CKAN 2.11.7

Migration notes

• This version requires a requirements upgrade on source installations. The packages nh3 and pglast have been added as requirements, and sqlparse has been dropped.
• Resource Views can no longer be previewed in the resource view form unless they don’t provide their own iframe in the view template. This only applies to views with the iframed: True setting.

Minor changes

• HTML cleaning is done with nh3 instead of bleach from now on. More tags and attributes are allowed by default and clean_html now strips unknown tags instead of escaping HTML-entities. render_markdown with allow_html=False now strips script and style tags alongside with their content; previously, only the tag was removed, while content was kept. (#9472 <https://github.com/ckan/ckan/pull/9472>_)
• Use pglast instead of sqlparse to sanitize datastore_search_sql input (#9475 <https://github.com/ckan/ckan/pull/9475>_)

Bugfixes

• GHSA-wg5m-39wv-h9q4 (CVE pending) <https://github.com/ckan/ckan/security/advisories/GHSA-wg5m-39wv-h9q4>_: Stored XSS vector via field name in DataTables view
• GHSA-gc3w-w5vv-w2vc (CVE pending) <https://github.com/ckan/ckan/security/advisories/GHSA-gc3w-w5vv-w2vc>_: member_list discloses IDs of private datasets to unauthenticated user
• GHSA-xj2r-hpg6-375c (CVE pending) <https://github.com/ckan/ckan/security/advisories/GHSA-xj2r-hpg6-375c>_: Exposure of private dataset identifiers via Solr parameters
• GHSA-hr6p-cwrr-4gg2 (CVE pending) <https://github.com/ckan/ckan/security/advisories/GHSA-hr6p-cwrr-4gg2>_: resource_view_update permission check bypass
• GHSA-3h7g-fpc6-9vc9 (CVE pending) <https://github.com/ckan/ckan/security/advisories/GHSA-3h7g-fpc6-9vc9>_: Forgeable user/login
• GHSA-34rr-qrr4-397f (CVE pending) <https://github.com/ckan/ckan/security/advisories/GHSA-34rr-qrr4-397f>_: Unauthenticated SQL injection in datastore_search
• CVE-2026-115579 <https://github.com/ckan/ckan/security/advisories/GHSA-5f35-225m-5mg7>_: Unauthenticated reflected XSS via webpage_view
• Resource view activities have the same permission labels as the corresponding dataset. (#9611 <https://github.com/ckan/ckan/pull/9611>_)
• Skip the Data Explorer view when there are field errors, instead of breaking the whole resource view page (#9529 <https://github.com/ckan/ckan/pull/9529>_)
• Add an index on tracking_summary (package_id, tracking_date) (#9538 <https://github.com/ckan/ckan/pull/9538>_)
• Fix dataset_purge failing with an IntegrityError for datasets that have collaborators. (#9576 <https://github.com/ckan/ckan/pull/9576>_)
• Fix datastore_upsert method=insert (and datastore_create) records_row error value. Used to always report last row regardless of which record contained the error. (#9587 <https://github.com/ckan/ckan/pull/9587>_)