LabKey SDMS: Premium Edition Features

• MCP Server - Provides new ways to explore your data using intelligent agents. (docs)
• MCP-Enabled SQL Access - AI agents connected to the MCP Server can now read and query data from any schema or table the authenticated user has permission to access, using the new 'executeSQL' tool. Query results respect existing container and row-level permissions.
• SQL Server 2025 Support - Support for SQL Server 2025 as an external data source. (docs)
• Exchange Online Email Support - Support for sending email via Exchange Online using Microsoft Graph Protocol API for authentication.
• Calculated Column Expression Assistant - Describe the calculation you need in plain language and let AI generate the LabKey SQL expression for you. (docs)
• AI-Backed Product Features Flag - This optional feature flag controls AI-backed assistance embedded in the product, such as the Calculated Column Expression Assistant, independently of the Enable MCP Server feature. (docs)
• File Naming Pattern Required for File Watchers - New file watchers and edits to existing file watchers must have a file naming pattern provided in order to save successfully. (docs)

LabKey SDMS: Community Edition Features

• Experiment Diagram Improvements - Experiment diagrams have been enlarged and rendering has been improved.
• MVTC Audit Log Quoting - Multi-value text column (MVTC) fields now include additional quotes in audit log entries to accurately represent the stored values in the database. This applies across all data types.
• New Reports/Views/Queries Metadata Tables - New built-in queries collect all Reports, Custom Views, Custom Queries on the site, giving administrators improved control over these resources. Available via the Schema Browser and all standard query access mechanisms, these queries expose key metadata and support filtering, sorting, and deletion of unneeded objects.
• Role-Restricted API Keys - API keys can now be restricted to a specific security role (for example, Reader or Editor), as a way to impose appropriate limits on AI agents, tools, and scripts. (docs)
• CAS renew Option - The CAS identity provider now supports the renew=true option of the login endpoint.
• Limit Login Attempts Moved to Community Edition - "Limit Login Attempts" has been moved to the Community Edition. (docs)
• frame-ancestors CSP Directive - You can now select frame-ancestors as a Content Security Policy (CSP) directive when configuring Allowed External Resource Hosts, making it possible to allow embedding LabKey in an iframe on an external site without editing application.properties.
• LabKey Documentation AI Agent Integration - Desktop AI agents can now connect to the labkey.org MCP server to answer questions directly from the documentation. (docs)
• Configurable Terms of Use Acceptance Interval - Administrators can now configure how often users must accept terms of use: every sign-in (the default), once a day, every 7 days, or every 30 days. When a longer interval is selected, users are no longer prompted on the login page. Instead, their remembered acceptance is checked after sign-in, and they are only asked to re-accept once it expires.

Distribution Changes and Upgrade Notes

• Microsoft SQL Server No Longer Supported as Primary Database - 26.7 is the last LabKey release that will support Microsoft SQL Server as the primary database. All future releases will require PostgreSQL as the primary database. Using SQL Server as an external data source will continue to be supported.
• Graphviz/DOT No Longer Used - Graphviz/DOT executables are no longer used by LabKey, are no longer included in distributions, and can be uninstalled from existing deployments.
• module.xml vcsTag Removal - Third-party modules should remove 'vcsTag' from any manually maintained 'module.xml' files. Modules containing this property will cause errors at startup.
• Inactive Users Lose All Permissions - Inactive users now have no permissions. Any ETL or file watcher configured to run as an inactive user will start to fail; update these configurations to use an active user.
• Redefinition of "Project Users" - The definition of "project users" has changed from "members of any project group" to "users with read permissions in the current folder or project."
• Disallow Mutating SQL in GET Requests - Actions that execute mutating SQL (INSERT, UPDATE, DELETE, etc.) triggered via GET requests are no longer allowed in production deployments. Previously, this restriction was only enforced in dev mode. A deprecated feature flag is available to temporarily restore the previous behavior if you encounter an action that has not yet been migrated to POST.
• X-Frame-Options Header Removed - The X-Frame-Options header setting in Site Settings has been removed in favor of the frame-ancestors directive in the standard CSP. If necessary, this (and all other CSP directives) can be customized on the "Allowed External Resource Hosts" administration page.
• Server and Database Time Discrepancy Warning - If the web server and database server clocks differ by more than 10 seconds, a configuration warning is now displayed to administrators, helping prevent data integrity issues caused by inconsistent timestamp comparisons.

Deprecated Features

• Derive Samples Button Removed - The "Derive Samples" button has been removed from data grids in LabKey SDMS. Also, the link "Derive samples from this sample" has been removed from the sample details page.
• Special R Report Sharing Removed - Support for special R report sharing has been removed.
• ExtJS v3.4.1 Deprecated - The site settings requiring ExtJS v3.4.1 and the ExtJS 3.x-based Client API have been changed to deprecated feature flags and turned off by default. These flags will be removed permanently in 26.11. (docs)

Client APIs and Development Notes

• getUsersWithPermissions() Flags Removed - The 'getUsersWithPermissions()' Java method no longer supports the 'inactive' or 'includeInactive' flags.
• user-getUsers.api Now Admin-Only - The user-getUsers.api action now requires administrator permissions and returns all users in the system matching the requested criteria. Previously, it returned only "project users" matching the criteria - a concept that no longer applies.
• security-bulkUpdateGroup.api Container Requirement - When updating a project group, callers of security-bulkUpdateGroup.api must use the project that owns the group. Previously, Site Administrators could perform updates in the root container.

Other Release Notes

• LIMS Suite Release Notes
• Release Notes: SDMS 26.3