v5.57.0

v5.57.0 - 2026-06-25

Changed

• Harden the production container images. Closes #13477. Changes made:
  • Run all containers in both the Docker-composition and the Helm chart with a read-only root filesystem (except the development-only LDAP and Mongo Express containers in the Docker-composition), with mounts for the locations the components write to, such as /tmp.
  • Collector and notifier now write the health check file to /tmp. The HEALTH_CHECK_FILE environment variable can still be used to configure a different location if needed.
  • Add liveness probes (all components) and readiness probes (all components that serve traffic) to the Helm chart, mirroring the Docker health checks.
  • Remove the shell, package manager, and Python installer and developer tools from the production Python container images to reduce their attack surface. As a result, the running container no longer has a shell, so opening a shell in it (for example with docker exec or kubectl exec) is no longer possible.
  • Remove the package manager from the frontend and proxy container images to reduce their attack surface.
  • Remove npm and the package manager from the renderer container image to reduce its attack surface.
  • Run the renderer container as a non-login system user, consistent with the other components.
  • Remove the unused MongoDB database tools (mongodump, mongorestore, mongoexport, mongostat, and so on) from the database container image to reduce its attack surface. Backups continue to work as documented, using a separate Mongo container.
  • Use the default non-root mongodb user (UID 999) so that gosu can be removed from the database container image to reduce its attack surface. The database image also supports running as a UID >= 1000 or an arbitrary UID (for example on OpenShift); see the "Customizing" section in the Helm chart README.

Fixed

• When using GitLab as source for the 'failed jobs' metric, instead of asking GitLab for only failed jobs, fetch all jobs within the look-back period and then filter them for status so that jobs that first fail and then pass are not reported as failed. Fixes #13478.
• Show the singular version of the metric unit when the measurement value is one. Note: when multiple dates are shown, the plural version of the unit is used regardless of the measurement values. Fixes #13479.
• When using Dependency-Track as source for the 'security warnings' metric, don't fail when a vulnerability has no description or severity. Fixes #13608.
• Truncate long titles on the dashboard cards with an ellipsis. The full title is shown in a tooltip on hover. Fixes #10841.

v5.57.0-rc.0

v5.56.0 - 2026-06-11

Added

• Add an "Export as CSV" button to the report header to export the report to a CSV file, mirroring the report as currently displayed (sort order, visible columns, hidden tags, and date(s)). Closes #13324.

Changed

• Rename the "Export report" button in the report header to "Export as JSON", to distinguish it from the new "Export as CSV" button. Closes #13324.

v5.56.0

v5.56.0 - 2026-06-11

Added

• Add an "Export as CSV" button to the report header to export the report to a CSV file, mirroring the report as currently displayed (sort order, visible columns, hidden tags, and date(s)). Closes #13324.

Changed

• Rename the "Export report" button in the report header to "Export as JSON", to distinguish it from the new "Export as CSV" button. Closes #13324.

v5.56.0-rc.0

v5.55.1 - 2026-06-04

Fixed

• Rename the merge requests parameter "Minimum number of upvotes" to "Required number of upvotes" to make the purpose of the parameter clearer. Fixes #13016.
• If an LDAP server does not return the user password attribute when Quality-time tries to authenticate a user, attempt an LDAP bind instead of throwing an exception. Fixes #13305.

v5.55.1

v5.55.1 - 2026-06-04

Fixed

• Rename the merge requests parameter "Minimum number of upvotes" to "Required number of upvotes" to make the purpose of the parameter clearer. Fixes #13016.
• If an LDAP server does not return the user password attribute when Quality-time tries to authenticate a user, attempt an LDAP bind instead of throwing an exception. Fixes #13305.

v5.55.1-rc.1

v5.55.0 - 2026-05-21

Added

• Show the configured date below the source name in the metrics table for calendar date sources, so the date is visible when the metric is collapsed. Closes #11143.
• When measuring outdated dependencies with pip as source, allow for filtering major, minor, or patch updates. Closes #12979.
• When using Grafana k6 summary.json as source for the 'source version' metric, also accept the snake case k6_version key as written by k6 v1.7.x, in addition to the camel case k6Version key specified by the schema. Closes #13243.
• When using Grafana k6 summary.json as source for the 'source up-to-dateness' metric, also accept the snake case generated_at key as written by k6 v1.7.x, in addition to the camel case generatedAt key specified by the schema. Closes #13276.

Removed

• Remove the feature to mass edit source parameters of sources with the same type in a metric, in a subject, or in all reports. This prepares for the introduction of source locations as objects separate from sources. Source location parameters (URLs and credentials) can still be changed for sources with the same type in a report via the "Sources" tab in the report title. Closes #13153.
• Removed the "v"-prefix from the Helm chart version number to comply with SemVerV2 enforced by the Helm linter. Closes #13246.

Fixed

• The documentation on importing reports was claiming that a report with credentials can only be re-imported into the same Quality-time instance. This is no longer true since v5.52.0. Fixes #13080.
• When a metric had multiple sources where one source was created by copying another, the copied source's entity user data (such as suppressed violation statuses) was overwritten with the original source's user data on every measurement, causing suppressed violations to revert to "unconfirmed". Fixes #13275.

Deprecated

• Support for Pyupio Safety as source for metrics is deprecated and marked for removal in the future, because Quality-time only supports v1 of the Safety JSON output and upgrading to v3 is blocked. Closes #13077.

v5.55.1-rc.0

v5.55.0 - 2026-05-21

Added

• Show the configured date below the source name in the metrics table for calendar date sources, so the date is visible when the metric is collapsed. Closes #11143.
• When measuring outdated dependencies with pip as source, allow for filtering major, minor, or patch updates. Closes #12979.
• When using Grafana k6 summary.json as source for the 'source version' metric, also accept the snake case k6_version key as written by k6 v1.7.x, in addition to the camel case k6Version key specified by the schema. Closes #13243.
• When using Grafana k6 summary.json as source for the 'source up-to-dateness' metric, also accept the snake case generated_at key as written by k6 v1.7.x, in addition to the camel case generatedAt key specified by the schema. Closes #13276.

Removed

• Remove the feature to mass edit source parameters of sources with the same type in a metric, in a subject, or in all reports. This prepares for the introduction of source locations as objects separate from sources. Source location parameters (URLs and credentials) can still be changed for sources with the same type in a report via the "Sources" tab in the report title. Closes #13153.
• Removed the "v"-prefix from the Helm chart version number to comply with SemVerV2 enforced by the Helm linter. Closes #13246.

Fixed

• The documentation on importing reports was claiming that a report with credentials can only be re-imported into the same Quality-time instance. This is no longer true since v5.52.0. Fixes #13080.
• When a metric had multiple sources where one source was created by copying another, the copied source's entity user data (such as suppressed violation statuses) was overwritten with the original source's user data on every measurement, causing suppressed violations to revert to "unconfirmed". Fixes #13275.

Deprecated

• Support for Pyupio Safety as source for metrics is deprecated and marked for removal in the future, because Quality-time only supports v1 of the Safety JSON output and upgrading to v3 is blocked. Closes #13077.

v5.55.0

v5.55.0 - 2026-05-21

Added

• Show the configured date below the source name in the metrics table for calendar date sources, so the date is visible when the metric is collapsed. Closes #11143.
• When measuring outdated dependencies with pip as source, allow for filtering major, minor, or patch updates. Closes #12979.
• When using Grafana k6 summary.json as source for the 'source version' metric, also accept the snake case k6_version key as written by k6 v1.7.x, in addition to the camel case k6Version key specified by the schema. Closes #13243.
• When using Grafana k6 summary.json as source for the 'source up-to-dateness' metric, also accept the snake case generated_at key as written by k6 v1.7.x, in addition to the camel case generatedAt key specified by the schema. Closes #13276.

Removed

• Remove the feature to mass edit source parameters of sources with the same type in a metric, in a subject, or in all reports. This prepares for the introduction of source locations as objects separate from sources. Source location parameters (URLs and credentials) can still be changed for sources with the same type in a report via the "Sources" tab in the report title. Closes #13153.
• Removed the "v"-prefix from the Helm chart version number to comply with SemVerV2 enforced by the Helm linter. Closes #13246.

Fixed

• The documentation on importing reports was claiming that a report with credentials can only be re-imported into the same Quality-time instance. This is no longer true since v5.52.0. Fixes #13080.
• When a metric had multiple sources where one source was created by copying another, the copied source's entity user data (such as suppressed violation statuses) was overwritten with the original source's user data on every measurement, causing suppressed violations to revert to "unconfirmed". Fixes #13275.

Deprecated

• Support for Pyupio Safety as source for metrics is deprecated and marked for removal in the future, because Quality-time only supports v1 of the Safety JSON output and upgrading to v3 is blocked. Closes #13077.

v5.55.0-rc.0

v5.54.0 - 2026-05-01

Added

• Clicking columns in the metric table expands the metric details, if not yet expanded, and activates the tab most closely corresponding to the column clicked. Once the metric is expanded, clicking columns has no effect. Closes #4172.

v5.54.0

v5.54.0 - 2026-05-01

Added

• Clicking columns in the metric table expands the metric details, if not yet expanded, and activates the tab most closely corresponding to the column clicked. Once the metric is expanded, clicking columns has no effect. Closes #4172.