Merge pull request #9779 from cvat-ai/release-2.44.0

Release v2.44.0

Author: cvat-bot[bot]

.github/workflows/bandit.yml

@@ -5,24 +5,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - id: files
-        uses: tj-actions/[email protected]
-        with:
-          files: |
-            **/*.py
-          files_ignore: |
-            **/cvat-sdk/*
 
       - name: Run checks
         run: |
-          CHANGED_FILES="${{steps.files.outputs.all_changed_files}}"
+          pipx install $(grep "^bandit" ./dev/requirements.txt)
 
-          if [[ ! -z $CHANGED_FILES ]]; then
-            pipx install bandit
-
-            echo "Bandit version: "$(bandit --version | head -1)
-            echo "The files will be checked: "$(echo $CHANGED_FILES)
-            bandit -a file --ini .bandit $CHANGED_FILES
-          else
-            echo "No files with the \"py\" extension found"
-          fi
+          echo "Bandit version: "$(bandit --version | head -1)
+          bandit -a file --ini .bandit --recursive .

.github/workflows/eslint.yml

@@ -11,8 +11,9 @@ jobs:
 
       - name: Install dependencies
         run: |
-          yarn install --frozen-lockfile
-          (cd tests && yarn install --frozen-lockfile)
+          corepack enable yarn
+          yarn install --immutable
+          (cd tests && yarn install --immutable)
 
       - name: Run checks
         run: |

.github/workflows/full.yml

@@ -308,7 +308,8 @@ jobs:
         run: |
           docker exec -i cvat_server /bin/bash -c "echo \"from django.contrib.auth.models import User; User.objects.create_superuser('${DJANGO_SU_NAME}', '${DJANGO_SU_EMAIL}', '${DJANGO_SU_PASSWORD}')\" | python3 ~/manage.py shell"
           cd ./tests
-          yarn --frozen-lockfile
+          corepack enable yarn
+          yarn --immutable
 
           if [[ ${{ matrix.specs }} == canvas3d_* ]]; then
             npx cypress run \

.github/workflows/main.yml

@@ -72,7 +72,8 @@ jobs:
 
       - name: Instrumentation of the code then rebuilding the CVAT UI
         run: |
-          yarn --frozen-lockfile
+          corepack enable yarn
+          yarn --immutable
           yarn run coverage
 
       - name: CVAT UI. Build and push
@@ -143,6 +144,8 @@ jobs:
             allow_cache: 'no'
           - pattern: "not test_task_data"
             allow_cache: 'no'
+          - pattern: "not test_task_data"
+            allow_cache: 'true'
     name: rest_api_testing [${{ matrix.pattern }}, cache-${{ matrix.allow_cache }}]
     steps:
       - uses: actions/checkout@v4
@@ -192,14 +195,10 @@ jobs:
       - name: Uploading code coverage results as an artifact
         uses: actions/upload-artifact@v4
         with:
-          name: ${{
-            contains(matrix.pattern, 'not')
-              && 'coverage_results_rest_api'
-              || format(
-                  'coverage_results_rest_api-{0}-cache-{1}',
-                  matrix.pattern, matrix.allow_cache
-                )
-            }}
+          name: ${{format(
+            'coverage_results_rest_api-{0}-cache-{1}',
+            matrix.pattern, matrix.allow_cache
+            )}}
           path: |
             coverage*.json
 
@@ -218,28 +217,20 @@ jobs:
         if: failure() && steps.run_tests.conclusion == 'failure'
         uses: actions/upload-artifact@v4
         with:
-          name: ${{
-            contains(matrix.pattern, 'not')
-              && 'rest_api_container_logs'
-              || format(
-                  'rest_api_container_logs-{0}-cache-{1}',
-                  matrix.pattern, matrix.allow_cache
-                )
-            }}
+          name: ${{format(
+              'rest_api_container_logs-{0}-cache-{1}',
+              matrix.pattern, matrix.allow_cache
+            )}}
           path: "${{ github.workspace }}/rest_api_testing"
 
       - name: Upload allure results
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: ${{
-            contains(matrix.pattern, 'not')
-              && 'allure-results-tests-api'
-              || format(
-                  'allure-results-tests-api-{0}-cache-{1}',
-                  matrix.pattern, matrix.allow_cache
-                )
-            }}
+          name: ${{format(
+              'allure-results-tests-api-{0}-cache-{1}',
+              matrix.pattern,matrix.allow_cache
+            )}}
           path: tests/python/allure-results
 
   unit_testing:
@@ -319,6 +310,8 @@ jobs:
       - uses: actions/setup-node@v4
         with:
             node-version: '22.x'
+            # NOTE: corepack is not bundled after Node 25
+            # https://nodejs.org/docs/v22.18.0/api/corepack.html#corepack
 
       - name: Download CVAT server image
         uses: actions/download-artifact@v4
@@ -371,7 +364,8 @@ jobs:
         run: |
           docker exec -i cvat_server /bin/bash -c "echo \"from django.contrib.auth.models import User; User.objects.create_superuser('${DJANGO_SU_NAME}', '${DJANGO_SU_EMAIL}', '${DJANGO_SU_PASSWORD}')\" | python3 ~/manage.py shell"
           cd ./tests
-          yarn --frozen-lockfile
+          corepack enable yarn
+          yarn --immutable
 
           if [[ ${{ matrix.specs }} == canvas3d_* ]]; then
             npx cypress run \

.github/workflows/remark.yml

@@ -11,7 +11,8 @@ jobs:
 
       - name: Run checks
         run: |
-          yarn install --frozen-lockfile
+          corepack enable yarn
+          yarn install --immutable
 
           echo "Remark version: "`npx remark --version`
           npx remark --quiet --frail -i .remarkignore .

.github/workflows/schedule.yml

@@ -256,7 +256,8 @@ jobs:
       - name: Run tests
         run: |
           cd ./tests
-          yarn --frozen-lockfile
+          corepack enable yarn
+          yarn --immutable
 
           shopt -s extglob
           if [[ ${{ matrix.specs }} == canvas3d_* ]]; then

.github/workflows/stylelint.yml

@@ -11,7 +11,8 @@ jobs:
 
       - name: Install dependencies
         run: |
-          yarn install --frozen-lockfile
+          corepack enable yarn
+          yarn install --immutable
 
       - name: Run checks
         run: |

.gitignore

@@ -50,6 +50,7 @@ yarn-error.log*
 node_modules
 /*env*/
 /.*env*
+perfkit.egg-info/
 
 # Ignore all js dists
 cvat-data/dist
@@ -67,3 +68,12 @@ cvat-ui/dist
 # produced by allure report
 /**/allure-report*
 /**/allure-results*
+
+# https://yarnpkg.com/getting-started/qa#which-files-should-be-gitignored
+**/.pnp.*
+**/.yarn/*
+**/!.yarn/patches
+**/!.yarn/plugins
+**/!.yarn/releases
+**/!.yarn/sdks
+**/!.yarn/versions

.yarnrc.yml

@@ -0,0 +1 @@
+nodeLinker: node-modules

CHANGELOG.md

@@ -16,6 +16,97 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- scriv-insert-here -->
 
+<a id='changelog-2.44.0'></a>
+## \[2.44.0\] - 2025-09-01
+
+### Added
+
+- Introduced bulk actions to perform operations on multiple selected resources at once
+  - Multi-select resources using click with Ctrl, Shift or using Select all button at the top bar
+  - Supported resources: Tasks, Jobs, Projects, Requests, Organization members, Webhooks, Cloud Storages
+  - Supported operations: Export, Backup, Delete, Download, Change: Assignee, State, Stage, Role
+  (<https://github.com/cvat-ai/cvat/pull/9582>)
+
+- \[SDK\] Auto-annotation functions are now able to output tags
+  (<https://github.com/cvat-ai/cvat/pull/9671>)
+
+- Now it is possible to move projects and tasks between organizations
+  (<https://github.com/cvat-ai/cvat/pull/9528>)
+
+- Improved validation errors for invalid json filter queries
+  (<https://github.com/cvat-ai/cvat/pull/9703>)
+
+- \[SDK, CLI\] Support for exporting with server-generated filename
+  (<https://github.com/cvat-ai/cvat/pull/9732>)
+
+- Organization transfer now supported as a bulk action
+  (<https://github.com/cvat-ai/cvat/pull/9727>)
+
+- Ability to replace cloud storage for tasks.
+  (<https://github.com/cvat-ai/cvat/pull/9535>)
+
+- Lightweight backup option in Export backup dialog (excludes media for cloud-storage tasks).
+  (<https://github.com/cvat-ai/cvat/pull/9535>)
+
+### Changed
+
+- Updated Yarn version from 1.22.22 to 4.9.2
+  (<https://github.com/cvat-ai/cvat/pull/9688>)
+
+- \[SDK\] simplified sending of custom requests with `ApiClient`, added documentation
+  and improved related APIs. Documented using foreign libraries for sending requests.
+  (<https://github.com/cvat-ai/cvat/pull/9730>)
+
+- \[CLI\] `task backup` and `task export-dataset` now download files with the server-generated
+  filenames by default
+  (<https://github.com/cvat-ai/cvat/pull/9732>)
+- \[CLI\] `task backup` and `task export-dataset` now always export files locally,
+  regardless of the default export location on the server
+  (<https://github.com/cvat-ai/cvat/pull/9732>)
+
+- The cvat/server Docker image is now configured with a numeric UID
+  rather than a username
+  (<https://github.com/cvat-ai/cvat/pull/9743>)
+
+- The frontend container no longer runs as root
+  (<https://github.com/cvat-ai/cvat/pull/9746>)
+
+- \[Helm\] The Clickhouse, PostgreSQL and Redis containers now use
+  the images from the Bitnami Legacy repository by default
+  (<https://github.com/cvat-ai/cvat/pull/9754>)
+
+- \[Compose, Helm\] The Vector container now runs as a non-root user
+  (<https://github.com/cvat-ai/cvat/pull/9755>)
+
+- \[Helm\] The Kvrocks container now has overridden UID/GID, making
+  it compatible with the `runAsNonRoot` security context setting
+
+- Made the error message when a particular image cannot be saved
+  to a compressed chunk more useful
+  (<https://github.com/cvat-ai/cvat/pull/9724>)
+
+- When registering a user, the server will now reject overly long email,
+  first name and last name fields, instead of truncating them
+  (<https://github.com/cvat-ai/cvat/pull/9767>)
+
+### Removed
+
+- Removed deprecated `seed` parameter in job creation in favor of `random_seed`
+  (<https://github.com/cvat-ai/cvat/pull/9744>)
+
+### Fixed
+
+- Invalid GT job frame numbers in backups of video tasks with custom start/stop frame or frame step
+  (<https://github.com/cvat-ai/cvat/pull/9695>)
+
+- Server error in GT job creation if the `random_per_job` frame selection method
+  was used with the `seed` parameter.
+  (<https://github.com/cvat-ai/cvat/pull/9744>)
+
+- \[Helm\] A useless `/models` directory is no longer created in the main
+  data volume
+  (<https://github.com/cvat-ai/cvat/pull/9773>)
+
 <a id='changelog-2.43.0'></a>
 ## \[2.43.0\] - 2025-08-07