Release notes¶

The notes contain

actions to take before using a new version
important information regarding compatibility

For a complete list of fixes, added features, etc. see Tatin on GitHub.

v0.127.0 ⋄ 2026-09-20¶

Minor change in behaviour in order to fix a problem: When scanning registries, if a registry is unreachable and skipped, a dependency that lives only there now causes an error. Before, it produced an incomplete build list.

Two more changes in behaviour, both of them about versions going backwards:

]Tatin.ReInstallDependencies -update now refuses, and changes nothing, when it would replace an installed package by an earlier version of it. That used to happen silently to a package whose installed version had been withdrawn from the Registry it came from, or had never been published: the version was widened to its major version line, and whatever the Registry offered as the best version of that line was installed over it.
]Tatin.CheckForLaterVersion compares versions now instead of just checking whether they differ, so such a package is no longer reported as updatable to an earlier version.

When the installed version is not hosted by any Registry it says "Not available any more", which means that install cannot be reproduced by anybody.

Server¶

This release fixes the server answering a request for several packages' dependencies with a 404 when it hosts only some of them, which cost clients the dependencies it did host.

Older clients benefit from that fix as well, so it is worth updating a Registry even if nobody using it has upgraded their client.

v0.126.2 ⋄ 2026-09-15¶

Version 0.126.1 came with a bug that stopped housekeeping from doing its job, so every server running 0.126.1 should update. As long as 0.126.1 was running:
READMEs of newly published packages were not fetched.
IndexNow was not told about new or changed pages.
Changes to Credentials.csv and server.ini were not picked up.
Usage data was not processed.

READMEs and IndexNow catch up on their own once 0.126.2 is running. A change made to Credentials.csv or server.ini while 0.126.1 was running takes effect with the update to 0.126.2.

No breaking changes, no user actions required. Usage data files that are not needed any more, like the monthly files of a year that has a file for the whole year, are deleted automatically by the first housekeeping run: there is no need to delete them by hand.

This is a server-only release, the client has not changed.

v0.126.1 ⋄ 2026-09-12¶

This is a server-only release, and it fixes a serious security problem. Everybody who runs a Tatin server should update right away.

Until this version the server handed out files it must never serve:

Everything in Assets/Runtime/, including the certificates that come with Tatin.
Any file the server process was able to read. Such a file could be reached with .. from /Assets/ or from /usage-data/ and through the download of usage data; among them are server.ini and the Credentials.csv file of the Registry.
The application log, which lives in the same folder as the usage data files.

All of these now get a 404, just like a file that does not exist.

There is no telling whether anybody took advantage of this, so assume that everything the server process was able to read has been read:

Change the password in the [EMAIL] section of server.ini and [CONFIG]IndexNowKey, if you use them.
API keys are kept in Credentials.csv as salted hashes rather than in plain text, but you might consider issuing new ones anyway.
Replace the Assets/ folder in the root of your Tatin server with the one that comes with this version, as described in Assets.

This needs more care only if your server serves HTTPS itself ([CONFIG]Secure=1) and [CERTIFICATES]PublicCertFile or [CERTIFICATES]PrivateKeyFile point anywhere into Assets/. That certificate was there for anybody to download, and replacing the folder would delete it anyway. In that case, before replacing Assets/:

Put a new certificate and its private key into the root of your Tatin server, where server.ini lives, but not anywhere in Assets/.
Point [CERTIFICATES]PublicCertFile and [CERTIFICATES]PrivateKeyFile to the new files.

Packages turned out to be far messier in real life than anticipated; this release brings in the required adjustments:
When a project carries no tags at all, or none that fits the version, the README is now fetched from the project's default branch instead. The package page says so: such a README describes the project as it is today, not that particular release.
The README is now looked for as "README.md", "README.MD", "ReadMe.md" and "readme.md": GitHub serves file names case sensitively, so the spelling matters.

v0.126.0 ⋄ 2026-09-09¶

This is a server-only release: the client side of Tatin has not changed at all.
The INI entry CONFIG:MenuItemBefore is gone. It used to put a prefix in front of some of the links on the home page; those links now live in a menu carried by every page, where a prefix repeated on each item would be noise.

Nothing needs doing. An entry left in the INI file is ignored, so it can be removed at leisure or left where it is.

Replace the Assets/ folder in the root of your Tatin server with the one that comes with this version. Replace rather than copy over, and see Assets for how to go about it: files were added in this version, and a plain copy leaves whatever it does not overwrite behind.

Until now jQuery and the DataTables extension were loaded from a CDN. They are now served from Assets/ instead, so that a Registry without access to the internet gets working tables as well. Two new files are involved and they live in two different folders:

Assets/CSS/datatables-1.12.1.min.css
Assets/JS/datatables-1.12.1.min.js

Copying only one of them fails quietly: with the JavaScript in place but the CSS missing, tables still sort and the filter box still works, while the sort markers in the column captions have disappeared.

Package pages now carry the README of the package, and a number of changes were made so that search engines can make sense of a Registry at all. What these are and what each of them is for is described in Search engines.

Two things are worth doing after the upgrade:

* Run `Server.BackfillReadmes` once. READMEs are otherwise fetched by housekeeping, which walks the Registry when something has been published or once a day, so an established Registry would take a while to fill up on its own.

* If your server sits behind a reverse proxy, make sure `CONFIG:BaseURL` is set. It was introduced in 0.125.1 for the sitemap, and the canonical links added with this version need it just as much: without it they would name the wrong protocol.

Note also that every page carries a title of its own now. Until this version all pages of a Registry shared one and the same title, which left anybody looking at a column of identical search results with no way of telling them apart.

URLs pointing to a help page that does not exist anymore are now correctly answered by a 301 (Redirect),

v0.125.1 ⋄ 2026-09-02¶

No action is required except when you already took advantage of the new CONFIG:Sitemap=1 feature from the preceding release 0.125.0 and you run a Tatin server behind a proxy like an Apache.

When Tatin runs behind Apache and CONFIG:Sitemap=1 then both the sitemap URL in robots.txt and all links in sitemap.xml use http:// as protocol, not https://.

Version 0.125.1 fixed this with the introduction of a new INI entry CONFIG:BaseURL: the URL used by the outside world to reach the server, something like https://tatin.dev. It can be left empty with no CONFIG:Sitemap or CONFIG:Sitemap=0; behind a proxy with CONFIG:Sitemap=1 it needs to be set.

Instead of setting CONFIG:BaseURL you may make the proxy tell Tatin which protocol the outside world used. With Apache that means adding RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME} to the virtual host; see Reverse proxy.

The client side of Tatin has not changed at all with 0.125.1.

v0.125.0 ⋄ 2026-09-01¶

No action required

v0.124.3 ⋄ 2026-08-06¶

Note that recent versions did not allow anymore to load a package into an empty namespace. That was too restrictive, though loading into a scripted namespace is still not allowed.
This version comes with a new version of the ]Activate user command: it now can handle Tatin or Cider being installed in both the version-specific location and the version-agnostic location with the -reset option.

v0.124.2 ⋄ 2026-07-01¶

No action required

v0.124.1 ⋄ 2026-06-21¶

No action required

v0.124.0 ⋄ 2026-06-20¶

The result of the function Client.CopyRegistry has changed: it's now always a two-column matrix. Check the APL documentation for details.
The documentation has moved to https://aplteam.github.io. Therefore, the docs/ folder in the root of an installed Tatin server is not required anymore. In old installations it should be removed, avoiding potential confusion.

v0.123.0 ⋄ 2025-12-07¶

No action required

v0.122.0 ⋄ 2025-09-29¶

No action required

v0.121.1 ⋄ 2025-08-08¶

No action required

v0.121.0 ⋄ 2025-07-10¶

The API function Client.ListPackagesInInstallFolder returned two columns in earlier versions; now it returns four columns.

v0.120.0 ⋄ 2025-05-03¶

LoadPackages now throws an error when one of the packages specified cannot be found. No package is loaded.

No action required

v0.119.0 ⋄ 2025-03-12¶

No action required

v0.118.2 ⋄ 2025-02-03¶

No action required

v0.118.1 ⋄ 2025-01-14¶

No action required

v0.118.0 ⋄ 2024-12-30¶

The API function BuildPackage does not process a property tatinVars anymore; if it is fed one anyway, it will throw an error.

The function CreateBuildParms does not contain a variable tatinVars anymore but a variable projectspace, which is optional. You may set it to the namespace where the package project lives. That enables BuildPackage to update TatinVars.CONFIG in that namespace, otherwise BuildPackage doesn’t know where to look.

Accordingly the option -tatinVars= was removed from the ]BuildPackage user command but the option -projectspace= was introduced.

The user command ]ReInstallDependencies now accepts a flag -recursive. This can be put to use with a folder that contains multiple independent packages, for example the folder [MyUCMDs]: all installed packages in that folder can be re-installed and (in this instance) updated without user interaction with the following statement.

]ReInstallDependencies [MyUCMDs] -recursive -update -force

v0.117.0 ⋄ 2024-12-08¶

The way build numbers are processed has changed: prior to 0.117.0 when a complete version number — including a build number — was passed on to ]BuildPackage the build number was not bumped. Now it is bumped.

v0.116.0 ⋄ 2024-11-30¶

Tatin now requires at least 18.2: 18.0 is not supported any longer.

v0.115.3 ⋄ 2024-11-25¶

Fixes a gaping security hole (Server only, group home page)

v0.115.2 ⋄ 2024-11-16¶

No action required

v0.115.1 ⋄ 2024-11-15¶

No action required

v0.115.0 ⋄ 2024-10-14¶

No action required

v0.114.0 ⋄ 2024-09-30¶

In case you are on Windows and you are using OneDrive then you might need to pay attention.

Older versions of Tatin did not cooperate with OneDrive; this can potentially cause problems. A new document, "Tatin and OneDrive," discusses this issue. If you use OneDrive, read it!

Otherwise no action is required, but be aware of changes made to ]ListVersions: if no argument is provided it checks on open Cider projects now. In other words, it became more powerful.

v0.113.1 ⋄ 2024-09-08¶

No action required

v0.113.0 ⋄ 2024-09-05¶

No action required

v0.112.1 ⋄ 2024-08-16¶

No action required

v0.112.0 ⋄ 2024-07-14¶

The ]CopyRegistry user command, introduced in 0.110.0, got a changed syntax:

The -full flag was removed.
Default behaviour is now what was so far achievable with -full except that deprecated packages are now copied as well.

This is a necessity for compatability, because some package might well depend on an earlier version of a now deprecated package.
With -dry one might omit both arguments, meaning that the URL defaults to [tatin] while no path is required.
The list of copied packages is now returned as a matrix.

v0.111.0 ⋄ 2024-07-12¶

No action required

v0.110.0 ⋄ 2024-07-09¶

A maintenance file "2024-07-07-Inject-Exclude.aplf" was introduced.

It allows to add the new "exclude" property (introduced with version 0.109.0) to be introduced into all saved packages as an empty text vector.

You don't have to run this maintenance function on all your packages (Tatin deals with both a defined "exclude" as well as an absent "exclude") but it is better for future use when this is part of all packages.

v0.109.0 ⋄ 2024-06-27¶

No action required

v0.108.1 ⋄ 2024-05-04¶

No action required

v0.108.0 ⋄ 2024-05-02¶

You must update your client to 0.108.0 for correct results — prior versions are incompatible with 0.108.0!

v0.107.0 ⋄ 2024-04-04¶

The syntax of the API function DeletePackages has changed.

v0.106.2 ⋄ 2024-03-27¶

Action is required with version 18.2 and/or 18.0

With this version the Tatin user commands won't be available in the session until you either execute ]UReset yourself, or you add the following code to your setup.dyalog in MyUCMDs/:

:If ~IfAtLeastVersion 19
    {}⎕SE.SALTUtils.ResetUCMDcache -1                 
:EndIf

v0.106.1 ⋄ 2024-03-18¶

No action required when running Tatin.

v0.106.0 ⋄ 2024-03-12¶

No action required when running Tatin.

However, when developing (contributing to) Tatin there is a significant change: read "Special case: working on user commands" in the "Tatin for Contributors" document for details.

v0.105.0 ⋄ 2024-03-02¶

Potentially breaking changes:

The function DeletePackage was renamed: DeletePackages
The user command ]DeletePackage was renamed: ]DeletePackages

v0.104.1 ⋄ 2024-01-28¶

The client requires a server on 0.104.1 as well

v0.104.0 ⋄ 2024-01-22¶

The result of both ]ListRegistries and the corresponding API function return a different (extended) result now.

This implies that older versions of Tatin than 0.104.0 are incompatible with this new version, therefore you are forced to update.

Apart from the update no action is required.

v0.103.2 ⋄ 2024-01-16¶

No action required.

v0.103.1 ⋄ 2023-12-14¶

No action required.

v0.103.0 ⋄ 2023-11-04¶

No action required but note that the result of the API function LoadPackages has changed.

v0.102.3 ⋄ 2023-10-13¶

No action required

v0.102.2 ⋄ 2023-10-09¶

No action required

v0.102.1 ⋄ 2023-10-07¶

Most importantly, a bug fix in ]TATIN.CiderUpdate

v0.102.0 ⋄ 2023-10-04¶

Most importantly, a revised install procedure

v0.101.2 ⋄ 2023-09-30¶

Very important bug fix in UnInstallPackages

v0.101.1 ⋄ 2023-09-26¶

Two massive changes:

This version is only compatible with Cider 0.36.0 or later
The installation folder is not MyUCMDs/ anymore. However, ]TATIN.UpdateTatin of your old version cannot know about this, therefore you have to take action once in order to get Tatin into the right folder.

See ]UpdateTatin for details.
In future ]TATIN.UpdateTatin will use the new installation folder.

v0.100.2 ⋄ 2023-09-23¶

No breaking changes, no user actions required.

v0.100.1 ⋄ 2023-08-28¶

No breaking changes, no user actions required.

v0.100.0 ⋄ 2023-08-27¶

No breaking changes, no user actions required.

v0.99.1 ⋄ 2023-08-05¶

No breaking changes, no user actions required.

v0.99.0 ⋄ 2023-08-02¶

No breaking changes, no user actions required.

v0.98.2 ⋄ 2023-07-14¶

This release addresses a bug in the server; the client has not been changed.

Update only required if you run a server.

v0.98.1 ⋄ 2023-07-13¶

No breaking changes, no user actions required.

v0.98.0 ⋄ 2023-07-05¶

No breaking changes for the Tatin client, therefore there are no user actions required
If you run a Tatin server you don't need to take action but you should be aware of a major change

Before version 0.98.0 credentials got stored in a file Credentials.txt. The format was:

<group>=<api-key>

The API-keys were stored as clear text. We don't want that anymore.

With version 0.98.0 credentials will be stored in a file Credentials.csv. The format is different:

<group>,<api-key-hash>,<Salt>

The server will convert Credentials.txt automatically into Credentials.csv. Afterwards there is a new file Credentials.csv while the old file Credentials.txt will be deleted.

Note that you might create at a later stage a new file Credentials.txt with entries like

<group-name>=<api-key>

or

<group-name>,<api-key>

That allows you to add new groups, or overwrite existing ones, for example when somebody lost the API-key.

The server will perform the following actions:

Take the data and convert it
Delete rows from Credentials.csv that are also contained in Credentials.txt (same group name)
Add the data to Credentials.csv
Delete Credentials.txt

v0.97.1 ⋄ 2023-06-30¶

No breaking changes, no user actions required.

v0.97.0 ⋄ 2023-06-14¶

This version comes with several breaking changes:

The ]FindDependencies user command's -detailed property has been renamed to verbose
The API function FindDependencies has a changed syntax and returns a changed result.

v0.96.2 ⋄ 2023-06-08¶

No breaking changes, no user actions required.

v0.96.1 ⋄ 2023-05-21¶

No breaking changes, no user actions required.

v0.96.0 ⋄ 2023-05-18¶

No breaking changes, no user actions required.