diff --git a/client/src/api/schema/schema.ts b/client/src/api/schema/schema.ts
index 1e73e27175a7..1e9ab944ad2e 100644
--- a/client/src/api/schema/schema.ts
+++ b/client/src/api/schema/schema.ts
@@ -4804,7 +4804,7 @@ export interface paths {
         };
         /**
          * Get User Roles
-         * @description Return a collection of roles associated with this user. Only admins can see user roles.
+         * @description Return a list of roles associated with this user. Only admins can see user roles.
          */
         get: operations["get_user_roles_api_users__user_id__roles_get"];
         put?: never;
diff --git a/client/src/components/Common/TextSummary.vue b/client/src/components/Common/TextSummary.vue
index 19b7f40e98c7..6ef4b607402d 100644
--- a/client/src/components/Common/TextSummary.vue
+++ b/client/src/components/Common/TextSummary.vue
@@ -11,7 +11,8 @@ interface Props {
     maxLength?: number;
     /** The text to summarize */
     description: string;
-    /** If `true`, doesn't let unexpanded text go beyond height of one line */
+    /** If `true`, doesn't let unexpanded text go beyond height of one line
+     * and ignores `maxLength` */
     oneLineSummary?: boolean;
     /** If `true`, doesn't show expand/collapse buttons */
     noExpand?: boolean;
@@ -25,8 +26,17 @@ const props = withDefaults(defineProps<Props>(), {
 });
 
 const showDetails = ref(false);
+const refOneLineSummary = ref<HTMLElement | null>(null);
 
-const textTooLong = computed(() => props.description.length > props.maxLength);
+const textTooLong = computed(() => {
+    if (!props.oneLineSummary) {
+        return props.description.length > props.maxLength;
+    } else if (refOneLineSummary.value) {
+        return refOneLineSummary.value.scrollWidth > refOneLineSummary.value.clientWidth;
+    } else {
+        return false;
+    }
+});
 const text = computed(() =>
     textTooLong.value && !showDetails.value
         ? props.description.slice(0, Math.round(props.maxLength - props.maxLength / 2)) + "..."
@@ -35,8 +45,12 @@ const text = computed(() =>
 </script>
 
 <template>
-    <div>
-        <component :is="props.component" v-if="props.oneLineSummary" class="one-line-summary">
+    <div :class="{ 'd-flex': props.oneLineSummary && !noExpand }">
+        <component
+            :is="props.component"
+            v-if="props.oneLineSummary"
+            ref="refOneLineSummary"
+            :class="{ 'one-line-summary': !showDetails }">
             {{ props.description }}
         </component>
         <span v-else>{{ text }}</span>
diff --git a/client/src/components/Workflow/Run/WorkflowRunFormSimple.vue b/client/src/components/Workflow/Run/WorkflowRunFormSimple.vue
index 802ebac376a4..ab4f42fa16b7 100644
--- a/client/src/components/Workflow/Run/WorkflowRunFormSimple.vue
+++ b/client/src/components/Workflow/Run/WorkflowRunFormSimple.vue
@@ -12,7 +12,7 @@
                 :run-disabled="hasValidationErrors || !canRunOnHistory"
                 :run-waiting="waitingForRequest"
                 @on-execute="onExecute">
-                <template v-slot:workflow-run-actions>
+                <template v-slot:workflow-title-actions>
                     <b-dropdown
                         v-if="showRuntimeSettings(currentUser)"
                         id="dropdown-form"
diff --git a/client/src/components/Workflow/Run/WorkflowRunSuccess.vue b/client/src/components/Workflow/Run/WorkflowRunSuccess.vue
index c51868e53705..f5d71a820167 100644
--- a/client/src/components/Workflow/Run/WorkflowRunSuccess.vue
+++ b/client/src/components/Workflow/Run/WorkflowRunSuccess.vue
@@ -39,9 +39,9 @@ const wasNewHistoryTarget =
 
 <template>
     <div>
-        <div class="donemessagelarge">
+        <div v-if="props.invocations.length > 1" class="donemessagelarge">
             Successfully invoked workflow <b>{{ props.workflowName }}</b>
-            <em v-if="props.invocations.length > 1"> - {{ props.invocations.length }} times</em>.
+            <em> - {{ props.invocations.length }} times</em>.
             <span v-if="targetHistories.length > 1">
                 This workflow will generate results in multiple histories. You can observe progress in the
                 <router-link to="/histories/view_multiple">history multi-view</router-link>.
diff --git a/client/src/components/Workflow/Run/model.js b/client/src/components/Workflow/Run/model.js
index 29eeca92c369..1238146d7ba6 100644
--- a/client/src/components/Workflow/Run/model.js
+++ b/client/src/components/Workflow/Run/model.js
@@ -136,34 +136,30 @@ export class WorkflowRunModel {
         // or if an explicit reference is specified as data_ref and available
         _.each(this.steps, (step) => {
             if (step.step_type == "tool") {
-                var data_resolved = true;
+                let dataResolved = true;
                 visitInputs(step.inputs, (input, name, context) => {
-                    var is_runtime_value = input.value && input.value.__class__ == "RuntimeValue";
-                    var is_data_input = ["data", "data_collection"].indexOf(input.type) != -1;
-                    var data_ref = context[input.data_ref];
+                    const isRuntimeValue = input.value && input.value.__class__ == "RuntimeValue";
+                    const isDataInput = ["data", "data_collection"].indexOf(input.type) != -1;
+                    const dataRef = context[input.data_ref];
                     if (input.step_linked && !isDataStep(input.step_linked)) {
-                        data_resolved = false;
+                        dataResolved = false;
                     }
-                    if (input.options && ((input.options.length == 0 && !data_resolved) || input.wp_linked)) {
+                    if (input.options && ((input.options.length == 0 && !dataResolved) || input.wp_linked)) {
                         input.is_workflow = true;
                     }
-                    if (data_ref) {
+                    if (dataRef) {
                         input.is_workflow =
-                            (data_ref.step_linked && !isDataStep(data_ref.step_linked)) || input.wp_linked;
+                            (dataRef.step_linked && !isDataStep(dataRef.step_linked)) || input.wp_linked;
                     }
-                    if (
-                        !input.optional &&
-                        (is_data_input ||
-                            (input.value && input.value.__class__ == "RuntimeValue" && !input.step_linked))
-                    ) {
+                    if ((isDataInput && !input.optional) || (!isDataInput && isRuntimeValue && !input.step_linked)) {
                         step.expanded = true;
                         hasOpenToolSteps = true;
                     }
-                    if (is_runtime_value) {
+                    if (isRuntimeValue) {
                         input.value = null;
                     }
                     input.flavor = "workflow";
-                    if (!is_runtime_value && !is_data_input && input.type !== "hidden" && !input.wp_linked) {
+                    if (!isRuntimeValue && !isDataInput && input.type !== "hidden" && !input.wp_linked) {
                         if (input.optional || (!isEmpty(input.value) && input.value !== "")) {
                             input.collapsible_value = input.value;
                             input.collapsible_preview = true;
diff --git a/client/src/components/Workflow/WorkflowAnnotation.test.ts b/client/src/components/Workflow/WorkflowAnnotation.test.ts
index 8ebc19904b64..597810fe7c2a 100644
--- a/client/src/components/Workflow/WorkflowAnnotation.test.ts
+++ b/client/src/components/Workflow/WorkflowAnnotation.test.ts
@@ -116,7 +116,7 @@ async function mountWorkflowAnnotation(version: "run_form" | "invocation", ownsW
 }
 
 describe("WorkflowAnnotation renders", () => {
-    it("(always) the run count and history, not indicators if owned not published", async () => {
+    it("the run count and history, not indicators if owned not published", async () => {
         async function checkHasRunCount(version: "run_form" | "invocation") {
             const { wrapper } = await mountWorkflowAnnotation(version);
 
@@ -124,7 +124,11 @@ describe("WorkflowAnnotation renders", () => {
             expect(runCount.text()).toContain("workflow runs:");
             expect(runCount.text()).toContain(SAMPLE_RUN_COUNT.toString());
 
-            expect(wrapper.find(SELECTORS.SWITCH_TO_HISTORY_LINK).text()).toBe(TEST_HISTORY.name);
+            if (version === "run_form") {
+                expect(wrapper.find(SELECTORS.SWITCH_TO_HISTORY_LINK).exists()).toBe(false);
+            } else {
+                expect(wrapper.find(SELECTORS.SWITCH_TO_HISTORY_LINK).text()).toBe(TEST_HISTORY.name);
+            }
 
             // Since this is the user's own workflow, the indicators link
             // (to view all published workflows by the owner) should not be present
diff --git a/client/src/components/Workflow/WorkflowAnnotation.vue b/client/src/components/Workflow/WorkflowAnnotation.vue
index 28559a7313d8..ab4738b35161 100644
--- a/client/src/components/Workflow/WorkflowAnnotation.vue
+++ b/client/src/components/Workflow/WorkflowAnnotation.vue
@@ -69,8 +69,8 @@ const workflowTags = computed(() => {
                     </span>
                     <UtcDate :date="timeElapsed" mode="elapsed" data-description="workflow annotation date" />
                 </i>
-                <span class="d-flex flex-gapx-1 align-items-center">
-                    <FontAwesomeIcon :icon="faHdd" />Input History:
+                <span v-if="invocationUpdateTime" class="d-flex flex-gapx-1 align-items-center">
+                    <FontAwesomeIcon :icon="faHdd" />History:
                     <SwitchToHistoryLink :history-id="props.historyId" />
                     <BBadge
                         v-if="props.newHistoryTarget && useHistoryStore().currentHistoryId !== props.historyId"
@@ -92,8 +92,9 @@ const workflowTags = computed(() => {
             </div>
         </div>
         <div v-if="props.showDetails">
-            <TextSummary v-if="description" class="my-1" :description="description" />
+            <TextSummary v-if="description" class="my-1" :description="description" one-line-summary component="span" />
             <StatelessTags v-if="workflowTags.length" :value="workflowTags" :disabled="true" />
+            <hr class="mb-0 mt-2" />
         </div>
     </div>
 </template>
diff --git a/client/src/components/Workflow/WorkflowNavigationTitle.vue b/client/src/components/Workflow/WorkflowNavigationTitle.vue
index 4a5b9a413716..5237d61e7e12 100644
--- a/client/src/components/Workflow/WorkflowNavigationTitle.vue
+++ b/client/src/components/Workflow/WorkflowNavigationTitle.vue
@@ -28,6 +28,7 @@ interface Props {
     workflowId: string;
     runDisabled?: boolean;
     runWaiting?: boolean;
+    success?: boolean;
 }
 
 const props = withDefaults(defineProps<Props>(), {
@@ -84,20 +85,20 @@ const workflowImportTitle = computed(() => {
 
 <template>
     <div>
-        <div>
-            <BAlert v-if="importErrorMessage" variant="danger" dismissible show @dismissed="importErrorMessage = null">
-                {{ importErrorMessage }}
-            </BAlert>
-            <BAlert v-else-if="importedWorkflow" variant="info" dismissible show @dismissed="importedWorkflow = null">
-                <span>
-                    Workflow <b>{{ importedWorkflow.name }}</b> imported successfully.
-                </span>
-                <RouterLink to="/workflows/list">Click here</RouterLink> to view the imported workflow in the workflows
-                list.
-            </BAlert>
-
-            <BAlert v-if="error" variant="danger" show>{{ error }}</BAlert>
-
+        <BAlert v-if="importErrorMessage" variant="danger" dismissible show @dismissed="importErrorMessage = null">
+            {{ importErrorMessage }}
+        </BAlert>
+        <BAlert v-else-if="importedWorkflow" variant="info" dismissible show @dismissed="importedWorkflow = null">
+            <span>
+                Workflow <b>{{ importedWorkflow.name }}</b> imported successfully.
+            </span>
+            <RouterLink to="/workflows/list">Click here</RouterLink> to view the imported workflow in the workflows
+            list.
+        </BAlert>
+
+        <BAlert v-if="error" variant="danger" show>{{ error }}</BAlert>
+
+        <div class="position-relative">
             <div v-if="workflow" class="ui-portlet-section">
                 <div class="d-flex portlet-header align-items-center">
                     <div class="flex-grow-1" data-description="workflow heading">
@@ -136,7 +137,7 @@ const workflowImportTitle = computed(() => {
                             :action="onImport">
                         </AsyncButton>
 
-                        <slot name="workflow-run-actions" />
+                        <slot name="workflow-title-actions" />
 
                         <ButtonSpinner
                             v-if="!props.invocation"
@@ -163,6 +164,30 @@ const workflowImportTitle = computed(() => {
                     </BButtonGroup>
                 </div>
             </div>
+            <div v-if="props.success" class="donemessagelarge">
+                Successfully invoked workflow
+                <b>{{ getWorkflowName() }}</b>
+            </div>
         </div>
     </div>
 </template>
+
+<style scoped lang="scss">
+@keyframes fadeOut {
+    0% {
+        opacity: 1;
+    }
+    100% {
+        opacity: 0;
+        display: none;
+        pointer-events: none;
+    }
+}
+
+.donemessagelarge {
+    top: 0;
+    position: absolute;
+    width: 100%;
+    animation: fadeOut 3s forwards;
+}
+</style>
diff --git a/client/src/components/WorkflowInvocationState/WorkflowInvocationState.test.ts b/client/src/components/WorkflowInvocationState/WorkflowInvocationState.test.ts
index f16536249e3e..84abb4dd163e 100644
--- a/client/src/components/WorkflowInvocationState/WorkflowInvocationState.test.ts
+++ b/client/src/components/WorkflowInvocationState/WorkflowInvocationState.test.ts
@@ -15,7 +15,7 @@ const selectors = {
     invocationSummary: ".invocation-overview",
     bAlertStub: "balert-stub",
     spanElement: "span",
-    invocationReportTab: "btab-stub[title='Report']",
+    invocationReportTab: '[titleitemclass="invocation-report-tab"]',
     fullPageHeading: "anonymous-stub[h1='true']",
 };
 
diff --git a/client/src/components/WorkflowInvocationState/WorkflowInvocationState.vue b/client/src/components/WorkflowInvocationState/WorkflowInvocationState.vue
index 299b1227a9a1..839dda0cf7bb 100644
--- a/client/src/components/WorkflowInvocationState/WorkflowInvocationState.vue
+++ b/client/src/components/WorkflowInvocationState/WorkflowInvocationState.vue
@@ -1,12 +1,11 @@
 <script setup lang="ts">
-import { faDownload, faTimes } from "@fortawesome/free-solid-svg-icons";
+import { faExclamation, faSquare, faTimes } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/vue-fontawesome";
-import { BAlert, BButton, BNavItem, BTab, BTabs } from "bootstrap-vue";
+import { BAlert, BBadge, BButton, BTab, BTabs } from "bootstrap-vue";
 import { computed, onUnmounted, ref, watch } from "vue";
 
 import { type InvocationJobsSummary, type InvocationStep, type WorkflowInvocationElementView } from "@/api/invocations";
 import { useAnimationFrameResizeObserver } from "@/composables/sensors/animationFrameResizeObserver";
-import { getRootFromIndexLink } from "@/onload";
 import { useInvocationStore } from "@/stores/invocationStore";
 import { useWorkflowStore } from "@/stores/workflowStore";
 import { errorMessageAsString } from "@/utils/simple-error";
@@ -67,11 +66,15 @@ watch(
     }
 );
 
-// Report and PDF generation
-const generatePdfTooltip = "Generate PDF report for this workflow invocation";
-const invocationPdfLink = computed<string | null>(
-    () => getRootFromIndexLink() + `api/invocations/${props.invocationId}/report.pdf`
+const workflowStore = useWorkflowStore();
+const reportTabDisabled = computed(
+    () =>
+        !invocationStateSuccess.value ||
+        !invocation.value ||
+        !workflowStore.getStoredWorkflowByInstanceId(invocation.value.workflow_id)
 );
+
+/** Tooltip message for the report tab when it is disabled */
 const disabledReportTooltip = computed(() => {
     const state = invocationState.value;
     if (state != "scheduled") {
@@ -175,8 +178,6 @@ const jobStatesStr = computed(() => {
     return `${jobStr}.`;
 });
 
-const workflowStore = useWorkflowStore();
-
 watch(
     () => props.invocationId,
     async (id) => {
@@ -229,9 +230,25 @@ function cancelWorkflowSchedulingLocal() {
 <template>
     <div v-if="invocation" class="d-flex flex-column w-100" data-description="workflow invocation state">
         <WorkflowNavigationTitle
-            v-if="props.isFullPage && !props.success"
+            v-if="props.isFullPage"
             :invocation="invocation"
-            :workflow-id="invocation.workflow_id" />
+            :workflow-id="invocation.workflow_id"
+            :success="props.success">
+            <template v-slot:workflow-title-actions>
+                <BButton
+                    v-if="!invocationAndJobTerminal"
+                    v-b-tooltip.noninteractive.hover
+                    title="Cancel scheduling of workflow invocation"
+                    data-description="header cancel invocation button"
+                    size="sm"
+                    class="text-decoration-none"
+                    variant="link"
+                    @click="onCancel">
+                    <FontAwesomeIcon :icon="faSquare" fixed-width />
+                    Cancel
+                </BButton>
+            </template>
+        </WorkflowNavigationTitle>
         <WorkflowAnnotation
             v-if="props.isFullPage"
             :workflow-id="invocation.workflow_id"
@@ -301,13 +318,20 @@ function cancelWorkflowSchedulingLocal() {
             </BTab> -->
             <BTab
                 v-if="!props.isSubworkflow"
-                title="Report"
                 title-item-class="invocation-report-tab"
-                :disabled="
-                    !invocationStateSuccess || !workflowStore.getStoredWorkflowByInstanceId(invocation.workflow_id)
-                "
+                :disabled="reportTabDisabled"
                 :lazy="reportLazy"
                 :active.sync="reportActive">
+                <template v-slot:title>
+                    <span>Report</span>
+                    <BBadge
+                        v-if="reportTabDisabled"
+                        v-b-tooltip.hover.noninteractive
+                        :title="disabledReportTooltip"
+                        variant="warning">
+                        <FontAwesomeIcon :icon="faExclamation" />
+                    </BBadge>
+                </template>
                 <InvocationReport v-if="invocationStateSuccess" :invocation-id="invocation.id" />
             </BTab>
             <BTab title="Export" lazy>
@@ -322,35 +346,17 @@ function cancelWorkflowSchedulingLocal() {
                 <WorkflowInvocationMetrics :invocation-id="invocation.id"></WorkflowInvocationMetrics>
             </BTab>
             <template v-slot:tabs-end>
-                <BNavItem v-if="!invocationAndJobTerminal" class="ml-auto alert-info mr-1">
-                    <LoadingSpan message="Waiting to complete invocation" />
-                    <BButton
-                        v-b-tooltip.noninteractive.hover
-                        title="Cancel scheduling of workflow invocation"
-                        data-description="cancel invocation button"
-                        size="sm"
-                        variant="danger"
-                        @click="onCancel">
-                        <FontAwesomeIcon :icon="faTimes" fixed-width />
-                        Cancel Workflow
-                    </BButton>
-                </BNavItem>
-                <li
-                    role="presentation"
-                    class="nav-item align-self-center mr-2"
-                    :class="{ 'ml-auto': invocationAndJobTerminal }"
-                    data-description="generate pdf report button">
-                    <BButton
-                        v-b-tooltip.hover.bottom.noninteractive
-                        :title="invocationStateSuccess ? generatePdfTooltip : disabledReportTooltip"
-                        :disabled="!invocationStateSuccess"
-                        :href="invocationPdfLink"
-                        size="sm"
-                        target="_blank">
-                        <FontAwesomeIcon :icon="faDownload" fixed-width />
-                        Generate PDF
-                    </BButton>
-                </li>
+                <BButton
+                    v-if="!props.isFullPage && !invocationAndJobTerminal"
+                    v-b-tooltip.noninteractive.hover
+                    class="ml-auto my-1"
+                    title="Cancel scheduling of workflow invocation"
+                    data-description="cancel invocation button"
+                    size="sm"
+                    @click="onCancel">
+                    <FontAwesomeIcon :icon="faTimes" fixed-width />
+                    Cancel Workflow
+                </BButton>
             </template>
         </BTabs>
     </div>
@@ -365,6 +371,15 @@ function cancelWorkflowSchedulingLocal() {
     </BAlert>
 </template>
 
+<style lang="scss">
+// To show the tooltip on the disabled report tab badge
+.invocation-report-tab {
+    .nav-link.disabled {
+        pointer-events: auto !important;
+    }
+}
+</style>
+
 <style scoped lang="scss">
 .progress-bars {
     // progress bar shrinks to fit divs on either side
diff --git a/doc/schema_template.md b/doc/schema_template.md
index d08c7a4a0d06..d6577843ba2f 100644
--- a/doc/schema_template.md
+++ b/doc/schema_template.md
@@ -31,6 +31,7 @@ $tag:tool|creator|organization://complexType[@name='Organization']
 $tag:tool|requirements://complexType[@name='Requirements']
 $tag:tool|requirements|requirement://complexType[@name='Requirement']
 $tag:tool|requirements|container://complexType[@name='Container']
+$tag:tool|requirements|resource://complexType[@name='Resource']
 $tag:tool|required_files://complexType[@name='RequiredFiles']
 $tag:tool|required_files|include://complexType[@name='RequiredFileInclude']
 $tag:tool|required_files|exclude://complexType[@name='RequiredFileExclude']
diff --git a/doc/source/dev/data_types.md b/doc/source/dev/data_types.md
index fb03c4fe5d04..16b970290be2 100644
--- a/doc/source/dev/data_types.md
+++ b/doc/source/dev/data_types.md
@@ -36,7 +36,8 @@ tag section of the `datatypes_conf.xml` file. Sample
 where
 
 - `extension` - the data type's Dataset file extension (e.g., `ab1`, `bed`,
-  `gff`, `qual`, etc.)
+  `gff`, `qual`, etc.). The extension must consist only of lowercase letters,
+  numbers, `_`, `-`, and `.`.
 - `type` - the path to the class for that data type.
 - `mimetype` - if present (it's optional), the data type's mime type
 - `display_in_upload` - if present (it's optional and defaults to False), the
diff --git a/lib/galaxy/config/sample/datatypes_conf.xml.sample b/lib/galaxy/config/sample/datatypes_conf.xml.sample
index 722715746ea7..89024e5ace7b 100644
--- a/lib/galaxy/config/sample/datatypes_conf.xml.sample
+++ b/lib/galaxy/config/sample/datatypes_conf.xml.sample
@@ -190,7 +190,7 @@
     <datatype extension="gif" type="galaxy.datatypes.images:Gif" mimetype="image/gif"/>
     <datatype extension="gmaj.zip" type="galaxy.datatypes.images:Gmaj" mimetype="application/zip"/>
     <datatype extension="graph_dot" type="galaxy.datatypes.data:Text" subclass="true"/>
-    <datatype extension="gtf" type="galaxy.datatypes.interval:Gtf" display_in_upload="true">
+    <datatype extension="gtf" auto_compressed_types="gz" type="galaxy.datatypes.interval:Gtf" display_in_upload="true">
       <converter file="gff_to_interval_index_converter.xml" target_datatype="interval_index"/>
       <converter file="bed_gff_or_vcf_to_bigwig_converter.xml" target_datatype="bigwig"/>
       <display file="igb/gtf.xml"/>
diff --git a/lib/galaxy/files/templates/examples/production_aws_private_bucket.yml b/lib/galaxy/files/templates/examples/production_aws_private_bucket.yml
index 59977b00aac8..600bbdebb09e 100644
--- a/lib/galaxy/files/templates/examples/production_aws_private_bucket.yml
+++ b/lib/galaxy/files/templates/examples/production_aws_private_bucket.yml
@@ -4,10 +4,10 @@
   description: Setup access to a private AWS bucket using a secret access key.
   configuration:
     type: s3fs
-    bucket: "{{ bucket }}"
-    writable: "{{ writable }}"
-    secret: "{{ secret_key }}"
-    key: "{{ access_key }}"
+    bucket: "{{ variables.bucket }}"
+    writable: "{{ variables.writable }}"
+    secret: "{{ secrets.secret_key }}"
+    key: "{{ variables.access_key }}"
   variables:
     access_key:
       label: Access Key ID
diff --git a/lib/galaxy/managers/users.py b/lib/galaxy/managers/users.py
index fc8644d1ba4e..d1f24e4cb0b6 100644
--- a/lib/galaxy/managers/users.py
+++ b/lib/galaxy/managers/users.py
@@ -46,6 +46,7 @@
 )
 from galaxy.model.base import transaction
 from galaxy.model.db.user import (
+    _cleanup_nonprivate_user_roles,
     get_user_by_email,
     get_user_by_username,
 )
@@ -214,10 +215,7 @@ def purge(self, user, flush=True):
         # Delete UserGroupAssociations
         for uga in user.groups:
             self.session().delete(uga)
-        # Delete UserRoleAssociations EXCEPT FOR THE PRIVATE ROLE
-        for ura in user.roles:
-            if ura.role_id != private_role.id:
-                self.session().delete(ura)
+        _cleanup_nonprivate_user_roles(self.session(), user, private_role.id)
         # Delete UserAddresses
         for address in user.addresses:
             self.session().delete(address)
diff --git a/lib/galaxy/model/db/user.py b/lib/galaxy/model/db/user.py
index 823247f725dd..00f824f5e1ee 100644
--- a/lib/galaxy/model/db/user.py
+++ b/lib/galaxy/model/db/user.py
@@ -8,7 +8,10 @@
     true,
 )
 
-from galaxy.model import User
+from galaxy.model import (
+    Role,
+    User,
+)
 from galaxy.model.scoped_session import galaxy_scoped_session
 
 
@@ -64,3 +67,26 @@ def get_users_for_index(
     else:
         stmt = stmt.where(User.deleted == false())
     return session.scalars(stmt).all()
+
+
+def _cleanup_nonprivate_user_roles(session, user, private_role_id):
+    """
+    Delete UserRoleAssociations EXCEPT FOR THE PRIVATE ROLE;
+    Delete sharing roles that are associated with this user only;
+    Remove user email from sharing role names associated with multiple users.
+
+    Note: this method updates the session without flushing or committing.
+    """
+    user_roles = [ura for ura in user.roles if ura.role_id != private_role_id]
+    for user_role_assoc in user_roles:
+        role = user_role_assoc.role
+        if role.type == Role.types.SHARING:
+            if len(role.users) == 1:
+                # This role is associated with this user only, so we can delete it
+                session.delete(role)
+            elif user.email in role.name:
+                # Remove user email from sharing role's name
+                role.name = role.name.replace(user.email, "[USER PURGED]")
+                session.add(role)
+        # Delete user role association
+        session.delete(user_role_assoc)
diff --git a/lib/galaxy/schema/generics.py b/lib/galaxy/schema/generics.py
index 6eca44835054..7312a4b32869 100644
--- a/lib/galaxy/schema/generics.py
+++ b/lib/galaxy/schema/generics.py
@@ -1,5 +1,7 @@
+import sys
 from typing import (
     Any,
+    Generic,
     Tuple,
     Type,
     TypeVar,
@@ -7,6 +9,7 @@
 
 from pydantic import BaseModel
 from pydantic.json_schema import GenerateJsonSchema
+from typing_extensions import override
 
 from galaxy.schema.fields import (
     DecodedDatabaseIdField,
@@ -50,3 +53,46 @@ def get_defs_ref(self, core_mode_ref):
             for i, choice in enumerate(choices):
                 choices[i] = choice.replace(choices[0], ref_to_name[ref])  # type: ignore[call-overload]
         return full_def
+
+
+class PatchGenericPickle:
+    """A mixin that allows generic pydantic models to be serialized and deserialized with pickle.
+
+    Notes
+    ----
+    In general, pickle shouldn't be encouraged as a means of serialization since there are better,
+    safer options. In some cases e.g. Streamlit's `@st.cache_data there's no getting around
+    needing to use pickle.
+
+    As of Pydantic 2.7, generics don't properly work with pickle. The core issue is the following
+    1. For each specialized generic, pydantic creates a new subclass at runtime. This class
+       has a `__qualname__` that contains the type var argument e.g. `"MyGeneric[str]"` for a
+       `class MyGeneric(BaseModel, Generic[T])`.
+    2. Pickle attempts to find a symbol with the value of `__qualname__` in the module where the
+       class was defined, which fails since Pydantic defines that class dynamically at runtime.
+       Pydantic does attempt to register these dynamic classes but currently only for classes
+       defined at the top-level of the interpreter.
+
+    See Also
+    --------
+    - https://github.com/pydantic/pydantic/issues/9390
+    """
+
+    @classmethod
+    @override
+    def __init_subclass__(cls, **kwargs):
+        # Note: we're still in __init_subclass__, not yet in __pydantic_init_subclass__
+        #  not all model_fields are available at this point.
+        super().__init_subclass__(**kwargs)
+
+        if not issubclass(cls, BaseModel):
+            raise TypeError("PatchGenericPickle can only be used with subclasses of pydantic.BaseModel")
+        if not issubclass(cls, Generic):  # type: ignore [arg-type]
+            raise TypeError("PatchGenericPickle can only be used with Generic models")
+
+        qualname = cls.__qualname__
+        declaring_module = sys.modules[cls.__module__]
+        if qualname not in declaring_module.__dict__:
+            # This should work in all cases, but we might need to make this check and update more
+            # involved e.g. see pydantic._internal._generics.create_generic_submodel
+            declaring_module.__dict__[qualname] = cls
diff --git a/lib/galaxy/schema/notifications.py b/lib/galaxy/schema/notifications.py
index 90bbaa346509..1c8204a2369b 100644
--- a/lib/galaxy/schema/notifications.py
+++ b/lib/galaxy/schema/notifications.py
@@ -26,6 +26,7 @@
 from galaxy.schema.generics import (
     DatabaseIdT,
     GenericModel,
+    PatchGenericPickle,
 )
 from galaxy.schema.schema import Model
 from galaxy.schema.types import (
@@ -275,7 +276,7 @@ class NotificationCreateData(Model):
     )
 
 
-class GenericNotificationRecipients(GenericModel, Generic[DatabaseIdT]):
+class GenericNotificationRecipients(GenericModel, Generic[DatabaseIdT], PatchGenericPickle):
     """The recipients of a notification. Can be a combination of users, groups and roles."""
 
     user_ids: List[DatabaseIdT] = Field(
diff --git a/lib/galaxy/tool_util/deps/mulled/mulled_hash.py b/lib/galaxy/tool_util/deps/mulled/mulled_hash.py
index 3b4766c61648..1cd87d5a3d09 100644
--- a/lib/galaxy/tool_util/deps/mulled/mulled_hash.py
+++ b/lib/galaxy/tool_util/deps/mulled/mulled_hash.py
@@ -7,6 +7,7 @@
 
     mulled-hash samtools=1.3.1,bedtools=2.22
 """
+from typing_extensions import Literal
 
 from ._cli import arg_parser
 from .mulled_build import target_str_to_targets
@@ -16,14 +17,14 @@
 )
 
 
-def _mulled_hash(hash, targets):
+def _mulled_hash(hash: Literal["v1", "v2"], targets_str: str):
     """
-    >>> _mulled_hash(hash="v2", targets="samtools=1.3.1,bedtools=2.26.0")
+    >>> _mulled_hash("v2", "samtools=1.3.1,bedtools=2.26.0")
     'mulled-v2-8186960447c5cb2faa697666dc1e6d919ad23f3e:a6419f25efff953fc505dbd5ee734856180bb619'
-    >>> _mulled_hash(hash="v2", targets="samtools=1.3.1=h9071d68_10,bedtools=2.26.0=0")
+    >>> _mulled_hash("v2", "samtools=1.3.1=h9071d68_10,bedtools=2.26.0=0")
     'mulled-v2-8186960447c5cb2faa697666dc1e6d919ad23f3e:a6419f25efff953fc505dbd5ee734856180bb619'
     """
-    targets = target_str_to_targets(targets)
+    targets = target_str_to_targets(targets_str)
     image_name = v2_image_name if hash == "v2" else v1_image_name
     return image_name(targets)
 
@@ -36,8 +37,7 @@ def main(argv=None):
     )
     parser.add_argument("--hash", dest="hash", choices=["v1", "v2"], default="v2")
     args = parser.parse_args()
-    targets = target_str_to_targets(args.targets)
-    print(_mulled_hash(args.hash, targets))
+    print(_mulled_hash(args.hash, args.targets))
 
 
 __all__ = ("main",)
diff --git a/lib/galaxy/tool_util/linters/datatypes.py b/lib/galaxy/tool_util/linters/datatypes.py
new file mode 100644
index 000000000000..534868ed01ec
--- /dev/null
+++ b/lib/galaxy/tool_util/linters/datatypes.py
@@ -0,0 +1,84 @@
+import os.path
+from typing import (
+    Set,
+    TYPE_CHECKING,
+)
+
+# from galaxy import config
+from galaxy.tool_util.lint import Linter
+from galaxy.util import (
+    listify,
+    parse_xml,
+)
+
+if TYPE_CHECKING:
+    from galaxy.tool_util.lint import LintContext
+    from galaxy.tool_util.parser import ToolSource
+
+DATATYPES_CONF = os.path.join(os.path.dirname(__file__), "datatypes_conf.xml.sample")
+
+
+def _parse_datatypes(datatype_conf_path: str) -> Set[str]:
+    datatypes = set()
+    tree = parse_xml(datatype_conf_path)
+    root = tree.getroot()
+    for elem in root.findall("./registration/datatype"):
+        extension = elem.get("extension", "")
+        datatypes.add(extension)
+        auto_compressed_types = listify(elem.get("auto_compressed_types", ""))
+        for act in auto_compressed_types:
+            datatypes.add(f"{extension}.{act}")
+    return datatypes
+
+
+class DatatypesCustomConf(Linter):
+    """
+    Check if a custom datatypes_conf.xml is present
+    """
+
+    @classmethod
+    def lint(cls, tool_source: "ToolSource", lint_ctx: "LintContext"):
+        if not tool_source.source_path:
+            return
+        tool_xml = getattr(tool_source, "xml_tree", None)
+        if not tool_xml:
+            return
+        tool_node = tool_xml.getroot()
+        tool_dir = os.path.dirname(tool_source.source_path)
+        datatypes_conf_path = os.path.join(tool_dir, "datatypes_conf.xml")
+        if os.path.exists(datatypes_conf_path):
+            lint_ctx.warn(
+                "Tool uses a custom datatypes_conf.xml which is discouraged",
+                linter=cls.name(),
+                node=tool_node,
+            )
+
+
+class ValidDatatypes(Linter):
+    """
+    Check that used datatypes are available
+    """
+
+    @classmethod
+    def lint(cls, tool_source: "ToolSource", lint_ctx: "LintContext"):
+        tool_xml = getattr(tool_source, "xml_tree", None)
+        if not tool_xml:
+            return
+        # get Galaxy built-in dataypes
+        datatypes = _parse_datatypes(DATATYPES_CONF)
+        # add custom tool data types
+        if tool_source.source_path:
+            tool_dir = os.path.dirname(tool_source.source_path)
+            datatypes_conf_path = os.path.join(tool_dir, "datatypes_conf.xml")
+            if os.path.exists(datatypes_conf_path):
+                datatypes |= _parse_datatypes(datatypes_conf_path)
+        for attrib in ["format", "ftype", "ext"]:
+            for elem in tool_xml.findall(f".//*[@{attrib}]"):
+                formats = elem.get(attrib, "").split(",")
+                for format in formats:
+                    if format not in datatypes:
+                        lint_ctx.error(
+                            f"Unknown datatype [{format}] used in {elem.tag} element",
+                            linter=cls.name(),
+                            node=elem,
+                        )
diff --git a/lib/galaxy/tool_util/linters/datatypes_conf.xml.sample b/lib/galaxy/tool_util/linters/datatypes_conf.xml.sample
new file mode 120000
index 000000000000..6a8d2e103481
--- /dev/null
+++ b/lib/galaxy/tool_util/linters/datatypes_conf.xml.sample
@@ -0,0 +1 @@
+../../config/sample/datatypes_conf.xml.sample
\ No newline at end of file
diff --git a/lib/galaxy/tool_util/xsd/galaxy.xsd b/lib/galaxy/tool_util/xsd/galaxy.xsd
index 45ff42bf1772..1c23f88066fe 100644
--- a/lib/galaxy/tool_util/xsd/galaxy.xsd
+++ b/lib/galaxy/tool_util/xsd/galaxy.xsd
@@ -675,6 +675,12 @@ resolver.
     </xs:simpleContent>
   </xs:complexType>
   <xs:complexType name="Resource">
+    <xs:annotation>
+      <xs:documentation xml:lang="en"><![CDATA[
+Allows to describe a resource requirement of a tool. At the moment this tag is mostly descriptive,
+It can be used by dynamic job rules and serves to guide Galaxy admins.
+]]></xs:documentation>
+    </xs:annotation>
     <xs:simpleContent>
       <xs:extension base="xs:string">
         <xs:attribute name="type" type="ResourceType" use="required">
@@ -1566,7 +1572,7 @@ used to load typed parameters. This string will be loaded as JSON and its type w
 attempt to be preserved through API requests to Galaxy.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
-    <xs:attribute name="ftype" type="xs:string">
+    <xs:attribute name="ftype" type="Format">
       <xs:annotation>
         <xs:documentation xml:lang="en">This attribute name should be included
 only with parameters of ``type`` ``data`` for the tool. If this
@@ -1711,7 +1717,7 @@ generated as JSON. This can be useful for testing tool outputs that are not file
 ]]></xs:documentation>
       </xs:annotation>
     </xs:attribute>
-    <xs:attribute name="ftype" type="xs:string">
+    <xs:attribute name="ftype" type="Format">
       <xs:annotation>
         <xs:documentation xml:lang="en"><![CDATA[
 
@@ -4202,7 +4208,7 @@ only when the ``type`` attribute value is ``data``, ``float``, or ``integer``.</
 only when the ``type`` attribute value is ``data``, ``float``, or ``integer``.</xs:documentation>
           </xs:annotation>
         </xs:attribute>
-        <xs:attribute name="format" type="xs:string">
+        <xs:attribute name="format" type="FormatList">
           <xs:annotation>
             <xs:documentation xml:lang="en">The comma-separated list of accepted
 data formats for this input. The list of supported data formats is contained in the
@@ -5943,7 +5949,7 @@ The default is ``galaxy.json``.
     </xs:choice>
   </xs:group>
   <xs:attributeGroup name="OutputCommon">
-    <xs:attribute name="format" type="xs:string">
+    <xs:attribute name="format" type="Format">
       <xs:annotation>
         <xs:documentation xml:lang="en"><![CDATA[
 The short name for the output datatype. The valid values for format can be found in
@@ -6331,12 +6337,12 @@ Therefore a filter for such a variable looks like the following example.
         <xs:documentation xml:lang="en">Indicates that the entire path of the discovered dataset relative to the specified directory should be available for matching patterns.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
-    <xs:attribute name="format" type="xs:string" use="optional">
+    <xs:attribute name="format" type="Format" use="optional">
       <xs:annotation>
         <xs:documentation xml:lang="en">Format (or datatype) of discovered datasets (an alias with ``ext``).</xs:documentation>
       </xs:annotation>
     </xs:attribute>
-    <xs:attribute name="ext" type="xs:string" use="optional">
+    <xs:attribute name="ext" type="Format" use="optional">
       <xs:annotation>
         <xs:documentation xml:lang="en">Format (or datatype) of discovered datasets (an alias with ``format``).</xs:documentation>
       </xs:annotation>
@@ -7660,7 +7666,7 @@ parameter (e.g. ``value="interval"`` above), or of the deprecated ``input_datase
 attribute.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
-    <xs:attribute name="format" type="xs:string" use="required">
+    <xs:attribute name="format" type="Format" use="required">
       <xs:annotation>
         <xs:documentation xml:lang="en">This value must be a supported data type
 (e.g. ``format="interval"``). See
@@ -8083,6 +8089,18 @@ favour of a ``has_size`` assertion.</xs:documentation>
       </xs:simpleType>
     </xs:union>
   </xs:simpleType>
+  
+  <xs:simpleType name="Format">
+    <xs:restriction base="xs:string">
+      <xs:pattern value="[0-9a-z.-_]+"/>
+    </xs:restriction>
+  </xs:simpleType>
+  <xs:simpleType name="FormatList">
+    <xs:restriction base="xs:string">
+      <xs:pattern value="([a-z0-9._-]+)(,([a-z0-9._-]+))*"/>
+    </xs:restriction>
+  </xs:simpleType>
+  
   <xs:complexType name="EdamTopics">
     <xs:annotation gxdocs:best_practices="tool-annotations-edam">
       <xs:documentation xml:lang="en"><![CDATA[
diff --git a/lib/galaxy/webapps/galaxy/api/users.py b/lib/galaxy/webapps/galaxy/api/users.py
index c9d4f8bd50ee..51b5dcea8ebd 100644
--- a/lib/galaxy/webapps/galaxy/api/users.py
+++ b/lib/galaxy/webapps/galaxy/api/users.py
@@ -734,7 +734,7 @@ def send_activation_email(
     @router.get(
         "/api/users/{user_id}/roles",
         name="get user roles",
-        description="Return a collection of roles associated with this user. Only admins can see user roles.",
+        description="Return a list of roles associated with this user. Only admins can see user roles.",
         require_admin=True,
     )
     def get_user_roles(
diff --git a/lib/galaxy_test/selenium/test_workflow_run.py b/lib/galaxy_test/selenium/test_workflow_run.py
index 047681aa0f45..5405545ce2e1 100644
--- a/lib/galaxy_test/selenium/test_workflow_run.py
+++ b/lib/galaxy_test/selenium/test_workflow_run.py
@@ -75,6 +75,29 @@ def test_runtime_parameters_simple(self):
 
         self._assert_has_3_lines_after_run(hid=2)
 
+    @selenium_test
+    @managed_history
+    def test_runtime_parameters_simple_optional(self):
+        self.workflow_run_open_workflow(
+            """
+class: GalaxyWorkflow
+inputs: {}
+steps:
+  int_step:
+    tool_id: expression_null_handling_integer
+    runtime_inputs:
+      - int_input
+"""
+        )
+        self.tool_parameter_div("int_input")
+        self._set_num_lines_to_3("int_input")
+        self.screenshot("workflow_run_optional_runtime_parameters_modified")
+        self.workflow_run_submit()
+        self.workflow_run_wait_for_ok(hid=1)
+        history_id = self.current_history_id()
+        content = self.dataset_populator.get_history_dataset_content(history_id, hid=1)
+        assert json.loads(content) == 3
+
     @selenium_test
     @managed_history
     def test_subworkflows_expanded(self):
diff --git a/packages/tool_util/MANIFEST.in b/packages/tool_util/MANIFEST.in
index 3c6d371983de..a60b960699b6 100644
--- a/packages/tool_util/MANIFEST.in
+++ b/packages/tool_util/MANIFEST.in
@@ -5,3 +5,4 @@ include galaxy/tool_util/toolbox/filters/*.sample
 include galaxy/tool_util/verify/test_config.sample.yml
 include galaxy/tool_util/xsd/*
 include galaxy/tool_util/ontologies/*tsv
+include galaxy/tool_util/linters/datatypes_conf.xml.sample
\ No newline at end of file
diff --git a/test/unit/data/model/db/test_user.py b/test/unit/data/model/db/test_user.py
index 87d136a125a4..042a541eb817 100644
--- a/test/unit/data/model/db/test_user.py
+++ b/test/unit/data/model/db/test_user.py
@@ -1,7 +1,13 @@
 import pytest
+from sqlalchemy import select
 from sqlalchemy.exc import IntegrityError
 
+from galaxy.model import (
+    Role,
+    UserRoleAssociation,
+)
 from galaxy.model.db.user import (
+    _cleanup_nonprivate_user_roles,
     get_user_by_email,
     get_user_by_username,
     get_users_by_ids,
@@ -80,3 +86,78 @@ def test_username_is_unique(make_user):
     make_user(username="a")
     with pytest.raises(IntegrityError):
         make_user(username="a")
+
+
+def test_cleanup_nonprivate_user_roles(session, make_user_and_role, make_role, make_user_role_association):
+    # Create 3 users with private roles
+    user1, role_private1 = make_user_and_role(email="user1@foo.com")
+    user2, role_private2 = make_user_and_role(email="user2@foo.com")
+    user3, role_private3 = make_user_and_role(email="user3@foo.com")
+
+    # Create role_sharing1 and associated it with user1 and user2
+    role_sharing1 = make_role(type=Role.types.SHARING, name="sharing role for user1@foo.com, user2@foo.com")
+    make_user_role_association(user1, role_sharing1)
+    make_user_role_association(user2, role_sharing1)
+
+    # Create role_sharing2 and associated it with user3
+    role_sharing2 = make_role(type=Role.types.SHARING, name="sharing role for user3@foo.com")
+    make_user_role_association(user3, role_sharing2)
+
+    # Create another role and associate it with all users
+    role6 = make_role()
+    make_user_role_association(user1, role6)
+    make_user_role_association(user2, role6)
+    make_user_role_association(user3, role6)
+
+    # verify number of all user role associations
+    associations = session.scalars(select(UserRoleAssociation)).all()
+    assert len(associations) == 9  # 3 private, 2 + 1 sharing, 3 with role6
+
+    # verify user1 roles
+    assert len(user1.roles) == 3
+    assert role_private1 in [ura.role for ura in user1.roles]
+    assert role_sharing1 in [ura.role for ura in user1.roles]
+    assert role6 in [ura.role for ura in user1.roles]
+
+    # run cleanup on user user1
+    _cleanup_nonprivate_user_roles(session, user1, role_private1.id)
+    session.commit()  # must commit since method does not commit
+
+    # private role not deleted, associations with role6 and with sharing role deleted, sharing role name updated
+    assert len(user1.roles) == 1
+    assert user1.roles[0].id == role_private1.id
+    assert role_sharing1.name == "sharing role for [USER PURGED], user2@foo.com"
+
+    # verify user2 roles
+    assert len(user2.roles) == 3
+    assert role_private2 in [ura.role for ura in user2.roles]
+    assert role_sharing1 in [ura.role for ura in user2.roles]
+    assert role6 in [ura.role for ura in user2.roles]
+
+    # run cleanup on user user2
+    _cleanup_nonprivate_user_roles(session, user2, role_private2.id)
+    session.commit()
+
+    # private role not deleted, association with sharing role deleted
+    assert len(user2.roles) == 1
+    assert user2.roles[0].id == role_private2.id
+    # sharing role1 deleted since it has no more users associated with it
+    roles = session.scalars(select(Role)).all()
+    assert len(roles) == 5  # 3 private, role6, sharing2
+    assert role_sharing1.id not in [role.id for role in roles]
+
+    # verify user3 roles
+    assert len(user3.roles) == 3
+    assert role_private3 in [ura.role for ura in user3.roles]
+    assert role_sharing2 in [ura.role for ura in user3.roles]
+    assert role6 in [ura.role for ura in user3.roles]
+
+    # run cleanup on user user3
+    _cleanup_nonprivate_user_roles(session, user3, role_private3.id)
+    session.commit()
+
+    # remaining: 3 private roles + 3 associations, role6
+    roles = session.scalars(select(Role)).all()
+    assert len(roles) == 4
+    associations = session.scalars(select(UserRoleAssociation)).all()
+    assert len(associations) == 3
diff --git a/test/unit/tool_util/test_tool_linters.py b/test/unit/tool_util/test_tool_linters.py
index 939545c8a078..c8dbcda5d4a3 100644
--- a/test/unit/tool_util/test_tool_linters.py
+++ b/test/unit/tool_util/test_tool_linters.py
@@ -16,6 +16,7 @@
 from galaxy.tool_util.linters import (
     citations,
     command,
+    datatypes,
     general,
     help,
     inputs,
@@ -2109,6 +2110,68 @@ def test_xml_order(lint_ctx):
     assert lint_ctx.error_messages == ["Invalid XML: Element 'wrong_tag': This element is not expected."]
 
 
+VALID_DATATYPES = """
+<tool id="id" name="name">
+    <inputs>
+        <param name="adata" type="data" format="txt"/>
+        <param name="bdata" type="data" format="invalid,fasta,custom"/>
+        <param name="fdata" type="data" format="fasta.gz"/>
+    </inputs>
+    <outputs>
+        <data name="name" format="another_invalid">
+            <change_format>
+                <when input="input_text" value="foo" format="just_another_invalid"/>
+            </change_format>
+        </data>
+        <collection name="collection_name" format="collection_format">
+            <discover_datasets format="txt"/>
+            <discover_datasets ext="invalid"/>
+        </collection>
+    </outputs>
+    <tests>
+        <test>
+            <param name="adata" ftype="txt"/>
+            <param name="bdata" ftype="invalid"/>
+        </test>
+    </tests>
+</tool>
+"""
+DATATYPES_CONF = """
+<datatypes>
+    <registration>
+        <datatype extension="custom"/>
+    </registration>
+</datatypes>
+"""
+
+
+def test_valid_datatypes(lint_ctx):
+    """
+    test datatypes linters
+    """
+    with tempfile.TemporaryDirectory() as tmp:
+        tool_path = os.path.join(tmp, "tool.xml")
+        datatypes_path = os.path.join(tmp, "datatypes_conf.xml")
+        with open(tool_path, "w") as tmpf:
+            tmpf.write(VALID_DATATYPES)
+        with open(datatypes_path, "w") as tmpf:
+            tmpf.write(DATATYPES_CONF)
+        tool_xml, _ = load_with_references(tool_path)
+        tool_source = XmlToolSource(tool_xml, source_path=tool_path)
+        run_lint_module(lint_ctx, datatypes, tool_source)
+    assert not lint_ctx.info_messages
+    assert not lint_ctx.valid_messages
+    assert "Tool uses a custom datatypes_conf.xml which is discouraged" in lint_ctx.warn_messages
+    assert len(lint_ctx.warn_messages) == 1
+    assert "Unknown datatype [invalid] used in param" in lint_ctx.error_messages
+    assert "Unknown datatype [another_invalid] used in data" in lint_ctx.error_messages
+    assert "Unknown datatype [just_another_invalid] used in when" in lint_ctx.error_messages
+    assert "Unknown datatype [collection_format] used in collection" in lint_ctx.error_messages
+    assert "Unknown datatype [invalid] used in param" in lint_ctx.error_messages
+    assert "Unknown datatype [invalid] used in discover_datasets" in lint_ctx.error_messages
+    assert len(lint_ctx.error_messages) == 6
+
+
 DATA_MANAGER = """<tool id="test_dm" name="test dm" version="1" tool_type="manage_data">
     <inputs>
         <param name="select" type="select">
@@ -2324,7 +2387,7 @@ def test_skip_by_module(lint_ctx):
 def test_list_linters():
     linter_names = Linter.list_listers()
     # make sure to add/remove a test for new/removed linters if this number changes
-    assert len(linter_names) == 140
+    assert len(linter_names) == 142
     assert "Linter" not in linter_names
     # make sure that linters from all modules are available
     for prefix in [