pdurbin · Oct 8, 2026 · Jun 24, 2026 · Jul 8, 2026 · Jul 8, 2026 · Jul 9, 2026
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -71,7 +71,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.38.0
+      uses: github/codeql-action/init@v4.38.2
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -99,6 +99,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.38.0
+      uses: github/codeql-action/analyze@v4.38.2
       with:
         category: "/language:${{matrix.language}}"
@@ -106,7 +106,8 @@ jobs:
           mvn -Pct docker:start \
             -Ddataverse.feature.index-harvested-metadata-source=true \
             -Ddataverse.oai.server.maxidentifiers=2 \
-            -Ddataverse.oai.server.maxrecords=2
+            -Ddataverse.oai.server.maxrecords=2 \
+            -Ddataverse.feature.allow-locally-fair-data=true
 
       # ---------------------------
       # WAIT FOR API READINESS
@@ -215,6 +216,7 @@ jobs:
             -Dtest="$TEST_SUITE" \
             -Dmaven.test.failure.ignore=true \
             -Ddataverse.test.baseurl=http://localhost:8080 \
+            -Ddataverse.test.solr.softcommit.millis=100 \
             -DcompilerArgument=-Xlint:unchecked
 
       # ---------------------------

diff --git a/.github/workflows/dataverse_jsf_tests.yml b/.github/workflows/dataverse_jsf_tests.yml
@@ -103,7 +103,8 @@ jobs:
           mvn -Pct docker:start \
             -Ddataverse.feature.index-harvested-metadata-source=true \
             -Ddataverse.oai.server.maxidentifiers=2 \
-            -Ddataverse.oai.server.maxrecords=2
+            -Ddataverse.oai.server.maxrecords=2 \
+            -Ddataverse.feature.allow-locally-fair-data=true
 
       # ---------------------------
       # WAIT FOR API READINESS
@@ -229,6 +230,7 @@ jobs:
           DV_FULL_NAME:   "Dataverse Admin"
           ROOT_DATAVERSE: "/dataverse/root"
           SKIP_PREFLIGHT: "true"
+          LOCALLY_FAIR_ENABLED: "false"
           DOTENV_CONFIG_QUIET: "true"
 
       # ---------------------------

@@ -141,11 +141,11 @@ for BRANCH in "$@"; do
   NEWER_IMAGE=0
   if (( NEWER_BASE_IMAGE + FIXES_AVAILABLE + FORCE_BUILD > 0 )); then
     if ! (( DRY_RUN )); then
-      # Build the application image, but skip the configbaker image (that's a different job)!
+      # Build the configbaker image, but skip the application image (that's a different job)!
       # shellcheck disable=SC2046
       mvn -Pct -f . deploy -Ddocker.noCache -Ddocker.platforms="${PLATFORMS}" \
         -Dapp.skipBuild -Dconf.image.base="${BASE_IMAGE_REF}" \
-        -Dmaven.main.skip -Dmaven.test.skip -Dmaven.war.skip $TAG_OPTIONS \
+        -Dmaven.main.skip -Dmaven.test.skip -Dmaven.war.skip -Dmaven.smallrye.skip $TAG_OPTIONS \
         $( if (( DAMP_RUN )); then echo "-Ddocker.skip.push"; fi )
     else
       echo "Skipping Maven build as requested by DRY_RUN=1"

diff --git a/conf/solr/schema.xml b/conf/solr/schema.xml
@@ -208,6 +208,7 @@
     <field name="fileRestricted" type="boolean" stored="true" indexed="false" multiValued="false"/>
     <field name="canDownloadFile" type="boolean" stored="true" indexed="false" multiValued="false"/>
     <field name="versionNote" type="string" stored="true" indexed="false" multiValued="false"/>
+    <field name="isLinked" type="boolean" stored="true" indexed="false" multiValued="false"/>
 
     <!-- Added for Dataverse 4.0 alpha 1. This is a required field so we don't have to go to the database to get the database id of the entity. On cards we use the id in links -->
     <field name="entityId" type="plong" stored="true" indexed="true" multiValued="false"/>

diff --git a/doc/release-notes/6.12-release-notes.md b/doc/release-notes/6.12-release-notes.md
@@ -41,7 +41,7 @@ These are features that weren't already mentioned under "highlights" above.
 
 ## Other Changes
 
-- Payara 7.2026.8 is now the supported and recommended version. See upgrade instructions below and #12498. We are aware that Payara 7.2026.9 is out but it didn't "just work" so we don't recommend it yet. See #12715.
+- Payara 7.2026.9 is now the supported and recommended version. See upgrade instructions below, #12498 and #12715.
 - Database indexes were added to the guestbookresponse table to speed up queries. See #12616.
 - The QA Guide was added as an experiment in #10103 but has been removed because it has proved less useful than imagined. It can still be [viewed](https://guides.dataverse.org/en/6.11/qa/index.html) as it existed as of Dataverse 6.11. See #12582.
 
@@ -164,7 +164,7 @@ If you are running Payara as a non-root user (and you should be!), **remember no
 
 Also, we assume that Payara is installed in `/usr/local/payara7`. If not, adjust as needed.
 
-The instructions below describe the upgrade procedure based on moving your existing Payara 7.2026.2 domain directory into the new Payara 7.2026.8 distribution. We recommend this method because it is the easiest way to recreate your current configuration and preserve your data.
+The instructions below describe the upgrade procedure based on moving your existing Payara 7.2026.2 domain directory into the new Payara 7.2026.9 distribution. We recommend this method because it is the easiest way to recreate your current configuration and preserve your data.
 
 1. Undeploy Dataverse, if deployed, using the unprivileged service account ("dataverse", by default).
 
@@ -188,12 +188,12 @@ The instructions below describe the upgrade procedure based on moving your exist
    sudo mv /usr/local/payara7 /usr/local/payara7-2026.2
    ```
 
-1. Download the new Payara version 7.2026.8, and unzip it.
+1. Download the new Payara version 7.2026.9, and unzip it.
 
    ```shell
-   curl -L -O https://nexus.payara.fish/repository/payara-community/fish/payara/distributions/payara/7.2026.8/payara-7.2026.8.zip
+   curl -L -O https://nexus.payara.fish/repository/payara-community/fish/payara/distributions/payara/7.2026.9/payara-7.2026.9.zip
 
-   sudo unzip payara-7.2026.8.zip -d /usr/local/
+   sudo unzip payara-7.2026.9.zip -d /usr/local/
    ```
 1. Set permission for the service account ("dataverse" by default).
 
@@ -223,7 +223,7 @@ The instructions below describe the upgrade procedure based on moving your exist
 
 1. Update configuration files in the moved domain.
 
-   The file `glassfish-acc.xml` from Payara 7.2026.2 has been renamed to `payara-acc.xml` in Payara 7.2026.8. Also `default-logging.properties` has been updated in the Payara 7.2026.8. We recommend copying these new files from the Payara 7.2026.8 distribution domain into the domain you copied over from your Payara 7.2026.2 installation.
+   The file `glassfish-acc.xml` from Payara 7.2026.2 has been renamed to `payara-acc.xml` in Payara 7.2026.9. Also `default-logging.properties` has been updated in the Payara 7.2026.9. We recommend copying these new files from the Payara 7.2026.9 distribution domain into the domain you copied over from your Payara 7.2026.2 installation.
 
    ```shell
    sudo rm /usr/local/payara7/glassfish/domains/domain1/config/glassfish-acc.xml
@@ -257,8 +257,6 @@ The instructions below describe the upgrade procedure based on moving your exist
    sudo -u dataverse /usr/local/payara7/bin/asadmin deploy dataverse-6.12.war
    ```
 
-   Please note: when watching logs while waiting for the deployment to finish, you may encounter `SEVERE` level warnings like "Leaking injection manager found in the current thread. Very likely because it wasn't removed in a previous invocation and leaked into this invocation." We have not found severe issues during testing this release and advise to ignore but monitor for unusual resource usage. We plan to address the underlying issue with the next release. See #12715 for more details.
-
 1. Update metadata blocks.
 
    In #12346 we added the value "Translator" under "contributorType" field and we need to reload the citation.tsv file because of this.

diff --git a/doc/release-notes/6.12.1-release-notes.md b/doc/release-notes/6.12.1-release-notes.md
@@ -0,0 +1,190 @@
+# Dataverse 6.12.1
+
+Please note: To read these instructions in full, please go to https://github.com/IQSS/dataverse/releases/tag/v6.12.1 rather than the [list of releases](https://github.com/IQSS/dataverse/releases), which will cut them off.
+
+This release brings new features, enhancements, and bug fixes to Dataverse. Thank you to all of the community members who contributed code, suggestions, bug reports, and other assistance across the project!
+
+## Release Highlights
+
+Highlights for Dataverse 6.12.1 include:
+
+- Performance improvements
+- New and improved APIs
+- Bug fixes
+- Security fixes
+- Platform update: Payara upgraded to 7.2026.9
+
+## Performance Improvements
+
+### Clicking "Edit Metadata", Language Metadata Field
+
+It came to our attention that once you have created a dataset and then click "Edit Metadata" to add additional fields, it was taking 10 seconds or longer for the page to load. This was due to the thousands of languages that were being loaded for the Language metadata field. (The number of languages was greatly increased to the full ISO 639-3 list back in #10762 for Dataverse 6.4.)
+
+As of this version, the page should load much faster when you click "Edit Metadata". The UI/UX for the Language field has been changed to load languages on demand. You should also notice a similar speed up when editing templates. See #11223 and #12617.
+
+### Faster Dataset and File Pages for Datasets with Many Files
+
+The number of database queries required to load datasets and their files has been greatly reduced for large datasets: it no longer grows with the number of files, or with the number of variables of tabular files. An additional change improves the loading time of the file facets on the dataset page. The result is significantly faster dataset and file pages, and faster responses of the dataset and file listing APIs, for datasets with many files. See #12739 and #12740.
+
+## Bug Fixes
+
+- The "Cancel" button on the Guestbook Response dialogs did not close the dialog. This has been fixed. See #12205 and #12220.
+
+## Other Changes
+
+## API Updates
+
+- Search API now returns "isLinked" in the JSON response for datasets and collections that are linked. "isLinked" will also be returned in direct dataset and collection lookups. This attribute will only be included when the value is true. See #11845 and #12485.
+- When downloading a file citation it is now possible to specify the version of the dataset. See [the guides](https://guides.dataverse.org/en/6.12.1/api/dataaccess.html#citation-get-citation-in-other-formats), #12512, and #12711.
+
+## Security Updates
+
+This release contains important security updates. If you are not receiving security advisories, please sign up by following [the steps](https://guides.dataverse.org/en/latest/installation/config.html#security-advisories) in the guides (email support@dataverse.org to ask for an invite). These advisories are sent through the dataverse-security Google Group, as [announced](https://groups.google.com/g/dataverse-community/c/VQ-D0tIxVP4/m/whFIqm4HAgAJ) on the mailing list.
+
+## Notes for Dataverse Installation Administrators
+
+If you attempted a new installation of Dataverse 6.12 with PostgreSQL 16, it probably failed. (Upgrades of an existing Dataverse installation and an existing PostgreSQL 16 were not affected.) The Installation Guide has been updated to indicated that PostgreSQL 17+ is required for new installations. See [the guides](https://guides.dataverse.org/en/6.12.1/installation/prerequisites.html#postgresql), #12724 and #12738.
+
+## Complete List of Changes
+
+For the complete list of code changes in this release, see the [6.12.1 milestone](https://github.com/IQSS/dataverse/issues?q=milestone%3A6.12.1+is%3Aclosed) in GitHub.
+
+## Getting Help
+
+For help with upgrading, installing, or general questions please see [getting help](https://guides.dataverse.org/en/latest/installation/intro.html#getting-help) in the Installation Guide.
+
+## Installation
+
+If this is a new installation, please follow our [Installation Guide](https://guides.dataverse.org/en/latest/installation/). Please don't be shy about [asking for help](https://guides.dataverse.org/en/latest/installation/intro.html#getting-help) if you need it!
+
+Once you are in production, we would be delighted to update our [map of Dataverse installations around the world](https://dataverse.org/installations) to include yours! Please [create an issue](https://github.com/IQSS/dataverse-installations/issues) or email us at support@dataverse.org to join the club!
+
+You are also very welcome to join the [Global Dataverse Community Consortium](https://www.gdcc.io) (GDCC).
+
+## Upgrade Instructions
+
+Upgrading requires a maintenance window and downtime. Please plan accordingly, create backups of your database, etc.
+
+Note: These instructions assume that you are upgrading from the immediate previous version. That is to say, you've already upgraded through all the 6.x releases and are now running Dataverse 6.12. See [tags on GitHub](https://github.com/IQSS/dataverse/tags) for a list of versions. If you are running an earlier version, the only supported way to upgrade is to progress through the upgrades to all the releases in between before attempting the upgrade to this version.
+
+If you are running Payara as a non-root user (and you should be!), **remember not to execute the commands below as root**. By default, Payara runs as the `dataverse` user. In the commands below, we use sudo to run the commands as a non-root user.
+
+Also, we assume that Payara is installed in `/usr/local/payara7`. If not, adjust as needed.
+
+Payara has been upgraded to 7.2026.9. Dataverse 6.12 is not compatible with Payara 7.2026.9. You must run Dataverse 6.12.1 instead, as described below.
+
+The instructions below describe the upgrade procedure based on moving your existing Payara 7.2026.8 domain directory into the new Payara 7.2026.9 distribution. We recommend this method because it is the easiest way to recreate your current configuration and preserve your data.
+
+A quick note for admins connecting to their servers from MacOS systems: Once logged in, consider configuring your terminal as follows:
+```bash
+export TERM_PROGRAM=Apple_Terminal
+```
+You may see some junk characters added to the output of `asadmin` without it. Due, apparently, to a bug in a display library used in Payara 7.2026.9. (It appears to be harmless, functionality-wise.)
+
+1. Undeploy Dataverse, if deployed, using the unprivileged service account ("dataverse", by default).
+
+   The new version of Payara is not compatible with previous versions of Dataverse, so you should undeploy the running Dataverse 6.12 war file first.
+
+   ```shell
+   sudo -u dataverse /usr/local/payara7/bin/asadmin list-applications
+
+   sudo -u dataverse /usr/local/payara7/bin/asadmin undeploy dataverse-6.12
+   ```
+
+1. Stop Payara.
+
+   ```shell
+   sudo systemctl stop payara
+   ```
+
+1. Move the current Payara directory out of the way. Version 7.2026.8 is used in the examples below. Adjust accordingly if you are upgrading from a different version. 
+
+   ```shell
+   sudo mv /usr/local/payara7 /usr/local/payara7-2026.8
+   ```
+
+1. Download the new Payara version 7.2026.9, and unzip it.
+
+   ```shell
+   curl -L -O https://nexus.payara.fish/repository/payara-community/fish/payara/distributions/payara/7.2026.9/payara-7.2026.9.zip
+
+   sudo unzip payara-7.2026.9.zip -d /usr/local/
+   ```
+1. Set ownership of the payara distribution to root, making it read-only for the service account ("dataverse" by default).
+
+   ```shell
+   sudo chown -R root:root /usr/local/payara7
+   ```
+
+1. Replace the brand new `payara7/glassfish/domains/domain1` with your old, preserved domain1.
+
+   ```shell
+   sudo mv /usr/local/payara7/glassfish/domains/domain1 /usr/local/payara7/glassfish/domains/domain1_DIST
+
+   sudo mv /usr/local/payara7-2026.8/glassfish/domains/domain1 /usr/local/payara7/glassfish/domains/
+   ```
+
+1. Set ownership of the domain for the service account ("dataverse" by default). Ownership should have been preserved during the move above, but this step assures that the domain is writable by the service account.
+
+   ```shell
+   sudo chown -R dataverse:dataverse /usr/local/payara7/glassfish/domains/domain1
+   ```
+
+1. Remove the cache directories.
+
+   ```shell
+   sudo rm -rf /usr/local/payara7/glassfish/domains/domain1/generated/
+
+   sudo rm -rf /usr/local/payara7/glassfish/domains/domain1/osgi-cache/
+   ```
+
+1. Start Payara.
+
+   ```shell
+   sudo systemctl start payara
+   ```
+
+1. Deploy the Dataverse 6.12.1 war file.
+
+   ```shell
+   wget https://github.com/IQSS/dataverse/releases/download/v6.12.1/dataverse-6.12.1.war
+
+   sudo -u dataverse /usr/local/payara7/bin/asadmin deploy dataverse-6.12.1.war
+   ```
+
+1. Update Solr schema.
+
+   Due to changes in the Solr schema (the addition of "isLinked" in #12485), updating the Solr schema and reindexing is required.
+
+   First, back up your existing `schema.xml` file.
+
+   `sudo cp /usr/local/solr/solr-9.8.0/server/solr/collection1/conf/schema.xml /usr/local/solr/solr-9.8.0/server/solr/collection1/conf/schema.xml.orig`
+
+   (Note that Docker-based installations use this directory: `solr/data/data/collection1/conf/schema.xml`.)
+
+   Install the stock, default solr schema:
+
+   `wget https://raw.githubusercontent.com/IQSS/dataverse/v6.12.1/conf/solr/schema.xml`
+
+   `sudo cp schema.xml /usr/local/solr/solr-9.8.0/server/solr/collection1/conf`
+
+   If you do not have any custom metadata blocks, you can go directly to the "Reload the Solr core" step below.
+   If you do have custom metadata blocks, run the `update-fields.sh` script that we supply. The example below shows the default path for a non-Docker installation, but adjust the path as necessary.
+
+   `wget https://raw.githubusercontent.com/IQSS/dataverse/v6.12.1/conf/solr/update-fields.sh`
+
+   `chmod +x update-fields.sh`
+
+   `curl "http://localhost:8080/api/admin/index/solr/schema" | sudo ./update-fields.sh /usr/local/solr/solr-9.8.0/server/solr/collection1/conf/schema.xml`
+
+   Reload the Solr core
+
+   `curl "http://localhost:8983/solr/admin/cores?action=RELOAD&core=collection1"`
+
+1. Reindex Solr.
+
+   The only real change in the schema is the new "isLinked" field added in #12485, to mark linked datasets and collections in the output of the search API. If a full reindex is a quick task on your instance (for ex., it should only take a few minutes on an instance with a few hundred, or even thousands of datasets), we recommend that you do that, to be safe, via
+
+   `curl http://localhost:8080/api/admin/index`
+
+   However, if yours is one of the much larger instances where this takes a significant amount of CPU time, you may want to put more thought into it. Such as, consider whether your users will actually benefit from the field in the search API; and/or whether you actually have any linked objects in the repository in the first place. And if so, consider reindexing just the linked datasets and collections selectively. 
diff --git a/doc/sphinx-guides/source/api/dataaccess.rst b/doc/sphinx-guides/source/api/dataaccess.rst
@@ -271,8 +271,12 @@ Usage example:
   export SERVER_URL=https://demo.dataverse.org
   export DATAFILE_ID=99
   export FORMAT=EndNote
+  export VERSION=1.0
+  export API_TOKEN=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+
+  curl -H "X-Dataverse-key:$API_TOKEN" "$SERVER_URL/api/access/datafile/$DATAFILE_ID/citation/$FORMAT?version=$VERSION"
 
-  curl "$SERVER_URL/api/access/datafile/$DATAFILE_ID/citation/$FORMAT"
+The ``version`` query parameter is optional. It will default to ``:latest``. See :ref:`dataset-version-specifiers` for the list of possible values. If you request a draft, an API token with access must be provided.
 
 .. _data-variable-metadata-access:
 

diff --git a/doc/sphinx-guides/source/conf.py b/doc/sphinx-guides/source/conf.py
@@ -75,7 +75,7 @@
 # built documents.
 #
 # The short X.Y version.
-version = '6.12'
+version = '6.12.1'
 # The full version, including alpha/beta/rc tags.
 release = version