[Tools-discuss] June tools update

[Robert Sparks <[e-mail]>]

(This is also available at https://notes.ietf.org/tools-update-202606)

# IETF tools update 2026-06

[Previous report](https://notes.ietf.org/tools-update-202605) | [Next 
report](#)

## The Big Picture

### RFC Production Center Modernization Project

The first versions of the new RPC related applications were deployed May 
20. The deployment went as planned, with minimal disruption to users of 
rfc-editor.org. The feedback from the deployment has been predominantly 
positive with good suggestions for improvement being captured on the 
tools-discuss list and in github issues. In particular, in response to 
feedback we diverted some resources to providing basic fallback 
functionality for better access to the rfc-editor content for users that 
do not use javascript.

This set of deployments brought several years of effort into production, 
which now provides

* A new queue management workflow tool for the RPC fully integrated with 
the datatracker. This is the core RPC database and it has replaced the 
existing database and software that could not handle five-digit RFC numbers.
* A complete reimplementation of www.rfc-editor.org.  The backend takes 
data from the new queue management system and the datatracker, and the 
frontend uses a new design from our UI/UX specialist contractors that 
aims to significantly improve the experience for consumers of RFCs. The 
frontend is also built around the concept of pre-computation, and is 
served almost entirely from the edge.
* A new public site, queue.rfc-editor.org, for authors and others 
tracking the editing of an RFC, with detailed information about 
documents in the queue.
* Editing software for the RPC that now provides all the current 
functionality that the editors rely on in an integrated GUI, replacing 
the multiple command line scripts they previously worked with. This also 
integrates with GitHub and Datatracker, automating previously manual 
processes.
* A new, more streamlined publication process for RFCs that leverages 
GitHub.
* A reimplementation of the existing errata system into a new site, 
errata.rfc-editor.org that is integrated with the new www.rfc-editor.org 
and datatracker.
* As part of this work, extensive work has gone into identifying and 
resolving differences in data between the RPC database and datatracker, 
leading to significantly improved data on authors and RFCs in the 
datatracker.

More functionality remains to be developed building on this initial set 
of releases:
* The next set of improvements for www.rfc-editor.org have been 
professionally designed and implementation is beginning.
* A final review process that streamlines and integrates auth48 into the 
new system including the datatracker is being constructed.
* Further integration into the datatracker.

With the initial release, development is returning to a wider focus, 
addressing work that has been deferred by this project. The above 
additional functionality will be scheduled along with that work.

If you discover issues with the new Rfc Editor website, please either 
report them at https://github.com/ietf-tools/red/ or at 
[e-mail].

### IETF Tools roadmap

The roadmap has not been updated since the last report. We will be 
discussing our planning and how to engage with the community going 
forward at the tools retreat the week of 15 June.

---

## ⌨️ Development Projects

### Datatracker

Since the last IETF tools update (May 2026) there were four datatracker 
releases (two minor releases and two patch releases). See [the release 
page](https://github.com/ietf-tools/datatracker/releases) for releases 
12.64.0 through 12.65.2. The full set of changes is 
[here](https://github.com/ietf-tools/datatracker/compare/12.63.1...12.65.2).

These releases included:
* Fix for daily YANG model checks task failures
* Backporting a Django security patch for 
[CVE-2026-35192](https://github.com/advisories/GHSA-7h2m-m8vj-598h)
* More accurate author lists for RFCs
* Final preparations and integration with the new RPC tools

Current activities:
* Operational adjustments to reduce downtime during upcoming k8s upgrades
* Preparation for migration to Django 5.2 LTS

### Author Tools

See release notes for 
[1.10.16](https://github.com/ietf-tools/author-tools/releases/tag/1.10.16), 
[1.10.17](https://github.com/ietf-tools/author-tools/releases/tag/1.10.17) 
and 
[1.10.18](https://github.com/ietf-tools/author-tools/releases/tag/1.10.18).

These updates include `kramdown-rfc` and `xml2rfc` updates; also added 
github automation to create PRs for new `kramdown-rfc` releases.

### XML2RFC

See release notes for 
[3.34.0](https://github.com/ietf-tools/xml2rfc/releases/tag/v3.34.0).

This update improves reference sorting and fixes non 5-digit RFC and 
subseries reference sorting issue. See 
[#1318](https://github.com/ietf-tools/xml2rfc/issues/1318).
3.34.0 also bumps up Weasyprint requirement to 
[69.0](https://github.com/Kozea/WeasyPrint/releases/tag/v69.0) which 
contains a security update.

### BibXML Service

We have been working on moving BibXML geernation for RFCs, RFC subseries 
and I-Ds to datatracker.
These will be servered from a blob store.
These chagnes are current on a [feature 
branch](https://github.com/ietf-tools/datatracker/tree/feat/bibgen).

See [#10830](https://github.com/ietf-tools/datatracker/issues/10830), 
[#10914](https://github.com/ietf-tools/datatracker/issues/10914) and 
[#10973](https://github.com/ietf-tools/datatracker/issues/10973) for 
more information.

### Wagtail websites (www.ietf.org, www.iab.org)

_No updates since the last report._

### idnits

_No updates since the last report._

### Mailarchive
There were five releases since the last report. See [the release 
page](https://github.com/ietf-tools/mailarchive/releases) for releases 
2.44.0 through 2.46.2. Work focused on:
  * dependency updates
  * new API to import mbox archives
  * tooling to filter duplicate messages from the archive
  * continued work on blob storage support (message detail pages are now 
being served from the edge)


### Registration
There were three releases since the last report. Work consisted of:
  * improvements to Registration admin view
  * support adding ancillary registrations (hackathon, ANRW) from the 
participant dashboard without submitting another full registration
### Retooling the RPC workflow ("Purple")

#### General overview:
- purple was launched on May 20th
- the leadup to the release involved a large number of adjustments and 
corrections

#### Progress since last report:
- continuous work on non-blocking bugs reported before launch and issues 
reported since
- adjustments on email templates (enqueing, final review, publication 
announcement)
- improvements of label management
- fix of DT notification logic for approvel message updates
- improve UI for handling IANA status

### RFC Editor website ("Red")


Since the launch of the site there have been a flurry of fixes and 
features deployed:
- A new `/rfc-index/` route added, like the previous site's 
`/rfc-index.html` that has a simple list of all RFCs.
- The homepage and search results use Cards to display large block links 
to RFCs and other website content. They now have a hover/focus tint to 
better indicate the clickable area.
- New markdown pages contributed by Eliot Lear: 
[`/authors/ise/ise-checklist/`](https://rfc-editor.org/authors/ise/ise-checklist/), 
[`/authors/ise/iseb/`](https://rfc-editor.org/authors/ise/iseb/), 
[`/authors/ise/ise-reviewer-guidelines/`](https://rfc-editor.org/authors/ise/ise-reviewer-guidelines/).
- Improved No-JS handling (when browsers have JavaScript disabled or 
unavailable): menus, RFC tabs, and a simple search.
- Various redirects, read the [worker router definition for 
details](https://github.com/ietf-tools/red/blob/main/worker/src/index.ts#L56).
- Accessibility contrast color fixes.
- fix: Dark mode search
- fix: `/info/rfcN/` browser line-break hints `<wbr>` handling.
- fix: Safari-specific JS improvements.
- chore: Website JS bundle size optimisations (improved JS bundle 
chunking, removing `@nuxt/content` in favour of a bespoke solution as we 
don't need the WASM SQLite db query features).
- `CHANGELOG.md` moved to 
[`/docs/MAJOR_CHANGES.md`](https://github.com/ietf-tools/red/blob/main/docs/MAJOR_CHANGES.md)

### Queue

- fix: pending activities
- accessibility improvements: reduced motion support for graph.
- table improvements
   - all columns that can be sortable are sortable
   - all tables have 'sticky' headers (follow page scroll)

### Errata system

The re-implemented errata system deployment went smoothly. The system now

* Holds reports for spam screening by the secretariat.
* Uses datatracker credentials for RPC member and stream validator login.
* Makes the set of reported errata a logged in validator can validate 
easier to work with.
* Better integrates with datatracker for information about groups.

The re-impementation otherwise did not change the errata reporting, 
searching, or validation process. We still await community consensus 
around what the errata system should become before making major changes.

Upcoming work:
* A complete test framework, and small improvements to the ci/cd paths.
* Incremental improvements to views and emitted email.


### RPC Editor (DraftForge)

DraftForge has transitioned from alpha/beta to stable release 1.x.

- **feature**: Add export from markdown format
- **fix**: Ignore XML comments in "inconsistent capitalization" tool
- **fix**: Ignore email, target and title elements in "inconsistent 
capitalization" tool
- **fix**: Use output filename as input when generating HTML export
- **fix**: Warn when no format is selected in "Export as" tool

### Side Meetings

The "Request a Side Meeting" button is now disabled until the active 
period starts.

### Email systems

  * Updated Content-Security-Policy on existing mailman web interface to 
make avatars visible, h/t Kesara
  * Unified logging configuration for DMARC rewriting daemon, 
postconfirm, and postfix
  * Migration of UAT environment from Digital Ocean -> Azure
  * Development of global mail system dashboard, based on unified logs 
from all containers, relays and existing mail systems
  * Fixed IMAP failed login logging and dashboard for better awareness 
of operational issues

### YANG Catalog

_No updates since the last report._

### Meetecho Player

Now you can share a link at a certain timestamp with [Meetecho 
player](https://meetecho-player.ietf.org/).

---

## Maintenance

### Django
(Unchanged since previous report) As mentioned in previous IETF tools 
updates, several systems, including Datatracker, still run on Django 4.2 
LTS. This reached the end of long-term support with release 4.2.30 on 7 
April 2026. We are preparing to upgrade to Django 5.2 LTS as soon as 
other priorities allow. In the meantime, we are monitoring for CVEs that 
affect Django 4.2 and will take appropriate action if necessary. So far, 
one possibly relevant vulnerability has been identified 
([CVE-2026-35192](https://www.cve.org/CVERecord?id=CVE-2026-35192)) and 
we have backported the fix from Django 5.2.

### Debian image bases
(Unchanged since previous report) Most of our containerized applications 
rely on Debian, and require updates following the Debian lifecycles. The 
datatracker’s base image is currently built on bookworm (12), but needs 
to move to trixie (13) to support changes to libyang/libyang3-tools that 
are not available on bookworm. We attempted to make this move at the end 
of 2025 but encountered a dependency issue that will need to be resolved 
before we proceed.

### Kubernetes

The June 4 upgrades did not go as planned and will be rescheduled at a 
future date. We have not yet begun upgrading the Kubernetes versions for 
our primary production clusters.