October 2018 - galaxy-announce - lists.galaxyproject.org

Galaxy 18.09 Release
by Dannon Baker 29 Oct '18

29 Oct '18

We are pleased to announce the *release of Galaxy 18.09 <https://docs.galaxyproject.org/en/release_18.09/releases/18.09_announce.html>*. A few release highlights are: <http://localhost:8095/news/2018-9-galaxy-release/#extensive-workflow-enhanc…> Extensive Workflow Enhancements Workflows got a lot of love this time around, with new runtime parameters for subworkflows, exposed workflow versions, and zoom capability in the editor, to name a few. There were also a number of usability enhancements including better labeling, links, overhauled workflow import interfaces, and many more. <http://localhost:8095/news/2018-9-galaxy-release/#group-tags> Group Tags Galaxy now contains powerful new features for multiple factor analysis of collections of datasets. The concept of group tags has been added to Galaxy. These are a special class of tags that describe key-value pairs that can be attached to the contents of a collection during upload or using collection operation tools. These tags can describe multiple sets of variables for the contents of a collection. Once set, these tags can be consumed intelligently by tools that need to divide collections into multiple overlapping factors or sets of datasets. A special thanks to @mvdbeek for devising and implementing this approach. <http://localhost:8095/news/2018-9-galaxy-release/#python-3-beta-support> Python 3 Beta Support After almost 3 years of work and more than 100 pull requests, we are proud to announce the Beta-stage support for running Galaxy under Python 3. Lint, unit, API, framework, integration and Selenium tests all pass, time for you to give it a try and report any bug you find! Please see the full release notes <https://docs.galaxyproject.org/en/release_18.09/releases/18.09_announce.html> for more information, including how to upgrade today! *Thanks for using Galaxy!*

1 0

GX-2018-0006 - Unauthorized File System Operations via New Upload API
by John Chilton 04 Oct '18

04 Oct '18

DESCRIPTION A high severity security vulnerability was recently discovered in Galaxy 18.05's new upload API by the Galaxy Committers Team. Anyone with a Galaxy account can exploit this vulnerability to read and write arbitrary files on the Galaxy host accessible by the system user Galaxy runs as. This is possible due to insecure handling of tar file extraction. This vulnerability has been assigned the disclosure ID GX-2018-0006. AFFECTED VERSIONS This vulnerability affects Galaxy version 18.05 only (and the current development branch). IMPACT Administrators of Galaxy 18.05 servers should patch immediately. Galaxy servers running versions of Galaxy older than 18.05 are unaffected by this problem. The fix sanitizes the contents of tar files during upload while extracting them. INSTRUCTIONS The fixes are available on the `release_18.05` branch in the Galaxy GitHub repository[2]. You can simply `git pull` or use your normal update procedure to get the changes. For the changes to take effect, YOU MUST RESTART ALL GALAXY SERVER PROCESSES. --John Chilton (on behalf of the Galaxy Committers) [1] https://github.com/galaxyproject/galaxy/blob/dev/SECURITY_POLICY.md [2] https://github.com/galaxyproject/galaxy/

1 0

October 2018 Galactic News: SACNAS Workshops, European Galaxy Days, Admin Training; new Pubs, Public Servers, Job postings, and Blog posts!
by Mo Heydarian 01 Oct '18

01 Oct '18

Hello All, The October 2018 Galactic News <https://galaxyproject.org/news/2018-10-galaxy-update/> highlights what’s going on in the Galaxy this month, including: - Galactic Events: - 2018 SACNAS Workshops <https://galaxyproject.org/news/2018-10-galaxy-update/#2018-sacnas-pre-confe…>,10 October, USA - European Galaxy Days <https://galaxyproject.org/news/2018-10-galaxy-update/#european-galaxy-days-…>, 19 - 20 November, Germany - 2019 Galaxy Admin Training <https://galaxyproject.org/news/2018-10-galaxy-update/#2019-galaxy-admin-tra…>, 28 January - 1 February, USA - Other events <https://galaxyproject.org/news/2018-10-galaxy-update/#upcoming-events> across the world. - Galactic Blog <https://galaxyproject.org/news/2018-10-galaxy-update/#new-galactic-blog-pos…> : - Contributor of the Month: Yvan Le Bras <https://galaxyproject.org/news/2018-10-galaxy-update/#new-galactic-blog-pos…> - Tutorial of the month: “From Peaks to Genes” <https://galaxyproject.org/news/2018-10-galaxy-update/#new-galactic-blog-pos…> - Highlight: Hybrid Training delivering to far-reaching venues <https://galaxyproject.org/news/2018-10-galaxy-update/#new-galactic-blog-pos…> - New: - 200 publications <https://galaxyproject.org/news/2018-10-galaxy-update/#publications> - Public Galaxy Servers <https://galaxyproject.org/news/2018-10-galaxy-update/#public-galaxy-server-…>: MPDS-DM - Galactic Job Postings <https://galaxyproject.org/news/2018-10-galaxy-update/#whos-hiring> - Toolshed contributions <https://galaxyproject.org/news/2018-10-galaxy-update/#tools> - Releases <https://galaxyproject.org/news/2018-10-galaxy-update/#releases> of GVL 4.4.0, Planemo 0.55.0, and galaxy-lib. - And other news <https://galaxyproject.org/news/2018-10-galaxy-update/#other-news>. See the newslette <https://galaxyproject.org/news/2018-10-galaxy-update/>r for all of the details! Thanks for using Galaxy! Cheers, Mo, on behalf of Galaxy

1 0