[Tools-discuss] August Tools Update

[Robert Sparks <[e-mail]>]

This is also available at https://notes.ietf.org/tools-update-202608

# IETF tools update 2026-08

[Previous report](https://notes.ietf.org/tools-update-202607) | [Next 
report](https://notes.ietf.org/tools-update-202609)

## The Big Picture

### Planning and community engagement

There are thousands of outstanding GitHub issues (e.g. 1.1k for 
Datatracker) going back many years and almost all sit as individual 
issues, not part of a structure of related issues and have not been 
assessed for effort or priority.  This is a significant barrier to 
proper planning and prioritisation of work.

A major outcome of the Tools retreat was a new planning process to 
address and work has begun on a three phase plan to implement this.  The 
intended outcome is that all of the issues are organised, their effort 
assessed and then a process in place to understand and record community 
priorities.

While the process might seem heavyweight, it is unavoidable given the 
size of our systems and the work involved. The most daunting aspect is 
the backlog, but without that this process will be quick and adaptable.

#### Phase 1 - Organising the mess of GitHub issues
For the three weeks after IETF 126 Vienna, the team will be focused on 
the first phase - reviewing all outstanding GitHub issues and putting 
them into a structure of:
```
Goal -> Project -> Epic -> Task
```
Most of this work will be in the Tools Team ZenHub instance, which is 
not visible to the community, but the intention is to link it to the 
public repos so that the result is visible. During this phase anything 
immediately urgent will be identified, but most of the issues will not 
be estimated or prioritised at this point.

To provide an example of the work involved, take this issue [Reflect 
Designated Experts position in their personal Datatracker 
page](https://github.com/ietf-tools/datatracker/issues/9204) which might 
at first seem straightforward.  When triaged more closely, this breaks 
down into a series of steps: 1) Provide IANA with a spec for a needed 
API; 2) Model the different types of DE that can appear against a 
registry (e.g. person, AD role, list, set of chairs); 3) Reconcile IANA 
data with Datatracker; 4) Set up live import using the API. This now 
becomes a Project under the Goal of "Accurate and comprehensive record 
of the standards process, roles and personal contribution" and the steps 
underneath it become epics.

It is likely that three weeks will not be enough to complete this phase 
and a further sprint will be required.

#### Phase 2 - Estimating the level of effort (LoE) required
When the tasks are identified (the lowest level of structure), the LoE 
will be estimated by the developer most likely to implement. The team 
will meet together regularly to check consistency of the estimation 
using 'estimation poker'.  Estimating at the lowest level of structure 
allows for the calculation of the LoE for higher levels using simple 
summation.  It also means that if a task is estimate with an LoE larger 
than the largest estimate allowed then this triggers that task being 
broken up into smaller, more achievable tasks.

#### Phase 3 - Initial prioritisation and community engagement
Priority will generally be set at the Goal and Project level not below 
that. The Tools Team will take the first pass at that to provide a 
starting point and then open it up to the community for feedback, 
through a mechanism yet to be determined.

### System performance / SLA
The Executive Director expects to issue a consultation on system 
performance expectations and a proposed SLA for that, before the 
September update.

### AI written code
The team discussed AI in depth at their retreat, focusing on three areas.

#### Use of AI by the Tools Team
The views of individuals on how much they wish to use AI varied across 
the whole spectrum within the team.  The rule continues to be that it is 
the decision of each developer and they remain responsible for all code 
they commit.

#### AI assisted contributions
The team expects to start receiving large, ambitious PRs for most 
systems that are written with the assistance of AI.  This could prove a 
denial-of-service if the team continues its current practice of reading 
every line submitted in a PR.  To assist with this, the guidelines for 
contribution will be updated to ask submitters of large PRs to meet a 
detailed set of requirements aimed at making it practical for the team 
to review and assimilate them:
* A human readable high-level plan that explains their work
* The code broken down into small pieces, individually reviewable
* Code follows existing style
* Tests that meet our current test strategy
* All new dependencies clearly called out and justification provided as 
to why they are needed
* Backed by a human who makes an ongoing commitment to support this PR
* And compliance with other rules

Even with this, it is likely that some form of trusted contributor 
framework will need to be adopted as the only safe way to guard against 
malicious code (intentional or not) if it becomes practically impossible 
to read every line.

#### AI maintained codebases
It is clear that AI provides a real opportunity to address a large 
backlog of work and take on projects that have previously been 
considered too ambitious with current resource constraints. It also 
allows for old codebases that would not otherwise get much attention to 
be maintained.

However, this is at the cost of AI writing most of the code and that 
receiving a lower level of human review than would happen for a more 
critical system, where every line is read. The key concerns with this 
approach are correctness and security, which for high impact code will 
continue to require full human review, but for low impact code the 
checking may rely instead on assessing the test quality and/or 
adversarial code review with another AI.  This is all still under 
discussion.

## :fire: Hot Topics :fire:

### RFC Editor Part 2

Work is well underway on the remaining phases of the part two project 
for the RFC Editor website, a project supported by grant funding.  This 
has the three key objectives of:
1. Understanding RFC Consumer engagement
2. Assisting RFC Consumers in creating and using custom sets of RFCs
3. Improving the accessibility of on-screen rendering

The changes are underway, with those for objective 1 due to be released 
at the end of August.  These will include enabling people to:
* rate the site and provide suggestions for improvement
* rate an RFC and explain why they are reading it
* receive notifications on new RFCs and possibly errata on specified RFCs

The latter will require an account feature added to the site.

### IETF 126

We again had a very smooth meeting from the tooling operations 
perspective. Our systems operated as intended throughout the week and we 
encountered no significant service interruptions or outages.

---

## ⌨️ Development Projects

### Datatracker

During IETF 126, the Datatracker operated smoothly and without incident. 
We had our traditional Code Sprint on the Saturday before the meeting 
and are grateful for the contributed code and bug fixes from those who 
attended. One PR from the sprint has been merged and the others will be 
included in forthcoming releases. :tada:

The base image used by Datatracker is now running on Debian "trixie" 
(13), the current stable branch of the distribution. As part of this 
upgrade, it also moved to Node 26. Community contributors will need to 
rebuild their development containers when working on branches that 
include these updates.

Since the last IETF tools update (July 2026) there were three 
Datatracker releases (all minor releases). See [the release 
page](https://github.com/ietf-tools/datatracker/releases) for releases 
12.68.0 through 12.70.0. The full set of changes is 
[here](https://github.com/ietf-tools/datatracker/compare/12.67.1...12.70.0).

These releases included:
* Upgrading the base image to Debian "trixie" (13) and Node 26
* Moving to libyang/libyang3-tools v3.12.2
* Exposing idnits v3 to all users
* Generating RFC metadata JSON files at Datatracker at publication time
* Fixed styling for page breaks in HTML views of older RFCs
* Added link to the IESG Decisions view on the IESG group menu
* Dropped leading zeroes from RFC DOI references
* Added I-D archive URL to WG Last Call messages
* Reconciled participant / attendee counts across several contexts
* Using correct primary email for non-IETF-stream ballot emails
* New private API to support RPC author survey generation

Current activities:
* Systematically reviewing and organizing issue backlog in preparation 
for planning and prioritization
* Planning the conversion of Datatracker from an OIDC provider to a 
client of a new self-hosted authentication service
* Preparation for migration to Django 5.2 LTS
* Moving bibxml generation for RFCs and I-Ds into Datatracker (see the 
feat/bibxml branch)

### Author Tools

See release notes for 
[1.11.0](https://github.com/ietf-tools/author-tools/releases/tag/1.11.0).

This release migrates to `gevent` workers since `gnuicorn 26.0.0` 
dropped support for  `eventlet`.
This release also updated the header menu link for **idnits** to direct 
users to [idnits v3 micro 
service](https://author-tools.ietf.org/idnits3/). Old **idnits** 
interface is still available under 
[https://author-tools.ietf.org/idnits](https://author-tools.ietf.org/idnits).

### XML2RFC

No new releases since the last report.

### BibXML Service

We have been working on moving BibXML generation for RFCs, RFC subseries 
and I-Ds to datatracker.
These will be served from a blob store.
These changes are current on a [feature 
branch](https://github.com/ietf-tools/datatracker/tree/feat/bibgen). The 
initial implementation (when this goes live) will serve RFC and RFC 
subseries generated from datatracker via a blob store.

See [#10830](https://github.com/ietf-tools/datatracker/issues/10830), 
[#10914](https://github.com/ietf-tools/datatracker/issues/10914) and 
[#10973](https://github.com/ietf-tools/datatracker/issues/10973) for 
more information.

### Wagtail websites (www.ietf.org, www.iab.org)

See release notes for 
[2.10.0](https://github.com/ietf-tools/www/releases/tag/2.10.0) and 
[2.10.1](https://github.com/ietf-tools/www/releases/tag/2.10.1).

These releases updated NodeJS from 20 to 26 (LTS) and fixed issues with 
meta descriptions in HTML.

### idnits

No new releases since the last report.

### Mailarchive
There were two releases since the last report. See [the release 
pages](https://github.com/ietf-tools/mailarchive/releases) for releases 
2.48.0 - 2.48.1. Work focused on:
  * Fix bug with thread link orderering (below message content)
  * Simplify and improve purge of incoming message bucket
  * Dependency updates
  * Switch to use cloudflare purge by cache-tag for cache invalidations
  * Implemented a few code review efficiency improvements

### Registration
There were three releases since the last report (1.86.1 - 1.88.0). Work 
consisted of:
  * Fix bug with Add Remote Hackathon option
  * Prevent double submission of registration form
  * Add Hackathon Only Report
  * Fix issue with carried-forward credits
  * Change Tax Detail net sales computation (per accounting)
  * Improvements to EventRegistration admin view
  * Add button for canceling event registrations
  * Save canceled-by and date for canceled registrations


### RPC workflow tool (“Purple”)

Since the last IETF tools update (July 2026), there were six purple 
releases (all major releases). See the [release 
page](https://github.com/ietf-tools/purple/releases) for releases 1.18.0 
through 1.23.0.

These releases include:

* Added statistics graphs and tables
* Improved metadata validation
* Allow update of `rev` and `abstract` fields
* Backfill missing IRTF groups
* Allow search and display of withdrawn docs
* Improved RPC team member pages
* Added oxlint and oxftm validations in GitHub Actions and making 
current codebase compliant

### RFC Editor website ("Red")

Features:
* Search v2 (feature flagged).
* `/info/rfcN/`
   * `<wbr>` insertion fix, causing linebreaks after `_` characters.
   *  `<dl>` list alignment fix, improving vertical alignment of `<dt>` 
and `<dd>`.
   * Bug fix: scroll TOC
* List of 'Never Issued' RFCs, and link.
* Authentication prototyping
* Page rendering cache improvements
* Markdown page 'last updated' simplification.
* Bug fix: RFC metadata abstracts aren't HTML
* Bug fix: social media thumbnails rendering entities as text, due to 
Satori bug.
* Bug fix: to restore scroll position after clicking internal links and 
then browser 'back' button.
* Dependency upgrades.

### Queue pages

* Dependency upgrades.

### Errata system
No new releases since last report. [Several 
PRs](https://github.com/ietf-tools/errata/pulls?q=is%3Apr+is%3Amerged+closed%3A%3E2026-07-01+) 
have already been merged to main, and a release is expected in early August.

### RPC Editor (DraftForge)

No new releases since the last report.

### Side Meetings

A complete rewrite of the Side Meetings website is ready and will be 
deployed shortly after IETF 126. It removes the dependency on the 3rd 
party service (`Cal.com`) and instead use our own backend for greater 
flexibility and reliability.

It also provides an administration area for the secreteriat to manage 
meetings, rooms and bookings.

Past meetings are now viewable as well.

### IETF Account / Authentik

An authentik instance has been setup and a fully custom frontend for 
users to manage their account has been deployed.

There's remaining work for users to be able to migrate their Datatracker 
account over and to make Datatracker act as a OIDC consumer rather than 
a server.

### Email systems

Danebot has been modified to work with Cl.

### YANG Catalog

No updates since last report.

---

## Maintenance

### Django
(Unchanged since previous report) As mentioned in previous IETF tools 
updates, several systems, including Datatracker, still run on Django 4.2 
LTS. This reached the end of long-term support with release 4.2.30 on 7 
April 2026. We are preparing to upgrade to Django 5.2 LTS as soon as 
other priorities allow. In the meantime, we are monitoring for CVEs that 
affect Django 4.2 and will take appropriate action if necessary. So far, 
one possibly relevant vulnerability has been identified (CVE-2026-35192) 
and we have backported the fix from Django 5.2.
Debian image bases

### Debian image bases
Most of our containerized applications rely on Debian, and require 
updates following the Debian lifecycles. As described above, the 
Datatracker is now up-to-date with the stable Debian "trixie" (13). This 
work came in via [this pull 
request](https://github.com/ietf-tools/datatracker/pull/11361) and went 
live with the 12.70.0 release.

### Kubernetes

We're planning to upgrade our Kubernetes clusters to the latest version 
(1.36) at the beginning of August.

### Zulip Server

Zulip has released [12.x 
series](https://blog.zulip.com/2026/04/27/zulip-12-0-released/). The 
IETF zulip server will be updated to 12.x series in upcoming weeks.

### HedgeDoc/notes

Hedgedoc has released 
[1.11.1](https://github.com/hedgedoc/hedgedoc/releases/tag/1.11.1). The 
notes.ietf.org will be updated to that version in upcoming weeks. This 
release brings a feature to allow list of domains to have redirects 
without external redirect warning. IETF LLC managed domains will be 
added to this list. See 
[#12](https://github.com/ietf-tools/hedgedoc/issues/12) & 
[#14](https://github.com/ietf-tools/hedgedoc/pull/14/changes).