Numbas LTI provider v3.0

We’ve just released the next major version of the Numbas LTI provider: v3.0.

The main impetus for moving to a new major version was to get up to date with the third-party libraries that the LTI provider relies on; there were a few big changes in the way they worked, so working with the latest versions involved rewriting a lot of code.

However, I’ve also taken the opportunity to add a few new features, and to work through a lot of bug reports and interface improvements in the issue tracker.

We’ve been running v3.0 here at Newcastle for a couple of months, and it’s proved significantly more reliable than v2.

New location for the documentation

The documentation for the LTI provider is now at The documentation for each version is stored separately, so v3.0 is at and the latest version is always at

Upgrading to this version

There are detailed upgrade instructions in the documentation, for both Docker and non-Docker installations.

The installation instructions used to implicitly recommend running the git repository’s master branch, which has caused problems for some users who installed the LTI provider in between official releases, with no easy way of working out which version they had without looking at the git log.

The git repository now has “stable” branches for each major version: There is v2_STABLE, which won’t be updated any more, and v3_STABLE, which will keep up with the latest supported version of v3 until there are breaking changes. It’s my intention that it will always be safe to update from the stable branches.

Changes in v3.0

Report files

There are a few report files that the LTI provider can produce. Producing these reports can take a long time, so the job of making them is now handled by the asynchronous task workers. There’s a new “Reports” tab when viewing a resource, which will show all reports produced in the last 30 days.


  • All pages visible to instructors and administrators show the version of the LTI provider in the footer. (issue)
  • All pages visible to instructors and administrators show a link to the corresponding part of the documentation. (issue)
  • Many of the jobs that have to run after data is saved have moved to asynchronous tasks; this should make it less likely that an error will cause data to be lost.
  • When replacing an exam package, the text “this is a safe replacement” has been replaced with “make existing attempts use this”. It’s never been clear what the conditions for safe replacement are. I intend to add some more checks to help you make this decision in future. (issue)
  • In the shell, you can access deleted attempts through numbas_lti.models.Attempt.objects.deleted. (code)
  • When looking at a user’s list of attempt launches, the table shows when a launched attempt has subsequently been deleted. (issue)
  • When looking at the timeline for an attempt with no data, a message box says that. (issue)
  • The timeline for an attempt shows when entries are due to automatic re-marking, and who did the re-marking. (issue)
  • The global search form is in the top navigation bar of all admin pages, instead of just on the “dashboard” views. (issue)
  • When looking at the list of resources belonging to a context, there’s a column showing whether each resource is open or closed. (issue)
  • In the attempts summary for a resource, the graphic showing the per-question score breakdown for each attempt uses height to represent the score, instead of just colour. (code)
  • The manual re-marking and part discounting pages are now simple forms and much easier to understand. (issue)
  • Students are told on the attempts summary when an attempt has been remarked or has discounted parts. (issue)
  • The attempts summary CSV and the statistics page include the time spent on each attempt. (issue)

Bug fixes

  • When uploading an exam package, it shows a nice error message if you forget to upload a file, instead of a server error. (code)
  • The log no longer fills up with lines describing the LTI authentication. (code)
  • When getting user LTI data for a resource, catch the case where the user is anonymous. (code)
  • Fixed a timing issue where two cached question score records could be created for the same attempt. (code)
  • Fixed the client-side SCORM API so it works in the stress-test view. (code)
  • Catch the case when trying to run an attempt, but with no LTI resource attached – this can happen when cookies are blocked or otherwise missing. (code)
  • Deal with the case where a resource is not available to students but has no “available from” date set. (code)
  • The AJAX SCORM data fallback returns a “404 not found” error when the corresponding attempt doesn’t exist. (code)
  • The CSV reports cope with there being no attempts. (code)
  • When automatically re-marking attempts, an error with one attempt won’t prevent other attempts from being re-marked. (issue)
  • When automatically re-marking attempts, if there’s an error fetching the data for some attempts, an error message is shown. (issue)
  • When there’s a delay in getting the receipt for a completed attempt, the “please wait” message is shown in red, so students don’t close the window. (issue)
  • When an instructor tries to review a broken attempt, an error message is shown instead of creating a new attempt for that user. (issue)
  • When launching a new attempt, a new CSRF cookie is set. This is necessary because of a new security policy in Safari. (code)
  • Scores reported back to the LTI consumer are clamped between 0% and 100%. (issue)
  • The cross-site security token is now embedded in pages that use it, rather than relying on a cookie. (issue)
  • For resources set to report scores immediately, the score is reported as soon as a new attempt is started, to help differentiate students who have never attempted a resource from those who just scored zero. (issue)
  • Fixed a timing issue which could lead to the cached raw and percentage scores for attempts not matching. (issue)