42.64.0

Show maintenance

November 9, 2026

Features

Let administrators revoke all of a user's access4207

A Revoke action in the Danger Zone of the user page signs a compromised user out everywhere and removes their password, API keys, passkeys, two-factor authentication, and outstanding links. It also marks their email address as not verified, so the user can't recover the account by themselves and Virtool doesn't email them. To restore access, issue a recovery link and give it to the user through a channel you trust. Revoking an administrator requires the full administrator role.

Let a passkey satisfy the required two-factor authentication policy4214

When an instance requires two-factor authentication, a user who has a passkey can now use Virtool without an authenticator app. An administrator who has a passkey can now turn on the requirement. A user who has no authenticator app and removes their last passkey must set up an authenticator app before they can use Virtool again. The account security page warns before this happens.

Fixes

Ask for confirmation before deleting an analysis4212

A confirmation dialog now appears when you choose to delete an analysis. Before this change, the analysis was deleted immediately.

Disable the two-factor authentication policy checkbox while the change saves4214

On the security administration page, the "Require two-factor authentication" checkbox is now disabled and dimmed until Virtool saves the change. Before, the checkbox did not change and ignored clicks, with no sign that Virtool was saving.

Explain that API key permissions do not limit reads4214

The forms that create and edit API keys now tell you that permissions limit only what a key can change. A key can read all the data that your account can read.

Fix small problems in the Nuvs analysis view4212

The link to a running BLAST search now has the correct address. Sequences show 1 ORF in place of 1 ORFs, and sequences with no HMM hits no longer show an empty E-value. Exported Nuvs files now have an underscore in place of every space in the sample name. The HMM alert now uses the name Nuvs.

Fix the Virtool API link on the API Keys page4212

The link now opens the current Virtool API documentation. Before this change, the link pointed to a page that no longer exists.

Do not show the HMM alert in the analyze dialog boxes when HMM data is installed4212

The alert no longer appears when HMM data is installed. Before this change, the alert could appear even when the data was present.

Configure authentication only from Virtool's own variables4211

The web server does not start when BETTER_AUTH_SECRETS or BETTER_AUTH_TRUSTED_ORIGINS is set, because Better Auth would use them in place of, or in addition to, VT_AUTH_SECRET and VT_PUBLIC_ORIGIN. Unset them before you upgrade. The setup and login device cookies are now Secure when VT_PUBLIC_ORIGIN uses https, the same as the session cookies.

Require recent authentication to change the account handle4215

The handle is the name that you sign in with. If you have not signed in or confirmed your identity in the last 15 minutes, Virtool now asks you to confirm your identity before it changes your handle.

Show small read shares correctly in the Pathoscope mapping overview4212

The Subtracted row no longer shows −0.00% when no reads were subtracted. A share that is more than zero but less than 0.01% now shows as <0.01%.

Show a weight of zero as 04212

A weight of zero now appears as 0. Before this change, it appeared in scientific notation as 0E0.

Show the analysis delete button to users with write access to the sample4212

Sample owners and other users with write access can now delete analyses from the Analyses tab. Administrators without write access no longer see a button that the server refuses.

Show when an analysis failed or was cancelled4212

The analysis page now shows Analysis failed or Analysis cancelled when the job stops before the analysis is complete. The page also shows a link to the job. Before this change, the page showed Analysis in progress forever.

Show when an analysis job succeeded but the analysis did not finish4213

The analysis page now shows Analysis did not finish and a link to the job when the job succeeded but the analysis is not ready. Before this change, the page showed Analysis in progress forever.

Maintenance

Remove the fallback for email links queued in plaintext4203

42.65

42.64

42.63

42.62

42.61

42.60

42.59

42.58

42.57

42.56

42.55

42.54

42.53

42.52

42.51

42.50

42.49

42.48

42.47

42.46

42.45

42.44

42.43

42.42

42.41

42.40

42.39

42.38

42.37

42.36

42.35

42.34

42.33

42.32

42.31

42.30

42.29

42.28

42.27

42.26

42.25

42.24

42.23

42.22

42.21

42.20

42.19

42.18

42.17

42.16

42.15

42.14

42.13

42.12

42.11

42.10

42.9

42.8

42.7

42.6

42.5

42.4

42.3

42.2

42.1

42.0