From 5962ba2fb296deb820cfa954e2ef5372c5b91192 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Thu, 9 Apr 2026 20:15:55 +0200
Subject: [PATCH 01/15] Use correct timezone to compare step scheduling

`get_last_workflow_invocation_step_update_time()` returns UTC time (it's
set by galaxy.model.orm.now.now()) while datetime.now() is your local
time.

If your system is not on UTC time this caused 5 minute scheduling delays
for steps depending on expression tools that only produce parameters.

Fixes the delay observed in https://github.com/galaxyproject/tools-iuc/pull/7314
---
 lib/galaxy/model/orm/now.py               | 14 +++++++++++---
 lib/galaxy/workflow/scheduling_manager.py |  7 ++++---
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/lib/galaxy/model/orm/now.py b/lib/galaxy/model/orm/now.py
index d44fa59f6cd..fe8dbfcb280 100644
--- a/lib/galaxy/model/orm/now.py
+++ b/lib/galaxy/model/orm/now.py
@@ -1,4 +1,7 @@
-from datetime import datetime
+from datetime import (
+    datetime,
+    timezone,
+)
 
 # NOTE REGARDING TIMESTAMPS:
 #   It is currently difficult to have the timestamps calculated by the
@@ -7,7 +10,12 @@ from datetime import datetime
 #   relies on the client's clock being set correctly, so if clustering
 #   web servers, use a time server to ensure synchronization
 
-# Return the current time in UTC without any timezone information
-now = datetime.utcnow
+
+def now():
+    """
+    Return the current time in UTC without any timezone information.
+    """
+    return datetime.now(timezone.utc).replace(tzinfo=None)
+
 
 __all__ = ("now",)
diff --git a/lib/galaxy/workflow/scheduling_manager.py b/lib/galaxy/workflow/scheduling_manager.py
index 48951ead46d..3872349cad5 100644
--- a/lib/galaxy/workflow/scheduling_manager.py
+++ b/lib/galaxy/workflow/scheduling_manager.py
@@ -12,6 +12,7 @@ import galaxy.workflow.schedulers
 from galaxy import model
 from galaxy.exceptions import HandlerAssignmentError
 from galaxy.jobs.handler import InvocationGrabber
+from galaxy.model.orm.now import now
 from galaxy.schema.invocation import (
     FailureReason,
     InvocationFailureDatasetFailed,
@@ -341,12 +342,12 @@ class WorkflowRequestMonitor(Monitors):
                 invocation_step_update_time := invocation.get_last_workflow_invocation_step_update_time()
             ):
                 do_schedule = invocation_step_update_time > last_schedule_time
-            if not do_schedule and (datetime.now() - last_schedule_time) > self.timedelta:
+            if not do_schedule and (now() - last_schedule_time) > self.timedelta:
                 # If we haven't scheduled in a while, schedule anyway.
                 log.debug(
                     "Scheduling workflow invocation [%s] after %s seconds without scheduling.",
                     invocation.id,
-                    (datetime.now() - last_schedule_time).total_seconds(),
+                    (now() - last_schedule_time).total_seconds(),
                 )
                 do_schedule = True
             return do_schedule
@@ -449,7 +450,7 @@ class WorkflowRequestMonitor(Monitors):
                         if i.active and i.id < workflow_invocation.id:
                             return False
                 if self.ready_to_schedule_more(workflow_invocation):
-                    self.update_time_tracking_dict[invocation_id] = datetime.now()
+                    self.update_time_tracking_dict[invocation_id] = now()
                     workflow_scheduler.schedule(workflow_invocation)
                     log.debug("Workflow invocation [%s] scheduled", invocation_id)
             except Exception:

From 4eaaeafc24065e359db6c8d80170834624dbc386 Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Tue, 21 Apr 2026 15:14:12 -0500
Subject: [PATCH 02/15] [26.0] Fix `WorkflowAnnotation` wrapping consistencies

Fixes https://github.com/galaxyproject/galaxy/issues/22329
---
 .../components/History/TargetHistoryLink.vue  |  2 +-
 client/src/components/ProgressBar.vue         |  3 +
 .../Workflow/WorkflowAnnotation.vue           | 78 +++++++++++++++----
 .../WorkflowInvocationState.vue               | 18 +----
 4 files changed, 70 insertions(+), 31 deletions(-)

diff --git a/client/src/components/History/TargetHistoryLink.vue b/client/src/components/History/TargetHistoryLink.vue
index 337642ca3a3..c404c4025f8 100644
--- a/client/src/components/History/TargetHistoryLink.vue
+++ b/client/src/components/History/TargetHistoryLink.vue
@@ -38,7 +38,7 @@ const isCurrentTargetHistory = computed(() => {
                 v-else
                 v-b-tooltip.hover.noninteractive
                 data-description="not current history indicator"
-                class="text-warning"
+                class="text-warning text-nowrap"
                 title="This history is not your currently active history. You can click the link to switch to it.">
                 (not current)
             </span>
diff --git a/client/src/components/ProgressBar.vue b/client/src/components/ProgressBar.vue
index eb10d0bbe24..42924b57ae4 100644
--- a/client/src/components/ProgressBar.vue
+++ b/client/src/components/ProgressBar.vue
@@ -43,6 +43,9 @@ const props = withDefaults(defineProps<Props>(), {
     position: absolute;
     text-align: center;
     width: 100%;
+    white-space: nowrap;
+    overflow: hidden;
+    text-overflow: ellipsis;
 }
 .progress-container {
     position: relative;
diff --git a/client/src/components/Workflow/WorkflowAnnotation.vue b/client/src/components/Workflow/WorkflowAnnotation.vue
index 6425b9e62f9..7077b7ebf62 100644
--- a/client/src/components/Workflow/WorkflowAnnotation.vue
+++ b/client/src/components/Workflow/WorkflowAnnotation.vue
@@ -42,7 +42,7 @@ const workflowTags = computed(() => {
 <template>
     <div v-if="workflow" class="pb-2 pl-2">
         <div class="d-flex justify-content-between align-items-center">
-            <div>
+            <div class="annotation-left">
                 <i v-if="timeElapsed" data-description="workflow annotation time info">
                     <FontAwesomeIcon :icon="faClock" class="mr-1" />
                     <span v-localize>
@@ -52,9 +52,11 @@ const workflowTags = computed(() => {
                 </i>
                 <TargetHistoryLink v-if="props.invocationCreateTime" :target-history-id="props.historyId" />
             </div>
-            <slot name="middle-content" />
-            <div class="d-flex align-items-center">
-                <div class="d-flex flex-column align-items-end mr-2 flex-gapy-1">
+            <div class="annotation-middle">
+                <slot name="middle-content" />
+            </div>
+            <div class="annotation-right">
+                <div class="annotation-right-content">
                     <WorkflowIndicators :workflow="workflow" published-view no-edit-time />
                     <WorkflowInvocationsCount v-if="owned" class="mr-1" :workflow="workflow" />
                 </div>
@@ -69,16 +71,66 @@ const workflowTags = computed(() => {
 </template>
 
 <style scoped lang="scss">
-.history-link-wrapper {
-    max-width: 300px;
+// Left column: 35% of the width
+.annotation-left {
+    flex: 1 1 0;
+    max-width: 35%;
+    min-width: 0;
+    overflow: hidden;
 
-    &:deep(.history-link) {
-        .history-link-click {
-            overflow: hidden;
-            white-space: nowrap;
-            text-overflow: ellipsis;
-            display: block;
-        }
+    // Ensure neither the history name nor "(current)" escape the column.
+    :deep(.history-link-wrapper) {
+        min-width: 0;
+        overflow: hidden;
+    }
+
+    // SwitchToHistoryLink root div must be able to shrink to 0 so the
+    // "(current)" label stays visible as long as there is any room.
+    :deep(.history-link-wrapper > div) {
+        min-width: 0;
+        overflow: hidden;
+    }
+
+    :deep(.history-link) {
+        min-width: 0;
+    }
+
+    :deep(.history-link-click) {
+        overflow: hidden;
+        white-space: nowrap;
+        text-overflow: ellipsis;
+        display: block;
+    }
+}
+
+// Middle column: 30% of the width
+.annotation-middle {
+    flex: 1 1 0;
+    max-width: 30%;
+    min-width: 0;
+}
+
+// Right column: 35% of the width
+.annotation-right {
+    flex: 1 1 0;
+    max-width: 35%;
+    min-width: 0;
+    overflow: hidden;
+    justify-content: flex-end;
+
+    .annotation-right-content {
+        display: flex;
+        flex-direction: column;
+        align-items: flex-end;
+        gap: 0.25rem;
+        min-width: 0;
+        overflow: hidden;
+    }
+
+    // Ensure creator badges stay within the column instead of overflowing
+    :deep(.workflow-indicators) {
+        flex-wrap: wrap;
+        justify-content: flex-end;
     }
 }
 </style>
diff --git a/client/src/components/WorkflowInvocationState/WorkflowInvocationState.vue b/client/src/components/WorkflowInvocationState/WorkflowInvocationState.vue
index 6fd67f6b990..a176abc2783 100644
--- a/client/src/components/WorkflowInvocationState/WorkflowInvocationState.vue
+++ b/client/src/components/WorkflowInvocationState/WorkflowInvocationState.vue
@@ -310,7 +310,7 @@ async function onCancel() {
             :invocation-create-time="invocation.create_time"
             :history-id="invocation.history_id">
             <template v-slot:middle-content>
-                <div class="progress-bars mx-1">
+                <div class="w-100 mx-1">
                     <ProgressBar
                         v-if="!stepCount"
                         note="Loading step state summary..."
@@ -511,19 +511,3 @@ async function onCancel() {
     }
 }
 </style>
-
-<style scoped lang="scss">
-.progress-bars {
-    // progress bar shrinks to fit divs on either side
-    flex-grow: 1;
-    flex-shrink: 1;
-    max-width: 50%;
-
-    .steps-progress,
-    .jobs-progress {
-        // truncate text in progress bars
-        white-space: nowrap;
-        overflow: hidden;
-    }
-}
-</style>

From 5572aa4d655b574ae22a976ea46f1f42a17f9359 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Wed, 22 Apr 2026 14:56:36 +0200
Subject: [PATCH 03/15] Fix crash merging structurally invalid nested
 collections

`__recursively_create_collections_for_elements` called `.get("src")` on
every non-`DatasetCollection` element, assuming a `{"src": "new_collection"}`
descriptor dict. When `MERGE_COLLECTION` is given inputs that yield a
`list:paired` with a bare HDA in place of a sub-pair, the HDA reaches this
loop and raises `AttributeError`, short-circuiting the downstream
`_validate_nested_collection_elements` that would have returned a clean
`RequestParameterInvalidException`.

Guard the materialization loop with `isinstance(element, dict)` so non-dict
elements pass through untouched and validation issues the proper user error.

Fixes https://github.com/galaxyproject/galaxy/issues/22544 and GALAXY-MAIN-4KSCZZZ0015Z5
---
 lib/galaxy/managers/collections.py |  5 +----
 lib/galaxy_test/api/test_tools.py  | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/lib/galaxy/managers/collections.py b/lib/galaxy/managers/collections.py
index 2a81db4ee3a..ef1fd924b2f 100644
--- a/lib/galaxy/managers/collections.py
+++ b/lib/galaxy/managers/collections.py
@@ -638,10 +638,7 @@ class DatasetCollectionManager:
 
         new_elements = {}
         for key, element in elements.items():
-            if isinstance(element, DatasetCollection):
-                continue
-
-            if element.get("src") != "new_collection":
+            if not isinstance(element, dict) or element.get("src") != "new_collection":
                 continue
 
             # element is a dict with src new_collection and
diff --git a/lib/galaxy_test/api/test_tools.py b/lib/galaxy_test/api/test_tools.py
index 3b26545f7b9..144ad8b727f 100644
--- a/lib/galaxy_test/api/test_tools.py
+++ b/lib/galaxy_test/api/test_tools.py
@@ -23,6 +23,7 @@ from galaxy.util import galaxy_root_path
 from galaxy_test.base import rules_test_data
 from galaxy_test.base.api_asserts import (
     assert_error_code_is,
+    assert_error_message_contains,
     assert_file_looks_like_xlsx,
     assert_has_keys,
     assert_status_code_is,
@@ -810,6 +811,24 @@ class TestToolsApi(ApiTestCase, TestsTools):
             )
             assert zipped_hdca["collection_type"] == "list:paired"
 
+    @skip_without_tool("__MERGE_COLLECTION__")
+    def test_merge_collection_rejects_structurally_invalid_inputs(self):
+        with self.dataset_populator.test_history(require_new=False) as history_id:
+            list_paired_id = self.dataset_collection_populator.create_list_of_pairs_in_history(
+                history_id, wait=True
+            ).json()["outputs"][0]["id"]
+            plain_list_id = self.dataset_collection_populator.create_list_in_history(
+                history_id, contents=["a", "b"], wait=True
+            ).json()["outputs"][0]["id"]
+            self.dataset_populator.wait_for_history(history_id, assert_ok=True)
+            inputs = {
+                "inputs_0|input": {"src": "hdca", "id": list_paired_id},
+                "inputs_1|input": {"src": "hdca", "id": plain_list_id},
+            }
+            response = self._run("__MERGE_COLLECTION__", history_id, inputs, assert_ok=False)
+            assert_status_code_is(response, 400)
+            assert_error_message_contains(response, "must be a sub-collection")
+
     @skip_without_tool("__EXTRACT_DATASET__")
     @skip_without_tool("cat_data_and_sleep")
     def test_database_operation_tool_with_pending_inputs(self):

From fddee64ea46018c7fe35185b36ec02a135abfc02 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Wed, 22 Apr 2026 10:03:01 +0200
Subject: [PATCH 04/15] Handle list-valued tool_id in ToolRunner.__get_tool

When a POST to /tool_runner arrives with `tool_id` repeated (some data
source tools redirect back with duplicated parameters), webob's
`params.mixed()` delivers it as a list. Commit 30cc4e6bf04 ("Remove
unused ToolBox.get_tool_components") dropped the `listify()`
normalization that previously masked this; `tool_id.rstrip("/")` now
raises `AttributeError: 'list' object has no attribute 'rstrip'`.

Collapse duplicate values to a single id, and raise
`RequestParameterInvalidException` if the list contains conflicting ids.

Fixes https://github.com/galaxyproject/galaxy/issues/22543
---
 lib/galaxy/webapps/galaxy/controllers/tool_runner.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/galaxy/webapps/galaxy/controllers/tool_runner.py b/lib/galaxy/webapps/galaxy/controllers/tool_runner.py
index b8d09529ab5..40b12cbd2ce 100644
--- a/lib/galaxy/webapps/galaxy/controllers/tool_runner.py
+++ b/lib/galaxy/webapps/galaxy/controllers/tool_runner.py
@@ -8,6 +8,7 @@ from markupsafe import escape
 
 import galaxy.util
 from galaxy import web
+from galaxy.exceptions import RequestParameterInvalidException
 from galaxy.model import HistoryDatasetAssociation
 from galaxy.tool_util.identifiers import uri_safe_tool_id
 from galaxy.tools import DataSourceTool
@@ -39,6 +40,14 @@ class ToolRunner(BaseUIController):
         return self.index(trans, tool_id=tool_id, **kwd)
 
     def __get_tool(self, tool_id, tool_version=None):
+        # webob's params.mixed() returns a list when a form/query key is repeated
+        # (some data sources redirect back with tool_id duplicated); accept that
+        # case only when every value agrees.
+        if isinstance(tool_id, list):
+            unique_ids = set(tool_id)
+            if len(unique_ids) != 1:
+                raise RequestParameterInvalidException(f"Conflicting tool_id values supplied: {tool_id!r}")
+            tool_id = unique_ids.pop()
         # Some data sources send back redirects ending with `/`, this takes care of that case
         tool_id = tool_id.rstrip("/")
         return self.get_toolbox().get_tool(tool_id, tool_version=tool_version)

From 52dbfaf7050b4248d06d2a38cbed0947bf90a816 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Wed, 22 Apr 2026 15:34:31 +0200
Subject: [PATCH 05/15] Replace per-term joins in workflow search with EXISTS
 subqueries

Free-text search added one outer join on stored_workflow_tag_association
and one on galaxy_user per whitespace-separated term, producing ~2N joins
over a DISTINCT that is unusable for long queries (observed: 12-word
search generating 26 joins).
---
 lib/galaxy/managers/workflows.py      | 30 +++++++++++++--------------
 lib/galaxy/model/index_filter_util.py | 30 +++++++++++++++++++++++++++
 lib/galaxy_test/api/test_workflows.py | 11 ++++++++++
 3 files changed, 55 insertions(+), 16 deletions(-)

diff --git a/lib/galaxy/managers/workflows.py b/lib/galaxy/managers/workflows.py
index 3a917c61949..f36f48bc0fd 100644
--- a/lib/galaxy/managers/workflows.py
+++ b/lib/galaxy/managers/workflows.py
@@ -38,7 +38,6 @@ from sqlalchemy import (
     true,
 )
 from sqlalchemy.orm import (
-    aliased,
     joinedload,
     subqueryload,
 )
@@ -74,10 +73,10 @@ from galaxy.model import (
 )
 from galaxy.model.base import ensure_object_added_to_session
 from galaxy.model.index_filter_util import (
-    append_user_filter,
     raw_text_column_filter,
-    tag_filter,
+    tag_exists_filter,
     text_column_filter,
+    user_exists_filter,
 )
 from galaxy.model.item_attrs import UsesAnnotations
 from galaxy.schema.invocation import InvocationCancellationUserRequest
@@ -213,11 +212,14 @@ class WorkflowsManager(sharable.SharableModelManager[model.StoredWorkflow], dele
             search_query = payload.search
             parsed_search = parse_filters_structured(search_query, INDEX_SEARCH_FILTERS)
 
-            def w_tag_filter(term_text: str, quoted: bool):
-                nonlocal stmt
-                alias = aliased(StoredWorkflowTagAssociation)
-                stmt = stmt.outerjoin(StoredWorkflow.tags.of_type(alias))
-                return tag_filter(alias, term_text, quoted)
+            def w_tag_exists(term_text: str, quoted: bool):
+                return tag_exists_filter(
+                    StoredWorkflowTagAssociation,
+                    StoredWorkflowTagAssociation.stored_workflow_id,
+                    StoredWorkflow.id,
+                    term_text,
+                    quoted,
+                )
 
             def name_filter(term):
                 return text_column_filter(StoredWorkflow.name, term)
@@ -227,12 +229,11 @@ class WorkflowsManager(sharable.SharableModelManager[model.StoredWorkflow], dele
                     key = term.filter
                     q = term.text
                     if key == "tag":
-                        tf = w_tag_filter(term.text, term.quoted)
-                        stmt = stmt.where(tf)
+                        stmt = stmt.where(w_tag_exists(term.text, term.quoted))
                     elif key == "name":
                         stmt = stmt.where(name_filter(term))
                     elif key == "user":
-                        stmt = append_user_filter(stmt, StoredWorkflow, term)
+                        stmt = stmt.where(user_exists_filter(StoredWorkflow.user_id, term.text))
                     elif key == "is":
                         if q == "published":
                             stmt = stmt.where(StoredWorkflow.published == true())
@@ -260,15 +261,12 @@ class WorkflowsManager(sharable.SharableModelManager[model.StoredWorkflow], dele
                                 model.StoredWorkflowMenuEntry.stored_workflow_id == StoredWorkflow.id,
                             ).where(model.StoredWorkflowMenuEntry.user_id == user.id)
                 elif isinstance(term, RawTextTerm):
-                    tf = w_tag_filter(term.text, False)
-                    alias = aliased(User)
-                    stmt = stmt.outerjoin(StoredWorkflow.user.of_type(alias))
                     stmt = stmt.where(
                         raw_text_column_filter(
                             [
                                 StoredWorkflow.name,
-                                tf,
-                                alias.username,
+                                w_tag_exists(term.text, False),
+                                user_exists_filter(StoredWorkflow.user_id, term.text),
                             ],
                             term,
                         )
diff --git a/lib/galaxy/model/index_filter_util.py b/lib/galaxy/model/index_filter_util.py
index 1b339e3224d..1cb75a26b81 100644
--- a/lib/galaxy/model/index_filter_util.py
+++ b/lib/galaxy/model/index_filter_util.py
@@ -7,6 +7,7 @@ from typing import (
 from sqlalchemy import (
     and_,
     or_,
+    select,
 )
 from sqlalchemy.orm import (
     aliased,
@@ -68,3 +69,32 @@ def append_user_filter(query, model_class, term: FilteredTerm):
     query = query.outerjoin(model_class.user.of_type(alias))
     query = query.filter(text_column_filter(alias.username, term))
     return query
+
+
+def tag_exists_filter(association_model_class, fk_column, parent_id_column, term_text, quoted: bool = False):
+    """Correlated EXISTS subquery that matches any tag on the parent row against term_text.
+
+    Prefer this over adding a per-term outer join on the tag-association table: each
+    extra outer join multiplies rows (forcing an expensive DISTINCT) and in free-text
+    search N whitespace-separated terms produce N such joins.
+    """
+    return (
+        select(1)
+        .select_from(association_model_class)
+        .where(fk_column == parent_id_column)
+        .where(tag_filter(association_model_class, term_text, quoted))
+        .correlate_except(association_model_class)
+        .exists()
+    )
+
+
+def user_exists_filter(owner_id_column, term_text: str):
+    """Correlated EXISTS subquery that matches the owning user's username."""
+    return (
+        select(1)
+        .select_from(model.User)
+        .where(model.User.id == owner_id_column)
+        .where(model.User.username.ilike(f"%{term_text}%"))
+        .correlate_except(model.User)
+        .exists()
+    )
diff --git a/lib/galaxy_test/api/test_workflows.py b/lib/galaxy_test/api/test_workflows.py
index b2abb445492..deb40815f15 100644
--- a/lib/galaxy_test/api/test_workflows.py
+++ b/lib/galaxy_test/api/test_workflows.py
@@ -683,6 +683,17 @@ steps:
             assert workflow_id_2 not in index_ids
             assert workflow_id_3 not in index_ids
 
+    def test_index_search_many_terms(self):
+        # Regression: a whitespace-rich search string used to add one outer join
+        # on stored_workflow_tag_association and one on galaxy_user per term,
+        # producing an unusably expensive query for long searches.
+        name = f"Copy of Genomic Assembly and analysis - RDH shared by user {uuid4()}"
+        workflow_id = self.workflow_populator.simple_workflow(name)
+        self.workflow_populator.set_tags(workflow_id, [f"manyterms-{uuid4()}"])
+        search = "Copy of Genomic Assembly and analysis - RDH shared by user"
+        index_ids = self.workflow_populator.index_ids(search=search)
+        assert workflow_id in index_ids
+
     def test_search_casing(self):
         name1, name2 = (
             self.dataset_populator.get_random_name().upper(),

From 6367e4a3774e0d673add48ce48c7e4cced08410f Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Mon, 20 Apr 2026 18:14:29 -0500
Subject: [PATCH 06/15] fix TypeError when generating tour for tool with
 boolean conditional case

Fixes https://github.com/galaxyproject/galaxy/issues/22460

Co-Authored-By: Claude <noreply@anthropic.com>
---
 lib/galaxy/managers/tours.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/galaxy/managers/tours.py b/lib/galaxy/managers/tours.py
index bf39a426555..e65d29053a3 100644
--- a/lib/galaxy/managers/tours.py
+++ b/lib/galaxy/managers/tours.py
@@ -247,7 +247,7 @@ class TourGenerator:
                                 dataset = self._test.inputs[tour_id][0]
                                 step_msg = f"Select dataset: <b>{hid}: {dataset}</b>"
                             else:
-                                case_params = ", ".join(self._test.inputs[tour_id])
+                                case_params = ", ".join(str(v) for v in self._test.inputs[tour_id])
                                 step_msg = f"Select parameter(s): <b>{case_params}</b>"
                             cond_case_steps.append(
                                 TourStep(

From 6951edd21cdbdda12a7c544cb7c7694c2ffb3228 Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Tue, 21 Apr 2026 15:42:39 -0500
Subject: [PATCH 07/15] ensure tour uses string `Yes`/`No` rather than
 stringified booleans

---
 lib/galaxy/managers/tours.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/galaxy/managers/tours.py b/lib/galaxy/managers/tours.py
index e65d29053a3..e4b9b2e9af1 100644
--- a/lib/galaxy/managers/tours.py
+++ b/lib/galaxy/managers/tours.py
@@ -247,7 +247,10 @@ class TourGenerator:
                                 dataset = self._test.inputs[tour_id][0]
                                 step_msg = f"Select dataset: <b>{hid}: {dataset}</b>"
                             else:
-                                case_params = ", ".join(str(v) for v in self._test.inputs[tour_id])
+                                case_params = ", ".join(
+                                    ("Yes" if v is True else "No" if v is False else str(v))
+                                    for v in self._test.inputs[tour_id]
+                                )
                                 step_msg = f"Select parameter(s): <b>{case_params}</b>"
                             cond_case_steps.append(
                                 TourStep(

From d781a5975147f686b488c37d340a4333f0dd1d36 Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Wed, 22 Apr 2026 15:16:51 -0500
Subject: [PATCH 08/15] add selenium to test boolean conditional tool
 describing tour

---
 .../selenium/test_tool_describing_tours.py           | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/galaxy_test/selenium/test_tool_describing_tours.py b/lib/galaxy_test/selenium/test_tool_describing_tours.py
index ba1f4ed50ed..a428b00269b 100644
--- a/lib/galaxy_test/selenium/test_tool_describing_tours.py
+++ b/lib/galaxy_test/selenium/test_tool_describing_tours.py
@@ -61,3 +61,15 @@ class TestToolDescribingTours(SeleniumTestCase):
         self.tool_form_execute()
         self.history_panel_wait_for_hid_ok(2)
         self.screenshot("tool_describing_tour_3_after_execute")
+
+    @selenium_test
+    def test_generate_tour_boolean_conditional(self):
+        """Regression test for https://github.com/galaxyproject/galaxy/issues/22460.
+
+        Generating a tour for a tool whose conditional has a boolean inner parameter
+        (explicitly set in the first test case) previously raised a TypeError.
+        """
+        self.tool_open("gx_conditional_boolean")
+        self.tool_form_generate_tour()
+        popover_component = self.components.tour.popover._
+        popover_component.wait_for_visible()

From e453fdcceeb1bc435efa1126d864692ccf362252 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Thu, 23 Apr 2026 12:54:32 +0200
Subject: [PATCH 09/15] exercise buggy tour path and assert rendered value in
 selenium test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a first test case to gx_conditional_boolean that sets the inner
boolean_parameter explicitly, so TourGenerator enters the branch that
previously crashed on `", ".join([True])`. The selenium test walks the
popovers and asserts the inner step renders "Yes" — verifying both the
TypeError fix and the Yes/No rendering fix.
---
 .../selenium/test_tool_describing_tours.py    | 19 ++++++++++++++-----
 .../parameters/gx_conditional_boolean.xml     | 13 +++++++++++++
 2 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/lib/galaxy_test/selenium/test_tool_describing_tours.py b/lib/galaxy_test/selenium/test_tool_describing_tours.py
index a428b00269b..89212814b8a 100644
--- a/lib/galaxy_test/selenium/test_tool_describing_tours.py
+++ b/lib/galaxy_test/selenium/test_tool_describing_tours.py
@@ -64,12 +64,21 @@ class TestToolDescribingTours(SeleniumTestCase):
 
     @selenium_test
     def test_generate_tour_boolean_conditional(self):
-        """Regression test for https://github.com/galaxyproject/galaxy/issues/22460.
-
-        Generating a tour for a tool whose conditional has a boolean inner parameter
-        (explicitly set in the first test case) previously raised a TypeError.
-        """
         self.tool_open("gx_conditional_boolean")
         self.tool_form_generate_tour()
         popover_component = self.components.tour.popover._
         popover_component.wait_for_visible()
+
+        # Intro step: advance to the outer conditional step.
+        popover_component.next.wait_for_and_click()
+        self.sleep_for(self.wait_types.UX_RENDER)
+        # Advance to the inner boolean_parameter case step.
+        popover_component.next.wait_for_and_click()
+        self.sleep_for(self.wait_types.UX_RENDER)
+
+        # tests[0] specifies boolean_parameter="true" → tour should render "Yes".
+        text = popover_component.content.wait_for_visible().text
+        assert "Yes" in text, text
+
+        popover_component.end.wait_for_and_click()
+        popover_component.wait_for_absent_or_hidden()
diff --git a/test/functional/tools/parameters/gx_conditional_boolean.xml b/test/functional/tools/parameters/gx_conditional_boolean.xml
index 7c5feffab0e..7008e1c4a6f 100644
--- a/test/functional/tools/parameters/gx_conditional_boolean.xml
+++ b/test/functional/tools/parameters/gx_conditional_boolean.xml
@@ -16,6 +16,19 @@
         </conditional>
     </inputs>
     <tests>
+        <test>
+            <conditional name="conditional_parameter">
+                <param name="test_parameter" value="false" />
+                <param name="boolean_parameter" value="true" />
+            </conditional>
+            <expand macro="assert_output">
+                <has_line line="test: false" />
+            </expand>
+            <expand macro="assert_inputs_json">
+                <has_json_property_with_value property="test_parameter" value="false" />
+                <has_json_property_with_value property="boolean_parameter" value="true" />
+            </expand>
+        </test>
         <test>
             <expand macro="assert_output">
                 <has_line line="test: false" />

From c1dae3bad4cc88f437a0ca6898a8268f62ffa529 Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Fri, 24 Apr 2026 14:57:33 +0200
Subject: [PATCH 10/15] Fixes notification channels not processed correctly

Ensures all configured notification channels are used by referencing the correct class-level fields in new versions of pydantic.
---
 lib/galaxy/managers/notification.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/galaxy/managers/notification.py b/lib/galaxy/managers/notification.py
index 6891ae4f6a5..a15a9d5adf3 100644
--- a/lib/galaxy/managers/notification.py
+++ b/lib/galaxy/managers/notification.py
@@ -240,7 +240,7 @@ class NotificationManager:
         return self._is_subscribed_to_category(category_settings)
 
     def _send_via_channels(self, notification: Notification, user: User, channel_settings: NotificationChannelSettings):
-        channels = channel_settings.model_fields_set
+        channels = type(channel_settings).model_fields
         for channel in channels:
             if channel not in self.channel_plugins:
                 continue  # Skip unsupported channels

From 4d38f3025550a99ae79845a91c3d098ad7d4d96a Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Fri, 24 Apr 2026 15:31:42 +0200
Subject: [PATCH 11/15] Add regression test for notification channel logic

Ensures all notification channel settings are respected by verifying
that only enabled channels invoke their plugins. Prevents regressions
where default channel values might be ignored.
---
 .../app/managers/test_NotificationManager.py  | 24 ++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/test/unit/app/managers/test_NotificationManager.py b/test/unit/app/managers/test_NotificationManager.py
index ef87fa605a1..05a7466f3d2 100644
--- a/test/unit/app/managers/test_NotificationManager.py
+++ b/test/unit/app/managers/test_NotificationManager.py
@@ -6,7 +6,10 @@ from typing import (
     Any,
     Optional,
 )
-from unittest.mock import patch
+from unittest.mock import (
+    MagicMock,
+    patch,
+)
 
 import pytest
 
@@ -395,6 +398,25 @@ class TestUserNotifications(NotificationManagerBaseTestCase):
         user_notifications = self.notification_manager.get_user_notifications(user)
         assert len(user_notifications) == 1
 
+    def test_send_via_channels_uses_all_channel_fields(self):
+        user = self._create_test_user()
+        notification_data = NotificationCreateData(**self._default_test_notification_data())
+        notification = self.notification_manager._create_notification_model(notification_data)
+
+        push_plugin = MagicMock()
+        email_plugin = MagicMock()
+        self.notification_manager.channel_plugins = {
+            "push": push_plugin,
+            "email": email_plugin,
+        }
+
+        # `email` remains at its default value (True) and should still be considered.
+        channel_settings = NotificationChannelSettings(push=False)
+        self.notification_manager._send_via_channels(notification, user, channel_settings)
+
+        push_plugin.send.assert_not_called()
+        email_plugin.send.assert_called_once_with(notification, user)
+
 
 class TestUserNotificationsWithTasks(NotificationManagerBaseTestCaseWithTasks):
 

From fa886dcf2811a27271dc44e86701a3b461b7af28 Mon Sep 17 00:00:00 2001
From: davelopez <46503462+davelopez@users.noreply.github.com>
Date: Fri, 24 Apr 2026 17:13:42 +0200
Subject: [PATCH 12/15] Simplifies notification channel iteration logic

Refactors notification dispatch to iterate directly over available plugins, avoiding reliance on channel settings' model fields ensuring only supported channels are processed.

Co-authored-by: Copilot <copilot@github.com>
---
 lib/galaxy/managers/notification.py | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/lib/galaxy/managers/notification.py b/lib/galaxy/managers/notification.py
index a15a9d5adf3..b5a98f34fb4 100644
--- a/lib/galaxy/managers/notification.py
+++ b/lib/galaxy/managers/notification.py
@@ -240,15 +240,11 @@ class NotificationManager:
         return self._is_subscribed_to_category(category_settings)
 
     def _send_via_channels(self, notification: Notification, user: User, channel_settings: NotificationChannelSettings):
-        channels = type(channel_settings).model_fields
-        for channel in channels:
-            if channel not in self.channel_plugins:
-                continue  # Skip unsupported channels
+        for channel, plugin in self.channel_plugins.items():
             user_opted_out = getattr(channel_settings, channel, False) is False
             if user_opted_out and not self._is_urgent(notification):
                 continue  # Skip sending to opted-out users unless it's an urgent notification
             try:
-                plugin = self.channel_plugins[channel]
                 plugin.send(notification, user)
             except Exception as e:
                 log.error(

From 6a1a763cdcd7ae152d0fbe97bceeb95e60e1ae9f Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Sat, 25 Apr 2026 08:41:04 +0200
Subject: [PATCH 13/15] Cancel background traffic before login/register so
 session cookie isn't clobbered
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When handle_user_login invalidates the previous anonymous session and a
concurrent request using the old cookie is still in flight, the server
creates a *new* anonymous session for it and responds with a fresh
`Set-Cookie: galaxysession=<anon>`. If that response lands between the
login POST and the full-page navigation, the browser navigates with the
anonymous cookie and the new page loads logged out.

Fix: synchronously stop the polling watchers and rotate a shared
AbortController before sending the login/register POST. The shared signal
is wired through both axios (via a request interceptor) and the
GalaxyApi/openapi-fetch client (via a request middleware) so a single
rotation cancels every in-flight request, regardless of transport. With
no in-flight anonymous-cookie request, the server can't emit the
clobbering Set-Cookie, and the authenticated cookie survives until
navigation.

Backport of the relevant pieces of #22513 (sse-notifications) for
release_26.0 — the same race exists outside SSE because it is the
in-flight polling/REST traffic, not the SSE stream itself, that carries
the stale cookie.
---
 client/src/api/client/index.ts                |  4 ++
 .../api/client/pendingRequestsMiddleware.ts   | 24 ++++++++
 client/src/api/pendingRequests.ts             | 58 +++++++++++++++++++
 client/src/components/Login/LoginForm.vue     | 23 ++++++--
 .../src/components/Register/RegisterForm.vue  | 27 ++++++---
 client/src/composables/useAuthNavigation.ts   | 25 ++++++++
 client/src/entry/analysis/index.ts            |  7 +++
 client/src/stores/entryPointStore.ts          | 10 ++--
 client/src/stores/historyStore.ts             | 16 ++---
 client/src/stores/notificationsStore.ts       | 10 ++--
 10 files changed, 175 insertions(+), 29 deletions(-)
 create mode 100644 client/src/api/client/pendingRequestsMiddleware.ts
 create mode 100644 client/src/api/pendingRequests.ts
 create mode 100644 client/src/composables/useAuthNavigation.ts

diff --git a/client/src/api/client/index.ts b/client/src/api/client/index.ts
index 5e1d4d09c85..98a35938777 100644
--- a/client/src/api/client/index.ts
+++ b/client/src/api/client/index.ts
@@ -1,5 +1,6 @@
 import createClient from "openapi-fetch";
 
+import { pendingRequestsMiddleware } from "@/api/client/pendingRequestsMiddleware";
 import { createRateLimiterMiddleware } from "@/api/client/rateLimiter";
 import type { GalaxyApiPaths } from "@/api/schema";
 import { getAppRoot } from "@/onload/loadConfig";
@@ -12,6 +13,9 @@ function getBaseUrl() {
 function apiClientFactory() {
     const client = createClient<GalaxyApiPaths>({ baseUrl: getBaseUrl() });
 
+    // Registered first so aborted requests bypass the rate-limiter queue.
+    client.use(pendingRequestsMiddleware);
+
     // TODO: Adjust based on server limits (maybe this goes in Galaxy config?)
     client.use(
         createRateLimiterMiddleware({
diff --git a/client/src/api/client/pendingRequestsMiddleware.ts b/client/src/api/client/pendingRequestsMiddleware.ts
new file mode 100644
index 00000000000..04eb4b2c11a
--- /dev/null
+++ b/client/src/api/client/pendingRequestsMiddleware.ts
@@ -0,0 +1,24 @@
+import type { Middleware } from "openapi-fetch";
+
+import { getPendingAbortSignal, SKIP_PENDING_REQUESTS_HEADER } from "@/api/pendingRequests";
+
+/**
+ * Attaches the shared pending-requests signal to every ``GalaxyApi`` request.
+ * The ``openapi-fetch`` client uses native ``fetch()`` so the axios
+ * interceptor does not apply; without this middleware, login/register
+ * navigations cannot cancel in-flight ``/api/...`` calls and a late
+ * anonymous-cookie response can clobber the authenticated ``galaxysession``
+ * cookie. See ``client/src/api/pendingRequests.ts`` for the race.
+ */
+export const pendingRequestsMiddleware: Middleware = {
+    async onRequest({ request }) {
+        if (request.headers.has(SKIP_PENDING_REQUESTS_HEADER)) {
+            const headers = new Headers(request.headers);
+            headers.delete(SKIP_PENDING_REQUESTS_HEADER);
+            return new Request(request, { headers });
+        }
+        const shared = getPendingAbortSignal();
+        const signal = typeof AbortSignal.any === "function" ? AbortSignal.any([request.signal, shared]) : shared;
+        return new Request(request, { signal });
+    },
+};
diff --git a/client/src/api/pendingRequests.ts b/client/src/api/pendingRequests.ts
new file mode 100644
index 00000000000..cbae404bd40
--- /dev/null
+++ b/client/src/api/pendingRequests.ts
@@ -0,0 +1,58 @@
+/**
+ * Shared ``AbortController`` used by both the axios interceptor and the
+ * ``openapi-fetch`` middleware so we can cancel every in-flight request in
+ * one shot right before a login/register navigation.
+ *
+ * Why this exists: when the server processes a request that carries the old
+ * anonymous ``galaxysession`` cookie *after* ``handle_user_login`` has marked
+ * that session ``is_valid=False``, it creates a fresh anonymous session and
+ * responds with ``Set-Cookie: galaxysession=<new>``. Delivered into the cookie
+ * jar after the login response but before the new page loads, it overwrites
+ * the just-issued authenticated cookie — so the new page loads anonymous and
+ * ``wait_for_logged_in`` times out in selenium. Aborting the TCP connection
+ * before the response headers are parsed prevents that ``Set-Cookie`` from
+ * ever applying.
+ */
+import axios, { type InternalAxiosRequestConfig } from "axios";
+
+let activeController = new AbortController();
+
+/** Explicit opt-out header that the login/register POST itself sets. */
+export const SKIP_PENDING_REQUESTS_HEADER = "x-galaxy-skip-pending-abort";
+
+/**
+ * The signal every request should ride on by default. Read lazily so the
+ * ``openapi-fetch`` middleware picks up the fresh signal after each
+ * ``cancelPendingRequests()`` rotation.
+ */
+export function getPendingAbortSignal(): AbortSignal {
+    return activeController.signal;
+}
+
+/**
+ * Install a request interceptor that attaches the shared signal to every
+ * outgoing axios request that didn't set one itself. Call once at app boot.
+ */
+export function installPendingRequestsInterceptor() {
+    axios.interceptors.request.use((config: InternalAxiosRequestConfig) => {
+        if (config.signal !== undefined) {
+            return config;
+        }
+        if (config.headers?.[SKIP_PENDING_REQUESTS_HEADER]) {
+            delete config.headers[SKIP_PENDING_REQUESTS_HEADER];
+            return config;
+        }
+        config.signal = activeController.signal;
+        return config;
+    });
+}
+
+/**
+ * Abort every request that is using the shared signal (both axios via the
+ * interceptor and ``openapi-fetch`` via its middleware) and install a fresh
+ * controller so subsequent requests can still go out.
+ */
+export function cancelPendingRequests() {
+    activeController.abort();
+    activeController = new AbortController();
+}
diff --git a/client/src/components/Login/LoginForm.vue b/client/src/components/Login/LoginForm.vue
index 7ec8b232cd1..a59328ad69c 100644
--- a/client/src/components/Login/LoginForm.vue
+++ b/client/src/components/Login/LoginForm.vue
@@ -15,6 +15,8 @@ import {
 import { computed, ref } from "vue";
 import { useRouter } from "vue-router/composables";
 
+import { SKIP_PENDING_REQUESTS_HEADER } from "@/api/pendingRequests";
+import { discardActiveConnectionsBeforeAuthNavigation } from "@/composables/useAuthNavigation";
 import localize from "@/utils/localization";
 import { withPrefix } from "@/utils/redirect";
 import { errorMessageAsString } from "@/utils/simple-error";
@@ -86,13 +88,22 @@ async function submitLogin() {
         redirect = props.redirect ?? null;
     }
 
+    // Stop polling and abort in-flight axios/GalaxyApi before sending the
+    // login POST — otherwise a late anonymous-cookie response can overwrite
+    // the authenticated cookie we're about to receive.
+    discardActiveConnectionsBeforeAuthNavigation();
+
     try {
-        const response = await axios.post(withPrefix("/user/login"), {
-            login: login.value,
-            password: password.value,
-            redirect: redirect,
-            session_csrf_token: props.sessionCsrfToken,
-        });
+        const response = await axios.post(
+            withPrefix("/user/login"),
+            {
+                login: login.value,
+                password: password.value,
+                redirect: redirect,
+                session_csrf_token: props.sessionCsrfToken,
+            },
+            { headers: { [SKIP_PENDING_REQUESTS_HEADER]: "1" } },
+        );
 
         if (response.data.message && response.data.status) {
             alert(response.data.message);
diff --git a/client/src/components/Register/RegisterForm.vue b/client/src/components/Register/RegisterForm.vue
index 839f498c7bd..46502c5361c 100644
--- a/client/src/components/Register/RegisterForm.vue
+++ b/client/src/components/Register/RegisterForm.vue
@@ -15,8 +15,10 @@ import {
 } from "bootstrap-vue";
 import { computed, type Ref, ref } from "vue";
 
+import { SKIP_PENDING_REQUESTS_HEADER } from "@/api/pendingRequests";
 import { getOIDCIdpsWithRegistration, type OIDCConfig } from "@/components/User/ExternalIdentities/ExternalIDHelper";
 import { Toast } from "@/composables/toast";
+import { discardActiveConnectionsBeforeAuthNavigation } from "@/composables/useAuthNavigation";
 import localize from "@/utils/localization";
 import { withPrefix } from "@/utils/redirect";
 import { errorMessageAsString } from "@/utils/simple-error";
@@ -70,15 +72,24 @@ const registerColumnDisplay = computed(() => Boolean(props.termsUrl));
 async function submit() {
     disableCreate.value = true;
 
+    // Stop polling and abort in-flight axios/GalaxyApi before sending the
+    // register POST — otherwise a late anonymous-cookie response can overwrite
+    // the authenticated cookie we're about to receive.
+    discardActiveConnectionsBeforeAuthNavigation();
+
     try {
-        const response = await axios.post(withPrefix("/user/create"), {
-            email: email.value,
-            username: username.value,
-            password: password.value,
-            confirm: confirm.value,
-            subscribe: subscribe.value,
-            session_csrf_token: props.sessionCsrfToken,
-        });
+        const response = await axios.post(
+            withPrefix("/user/create"),
+            {
+                email: email.value,
+                username: username.value,
+                password: password.value,
+                confirm: confirm.value,
+                subscribe: subscribe.value,
+                session_csrf_token: props.sessionCsrfToken,
+            },
+            { headers: { [SKIP_PENDING_REQUESTS_HEADER]: "1" } },
+        );
 
         if (response.data.message && response.data.status) {
             Toast.info(response.data.message);
diff --git a/client/src/composables/useAuthNavigation.ts b/client/src/composables/useAuthNavigation.ts
new file mode 100644
index 00000000000..244d5a0012e
--- /dev/null
+++ b/client/src/composables/useAuthNavigation.ts
@@ -0,0 +1,25 @@
+import { cancelPendingRequests } from "@/api/pendingRequests";
+import { useEntryPointStore } from "@/stores/entryPointStore";
+import { useHistoryStore } from "@/stores/historyStore";
+import { useNotificationsStore } from "@/stores/notificationsStore";
+
+/**
+ * Tear down every long-lived connection and cancel every in-flight request
+ * (both axios and ``openapi-fetch``/GalaxyApi) so that nothing issued under
+ * the old anonymous ``galaxysession`` cookie can land on the server after
+ * ``handle_user_login`` has invalidated it. See
+ * ``client/src/api/pendingRequests.ts`` for the race this guards against.
+ *
+ * Call this synchronously as the first step of a login or registration
+ * submit, before the authenticating POST goes out. The shared abort
+ * controller is rotated, so the login/register POST (issued right after)
+ * will use a fresh signal and is not affected.
+ */
+export function discardActiveConnectionsBeforeAuthNavigation() {
+    // Stop polling watchers first so they can't kick off new fetches, then
+    // abort any requests still in flight via the shared AbortController.
+    useHistoryStore().stopWatchingHistory();
+    useEntryPointStore().stopWatchingEntryPoints();
+    useNotificationsStore().stopWatchingNotifications();
+    cancelPendingRequests();
+}
diff --git a/client/src/entry/analysis/index.ts b/client/src/entry/analysis/index.ts
index a5bf9dab06c..c03042fc2e9 100644
--- a/client/src/entry/analysis/index.ts
+++ b/client/src/entry/analysis/index.ts
@@ -2,6 +2,7 @@
 import { createPinia, PiniaVuePlugin } from "pinia";
 import Vue from "vue";
 
+import { installPendingRequestsInterceptor } from "@/api/pendingRequests";
 import { initGalaxyInstance } from "@/app";
 import { initSentry } from "@/app/addons/sentry";
 import { initWebhooks } from "@/app/addons/webhooks";
@@ -13,6 +14,12 @@ import App from "./App.vue";
 Vue.use(PiniaVuePlugin);
 const pinia = createPinia();
 
+// Attach the shared AbortController signal to every outgoing axios request
+// so we can cancel in-flight anonymous-cookie requests before login/register
+// navigates — otherwise their late ``Set-Cookie: galaxysession=<anon>`` can
+// clobber the authenticated cookie.
+installPendingRequestsInterceptor();
+
 window.addEventListener("load", async () => {
     // Create Galaxy object
     const Galaxy = await initGalaxyInstance();
diff --git a/client/src/stores/entryPointStore.ts b/client/src/stores/entryPointStore.ts
index e59b6fefeea..805124a713d 100644
--- a/client/src/stores/entryPointStore.ts
+++ b/client/src/stores/entryPointStore.ts
@@ -23,10 +23,11 @@ interface EntryPoint {
 }
 
 export const useEntryPointStore = defineStore("entryPointStore", () => {
-    const { startWatchingResource: startWatchingEntryPoints } = useResourceWatcher(fetchEntryPoints, {
-        shortPollingInterval: ACTIVE_POLLING_INTERVAL,
-        enableBackgroundPolling: false, // No need to poll in the background
-    });
+    const { startWatchingResource: startWatchingEntryPoints, stopWatchingResource: stopWatchingEntryPoints } =
+        useResourceWatcher(fetchEntryPoints, {
+            shortPollingInterval: ACTIVE_POLLING_INTERVAL,
+            enableBackgroundPolling: false, // No need to poll in the background
+        });
 
     const entryPoints = ref<EntryPoint[]>([]);
 
@@ -92,5 +93,6 @@ export const useEntryPointStore = defineStore("entryPointStore", () => {
         updateEntryPoints,
         removeEntryPoint,
         startWatchingEntryPoints,
+        stopWatchingEntryPoints,
     };
 });
diff --git a/client/src/stores/historyStore.ts b/client/src/stores/historyStore.ts
index b8688ff68ce..f5998d35dca 100644
--- a/client/src/stores/historyStore.ts
+++ b/client/src/stores/historyStore.ts
@@ -379,13 +379,14 @@ export const useHistoryStore = defineStore("historyStore", () => {
         return watchHistorySuppliedApp(app);
     }
 
-    const { startWatchingResource: startWatchingHistory, isWatchingResource: isWatchingHistory } = useResourceWatcher(
-        watchHistory,
-        {
-            shortPollingInterval: ACTIVE_POLLING_INTERVAL,
-            longPollingInterval: INACTIVE_POLLING_INTERVAL,
-        },
-    );
+    const {
+        startWatchingResource: startWatchingHistory,
+        stopWatchingResource: stopWatchingHistory,
+        isWatchingResource: isWatchingHistory,
+    } = useResourceWatcher(watchHistory, {
+        shortPollingInterval: ACTIVE_POLLING_INTERVAL,
+        longPollingInterval: INACTIVE_POLLING_INTERVAL,
+    });
 
     async function loadHistoryById(historyId: string): Promise<HistorySummaryExtended | undefined> {
         if (!isLoadingHistory.has(historyId)) {
@@ -508,6 +509,7 @@ export const useHistoryStore = defineStore("historyStore", () => {
         restoreHistories,
         handleTotalCountChange,
         startWatchingHistory,
+        stopWatchingHistory,
         isWatchingHistory,
         loadCurrentHistory,
         loadCurrentHistoryId,
diff --git a/client/src/stores/notificationsStore.ts b/client/src/stores/notificationsStore.ts
index 48f8cc8652d..2a154885d99 100644
--- a/client/src/stores/notificationsStore.ts
+++ b/client/src/stores/notificationsStore.ts
@@ -13,10 +13,11 @@ const ACTIVE_POLLING_INTERVAL = 30000; // 30 seconds
 const INACTIVE_POLLING_INTERVAL = ACTIVE_POLLING_INTERVAL * 20; // 10 minutes
 
 export const useNotificationsStore = defineStore("notificationsStore", () => {
-    const { startWatchingResource: startWatchingNotifications } = useResourceWatcher(getNotificationStatus, {
-        shortPollingInterval: ACTIVE_POLLING_INTERVAL,
-        longPollingInterval: INACTIVE_POLLING_INTERVAL,
-    });
+    const { startWatchingResource: startWatchingNotifications, stopWatchingResource: stopWatchingNotifications } =
+        useResourceWatcher(getNotificationStatus, {
+            shortPollingInterval: ACTIVE_POLLING_INTERVAL,
+            longPollingInterval: INACTIVE_POLLING_INTERVAL,
+        });
     const broadcastsStore = useBroadcastsStore();
 
     const totalUnreadCount = ref<number>(0);
@@ -106,5 +107,6 @@ export const useNotificationsStore = defineStore("notificationsStore", () => {
         updateNotification,
         updateBatchNotification,
         startWatchingNotifications,
+        stopWatchingNotifications,
     };
 });

From 778dd5de52bf112d84b05ce82d83ce2204dde018 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Mon, 27 Apr 2026 09:52:46 +0200
Subject: [PATCH 14/15] Fix admin resend-activation email missing hostname

In a FastAPI request, UrlBuilder's NoMatchFound fallback called
web.url_for without the popped qualified flag, and routes.url_for has
no host available in an ASGI context. The admin resend-activation
endpoint hits this path (since /user/activate is a WSGI-only
@web.expose route) and produced links like http:///user/activate?... .

Latent in the FastAPI endpoint since 72d5cceda8f ("Add mail activation
operation to api"); surfaced for users after c9b849d934a bumped
fastapi 0.135.3 -> 0.136.0.

Qualify the fallback URL with request.base_url when qualified=True.

Integration test posts to /api/users/{user_id}/send_activation_email as
admin with mock SMTP capture, then asserts the captured email body
contains a fully-qualified activation link with a non-empty host. Would
have caught the regression that produced http:///user/activate?... .
---
 lib/galaxy/webapps/galaxy/api/__init__.py |  9 +++++--
 test/integration/test_users.py            | 31 +++++++++++++++++++++++
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/lib/galaxy/webapps/galaxy/api/__init__.py b/lib/galaxy/webapps/galaxy/api/__init__.py
index d95e8939f87..bb8ee853fc0 100644
--- a/lib/galaxy/webapps/galaxy/api/__init__.py
+++ b/lib/galaxy/webapps/galaxy/api/__init__.py
@@ -228,10 +228,15 @@ class UrlBuilder:
                 url = f"{url}?{urlencode(query_params)}"
             return url
         except NoMatchFound:
-            # Fallback to legacy url_for
+            # Fallback to legacy WSGI url_for for routes not registered with FastAPI
             if query_params:
                 path_params.update(query_params)
-            return web.url_for(name, **path_params)
+            url = web.url_for(name, **path_params)
+            if qualified and not url.startswith(("http://", "https://")):
+                # routes.url_for has no thread-local request_config in an ASGI
+                # request, so qualify the URL using the FastAPI request base_url.
+                url = str(self.request.base_url).rstrip("/") + url
+            return url
 
     def _url_path_for(self, name: str, **path_params) -> str:
         """O(1) route lookup using the app's pre-built name index.
diff --git a/test/integration/test_users.py b/test/integration/test_users.py
index 5c40d980e44..dc1cc2edc0d 100644
--- a/test/integration/test_users.py
+++ b/test/integration/test_users.py
@@ -1,3 +1,6 @@
+import json
+import os
+import re
 from typing import (
     ClassVar,
 )
@@ -91,3 +94,31 @@ class TestUnexposedUsersIntegration(UsersIntegrationCase):
     # And the current user has all fields, so no limited fields.
     expected_limited_user_keys = set()
     expected_regular_user_list_count = 1
+
+
+class TestAdminResendActivationEmail(integration_util.IntegrationTestCase):
+    email_directory: ClassVar[str]
+
+    @classmethod
+    def handle_galaxy_config_kwds(cls, config):
+        super().handle_galaxy_config_kwds(config)
+        cls.email_directory = cls._test_driver.mkdtemp()
+        config["user_activation_on"] = True
+        config["activation_grace_period"] = 3
+        config["email_from"] = "galaxy-noreply@example.com"
+        config["smtp_server"] = f"mock_emails_to_path://{cls.email_directory}/email.json"
+
+    def test_resend_activation_includes_qualified_link(self):
+        user = self._setup_user("resend-activation@test.gx")
+        response = self._post(f"users/{user['id']}/send_activation_email", admin=True)
+        self._assert_status_code_is_ok(response)
+
+        with open(os.path.join(self.email_directory, "email.json")) as f:
+            email = json.loads(f.read())
+        assert email["to"] == "resend-activation@test.gx"
+        assert email["subject"] == "Galaxy Account Activation"
+        match = re.search(r"(https?://[^/\s]+/user/activate\?[^\s]+)", email["body"])
+        assert match, f"No qualified activation link found in email body:\n{email['body']}"
+        link = match.group(1)
+        assert "activation_token=" in link
+        assert "email=" in link

From ac5d7753b61c1b894000b7ed8c3c19b84493b221 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Wed, 22 Apr 2026 16:03:45 +0200
Subject: [PATCH 15/15] Drop short / excess raw terms in index-search parser

ILIKE '%term%' on unindexed columns is linear in table size, so every raw
term in a whitespace-split search string is one full scan. Terms shorter
than 4 characters ('of', 'and', 'by', ...) match too much to be useful
and, once joined with all the others, dominate query time. Cap raw
terms at 7 and drop any shorter than 4; filtered terms (tag:foo) and
quoted raw terms ('ab') are preserved as explicit user intent.
---
 lib/galaxy/managers/workflows.py |  3 +-
 lib/galaxy/util/search.py        | 38 ++++++++++++++++++++++
 test/unit/util/test_search.py    | 55 ++++++++++++++++++++++++++++++++
 3 files changed, 95 insertions(+), 1 deletion(-)

diff --git a/lib/galaxy/managers/workflows.py b/lib/galaxy/managers/workflows.py
index f36f48bc0fd..dc468445b6a 100644
--- a/lib/galaxy/managers/workflows.py
+++ b/lib/galaxy/managers/workflows.py
@@ -102,6 +102,7 @@ from galaxy.util.json import (
 )
 from galaxy.util.sanitize_html import sanitize_html
 from galaxy.util.search import (
+    filter_terms,
     FilteredTerm,
     parse_filters_structured,
     RawTextTerm,
@@ -210,7 +211,7 @@ class WorkflowsManager(sharable.SharableModelManager[model.StoredWorkflow], dele
         stmt = stmt.where(StoredWorkflow.hidden == (true() if show_hidden else false()))
         if payload.search:
             search_query = payload.search
-            parsed_search = parse_filters_structured(search_query, INDEX_SEARCH_FILTERS)
+            parsed_search = filter_terms(parse_filters_structured(search_query, INDEX_SEARCH_FILTERS))
 
             def w_tag_exists(term_text: str, quoted: bool):
                 return tag_exists_filter(
diff --git a/lib/galaxy/util/search.py b/lib/galaxy/util/search.py
index 11f072489e8..d25e419038e 100644
--- a/lib/galaxy/util/search.py
+++ b/lib/galaxy/util/search.py
@@ -12,6 +12,12 @@ KeyedQueryT = Tuple[str, str]
 ParseFilterResultT = Tuple[Optional[List["FilteredTerm"]], Optional[str]]
 QUOTE_PATTERN = re.compile(r"\'(.*?)\'")
 
+# Defaults for `filter_terms` used by index-search callers. A whitespace-rich
+# query turns into one WHERE clause (and, pre-trigram-index, one seq scan per
+# matching table) per raw term, so both floors are there to bound query cost.
+DEFAULT_MIN_RAW_TERM_LENGTH = 4
+DEFAULT_MAX_RAW_TERMS = 7
+
 
 def parse_filters(search_term: str, filters: Optional[Dict[str, str]] = None) -> ParseFilterResultT:
     """Support github-like filters for narrowing the results.
@@ -110,7 +116,39 @@ class ParsedSearch:
         return None if len(self.filter_terms) == 0 else self.filter_terms, " ".join([t.text for t in self.text_terms])
 
 
+def filter_terms(
+    parsed: "ParsedSearch",
+    min_raw_term_length: int = DEFAULT_MIN_RAW_TERM_LENGTH,
+    max_raw_terms: Optional[int] = DEFAULT_MAX_RAW_TERMS,
+) -> "ParsedSearch":
+    """Return a new ParsedSearch with short / excess raw text terms dropped.
+
+    Raw (unquoted, non-keyed) terms shorter than ``min_raw_term_length`` are
+    dropped, and the surviving raw terms are capped at ``max_raw_terms``.
+    Filtered terms (``key:value``) and quoted raw terms ('foo bar') are
+    always kept — those are explicit user intent.
+    """
+    out = ParsedSearch()
+    raw_kept = 0
+    for term in parsed.terms:
+        if isinstance(term, RawTextTerm) and not term.quoted:
+            if len(term.text) < min_raw_term_length:
+                continue
+            if max_raw_terms is not None and raw_kept >= max_raw_terms:
+                continue
+            raw_kept += 1
+            out.add_unfiltered_text(term.text, term.quoted)
+        elif isinstance(term, RawTextTerm):
+            out.add_unfiltered_text(term.text, term.quoted)
+        else:
+            out.add_keyed_term(term.filter, term.text, term.quoted)
+    return out
+
+
 __all__ = (
+    "DEFAULT_MAX_RAW_TERMS",
+    "DEFAULT_MIN_RAW_TERM_LENGTH",
+    "filter_terms",
     "parse_filters",
     "parse_filters_structured",
 )
diff --git a/test/unit/util/test_search.py b/test/unit/util/test_search.py
index 83deb7315ea..3eab10f6cf8 100644
--- a/test/unit/util/test_search.py
+++ b/test/unit/util/test_search.py
@@ -1,6 +1,9 @@
 from galaxy.util.search import (
+    filter_terms,
+    FilteredTerm,
     parse_filters,
     parse_filters_structured,
+    RawTextTerm,
 )
 
 
@@ -94,3 +97,55 @@ def test_parse_filters_structured():
     assert text_terms[1].quoted is True
     assert text_terms[2].text == "foo"
     assert text_terms[2].quoted is False
+
+
+def test_filter_terms_drops_short_raw_terms():
+    parsed = parse_filters_structured("Copy of Genomic Assembly and analysis", {})
+    filtered = filter_terms(parsed, min_raw_term_length=4, max_raw_terms=None)
+    kept = [t.text for t in filtered.terms]
+    assert kept == ["Copy", "Genomic", "Assembly", "analysis"]
+
+
+def test_filter_terms_preserves_quoted_raw_terms():
+    parsed = parse_filters_structured("'ab' Copy 'de'", {})
+    filtered = filter_terms(parsed, min_raw_term_length=4, max_raw_terms=None)
+    assert [(t.text, t.quoted) for t in filtered.terms] == [
+        ("ab", True),
+        ("Copy", False),
+        ("de", True),
+    ]
+
+
+def test_filter_terms_preserves_filtered_terms_of_any_length():
+    parsed = parse_filters_structured("tag:ab user:cd Copy", {"tag": "tag", "user": "user"})
+    filtered = filter_terms(parsed, min_raw_term_length=4, max_raw_terms=None)
+    kinds = [(t.__class__.__name__, t.text) for t in filtered.terms]
+    # Both filtered terms are preserved even though their text is shorter than 4;
+    # "Copy" (4) is preserved too.
+    assert ("FilteredTerm", "ab") in kinds
+    assert ("FilteredTerm", "cd") in kinds
+    assert ("RawTextTerm", "Copy") in kinds
+
+
+def test_filter_terms_caps_raw_terms_only():
+    parsed = parse_filters_structured(
+        "tag:foo Copy Genomic Assembly analysis shared user nedflanders extra1 extra2",
+        {"tag": "tag"},
+    )
+    filtered = filter_terms(parsed, min_raw_term_length=4, max_raw_terms=3)
+    raw = [t.text for t in filtered.terms if isinstance(t, RawTextTerm)]
+    filt = [t.text for t in filtered.terms if isinstance(t, FilteredTerm)]
+    assert raw == ["Copy", "Genomic", "Assembly"]
+    assert filt == ["foo"]
+
+
+def test_filter_terms_defaults():
+    # Default behaviour: 4-char min length, 7-term cap on raw terms.
+    parsed = parse_filters_structured(
+        "Copy of Genomic Assembly and analysis - RDH shared by user nedflanders",
+        {},
+    )
+    filtered = filter_terms(parsed)
+    kept = [t.text for t in filtered.terms]
+    # of, and, -, RDH, by dropped for length; everything else survives.
+    assert kept == ["Copy", "Genomic", "Assembly", "analysis", "shared", "user", "nedflanders"]