From d762a78bde28d55c42b800b8726f3a608c7944e0 Mon Sep 17 00:00:00 2001
From: guerler <aysam.guerler@gmail.com>
Date: Mon, 10 Nov 2025 20:27:37 +0300
Subject: [PATCH 01/13] Allow selection of genomes from history fasta/2bit

---
 client/visualizations.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/visualizations.yml b/client/visualizations.yml
index ea51399c8be..605de8c4a1a 100644
--- a/client/visualizations.yml
+++ b/client/visualizations.yml
@@ -44,7 +44,7 @@ hyphyvision:
     version: 0.0.0
 igv:
     package: "@galaxyproject/igv"
-    version: 0.0.16
+    version: 0.0.23
 jupyterlite:
     package: "@galaxyproject/jupyterlite"
     version: 0.0.17

From f3a3de560d699ae9a4dc9f8cc05133c7d8d54e1c Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Wed, 12 Nov 2025 20:51:17 -0600
Subject: [PATCH 02/13] [25.1] Add a client side rate limiter

Adds a rate limiter middleware to the `openapi-fetch` client side API factory.

For now, the maximum number of requests are defined in this `rateLimiter` utility file (and so is the window duration, retry delay for 429s and max retries). Maybe this could be defined in a config file?

Also, we do not handle max retries for 429 responses (Retry-After) for now.
---
 client/src/api/client/index.ts       | 15 ++++-
 client/src/api/client/rateLimiter.ts | 82 ++++++++++++++++++++++++++++
 2 files changed, 96 insertions(+), 1 deletion(-)
 create mode 100644 client/src/api/client/rateLimiter.ts

diff --git a/client/src/api/client/index.ts b/client/src/api/client/index.ts
index b3d53c1106b..01cd2a1a213 100644
--- a/client/src/api/client/index.ts
+++ b/client/src/api/client/index.ts
@@ -1,5 +1,6 @@
 import createClient from "openapi-fetch";
 
+import { createRateLimiterMiddleware } from "@/api/client/rateLimiter";
 import type { GalaxyApiPaths } from "@/api/schema";
 import { getAppRoot } from "@/onload/loadConfig";
 
@@ -9,7 +10,19 @@ function getBaseUrl() {
 }
 
 function apiClientFactory() {
-    return createClient<GalaxyApiPaths>({ baseUrl: getBaseUrl() });
+    const client = createClient<GalaxyApiPaths>({ baseUrl: getBaseUrl() });
+
+    // TODO: Adjust based on server limits (maybe this goes in Galaxy config?)
+    client.use(
+        createRateLimiterMiddleware({
+            maxRequests: 100,
+            windowMs: 3000,
+            retryDelay: 1000,
+            maxRetries: 3,
+        }),
+    );
+
+    return client;
 }
 
 export type GalaxyApiClient = ReturnType<typeof apiClientFactory>;
diff --git a/client/src/api/client/rateLimiter.ts b/client/src/api/client/rateLimiter.ts
new file mode 100644
index 00000000000..5ead5873fb6
--- /dev/null
+++ b/client/src/api/client/rateLimiter.ts
@@ -0,0 +1,82 @@
+import type { Middleware } from "openapi-fetch";
+
+interface RateLimitConfig {
+    /** Maximum requests per window */
+    maxRequests?: number;
+    /** Time the requestwindow lasts in milliseconds */
+    windowMs?: number;
+    /** Delay between retries on 429 */
+    retryDelay?: number;
+    /** Maximum retry attempts */
+    maxRetries?: number;
+}
+
+const DEFAULT_CONFIG: Required<RateLimitConfig> = {
+    maxRequests: 100,
+    windowMs: 60000,
+    retryDelay: 1000,
+    maxRetries: 3,
+};
+
+/**
+ * Rate limiting middleware to control the rate of API requests.
+ *
+ * Uses a timed window and only allows a maximum number of requests per that window.
+ */
+export function createRateLimiterMiddleware(config: RateLimitConfig = {}): Middleware {
+    const cfg = { ...DEFAULT_CONFIG, ...config };
+
+    let requestCount = 0;
+    let windowStart = Date.now();
+
+    /** Resets the request window if the time has elapsed */
+    function resetWindowIfNeeded() {
+        const now = Date.now();
+        if (now - windowStart >= cfg.windowMs) {
+            requestCount = 0;
+            windowStart = now;
+        }
+    }
+
+    /** Places a request in the rate limiter queue */
+    async function placeRequestInQueue(): Promise<void> {
+        resetWindowIfNeeded();
+
+        if (requestCount < cfg.maxRequests) {
+            requestCount++;
+            return;
+        }
+
+        // Rate limit exceeded, wait for next window
+        const waitTime = cfg.windowMs - (Date.now() - windowStart);
+
+        await new Promise((resolve) => setTimeout(resolve, waitTime));
+
+        // After waiting, try again (this will reset the window)
+        return placeRequestInQueue();
+    }
+
+    const middleware: Middleware = {
+        async onRequest({ request }) {
+            await placeRequestInQueue();
+            return request;
+        },
+
+        async onResponse({ response: res }) {
+            // TODO: Implement max retries logic
+
+            // Handle 429 Too Many Requests from server
+            if (res.status === 429) {
+                const retryAfter = res.headers.get("Retry-After");
+                const delay = retryAfter ? parseInt(retryAfter) * 1000 : cfg.retryDelay;
+
+                console.warn(`Received 429 from server, waiting ${delay}ms before retry`);
+                await new Promise((resolve) => setTimeout(resolve, delay));
+            }
+
+            return res;
+        },
+    };
+
+    return middleware;
+}

From 5d91b557320fda2b029124cc2fd4d2f469e29278 Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Tue, 18 Nov 2025 10:55:53 -0600
Subject: [PATCH 03/13] [25.1] Set `create_time` as the default time for
 sorting/display for invocations

As opposed to `update_time`.
---
 .../Workflow/Invocation/InvocationScrollList.vue       |  5 ++++-
 .../src/components/Workflow/WorkflowAnnotation.test.ts |  4 ++--
 client/src/components/Workflow/WorkflowAnnotation.vue  | 10 +++++-----
 .../WorkflowInvocationState.vue                        |  2 +-
 4 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/client/src/components/Workflow/Invocation/InvocationScrollList.vue b/client/src/components/Workflow/Invocation/InvocationScrollList.vue
index ee65b3e0266..7e9290cb317 100644
--- a/client/src/components/Workflow/Invocation/InvocationScrollList.vue
+++ b/client/src/components/Workflow/Invocation/InvocationScrollList.vue
@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import { faClock } from "@fortawesome/free-regular-svg-icons";
 import { faHdd, faSitemap } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
 import { storeToRefs } from "pinia";
@@ -123,7 +124,9 @@ function getInvocationBadges(invocation: WorkflowInvocation) {
                 :title-icon="{ icon: faSitemap }"
                 :title-n-lines="2"
                 title-size="text"
-                :update-time="invocation.update_time"
+                :update-time="invocation.create_time"
+                update-time-title="Invoked"
+                :update-time-icon="faClock"
                 @title-click="workflowName(invocation.workflow_id)"
                 @click="() => cardClicked(invocation)">
                 <template v-slot:description>
diff --git a/client/src/components/Workflow/WorkflowAnnotation.test.ts b/client/src/components/Workflow/WorkflowAnnotation.test.ts
index c4cd73287fe..47489f27639 100644
--- a/client/src/components/Workflow/WorkflowAnnotation.test.ts
+++ b/client/src/components/Workflow/WorkflowAnnotation.test.ts
@@ -92,7 +92,7 @@ async function mountWorkflowAnnotation(version: "run_form" | "invocation", ownsW
         propsData: {
             workflowId: ownsWorkflow ? SAMPLE_WORKFLOW.id : OTHER_USER_WORKFLOW_ID,
             historyId: TEST_HISTORY_ID,
-            invocationUpdateTime: version === "invocation" ? INVOCATION_TIME : undefined,
+            invocationCreateTime: version === "invocation" ? INVOCATION_TIME : undefined,
             showDetails: version === "run_form",
         },
         localVue,
@@ -164,7 +164,7 @@ describe("WorkflowAnnotation renders", () => {
         const { wrapper } = await mountWorkflowAnnotation("invocation");
 
         const timeInfo = wrapper.find(SELECTORS.TIME_INFO);
-        expect(timeInfo.text()).toContain("updated");
+        expect(timeInfo.text()).toContain("invoked");
         expect(timeInfo.find(SELECTORS.DATE).attributes("title")).toBe(INVOCATION_TIME);
     });
 });
diff --git a/client/src/components/Workflow/WorkflowAnnotation.vue b/client/src/components/Workflow/WorkflowAnnotation.vue
index 8dd3e6bffb7..4dcb9e98cdf 100644
--- a/client/src/components/Workflow/WorkflowAnnotation.vue
+++ b/client/src/components/Workflow/WorkflowAnnotation.vue
@@ -17,14 +17,14 @@ import WorkflowIndicators from "@/components/Workflow/List/WorkflowIndicators.vu
 
 interface Props {
     workflowId: string;
-    invocationUpdateTime?: string;
+    invocationCreateTime?: string;
     historyId: string;
     showDetails?: boolean;
     hideHr?: boolean;
 }
 
 const props = withDefaults(defineProps<Props>(), {
-    invocationUpdateTime: undefined,
+    invocationCreateTime: undefined,
 });
 
 const { workflow, owned } = useWorkflowInstance(props.workflowId);
@@ -34,7 +34,7 @@ const description = computed(() => {
 });
 
 const timeElapsed = computed(() => {
-    return props.invocationUpdateTime || workflow.value?.update_time;
+    return props.invocationCreateTime || workflow.value?.update_time;
 });
 
 const workflowTags = computed(() => {
@@ -49,11 +49,11 @@ const workflowTags = computed(() => {
                 <i v-if="timeElapsed" data-description="workflow annotation time info">
                     <FontAwesomeIcon :icon="faClock" class="mr-1" />
                     <span v-localize>
-                        {{ props.invocationUpdateTime ? "updated" : "edited" }}
+                        {{ props.invocationCreateTime ? "invoked" : "edited" }}
                     </span>
                     <UtcDate :date="timeElapsed" mode="elapsed" data-description="workflow annotation date" />
                 </i>
-                <span v-if="invocationUpdateTime" class="d-flex flex-gapx-1 align-items-center">
+                <span v-if="invocationCreateTime" class="d-flex flex-gapx-1 align-items-center">
                     <FontAwesomeIcon :icon="faHdd" />History:
 
                     <span class="history-link-wrapper">
diff --git a/client/src/components/WorkflowInvocationState/WorkflowInvocationState.vue b/client/src/components/WorkflowInvocationState/WorkflowInvocationState.vue
index f39da7a0bae..802bd15436b 100644
--- a/client/src/components/WorkflowInvocationState/WorkflowInvocationState.vue
+++ b/client/src/components/WorkflowInvocationState/WorkflowInvocationState.vue
@@ -304,7 +304,7 @@ async function onCancel() {
         <WorkflowAnnotation
             v-if="props.isFullPage"
             :workflow-id="invocation.workflow_id"
-            :invocation-update-time="invocation.update_time"
+            :invocation-create-time="invocation.create_time"
             :history-id="invocation.history_id">
             <template v-slot:middle-content>
                 <div class="progress-bars mx-1">

From f25c8551d595493bc1517d8cc45b266c3e2f072c Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Wed, 19 Nov 2025 18:31:46 -0600
Subject: [PATCH 04/13] only handle GET 429 responses

---
 client/src/api/client/rateLimiter.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/src/api/client/rateLimiter.ts b/client/src/api/client/rateLimiter.ts
index 5ead5873fb6..73d62401e0f 100644
--- a/client/src/api/client/rateLimiter.ts
+++ b/client/src/api/client/rateLimiter.ts
@@ -62,11 +62,11 @@ export function createRateLimiterMiddleware(config: RateLimitConfig = {}): Middl
             return request;
         },
 
-        async onResponse({ response: res }) {
+        async onResponse({ response: res, request }) {
             // TODO: Implement max retries logic
 
             // Handle 429 Too Many Requests from server
-            if (res.status === 429) {
+            if (res.status === 429 && request.method === "GET") {
                 const retryAfter = res.headers.get("Retry-After");
                 const delay = retryAfter ? parseInt(retryAfter) * 1000 : cfg.retryDelay;
 

From 9103a34bdce0ea765e1f0d1c107ffb19a378ad82 Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Wed, 19 Nov 2025 19:47:09 -0600
Subject: [PATCH 05/13] add retry logic for 429 requests, and a jest that tests
 that logic

---
 client/src/api/client/rateLimiter.test.ts | 139 ++++++++++++++++++++++
 client/src/api/client/rateLimiter.ts      |  20 +++-
 2 files changed, 155 insertions(+), 4 deletions(-)
 create mode 100644 client/src/api/client/rateLimiter.test.ts

diff --git a/client/src/api/client/rateLimiter.test.ts b/client/src/api/client/rateLimiter.test.ts
new file mode 100644
index 00000000000..5066ced57c0
--- /dev/null
+++ b/client/src/api/client/rateLimiter.test.ts
@@ -0,0 +1,139 @@
+import type { MessageException } from "@/api";
+import { GalaxyApi } from "@/api/client";
+import { useServerMock } from "@/api/client/__mocks__";
+
+import { DEFAULT_CONFIG } from "./rateLimiter";
+
+const { server, http } = useServerMock();
+
+/** Spy to count number of times a 429 response is returned */
+const mock429ResponseSpy = jest.fn();
+
+describe("Rate Limiter Middleware", () => {
+    let consoleWarnSpy: jest.SpyInstance;
+    let consoleErrorSpy: jest.SpyInstance;
+
+    /** Helper to verify that there is a 429 response without retries */
+    function ensure429AndNoRetries(response: Response, error: MessageException | undefined) {
+        // Verify the request failed as expected
+        expect(response.status).toBe(429);
+        expect(error).toBeDefined();
+        expect(error?.err_code).toBe(429);
+
+        // Verify no retry behavior occurred by confirming console warns/errors were not called
+        expect(consoleWarnSpy).not.toHaveBeenCalled();
+        expect(consoleErrorSpy).not.toHaveBeenCalled();
+
+        // Verify the mock 429 response was called only once (no retries)
+        expect(mock429ResponseSpy).toHaveBeenCalledTimes(1);
+    }
+
+    beforeEach(() => {
+        consoleWarnSpy = jest.spyOn(console, "warn").mockImplementation();
+        consoleErrorSpy = jest.spyOn(console, "error").mockImplementation();
+    });
+    afterEach(() => {
+        consoleWarnSpy.mockRestore();
+        consoleErrorSpy.mockRestore();
+        mock429ResponseSpy.mockReset();
+    });
+
+    it("should retry 429 GET responses", async () => {
+        // Set up a mock GET endpoint that always returns 429
+        server.use(
+            http.get("/api/histories/{history_id}", ({ response }) => {
+                mock429ResponseSpy();
+                return response("4XX").json({ err_code: 429, err_msg: "Too Many Requests" }, { status: 429 });
+            }),
+        );
+
+        const { error, response } = await GalaxyApi().GET("/api/histories/{history_id}", {
+            params: {
+                path: { history_id: "test" },
+            },
+        });
+
+        // Verify the request failed as expected
+        expect(response.status).toBe(429);
+        expect(error).toBeDefined();
+        expect(error?.err_code).toBe(429);
+
+        // Verify retry behavior occurred by confirming console warns/errors
+        expect(consoleWarnSpy).toHaveBeenCalledWith(
+            expect.stringContaining(`Received 429 from server, waiting ${DEFAULT_CONFIG.retryDelay}ms before retry`),
+        );
+
+        for (let i = 1; i <= DEFAULT_CONFIG.maxRetries; i++) {
+            expect(consoleWarnSpy).toHaveBeenCalledWith(expect.stringContaining(`Retry ${i} also received 429`));
+        }
+
+        expect(consoleErrorSpy).toHaveBeenCalledWith(
+            expect.stringContaining(`Max retries reached for request to ${response.url}`),
+        );
+
+        // Verify the mock 429 response was called the first time and then for each retry
+        expect(mock429ResponseSpy).toHaveBeenCalledTimes(DEFAULT_CONFIG.maxRetries + 1);
+    });
+
+    it("should not retry 429 POST responses", async () => {
+        // Set up a mock POST endpoint that always returns 429
+        server.use(
+            http.post("/api/chat", ({ response }) => {
+                mock429ResponseSpy();
+                return response("4XX").json({ err_code: 429, err_msg: "Too Many Requests" }, { status: 429 });
+            }),
+        );
+
+        const { error, response } = await GalaxyApi().POST("/api/chat", {
+            params: {
+                query: { job_id: "test" },
+            },
+            body: {
+                query: "test message",
+                context: "test",
+            },
+        });
+
+        ensure429AndNoRetries(response, error);
+    });
+
+    it("should not retry 429 DELETE responses", async () => {
+        // Set up a mock DELETE endpoint that always returns 429
+        server.use(
+            http.delete("/api/datasets/{dataset_id}", ({ response }) => {
+                mock429ResponseSpy();
+                return response("4XX").json({ err_code: 429, err_msg: "Too Many Requests" }, { status: 429 });
+            }),
+        );
+
+        const { error, response } = await GalaxyApi().DELETE("/api/datasets/{dataset_id}", {
+            params: {
+                path: { dataset_id: "test_id" },
+                query: { purge: true },
+            },
+        });
+
+        ensure429AndNoRetries(response, error);
+    });
+
+    it("should not retry 429 PUT responses", async () => {
+        // Set up a mock PUT endpoint that always returns 429
+        server.use(
+            http.put("/api/datasets/{dataset_id}", ({ response }) => {
+                mock429ResponseSpy();
+                return response("4XX").json({ err_code: 429, err_msg: "Too Many Requests" }, { status: 429 });
+            }),
+        );
+
+        const { error, response } = await GalaxyApi().PUT("/api/datasets/{dataset_id}", {
+            params: {
+                path: { dataset_id: "test_id" },
+            },
+            body: {
+                deleted: false,
+            },
+        });
+
+        ensure429AndNoRetries(response, error);
+    });
+});
diff --git a/client/src/api/client/rateLimiter.ts b/client/src/api/client/rateLimiter.ts
index 73d62401e0f..1dbae3485fd 100644
--- a/client/src/api/client/rateLimiter.ts
+++ b/client/src/api/client/rateLimiter.ts
@@ -11,7 +11,7 @@ interface RateLimitConfig {
     maxRetries?: number;
 }
 
-const DEFAULT_CONFIG: Required<RateLimitConfig> = {
+export const DEFAULT_CONFIG: Required<RateLimitConfig> = {
     maxRequests: 100,
     windowMs: 60000,
     retryDelay: 1000,
@@ -63,15 +63,27 @@ export function createRateLimiterMiddleware(config: RateLimitConfig = {}): Middl
         },
 
         async onResponse({ response: res, request }) {
-            // TODO: Implement max retries logic
-
             // Handle 429 Too Many Requests from server
             if (res.status === 429 && request.method === "GET") {
                 const retryAfter = res.headers.get("Retry-After");
                 const delay = retryAfter ? parseInt(retryAfter) * 1000 : cfg.retryDelay;
 
                 console.warn(`Received 429 from server, waiting ${delay}ms before retry`);
-                await new Promise((resolve) => setTimeout(resolve, delay));
+
+                let retries = 0;
+                while (retries < cfg.maxRetries) {
+                    retries++;
+                    await new Promise((resolve) => setTimeout(resolve, delay));
+
+                    // A tricky thing here is that we will bypass the middleware chain on retry
+                    const retryResponse = await fetch(request);
+                    if (retryResponse.status !== 429) {
+                        return retryResponse;
+                    }
+                    console.warn(`Retry ${retries} also received 429, retrying...`);
+                }
+
+                console.error(`Max retries reached for request to ${request.url}`);
             }
 
             return res;

From c22deeac53343cecaddaf38cd0334198b61cca08 Mon Sep 17 00:00:00 2001
From: Ahmed Awan <qe66653@umbc.edu>
Date: Thu, 20 Nov 2025 16:25:44 -0600
Subject: [PATCH 06/13] [25.1] Fix `TERMINAL_STATES` array has a duplicate
 state

The array has `skipped` listed twice. This was causing the bug where we would over-count jobs in the progress bar in the invocation view:

Fixes https://github.com/galaxyproject/galaxy/issues/21266
---
 client/src/api/jobs.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/client/src/api/jobs.ts b/client/src/api/jobs.ts
index 1571b2c39f4..692e65a37f3 100644
--- a/client/src/api/jobs.ts
+++ b/client/src/api/jobs.ts
@@ -17,7 +17,7 @@ export type JobMessage =
 
 export const NON_TERMINAL_STATES = ["new", "queued", "running", "waiting", "paused", "resubmitted", "stop"];
 export const ERROR_STATES = ["error", "deleted", "deleting"];
-export const TERMINAL_STATES = ["ok", "skipped", "stop", "stopping", "skipped"].concat(ERROR_STATES);
+export const TERMINAL_STATES = ["ok", "skipped", "stop", "stopping"].concat(ERROR_STATES);
 
 interface JobDef {
     tool_id: string;

From c8a8f07899fb5192e211dec6a0223fce1d3cb270 Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Sat, 22 Nov 2025 20:32:17 +0100
Subject: [PATCH 07/13] Force correct client build

We should follow up and bump this too in galaxy-release-util
---
 client/package.json | 2 +-
 package.json        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/package.json b/client/package.json
index a10f082f3fe..2e1b32fe298 100644
--- a/client/package.json
+++ b/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@galaxyproject/galaxy-client",
-  "version": "25.0.5.dev0",
+  "version": "25.0.4",
   "description": "Galaxy client application build system",
   "keywords": [
     "galaxy"
diff --git a/package.json b/package.json
index 93f800fdf70..9b6a4da87ba 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,7 @@
   },
   "homepage": "https://github.com/galaxyproject/galaxy#readme",
   "dependencies": {
-    "@galaxyproject/galaxy-client": "^24.0.0",
+    "@galaxyproject/galaxy-client": "^25.0.4",
     "cpy-cli": "^5.0.0"
   },
   "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"

From 213b679200ef10409938250ce57245d6445f9d2b Mon Sep 17 00:00:00 2001
From: mvdbeek <m.vandenbeek@gmail.com>
Date: Mon, 24 Nov 2025 10:14:40 +0100
Subject: [PATCH 08/13] Fix fastapi package conflict

Just install both ...
---
 lib/galaxy/dependencies/pinned-requirements.txt | 1 +
 pyproject.toml                                  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/lib/galaxy/dependencies/pinned-requirements.txt b/lib/galaxy/dependencies/pinned-requirements.txt
index e3bb9a047d4..3d56488bb33 100644
--- a/lib/galaxy/dependencies/pinned-requirements.txt
+++ b/lib/galaxy/dependencies/pinned-requirements.txt
@@ -63,6 +63,7 @@ dparse==0.6.4
 edam-ontology==1.25.2
 email-validator==2.2.0
 exceptiongroup==1.2.2 ; python_full_version < '3.11'
+fastapi==0.115.12
 fastapi-slim==0.115.12
 filelock==3.18.0
 fissix==24.4.24
diff --git a/pyproject.toml b/pyproject.toml
index 1ab637d0e30..c90fbc91647 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -37,6 +37,7 @@ dependencies = [
     "docutils!=0.17,!=0.17.1",
     "dparse",
     "edam-ontology",
+    "fastapi>=0.111.0",
     "fastapi-slim>=0.111.0",
     "fissix",
     "fs",

From 288e1b4a0dab1f9c3abf750282f761a1527029f7 Mon Sep 17 00:00:00 2001
From: Marius van den Beek <m.vandenbeek@gmail.com>
Date: Mon, 24 Nov 2025 12:40:38 +0100
Subject: [PATCH 09/13] Drop fastapi-slim

Co-authored-by: Nicola Soranzo <nicola.soranzo@gmail.com>
---
 lib/galaxy/dependencies/pinned-requirements.txt | 1 -
 pyproject.toml                                  | 1 -
 2 files changed, 2 deletions(-)

diff --git a/lib/galaxy/dependencies/pinned-requirements.txt b/lib/galaxy/dependencies/pinned-requirements.txt
index 3d56488bb33..e9df6d07e91 100644
--- a/lib/galaxy/dependencies/pinned-requirements.txt
+++ b/lib/galaxy/dependencies/pinned-requirements.txt
@@ -64,7 +64,6 @@ edam-ontology==1.25.2
 email-validator==2.2.0
 exceptiongroup==1.2.2 ; python_full_version < '3.11'
 fastapi==0.115.12
-fastapi-slim==0.115.12
 filelock==3.18.0
 fissix==24.4.24
 frozenlist==1.6.0
diff --git a/pyproject.toml b/pyproject.toml
index c90fbc91647..679fcf3888c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -38,7 +38,6 @@ dependencies = [
     "dparse",
     "edam-ontology",
     "fastapi>=0.111.0",
-    "fastapi-slim>=0.111.0",
     "fissix",
     "fs",
     "future>=1.0.0",  # Python 3.12 support

From 01ef7c15969cd0bd586314dcdbc839896ffe406a Mon Sep 17 00:00:00 2001
From: Keith Suderman <suderman@jhu.edu>
Date: Mon, 24 Nov 2025 10:44:19 -0500
Subject: [PATCH 10/13] Backport smoke-test and pr jobs from dev branch

---
 .github/workflows/build_container_image.yaml | 145 +++++++++++++++++++
 1 file changed, 145 insertions(+)

diff --git a/.github/workflows/build_container_image.yaml b/.github/workflows/build_container_image.yaml
index 251c9c88694..bcb9e1172a5 100644
--- a/.github/workflows/build_container_image.yaml
+++ b/.github/workflows/build_container_image.yaml
@@ -75,10 +75,16 @@ jobs:
     name: Build container image for Galaxy repos
     runs-on: ubuntu-latest
     if: github.repository_owner == 'galaxyproject'
+    outputs:
+      tag: ${{ steps.branch.outputs.name }}
+      version: ${{ steps.version.outputs.version }}
     steps:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.12'
       # https://stackoverflow.com/questions/59810838/how-to-get-the-short-sha-for-the-github-workflow
       - name: Set outputs
         id: commit
@@ -94,6 +100,11 @@ jobs:
             echo "name=${GITHUB_REF#refs/heads/release_}-auto" >> $GITHUB_OUTPUT
           fi
         shell: bash
+      - name: Get the current Galaxy version
+        id: version
+        run: |
+          version=$(python3 -c "import lib.galaxy.version; print(lib.galaxy.version.VERSION)")
+          echo "version=$version" >> $GITHUB_OUTPUT
       - name: Build container image
         run: docker build . --build-arg GIT_COMMIT=$(git rev-parse HEAD) --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') --build-arg IMAGE_TAG=${{ steps.branch.outputs.name }} -t galaxy/galaxy-min:${{ steps.branch.outputs.name }} -t quay.io/galaxyproject/galaxy-min:${{ steps.branch.outputs.name }} -f .k8s_ci.Dockerfile
       - name: Create auto-expiring one for per-commit auto repository
@@ -122,3 +133,137 @@ jobs:
         with:
           args: push galaxy/galaxy-min:${{ steps.branch.outputs.name }}
 
+  smoke-test:
+    name: Try installing the new image
+    runs-on: ubuntu-latest
+    needs: [ build ]
+    steps:
+      - name: Start k8s locally
+        uses: jupyterhub/action-k3s-helm@v3
+        with:
+          k3s-version: v1.32.0+k3s1  # releases:  https://github.com/k3s-io/k3s/tags
+          metrics-enabled: false
+          traefik-enabled: false
+      - name: Verify function of k8s, kubectl, and helm
+        run: |
+          echo "kubeconfig: $KUBECONFIG"
+          kubectl version
+          kubectl get pods --all-namespaces
+          helm version
+          helm list
+      - name: Add the Galaxy Helm repository
+        run: helm repo add galaxy https://github.com/CloudVE/helm-charts/raw/master
+      - name: Install the Galaxy dependencies
+        run: |
+          helm install galaxy-deps galaxy/galaxy-deps \
+          --namespace galaxy-deps \
+          --create-namespace \
+          --set cvmfs.cvmfscsi.cache.alien.enabled=false \
+          --wait \
+          --timeout=1200s
+      - name: Install Galaxy using the image we just pushed
+        run: |
+          helm install galaxy galaxy/galaxy \
+          --namespace galaxy \
+          --create-namespace \
+          --set persistence.accessMode="ReadWriteOnce" \
+          --set resources.requests.memory=0Mi,resources.requests.cpu=0m \
+          --set image.tag=${{ needs.build.outputs.tag }} \
+          --set webHandlers.startupProbe.initialDelaySeconds=120 \
+          --set webHandlers.startupProbe.periodSeconds=15 \
+          --set webHandlers.startupProbe.failureThreshold=72 \
+          --wait \
+          --timeout=1200s
+      - name: Debug deployment on failure
+        if: failure()
+        run: |
+          echo "=== Deployment failed, gathering debug information ==="
+
+          echo "=== All pods in galaxy namespace ==="
+          kubectl get pods -n galaxy -o wide
+
+          echo "=== All pods in galaxy-deps namespace ==="
+          kubectl get pods -n galaxy-deps -o wide
+
+          echo "=== CSI Drivers ==="
+          kubectl get csidriver
+
+          echo "=== Storage Classes ==="
+          kubectl get sc
+
+          echo "=== PVCs in galaxy namespace ==="
+          kubectl get pvc -n galaxy
+
+          echo "=== PVCs in galaxy-deps namespace ==="
+          kubectl get pvc -n galaxy-deps
+
+          echo "=== Recent events in galaxy namespace ==="
+          kubectl get events -n galaxy --sort-by='.lastTimestamp' | tail -50
+
+          echo "=== Recent events in galaxy-deps namespace ==="
+          kubectl get events -n galaxy-deps --sort-by='.lastTimestamp' | tail -50
+
+          echo "=== Describe pending/failed pods in galaxy namespace ==="
+          for pod in $(kubectl get pods -n galaxy --field-selector=status.phase!=Running,status.phase!=Succeeded -o name 2>/dev/null); do
+            echo "--- Describing $pod ---"
+            kubectl describe -n galaxy $pod
+          done
+
+          echo "=== Describe pending/failed pods in galaxy-deps namespace ==="
+          for pod in $(kubectl get pods -n galaxy-deps --field-selector=status.phase!=Running,status.phase!=Succeeded -o name 2>/dev/null); do
+            echo "--- Describing $pod ---"
+            kubectl describe -n galaxy-deps $pod
+          done
+      - name: Check the version
+        run: |
+          kubectl get svc -n galaxy
+          kubectl describe svc -n galaxy galaxy-nginx
+          address=$(kubectl get svc -n galaxy galaxy-nginx -o jsonpath="http://{.spec.clusterIP}:{.spec.ports[0].port}/galaxy/api/version")
+          echo "Address is $address"
+          appVersion=${{ needs.build.outputs.version }}
+          apiVersion=$(curl $address | jq -r '"\(.version_major).\(.version_minor)"')
+          echo "appVersion: $appVersion"
+          echo "apiVersion: $apiVersion"
+          if [ "$appVersion" != "$apiVersion" ]; then
+            exit 1
+          fi
+
+  pr:
+    name: Create a PR to update the Galaxy Helm chart when a release is tagged
+    runs-on: ubuntu-latest
+    needs: [smoke-test, build]
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - name: Checkout Galaxy Helm chart
+        uses: actions/checkout@v4
+        with:
+          repository: galaxyproject/galaxy-helm
+          token: ${{ secrets.GITHUB_TOKEN }}
+          persist-credentials: true
+
+      - name: Update Chart.yaml appVersion
+        run: |
+          sed -i "s/^appVersion:.*/appVersion: \"${{ needs.build.outputs.version }}\"/" galaxy/Chart.yaml
+
+      - name: Update values.yaml image.tag
+        run: |
+          sed -i "s/^  tag:.*/  tag: \"${{ needs.build.outputs.tag }}\"/" galaxy/values.yaml
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GALAXY_HELM_PULL_REQUEST_TOKEN }}
+          commit-message: "Update Galaxy to version ${{ needs.build.outputs.version }}"
+          title: "Update Galaxy to version ${{ needs.build.outputs.version }}"
+          body: |
+            This PR updates the Galaxy Helm chart to use the new Galaxy release.
+
+            Changes:
+            - appVersion: ${{ needs.build.outputs.version }}
+            - image.tag: ${{ needs.build.outputs.tag }}
+
+            Triggered by: ${{ github.ref }}
+          branch: update-galaxy-${{ needs.build.outputs.version }}
+          delete-branch: true
+          labels: patch
+

From 4a04fd445dbe8223c56eae688791d61a083e0470 Mon Sep 17 00:00:00 2001
From: Keith Suderman <suderman@jhu.edu>
Date: Tue, 25 Nov 2025 09:34:27 -0500
Subject: [PATCH 11/13] Update .github/workflows/build_container_image.yaml

Co-authored-by: Nicola Soranzo <nicola.soranzo@gmail.com>
---
 .github/workflows/build_container_image.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build_container_image.yaml b/.github/workflows/build_container_image.yaml
index bcb9e1172a5..05dad1efb0a 100644
--- a/.github/workflows/build_container_image.yaml
+++ b/.github/workflows/build_container_image.yaml
@@ -82,7 +82,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.12'
       # https://stackoverflow.com/questions/59810838/how-to-get-the-short-sha-for-the-github-workflow

From 42fda3adcd3e1d176672971eb865c04864d70509 Mon Sep 17 00:00:00 2001
From: Nicola Soranzo <nicola.soranzo@earlham.ac.uk>
Date: Tue, 25 Nov 2025 15:54:41 +0000
Subject: [PATCH 12/13] Use anaconda API to find package download URL

Fix the following failing mulled unit test:

```
FAILED test/unit/tool_util/mulled/test_get_tests.py::test_find_anaconda_versions - AssertionError: assert '/bioconda/2pg_cartesian/1.0.1/download/linux-64/2pg_cartesian-1.0.1-0.tar.bz2' in []
```
---
 lib/galaxy/tool_util/deps/mulled/get_tests.py | 66 ++++++++++---------
 test/unit/tool_util/mulled/test_get_tests.py  | 25 ++++---
 2 files changed, 50 insertions(+), 41 deletions(-)

diff --git a/lib/galaxy/tool_util/deps/mulled/get_tests.py b/lib/galaxy/tool_util/deps/mulled/get_tests.py
index 6f042c67c34..7ff662856d1 100644
--- a/lib/galaxy/tool_util/deps/mulled/get_tests.py
+++ b/lib/galaxy/tool_util/deps/mulled/get_tests.py
@@ -108,13 +108,6 @@ def get_anaconda_url(container, anaconda_channel="bioconda"):
     return f"https://anaconda.org/{anaconda_channel}/{name[0]}/{name[1]}/download/linux-64/{'-'.join(name)}.tar.bz2"
 
 
-def prepend_anaconda_url(url):
-    """
-    Take a partial url and prepend 'https://anaconda.org'
-    """
-    return f"https://anaconda.org{url}"
-
-
 def get_test_from_anaconda(url: str) -> Optional[Dict[str, Any]]:
     """
     Given the URL of an anaconda tarball, return tests
@@ -132,20 +125,26 @@ def get_test_from_anaconda(url: str) -> Optional[Dict[str, Any]]:
     return None
 
 
-def find_anaconda_versions(name, anaconda_channel="bioconda"):
+def find_anaconda_download_url(
+    name: str, version: str, build: Optional[str] = None, anaconda_channel: str = "bioconda"
+) -> Optional[str]:
     """
-    Find a list of available anaconda versions for a given container name
+    Find the anaconda download url for a given package.
     """
     r = requests.get(
-        f"https://anaconda.org/{anaconda_channel}/{name}/files",
+        f"https://api.anaconda.org/package/{anaconda_channel}/{name}/files",
         timeout=MULLED_SOCKET_TIMEOUT,
     )
     r.raise_for_status()
-    urls = []
-    for line in r.text.splitlines():
-        if "download/linux" in line:
-            urls.append(line.split('"')[1])
-    return urls
+    package_files = r.json()
+    for package_file in reversed(package_files):
+        if (
+            package_file["version"] == version
+            and (build is None or package_file["attrs"]["build"] == build)
+            and package_file["attrs"]["subdir"] in ["linux-64", "noarch"]
+        ):
+            return f"https:{package_file['download_url']}"
+    return None
 
 
 def open_recipe_file(file, recipes_path=None, github_repo="bioconda/bioconda-recipes"):
@@ -211,50 +210,55 @@ def deep_test_search(
     """
     Look in bioconda-recipes repo as well as anaconda for the tests, checking in multiple possible locations. If no test is found for the specified version, search if other package versions have a test available.
     """
-    name = split_container_name(container)
+    name_tuple = split_container_name(container)
+    assert len(name_tuple) in (2, 3)
+    name = name_tuple[0]
+    version = name_tuple[1]
+    build = name_tuple[2] if len(name_tuple) == 3 else None
     for f in [
         (
             get_commands_from_yaml,
             open_recipe_file,
-            (f"recipes/{name[0]}/{name[1]}/meta.yaml", recipes_path, github_repo),
+            (f"recipes/{name}/{version}/meta.yaml", recipes_path, github_repo),
             container,
         ),
         (
             get_run_test,
             open_recipe_file,
-            (f"recipes/{name[0]}/{name[1]}/run_test.sh", recipes_path, github_repo),
+            (f"recipes/{name}/{version}/run_test.sh", recipes_path, github_repo),
             container,
         ),
         (
             get_commands_from_yaml,
             open_recipe_file,
-            (f"recipes/{name[0]}/meta.yaml", recipes_path, github_repo),
+            (f"recipes/{name}/meta.yaml", recipes_path, github_repo),
             container,
         ),
-        (get_run_test, open_recipe_file, (f"recipes/{name[0]}/run_test.sh", recipes_path, github_repo), container),
+        (get_run_test, open_recipe_file, (f"recipes/{name}/run_test.sh", recipes_path, github_repo), container),
         (get_test_from_anaconda, get_anaconda_url, (container, anaconda_channel), container),
     ]:
         result = try_a_func(*f)
         if result:
             return result
 
-    versions = get_alternative_versions(f"recipes/{name[0]}", "meta.yaml", recipes_path, github_repo)
-    for version in versions:
-        result = try_a_func(get_commands_from_yaml, open_recipe_file, (version, recipes_path, github_repo), container)
+    alt_versions = get_alternative_versions(f"recipes/{name}", "meta.yaml", recipes_path, github_repo)
+    for alt_version in alt_versions:
+        result = try_a_func(
+            get_commands_from_yaml, open_recipe_file, (alt_version, recipes_path, github_repo), container
+        )
         if result:
             return result
 
-    versions = get_alternative_versions(f"recipes/{name[0]}", "run_test.sh", recipes_path, github_repo)
-    for version in versions:
-        result = try_a_func(get_run_test, open_recipe_file, (version, recipes_path, github_repo), container)
+    alt_versions = get_alternative_versions(f"recipes/{name}", "run_test.sh", recipes_path, github_repo)
+    for alt_version in alt_versions:
+        result = try_a_func(get_run_test, open_recipe_file, (alt_version, recipes_path, github_repo), container)
         if result:
             return result
 
-    versions = find_anaconda_versions(name[0], anaconda_channel)
-    for version in versions:
-        result = try_a_func(get_test_from_anaconda, prepend_anaconda_url, (version,), container)
-        if result:
-            return result
+    url = find_anaconda_download_url(name, version, build=build, anaconda_channel=anaconda_channel)
+    result = try_a_func(get_test_from_anaconda, lambda x: x, (url,), container)
+    if result:
+        return result
 
     # if everything fails
     return {"container": container}
diff --git a/test/unit/tool_util/mulled/test_get_tests.py b/test/unit/tool_util/mulled/test_get_tests.py
index 6ee690fd2fb..c24d140d4fc 100644
--- a/test/unit/tool_util/mulled/test_get_tests.py
+++ b/test/unit/tool_util/mulled/test_get_tests.py
@@ -2,7 +2,7 @@ from unittest import SkipTest
 
 from galaxy.tool_util.deps.mulled.get_tests import (
     deep_test_search,
-    find_anaconda_versions,
+    find_anaconda_download_url,
     get_alternative_versions,
     get_anaconda_url,
     get_commands_from_yaml,
@@ -11,7 +11,6 @@ from galaxy.tool_util.deps.mulled.get_tests import (
     hashed_test_search,
     main_test_search,
     open_recipe_file,
-    prepend_anaconda_url,
 )
 from galaxy.util import smart_str
 from ..util import external_dependency_management
@@ -49,11 +48,6 @@ def test_get_anaconda_url():
     assert url == "https://anaconda.org/bioconda/samtools/1.7/download/linux-64/samtools-1.7-1.tar.bz2"
 
 
-def test_prepend_anaconda_url():
-    url = prepend_anaconda_url("/bioconda/samtools/0.1.12/download/linux-64/samtools-0.1.12-2.tar.bz2")
-    assert url == "https://anaconda.org/bioconda/samtools/0.1.12/download/linux-64/samtools-0.1.12-2.tar.bz2"
-
-
 @external_dependency_management
 def test_get_test_from_anaconda():
     # test old fashion tar.bz2 package
@@ -81,9 +75,20 @@ def test_get_test_from_anaconda():
 
 
 @external_dependency_management
-def test_find_anaconda_versions():
-    versions = find_anaconda_versions("2pg_cartesian")
-    assert "/bioconda/2pg_cartesian/1.0.1/download/linux-64/2pg_cartesian-1.0.1-0.tar.bz2" in versions
+def test_find_anaconda_download_url():
+    download_url = find_anaconda_download_url("2pg_cartesian", "1.0.0")
+    assert download_url is None
+    download_url = find_anaconda_download_url("2pg_cartesian", "1.0.1")
+    assert download_url is not None
+    assert download_url.startswith(
+        "https://api.anaconda.org/download/bioconda/2pg_cartesian/1.0.1/linux-64/2pg_cartesian-1.0.1-"
+    )
+    download_url = find_anaconda_download_url("2pg_cartesian", "1.0.1", "0")
+    assert download_url is not None
+    assert (
+        download_url
+        == "https://api.anaconda.org/download/bioconda/2pg_cartesian/1.0.1/linux-64/2pg_cartesian-1.0.1-0.tar.bz2"
+    )
 
 
 @external_dependency_management

From 78790f1a8a57700bec863ff4617e7116a031fcbd Mon Sep 17 00:00:00 2001
From: Nicola Soranzo <nicola.soranzo@gmail.com>
Date: Tue, 25 Nov 2025 17:14:12 +0000
Subject: [PATCH 13/13] Update action versions

to simplify forward merging.
---
 .github/workflows/build_container_image.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build_container_image.yaml b/.github/workflows/build_container_image.yaml
index 05dad1efb0a..9d1b93e1fa9 100644
--- a/.github/workflows/build_container_image.yaml
+++ b/.github/workflows/build_container_image.yaml
@@ -79,7 +79,7 @@ jobs:
       tag: ${{ steps.branch.outputs.name }}
       version: ${{ steps.version.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
       - uses: actions/setup-python@v6
@@ -139,7 +139,7 @@ jobs:
     needs: [ build ]
     steps:
       - name: Start k8s locally
-        uses: jupyterhub/action-k3s-helm@v3
+        uses: jupyterhub/action-k3s-helm@v4
         with:
           k3s-version: v1.32.0+k3s1  # releases:  https://github.com/k3s-io/k3s/tags
           metrics-enabled: false
@@ -235,7 +235,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Checkout Galaxy Helm chart
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: galaxyproject/galaxy-helm
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -250,7 +250,7 @@ jobs:
           sed -i "s/^  tag:.*/  tag: \"${{ needs.build.outputs.tag }}\"/" galaxy/values.yaml
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GALAXY_HELM_PULL_REQUEST_TOKEN }}
           commit-message: "Update Galaxy to version ${{ needs.build.outputs.version }}"