# Connexio Oxygen release notes ## Unreleased ### Added - **API** Users can save a high-contrast mode (`contrast-mode`: `normal` or `high`) and a text size (`text-size`: `100`, `125`, `150` or `200`) as their own preferences (ADR-0071). ### Changed - **API** The colour mode, contrast mode, text size, dyslexia-friendly font, email notification and language preferences only accept the values the SPA understands. Any other value is refused, whether it is saved by key or through the profile, and the profile now stores preference keys in the same kebab case as the preference endpoint. - **API** A glossary search lists exact name matches first, then partial name matches, then synonym matches, then tag matches. Each result says what it matched on, so a term that was found is always labelled as a name, synonym or tag match. ## 2026-10-23 · API 6.0.362 ### Added - **API** Media files can be stored in S3-compatible object storage instead of on the file system. No environment uses it yet. - **API** Client endpoints for the glossary: the glossary cards and the tag list that drives the glossary page (ADR-0068). - **API** A client endpoint that reads a custom content widget's content (ADR-0080). - **API** Release notes for the API and the SPA, served at `/release-notes.md` as a filterable, searchable timeline. The landing page, the error pages and the release notes share one look, with a light, dark and automatic theme. ### Changed - **API** The testing endpoints that wipe the database (`api/v1/bootstrap`, `api/v1/import` and `api/v1/reseed`) are off by default and answer 404. An environment switches each one on with `Testing:Bootstrap:Enabled`, `Testing:Import:Enabled` or `Testing:Reseed:Enabled`. Even when switched on, they refuse a browser prefetch or prerender with a 422. - **API** The tags on a glossary mark are hydrated with the same status range as its meaning, term and synonyms, so an administrative read shows draft tags and a member's read does not. - **API** Scalar and the OpenAPI documents are served only where `Documentation:Enabled` is on. It is on by default in Development and off everywhere else. Outside a developer's own machine, Scalar shows a token field and every call needs a real access token. - **API** The automatic Administrator sign-in for local exploration applies only to requests from the developer's own machine. - **API** The testing endpoints answer only on a developer's own machine, except `api/v1/ping` and `api/v1/httpcode`. `api/v1/downloadlogfiles` needs an Administrator, and `api/v1/token` is removed. - **API** Only the files in `wwwroot` are served as static files. - **API** Error responses leave out exception details unless `ExceptionDetail` is switched on. - **API** A validation problem response lists only the property name, message and error code of each failure, no longer the submitted value. - **API** The API logs at Info by default instead of Trace. ### Fixed - **API** A browser request that ended in an error status, such as an anonymous visit to the Hangfire dashboard, got a 500 on Linux hosts instead of that status. ### Maintenance - **API** Updated Scalar to 2.18.2 and removed the last compile exclusions from the solution. - **API** `appsettings.json` lists every configuration key the API reads, with `null` for secrets and for values that differ per environment. ## 2026-10-19 · API 6.0.343 ### Added - **API** The glossary: terms, synonyms, meanings and their tags (ADR-0068). - **API + SPA** Fragment bodies are expanded when content is read, instead of being copied into every place a fragment is embedded (ADR-0063). - **API + SPA** Content references in rich text (links, tiles, media, fragments and decision trees) are hydrated when content is read and stripped back to plain IDs when it is saved. Renamed or moved items no longer leave stale titles and URLs behind (ADR-0060). - **API** A Content widget type with its own rich-text content, and the admin endpoint the widget form loads it from (ADR-0080). - **API + SPA** An accreditation widget, an accreditation counts endpoint, and an accreditation summary strip with filters, a doughnut chart and a phone layout on the accreditation page (ADR-0070). - **API** Admin content inventory endpoints (ADR-0062). - **API** The tenant context returns an optional Environment, so the SPA can show which environment it runs in. - **API** Each setting's minimum and maximum are returned on the settings overview. Day-based settings are bounded to 0–3650 and refused on save when out of range. - **API** The accreditation overview returns the tenant's warning window as WarningDays. - **API** Client endpoints to read an asset's schematic and a decision tree. - **API** Thumbnails and mime types on widget rows. - **API** The admin roots and children report each item's rank, so a client can rerank relative to a sibling. - **API** NLV files can be downloaded by their GUID. - **API** Every entity table has a database-maintained RowVersion. - **API** The database can be populated by bootstrap, reseed or import. - **SPA** Replacing a departing user from the users page, with a matching authentication audit action (ADR-0055). - **SPA** Users and Pending tabs with approve and deny actions for self-registered users. - **SPA** Move and Mirror actions on the asset tree, with a destination browser. - **SPA** An Order children dialog for the asset tree (ADR-0050). - **SPA** The NLV Manager admin page: upload, publish, delete, download and document history (ADR-0044). - **SPA** Notification acknowledgement: a Require acknowledgement field with a mandatory link, a Distributed badge, a role picker for the audience, and unread counts on the admin bell (ADR-0053). - **SPA** A tenant contact information page, its settings panel, and a contact link in the feedback dialog (ADR-0058). - **SPA** Lifecycle moves in the rolodex actions menu that follow the item's status. Fragments set their status per version from the editor header. - **SPA** Print layouts for help, assets, media, the profile page and the accreditation page. - **SPA** Editor: a heading menu (H2–H6), a fixed text colour palette, table cell colours, grid cell borders, numbered list styles with indent shortcuts, block titles, and Tab navigation through blocks. - **SPA** A copy-link button on links, favourites and notifications. Copying a notification's link also acknowledges it. - **SPA** Create new Process and Visio import in the asset root menu. - **SPA** A real-time connection to the API that reconnects when the tab becomes visible again (ADR-0051). - **SPA** A collapse/expand control on client pages with rich-text content. - **SPA** AVIF and BMP image uploads. ### Changed - **API + SPA** `AbsoluteUrl` is renamed to `MediaUrl`. The media address is split into a stored location and an external URL, and the stored location never appears in rolodex rows or in the SPA. - **API** Every date-time in a response is written as UTC with a `Z`, so browsers no longer show times one or two hours early or a picked date as the day before. - **API** A known user without access gets a 403 with a `User.NoAccess` or `User.PendingApproval` problem code on sign-in, Active Directory sign-in and token refresh. - **API** Comments can only be edited or deleted by their author or a manager, only managers mark comments as seen, and a reply stays on the same item as the comment it answers (ADR-0083). - **API** Users see only their own and the system favourite collections. System favourites are read-only on the client (ADR-0084). - **API** Access groups are enforced on asset writes. - **API** A group change can no longer hide features from the person making it, and users can no longer change their own role or status. Admin-created users are invited to choose their own password, and the e-mail address stays equal to the username outside Active Directory. - **API** Client rolodexes return only published items, and members never see a meaning or synonym of an unpublished term. - **API** Emails sent by a signed-in user (account invitation, registration approval) link to the tenant's front end. - **API** Version operations work only through the version's own asset or fragment, and version responses identify the version. Seeded asset version IDs start at 100001, so they never coincide with asset IDs. - **API** The link audit is kept current from the save pipeline, and references to trashed or deleted items are reported as broken. - **API** An uploaded file keeps its URL when a request leaves it out, and an external item requires a URL. - **API** Every member can send feedback, not only contributors and above. - **API** Tag names are trimmed and matched case-insensitively, so a padded or differently cased label reuses its tag. - **API** Unhandled exceptions are logged and reported, abandoned requests are recorded as 499, and Redis failures are bounded. - **API** Synchronous saves are rejected, so the save pipeline cannot be bypassed. - **SPA** Text fields are capped at the same maximum lengths as the API validators. - **SPA** Drag-and-drop on the asset tree is replaced by the Move, Mirror and Order children actions. - **SPA** Managers can mark notifications as seen. Restyled the notification popovers. - **SPA** The group form hides the Active Directory name on tenants that do not use Active Directory. - **SPA** Tenant colours get a computed text colour for dark mode, and headings, titles and icons use high-contrast text. ### Fixed - **API** Asset and fragment version bugs, and the response metadata of several endpoints. - **API** Single sign-on. - **API** An asset's relations are deleted with the asset. - **API** Retry and concurrency settings on background jobs were ignored. - **API** The password reset request returned the reset token. - **API** The anonymous diagnostics endpoint showed connection details. - **API** Security gaps found by the new endpoint test suite. - **SPA** The version menu showed "v null" for versions without a number. - **SPA** Restoring an asset or fragment version left the status on Trashed. - **SPA** Typing in one form field re-rendered every other field. - **SPA** The save bar's fade covered the last lines of a form. - **SPA** Tab jumped to the first accordion in the editor, and a late content echo could drop a keystroke. - **SPA** Links with unsafe schemes could be followed in read-only mode. - **SPA** Library viewers showed a blank viewer for items without a file. - **SPA** The accreditation list used a different expiry window than the overview. - **SPA** The contacts list opened with a sort order without a direction. - **SPA** Mirrored asset rows shared their selection and menu state. ### Maintenance - **API** Updated to the .NET 10.0.13 runtime libraries, FluentValidation, LinqKit, Scalar, NLog and xunit.v3, and removed unused packages. - **API** Renamed code, files and Caretaker steps to say what they do, and regenerated the tests so a schema change only rewrites its own entity's tests. ## 2026-09-13 · API 6.0.256 ### Added - **API + SPA** Active Directory sign-in. - **API + SPA** The Accreditor role (below Member), with its own detail-read endpoints for the six accreditable item types. In the SPA, accreditors only reach the accreditation pages. - **API + SPA** The accreditation overview (ADR-0047), with an Accredit flag on assets and contacts that can be changed after creation. - **API + SPA** The search index overview endpoint and report, and Status on the admin rolodexes (ADR-0054). - **API** Replacing a departing user with their successor (ADR-0055). - **API** Notification acknowledgement (ADR-0053). - **API + SPA** Multi-column dashboard widgets: a Width on every widget, shown in four sizes (S, M, L, XL). - **API + SPA** Image thumbnails, generated on save and shown in the media explorer and on client tiles (ADR-0064). - **API** Real-time page locking over SignalR and Redis, behind `RealTime:Enabled` (ADR-0034), and a real-time broadcaster in every service (ADR-0051). - **API** NLV, VTV and REF import from the toolbox, including Excel rich-text formatting (ADR-0044, ADR-0059). - **API** A generic sourced-asset import engine for legislation (ADR-0042). - **API** Per-job duration tracking, a tighter nightly maintenance schedule, and a settings catalog with an admin overview endpoint (ADR-0043). - **API** An author-controlled rank orders the asset tree (ADR-0050). - **API** The admin asset endpoints and roots can be filtered by status. - **API** A contact information setting for the tenant contact page (ADR-0058). - **API** `--drop`, `--bootstrap` and `--seed` command-line options for database maintenance. - **API** Author on News responses, and the feedback rolodex can be sorted by submitter. - **SPA** The settings page renders the settings catalog by domain, with a Features section to switch features on and off. - **SPA** An admin dashboard with activity trends, a status breakdown and a search index row. - **SPA** A process page that shows its transactions next to the content, with the process model above them. Clicking a shape in the model opens its transaction. - **SPA** Visio imports stamp each transaction's ID onto the diagram. - **SPA** Users of a higher role than the signed-in user are shown as locked, and roles can only be assigned up to one's own. - **SPA** Toolbox apps receive the API's base URL. ### Changed - **API** Tokens are refused for users whose role is No access, and search requires the Member role. - **API** Changing an item's status clears a stale expiry or publication date (ADR-0056). - **API** Link-table rows and preferences are left out of the change audit. - **API** A user's own personal rows are exempt from the write role gate. - **API** Rich text is no longer HTML-sanitised automatically on save. - **API** Indexes on Status and Modified for every entity the nightly purge, discard and expiry jobs scan. - **SPA** Lists default to the grid view and show images instead of icons wherever an item has one. - **SPA** The client asset tree always starts collapsed, and summaries are truncated with a tooltip. - **SPA** Upgraded the news viewer. ### Fixed - **API** The groups claim was blanked on token refresh, and comment lists left out the comment body. - **API** Accredit dropped out of several asset projections. - **API** A duplicate endpoint name stopped the API from starting. Startup now refuses duplicate and missing endpoint names. - **API** HTML escaping touched the whole Latin-1 range instead of only the characters that need it. - **SPA** The cross-tab session broadcast could carry authentication tokens. - **SPA** The media and news forms sent group access in the wrong field. - **SPA** The asset editor's discard dialog did not appear when switching items in the tree. - **SPA** A favourite in a system collection could be dragged out of it. - **SPA** The asset and help sidebars collapsed together. ### Maintenance - **API** Updated the NuGet packages, moved the tests to xunit.v3 4, formatted the code with CSharpier, and the pipeline now runs the tests. The container runs as a non-root user. ## 2026-07-29 · API 6.0.173 ### Added - **API + SPA** Self-registration with admin approval, with registration emails and notifications, and the registration page in the SPA. - **API + SPA** Feedback: a feedback button on every client page, and an admin review page with notifications to the submitter. - **API + SPA** Schematics: a Visio diagram can be imported as an asset's model and viewed with pan and zoom. Schematics have their own admin pages. - **API + SPA** Tenant branding: colours, logo and authentication mode, applied to the sign-in page, the client and the admin side. - **API** Moving and mirroring assets, each in a single transaction. - **API** Hierarchical asset access: direct, ancestor and descendant. - **API** Gatekeeper and Caretaker rules for every entity, not only assets. - **API** Notifications and their distribution to users. - **API** Zone layouts. - **API** A tenant context endpoint for the sign-in page. - **API** A knowledge fragment's body is propagated into every place it is embedded. - **API** Search results carry a category, so they can be grouped into tabs. - **API** Authentication audits record the client IP address. - **API** The features tree is filtered by minimum role, not only by group access (ADR-0036). The tenants group and the settings feature are for administrators only. - **API** Media URLs are always relative, with a resolved absolute URL alongside. - **SPA** A Visio import wizard that creates the process's assets from the diagram. - **SPA** Asset status lifecycle controls in the editor, with a show-deleted toggle and root creation in the asset tree. - **SPA** A redesigned client asset area: grids, grouped views with expand and collapse all, and compact hover cards. - **SPA** Search with breadcrumbs under the results and routing into assets. - **SPA** User, group and notification forms pick members with an assignment picker. - **SPA** Unsaved-changes and validation indicators on every admin form's save bar. - **SPA** Language, theme and font follow the user's saved preferences. - **SPA** `/health.json` and a generated `/version.json`. ### Changed - **API** Asset lists and rolodexes are faster: no content in list responses, a HasChildren flag instead of a child count, and split queries. - **API** Asset status business rules are enforced. - **API** Link-table rows are hard-deleted and have no revisions. System entities no longer keep revisions. - **API** Asset paths replace the asset closure table. - **API** Index invalidation cascades to descendant assets. - **API** The Hangfire and Scalar pages need authorisation, and the content security policy is set per environment. - **API** Outbound email layout and the tenant logo are stored on the tenant. - **API** Caretaker audit actions are grouped into five categories. - **SPA** Author and Editor roles can reach the admin pages. ### Fixed - **API** The indexer kept marking committed entries as not indexed. - **API** Asset paths were never populated, and an incremental rebuild could delete valid paths of shared descendants. - **API** A trashed version could become the active version and block reactivation. - **API** Notification distribution silently untracked the caller's entity. - **API** Indexing created duplicate index entries. - **API** Upserting a preference read the stored row without tracking it. - **SPA** Cross-tab session sync caused reload loops and spurious sign-outs. - **SPA** The asset filter crashed on regex characters. - **SPA** The news page was blank until a filter was picked. ### Maintenance - **API** Patched a transitive AngleSharp vulnerability (GHSA-pgww-w46g-26qg) and applied pending NuGet updates. - **API** Added an HTML test report and scripts for running the tests. ## 2026-06-26 · API 6.0.67 ### Added - **API + SPA** Semantic search with OpenSearch, with a search audit, and a new search dialog in the SPA. - **API + SPA** Widgets on the client dashboard, with drag-and-drop ordering. - **API + SPA** Change, view and link audit reports, with graphs and generic filters. - **API + SPA** Video and audio streaming. Uploaded files are stored as `{id}~{filename}` so the streaming server can serve them from one directory. - **API** Pagination. - **API** Legislation ingest through the GKD gateway. - **API** The Caretaker link sync and link audit. - **API** Notifications with an audience, e-mail, batch processing and media delete. - **API** A Markdown viewer for `.md` files. - **API** Asset URLs include their breadcrumbs. - **API** A layout attribute on zones. - **SPA** Decision tree editor with a walkthrough preview, and decision trees embedded in rich text. - **SPA** A PDF viewer. - **SPA** Duplicate, archive, permanent delete and purge actions in the rolodex. - **SPA** A generated password field when creating a user. - **SPA** Expiry-date shortcuts on date pickers. - **SPA** Basic page-view tracking. ### Changed - **API** The maximum request body is 1.5 GB. - **API** Media data is never written to the logs, and `tenant` is dropped from media URLs. - **SPA** Client pages use the full screen width. - **SPA** The auth pages, editor, media explorer and asset tree are translated. ### Fixed - **API** Reading an asset with unpublished children reported the wrong child count. - **API** Deleting an asset version or a fragment version failed. - **API** The news URL in the news widget was wrong. - **SPA** The selected language did not survive a reload. ### Maintenance - **SPA** Updated to React 19, MUI 9, React Router 7, Zustand 5, date-fns 4 and i18next 26, and cleared all npm audit advisories. ## May 2026 · API 6.0.6–6.0.29 ### Added - **API + SPA** Rank-based ordering with a nightly rebalancing job, replacing Order. The SPA reranks assets, help topics, zones, widgets, apps and favourite collections by drag-and-drop. - **API** Cascading delete, restore and status change through the Gatekeeper. - **API** Asset rolodexes for all, most viewed, popular, recently changed and favourite assets, and an IsFavourite check. - **API** Department on the user profile. - **API** Forwarded headers for proxies, and updated version and diagnostics endpoints. - **API** Mime type in the media rolodexes. - **SPA** A redesigned library with a category tree filter, chips and a collection search bar. - **SPA** Tabbed help editor and asset editor with version handling. - **SPA** Hover cards on the asset and help trees. ### Changed - **API** Active Directory user and group synchronisation over LDAP, cross-platform. - **SPA** The sign-in page always uses the client theme. ### Fixed - **API** Creating and updating asset comments, and the update response of all comments. - **SPA** Duplicate API calls in the library, reports and asset tree. - **SPA** Token decoding broke on non-ASCII characters. ## April 2026 · API 6.0.5 ### Added - **API** Active Directory user check and group sync. - **API** Version numbers from git (Nerdbank.GitVersioning). - **SPA** Drag-and-drop for tabs in the editor, an accordion block, and conversion between tabs and accordions. ### Changed - **API** Favourites and favourite collections no longer have to be unique. ### Fixed - **SPA** Stale data and race conditions in the link editor's tabs. ### Maintenance - **API** Updated Newtonsoft.Json and MailKit for a reported vulnerability, and fixed a container security finding. ## March 2026 ### Added - **API + SPA** Favourites: personal and system favourite collections, renamed from bookmarks. - **API + SPA** Container images, Kubernetes deployments for development and testing, and Trivy and Sonar scans in the pipeline. - **SPA** A new link editor with tabs and previews for assets, media, contacts and text. - **SPA** Audio in the editor and the media explorer. - **SPA** Config-driven forms for every admin entity. - **SPA** Fragment versions with version-aware save. - **SPA** Redirect to the intended page after sign-in. ### Changed - **API** Generated files are saved as UTF-8 without a byte order mark, and file headers carry `NOSONAR`. ### Maintenance - **SPA** Resolved the Sonar code quality findings across the code base. ## February 2026 · API 6.0.26.0203–6.0.26.0226 ### Added - **SPA** Rolodex sidebar layout for media, users and groups, and group feature permissions. - **SPA** Notification targeting by groups and users. - **SPA** Forgot-password page. ### Changed - **SPA** Rich text is saved as Tiptap JSON instead of HTML. - **SPA** Fragments are embedded with their content, like templates. ## January 2026 · API 6.0.26.0107–6.0.26.0128 ### Added - **API** Search: an index entry queue, an OpenSearch indexer and EagleSearch. - **API** Bookmarks and bookmark collections as a tree, and apps by category. - **SPA** Bookmark manager with drag-and-drop between collections, bookmarking from any client page, and system collections. - **SPA** A new rolodex with category filters and infinite scroll, used for news, fragments and templates. - **SPA** Fragment editor with versions. ## 2025 · API 6.25.01.22–6.0.25.1230 ### Added - **API** Asset fragments with categories and versions, and asset template categories. - **API** API keys, file storage and a background job base. - **API** Apps and app categories, asset templates, bookmarks and domains. - **API** System, search, change and link audits. - **API** Audio as a media type, with categories, tags, comments, favourites and views. - **API** Reading and upserting a setting by key. - **API** An option to include children when fetching assets. - **API** Descriptions for the authentication endpoint properties. - **API** Preference endpoints for the signed-in user. - **API** Local, development, staging and production environments. - **API** Security headers. - **API** A reseed service. - **API** The Caretaker audit with graphs. - **API** Reorder endpoints for asset paths, asset relations, features, help topics, widgets and zones. - **API** Asset root, path and children responses include path, route and breadcrumbs. - **API** Asset roots and children, and version activation. - **API** Asset content and details as separate reads. - **API** Self-registration, the authentication audit and authentication event graphs. - **SPA** Asset templates and fragments, inserted from the editor toolbar. - **SPA** Knowledge assets: tree navigation, a move dialog and versioning. - **SPA** Apps on the client, and a toolbox button on small screens. - **SPA** User preferences stored through the API: theme, dyslexia-friendly font and widget layout. - **SPA** Unsaved-changes warnings on every form. - **SPA** The Oxygen SPA, built on Vite and React: JWT sign-in with token refresh and cross-tab session sync, routes generated from the feature tree, admin and client layouts, the rich-text editor, the media explorer, help, contacts, news and tenants. - **SPA** An OpenDyslexic font option, and light and dark themes. ### Changed - **API** Endpoints renamed verb-first (for example `GetAssetRoots`, `CreateAssetVersion`). - **API** `appsettings.json` is no longer tracked in git. ### Fixed - **API** Update returned the old data instead of the new. ### Maintenance - **API** Upgraded to .NET 10. - **API** Moved the tests from MSTest to xUnit v3. ## 2024 · API 6.0.alpha.8795–6.24.12.13 ### Added - **API** Contacts, decision trees, e-mail and notifications. - **API** Asset versions, and breadcrumbs for assets and document categories. - **API** Change password, password forgotten and reset password. - **API** Widgets with group access. - **API** Favourite, most viewed, popular and recently changed assets. - **API** API key authorisation and request logging, with arguments anonymised in the logs. - **API** Dark mode on the API's own pages, and log file downloads. - **API** The asset cluster: assets, access, comments, favourites, paths, relations, tags, versions and views. - **API** Revision history for every entity, and generated test data. - **API** News with summary, content and author, and library rolodexes in news. - **API** A taxonomy tree in the back end. - **API** Accreditation and the metacorder in the library. - **API** Exception handling and logging. ### Changed - **API** Rewritten for .NET 8, after a final .NET Framework 4.8 version. Every endpoint was completed, with a uniform operation result, input sanitisation and cascading delete. - **API** All date-times are returned as UTC. - **API** Categories are only Published and have no history. Deleting a category reconnects its children to its parent. - **API** Hidden documents are left out of the rolodexes. - **API** Upload size raised to 1 GB. - **API** Database calls are asynchronous. ## 2023 · API 6.0.8575–6.0.alpha.8739 ### Added - **API** Blob storage for documents, images and videos. - **API** Drop-down lists on the `GET /api//{id}` endpoints. - **API** Front-end endpoints for documents, images and videos: all, favourites, popular, recommended, most viewed and last changed, plus category trees and favourite toggles. - **API** Category titles on documents, images and videos. - **API** Authentication with HttpOnly cookies. - **API** Views are registered for documents, images and videos, with view counts and popularity in the rolodexes. - **API** Tags for documents, images and videos. - **API** Documents and document categories. - **API** Images, image categories, videos and video categories. - **API** A Statuses object on every rolodex and on the empty entity (`GET /api//0`), to populate status bars and drop-downs. - **API** A dynamic Data field on the rolodex, used to fetch only the users or groups with the given IDs. - **API** `GET /api/users/features` returns the ordered feature groups and features. - **API** Documents accept their file as a base64 string. - **API** Smoke and unit tests cover every entity, and mock data is generated. - **API** Endpoints to add users to groups and list a group's members and non-members. - **API** Full name and role name in the JWT. - **API** History tables. - **API** A status name on every status. - **API** First alpha release of the Connexio Oxygen API: users, groups, roles and statuses, with JWT authentication and refresh tokens. ### Changed - **API** Tags are added when creating or updating documents. - **API** Back-end endpoints moved from `api/v1` to `api/v1/backend`. Front-end endpoints live under `api/v1/frontend`. - **API** First and last name are required on users. - **API** All drop-down lists are key/value pairs, and category lists are sorted by title path and title. - **API** `Enabled` on library reads and rolodexes is renamed `IsFavourite`. - **API** Tenant, user, group, locale, feature group, feature, document, image and video fields renamed and extended (for example `User.ExpiryDate`, `Locale.Handle`, `Group.ActiveDirectoryName`). - **API** Only administrators see the Deleted status. ### Fixed - **API** Popular documents were not in order of popularity. - **API** CORS did not work on Azure. - **API** A group's description was not saved.