Self-hosting releases

​

Bug fixes

• Connectors: Self-hosted deployments that supply the connector credential encryption key through a secret store (External Secrets, Sealed Secrets, or native external secrets) start more reliably.
• Connectors: The connector encryption primary key ID is now handled consistently as a non-sensitive value across every secret mode.

​

Upgrade guide

​

What’s new

• BigQuery Workload Identity Federation
• Thread costs on the billed basis
• Access control for Tableau datasets
• Improved sandbox DNS egress

​

Bug fixes

• Chat: Fixed hanging conversations by improving block streaming.
• Chat: Long conversations compact their context earlier, reducing mid-turn failures on long threads.
• Chat: Optimized sidebar chat list loads faster for members with a large number of chats.

​

Upgrade guide

​

What’s new

• Required connector credential encryption

​

Upgrade guide

1. Generate a 32-byte key, base64-encoded:
   openssl rand -base64 32
   
2. Set the key ring and the primary key ID under global.auth in your values file:
   global:
     auth:
       # Key ring: comma-separated id=base64key pairs. Keep every key ID you have ever used.
       connectorEncryptionKeys: "k1=<paste the base64 key from step 1>"
       # The key ID new credentials are encrypted with. Must match an entry above.
       connectorEncryptionPrimaryKey: "k1"
   
   If you use externalSecrets, nativeExternalSecrets or none, do not put the key material in your values file. Instead provision the <remoteKeyPrefix>-connector-encryption-keys secret in your external store (default prefix textql), and still set global.auth.connectorEncryptionPrimaryKey to the key ID (for example k1).
3. Upgrade the chart. On first start, any connector credentials still stored in plaintext are automatically encrypted in the background using the primary key.

​

What’s new

• Scoped API access keys
• Power BI row-level security for end users (Beta)
• Tableau embeds attach the Ontology automatically
• Org settings changes recorded as diffs
• Configurable service account annotations
• Custom sidecar and init containers

​

Bug fixes

• Ontology: Non-admin members no longer lose access to the ontology query tool.

​

Upgrade guide

​

What’s new

• Expanded audit logging
• Sonnet 4.6 deprecation
• Custom Tableau connector resources

​

Bug fixes

• Chat: A transient permission-check failure no longer shows a false “Request Access” screen; the underlying error is surfaced and access is re-checked once the check succeeds.
• Chat: Improved handling of deleted datasources/connectors.
• Chat: Unsupported or mislabeled image formats are now skipped and reported to the model as unavailable.
• Connectors: Further hardened Tableau connector authentication and HTTP handling to eliminate remaining intermittent 401 errors on data source queries and metadata lookups.
• Embeds: Tableau embed URLs now accept optional parameters to preselect which connectors a chat uses and to enable SQL and Ontology features for that chat, so an embed can be scoped directly from its URL.
• Charts: ECharts visualizations no longer render blank under strict cross-origin resource policy headers, and the chart Grid Style popover no longer renders behind the chat input and cards.
• Dashboards: When a dashboard’s service is still starting or recovering, opening it now shows an auto-reconnecting retry page instead of a proxy error.
• Observability: Fixed total calculations and idle-time handling in the thread timeline view.

​

Upgrade guide

​

What’s new

• Chargeback for usage costs (Beta)
• Revert approved Ontology changes
• Progressive results in batch chat cells
• Streamed cell events in the chat API
• Built-in skills
• Configurable Python execution timeout
• Helm chart version in settings

​

Bug fixes

• Playbooks: Sharing a template-based playbook now accounts for access to the underlying template data — extending access when the sharer is able to, or warning when the data cannot be shared — instead of sharing a playbook the recipient cannot fully use.
• Chat: Deep links to a chart or other artifact are no longer dropped on slow connections; the linked item now opens once the chat finishes loading.
• Connectors: Per-user OAuth sign-in now completes reliably under strict Cross-Origin-Opener-Policy across the API, Azure SQL, Databricks, Power BI, and Snowflake connectors.
• Connectors: Dataset-based Tableau chats now use the connectors configured for the dataset.
• Sandbox: Out-of-range date and time values are now nulled at dataframe boundaries instead of failing the conversion.
• Sandbox: Wedged Python executions are now stopped by a compute-side deadline, with clearer timeout errors and correct handling of cancellations.
• Dashboards: Fixed a write-access check that could drop valid grants, and improved error reporting and retry pacing for external data requests.
• Self-hosted diagnostics: The Network Check no longer reports false failures for the sandbox-to-engine probe or for browser file uploads, and audit logs, rate limiting, and per-IP OAuth limits now record the real client IP instead of the ingress address.

​

Upgrade guide

​

What’s new

• Lower storage use for chat working files

​

Bug fixes

​

Upgrade guide

​

Bug fixes

• Connectors: Fixed Tableau Personal Access Token session churn — the connector no longer signs out and re-authenticates around every operation, which invalidated its own active sessions and caused intermittent 401 errors on data source queries. Concurrent sign-ins are now serialized and back off when Tableau rate-limits.
• Connectors: Tableau dataset creation and refresh now stop with a clear error when data sources cannot be resolved from the selected views, instead of continuing with incomplete data.
• Sandbox: Active sandbox workers are no longer disrupted by node consolidation on EKS Auto deployments during cluster scale-down.
• Slack: Reports containing tables with blank cells now deliver to Slack reliably, instead of failing with a formatting error.

​

Upgrade guide

​

What’s new

• Merge conflict resolution for Ontology changes
• Role management in the v2 REST API
• Ontology library files in the v2 files API
• AWS CodeCommit git sync for Ontology
• Research reports honor the requested document format
• Configurable sandbox worker directory retention

​

Bug fixes

• LLM: Fixed a 400 error from Fable on consecutive steering messages.
• Dashboards: Hardened generated-code handling and fixed a data-source access join that could hide accessible sources.
• Chat: The app now auto-recovers when a page fails to load one of its code chunks, instead of leaving a blank or broken view.
• Connectors: Large queries no longer stall sandbox SQL parsing, and requests to an org’s own Azure storage account host are no longer blocked by the SSRF guard.
• Sandbox: File preview hints are now scoped to user-visible output files, and a compute request timeout was raised so longer query dispatches are no longer cut off prematurely.
• Members: Fixed the member reinstatement email.

​

Upgrade guide

​

What’s new

• GPT-5.6 model family
• Connector access management in the v2 REST API
• Postgres password from AWS Secrets Manager
• Playbook output gated on connector access
• Persistent Power BI and Tableau selections

​

Bug fixes

• UI: Various minor fixes to the chat page.

​

Upgrade guide

​

What’s new

• Concurrent multi-organization sessions
• Encrypted OIDC and OAuth secrets at rest
• Chat drafts
• People analytics in observability
• Dashboard list-view actions

​

Bug fixes

• Slack: Channel and user syncing now completes reliably on very large workspaces under rate limits, and a failed refresh no longer wipes the cached channel and user tables.
• Chat: Canceled or expired requests (such as navigating away mid-stream) no longer surface a spurious error.
• Connectors: Editing an API connector no longer drops previously saved authentication headers.
• Artifacts: Images and PDFs upload and convert more reliably, and unavailable assets now show a clear placeholder instead of a broken link.
• Sandbox: Fixed a connection leak to sandbox workers that degraded performance over long uptime.

​

Upgrade guide

​

What’s new

• Desktop app tabs and multi-window
• Connection diagnostics for restrictive networks
• Ontology Owners subtab
• Workspace and asset endpoints in the v2 REST API
• Faster dashboard source execution
• Dynamic slow-query warnings
• Compute functions return tabular data

​

Bug fixes

• Chat: Switching threads no longer leaves the message “expand” control dead; threads containing cell types this build doesn’t recognize now load instead of breaking; runaway line-break floods in markdown are collapsed; and the composer keeps focus when an artifact URL updates.
• Chat: Removed a false “sandbox restarted” error on send, and fixed dropped sends and lossy sandbox restores when reconnecting.
• Charts: Fixed blank liquid-fill and extension charts.
• Ontology: Fixed the “create new file” button.
• Sandbox: Fixed cross-replica worker allocation races, and multi-GB sandbox states now persist with memory escalation after out-of-memory kills.
• LLM: Fixed an assistant-prefill 400 error on failover retry, and backup failover is now gated on whether the backup model supports the request.
• Azure: Fixed copy/paste, theme-editor logo upload to Azure file storage, and propagation of email attachments through Azure Email Communication Service.
• Playbooks: A replay of the last run is no longer presented as a live run.

​

Upgrade guide

​

What’s new

• Claude Sonnet 5 model
• MongoDB connector
• Bedrock console proxy for Anthropic models
• Packages settings gated on read permission
• Monthly billing aligned to the first of the month

​

Bug fixes

• Chat: The “thinking” indicator now appears immediately when you send a message — including on brand-new threads — instead of showing up late or not at all.
• Chat: Pasting multiple images into the composer no longer collides them under a single filename; each pasted image now uploads and reaches the sandbox correctly.
• White-label: Additional hardcoded “TextQL”, “Ana”, and textql.com references — across the frontend, chat prompts, emails, and Slack — now resolve to the deployment’s configured brand.
• API: The v2 chat API now honors the documented top-level connector_ids field even when tools is set, so programmatic chats start with the connectors you requested instead of none.
• Ontology: Config edits now save optimistically for a snappier editing experience, and roll back cleanly if a save fails.

​

Upgrade guide

​

What’s new

• Opus 4.7 and Kimi K2.5 deprecation
• Sandbox scratch volume failover

​

Bug fixes

• Connectors: Fixed Ramp OAuth by keying the flow off the authorization URL rather than the configured provider, so Ramp connects reliably.
• Ontology: Fixed auto-attach rule settings.
• Sandboxes: Self-hosted sandbox storage now fails loudly when the configured NAS path is empty instead of starting in a bad state, and junction-resolution errors surface through the scratch-volume backend.

​

Upgrade guide

​

What’s new

• Support of custom gateway when using Anthropic models
• Self-managed Kubernetes secrets mode
• New chart flags to disable k8s CRDs and use Ingress in GKE
• Configurable asset URL expiry
• Ontology change review in the v2 REST API
• Importable library subdirectory modules
• Hide the desktop app page for branded deployments

​

Bug fixes

• Models: Fixed interleaved tool-call streaming on Snowflake Cortex that could corrupt tool-call IDs and create duplicate cells.
• Chat: Runs interrupted mid-tool-call now resume across pod drains and deploy handoffs — backed by a durable send queue and pending-turn recovery — so conversations no longer get stuck.
• Chat: Fixed a citation delivery bug that could drop citations from an answer.
• MCP: Fixed sandbox output and state handling, plus several connection issues for dynamic MCP — bare-origin OAuth resource indicators, query-tolerant audiences, and pre-session SSE probes are now handled correctly.
• Connectors: Fixed Ramp OAuth by no longer sending access_type=offline.
• Connectors: The OAuth callback URL now stays visible after an authentication failure, so you can finish connecting.
• SCIM: Re-provisioning a previously deactivated member now restores the existing member instead of failing.
• Playbooks: Editing a playbook as a non-owner no longer unexpectedly forks it.
• Ontology: Config run_as now accepts an email address instead of requiring a member ID.
• Desktop: Auth cookies are now flushed to disk, fixing periodic logouts.
• Charts: Fixed the minimap Y axis.

​

Upgrade guide

​

What’s new

• Per-member Microsoft Entra ID OAuth for SQL Server and Synapse
• Google Vertex AI model provider
• Per-member default model and fast mode
• Model selection in the v2 chat API
• Ontology building methodology
• Token usage for bring-your-own-key models

​

Bug fixes

• Dashboards: Chatting with a dashboard now automatically attaches its .tql query connectors, so Ana can query the same sources the dashboard uses instead of starting with none.
• Dashboards: Live-dashboard queries are now attributed to the viewer rather than the dashboard creator, so warehouse session identity and audit logs reflect who is actually viewing.
• Charts: ECharts visualizations no longer render blank in scheduled reports and emails.
• Chat: Stalled runs now recover and resume across compute restarts and deploy handoffs, instead of leaving a conversation stuck mid-run.
• Chat: Your model selection is now preserved when starting a new thread.
• Chat: Live chat updates fall back to SSE streaming when the primary connection is unavailable, keeping streams reliable.
• Connectors: Fixed SQL Server and Synapse connections over Microsoft Entra by correcting TLS server name and protocol negotiation.
• Steering: Fixed steering on GPT models, and the Steer button on a queued message now appears only for steering-capable models.
• Models: Gemini’s output cap was raised and stream retries hardened, reducing truncated or dropped responses.
• Ontology: A durable migration marker fixes a “migrate” banner that could linger after migration had already completed.
• Ontology: Config-managed objects now catch up when the Library repository drifts without a sync trigger.

​

Upgrade guide

​

What’s new

• Citation lineage
• Chat citations
• Refreshed tables across the app

​

Bug fixes

• Chat: A conversation no longer breaks when Ana encounters an unrecognized tool call; the turn now degrades gracefully instead of erroring out.
• Chat: The report tool stays available across every turn of a conversation, instead of dropping out after the first turn.
• Chat: An expired connector token no longer wedges a chat — the connector prompts for re-authentication instead of stalling the conversation.
• Chat: Long option labels and answer text in question cells no longer overflow the card.
• MCP: ana_poll is now history-backed, so a long-running answer can no longer be lost between polls.
• MCP: The OAuth authorize flow now accepts OIDC scopes.
• MCP: Internal framework _summary fields are no longer leaked into outbound MCP tool calls.
• Ontology: The scheduled-sync failure banner no longer appears when git is disconnected, and the “Sync now” spinner now rotates in the correct direction.
• Ontology: Transient ONTAP job 404s are now retried instead of failing the operation on FSx ONTAP deployments.
• Sandbox: Query result dataframes can now be used with Streamlit’s cache decorators.

​

Upgrade guide

​

What’s new

• MCP server management
• Connector discovery over MCP
• Save playbooks as configuration files

​

Bug fixes

• Dashboards: Fixed a stale-state bug that could leave a dashboard stuck instead of refreshing.
• Ontology: Patch review links now deep-link to the specific review instead of the review list.
• MCP: Tool input schemas now preserve anyOf / $ref, fixing tools whose parameters use them (such as DataHub’s get_entities).
• MCP: The assistant and company names surfaced over MCP now follow the deployment’s configured brand.
• Compute: Fixed a cross-replica disagreement about the sandbox storage backend that could cause sandbox file errors on multi-replica deployments.

​

Upgrade guide

​

What’s new

• Connector explore page

​

Bug fixes

• Sandbox: Fixed checksum handling for sandbox file uploads, so uploading files into the Python sandbox no longer fails on non-AWS S3-compatible object storage.

​

Upgrade guide

​

What’s new

• Dataset access control
• HubSpot connector
• pip extras in custom package installs

​

Bug fixes

• Compute: A request cancellation (a turn ending or timing out) no longer cascades into a failed sandbox cleanup. Previously it could leave a chat stuck in a “no worker assigned” state and surface a misleading “persisting chat generation fence … context canceled” error; failed and respawned workers are now always cleaned up so the next turn assigns a fresh sandbox.
• Connectors: API connectors using the client-credentials OAuth grant now automatically refresh their access token when it expires, instead of failing once the token lapses and requiring manual re-authentication.
• Connectors: Deleted or inaccessible connectors no longer appear in default connector lists or in new chats.
• Google Cloud Storage and other non-AWS S3-compatible endpoints no longer fail with SignatureDoesNotMatch; default request checksums are disabled for non-AWS endpoints.
• Chat: The sandbox is kept alive during active turns, reducing intermittent “recovering files” errors on long-running chats.
• Dashboards: An attached dashboard now renders in the artifact drawer before the first message is sent.
• Ontology: Fixed auto-attach for context file paths.
• Microsoft Teams: Fixed manifest validation errors and the outline icon.
• Settings: The role dialog now displays model access correctly.

​

Upgrade guide

​

Bug fixes

• White-label: Settings → Personal and the Authorized Apps list now display the deployment’s configured assistant and brand names instead of hardcoded “Ana” and “TextQL”, so white-labeled deployments read correctly throughout these screens.
• MCP: The MCP server now normalizes request headers on POST, accepting clients that send a parameterized application/json content type (such as Microsoft Copilot) instead of rejecting the handshake.

​

Upgrade guide

​

What’s new

• FSx snapshot storage routing

​

Bug fixes

• SCIM: Updating a user’s externalId via PUT or PATCH is now accepted instead of being rejected as immutable, so identity providers that re-issue external IDs (for example after an attribute-mapping change) sync successfully. A value already assigned to another user returns a 409 uniqueness error.
• MCP: Ana’s MCP server now returns JSON responses during the connection handshake, fixing connections from Microsoft Copilot.
• Ontology: Patch cells no longer fire duplicate concurrent requests for the same patch, and approval lookups wait until the patch has finished being created.
• Compute: Per-worker library volume mounts now use NFS soft mounts, so a storage outage surfaces as errors instead of leaving processes blocked indefinitely.

​

Upgrade guide

​

What’s new

• Ramp, ElevenLabs, Apollo, Pylon, and Mercury API connectors
• Istio toggle for Helm deployments
• Clickable links in CSV previews
• Desktop app automatic updates

​

Bug fixes

• Auth: SCIM-provisioned users are no longer denied login when their username domain differs from their email domain — OIDC logins now reconcile to the SCIM-provisioned identity, preserving organization memberships.
• Ontology: Patch diffs are now computed from a snapshot taken at diff time, fixing spurious “no changes” failures and files that could not be added to a patch.
• Dashboards: Recently viewed dashboards now stay warm for a configurable period before release, and failed dashboard startups no longer leave orphaned workers or phantom billing.
• Chat: Long mentions now wrap correctly on narrow screens, and CSV preview filter dropdowns position correctly.
• Playbooks: The empty-state status now reads “Awaiting run” instead of “Awaiting input”.
• Compute: Wedged sandbox storage mounts are now detected and unmounted automatically, independent of live sandbox pods.

​

Upgrade guide

​

What’s new

• Claude Fable 5 model
• Cloudflare and SendGrid API connectors
• Configurable SQL query timeouts
• Hide non-ZDR models when data retention is disabled
• HEIC image support
• Connector management in the v2 REST API
• Multi-approval for Ontology patches

​

Bug fixes

• Chat: Run-completion delivery is more reliable with a long-poll fallback, and streaming no longer re-processes the entire conversation on every token.
• Slack: Response delivery is now idempotent, preventing duplicate messages; image attachments render correctly in Slack and email.
• Auth: Allowed email domains are normalized when read, so case differences no longer cause false mismatches; fixed login on mobile WebKit browsers; expanded the disposable-email blocklist.
• Dashboards: Fixed slow loads and stuck updates, and idle dashboard sandboxes are now released based on viewer presence.
• Ontology: Fixed Git sync pushes to empty repositories, folder renames, and file-tree truncation; config reconciliation now resolves the repository HEAD instead of assuming main.
• Compute: The screenshot browser recovers from panics instead of failing runs, the LLM proxy now matches Anthropic’s 32 MB request size limit, and the FSx backup tagging algorithm is fixed.
• Sandbox: Runaway outbound request loops are now capped.

​

Upgrade guide

​

What’s new

• New API connectors
• Audio and video file previews
• Live dashboard content updates
• Per-connector database session identity
• Cell response ratings

​

Bug fixes

• Chat: Completed cells no longer re-arm streaming, and stuck streams now reconcile through a run-state poll — including on newly created chats — so conversations stop showing a spurious “still running” state.
• Chat: Hardened run-completion events in the v2 chat handlers so runs reliably report when they finish.
• Tableau: Fixed fsGroup permissions that broke Hyper extract queries, and hardened the connector’s container security context and finalizer handling.
• Ontology: Patch diffs are now computed against the merge-base for accurate change sets, and draft patches correctly show approve and deny buttons.
• Connectors: Connector logos now render without distortion in connector pills.
• Compute: Outbound AWS S3 uploads no longer stall.
• Sandbox: Idle sandboxes are now reclaimed correctly; fixed a last-access tracking bug that could defeat TTL expiry.
• Security: Upgraded pyarrow to 23.0.1 to address a dependency vulnerability.

​

Upgrade guide

​

What’s new

• Mid-conversation steering
• Edit dashboard code and sources inline
• Capabilities settings redesign
• Resumable chat streaming
• Distributed sandbox pool

​

Bug fixes

• Chat: Switching conversations during a network error no longer leaks report mode, dashboard mode, fast mode, or methodology settings between chats.
• Dashboards: Suspended organizations now stop dashboard retry storms — dashboards are marked failed with a clear suspension message instead of repeatedly respawning.
• Chat: Requests like “give me”, “create”, or “write X” now deliver the file directly in chat instead of saving it to the Ontology library.
• Tableau: Upgraded the connector’s web framework to address a Starlette host-header vulnerability.
• Connectors: The AWS Partner Central connector now uses a tightly scoped endpoint allowlist instead of a broad *.amazonaws.com pattern.

​

Upgrade guide

​

What’s new

• Distributed compute engine
• Ana Claude Code plugin
• Library skills via slash command
• Word document uploads
• PowerPoint uploads
• Snowflake optional database
• Ontology patch revision history
• Bedrock per-user audit attribution
• Email tool access control

​

Bug fixes

• PowerBI: Embed now works correctly inside sandboxed iframes (Power BI custom visuals) where allow-same-origin is absent.
• Connectors: OAuth config rows are de-duplicated and access-checked so non-admins can no longer view private connector keys.
• Databricks: Fixed a nil-pointer crash when converting decimal array columns.
• Dashboards: SQL Server and Azure Synapse queries are now correctly routed for dialect transpilation.
• Chat: Fixed a stream iterator panic and a nil dereference during message streaming.
• White-label: The browser notification icon is now brand-aware; white-labeled deployments show their own logo instead of the TextQL default.
• Compute: Sandbox allocation now falls back to Filestore/EFS automatically when FSx capacity is exhausted.

​

Upgrade guide

​

What’s new

• Chat input and conversation polish
• TQL frontmatter in tql files
• Auto-attach select all
• Paginated patch reviews
• PowerBI preconfiguration via embed URL
• Cross-domain email allowlist toggle

​

Bug fixes

• Billing — service account seat exclusion: Service accounts are automatically excluded from active seat-limit calculations.
• Sidebar: Recent Threads no longer appears nearly empty for members with many automated background chats; these are now excluded server-side before the 50-thread limit is applied.
• Ontology: Orphaned patches are now denied on submission.
• Chat: Empty attachment wrapper no longer reserves vertical space in the input card when no files are attached.

​

Upgrade guide

​

What’s new

• Ana as an MCP server
• MCP streaming responses and inline previews
• Interactive ECharts visualizations
• Library TQL data source for dashboards
• Ontology auto-approve rules
• OIDC identity provider
• TextQL Doctor diagnostics
• Language adherence
• Library plan-first git sync

​

Bug fixes

• PowerBI: Connector no longer incorrectly shows as “connected but not available in this chat.”
• OAuth: MCP consent state is correctly resumed after a login redirect.
• Ontology: Auto-approve spinner sizing corrected.
• Chat: Search filters reset on hard refresh instead of persisting stale state across sessions.
• Reports: Markdown tables now render correctly in email delivery.
• RBAC: Playbook template endpoints now correctly enforce playbook:read permission.

​

Upgrade guide

​

What’s new

• Unified Ontology surface
• Ontology settings section
• Ontology relationship graph redesign
• Ontology sync run tracking
• Ontology PDF and image migration
• Ontology GitHub App connect flow
• Ontology reviews split view
• Ontology new file highlighting
• Microsoft Teams integration
• Power BI per-member OAuth
• Firebolt connector
• Observability export to S3
• Playbook connector inheritance
• Plain-English role editor
• Email domain enforcement
• Editable Python package versions
• SCIM and OIDC identity merge
• Safe iframe embedding
• Cerebras LLM provider
• Custom documentation URL

​

Bug fixes

• Chat: Tool cells (SQL, Python, DAX, and others) now stay expanded across remounts and navigation.
• Chat: Cross-origin artifact downloads now force a blob fetch, fixing silent failures in some browser configurations.
• PowerBI: Missing member OAuth no longer triggers a full logout; reauth is surfaced inline instead.
• MCP Servers: Settings modal no longer hangs on “Loading servers…” due to a reactive loop.
• Settings: Notification preferences can now be updated without prior email-based access.
• Share links: Org branding is now respected in share link unfurl cards.
• Model restrictions: Role and org model allowlists are enforced across all chat APIs.

​

Upgrade guide

​

Bug fixes

• Fixed network policy that was blocking internal sandbox health checks for specific environments.

​

Upgrade guide

​

What’s new

• Asset origin restrictions and Content Security Policies
• Rich-text editing for Ontology markdown
• Context page refresh on role changes

​

Bug fixes

• Chat: Unsent draft text no longer leaks between chats when navigating; each chat retains its own draft independently.
• PowerBI: Connector auto-enable no longer gets forcibly cleared during connector updates.
• Ontology: Fixed parameter placeholder for MSSQL/Azure Synapse schema DDL queries.
• Chat: Safari caret mispaint after inserting an @-mention chip via Backspace is resolved.
• Platform API: Code execution failures now return a consistent response payload with an explicit error field and empty outputs.

​

Upgrade guide

• If you are using sealedSecrets, make sure to seal those values using kubeseal and then add the value to the values.yaml file.
• If you are using externalSecrets or nativeExternalSecrets, make sure the secrets are created in Secrets Manager.

​

What’s new

• Insert connectors and files as chat chips
• Paginated chat listing endpoint
• Expanded Ontology git providers
• Per-viewer dashboard breakdown popover
• Org defaults for dashboard output and private playbooks
• Ontology enabled by default with seeded connectors
• Fast mode for Anthropic Opus 4.7

​

Bug fixes

• RBAC: API key create/rotate/revoke operations now follow the correct permission flow. Fixed the assume roles issue.
• Sandbox: Org-installed packages no longer override base dependency versions.
• Chat: Connector chip correctly attached when inserted after a multi-line paste in Chrome.
• Shared chat link no longer stuck on a loading skeleton until refresh.
• Snowflake: Ontology table discovery using native object listing, surfacing objects beyond INFORMATION_SCHEMA.

​

Upgrade guide

​

What’s new

• REST API v2 endpoints
• Per-member OAuth for Snowflake and Databricks ontology
• Delete playbook from detail page
• Opt-in email tool with recipient lists
• Per-source dashboard cache invalidation
• Bedrock STS role assumption
• Configurable proxy trusted-host allowlist
• Unified default model resolution
• Sandboxed PDF processing
• Patch cell UX refinements

​

Bug fixes

• Model picker now populates all org-enabled models (was showing only “System Default”).
• SCIM, desktop download, and Git API routes excluded from the frontend auth catch-all and handled by their own access control rules, allowing these in functionality when enforceAuth: True.

​

Upgrade guide

​

What’s new

• Redesigned share modal with airlock preview
• File uploads in chat and stream APIs
• Automatic ontology migration

​

Bug fixes

• Oracle: Fixed missing synonym resolution for connect_string/wallet auth.
• Sandbox: Fixed RBAC admin permission enforcement.
• Share modal no longer fails to re-open after being closed.
• Numbered list rendering fixed in chat.
• UX improvements for expired and timed-out threads.
• Sidebar navigation pinning and back-navigation across panels.
• Packages settings tab no longer stuck in loading state when empty.

​

Upgrade guide

​

What’s new

• GPT-5.5 and Kimi K2.6 models
• Fast mode inference
• SAP HANA support
• Expanded connector authentication
• Ontology git sync
• SCIM group linking to system roles
• OIDC single-tenant role sync
• Self-healing dashboard workers
• Playbook owner failure alerts
• Tool-level RBAC enforcement

​

Bug fixes

• Tableau: Retry on expired sessions; fix multi-connector modal selection.
• PowerBI: Fix stale dataset name resolution; run upfront discovery queries at thread start.
• Databricks: Fix client credentials auth in SQL execution.
• SAP HANA: Fix sqlglot transpilation.
• Auth: Survive backend restarts without forcing re-login; fix logout redirect for enforceAuth mode; clear stale cookies on OIDC reauth.
• Chat: Fix parallel SQL/Python race condition; fix blank parallel tool cells from SDK delta misrouting; disable attach button while streaming.
• Connectors: Fix domain whitelist save button; fix New API Access button skipping picker; default auth type to token for API providers.
• Slack: Auto-sync channels; gate admin actions for non-admins.
• Security: Harden sandbox (CVE-2026-31431); harden console TLS cipher suites; fix xmldom/postcss vulnerabilities.
• Bedrock: Strip eager_input_streaming for Haiku 4.5.

​

Upgrade guide

​

What’s new

• Dashboards engine rebuild
• Ontology library redesign
• Redesigned assume-roles experience
• Mark threads as unread
• Markdown previews in the artifact drawer
• Connector UI gated on connector write permission
• Observability billing granularity
• TLS 1.2 and 1.3 enforcement
• Automated Helm chart releases

​

Bug fixes

• Dashboards: Fix Dash callbacks; fix prefill errors on LLM-created dashboards; fix parameterized queries; fix hot refresh on dedicated workers.
• Tableau: Retry on expired sessions.
• Slack: Fix mentions and WhoAmI; chunk blocks to respect 50-block limit.
• Chat: Fix tool_result image interleaving in parallel batches; improved chat navigation performance.
• Sandbox: Reduce lock contention causing deadline exceeded errors.
• Databricks: Fix client credentials auth in SQL execution.
• Console: Fix invoice due date timezone and off-by-one.
• Hourly playbook frequency detection restricted to exclude minute-level schedules.

​

Upgrade guide

• global.aws.useBedrock deprecated. Remove from the code.
• compute.sealedSecrets deprecated. Use compute.secretsMode = "sealedSecrets" instead.
• compute.worker deprecated. Attributes go to another section, called sandbox (at the root level like global, compute, web, etc).
  • compute.worker.computeClass → sandbox.computeClass
  • compute.worker.machineFamily → sandbox.machineFamily
  • compute.worker.imageTag → sandbox.imageTag
  • compute.worker.useInternalSandbox → remove from the code
• compute.constraints.sandbox deprecated — move sandbox constraints to the sandbox.constraints block instead.
• global.loopsApiKey - move to global.loops.apiKey.

​

What’s new

• Slack sender names and View in App
• Granular per-thread sharing controls
• Tool restriction controls and admin override
• Per-user MCP OAuth tokens
• Pause playbooks from the editor
• Copy artifact filenames
• Ontology file API
• Usage and billing sidebar permission gating
• Org logo removal and theme editor polish

​

Bug fixes

• Sandbox: Timeout guardrails and proxy error reduction.
• Connectors: Fix Snowflake role not applied; fix BigQuery regional dataset routing.
• Chat: Fix connector dropdown direction flip and flicker; fix OAuth prompts hidden by collapsible tool call UI.
• Settings: Fix dropdowns crashing on click.
• Dashboards: Fix unpublished changes status mismatch; increase spawn and script timeouts.
• Auth: Fix cross-org shared link switching.
• SCIM: Add Retry-After header to 429 responses.
• ACU billing calculation fix.
• Mobile UI improvements.
• Security: Critical dependency vulnerability patches.

​

Upgrade guide