SobekCM Version 5.1.0 Release Notes

 

These are notes for version 5.1.0 which was released to the open source community on September 9th, 2026.

Summary

SobekCM 5.1.0 is centered on a major new capability: support for Google Cloud Storage as an alternative to local-disk storage for resource files, running either in a hybrid mode (small files like thumbnails and METS stay local, while masters and derivatives live in the cloud) or a fully cloud-resident mode. This required rebuilding how the application, the Builder, and the image server all read and write files so they work correctly regardless of storage backend, along with a redesigned image tile server capable of serving zoom/pan requests against cloud-stored images, corrected MIME-type handling so files render inline instead of forcing downloads, and access control for restricted items that now works through signed URLs rather than on-disk rules that don't apply once files leave local disk.

This release also improves how the Builder processes items — it now distinguishes a simple metadata update from a full item rebuild and skips the expensive processing pipeline entirely when only metadata changed, while still correctly carrying forward structural and thumbnail information from the previously published version. Authentication and several admin-facing screens were also restructured into a more extensible plugin-style architecture, letting features like OIDC and SAML login be added, enabled, or disabled independently rather than being built permanently into the core application.

The rest of the release is a broad set of correctness and polish fixes: tightened login requirements on usage-statistics screens, a fix for restricted items incorrectly hiding their thumbnails, a stale-cache issue where a visibility change could silently revert on the next page load, cleaner and more consistent banner placement across admin and personal-account screens, several fixes to the web-based skin editor, and continued Linux compatibility work for the Builder. An automated smoke-test suite was also added so key parts of a live deployment are checked automatically on every release going forward.

 

New Features

Google Cloud Storage support

This version completes Google Cloud Storage as a full alternative to local-disk storage for resource files, with two operating modes: Hybrid (thumbnails, METS, and other small "always local" files stay on disk; masters and derivatives live in GCS) and Full (nothing kept locally at all). This required:

1. A new storage abstraction so the app, the Builder, and the image server all read/write through one interface regardless of which mode is active.
2. Correct MIME-type detection on upload (previously everything uploaded as generic binary, forcing browser downloads instead of inline rendering for PDFs/images).
3. A GCS-appropriate object-key scheme (flat, namespaced by instance, rather than mirroring the old local pairtree layout) so multiple instances can safely share one bucket.
4. A dedicated image tile server able to serve JP2 zoom/pan requests against GCS-backed images (the original zoom viewer only ever worked against local files).
5. Protection against GCS silently overwriting a depositor's just-uploaded replacement file.
6. Correct handling of restricted/dark items under GCS — access control moved from on-disk web.config rules (meaningless once files aren't served from disk) to signed URLs.

Supporting tooling shipped alongside it: a bulk migration utility to move an existing local-storage instance up to GCS, a lightweight utility to pull files back out of GCS for spot-checking, and a disaster-recovery/hydration utility that rebuilds an instance's local half (thumbnails/METS) from the bucket — useful both for recovering a lost local disk and for bringing a brand-new instance up against an existing bucket.

 

Admin screens & UI polish

1. Fixed banner placement across admin and mySobek screens — consolidated a scattered, inconsistent per-screen pattern (some screens drew their own banner, some didn't, one drew it twice) into one centralized, correctly-gated mechanism.
2. Fixed several real bugs in the web-skin editor: an editing race with the new CKEditor5-based source view, invalid HTML nesting in the editor's table markup, and a data-loss bug where multiple languages sharing one legacy home-page file meant editing one language silently overwrote the others.
3. Fixed a checkbox bug in the skin admin screen where checkboxes always appeared checked regardless of their actual saved state.
4. Fixed missing bullet-point suppression on a bookshelf tree view.
5. Full localization of the internal diagnostic views
6. Fix to the web-skin editor's "copy an existing language" feature which was silently producing empty content due to a path-handling and case-sensitivity bug.

 

Security & access control

1. Usage statistics screens (both the per-collection view and the site-wide view) now correctly require login, and the redirect target was corrected to send an unauthenticated visitor to the actual login screen rather than just back to a collection home page.
2. Fixed a stale-cache bug where changing an item's visibility/restriction status cleared the in-memory cache but not the on-disk cache file, so the very next page view could silently reload and re-apply the old (wrong) restriction state.
3. Fixed restricted items incorrectly showing a generic placeholder in place of their main thumbnail — the main thumbnail is explicitly meant to always display regardless of restriction status.
4. Admins now have a controlled way to delete individual files from an item's file listing directly, gated to system/host admins and re-verified server-side rather than trusted from the rendered page.

Code Updates & Tech Debt

Extensibility architecture

Authentication providers, admin screens, and top-level page renderers ("main writers") were all converted to the plugin-style architecture: built-in behavior still resolves through fast, hardcoded paths, but anything unrecognized is now looked up against a configurable extension registry and loaded dynamically. This is what let OIDC and SAML authentication ship as genuinely separate, independently enable/disable-able plugins rather than baked into the core app — and toggling one now triggers an automatic, debounced app restart since authentication schemes only register at startup.

 

Third-party component updates

Refreshed most of the vendored JavaScript/CSS libraries (editor, date pickers, tables, image viewer) to current versions, including a full move from CKEditor4 to CKEditor5, and removed several long-dead libraries (Flash-based upload, an old charting library) that were no longer in use.

 

Infrastructure Improvements

Builder / batch processing improvements

1. Metadata-only vs. full reprocess: the Builder can now tell the difference between "this item just needs its metadata updated" and "this item needs a genuine full rebuild," and skips the expensive file-processing pipeline (image derivatives, OCR, PDF text extraction, etc.) entirely for metadata-only work. Struct maps and thumbnail references get correctly carried forward from the currently-published item in that case, and that carried-forward data is now properly persisted rather than silently discarded by a later reload step.
2. Fixed a scheduling bug where the Builder's configured stop time could re-trigger immediately after launching instead of correctly waiting until the next real occurrence.
3. Fixed a resiliency bug where a Builder instance that failed to initialize once was permanently abandoned for the rest of the run instead of retrying on the next poll cycle.
4. Cross-platform (Linux) fixes: ImageMagick auto-detection now recognizes the newer magick executable name (the old convert name isn't shipped on modern/Linux installs), plus timezone handling and online-settings updates for non-Windows deployment.

 

Testing & deployment infrastructure

1. Added an automated smoke-test suite (home page, search, login, maintenance-mode detection) that runs against a live deployment on every push, on a daily schedule, and on demand.
2. Fixed a deployment script bug where a stale local build cache could get bundled into a fresh release, and a build-and-push script that could report false failures due to a leftover exit code.

 

New standalone utilities

Beyond the GCS migration/pull/restore tools mentioned above, a health-check endpoint was added that actually verifies database connectivity with its own short timeout, rather than just confirming the process is running.