915-escape-spookiness
• beccagraber/dev-1917-configurable-arn-string
• beccagraber/dev-1922-remove-credentials
• beccagraber/dev-195-add-query-counting-tests-to-critical-endpoints
• beccagraber/dev-1955-auto-accept-transcripts-for-qa
• beccagraber/dev-1966-accept-nlp-over-limit
• beccagraber/dev-1988-permission-for-single-delete
• beccagraber/dev-1990-add-created-by-to-response
• beccagraber/dev-2030-500-from-migration
• beccagraber/dev-204
• beccagraber/dev-2094-fix-error
• beccagraber/dev-2094-make-it-end
• beccagraber/dev-2094-migrate-q-to-xpath
• beccagraber/dev-2112-increase-page-size
• beccagraber/dev-2149-fix-token-504
• beccagraber/dev-215
• beccagraber/dev-216
• beccagraber/dev-218
• beccagraber/dev-2180-fix-admin-add-user
• beccagraber/dev-2207-make-retention-setting
• beccagraber/dev-2248-unable-to-delete-projects
• beccagraber/dev-234-uid-in-response
• beccagraber/dev-29-add-project_owner-to-project-history-submission-logs
• beccagraber/dev-343
• beccagraber/dev-343-fix-transfer
• beccagraber/dev-45-add-project-owner-to-deployment-ph-logs
• beccagraber/dev-478
• beccagraber/dev-562
• beccagraber/dev-565
• beccagraber/dev-574
• beccagraber/dev-587
• beccagraber/dev-595
• beccagraber/dev-596
• beccagraber/dev-605
• beccagraber/dev-626-use-username
• beccagraber/dev-711-pickle-error
• beccagraber/dev-714-add-hints
• beccagraber/dev-721-backup-llm
• beccagraber/dev-734-add-to-exports
• beccagraber/dev-734-handle-acceptance
• beccagraber/dev-754-add-root-uuid-to-instance-history
• beccagraber/dev-786-create-db-models
• beccagraber/dev-786-revert-accidental-change
• beccagraber/dev-787-new-auth-class
• beccagraber/dev-788-update-list-endpoints
• beccagraber/dev-797-update-submission-endpoints
• beccagraber/dev-798-create-enketo-links-dc-management
• beccagraber/dev-798-create-enketo-links-for-assets
• beccagraber/dev-798-create-enketo-links-utils
• beccagraber/dev-798-create-enketo-urls
• beccagraber/dev-798-fix-asset-change
• beccagraber/dev-798-fix-enketo-links
• beccagraber/dev-799-remove-test
• beccagraber/dev-838-remove-reversion-version
• beccagraber/dev-842-add-logging
• beccagraber/dev-842-retry-attachments
• beccagraber/dev-903-use-better-name
• beccagraber/dev-935-allow-hiding-qa-questions
• beccagraber/dev-946-optimize
• beccagraber/dev-946-version-cleanup-task
• beccagraber/dev-964-add-ph-logs
• beccagraber/dev-975-fix-redirect-from-create-account
• beccagraber/email-qa
• beccagraber/fix-biome
• beccagraber/fix-erratic-test
• beccagraber/fix-import-tests
• beccagraber/fix-metadata-endpoint
• beccagraber/fix-org-admin-endpoints
• beccagraber/fix-query-counts
• beccagraber/fix-stripe-bug
• beccagraber/fix-timeouts
• beccagraber/improve-mongo-sync
• beccagraber/improve-mongo-sync-more
• beccagraber/include-test-query
• beccagraber/new-gh-action
• beccagraber/optimize-search-filter
• beccagraber/refactor-subsequences-2025-fix-tests
• beccagraber/refactor-subsequences-2025-migration
• beccagraber/remove-hint
• beccagraber/rename-chained-qual
• beccagraber/reset-lrm-0024
• beccagraber/speed-up-migration
• beccagraber/store-all-transfer-errors
• beccagraber/take-email-setting-from-env
• beccagraber/update-audit-log-pagination
• beccagraber/update-data-interface
• beccagraber/user-stuff
• beta
• block-project-transfers-to-org-members
• ci-move-kfmain
• codacy_coverage
• consolidate-xml-processing
• convert-stream-name-to-input-for-zulip-workflow
• copy-history-logs-code-from-main-to-2.025.02
• decrease-restarted-tasks
• decrease-unittest-running-time
• dependabot/github_actions/actions-deps-2b1d353b35
• dependabot/github_actions/actions-deps-2d1112a488
• dependabot/github_actions/actions-deps-36ea5327de
• dependabot/github_actions/actions-deps-4563e2e311
• dependabot/github_actions/actions-deps-51f4226e04
• dependabot/github_actions/actions-deps-5df0e1d16a
• dependabot/github_actions/actions-deps-64f5bdb44b
• dependabot/github_actions/actions-deps-6c4124e1f2
• dependabot/github_actions/actions-deps-742e3c8d1b
• dependabot/github_actions/actions-deps-7530ffc9b9
• dependabot/github_actions/actions-deps-78e37b62cc
• dependabot/github_actions/actions-deps-a331d3ec2d
• dependabot/github_actions/actions-deps-ea22d4cb26
• dev-1001-update-usage-counters-zero-days
• dev-1006-kc-api-endpoints-not-working
• dev-1007-schedule-update-counters-with-chrontab
• dev-1015-edits-bypass-limit-enforcement
• dev-1021-filter-on-datetime-instead-of-date-when-filtering-limit-counters
• dev-1022-transferring-project-ownership-issues-sharing-permissions
• dev-1023-fix-infinite-load-when-previewing-form-as-an-anonymous-user
• dev-1031-update-stripe-limits-code-for-llm
• dev-1033-fix-darker-ci
• dev-1038-fix-auth-submission-error-openrosa
• dev-1041-api-documentation-improvement
• dev-1047-add-proper-markdown-documentation-for-access-logs
• dev-1049-show-uid-instead-of-parent-lookup
• dev-1061-fix-drf-spectacular-warnings-service-usage
• dev-1062-fix-usage-balances-value-or-null
• dev-1063-fix-openapi-organization-props
• dev-1072-do-not-show-inactive-users-in-mmo-members-list
• dev-1084-add-admin-action-to-deactivate-users
• dev-1084-add-inactive-users-filter-in-django-admin
• dev-1092-deduplicate-member-enums
• dev-1093-make-memberresponse-invite-optional
• dev-1103-endpoint-for-deleting-all-user-permissions
• dev-1105-fix-500-error-accessing-asset-snapshot-endpoint-anonymously
• dev-1108-disable-emails-to-unknown-accounts
• dev-1115-fix-rendering-with-browser
• dev-1124-do-not-let-user-trash-themselves-via-api-if-they-still-own-projects
• dev-1129-reject-submissions-with-invalid-xml-characters
• dev-1131-fix-bulk-update-raises-500-instead-of-400
• dev-1131-fix-bulk-update-raises-500-instead-of-400-error
• dev-1134-users-cant-be-deleted
• dev-1140-avoid-import-module-in-create-instance
• dev-1140-consolidate-user-profile-queries
• dev-1140-fix-advisory-lock
• dev-1140-use-cache-request-for-subsequent-calls-of-check-limit
• dev-1140-use-main-profile-counters
• dev-1156-fix-uid-import
• dev-1164-fix-wrong-tags-for-stagingprod-environments
• dev-1170-project-exports-fail-with-500-error
• dev-1172-mismatched-labels-and-translations-export-failure
• dev-1176-set-attachment-media-file-basename-consistenly
• dev-1193-editing-and-previewing-broken-for-dynamic-data
• dev-1200-attachment-inline
• dev-1202-basic-html-renderer-does-not-consume-generators
• dev-1207-allow-safe-inline-mimetypes
• dev-1210-remove-cascade-from-instance-fk-to-user
• dev-1211-persist-submitted-by-on-user-deletion
• dev-1223-list-all-users-in-apiv2users
• dev-1230-openapi-schema-for-advanded-features
• dev-1234-AnonymousUser-not-able-submit-data-bug
• dev-1236-apiv2users-returns-a-502
• dev-1236-apiv2users-returns-a-502-with-gen
• dev-1241-new-organization-is-created-after-user-removal
• dev-1242-add-extra-details-to-user-reports
• dev-1253-set-removed-users-to-null-in-audit_logs
• dev-1256-remove-organizations-owned-by-deleted-users
• dev-1257-remove-v1-forms-endpoint
• dev-1258-remove-v1-data-endpoint
• dev-1259-remove-metadata-endpoints
• dev-126-enable-unlimited-plan-upgrades
• dev-1260-remove-v1-notes-endpoint
• dev-1261-remove-api_v1_submissions_endpoints
• dev-1266-remove-kpi-v1-endpoints
• dev-1267-add-snapshot-date-modified-to-api-response
• dev-1268-remove-done_storage_limits_check-from-api-response
• dev-1269-add-organization-website-to-user-reports-response
• dev-1272-migrations-discrepancy
• dev-1278-data-endpoint-pagination
• dev-1282-switch-pip-to-uv
• dev-1286-long-running-own-queue
• dev-1288-restservice-creation-regression
• dev-1289-fix-bug-with-heic-images
• dev-1297-implement-methods-for-qual-action
• dev-1303-fix_2fa_recovery_code_error
• dev-1308-add-ses-configuration-set-env
• dev-1313-remove-count-super-user-endpoints
• dev-1342-update-billing-portal-handling
• dev-1347-fix-failing-anonymous-submissions-from-collect
• dev-1354-remove-count-user-report
• dev-1358-erase-anonymous-exports
• dev-1369-remove-audit-log-exports
• dev-1370-remove-old-project-view-exports
• dev-1371-rename-ANONYMOUS_EXPORTS_GRACE_PERIOD-variable
• dev-1372-erase-older-syncronous-exports
• dev-1372-refactor-tests
• dev-1373-remove-exports-based-on-the-last-modification-time
• dev-1374-remove-v1-users-endpoint
• dev-1375-remove-v1-user-endpoint
• dev-1376-remove-v1-formlist-endpoint
• dev-1377-remove-api-v1-briefcase-endpoints
• dev-1379-clean-up-unused-code
• dev-1383-404-response
• dev-1383-unit-tests
• dev-1420-upgrade-google-translation-api
• dev-1421-create-bulk-action-models
• dev-1422-update-automatic-google-transcription-flow
• dev-1426-placehold-bulk-jobs-api
• dev-1440-create-index-on-pending-delete
• dev-1442-not-flag-deletion-as-accepted
• dev-1443-fix-NLP-actions-background-update
• dev-1449-throttle-requests-for-automatic-QA
• dev-1459-disable-django-all-auth-rate-limiting
• dev-1470-create-tag-tracker
• dev-1475-clean-up-refactor-subsequences
• dev-1475-linter-refactor-subsequences
• dev-1479-500-error-with-deployed-project
• dev-1483-uv-pip-compile-output
• dev-1487-add-unit-test-for-assets-numeric-search
• dev-1487-fix-project-search-bar-issue
• dev-1490-fix-duplicate-social-accounts-issue
• dev-1491-fix-duplicate-orgs
• dev-1494-add-bulk-actions-celery-task
• dev-1494-execution-and-polling-for-bulk-actions
• dev-1496-in-app-message-user-details
• dev-1498-upgrade-google-transcription-to-use-v2-api
• dev-1500-viewset-and-serializer-for-bulk-actions
• dev-1501-bulk-actions-schema-documentation
• dev-1501-clean
• dev-1523-create-models-for-extra-project-metadata-fields
• dev-1525-update-environment-endpoint
• dev-1532-django-model-admin-for-extra-project-metadata-fields
• dev-1538-counters-out-of-sync
• dev-1542-transx-react-query-poc
• dev-1546-add-locale-field-for-nlp-actions-in-documentation
• dev-1547-fix-500-error-when-reading-supplementaldetails-in-api
• dev-1550-fix-deleting-null-value
• dev-1573-dataresponse
• dev-1573-handle-indexable-openapi-types
• dev-1577-fix-dataresponse-schema
• dev-1578-supplementaildetails-types
• dev-1589-implement-bulk-action-cancellation
• dev-1600-data-detail-endpoint-should-return-backward-compatible
• dev-1601-deleting-an-action-does-not-remove-it-from-the-supplementdetail
• dev-1603-support-admin-actions-in-audit-logs
• dev-1604-audit-log-integration-for-django-admin
• dev-1605-implement-constance-config-logging
• dev-1607-migrate-audit-log-object-id-to-char-field
• dev-1613-do-not-allow-translation-of-deleted-transcripts
• dev-1627-update-advanced-feature-patch-api-schema
• dev-1628-openapi-qual-params-missing-option
• dev-162_perm_error_qualitative_analysis
• dev-1632-data-supplement-response-qual-item-data-fix
• dev-1634-api-advanced-features-should-reject-qa-item-with-non-uuid-uuid
• dev-1645-fix-neighboring-submission-ordering
• dev-1652-track-users-accessing-v1-endpoints
• dev-1657-support-rootuuid-in-submission
• dev-1664-idps-models-admin
• dev-1665-scim-get-list-api-endpoints
• dev-1666-deprovisioning-endpoint
• dev-1674-fix-missing-information-issue
• dev-1680-usernames
• dev-1682-metadata-mapping
• dev-1683-scim-reactivation-logic
• dev-1685-audit-logs
• dev-1689-some-profiles-still-have-the-submission-suspended-flag-enabled-after
• dev-1698-fix_0005_lrm_timeout
• dev-1714-fix-duplicate-organization-removal-logic
• dev-1715-fix-translation-not-created-when-transcript-deleted
• dev-1716-make-data-endpoint-limit-env-vars
• dev-1718-remove-drf-frontend-files
• dev-1720-fix-null-bucket-name-infinite-processing
• dev-1731-remove-free-tier-code
• dev-1735-teams-subscription-not-showing-in-user-reports
• dev-1741-blacklist-domains-to-prevent-signup
• dev-1751-block-edit-duplicated-submissions
• dev-1751-submissions-unable-to-submit-after-editing
• dev-1767-improve-rest-service-retry-logic-and-status-handling
• dev-1768-failed-to-list-assets-500-error
• dev-1787-add-tests-poll-run-external-process-failure
• dev-1797-custom-report-internal-server-error
• dev-1798-restart-long-running-migrations
• dev-1799-make-mfa-available-for-everyone
• dev-1801-fix-500-when-requesting-auto-QA
• dev-1803-perms-asset-memory-leak
• dev-1808-extend-window-of-activation-and-confirm-email-links
• dev-1809-fix-mfa-unit-tests
• dev-1815-groups-serviceproviderconfig-endpoints
• dev-1816-update-backup-llm-model
• dev-1822-fix-materialized-view-migration-conflict
• dev-1829-allauth-openapi-docs
• dev-1835-prevent-mfa-lockout
• dev-1838-celery-logs-produce-duplicate-logs
• dev-1841-error-502-on-form-load
• dev-1863-remove-reversion-tech-debt
• dev-1884-issues-with-sharing-permissions
• dev-1888-do-not-allow-users-to-change-usernames
• dev-1897-metadata-endpoints
• dev-1898-make-nlp-configureable-via-env-vars
• dev-1902-paireddataallowed-fields-exposes-all-source-data-when-field
• dev-1910-make-very-long-running-migrations-retry-on-common-errors
• dev-1911-fix-mfa-is-active-in-user-reports
• dev-1912-updating-prompts
• dev-1913-automation-assistance-for-manual-invoicing
• dev-1926-superuser-cannot-deactivate-mfa-when-SUPERUSER_AUTH_ENFORCEMENT-is-active
• dev-1928-timeout-slow-QA-responses-gracefully
• dev-1929-remove-V1UserTracker
• dev-1938-remove-api-v1-media-endpoints
• dev-1943-google-regional-data
• dev-1946-update-auto-qa-primary-model
• dev-1947-create-apiv2assetslisting-endpoint
• dev-1948-remove-misleading-last_updated-from-user-reports
• dev-1951-mass-email-v1user-filter
• dev-1957-fix-nlp-counter-without-stripe
• dev-1961-subsequence-mngt-cmd-migration
• dev-1969-allow-verifying-llm-answers-even-if-limit-exceeded
• dev-1973-remove-tags-notes-from-mongodb
• dev-1999-update-languages-to-support-google-v2
• dev-2002-mock-storage
• dev-2012-audit-log-migration-blocks-202612-release-deployment
• dev-2014-auth-internal-endpoints
• dev-2015-cannot-apply-djstripe-migration-on-production
• dev-2017-remove-env-fallback-from-nlp-constance-settings
• dev-2021-prevent-simultaneous-async-exports
• dev-2023-fix-mfa-re-enrollment-lockout
• dev-2025-fix-v1-access-logging-token-auth
• dev-2027-constance-4x-upgrade-breaks-mfa
• dev-2027-constance-4x-upgrade-error
• dev-2036-fix-empty-supplement-content
• dev-206-fix-active-subscription-query
• dev-2067-move-environment-to-v2
• dev-2072-add-nested-storage-for-extra-project-metadata-on-asset-settings
• dev-208-improve-trash-bin-retry
• dev-2086-asr-quality-improvement
• dev-2090-background-polling-support-for-translations
• dev-2095-issue-importing-multilingual-xlsform-files
• dev-2128-fix-cast-issue
• dev-2143-fix-schema-for-languages
• dev-2148-constance-cache-fix
• dev-2161-always-include-extra_metadata-fields-in-asset-response
• dev-2162-remove-email-support-links
• dev-2189-openapi-schema-for-imports-fix
• dev-2199-simplify-nlp-api-location-and-implement-toggle
• dev-2209-project-views-teams-view
• dev-2210-implement-bulk-processing-history-log-action
• dev-222-set-attachment-deleted-flag-in-mongo-after-cleanup
• dev-2226-connect-sso-to-a-kobo-account-from-account-settingssecurity-page
• dev-2233-export-qual-qs
• dev-2239-bulk-action-skip-conflicts
• dev-2254-endpoint-to-return-audio-length
• dev-2258-attachments-deletion-fix
• dev-227-replace_guardian_assign_remove_perm
• dev-2271-inactive-users-filter-timesout
• dev-2271-simplify-user-activity-filters
• dev-2276-add-failed-login-attempts
• dev-228-remove-openrosa-permissions-backend
• dev-229-remove-guardian-related_code
• dev-2304-metadata-integration
• dev-231-remove_PERM_FROM_KC_ONLY
• dev-232-extend-api-view
• dev-2320-backfill-remaining-root-uuid
• dev-2324-bulk-accept-endpoint
• dev-2332-final-review-comments
• dev-2333-add-pending-review-flag
• dev-2344-some-users-not-able-to-submit
• dev-2346-fix-bulk-action-failure-when-switching-languages
• dev-2349-blacklist-lookups
• dev-2385-fix-bulk-accept-endpoint
• dev-239-celery-task-to-retrieve-every-user-above-limit
• dev-2394-user-names-and-metadata-refactor
• dev-240-create-a-celery-task-to-move-attachment-to-trash-bin
• dev-241-improve-admin-ui-to-filter-trash-bin
• dev-242-fix-org-tests-no-stripe
• dev-253-reset-xform-idstring-on-transfer-conflict
• dev-264-fix-anonymous-submissions-for-organizations-members
• dev-272-kobo-install-breaks-on-initial-run
• dev-287-add-filtering-for-user-reports-endpoint
• dev-294-fix-duplicate-attachments
• dev-343-avoid-race-conditions
• dev-347-move-counter-lock-at-the-end-of-transaction
• dev-349-do-not-return-202-on-advisory-lock
• dev-351-improve-bulk-update-attachments-storage-counters
• dev-421-speed-up-bulk-permision-assignments
• dev-438-remove-briefcase-creation-api
• dev-444-ensure-accurate-limit-counters
• dev-485-block-submissions-for-exceeding-limits
• dev-486-reset-data-on-subscription-change
• dev-487-recurring-task-update-limit-counters
• dev-489-block-nlp-over-limit
• dev-530-api-documentation-files
• dev-531-api-documentation-history
• dev-532-api-documentation-hooks
• dev-533-api-documentation-logs
• dev-534-api-documentation-paired-data
• dev-535-api-documentation-permission-assignment
• dev-536-api-documentation-version
• dev-537-api-documentation-audit-logs
• dev-538-api-documentation-imports
• dev-539-api-documentation-languages
• dev-540-api-documentation-organization
• dev-541-api-documentation-members
• dev-542-api-documentation-invites
• dev-543-api-documentation-permissions
• dev-544-api-documentation-project-ownership-invites
• dev-545-api-documentation-transfer
• dev-546-api-documentation-project-views
• dev-547-api-documentation-service-usage
• dev-548-api-documentation-transcription-service
• dev-549-api-documentation-users
• dev-550-api-documentation-deployment
• dev-554-allow-disabling-limit-enforcement
• dev-558-duplicate-transfer-django-admin
• dev-570-make-0005-long-running-migration-lighter-on-memory
• dev-570-restart-long-running-migration-0005
• dev-571-use-root-uuid-in-subsequence-app
• dev-576-fix-empty-xml-is-returned-when-xlsform-is-invalid
• dev-604-refactor-stripe-utils
• dev-614-cannot-load-api-documentation-on-staging-server
• dev-624-fix_error_500_in_summary
• dev-625-cannot-edit-submissions-with-null-root-uuid
• dev-634-exports
• dev-645-old-edited-submissions-cannot-be-edited-again
• dev-650-edited-submissions-receive-409-on-new-edits
• dev-650-fix-crash-management-command
• dev-650-fix-crash-management-command-2.025.14-backport
• dev-677-cannot-duplicate-edited-submissions
• dev-695-type-error-when-retrieving-xpath-with-old-versions
• dev-698-bulk-edit-no-rootuuid
• dev-701-expose-last-modified-by-field
• dev-706-bad-gateway-in-synchronous-export
• dev-727-api-documentation-refactor
• dev-727-status-export-choice-field
• dev-728-update-models-for-llm-usage
• dev-745-prompt-engineering
• dev-746-upgrade-allauth-version
• dev-748-api-documentation-schema-refactor
• dev-749-mfa-update-endpoints
• dev-750-replace-trench-forms
• dev-752-make-instancehistory-persist-on-delete
• dev-753-celery-task-to-clean-submissions
• dev-758-api-documentation-me
• dev-762-api-documentation-generic-fields
• dev-769-api-documentation-formlist
• dev-771-api-documentation-submission
• dev-772-api-documentation-form-manifest
• dev-773-api-documentation-xformMedia
• dev-774-create-openrosa-doc
• dev-774-fix-openrosa-endpoint-in-v2
• dev-775-api-documentation-translation-service
• dev-782-api-documentation-remove-openrosa-endpoints
• dev-785-add-deprecation-and-removal-md
• dev-800-migrating-tag-endpoint-to-v2
• dev-801-remove-sitewidemessage-endpoint
• dev-805-use-usage-limit-enforcement-env-var
• dev-807-expose-tos-in-api
• dev-810-migrate-authorized-application-endpoints
• dev-817-port-xform-missing-properties-to-v2
• dev-824-clean_up_obsolete_permissions_code
• dev-828-api-documentation-tags
• dev-829-schema-generator-script
• dev-831-api-documentation-email
• dev-832-api-documentation-social
• dev-837-merge-routers-into-one
• dev-844-api-documentation-terms-of-services
• dev-845-api-documentation-authorized-application
• dev-848-fix-authorized-url-bug
• dev-854-migrate-trench-data
• dev-869-status-fields-must-be-enums
• dev-877-api-documentation-xformlist
• dev-878-fix-url-util-bad-format
• dev-880-optimize-asset-list-endpoint
• dev-884-remove-manifest-endpoint
• dev-889-fix-field-in-me
• dev-891-remove-openrosa-errors
• dev-894-fix-member-fields
• dev-897-invalid-characters
• dev-899-optimize-queries-for-subscriptions
• dev-899-optimize-queries-for-usage-and-subscription
• dev-899-optimize-users-endpoint-queries
• dev-902-fix-invite-endpoint
• dev-907-fix-enum-field
• dev-909-check-limits-on-submission-402
• dev-912-clean-up-renderers
• dev-916-fill-exceedlimitcounters-objects
• dev-917-rewrite-limit-notifications-frontend
• dev-920-improve-django-admin-ui-for-datacollectorgroups
• dev-925-get_name_from_extra_details
• dev-940-remove-leftover-renderers
• dev-945-remove-reversion-usages
• dev-950-request_user_role_enum
• dev-951-patchedinvitepatchpayload-enums
• dev-952-required-props-in-org-service-usage
• dev-953-required-fields-total-nlp-usage
• dev-954-shared-type-for-service-usage-balances
• dev-955-stripe-subscriptions-schema
• dev-956-parameterization-of-inactive-users-mass-emails
• dev-957-errordetail-errorobject
• dev-962-refactor-attachment-trash-logging-to-use-project-history-log
• dev-971-fix-error-in-attachment-trash-when-associated-submission-is-deleted
• dev-978-adjust-limit-counter-days-creation-default
• dev-987-asset-usage-limit-offset-pagination
• dev-994-enable-delete-account-feature
• dev-api-documentation-fix-error-in-enum
• develop
• develop_codacy_python_coverage
• django-5.2
• django-5.2-lint
• django-5.2-update-deps
• django-5.2-update-stripe
• django-registration-redux-downgrade
• docker_buildable
• docker_more_npm_installs
• docker_npm_cache
• exclude-forms-of-inactive-users-from-formlist
• exclude_trashed_xforms_from_attachment_storage_bytes_calculations
• expose-attachment-uid-in-data-endpoint
• feature-automatic-qa
• feature/api-documentation
• feature/api-documentation-handle-other-responses
• feature/long-running-migrations
• fix-2.025.02-blocking-migrations
• fix-admin-user-list
• fix-and-consolidate-submission-version-matching
• fix-asset-from-xform-bottleneck
• fix-asset-lookup-fallback
• fix-attachment-index-migration
• fix-attachment-transfer
• fix-auto-qa-throttling-tests
• fix-auto-qa-throttling-tests-2.026.12
• fix-automatic-qa-throttling-test-cache-isolation
• fix-billing-test-edge-case
• fix-bug-cannot-delete-edited-submission-attachments
• fix-cancelled-plan-period
• fix-celery-beat-schedule
• fix-celery-settings
• fix-clean-duplicated-submissions-with-options
• fix-conflicting-template-names
• fix-counter-bug-after-project-transfer
• fix-date-modified-abstract-model
• fix-documentation
• fix-drf-urlpattern-wrong-regex
• fix-export-deletion-task-paths
• fix-formpack-version
• fix-hook-log-tests
• fix-invite-permissions-for-external
• fix-linter-on-bad-merge
• fix-linting-js
• fix-mgnt-cmd-update_attachment_storage_bytes
• fix-migrations-new-install
• fix-mongo-maxtimeout
• fix-mongohelper-update-many
• fix-mv-recreation
• fix-nlp-partial-permission-check
• fix-nlp-test
• fix-null-root-uuid-in-api-response
• fix-obsolete-qpath-in-formpack
• fix-openrosa-model-permission
• fix-pending-delete-xforms-mgnt-cmd
• fix-permission-mutations
• fix-pip-compile-error
• fix-race-conditions-on-transfer-from-django-admin
• fix-remongo
• fix-remove-from-kc-only-permissions-job
• fix-silent-data-loss-when-image-question-has-an-appearance
• fix-silent-data-loss-when-image-question-has-an-appearance-oleger
• fix-slow-lrm-0020
• fix-snapshot-regeneration
• fix-swagger-ui-search-bar
• fix-test-to-use-reverse
• fix-throttle-bedrock-tests
• fix-throttling-tests
• fix-timeout-invite-admin-ui
• fix-transfer-data-to-org-on-invite
• fix-transferred-owner-shared-with-another-owner
• fix-trash-bin-put-back
• fix-trash-bin-task-restarter
• fix-trashbin-fail-immediately-missing-xforms
• fix-travis-install-issue
• fix-typo-migration-names
• fix-unit-test-after-release-2.025.34-merge
• fix-unit-test-for-cancelled-plan-last-month
• fix-user-roles-in-user-reports-endpoint
• fix-version-hash-lrm-oom
• fix-wrong-skip-heavy-migrations
• formpack-content-updates
• guitlle/dev-1393-pagination-classes-parameters
• guitlle/dev-1695-fix-mfa-tests
• guitlle/dev-1728-fix-rest-service-not-triggered
• guitlle/dev-1745-fix-long-running-migration-issue
• guitlle/fix-hub-merge-conflict
• guitlle/fix-mfa-copy
• guitlle/fix-mfa-login-copy
• guitlle/fix-user-deletion-monkey-patching
• handle-old-qpaths-bug
• hubspot
• hugo/dev-2034-deleted-connected-projects-in-paired-data-source-list
• improve-admin-ui
• improve-long-running-migrations-system-checks-message
• improve-manual-postgresql-instructions
• improve-openrosa-endpoints
• improve-paired-data-sync
• improve-user-agent-for-enketo-and-collect
• increase-default-files-path-length
• issue-877
• issue-977
• kalvis/api-orval
• kalvis/api-orval-invite
• kalvis/be-linter
• kalvis/biome-autofix
• kalvis/ci-biome
• kalvis/ci-biome-2
• kalvis/ci-locally
• kalvis/ci-openapi
• kalvis/deleted-attachment
• kalvis/es6-to-js
• kalvis/filters
• kalvis/format
• kalvis/gen-schema
• kalvis/gha-bot-channels
• kalvis/gha-typo
• kalvis/github-actions-bot
• kalvis/ignore-minified-swagger
• kalvis/locale-submodule
• kalvis/release-linter
• kalvis/release-notifications
• kalvis/releases-fix2
• kalvis/submodules-python
• kalvis/swagger
• kalvis/transifex
• kalvis/translate-coffeescript-too
• leszek/DEV-1157-self-delete-feature-optional
• leszek/dev-1382-export-error-handling
• leszek/dev-1580-assetsListParams
• leszek/dev-1626-fix-quary-param-name
• leszek/dev-1900-map-403-bugfix-2.026.07
• leszek/dev-1900-map-403-bugfix-2.026.12
• leszek/dev-2057-mantineify-assettagsmodal
• leszek/dev-2176-orvalify-formmedia
• leszek/dev-2232-orval-msw-gen
• leszek/dev-353-rootuuid
• leszek/dev-725-ai-indicators-and-clear-2
• leszek/dev-763-last-edited-column
• leszek/dev-94-remove-cypress
• leszek/task-1466-academy-button
• linter-and-format-after-merge-2.025.37
• loginas
• long-running-migration-wrong-queue
• long-running-migrations
• main
• master
• migrate-versions
• more-resilient-project-transfers
• multiple-objects-returned-error
• new-ui
• no-rename-explicit-names
• oct21-UI-fixes
• optimize-backfilling-attachment-model
• org-invitations-status-validation
• org-update-migrations
• pamorim/dev-1035-fix-project-over-limit-blockage
• pamorim/dev-1636-llm-fix-unit-tests
• pamorim/dev-2032-fix-debug-toolbar-not-found
• pamorim/dev-976-fix-background-audio-soft-deletion
• pamorim/dev-993-conditional-over-limit-error-message
• pamorim/dev-998-mantine-missing-in-basic-layout
• phil/bulk-submission-any-filetype
• pin-git-pip-requirements
• populate-kuid-in-builder
• populate-media-file-basename-in-mongodb
• populate_assetversions-memory-conservation
• python-3.12
• python-3.12-formpack-bump
• refactor-long-running-migrations-execute
• refactor-new-columns-attachment-migration
• refactor-subsequences-2025
• refactor-subsequences-2025--DEV-1301-update-formpack
• release/2.025
• release/2.025.10
• release/2.025.14
• release/2.025.28
• release/2.025.29
• release/2.025.30
• release/2.025.32
• release/2.025.34
• release/2.025.37
• release/2.025.43
• release/2.025.47
• release/2.025.51
• release/2.026.03
• release/2.026.07
• release/2.026.12
• release/2.026.13
• release/2.026.21
• release/2.026.22
• release/2.026.23
• release/2.026.25
• release/2.026.26
• remove-defaults-from-migrations
• remove-nlp-addon-quantity-backend
• remove-temporary-python-pins
• remove-v1-endpoints
• rename-long-running-migration-job
• rename-retention-variables
• rename-user-report-materialized-view-fields
• report-by-name
• reports-hotfix
• resolve-merge-conflicts-2-026-13-to-main
• rest-service-fix
• restore-get-endpoint-in-tests
• revert-6000-dev-805-use-usage-limit-enforcement-env-var
• revert-6157-beccagraber/dev-838-remove-reversion-version
• revert-6238-beccagraber/dev-1005-no-email-update-for-sso
• revert-6583-beccagraber/dev-1452-dont-allow-failed-answers
• revert-6590-revert-6583-beccagraber/dev-1452-dont-allow-failed-answers
• revert-6946-beccagraber/DEV-1982-migrate-bad-qaf
• revert-change-to-historical-assetversion-migration
• revert-kpi#6153
• revert-task-1038-changes
• revise-bulk-delete-attachments-endpoint
• revoke-org-asset-permission-after-deleting-user-from-org
• revoke-org-asset-permission-after-deleting-user-from-org-release-2.025.02
• rm-dummyemail-in-sharemodal
• rsgraber/1552-upgrade-ubuntu-in-gh-actions
• rsgraber/TASK-1056-export-ph-logs
• rsgraber/TASK-1188-fix-allauth-usersession-bug
• rsgraber/TASK-1188-patch
• rsgraber/TASK-1209-audit-log-docs
• rsgraber/TASK-1209-port-docs
• rsgraber/TASK-1243-missing-tasks
• rsgraber/TASK-1340-use-ALVS
• rsgraber/TASK-1342-duplicate-submissions
• rsgraber/TASK-1344-log-deletes
• rsgraber/TASK-1348-log-updated-submissions
• rsgraber/TASK-1358-fix-deleted-user-logs
• rsgraber/TASK-1358-log-new-subs
• rsgraber/TASK-1365-all-types-endpoint
• rsgraber/TASK-1452-rename-admin-user-in-fixtures
• rsgraber/TASK-1454-storage-usage-query
• rsgraber/TASK-1454-storage-usage-query-2
• rsgraber/TASK-1467-upgrade-pyxform
• rsgraber/TASK-1487-add-root-uuids-to-sub-logs
• rsgraber/TASK-1493-inconsistent-sso
• rsgraber/TASK-1506-ph-logs-for-nlp
• rsgraber/TASK-152-nlp-usage-query-2
• rsgraber/TASK-1553-use-trimmed-in-block-translate
• rsgraber/TASK-1579-submission-limits
• rsgraber/TASK-1672-date-modified
• rsgraber/TASK-1734-limit-send-rate
• rsgraber/TASK-751-mass-email-models
• rsgraber/TASK-973-fix-documentation
• rsgraber/bugfix-no-500-on-404
• rsgraber/change-ph-log-export-message
• rsgraber/check-submission-uuid
• rsgraber/fake-innocent
• rsgraber/fake-innocent-3
• rsgraber/fake-main-innocent-2
• rsgraber/fake-problem
• rsgraber/fake-problem-2
• rsgraber/fake-problem-3
• rsgraber/fix-plan-name
• rsgraber/fix-product-import
• rsgraber/make-product-import-conditional
• rsgraber/make-product-import-conditional-backport
• rsgraber/organize-ph-files
• rsgraber/paramaterize-docs
• rsgraber/test-one
• rsgraber/test-two
• rsgraber/try-refactoring-limit-calculations
• rsgraber/update-docs
• ruthturk/dev-1363
• ruthturk/dev-1431
• ruthturk/dev-1432
• ruthturk/dev-1492
• ruthturk/dev-1570
• ruthturk/dev-1620
• ruthturk/dev-1626
• ruthturk/dev-1631
• ruthturk/dev-1637
• ruthturk/dev-1643
• ruthturk/dev-1807
• scott/hsts_comment
• security/2.026.12
• set-fk-for-attachments-linter
• speedup-version-deletion
• sso-provisioning
• sso-stripe-setup-script
• suggested-changes-for-text-input-pr
• swagger-ui-fix-for-csrf-with-sessions
• task-1187-narrow-down-my-projects-list-of-the-org-owner
• task-1210-add-geojson-mime-type
• task-1322-fix_nlp_feature
• task-1327-return-only-relevant-cycle-for-service-usage
• task-1329-remove-users-by-org-report
• task-1330-add-org-name-to-report
• task-1332-avoid-creating-invites-for-existing-transfers
• task-1334-filter-with-owner-label
• task-1338-transfer-to-org-owner
• task-1339-email-template-for-transfer-to-org
• task-1345-independent-org-updates
• task-1353-catch-more-pyxform-errors
• task-1353-fix-odk-validation-error-handling
• task-1353-release-cherry-pick
• task-1353-xlsxwriter-error-handling
• task-1356-remove-deprecated-v1-endpoints
• task-1364-use-community-plan-limits
• task-1366-user-with-partial-perms-cannot-edit
• task-1458-inject-root-uuid-in-api-response
• task-1459-back-fill-rootuuid
• task-1478-add-search-field
• task-1478-async-org-exports
• task-1485-mt-500-error
• task-1494-delete_all-permissions
• task-1499-adjust-members-table-for-invitees
• task-1500-handle-role-update-with-invite-api
• task-1504-delete-submissions-after-transfer
• task-1512-hide-user-info-until-invite-accepted
• task-1520-member-list-optimistic-updates
• task-1522-stop-using-pk-for-attachment-api
• task-1523-add-kpi-uid-field
• task-1524-data-attachment-delete-endpoint
• task-1525-new-attachment-trash-model
• task-1525-refactor-trash-models
• task-1526-create-attachment-celery-tasks
• task-1526-refactor-trash-bin-celery-tasks
• task-1529-delete-status-attachment-model
• task-1533-add-AbstractTimeStampedModel
• task-1534-backfill-attachment-model
• task-1540-fix-trash-bin
• task-1546-update-admin-model-to-support-attachments-in-trash-bin
• task-1547-block-org-invitations-for-existing-members
• task-1581-implement-account-inactive-query
• task-1587-fail-tasks-that-have-been-enqueued-too-long
• task-1590-fix-members-endpoint-to-remove-invite-details-for-removed-users
• task-1600-fix-wrong-org-invitation-assignment
• task-1605-add-org-plan-in-org-view
• task-1612-store-counters-for-over-limit-users
• task-1633-add-limits-to-service-usage-calculator
• task-1634-add-balances-to-service-usage-api
• task-1638-adjust-pending-transfer-block-handling
• task-1652-fix-validation-error-on-redeploy
• task-1680-KpiUidField-remove-null=true
• task-1681-use-AttachmentTimeStampedModel
• task-1690-celery-task-for-creating-daily-user-lists
• task-1691-add-emails-to-daily-send
• task-1692-celery-task-for-sending-emails
• task-1702-improve-default-free-plan-selection
• task-1712-use-default-plan-name
• task-1717-remove-deprecated-celery-task-from-database
• task-1724-api-documentation-access-logs
• task-1724-api-documentation-asset-snapshots
• task-1724-api-documentation-asset-subscriptions
• task-1724-api-documentation-asset-usage
• task-1724-api-documentation-code-reformat
• task-1724-api-documentation-preparation
• task-1724-api-documentation-renderer-class
• task-1724-api-documentation-updated-tags
• task-1724-api-documentation-url-types
• task-1724-api-documentation-url-util
• task-1724-response-util-reformat
• task-1732-test_endpoint_for_sending_emails
• task-1758-fix-blocking-migrations
• task-1764-atomicity-of-submissions
• task-1765-long-running-migration-system-check
• task-1768-fix-member-permissions
• task-1773-backfill-mongo-too
• task-1773-bug-fix-old-attachments
• task-1786-add-tests-for-moving-attachments-to-from-trash
• task-1794-api-documentation-assets
• task-1794-content-negotiation
• task-1796-asset-data
• task-1797-api-documentation-attachments
• task-1798-api-documentation-exports-settings
• task-1826-refactor-move_to_trash-to-include-status-toggle
• task-1827-standardize_usage_naming
• task-1833-add-org-service-usage-tests
• task-1836-fix-plan-name-test
• task-1839-refactor-validation-errors
• task-581-update-mongo-documents-to-expose-attachment-deleted-flag
• task-588-new-attachment-delete-endpoint
• task-679-update-mass-email-models
• task-859-uncomment-logout-all
• task-927-add-xform-and-user-fields
• task-969-create-endpoints-to-handle-org-invitations
• temporarily-skip-plan-cancellation-test
• tessa/dev-1813
• tessa/dev-362
• throttle-celery-beat-updates
• transfer-org-ownership-from-admin-ui
• update-constance-to-use-env-vars
• update-django-to-4.2.24
• update-formpack
• update-formpack-to-handle-deleted-attachments
• update-in-app-message-for-project-transfer-to-org
• update-in-app-message-for-project-transfer-to-org-2.025.02
• update-minor-patch-python-deps
• update-org-invitation-url
• update_clean_duplicated_submissions_management_command
• use-delete-all-permissions-endpoint-on-frontend
• use-deserialized-joins
• use-html-renderer
• use-html-renderer__change-wording
• whoosh-improvements

Build # 28865799815

Build Type

push

github

Committed by web-flow

Commit Message

fix(submissions): reject submissions with invalid xml character DEV-1129 (#6385)

### 📣 Summary
Reject form submissions containing invalid or invisible XML characters,
to prevent data corruption when responses are later viewed or edited.


### 📖 Description
Some clients can submit XML content containing characters outside the
range permitted by the XML standard (invisible control characters,
unpaired surrogates, etc.). These submissions could previously be stored
as-is, only to later fail when opened or edited in Enketo, risking data
loss or broken records.

This adds server-side validation (validate_xml_chars) that rejects such
submissions upfront with a clear 400 error message, instead of letting
them silently corrupt data down the line. Only characters permitted by
the XML standard are accepted.

This validation is kept as a safety net for any client (not just Enketo)
that might still submit disallowed characters, now that Enketo itself
has been fixed to strip them before submission.

Coverage Stats

9263 of 12603 branches covered (73.5%)

11 of 11 new or added lines in 2 files covered. (100.0%)

30221 of 37111 relevant lines covered (81.43%)

5.52 hits per line