Skip to content

Releases: alan-turing-institute/data-safe-haven

Release list

Release 5.7.1 (2026-02-13)

Release 5.7.1 (2026-02-13) Latest
Latest

Choose a tag to compare

View all tags
@cptanalatriste cptanalatriste released this 13 Feb 15:19
v5.7.1
212a4b6

Release Highlights

  • It is now possible to upgrade from v5.6.0. See notes below.
  • Using the config file, you can now specify the size of the OS disk of the TRE's workspaces.
  • We now support the --run-program option during the deployment of TREs.

Upgrading from 5.6.0

For updating a TRE deployed with data-safe-heaven==5.6.0, please do the following:

  1. After installing data-safe-haven==5.7.1, re-deploy your TRE using dsh sre deploy your-v560-tre --run-program.
  2. The previous command might fail. In any case, redeploy but with the run-program option disabled, by running dsh sre deploy your-v560-tre.
  3. During this process, you will hit a SubnetInUse in use error. In that case, go to the Azure Portal and delete the container group shm-<YOUR-SHM>-sre-<YOUR-V560-TRE>-container-group-dns. After that, launch the deployment again.

IMPORTANT: As part of this update, the OS disk of every workspace will be replaced. Every modification done outside dsh (for example, installing packages using dshadmin) will be lost.

What's Changed

Full Changelog: v5.7.0...v5.7.1

Contributors

llewelld, cptanalatriste, and dependabot
Assets 2
Loading

Release 5.7.0 (2026-01-21)

Release 5.7.0 (2026-01-21)

Choose a tag to compare

View all tags
@cptanalatriste cptanalatriste released this 29 Jan 17:03
v5.7.0
b22a1d6

Release Highlights

  • The TRE's DNS Server is now a virtual machine instead of a container instance. With this change, we won't experience issues due to the container changing its IP.
  • The Nexus Repository database is now in PostgreSQL instead of H2, which is less prone to the data corruption issues reported before.
  • The TRE's now support adding data disks to the workspaces' VMs. Data disks offer better read/write performance than NFS file shares, specially in programming tasks.

Upgrading from 5.6.0

Please do not attempt to update a v5.6.0 SRE to v5.7.0! Our experience is that you will be forced to manually delete multiple SRE resources, and even after that the SRE might end up in an inconsistent state. Our recommendation is to create a new v5.7.0 SRE from scratch, and transfer all the necessary elements from the legacy v5.6.0 (data ingressed, users registered, user files from home, gitea repositories, etc).

What's Changed

  • ⬆️ Bump the production-dependencies group across 1 directory with 30 updates by @dependabot[bot] in #2484
  • Merge v5.6.0 into Develop by @cptanalatriste in #2492
  • Bump peter-evans/create-pull-request from 7.0.8 to 7.0.9 by @dependabot[bot] in #2503
  • Bump actions/checkout from 5 to 6 by @dependabot[bot] in #2504
  • ⬆️ Update Pulumi Docker images by @github-actions[bot] in #2498
  • Bump the production-dependencies group across 1 directory with 19 updates by @dependabot[bot] in #2506
  • Bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #2495
  • Bump stefanzweifel/git-auto-commit-action from 6.0.1 to 7.0.0 by @dependabot[bot] in #2494
  • Bump the development-dependencies group across 1 directory with 10 updates by @dependabot[bot] in #2505
  • Replacing the DNS Container Instance with a Virtual Machine by @cptanalatriste in #2500
  • ⬆️ Update Pulumi Docker images by @github-actions[bot] in #2517
  • Bump stefanzweifel/git-auto-commit-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #2512
  • Bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in #2513
  • Bump peter-evans/create-pull-request from 7.0.9 to 8.0.0 by @dependabot[bot] in #2514
  • Bump filelock from 3.20.0 to 3.20.1 in /.hatch by @dependabot[bot] in #2510
  • Bump the development-dependencies group with 10 updates by @dependabot[bot] in #2516
  • Bump the production-dependencies group with 7 updates by @dependabot[bot] in #2515
  • Use PostgreSQL with Nexus instead of In-Memory H2 by @cptanalatriste in #2509
  • Increasing the memory available to the DNS Server VM by @cptanalatriste in #2526
  • Bump azure-core from 1.37.0 to 1.38.0 by @dependabot[bot] in #2531
  • Add data disk support to workspaces by @cptanalatriste in #2532

Full Changelog: v5.6.0...v5.7.0

Contributors

cptanalatriste and dependabot
Loading

Release 5.6.0 (2025-10-30)

Release 5.6.0 (2025-10-30)

Choose a tag to compare

View all tags
@cptanalatriste cptanalatriste released this 30 Oct 20:26
v5.6.0
cdb9754
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Highlights

  • SREs with Tier 0/1 won't be deploying a Nexus proxy, and can download packages directly from the internet.
  • SREs now support mirroring external GitHub repositories into the internal Gitea repository accessible from workspaces.

Upgrading from 5.5.1

As part of the current release, we're offering users more control over the DNS sidecar deployment by exposing two new parameters in the SRE configuration: workload_minimum_count and workload_maximum_count. Before updating your SRE, make sure your YAML config file contains valid values for these parameters. For example:

user_services:
  dns_sidecar:
    cron_expression: "*/30 * * * *"
    replica_timeout: 600
    retry_limit: 0
    workload_minimum_count: 1
    workload_maximum_count: 2

Upload your new configuration file using dsh config upload, and then run the following command to upgrade an existing SRE:

dsh deploy sre YOURSRENAME

What's Changed

Full Changelog: v5.5.1...v5.6.0

Contributors

cptanalatriste, jemrobinson, and 2 other contributors
Loading

Release 5.5.1 (2025-09-04)

Release 5.5.1 (2025-09-04)

Choose a tag to compare

View all tags
@cptanalatriste cptanalatriste released this 04 Sep 15:38
v5.5.1
380dcb8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Highlights

  • Fixes the clamav-clamonacc unit file configuration, so it doesn't interrupt Ansible from configuring SRE workspaces properly.

What's Changed

  • Hotfix: Using the correct socket on the unit file for clamav-clamonacc by @cptanalatriste in #2476

Upgrading from 5.5.0

Run the following command to upgrade an existing SRE:

dsh deploy sre YOURSRENAME

You might need to re-run cloud-init manually in your workspaces for the new configuration to take place.

Full Changelog: v5.5.0...v5.5.1

Contributors

cptanalatriste
Loading

Release 5.5.0 (2025-07-18)

Release 5.5.0 (2025-07-18)

Choose a tag to compare

View all tags
@cptanalatriste cptanalatriste released this 18 Jul 13:41
v5.5.0
9257214

Release Highlights

  • SRE users have now write privileges on /mnt/scratch, when using SRDs that support temporary storage.
  • It is now possible to set up the size of Nexus persistent directory in the configuration file. And the default value has been increased from 2Gb to 10Gb.
  • User services, like Gitea and HedgeDoc, sometimes change their IP address on restart, which makes them unavailable due to DNS issues. We have now a Container App Job that monitors this problem and fix it when happens.
  • Documentation updates on clipboard control limitations and data egress instructions.

Upgrading from 5.4.1

Run the following command to upgrade an existing SRE:

dsh deploy sre YOURSRENAME

Changing the size of Nexus' persistent directory and running a Job for fixing container DNS will likely have an impact on the cost of running an SRE. Please use the configuration file to ensure your costs are within your budget.

What's Changed

New Contributors

Full Changelog: v5.4.1...v5.5.0

Contributors

llewelld, cptanalatriste, and dependabot
Loading

Release 5.4.1 (2025-04-01)

Release 5.4.1 (2025-04-01)

Choose a tag to compare

View all tags
@cptanalatriste cptanalatriste released this 07 Apr 10:23
v5.4.1
a800151
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Highlights

  • Fixed a josepy related issue preventing DSH installation.
  • Fixed missing persistent storage for Gitea to prevent failure after container restart.

Upgrading from 5.4.1

Please back up your Gitea codebase before updating the SRE. Our testing shows that repositories created before this update won't be repaired, so you will need to re-create them once the update is completed.

Once the backup is finished, run the following command to upgrade an existing SRE.

dsh deploy sre YOURSRENAME

What's Changed

Full Changelog: v5.4.0...v5.4.1

Contributors

cptanalatriste and JimMadge
Loading

Release v5.4.0 (2025-03-03)

Release v5.4.0 (2025-03-03)

Choose a tag to compare

View all tags
@craddm craddm released this 03 Mar 14:37
v5.4.0
4e5e077
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Highlights

  • Adds the dsh allowlist family of commands to allow easy manipulation of the package allowlists that limit access to packages on SREs where only pre-approved packages can be downloaded from CRAN/PyPi.
  • Updates nexus-allowlist to handle changes to the Nexus Sonatype Repository initialization process

Upgrading from 5.3.1

Run the following command to upgrade an existing SRE

dsh deploy sre YOURSRENAME

Note that due to changes in the way the package allowlists are managed, new SREs will have no allowlist, and upgrading may remove existing allowlists. Administrators will need to manually update the allowlist as required.

What's Changed

Full Changelog: v5.3.1...v5.4.0

Contributors

jemrobinson, craddm, and 2 other contributors
Loading

Release 5.3.1 (2025-01-28)

Release 5.3.1 (2025-01-28)

Choose a tag to compare

View all tags
@jemrobinson jemrobinson released this 28 Jan 12:19
v5.3.1
4a237a9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Highlights

  • Fixes issue with expiring SSL certificate
  • Updates Nexus image to fix an initialisation problem

Upgrading from 5.3.0

Run the following command to upgrade an existing SRE

dsh deploy sre YOURSRENAME

What's Changed

Full Changelog: v5.3.0...v5.3.1

Contributors

jemrobinson
Loading

Release 5.3.0 (2025-01-20)

Release 5.3.0 (2025-01-20)

Choose a tag to compare

View all tags
@JimMadge JimMadge released this 20 Jan 14:20
v5.3.0
de563f8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Highlights

  • Adds/fixes support for Tier 0 and Tier 1 SREs
  • Adds a reference section for the command line interface to the documentation

Upgrading from 5.2.1

Run the following command to upgrade an existing SRE

dsh deploy sre YOURSRENAME

What's Changed

Full Changelog: v5.2.1...v5.3.0

Contributors

cptanalatriste, jemrobinson, and 3 other contributors
Loading

Release 5.2.1 (2025-01-13)

Release 5.2.1 (2025-01-13)

Choose a tag to compare

View all tags
@jemrobinson jemrobinson released this 13 Jan 11:57
v5.2.1
bf91ec0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Highlights

  • Fixes guacamole-user-sync crash which was limiting SREs to a maximum of 10 users
  • Fixes problem with listing users when SRE and SHM are deployed to different subscriptions

Upgrading from 5.2.0

Run the following command to upgrade an existing SRE

dsh deploy sre YOURSRENAME

What's Changed

  • Guacamole user synchronisation problems by @jemrobinson in #2352
  • Retrieve SRE sub name and use that when connecting to guac database by @craddm in #2354

Full Changelog: v5.2.0...v5.2.1

Contributors

jemrobinson and craddm
Loading