This release includes 8 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+3 more
Affected surfaces
ReleasePort's take
Moderate signalPostgres upgrades from version 15 to 17 now require a dump/restore or pg_upgrade; an in‑place restart is no longer supported.
Why it matters: Upgrading Postgres 15 → 17 mandates dump/restore or pg_upgrade, breaking any workflow that relied on an in‑place restart. Plan migration before the upgrade deadline.
Summary
AI summaryBroad release touches Admin and ops, Highlights, API, and Multi-organization / multi-site.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | High |
Postgres 15 → 17 upgrade requires dump/restore or pg_upgrade, not in-place restart. Postgres 15 → 17 upgrade requires dump/restore or pg_upgrade, not in-place restart. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Breaking | High |
DRF Token authentication removed; use JWT or per‑organization API keys instead. DRF Token authentication removed; use JWT or per‑organization API keys instead. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Breaking | High |
API now read‑only; external POST/PUT must use org‑scoped write path. API now read‑only; external POST/PUT must use org‑scoped write path. Source: llm_adapter@2026-06-02 Confidence: low |
— |
| Breaking | Medium |
Legacy article fields `takeaways` and `summary_plain_english` moved to per‑org `ArticleOrgContent`. Legacy article fields `takeaways` and `summary_plain_english` moved to per‑org `ArticleOrgContent`. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Breaking | Medium |
`Team.organization` field is now NOT NULL; defensive null handling removed. `Team.organization` field is now NOT NULL; defensive null handling removed. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Breaking | Medium |
`allowed_domains` moved from `Lists` model to new `CustomSetting` model. `allowed_domains` moved from `Lists` model to new `CustomSetting` model. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Breaking | Medium |
`TeamCredentials` model removed; ORCID and credentials are now per organization and team. `TeamCredentials` model removed; ORCID and credentials are now per organization and team. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Medium |
Adds full‑text search endpoint across articles, trials, and authors with CSV/streaming export. Adds full‑text search endpoint across articles, trials, and authors with CSV/streaming export. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Medium |
Adds per‑organization ORCID credentials and API keys, making GregoryAI multi‑tenant. Adds per‑organization ORCID credentials and API keys, making GregoryAI multi‑tenant. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Medium |
Adds new data sources: bioRxiv, medRxiv, ClinicalTrials.gov, and PNAS RSS feeds. Adds new data sources: bioRxiv, medRxiv, ClinicalTrials.gov, and PNAS RSS feeds. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Introduces announcements with CKEditor‑authored emails, CTA buttons, inline images, and per‑org ownership. Introduces announcements with CKEditor‑authored emails, CTA buttons, inline images, and per‑org ownership. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Enhances weekly digest email options: per‑date or relevancy modes, article limits, threshold filtering. Enhances weekly digest email options: per‑date or relevancy modes, article limits, threshold filtering. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Provides subscriber analytics including list distribution and historical active‑subscriber chart. Provides subscriber analytics including list distribution and historical active‑subscriber chart. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Adds new filters to API: intersection, `has_clinical_trials`, case‑insensitive trial status, ML‑score threshold, date filters. Adds new filters to API: intersection, `has_clinical_trials`, case‑insensitive trial status, ML‑score threshold, date filters. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Introduces per‑organization takeaways and summaries in serializers with read‑only viewsets. Introduces per‑organization takeaways and summaries in serializers with read‑only viewsets. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Dependency | High |
Python upgraded from 3.11 to 3.12; rebuild image and install from requirements.txt. Python upgraded from 3.11 to 3.12; rebuild image and install from requirements.txt. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Performance | Medium |
Performance tuning for full‑text search endpoint; reduced joins and caching added to `/stats/` aggregate endpoint. Performance tuning for full‑text search endpoint; reduced joins and caching added to `/stats/` aggregate endpoint. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Bugfix | Low |
Fixed dark‑mode rendering and Outlook email display issues; improved unsubscribe link handling. Fixed dark‑mode rendering and Outlook email display issues; improved unsubscribe link handling. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Refactor | Low |
Removed `pyproject.toml`; dependencies now installed from `requirements.txt`. Removed `pyproject.toml`; dependencies now installed from `requirements.txt`. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Refactor | Low |
Multi‑arch Docker build and push added via Makefile commands. Multi‑arch Docker build and push added via Makefile commands. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
Full changelog
I think it's the lack of hope that comes and gets you. … See, I believe in hope. I believe in belief. — Ted Lasso
And I believe that bringing people together is the best way to build something great. You don't need millions or the ability to throw rockets into space, you need a purpose and determination to build hope out of thin air.
This release is about building teams. GregoryAI is now a proper multi-tenant server and is already being used to speed up our research around brain regeneration.
Brain-regeneration.com was launched on the 16th of April and brings together 3 research labs.
- CNS, Blood and Peripheral Inflammation Lab — Lisbon, Portugal
- REGENERAR — Coimbra, Portugal
- LPJ Lab — Cambridge, UK
This release includes new API and newsletter features, improvements to newsletter subscriptions and lists, analytics on subscribers, per-organisation credentials, a Postgres and Python upgrade, and new data sources (bioRxiv, medRxiv, ClinicalTrials.gov, PNAS).
If you're running GregoryAI on your projects, please let us know. That way we can keep you up to date with the roadmap and add the project to the showcase on the main site.
Read on for the details.
Gregory AI v24
Range: v23 (2025-06-21) → main (2026-05-30). 113 merged PRs, ~717 commits.
Highlights
- GregoryAI is now multi-tenant: API keys, ORCID credentials, and editorial content are scoped per organization and team.
- New full-text search endpoint across articles, trials, and authors, with CSV and streaming export for large downloads.
- New data sources: bioRxiv, medRxiv, ClinicalTrials.gov, and PNAS.
- Announcements: rich, CKEditor-authored emails with CTA buttons and inline images.
- Platform upgrade to Postgres 17 and Python 3.12.
⚠️ Before you upgrade
Two changes will break a deploy if missed. Read these first, then the full list below.
- Postgres 15 → 17 is a major version bump — it needs a dump/restore or
pg_upgrade, not an in-place restart. - The API is now read-only. External clients that POST or PUT must move to the org-scoped write path.
The full breaking-changes list and step-by-step upgrade instructions are in the Breaking changes and Upgrade sections below.
What's new
Multi-organization / multi-site
- API keys per organization and team; org-scoped POST enforcement.
- Per-organization ORCID credentials (env-var dependency removed).
- Flag to mark an organization's API private, with visibility middleware.
- Multi-site support for subscription lists.
API
- Full-text search endpoint (articles, trials, authors) with performance tuning.
- CSV export and streaming responses for large downloads; full-results search export.
- New
/stats/aggregate endpoint with org filter, reduced joins, and caching. - Author endpoints: sort by article count; author statistics on
/categories/. - New filters: intersection,
has_clinical_trials(detects NCT IDs in abstracts), case-insensitive trial status, ML-score threshold, date filters. - Per-org takeaways and summaries in serializers; read-only viewsets.
Email and subscriptions
- Announcements: CKEditor-authored emails with CTA buttons and inline images, duplicate action, per-org ownership, image-quality and host-config safeguards.
- Weekly digest: per-date or per-relevancy modes, article limits, threshold filtering.
- Subscriber analytics: list distribution, historical active-subscriber chart.
- Dark-mode and Outlook email rendering fixes; sender-name setting; API-domain unsubscribe links; import, reconcile, and prune subscriber commands.
Data sources and ML
- bioRxiv and medRxiv support; ClinicalTrials.gov API; PNAS RSS.
- New RSS feeds for articles and clinical-trials-by-subject.
- Better ML algorithms and category matching with batch processing.
Admin and ops
- Richer admin: sources, subjects (with content analytics), teams (categories, sources, subjects inlines), per-org editorial inlines, subject deletion.
- Multi-arch Docker build and push; Makefile build commands.
- DB pruning for notifications and history; orphan author and article cleanup commands.
- Postgres 17, Python 3.12, codebase cleanup.
⚠️ Breaking changes
Read before upgrading.
- Postgres 15 → 17. Major version bump; requires a dump/restore or
pg_upgrade, not an in-place restart. SeeDEPLOYMENT_RUNBOOK.md. - Python 3.12. Rebuild the image;
pyproject.tomlwas removed — deploys install fromrequirements.txt. - API is now read-only. All ModelViewSets are locked to read-only (Phase 5). External clients that POST or PUT must move to the org-scoped write path.
- DRF Token auth removed. The
/api-token-auth/endpoint and authtoken tables are gone (Phase 6). Use JWT or per-organization API keys instead. - Legacy article fields dropped.
Articles.takeawaysandsummary_plain_englishnow live inArticleOrgContent(per-org). Confirm data was moved before deploying — seeMIGRATION_SAFETY.md. Team.organizationis now NOT NULL. Defensive null-handling removed; every team must belong to an organization.allowed_domainsmoved fromListstoCustomSetting.TeamCredentialsmodel removed — ORCID and credentials are now per organization and team.
Upgrade
Review MIGRATION_SAFETY.md first — there are 74 migrations, including irreversible data migrations and a Postgres major-version upgrade. Then follow DEPLOYMENT_RUNBOOK.md.
- Back up the database and confirm the dump is restorable.
- Upgrade Postgres 15 → 17 via dump/restore or
pg_upgrade. - Rebuild the image on Python 3.12 (installs from
requirements.txt). - Run migrations.
- Run
python manage.py createcachetable gregory_cacheto set up the new DB cache backend. - Migrate any external POST/PUT clients to the org-scoped write path and off Token auth.
Breaking Changes
- Postgres 15 → 17 major version bump requires dump/restore or pg_upgrade, not in‑place restart.
- Python upgraded to 3.12; rebuild image from requirements.txt (pyproject.toml removed).
- API is now read‑only; external POST/PUT must use org‑scoped write path.
- DRF Token authentication removed; migrate to JWT or per‑organization API keys.
- Legacy article fields `takeaways` and `summary_plain_english` moved to per‑org `ArticleOrgContent` model (dropped from Articles).
- `Team.organization` is now NOT NULL; every team must belong to an organization.
- `allowed_domains` migrated from `Lists` model to `CustomSetting`.
- Removed `TeamCredentials` model; ORCID and credentials are now per‑organization/team.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About brunoamaral/gregory-ai
All releases →Related context
Beta — feedback welcome: [email protected]