CKAN 2.12.1

Migration notes

• This version requires a requirements upgrade on source installations
• Resource Views can no longer be previewed in the resource view form unless they don’t provide their own iframe in the view template. This only applies to views with the iframed: True setting.

Bugfixes

• GHSA-wg5m-39wv-h9q4 (CVE pending) <https://github.com/ckan/ckan/security/advisories/GHSA-wg5m-39wv-h9q4>_: Stored XSS vector via field name in DataTables view
• GHSA-gc3w-w5vv-w2vc (CVE pending) <https://github.com/ckan/ckan/security/advisories/GHSA-gc3w-w5vv-w2vc>_: member_list discloses IDs of private datasets to unauthenticated user
• GHSA-xj2r-hpg6-375c (CVE pending) <https://github.com/ckan/ckan/security/advisories/GHSA-xj2r-hpg6-375c>_: Exposure of private dataset identifiers via Solr parameters
• GHSA-hr6p-cwrr-4gg2 (CVE pending) <https://github.com/ckan/ckan/security/advisories/GHSA-hr6p-cwrr-4gg2>_: resource_view_update permission check bypass
• GHSA-3h7g-fpc6-9vc9 (CVE pending) <https://github.com/ckan/ckan/security/advisories/GHSA-3h7g-fpc6-9vc9>_: Forgeable user/login
• GHSA-34rr-qrr4-397f (CVE pending) <https://github.com/ckan/ckan/security/advisories/GHSA-34rr-qrr4-397f>_: Unauthenticated SQL injection in datastore_search
• CVE-2026-115579 <https://github.com/ckan/ckan/security/advisories/GHSA-5f35-225m-5mg7>_: Unauthenticated reflected XSS via webpage_view
• Resource view activities have the same permission labels as the corresponding dataset. (#9611 <https://github.com/ckan/ckan/pull/9611>_)
• Skip the Data Explorer view when there are field errors, instead of breaking the whole resource view page (#9529 <https://github.com/ckan/ckan/pull/9529>_)
• Add an index on tracking_summary (package_id, tracking_date) (#9538 <https://github.com/ckan/ckan/pull/9538>_)
• Fix dataset_purge failing with an IntegrityError for datasets that have collaborators. (#9576 <https://github.com/ckan/ckan/pull/9576>_)
• Remove redundant queries and a function-local import from dataset_purge. (#9577 <https://github.com/ckan/ckan/pull/9577>_)
• Fix datastore_upsert method=insert (and datastore_create) records_row error value. Used to always report last row regardless of which record contained the error. (#9587 <https://github.com/ckan/ckan/pull/9587>_)