Magda Files

Magda v7.0.0 brings provider-agnostic PostgreSQL support (in-cluster PostgreSQL 17, AWS RDS, Azure Database for PostgreSQL and GCP Cloud SQL, with TLS by default), the Data Understanding data-dictionary and distribution-contract aspects, a built-in full map for map previews, and new Site Content settings pages that replace the legacy /admin UI.

⚠️ Upgrading from v6

The bundled in-cluster PostgreSQL is upgraded from 13.7 to 17.5. A plain helm upgrade to v7 gives you a new, empty PostgreSQL 17 database — your v6 data does not move across by itself. Before upgrading, read PostgreSQL Upgrade & Migration Pathways (v6 → v7) and pick your route:

• In-cluster PostgreSQL (the default): follow the PostgreSQL Major Upgrade runbook. In short:
• Enable majorUpgrade on every in-cluster database chart that holds data, e.g. --set magda-core.combined-db.magda-postgres.majorUpgrade.enabled=true for the umbrella magda chart. A wrong value path is silently ignored, so check it with helm template ... | grep -c major-upgrade (expect a non-zero count).
• Run helm upgrade with a generous --timeout (e.g. 3600s), and don't use --reuse-values: re-supply your values with -f.
• global.postgresql.auth.username must be postgres during the upgrade.
• Expect downtime for the dump & restore. Your PostgreSQL 13 data volume is kept, so you can roll back (see the runbook's "Rolling back" section).
• v6 wal-g backups can't be restored into PostgreSQL 17: take a fresh base backup after the upgrade.
• Managed / cloud database (AWS RDS, Azure, GCP Cloud SQL): your data is not touched. Magda supports PostgreSQL 13–17; upgrade with your existing external-database values.
• Authentication plugins: use plugin releases that support Magda v7, as service-to-database connections are now encrypted by default. An incompatible plugin is reported when the chart is rendered (global.magdaCompatibilityCheck); see Authentication plugins: Magda version compatibility.
• Legacy admin UI: the /admin pages are replaced by Settings › Site Content and Settings › Access Controls; /admin now redirects to /admin/connectors.

What's Changed

• #3836: Replace the retired Data61 logo in the default site footer with the CSIRO logo, linking to https://www.csiro.au/. Customised footers are not changed.
• #3835: Add Home Page (taglines, highlights & stories) and UI Text pages to the settings UI's Site Content section, replacing the legacy /admin editors:
• Highlights rotate daily in a set order and can be featured until a date. Their background images are no longer stretched, and their links work with full URLs.
• Stories can be reordered, and UI texts can be reset to their defaults.
• The legacy /admin pages are removed, including /admin/accounts (use Access Controls › Users / Roles instead). /admin now redirects to /admin/connectors.
• #3832: Add a Site Content section to the settings UI to manage the header navigation, the footer (menus, links & copyright), the logos & website icon, and the static pages, replacing the legacy /admin editors. The Users, Roles, Org Units, Resources & Access Groups pages are grouped under Access Controls.
• Behaviour change: footer links to site paths (e.g. /page/about) now open in the same window, like the header. Set "New window" on a link to keep the previous behaviour. Footer links also use their saved target & rel.
• Header & footer links to API paths (/api/*, /auth/*) opening in the same window no longer show the UI's "not found" page.
• #3834: Fix the Organisations page and organisation search failing with a 500 error when no dataset has a publisher. The datasets index version is bumped to 53 (the index is rebuilt on upgrade).
• #3831: Fix the settings UI's create forms (org unit, access group, permission & resource) showing values from the previously opened form, and a duplicate caret on registry record aspect panels.
• #3830: Upgrade the UI component library rsuite from v5 to v6 (6.2.5), including its theme.
• [#3808]: Add the distribution-contract aspect (part of [#3806]) to describe how to access a distribution's file, API or service: protocol, endpoint, specification & documentation links, authentication (never credentials), operations and pagination, with where each value came from and whether it was reviewed. The distribution page shows it in a How to use tab. See the Distribution Contract guide.
• [#3807]: Add the data-dictionary aspect (part of [#3806]) to describe a distribution's fields, entities, keys, relationships and dimensions, with where each value came from and whether it was reviewed. The distribution page shows it in a searchable Structure section. See the Data Dictionary guide.
• #3637: Support external PostgreSQL providers (AWS RDS, Azure Database for PostgreSQL, GCP Cloud SQL) as well as the in-cluster PostgreSQL (closes [#3636], [#3734], [#3735], [#3736]):
• Database connections use TLS by default, and the in-cluster PostgreSQL serves TLS by default.
• A non-default privileged database username can be used (global.postgresql.auth.username).
• Support SCRAM authentication (PostgreSQL 14+). The DB migrator's Flyway is upgraded from 4.2 to 12.11; existing deployments upgrade without re-running migrations.
• An authentication plugin of an incompatible version is reported when the chart is rendered (global.magdaCompatibilityCheck).
• #3767: Support verifying the database server's certificate (sslmode=verify-ca / verify-full) (#3739).
• #3773: Make the PostgreSQL CA available to external authentication plugin charts, so they can also use verify-ca / verify-full (#3772).
• [#3749]: Upgrade the in-cluster PostgreSQL from 13.7 to 17.5. This is a breaking change — please refer to the official version release notes for upgrading instructions.
• Fix registry-api failing to connect to PostgreSQL 15+ (SCRAM authentication).
• Backups use a custom wal-g build (ghcr.io/magda-io/magda-wal-g:3.0.8-magda-edcda8b), as no released wal-g can back up PostgreSQL 15+ the way Magda does. Temporary, until a wal-g release includes [wal-g/wal-g#2262](https://github.com/wal-g/wal-g/issues/2262).
• helm template / helm install print a harmless coalesce.go:316: warning: cannot overwrite table with non table warning per bundled PostgreSQL instance.
• [#3750]: Add an automated in-cluster PostgreSQL major upgrade path from v6 to v7. See the PostgreSQL major upgrade runbook.
• #3776: Show a clear error when the migrator's database user can't create objects in the public schema (no longer granted by default in PostgreSQL 15+), and detect such errors whatever the server's language (#3744, closes [#3770]).
• #3777: Fix backup retention pruning misreporting its result, which could hide a real deletion failure (#3763).
• #3752: Fix the backup CronJob succeeding, and still pruning old backups, after a failed backup (#3746).
• #3792: Fix data previews:
• ArcGIS FeatureServer distributions now preview (magda-minion-format 2.0.2).
• The map preview works behind the gateway again, and its default OpenStreetMap base map loads (magda-preview-map 2.0.0).
• #3793: Hide the map preview's "Open in National Map" button unless an external TerriaMap is configured (openInExternalTerriaMapTargetUrl), as nationalmap.gov.au has been discontinued (magda-io/magda-preview-map#54).
• #3800: Add an Open full map button to the map preview. When no external TerriaMap is configured, it opens the dataset in the deployment's own full map, with the full TerriaJS UI (magda-io/magda-preview-map#53).
• Upgrade magda-preview-map to 2.1.0, which adds a Magda data catalog to the full map so users can add other datasets they can access (magda-io/magda-preview-map#55).
• #3801: Fix map preview & full map features blocked by the gateway's Content Security Policy: file upload, region-mapped CSVs and the "Natural Earth II" base map. See Map Preview & Full Map: Content Security Policy (magda-io/magda-preview-map#56).
• #3802: Show the Open full map button for datasets whose files are stored in Magda (magda-io/magda-preview-map#53).
• #3804: Fix the dataset search region facet map showing "API key required" tiles. It now uses OpenStreetMap by default, and another tile provider can be set with the new web-server regionFacetBaseMap option. The gateway's default CSP imgSrc now allows https://tile.openstreetmap.org instead of https://*.tile.openstreetmap.org and https://*.basemaps.cartocdn.com (#3798).
• #3826: Set a default 1Gi memory limit for the bundled MinIO, which previously had none and could starve other workloads on the node. Raise storage-api.minio.resources.limits.memory for much larger or many concurrent uploads.

Full Changelog: https://github.com/magda-io/magda/compare/v6.2.1...v7.0.0