Classification: Bug (Sentry-reported) Severity: Medium Effort: Small (fix already exists)

The proxy endpoint's _filter_response_headers() in lib/galaxy/webapps/galaxy/api/proxy.py only strips content-length when upstream used content-encoding (compression). But the stream can also be truncated by MAX_STREAM_BYTES (1 MB) or MAX_STREAM_SECONDS (10s) limits on uncompressed responses, causing a mismatch between the forwarded content-length and actual bytes sent. Uvicorn's h11 layer then raises LocalProtocolError.

Classification: Bug Severity: Medium Effort: Small

The HistoryManager.purge() method in lib/galaxy/managers/histories.py (line 289) only cascades to HDAs, completely ignoring HDCAs:

Classification: Bug (regression in 25.1) Severity: Medium Effort: Small

PR #20859 (commit d679127310e) changed BaseDataToolParameter.to_python() in lib/galaxy/tools/parameters/basic.py to unwrap a single HDCA from the list when deserializing multiple="true" data parameters. Before this change, to_python always returned a list for multiple="true" params. Now when there's exactly one collection input, it returns a bare HistoryDatasetCollectionAssociation instead of [hdca].

File source template instances cannot be removed on Galaxy 26.0 because the "Remove instance" action (which sends PUT { hidden: true }) triggers variable validation against an empty dict, causing a 400 error when the template has required variables. This is a regression introduced by PR #21704 (merged 2026-02-12 into release_26.0), which tightened variable validation to treat variables as required by default. The fix is straightforward: skip variable validation in update_template_instance() when payload.variables is None (i.e., when the caller isn't changing variables). The same bug likely affects object store template instance removal.

• Severity: High -- functional breakage, core CRUD operation broken
• Blast radius: All file source template users on 26.0 with templates having required variables

Classification: Feature request (usability / configuration improvement)

Currently, Galaxy's credential support (used by tools via CredentialsService) stores secrets through the vault system, which requires admins to explicitly create a vault_conf.yml with a type: database entry and Fernet encryption keys. Without this config, VaultFactory.from_app() in lib/galaxy/security/vault.py returns a NullVault that throws InvalidVaultConfigException on any read/write.

As tools increasingly adopt the credentials framework (e.g., PR #21643 adding test credential support), every Galaxy instance that wants to use these tools needs manual vault configuration — a barrier that shouldn't exist for a core feature.

Classification: Bug

NOT a duplicate of #22019. The two issues have completely different stack traces and affect different subsystems:

• #22019: histories.py → get_record_metadata() — export metadata stored as string instead of dict
• #22132: tools/parameters/wrapped.py → process_key() — tool parameter flattening/nesting

Classification: Bug

The GCard component at client/src/components/Common/GCard.vue has no overflow constraint on its .g-card-content or .g-card-description containers, and no img { max-width: 100% } rule scoped to card content. When any card's description (rendered via markdown or the description slot) contains <img> elements, the images render at native size and bleed past the card border.

This affects any GCard consumer that allows user-supplied or markdown-rendered descriptions — workflow cards with annotated images, notification cards, etc. The markdown composable at client/src/composables/markdown.ts does nothing to constrain image sizes.

Classification: Bug

math.inf float values leak into JSON API responses where Python's json.dumps (with allow_nan=False, FastAPI/Starlette's default) rejects them. Two main sources:

1. Repeat.max field (lib/galaxy/tools/parameters/grouping.py:112): The Repeat group class defaults max to math.inf and includes it in dict_collection_visible_keys. When tool.to_dict() is called with io_details=True (e.g., GET /api/tools/{id}?io_details=true), the Repeat inputs are serialized, and inf ends up in the JSON response. The same applies to workflow module inputs that create Repeat groups with math.inf.

Dannon is running the weekly BRC-Analytics meeting this week. The plan is to open with a brief narrative retro of the past 7 days, ask about blockers, and then walk through the GitHub project board (galaxyproject/projects/56) as a group.