v2.9.0

CHANGE-LOG.md

@@ -1,5 +1,48 @@
 # OpenStudyBuilder (OSB) Commits changelog
 
+## V 2.9
+
+New Features and Enhancements
+============
+
+### Fixes and Enhancements
+
+- Many fixes in the Standard data model endpoints (SDTM). Non-exhaustive list : unstable or wrong ordering of elements, missing domains, duplicates in the results,...
+Libraries are now managed in a way that truly enables having multiple sponsor libraries
+- The ICH M11 preview under Studies, View Specifications is updated to the final M11 19 November 2025 version, with some improved display options.
+
+### New Feature
+
+- Added a display page for Sponsor Models. API to retrieve information are now in a first working state
+- When adding a new study, you can now choose “Create a study with default settings.” This option copies study visits, epochs, and activities from a template study. This option is available only if a template study has been defined previously in Library, Admin Definitions, Template Study. Please note, that the studies that can be used as templates and are listed in the Template Study list are locked.
+- E2E tests for "archived" library implemented.
+
+### Performance Improvements
+- Faster batch creation of study activities when selecting 'Select from Library' path.
+- Faster editing of a single study activity.
+- Faster batch editing of study activities in SoA, e.g. moving a couple of study activities to different SoA Group and assigning a few schedules to each study activity.
+
+### End-to-End Automated test enhancements
+- Various code improvements to ensure easier maintenance and overall tests stability.
+- Administration > Feature Flags: Adjusted tests to the changes in the Feature Flags page.
+- Library > Concepts > Activities > Activity Instances: Implemented tests for Events Activity Instance Class.
+- Library > Concepts > Activities > Activity Instances: Adjusted tests to the changes in the Overview Page.
+- Library > Concepts > Activities > Activity: Implemented tests for checking Study Linkage on the Activity Placeholder Overview Page.
+- Library > Data Collection Standards > CRF Builder > CRF Items: Improved and implemented tests for Activity Instance linkage.
+- Library > Data Collection Standards > CRF Builder > CRF Tree: Improved and implemented tests for Activity Instance linkage.
+- Studies > Define Study > Study Activities > Schedule of Activities > Protocol - Lab Table: Defined and Implemented tests.
+- Studies > Define Study > Study Interventions: Refactorization of Study Compounds and Study Compounds Dosings tests to use API calls for data creation.
+
+Solved Bugs
+============
+
+### Studies
+
+ **> Define Studies > Activity Instances** 
+
+- Fix StudyActivityInstance creation when ActivityPlaceholder is exchanged for multiple StudyActivities
+
+
 ## V 2.8
 
 New Features and Enhancements

clinical-mdr-api/.azuredevops/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "daily"
+      time: "09:00"
+      timezone: "Europe/Paris"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "python"
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"
+      prod-dependencies:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"

clinical-mdr-api/.claude/rules/code-standards.md

@@ -8,6 +8,7 @@
 - **Naming**: Follow PEP 8, public API = no leading underscore
 - **Disabled Pylint Checks**: Missing docstrings, fixme, too-few-public-methods, too-many-ancestors, cyclic-import, etc. (see `pyproject.toml`)
 - **Descriptive variable names over clever abbreviations**
+- **Imports always at the top of the file** - never use inline/local imports inside functions or test methods
 
 ## FastAPI Best Practices
 

clinical-mdr-api/.claude/rules/testing.md

@@ -21,4 +21,11 @@ paths:
 - Shared utilities in `clinical_mdr_api/tests/utils/`
 - Integration tests run in parallel with `-n 4` flag
 
+## Writing Tests
+
+- **Use real workflows, not shortcuts** - tests should trigger the actual code paths users hit, not manually arrange the end state
+- **Use `TestUtils`** - check `clinical_mdr_api/tests/integration/utils/utils.py` before writing test setup from scratch
+- **Verify the test fails without the fix** - before committing a bug fix test, confirm it actually fails on the old code
+- **Search for existing test patterns** - look at similar test files in the same directory before writing a new test
+
 

clinical-mdr-api/Pipfile

@@ -18,7 +18,7 @@ python-docx = "~=1.1.2"
 colour = "~=0.1.5"
 authlib = "~=1.6.5"
 pyjwt = "~=2.12.0"
-cryptography = "~=46.0.5"
+cryptography = "~=46.0"
 httpx = "~=0.27.2"
 starlette-context = "==0.4.0"
 python-multipart = "~=0.0.12"
@@ -44,7 +44,7 @@ pyasn1 = "~=0.6.3"
 pytest = "~=8.4.1"
 pytest-bdd = "~=7.3.0"
 pytest-cov = "~=6.0.0"
-pylint = "~=3.3.1"
+pylint = "~=4.0.5"
 rich = "~=14.0.0"
 flake8 = "~=7.1.1"
 pep8 = "~=1.7.1"
@@ -91,7 +91,7 @@ format = """sh -c "
     && python -m black clinical_mdr_api consumer_api common extensions \
 "
 """
-audit = "python -m pip_audit --ignore-vuln CVE-2026-4539"
+audit = "python -m pip_audit --ignore-vuln CVE-2026-4539 --ignore-vuln GHSA-jj8c-mmj3-mmgv --ignore-vuln CVE-2025-71176 --ignore-vuln CVE-2026-40347"
 openapi = "python generate_openapi_json.py"
 schemathesis = """
     schemathesis