microsoft/AzureTRE v0.29.0

0.29.0

on GitHub

(0.29.0) (August 14, 2026)

BREAKING CHANGES

• Remove Windows 10 and dsvm image support from Guacamole. (#4890)
• Add data science tooling (Azure CLI, VS Code, Storage Explorer, Git, Python/JupyterLab, R/RStudio) to Guacamole Windows VMs via a shared vm_config.ps1 bootstrap pulled through Nexus. Existing tre-service-guacamole-windowsvm, tre-service-guacamole-import-reviewvm, and tre-service-guacamole-export-reviewvm resources must not be upgraded to these new versions — redeploy instead. Upgrade the Nexus shared service to sonatype-nexus 3.9.0 before deploying the new Windows VM templates to ensure the required proxy repositories are available. (tre-service-guacamole-windowsvm 3.0.0, tre-service-guacamole-import-reviewvm/tre-service-guacamole-export-reviewvm 2.0.0, sonatype-nexus 3.9.0) (#4981)

ENHANCEMENTS:

• Upgrade FastAPI to 0.139.2, Starlette to 1.3.1, and compatible OpenTelemetry dependencies, with routing updates for newer FastAPI and Pydantic v2 compatibility.
• Enable graceful upgrading of the Nexus shared service: modified or added repository configs and the container image (now 3.94.0) are applied to the existing VM on upgrade without recreating it. Removed the non-functional snapcraft proxy (dead remote URL) and skip repositories left in a failed state so they don't block upgrades. (sonatype-nexus 3.10.0) (#2721)
• Specify default_outbound_access_enabled = false setting for all subnets (#4757)
• Pin all GitHub Actions workflow steps to full commit SHAs to prevent supply chain attacks plus update to latest releases (#4886)
• Add Windows Server 2025 image support to Guacamole. (#4890)
• Add support for setting resource processor VMSS SKU via environment variables (#4936)
• Exclude recovery service vaults from e2e tests (#4920)
• Strengthen TRE API authentication with a layered auth/ package (typed exceptions, PyJWKClient-backed token validation, immutable AuthenticatedUser model, composable RBAC factories), remove the redundant AccessService abstraction, and add Event Grid publish resilience with distinct Graph/publish failure reporting. (#4989)
• Add support for formatting UI code via pre-commit and fix existing formatting issues. (#4955)
• Update the version of super-linter used in the build_validation_develop workflow to 8.7.0 (#4957)
• Migration to Pydantic v2: Updates codebase to be compatible with Pydantic v2 for future FastAPI upgrades (#4637)

BUG FIXES:

• Mark secret parameters in porter.yaml as sensitive: true to prevent secrets from appearing in debug logs (#5011)
• Ignore changes to ip_tags on public IP resources to unblock deployments where these tags are set by Azure policy. (core 0.16.17, tre-shared-service-certs 0.7.11) (#5019)
• Fix workspace deletion when backup is enabled for the base, unrestricted and airlock-import-review workspaces by adding a delete_backups_on_uninstall flag and a pre-teardown backup cleanup (remove_backup.sh) that stops protection and either deletes or retains the Recovery Services Vault, so deletion works with Azure secure-by-default soft delete (#4962)
• Fix Nexus shared service security: fetch admin password from Key Vault at runtime via managed identity (IMDS) instead of embedding it in the VM Run Command script content. Fix deploy_nexus_container.sh short-circuit path to fail loudly if the container does not start. (sonatype-nexus 3.10.0) (#4983)
• Fix UI TypeScript deprecation warning by updating moduleResolution to bundler in tsconfig.json. (#4968)
• Fix API timeout and name collision failures on workspace creation by checking storage account name availability and improved logging. (#4946)
• Fix error handling in airlock processor (#4929)
• Update allowed URLs in Nexus for letsencrypt (#4899)
• Update API, CLI, and UI dependencies to address high-severity Dependabot alerts, including PyJWT, Vite, lodash, fast-uri, flatted, immutable, and minimatch. (#4914)
• Update dependencies to address Dependabot security alerts: aiohttp, pytest, pytest-asyncio, Pygments, esbuild, ws, js-yaml, @babel/core, flatted (via vitest upgrade), and react-router-dom. (#4915, #4950)
• Fix spelling in docs using codespell (#4954)
• Fix issues identified by flake8 (#4958)
• Replace deprecated yaspell with codespell and add pre-commit hook installer to devcontainer. (#4953)
• Fix Guacamole Windows VM image selections by aligning schema enums/defaults with supported image options in Windows and review VM templates. (#4963)
• Remove deprecated soft_delete_enabled setting from azurerm_recovery_services_vault in base workspace template. (#4967)
• Pin MKDocs to v1 to prevent incompatible upgrade. (#5009)

COMPONENTS:

Full Changelog: https://github.com/microsoft/AzureTRE/blob/main/CHANGELOG.md