> This page is for Itential Platform On-Prem, version 6 (default). > For other versions, use one of these documentation indexes: > - 6 (default): https://docs-test.itntl.com/itential-platform/6/llms.txt > - 2023.2: https://docs-test.itntl.com/itential-platform/2023-2/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs-test.itntl.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs-test.itntl.com/_mcp/server. # Itential Platform 6 changelog > How to stay informed about Platform 6 releases. > **Tip** > > Subscribe to our RSS feed to receive automatic notifications when new releases are published. > Get notified when we ship new features and improvements. ## October 15, 2026 # 6.6.1 Platform 6.6.1 replaces the Platform 6.6.0 minor release. It adds validation APIs across Platform components, expands audit logging, and introduces a rich text editor for Agent Prompts. This release also includes security updates, bug fixes, and enhancements across Core, Gateway Manager, Integrations, Work Center, and NSO Service Manager. For more information on new features introduced in this release, see [Platform 6.6 feature announcement](/itential-platform/release-notes/feature-announcements/660). #### Enhancements (26) | Component | Feature | Description | | -------------------------------- | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Agent Projects | **Rich text editor for Agent Prompts** (ENG-27470) | Replaced the plain text editor in Agent Prompts with a rich text editor. | | Configuration Manager | **Golden configuration validation API** (ENG-26750) | Added a validation API for golden configurations and improved validation checks when you create or update them. | | Core | **User-Agent and Referer headers in web server logs** (ENG-28293) | Added support for logging the User-Agent and Referer headers on the `webserver.log` entries. If a client doesn't send a header, Platform logs `-` for that field. | | Core | **Audit logging for authorization, service, and Studio resources** (ENG-27886) | Added audit logging for authorization, service, and Studio resources. | | Core | **Platform encryption key rotation script** (ENG-27147) | Added a script to rotate Platform encryption keys. | | Core | **Audit logging capabilities** (ENG-26769, ENG-27172) | Enabled `log.audit` capabilities in services and Platform. | | Core | **Web server metrics endpoint** (ENG-25533) | Added an OpenTelemetry-compatible `/metrics/webserver` endpoint that exposes web server request, error, and latency metrics for monitoring and observability. | | Core | **Certificate-based authentication for the Azure AAA adapter** (ENG-23829) | Added certificate-based authentication (CBA) support to the Azure AAA adapter. Platform can now authenticate to Microsoft Entra ID with a certificate and private key instead of a client secret. The client secret can still be used as an alternative to CBA. | | Gateway Manager | **Delete dialog styling for certificates** (ENG-28165) | Improved the styling of the delete dialog for Gateway Manager certificates. | | Gateway Manager | **Run Code task cluster restriction** (ENG-27560) | When an administrator restricts Run Code task execution to a designated gateway cluster, the **Gateway Cluster** field in the task configuration panel and the **CLUSTER** field in the code editor are now disabled. Platform also blocks saving a workflow whose Run Code task uses a cluster that isn't approved. It shows an error badge on the task and an entry in **Error History**. | | Gateway Manager | **Virtual cluster load balancing** (ENG-27425) | Made minor improvements to load balancing for virtual clusters. | | Gateway Manager | **Resource payload validation API** (ENG-26751) | Added a validation API endpoint that checks resource payloads before you create them. Also improved validation on the create and update endpoints to reject invalid or dangerous payloads more reliably. | | Configuration Manager Enterprise | **JSON compliance reports written to GridFS** (ENG-27199) | Large JSON compliance reports are now written to GridFS. | | Configuration Manager Enterprise | **Device compliance reports written to GridFS** (ENG-27198) | Large device compliance reports are now written to GridFS. | | Integrations | **URL encoding control** (ENG-19665) | Added support for the OpenAPI `allowReserved` option. Platform reads it from the OpenAPI document when you import an integration and applies it to `query` parameters and to `application/x-www-form-urlencoded` and `multipart/form-data` request bodies, so reserved characters aren't percent-encoded. You can also set it in the `x-itential-parameters` array. `allowReserved` doesn't apply to path parameters, so Platform still encodes reserved characters such as `/` in path values. | | Inventory Manager | **Semantic validation for inventory documents** (ENG-26749) | Added semantic validation for inventory, node, action, and tag documents. Validation runs automatically on create and update. You can also check a draft before saving with the new `POST /v1/validate` endpoint. This ensures FlowAI builder skills persist only valid changes. | | MOP | **MOP validation API** (ENG-26773) | Added a validation API that verifies the form and shape of templates using backend and frontend logic. | | Operations Manager | **componentType required with componentId or componentName** (ENG-26443) | Operations Manager now requires `componentType` whenever you set `componentId` or `componentName`. | | Operations Manager | **GBAC read-requires-write on createAutomation** (ENG-26442) | Enforced the GBAC read-requires-write rule on `createAutomation`. | | Operations Manager | **Validation for componentName-only automation updates** (ENG-26441) | Added validation for automation updates that set only `componentName`. | | Operations Manager | **Manual trigger validation** (ENG-26440) | Operations Manager now validates manual trigger `formId` and `formData` at write time. | | Operations Manager | **taskMocks option in Start Job API** (ENG-25895) | Added the `options.taskMocks` object to the Start Job API reference. It maps task IDs to task mock IDs so you can run a job with mocked tasks. | | Studio | **Transformation validation API** (ENG-26772) | Added a validation API for transformations. | | Studio, Workflow engine | **Keys with reserved characters** (ENG-27145) | Added support for resolving keys that contain `?`, `(`, `[`, or `{`. Platform no longer treats these characters as reserved. | | Templates | **Template validation API** (ENG-26793) | Added a validate template API endpoint that checks the structure of a template using frontend and backend rules. | | Workflows | **Deep validation option for workflow import** (ENG-27588, ENG-27589, ENG-27590) | Added an option to the import workflows API call for deep validation. Validation now warns when the `position` field is missing. | #### Bug fixes (55) | Component | Feature | Description | | --------------------------------------- | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Configuration Manager | **renderJinja2 hangs** (ENG-30772) | Fixed an issue where the `renderJinja2` method would hang and not complete when invoked through the HTTP API or as a task. | | Configuration Manager | **Disallow rule ignored for keys containing a dot** (ENG-27364) | Configuration Manager now fails a compliance plan when a line inside a key that contains a dot (`.`) is marked as disallowed and is present in the API response. | | Core | **Stale adapter method and task configurations** (ENG-27920) | Fixed an issue where restarting an adapter left Platform showing outdated method and task configurations. | | Core | **exportService and exportProfile errors** (ENG-27543) | Fixed an issue where `exportService` and `exportProfile` always threw an error instead of returning a result. | | Core | **Duplicate service fork** (ENG-27333) | Fixed a race condition that could fork a service twice and leave an untracked duplicate process when a restart, start, or reboot overlapped with another operation on the same service. | | Core | **Missing views property in pronghorn.json** (ENG-27329) | Fixed an issue where a missing `views` property in a `pronghorn.json` file caused UIs to crash with a "Something Went Wrong" message. | | Core | **MongoDB oplog growth in looped workflows** (ENG-27251) | Fixed excessive MongoDB oplog growth in looped workflows. | | Core | **OpenAPI 3.0 import rejected for boolean exclusiveMinimum** (ENG-26838) | Fixed an issue where OpenAPI 3.0 integration imports were rejected when `exclusiveMinimum` was a boolean. | | Core | **Integration worker memory leak** (ENG-26833) | Fixed a slow memory leak in the Integration worker. Per-request loggers left behind an exception handler, which caused memory use to grow over the life of a long-running process. | | FlowAI | **Tool discovery failure isolation** (ENG-27678) | Tool discovery now isolates a failure to the specific tool that failed instead of blocking the whole collection. | | FlowAI, Operations Manager, Work Center | **Redis rolling restart handling** (ENG-26590) | Fixed how FlowAI, Operations Manager, and Work Center handle a Redis rolling restart. | | Gateway Manager | **Stale text in delete confirmation dialogs** (ENG-28154) | Fixed an issue where Gateway delete confirmation dialogs displayed stale text. | | Gateway Manager | **Gateway certificate toggle** (ENG-27564) | Fixed a UI issue when toggling Gateway certificates. | | Integrations | **Bare string responses with dynamic retrieval** (ENG-28568, ENG-29247, ENG-28969) | Fixed authentication and Gateway-routed requests for integration models that use `x-itential-dynamic-retrieval` with a bare string response. | | Integrations | **Variable substitution for path-level and operation-level parameters** (ENG-27670) | Fixed OpenAPI integration variable substitution so `x-itential-variable` values declared on path-level or operation-level parameters are injected into outgoing requests. | | Integrations | **Oversized OpenAPI model import** (ENG-27378) | Fixed an issue where importing an OpenAPI integration model over 15 MB could succeed despite a warning. Platform now rejects oversized models with a clear error message. | | Integrations | **AWS Signature v4 with non-standard hostnames** (ENG-27372) | Added support for explicitly declaring the AWS region and service on an integration. AWS Signature v4 authentication now works with non-standard hostnames. | | JSON forms | **JSON form export failure** (ENG-29929) | Fixed an issue where JSON forms with dynamic dropdowns and containers or schema combinations couldn't be exported. | | JSON forms | **Dynamic dropdown 404 with special characters in adapter name** (ENG-9540) | Fixed an issue where a JSON form dynamic dropdown returned a 404 error when the adapter it queried had a space or other special character in its name. | | JSON forms | **Form clipped when errors are present** (ENG-7534) | Fixed an issue where a JSON form was visually clipped when form errors were present and you selected a radio button. | | JSON forms | **Add Validation tooltip** (ENG-5865) | Removed the tooltip from the **Add Validation** button in the JSON form configure dialog. | | JSON forms | **Duplicate wizard step numbers** (ENG-5860) | Fixed an issue where a dynamic dropdown with a JSON Schema transformation (JST) source and a field dependency displayed two wizard steps numbered "3" instead of "3" and "4". | | JSON forms | **Dynamic dropdown API display** (ENG-5159) | Fixed an issue with how dynamic dropdowns display API data. | | Lifecycle Manager | **Broken redirect** (ENG-10761) | Fixed a broken redirect in Lifecycle Manager. | | Lifecycle Manager | **Scrollbar flicker in Firefox** (ENG-5382) | Fixed an issue where the scrollbar flickered in the Instance History and Instance Groups history lists in Firefox. | | MOP, Studio, Workflows | **Blank ID overwrote existing ID** (ENG-27183) | Fixed an issue where an existing ID could be overwritten with a blank ID, which caused errors. | | NSO Service Manager | **Trace context for NSO 6.3 and later** (ENG-27014) | Improved trace context support for NSO 6.3 and later to provide better request tracing across additional supported methods. | | Operations Manager | **Browser freeze on long job ancestor chains** (ENG-29014) | Fixed an issue where opening the details page of a job with a very long ancestor chain froze or crashed the browser tab. An example is a recursive child job tens of thousands of levels deep. The job breadcrumb now looks up only the root job and the 10 nearest ancestors. Users without permission to view jobs no longer trigger the ancestor lookup. | | Operations Manager, Work Center | **Additional debug logging** (ENG-27156) | Added debug logging to Operations Manager and Work Center. | | Platform | **Misaligned array field columns** (ENG-27614) | Fixed an issue in JSON Schema Form array fields where row columns were misaligned with the column header. This happened when a schema combination (`allOf` or `if-then`) added a column for only some rows. | | Projects | **Pagination controls hidden by banner** (ENG-28241) | Fixed an issue where the pagination controls on the Projects list view became inaccessible when a banner was displayed. | | Projects | **Actions enabled for missing assets** (ENG-21416) | Fixed an issue where project assets deleted from the database still displayed enabled action menu items, which failed when selected. **Edit Details**, **Rename**, **Duplicate**, **Move to Global Space**, and **Add to New Folder** are now disabled for missing assets. **Delete** stays enabled so you can remove the stale reference. Each object in the `components` array of project responses, such as `GET /automation-studio/projects/{id}`, now includes an optional boolean `exists` field that is `false` when the asset is no longer in the database. | | Projects | **Add to project search filter** (ENG-4882) | Fixed the filter in the add to project search dialog so it searches all documents instead of only the current page. | | Projects, Studio | **Project name missing from edit dialog** (ENG-28631) | Fixed an issue where the project name wasn't shown in the edit details dialog when you opened it from the side navigation. | | Projects, Studio | **Empty area below tree navigation lists** (ENG-4204) | Fixed an issue where an empty, non-functional area appeared below the last item in some tree-based navigation lists. | | Projects, Transformations | **Long values clipped in output** (ENG-14239) | Fixed an issue where long unbroken values, such as tokens and URLs, were clipped instead of wrapping in the Log Console and Live Preview output. | | Projects, Transformations | **JST tour popup stays visible** (ENG-13439) | Fixed an issue where the JSON Schema transformation (JST) "Take a Tour!" onboarding popup stayed visible after you left the JST editor without dismissing it. | | Studio | **Run Service nested query saved to wrong field** (ENG-28436) | Fixed an issue where a task query on a field nested in the Run Service task's `params` object saved to a duplicate top-level field, so the task received an empty value at runtime. Queries now target the intended field. | | Studio, Templates, Transformations | **In-flight work lost during restart** (ENG-26870) | Fixed an issue where in-flight work in the JST transformation, MOP retry, and Template Builder services could be lost or left incomplete during a Platform restart. These services now complete or safely hand off in-flight work during shutdown. | | Transformations | **Multiple tabs opened on click** (ENG-27029) | Fixed an issue where a transformation opened multiple tabs when you selected it. | | Transformations | **Stop method scroll reset in JST builder** (ENG-4985) | Fixed an issue where the Stop method scroll position reset in the JST builder. | | Transformations | **Reordering user function inputs broke mappings** (ENG-3311) | Fixed an issue where reordering the inputs on a user function could break existing input mappings. | | Work Center | **Assignee dropdown and column** (ENG-28591) | Fixed an issue where the **Assignee** dropdown didn't populate until you typed a filter, and the **Assignee** column could show a raw account ID instead of the user's name. An older account record crashed the account list lookup. The lookup now handles these records. | | Workflow engine | **Task worker rate limiting resilience** (ENG-29018) | Task worker rate limiting is now more resilient. Platform logs and retries errors in the pull clock instead of crashing the service, and logs stalls. | | Workflows | **Task input values restored from another task** (ENG-29225) | Fixed an issue in the Workflow Editor where switching a task input back to **Job**, **Static**, or **Task** could restore a value from a different task's input with the same name. Platform now remembers previous values for each task and each input. | | Workflows | **Run Service task parameters** (ENG-28541) | Fixed existing workflows with Run Service tasks that were previously modified incorrectly. The queried value is now stored correctly in the task parameters. | | Workflows | **Job variable input validation** (ENG-27668) | Fixed an issue where running a workflow with a task input set to a job variable with an inline query failed input validation when you provided an object or array. The workflow input schema now accepts objects and arrays for these variables. | | Workflows | **.xlsm upload on Windows** (ENG-26434) | Fixed an issue where uploading `.xlsm` files on Windows failed. | | Workflows | **Focused task styling removed on save** (ENG-22932) | Fixed an issue where saving a workflow removed the focus styling from the selected task on the canvas. The task's colored border and corner focus indicators now stay in place after a save, for as long as the task's details panel is open. | | Workflows | **Task palette sort order** (ENG-22445) | Fixed an issue in the Studio task palette where tasks within a group weren't always listed in alphabetical order. Platform now sorts tasks by the name shown in the palette. | | Workflows | **Response failed its own schema check** (ENG-19442) | Fixed an issue where an API response failed the check against its own description because the description listed a field as a single value when it's a list. | | Workflows | **Task documentation links** (ENG-17657) | Updated the **Task Details** panel for applicable tasks to point to the new documentation website for task references and details. | | Workflows | **Edit buttons shifted by long names** (ENG-14388) | Fixed an issue where long names pushed the edit buttons down. The edit options now stay on the same line. | | Workflows | **Duplicate x and y coordinates** (ENG-9373) | Fixed an issue where an item stored more than one set of x and y coordinates. Each item now has only one set. | | Workflows | **Child job not run for empty loop array** (ENG-5444) | Platform now displays a clear message when a child job never ran because the loop array was empty. | #### Security fixes (40) This release includes security updates that address vulnerabilities in third-party packages and Platform components. | Component | Feature | Description | | ---------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin Essentials | **Prototype pollution in Integration Model viewer** (ENG-28232) | Fixed a client-side prototype pollution vulnerability (CVE-2026-93753) in the Integration Model viewer. Imported OpenAPI and Swagger documents are now sanitized to remove `__proto__`, `constructor`, and `prototype` keys before rendering. This closes a bypass in the `deepmerge` dependency, which has no upstream fix. | | Core | **ReDoS in brace-expansion** (ENG-28894) | Updated `brace-expansion`, which `minimatch` uses internally for glob pattern matching, to patched versions to resolve a denial-of-service (ReDoS) vulnerability (CVE-2026-102277). | | Core | **axios vulnerability** (ENG-28881) | Updated `axios` to resolve a security vulnerability. | | Core | **CRLF injection in form-data** (ENG-28474) | Updated `form-data` to 4.0.6 to resolve a CRLF injection vulnerability (CVE-2026-12143). The vulnerable code path isn't reachable from Platform first-party code. | | Core | **proxy-addr vulnerability** (ENG-27978) | Overrode the `proxy-addr` dependency to resolve a known vulnerability. | | Core | **moment vulnerability** (ENG-27977) | Updated `moment` to resolve a security vulnerability. | | Core | **Memory leak in compression** (ENG-27932) | Updated `compression` to resolve a memory-leak vulnerability. | | Core | **ReDoS in path-to-regexp** (ENG-27889) | Updated `path-to-regexp`, which Express uses internally, to the latest patched version to resolve a denial-of-service (ReDoS) vulnerability (CVE-2026-4867). | | Core | **undici vulnerability** (ENG-27496) | Updated `undici` to resolve a security vulnerability. | | Core | **fast-uri vulnerability** (ENG-27465) | Updated `fast-uri` to resolve a security vulnerability. | | Core | **@xmldom/xmldom vulnerability** (ENG-27392) | Updated the transitive `@xmldom/xmldom` dependency to resolve a security vulnerability. | | Core | **js-yaml vulnerability** (ENG-27390) | Updated `js-yaml` to resolve a security vulnerability. | | Core | **Unmaintained json-stringify-safe dependency** (ENG-26693) | Replaced the unmaintained `json-stringify-safe` dependency with `safe-stable-stringify` for worker-thread message serialization and JSON Schema sanitization. | | Gateway Manager | **Third-party dependency updates** (ENG-28266, ENG-27909, ENG-27908, ENG-27891, ENG-27890, ENG-27887) | Updated third-party dependencies to resolve security vulnerabilities. | | Gateway Manager | **ws vulnerability** (ENG-27892) | Updated `ws` to resolve security vulnerabilities. | | Gateway Manager | **HTML sanitizer vulnerability in monaco-editor** (ENG-26372) | Updated `monaco-editor`, the code editor bundled with Gateway Manager, to resolve a vulnerability (CVE-2026-65898) in its embedded HTML sanitizer. | | Gateway Manager, Inventory Manager | **Third-party dependency updates** (ENG-29474) | Updated third-party dependencies to resolve security vulnerabilities. | | Inventory Manager | **Third-party dependency updates** (ENG-28264, ENG-27910) | Updated third-party dependencies to resolve security vulnerabilities. | | Legacy Forms | **Unused wicked-good-xpath polyfill** (ENG-26695) | Removed the unused `wicked-good-xpath` polyfill from the Form Builder task path. | | NSO Service Manager | **XSS in DOMPurify (app-service_management)** (ENG-29479) | Resolved a cross-site scripting (XSS) vulnerability by updating `DOMPurify` to a secure version in app-service_management. | | NSO Service Manager | **Double decoding in fast-uri (app-nso_manager)** (ENG-29472) | Resolved a double decoding of the same data vulnerability (CVE-2026-75899) by updating `fast-uri` to a secure version in app-nso_manager. | | NSO Service Manager | **XSS in DOMPurify (app-nso_manager)** (ENG-29463) | Resolved a cross-site scripting (XSS) vulnerability by updating `DOMPurify` to a secure version in app-nso_manager. | | NSO Service Manager | **Uncontrolled recursion in brace-expansion (app-nso_manager)** (ENG-29457) | Resolved an uncontrolled recursion vulnerability (CVE-2026-102276) by updating `brace-expansion` to a secure version in app-nso_manager. | | NSO Service Manager | **Case sensitivity in fast-uri (app-service_management)** (ENG-29227) | Resolved an improper handling of case sensitivity vulnerability (CVE-2026-86472) by updating `fast-uri` to a secure version in app-service_management. | | NSO Service Manager | **Infinite loop in uri-js (app-service_management)** (ENG-29226) | Resolved an infinite loop vulnerability (CVE-2026-93690) by replacing the affected `uri-js` dependency with a drop-in replacement in app-service_management. | | NSO Service Manager | **SSRF in axios (app-nso_manager)** (ENG-29111) | Resolved a server-side request forgery (SSRF) vulnerability (CVE-2026-101898) by updating `axios` to 1.20.0 in app-nso_manager. | | NSO Service Manager | **Infinite loop in uri-js (app-nso_manager)** (ENG-28512) | Resolved an infinite loop vulnerability (CVE-2026-93690) by replacing the affected `uri-js` dependency with a secure replacement in app-nso_manager. | | NSO Service Manager | **Directory traversal in Moment (app-nso_manager)** (ENG-28511) | Resolved a directory traversal vulnerability (CVE-2026-17495) by updating `moment` to a secure version in app-nso_manager. | | NSO Service Manager | **Interpretation conflict in fast-uri (app-service_management)** (ENG-28510) | Resolved an interpretation conflict vulnerability (CVE-2026-84292) by updating `fast-uri` to 3.1.7 in app-service_management. | | Operations Manager | **axios vulnerability** (ENG-29405) | Updated `axios` in Operations Manager 23.2 to resolve a security vulnerability. | | Platform | **Dependency updates** (ENG-28288) | Updated Platform dependencies to resolve security vulnerabilities. | | Studio | **Deprecated lodash.isequal dependency** (ENG-26696) | Replaced the deprecated `lodash.isequal` dependency with `isDeepStrictEqual` from `node:util` on the server and `equals` from `ramda` in browser-bundled code. This internal change doesn't affect user-facing behavior. | | Work Center | **Multiple vulnerabilities in axios** (ENG-28877, ENG-28875, ENG-28873, ENG-28871, ENG-28870) | Updated `axios` to a patched release to resolve multiple high-severity vulnerabilities, including ReDoS, denial of service, improper input validation, and prototype pollution. | | Work Center | **Uncontrolled recursion in brace-expansion** (ENG-28739) | Resolved a high-severity uncontrolled recursion vulnerability (CVE-2026-102276) in the `brace-expansion` dependency used by nestjs-platform by updating the transitive dependency to a patched version. | | Work Center | **Uncontrolled recursion in backend dependency** (ENG-28731) | Resolved a high-severity uncontrolled recursion vulnerability, which could cause denial of service, by updating a third-party dependency of the Work Center backend service to a patched version. | | Work Center | **IP spoofing in proxy-addr** (ENG-27956, ENG-27942) | Resolved a critical vulnerability (CVE-2026-90711) in `proxy-addr`. A crafted `X-Forwarded-For` header could spoof the client IP address and bypass IP-based access control, rate limiting, geolocation, and audit logging. | | Work Center | **multer vulnerability** (ENG-27928) | Resolved a vulnerability in the `multer` package. | | Work Center | **Prototype pollution in joi** (ENG-27843) | Updated `joi` in work-center-service from 18.2.3 to 18.2.9 to resolve a prototype pollution vulnerability (CVE-2026-90771). | | Work Center | **js-yaml vulnerability** (ENG-27416) | Resolved a vulnerability in the `js-yaml` package. | | Work Center | **Nested dependency vulnerability in shared library** (ENG-27405) | Resolved a vulnerability in a nested dependency of a shared library that Work Center and Agent Session Manager use. | #### Sub-tasks (1) | Component | Feature | Description | | ------------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | NSO Service Manager | **Node.js 22 and npm 10 support** (ENG-27541, ENG-27540, ENG-27539) | Updated package metadata in app-service_management, app-nso_manager, and adapter-nso to support Node.js 22 and npm 10. | #### Component versions | Component | Version | | -------------------------------- | ------- | | FlowAI | 1.2.0 | | Gateway Manager | 1.2.4 | | Inventory Manager | 1.2.19 | | NSO Service Manager | 6.6.1 | | Configuration Manager Enterprise | 6.6.1 | ## October 7, 2026 # 6.6.0 > **Warning** > > Platform 6.6.0 artifacts are no longer available in the Itential Artifact Repository. Use Platform 6.6.1 instead. We apologize for any inconvenience. Platform 6.6.0 is a minor release that adds validation APIs across Platform components, expands audit logging, and introduces a rich text editor for Agent Prompts. This release also includes security updates, bug fixes, and enhancements across Core, Gateway Manager, Integrations, Work Center, and NSO Service Manager. For more information on new features introduced in this release, see [Platform 6.6 feature announcement](/itential-platform/release-notes/feature-announcements/660). #### Enhancements (26) | Component | Feature | Description | | -------------------------------- | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Agent Projects | **Rich text editor for Agent Prompts** (ENG-27470) | Replaced the plain text editor in Agent Prompts with a rich text editor. | | Configuration Manager | **Golden configuration validation API** (ENG-26750) | Added a validation API for golden configurations and improved validation checks when you create or update them. | | Core | **User-Agent and Referer headers in web server logs** (ENG-28293) | Added support for logging the User-Agent and Referer headers on the `webserver.log` entries. If a client doesn't send a header, Platform logs `-` for that field. | | Core | **Audit logging for authorization, service, and Studio resources** (ENG-27886) | Added audit logging for authorization, service, and Studio resources. | | Core | **Platform encryption key rotation script** (ENG-27147) | Added a script to rotate Platform encryption keys. | | Core | **Audit logging capabilities** (ENG-26769, ENG-27172) | Enabled `log.audit` capabilities in services and Platform. | | Core | **Web server metrics endpoint** (ENG-25533) | Added an OpenTelemetry-compatible `/metrics/webserver` endpoint that exposes web server request, error, and latency metrics for monitoring and observability. | | Core | **Certificate-based authentication for the Azure AAA adapter** (ENG-23829) | Added certificate-based authentication (CBA) support to the Azure AAA adapter. Platform can now authenticate to Microsoft Entra ID with a certificate and private key instead of a client secret. The client secret can still be used as an alternative to CBA. | | Gateway Manager | **Delete dialog styling for certificates** (ENG-28165) | Improved the styling of the delete dialog for Gateway Manager certificates. | | Gateway Manager | **Run Code task cluster restriction** (ENG-27560) | When an administrator restricts Run Code task execution to a designated gateway cluster, the **Gateway Cluster** field in the task configuration panel and the **CLUSTER** field in the code editor are now disabled. Platform also blocks saving a workflow whose Run Code task uses a cluster that isn't approved. It shows an error badge on the task and an entry in **Error History**. | | Gateway Manager | **Virtual cluster load balancing** (ENG-27425) | Made minor improvements to load balancing for virtual clusters. | | Gateway Manager | **Resource payload validation API** (ENG-26751) | Added a validation API endpoint that checks resource payloads before you create them. Also improved validation on the create and update endpoints to reject invalid or dangerous payloads more reliably. | | Configuration Manager Enterprise | **JSON compliance reports written to GridFS** (ENG-27199) | Large JSON compliance reports are now written to GridFS. | | Configuration Manager Enterprise | **Device compliance reports written to GridFS** (ENG-27198) | Large device compliance reports are now written to GridFS. | | Integrations | **URL encoding control** (ENG-19665) | Added support for the OpenAPI `allowReserved` option. Platform reads it from the OpenAPI document when you import an integration and applies it to `query` parameters and to `application/x-www-form-urlencoded` and `multipart/form-data` request bodies, so reserved characters aren't percent-encoded. You can also set it in the `x-itential-parameters` array. `allowReserved` doesn't apply to path parameters, so Platform still encodes reserved characters such as `/` in path values. | | Inventory Manager | **Semantic validation for inventory documents** (ENG-26749) | Added semantic validation for inventory, node, action, and tag documents. Validation runs automatically on create and update. You can also check a draft before saving with the new `POST /v1/validate` endpoint. This ensures FlowAI builder skills persist only valid changes. | | MOP | **MOP validation API** (ENG-26773) | Added a validation API that verifies the form and shape of templates using backend and frontend logic. | | Operations Manager | **componentType required with componentId or componentName** (ENG-26443) | Operations Manager now requires `componentType` whenever you set `componentId` or `componentName`. | | Operations Manager | **GBAC read-requires-write on createAutomation** (ENG-26442) | Enforced the GBAC read-requires-write rule on `createAutomation`. | | Operations Manager | **Validation for componentName-only automation updates** (ENG-26441) | Added validation for automation updates that set only `componentName`. | | Operations Manager | **Manual trigger validation** (ENG-26440) | Operations Manager now validates manual trigger `formId` and `formData` at write time. | | Operations Manager | **taskMocks option in Start Job API** (ENG-25895) | Added the `options.taskMocks` object to the Start Job API reference. It maps task IDs to task mock IDs so you can run a job with mocked tasks. | | Studio | **Transformation validation API** (ENG-26772) | Added a validation API for transformations. | | Studio, Workflow engine | **Keys with reserved characters** (ENG-27145) | Added support for resolving keys that contain `?`, `(`, `[`, or `{`. Platform no longer treats these characters as reserved. | | Templates | **Template validation API** (ENG-26793) | Added a validate template API endpoint that checks the structure of a template using frontend and backend rules. | | Workflows | **Deep validation option for workflow import** (ENG-27588, ENG-27589, ENG-27590) | Added an option to the import workflows API call for deep validation. Validation now warns when the `position` field is missing. | #### Bug fixes (44) | Component | Feature | Description | | --------------------------------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Core | **Stale adapter method and task configurations** (ENG-27920) | Fixed an issue where restarting an adapter left Platform showing outdated method and task configurations. | | Core | **exportService and exportProfile errors** (ENG-27543) | Fixed an issue where `exportService` and `exportProfile` always threw an error instead of returning a result. | | Core | **Duplicate service fork** (ENG-27333) | Fixed a race condition that could fork a service twice and leave an untracked duplicate process when a restart, start, or reboot overlapped with another operation on the same service. | | Core | **Missing views property in pronghorn.json** (ENG-27329) | Fixed an issue where a missing `views` property in a `pronghorn.json` file caused UIs to crash with a "Something Went Wrong" message. | | Core | **MongoDB oplog growth in looped workflows** (ENG-27251) | Fixed excessive MongoDB oplog growth in looped workflows. | | Core | **OpenAPI 3.0 import rejected for boolean exclusiveMinimum** (ENG-26838) | Fixed an issue where OpenAPI 3.0 integration imports were rejected when `exclusiveMinimum` was a boolean. | | Core | **Integration worker memory leak** (ENG-26833) | Fixed a slow memory leak in the Integration worker. Per-request loggers left behind an exception handler, which caused memory use to grow over the life of a long-running process. | | FlowAI | **Tool discovery failure isolation** (ENG-27678) | Tool discovery now isolates a failure to the specific tool that failed instead of blocking the whole collection. | | FlowAI, Operations Manager, Work Center | **Redis rolling restart handling** (ENG-26590) | Fixed how FlowAI, Operations Manager, and Work Center handle a Redis rolling restart. | | Gateway Manager | **Stale text in delete confirmation dialogs** (ENG-28154) | Fixed an issue where Gateway delete confirmation dialogs displayed stale text. | | Gateway Manager | **Gateway certificate toggle** (ENG-27564) | Fixed a UI issue when toggling Gateway certificates. | | Integrations | **Bare string responses with dynamic retrieval** (ENG-28568, ENG-29247, ENG-28969) | Fixed authentication and Gateway-routed requests for integration models that use `x-itential-dynamic-retrieval` with a bare string response. | | Integrations | **Variable substitution for path-level and operation-level parameters** (ENG-27670) | Fixed OpenAPI integration variable substitution so `x-itential-variable` values declared on path-level or operation-level parameters are injected into outgoing requests. | | Integrations | **Oversized OpenAPI model import** (ENG-27378) | Fixed an issue where importing an OpenAPI integration model over 15 MB could succeed despite a warning. Platform now rejects oversized models with a clear error message. | | Integrations | **AWS Signature v4 with non-standard hostnames** (ENG-27372) | Added support for explicitly declaring the AWS region and service on an integration. AWS Signature v4 authentication now works with non-standard hostnames. | | JSON forms | **Dynamic dropdown 404 with special characters in adapter name** (ENG-9540) | Fixed an issue where a JSON form dynamic dropdown returned a 404 error when the adapter it queried had a space or other special character in its name. | | JSON forms | **Form clipped when errors are present** (ENG-7534) | Fixed an issue where a JSON form was visually clipped when form errors were present and you selected a radio button. | | JSON forms | **Add Validation tooltip** (ENG-5865) | Removed the tooltip from the **Add Validation** button in the JSON form configure dialog. | | JSON forms | **Duplicate wizard step numbers** (ENG-5860) | Fixed an issue where a dynamic dropdown with a JSON Schema transformation (JST) source and a field dependency displayed two wizard steps numbered "3" instead of "3" and "4". | | JSON forms | **Dynamic dropdown API display** (ENG-5159) | Fixed an issue with how dynamic dropdowns display API data. | | Lifecycle Manager | **Broken redirect** (ENG-10761) | Fixed a broken redirect in Lifecycle Manager. | | Lifecycle Manager | **Scrollbar flicker in Firefox** (ENG-5382) | Fixed an issue where the scrollbar flickered in the Instance History and Instance Groups history lists in Firefox. | | MOP, Studio, Workflows | **Blank ID overwrote existing ID** (ENG-27183) | Fixed an issue where an existing ID could be overwritten with a blank ID, which caused errors. | | NSO Service Manager | **Trace context for NSO 6.3 and later** (ENG-27014) | Improved trace context support for NSO 6.3 and later to provide better request tracing across additional supported methods. | | Operations Manager | **Browser freeze on long job ancestor chains** (ENG-29014) | Fixed an issue where opening the details page of a job with a very long ancestor chain froze or crashed the browser tab. An example is a recursive child job tens of thousands of levels deep. The job breadcrumb now looks up only the root job and the 10 nearest ancestors. Users without permission to view jobs no longer trigger the ancestor lookup. | | Operations Manager, Work Center | **Additional debug logging** (ENG-27156) | Added debug logging to Operations Manager and Work Center. | | Platform | **Misaligned array field columns** (ENG-27614) | Fixed an issue in JSON Schema Form array fields where row columns were misaligned with the column header. This happened when a schema combination (`allOf` or `if-then`) added a column for only some rows. | | Projects | **Pagination controls hidden by banner** (ENG-28241) | Fixed an issue where the pagination controls on the Projects list view became inaccessible when a banner was displayed. | | Projects | **Add to project search filter** (ENG-4882) | Fixed the filter in the add to project search dialog so it searches all documents instead of only the current page. | | Projects, Studio | **Empty area below tree navigation lists** (ENG-4204) | Fixed an issue where an empty, non-functional area appeared below the last item in some tree-based navigation lists. | | Projects, Transformations | **JST tour popup stays visible** (ENG-13439) | Fixed an issue where the JSON Schema transformation (JST) "Take a Tour!" onboarding popup stayed visible after you left the JST editor without dismissing it. | | Studio | **Run Service nested query saved to wrong field** (ENG-28436) | Fixed an issue where a task query on a field nested in the Run Service task's `params` object saved to a duplicate top-level field, so the task received an empty value at runtime. Queries now target the intended field. | | Studio, Templates, Transformations | **In-flight work lost during restart** (ENG-26870) | Fixed an issue where in-flight work in the JST transformation, MOP retry, and Template Builder services could be lost or left incomplete during a Platform restart. These services now complete or safely hand off in-flight work during shutdown. | | Transformations | **Multiple tabs opened on click** (ENG-27029) | Fixed an issue where a transformation opened multiple tabs when you selected it. | | Transformations | **Stop method scroll reset in JST builder** (ENG-4985) | Fixed an issue where the Stop method scroll position reset in the JST builder. | | Transformations | **Reordering user function inputs broke mappings** (ENG-3311) | Fixed an issue where reordering the inputs on a user function could break existing input mappings. | | Work Center | **Assignee dropdown and column** (ENG-28591) | Fixed an issue where the **Assignee** dropdown didn't populate until you typed a filter, and the **Assignee** column could show a raw account ID instead of the user's name. An older account record crashed the account list lookup. The lookup now handles these records. | | Workflows | **Task input values restored from another task** (ENG-29225) | Fixed an issue in the Workflow Editor where switching a task input back to **Job**, **Static**, or **Task** could restore a value from a different task's input with the same name. Platform now remembers previous values for each task and each input. | | Workflows | **Run Service task parameters** (ENG-28541) | Fixed existing workflows with Run Service tasks that were previously modified incorrectly. The queried value is now stored correctly in the task parameters. | | Workflows | **Job variable input validation** (ENG-27668) | Fixed an issue where running a workflow with a task input set to a job variable with an inline query failed input validation when you provided an object or array. The workflow input schema now accepts objects and arrays for these variables. | | Workflows | **.xlsm upload on Windows** (ENG-26434) | Fixed an issue where uploading `.xlsm` files on Windows failed. | | Workflows | **Edit buttons shifted by long names** (ENG-14388) | Fixed an issue where long names pushed the edit buttons down. The edit options now stay on the same line. | | Workflows | **Duplicate x and y coordinates** (ENG-9373) | Fixed an issue where an item stored more than one set of x and y coordinates. Each item now has only one set. | | Workflows | **Child job not run for empty loop array** (ENG-5444) | Platform now displays a clear message when a child job never ran because the loop array was empty. | #### Security fixes (40) This release includes security updates that address vulnerabilities in third-party packages and Platform components. | Component | Feature | Description | | ---------------------------------- | ----------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin Essentials | **Prototype pollution in Integration Model viewer** (ENG-28232) | Fixed a client-side prototype pollution vulnerability (CVE-2026-93753) in the Integration Model viewer. Imported OpenAPI and Swagger documents are now sanitized to remove `__proto__`, `constructor`, and `prototype` keys before rendering. This closes a bypass in the `deepmerge` dependency, which has no upstream fix. | | Core | **ReDoS in brace-expansion** (ENG-28894) | Updated `brace-expansion`, which `minimatch` uses internally for glob pattern matching, to patched versions to resolve a denial-of-service (ReDoS) vulnerability (CVE-2026-102277). | | Core | **axios vulnerability** (ENG-28881) | Updated `axios` to resolve a security vulnerability. | | Core | **CRLF injection in form-data** (ENG-28474) | Updated `form-data` to 4.0.6 to resolve a CRLF injection vulnerability (CVE-2026-12143). The vulnerable code path isn't reachable from Platform first-party code. | | Core | **proxy-addr vulnerability** (ENG-27978) | Overrode the `proxy-addr` dependency to resolve a known vulnerability. | | Core | **moment vulnerability** (ENG-27977) | Updated `moment` to resolve a security vulnerability. | | Core | **Memory leak in compression** (ENG-27932) | Updated `compression` to resolve a memory-leak vulnerability. | | Core | **ReDoS in path-to-regexp** (ENG-27889) | Updated `path-to-regexp`, which Express uses internally, to the latest patched version to resolve a denial-of-service (ReDoS) vulnerability (CVE-2026-4867). | | Core | **undici vulnerability** (ENG-27496) | Updated `undici` to resolve a security vulnerability. | | Core | **fast-uri vulnerability** (ENG-27465) | Updated `fast-uri` to resolve a security vulnerability. | | Core | **@xmldom/xmldom vulnerability** (ENG-27392) | Updated the transitive `@xmldom/xmldom` dependency to resolve a security vulnerability. | | Core | **js-yaml vulnerability** (ENG-27390) | Updated `js-yaml` to resolve a security vulnerability. | | Core | **Unmaintained json-stringify-safe dependency** (ENG-26693) | Replaced the unmaintained `json-stringify-safe` dependency with `safe-stable-stringify` for worker-thread message serialization and JSON Schema sanitization. | | Gateway Manager | **Third-party dependency updates** (ENG-28266, ENG-27909, ENG-27908, ENG-27891, ENG-27890, ENG-27887) | Updated third-party dependencies to resolve security vulnerabilities. | | Gateway Manager | **ws vulnerability** (ENG-27892) | Updated `ws` to resolve security vulnerabilities. | | Gateway Manager | **HTML sanitizer vulnerability in monaco-editor** (ENG-26372) | Updated `monaco-editor`, the code editor bundled with Gateway Manager, to resolve a vulnerability (CVE-2026-65898) in its embedded HTML sanitizer. | | Gateway Manager, Inventory Manager | **Third-party dependency updates** (ENG-29474) | Updated third-party dependencies to resolve security vulnerabilities. | | Inventory Manager | **Third-party dependency updates** (ENG-28264, ENG-27910) | Updated third-party dependencies to resolve security vulnerabilities. | | Legacy Forms | **Unused wicked-good-xpath polyfill** (ENG-26695) | Removed the unused `wicked-good-xpath` polyfill from the Form Builder task path. | | NSO Service Manager | **XSS in DOMPurify (app-service_management)** (ENG-29479) | Resolved a cross-site scripting (XSS) vulnerability by updating `DOMPurify` to a secure version in app-service_management. | | NSO Service Manager | **Double decoding in fast-uri (app-nso_manager)** (ENG-29472) | Resolved a double decoding of the same data vulnerability (CVE-2026-75899) by updating `fast-uri` to a secure version in app-nso_manager. | | NSO Service Manager | **XSS in DOMPurify (app-nso_manager)** (ENG-29463) | Resolved a cross-site scripting (XSS) vulnerability by updating `DOMPurify` to a secure version in app-nso_manager. | | NSO Service Manager | **Uncontrolled recursion in brace-expansion (app-nso_manager)** (ENG-29457) | Resolved an uncontrolled recursion vulnerability (CVE-2026-102276) by updating `brace-expansion` to a secure version in app-nso_manager. | | NSO Service Manager | **Case sensitivity in fast-uri (app-service_management)** (ENG-29227) | Resolved an improper handling of case sensitivity vulnerability (CVE-2026-86472) by updating `fast-uri` to a secure version in app-service_management. | | NSO Service Manager | **Infinite loop in uri-js (app-service_management)** (ENG-29226) | Resolved an infinite loop vulnerability (CVE-2026-93690) by replacing the affected `uri-js` dependency with a drop-in replacement in app-service_management. | | NSO Service Manager | **SSRF in axios (app-nso_manager)** (ENG-29111) | Resolved a server-side request forgery (SSRF) vulnerability (CVE-2026-101898) by updating `axios` to 1.20.0 in app-nso_manager. | | NSO Service Manager | **Infinite loop in uri-js (app-nso_manager)** (ENG-28512) | Resolved an infinite loop vulnerability (CVE-2026-93690) by replacing the affected `uri-js` dependency with a secure replacement in app-nso_manager. | | NSO Service Manager | **Directory traversal in Moment (app-nso_manager)** (ENG-28511) | Resolved a directory traversal vulnerability (CVE-2026-17495) by updating `moment` to a secure version in app-nso_manager. | | NSO Service Manager | **Interpretation conflict in fast-uri (app-service_management)** (ENG-28510) | Resolved an interpretation conflict vulnerability (CVE-2026-84292) by updating `fast-uri` to 3.1.7 in app-service_management. | | Operations Manager | **axios vulnerability** (ENG-29405) | Updated `axios` in Operations Manager 23.2 to resolve a security vulnerability. | | Platform | **Dependency updates** (ENG-28288) | Updated Platform dependencies to resolve security vulnerabilities. | | Studio | **Deprecated lodash.isequal dependency** (ENG-26696) | Replaced the deprecated `lodash.isequal` dependency with `isDeepStrictEqual` from `node:util` on the server and `equals` from `ramda` in browser-bundled code. This internal change doesn't affect user-facing behavior. | | Work Center | **Multiple vulnerabilities in axios** (ENG-28877, ENG-28875, ENG-28873, ENG-28871, ENG-28870) | Updated `axios` to a patched release to resolve multiple high-severity vulnerabilities, including ReDoS, denial of service, improper input validation, and prototype pollution. | | Work Center | **Uncontrolled recursion in brace-expansion** (ENG-28739) | Resolved a high-severity uncontrolled recursion vulnerability (CVE-2026-102276) in the `brace-expansion` dependency used by nestjs-platform by updating the transitive dependency to a patched version. | | Work Center | **Uncontrolled recursion in backend dependency** (ENG-28731) | Resolved a high-severity uncontrolled recursion vulnerability, which could cause denial of service, by updating a third-party dependency of the Work Center backend service to a patched version. | | Work Center | **IP spoofing in proxy-addr** (ENG-27956, ENG-27942) | Resolved a critical vulnerability (CVE-2026-90711) in `proxy-addr`. A crafted `X-Forwarded-For` header could spoof the client IP address and bypass IP-based access control, rate limiting, geolocation, and audit logging. | | Work Center | **multer vulnerability** (ENG-27928) | Resolved a vulnerability in the `multer` package. | | Work Center | **Prototype pollution in joi** (ENG-27843) | Updated `joi` in work-center-service from 18.2.3 to 18.2.9 to resolve a prototype pollution vulnerability (CVE-2026-90771). | | Work Center | **js-yaml vulnerability** (ENG-27416) | Resolved a vulnerability in the `js-yaml` package. | | Work Center | **Nested dependency vulnerability in shared library** (ENG-27405) | Resolved a vulnerability in a nested dependency of a shared library that Work Center and Agent Session Manager use. | #### Sub-tasks (1) | Component | Feature | Description | | ------------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | NSO Service Manager | **Node.js 22 and npm 10 support** (ENG-27541, ENG-27540, ENG-27539) | Updated package metadata in app-service_management, app-nso_manager, and adapter-nso to support Node.js 22 and npm 10. | #### Component versions | Component | Version | | -------------------------------- | ------- | | FlowAI | 1.2.0 | | Gateway Manager | 1.2.4 | | Inventory Manager | 1.2.19 | | NSO Service Manager | 6.6.0 | | Configuration Manager Enterprise | 6.6.0 | ## September 2, 2026 # 6.5.2 Platform 6.5.2 is a maintenance release with security updates, bug fixes, and enhancements across NSO Service Manager, Core, Studio, Transformations, Work Center, Gateway Manager, Projects, Lifecycle Manager, and other Platform components. It addresses customer-reported issues and improves stability, reliability, and security across the platform. #### Enhancements (21) | Component | Feature | Description | | ----------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Core | **Removed NodeJS 22 deprecation warnings** (ENG-10619) | Updated code logic to remove NodeJS deprecation warnings when running on NodeJS 22. | | FlowAI | **JSON Forms API validation endpoint** (ENG-26771) | Added a new `/validate` API to JSON Forms. | | Gateway Manager | **Virtual Clusters added to Gateway Manager** (ENG-26391) | Added Virtual Clusters to Gateway Manager, along with general cleanup and checks. | | Gateway Manager | **More robust connection failure handling** (ENG-26413) | Added more robust messages and handling of connection failures to prevent Gateway Manager from crashing. | | Gateway Manager | **stdout_json output for runService task** (ENG-26740) | The `runService` task output now includes an `stdout_json` property when `stdout` is valid JSON. | | Gateway Manager | **SHA256 checksum files added to build pipeline** (ENG-26755) | Added `.sha256` checksum files to the build. | | Gateway Manager | **Improved virtual cluster gateway deletion** (ENG-27309) | Fixed an issue with deleting gateways associated with a virtual cluster. | | Integrations | **OpenAPI 3.0.4 support for Integrations** (ENG-26971) | Integration Engine now supports importing and executing Integrations built on OpenAPI 3.0.4 models. | | Inventory Manager | **SHA256 checksum files added to build pipeline** (ENG-26755) | Added `.sha256` checksum files to the build. | | Inventory Manager | **Fixed inventory name breadcrumb** (ENG-27214) | Fixed a UI bug that affected how inventory names displayed in the breadcrumb. | | JSON Forms | **JSON Forms API validation endpoint** (ENG-26771) | Added a new `/validate` API to JSON Forms. | | JSON Forms | **Shared header row for array and table fields** (ENG-26139) | JSON Form array and table fields now show a single shared header row, including a select-all checkbox for boolean columns, instead of repeating column labels on every row. | | Lifecycle Manager | **Query nested fields in LCM GET Instance API** (ENG-26782) | You can now query nested fields in `instanceData` and `lastAction` for resource model instances in Lifecycle Manager using `equals`, `starts-with`, and `in`. | | Projects | **Admin break-glass role for Project access** (ENG-12886) | Added a new `projects-admin` API role that lets authorized administrators view, list, and manage any Studio Project, including reassigning membership or deleting it, independent of the project's individual access permissions. | | Work Center | **Job description display in Work Center** (ENG-25842) | Job descriptions are now displayed in Work Center. | | Work Center | **Persistent Work Center column order** (ENG-26095) | Data table column orders in Work Center now persist across page refreshes. | | Work Center | **Interactive HTML task** (ENG-26096) | Added the **Interactive HTML** task, which renders a custom HTML5 document with CSS in Work Center and returns the operator's form input as task output to the calling workflow or agent. The task supports one `
` element and native HTML5 validation. JavaScript is stripped. | | Work Center | **Live work item description in stepper** (ENG-27040) | A work item's parent description now updates correctly when work items are changed through the timeline component. | | Workflow Engine | **Removed NodeJS 22 deprecation warnings** (ENG-10619) | Updated code logic to remove NodeJS deprecation warnings when running on NodeJS 22. | | Workflow Engine | **New workflow validation API for agents** (ENG-26131) | Added a `/workflows/:id/validate` endpoint so agents can validate custom-created workflows before saving. | | Workflow Engine | **Generic asset body field for workflow validation** (ENG-27207) | The `/workflows/validate` endpoint now accepts a generic asset body field alongside standard Workflow Engine roles, matching Orchestration behavior. | #### Bug fixes (27) | Component | Feature | Description | | -------------------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Configuration Manager Enterprise | **Persisted JSON Compliance configuration options** (ENG-24647) | Fixed an issue where the JSON Compliance Configuration Options dialog didn't persist previously saved rule values. | | Configuration Manager Enterprise | **Fixed F5 compliance check for nested specs** (ENG-26429) | Fixed an issue where the F5 config parser failed compliance checks for nested specs with similar header lines. | | Configuration Manager Enterprise | **Fixed F5 parser errors** (ENG-27088) | Fixed an issue with the F5 configuration parser. | | Core | **Fixed truncated webserver log paths** (ENG-18965) | Fixed truncated request paths in webserver access logs so entries include the full URI instead of the path after the mount prefix. | | Core | **Fixed Gateway Manager crashes during Redis rolling restarts** (ENG-24761) | Fixed a crash in Gateway Manager and other services during Redis/ElastiCache rolling restarts and failovers. Newly promoted primaries can briefly reject writes with READONLY; IAP now retries those commands within a time budget and rebuilds affected BullMQ workers instead of exiting the process. | | Core | **Fixed crash from circular references in logs** (ENG-25477) | Fixed an issue where logging an object with a circular reference caused an uncaught TypeError and terminated the process. Circular references now render as `[Circular ~...]` in log output instead of crashing. | | Core | **Fixed Redis Sentinel failover handling** (ENG-26554) | Fixed an issue where Redis Sentinel failovers could fail IAP health checks on LOADING or crash the FlowAI Tool Executor on READONLY. Both conditions are now treated as transient. | | FlowAI | **Fixed primitive tool result handling in Agent Engine** (ENG-26225) | Fixed an issue where Claim Check stored primitive tool results (numbers, booleans, and null) as inline document references instead of in the collection, causing Agent Engine to reject them. Claim Check now stores these results in the collection. | | Integrations | **Fixed inconsistent OAuth for gateway-routed Integrations** (ENG-26724) | Fixed an issue where Gateway-executed Integrations used an OAuth process inconsistent with directly-executed Integrations. | | Lifecycle Manager | **Fixed LCM Model Schema comment handling** (ENG-3705) | Removed the comment icon from Lifecycle Manager JSON editors and enforced treating `//` as invalid JSON, so schemas no longer lose commented lines. | | Lifecycle Manager | **Fixed inconsistent Save button validity on New Instance form** (ENG-26336) | Fixed an issue where Save button validity was inconsistent between JSON View and Form View on the New Instance form. | | Operations Manager | **Fixed ViewHTML task rendering when started by an agent** (ENG-25295) | Fixed an issue where the ViewHTML task rendered incorrectly in Work Center when started by an agent. | | Projects | **Prevented accidental project closure** (ENG-4696) | Fixed an issue where clicking a project's name closed the project. The project name is now static, non-interactive text. | | Projects | **Fixed layout issues in the delete project dialog** (ENG-5657) | Fixed styling issues that occurred when entering the wrong name while deleting a project. | | Projects | **Fixed sidebar highlighting for the current asset** (ENG-5659) | Fixed an issue where the Projects sidebar in Automation Studio didn't reliably highlight the currently open asset, including when opening or creating a project or adding a new asset. | | Projects | **Fixed overflowing branch names in the Manage Branch dialog** (ENG-5661) | Fixed an issue where long branch names overflowed the Manage Branch dialog's dropdown instead of truncating with an ellipsis. | | Projects | **Improved duplicate asset error messages** (ENG-6467) | Duplicate asset error messages in Projects now show only the human-readable reason instead of a raw JSON error. | | Projects | **Fixed project list order after deleting a project** (ENG-25464) | Fixed an issue where the project list's sort order swapped after a project was deleted. | | Projects | **Added pagination to the Studio Project list** (ENG-26589) | Fixed an issue where the Studio Project list view showed only 20 projects with no pagination. The Projects list table view now includes pagination. | | Studio | **Closed editor tab on workflow deletion** (ENG-24679) | Fixed an issue where deleting a workflow from the collection view left its editor tab open. Deleting a workflow now closes its open editor tab, if one is open. | | Studio | **Fixed stale field values on Cmd/Ctrl+S save** (ENG-25708) | Fixed an issue where pressing Cmd/Ctrl+S to save a workflow while still editing a task field's value discarded the edit and saved the field's previous value instead. In-progress task field edits are now committed before the save shortcut runs. | | Studio | **Fixed incorrect branch execution in JST if/else and switch/case blocks** (ENG-26655) | Fixed an issue where a transformation with an if/elseIf/else or switch/case block could run the wrong branch when more than one condition or case evaluated true. The transformation now consistently runs the first matching branch. | | Studio | **Fixed overlapping tab labels in the Add Existing Asset dialog** (ENG-26723) | Fixed an issue where tab labels in the Add Existing Asset dialog within Studio Projects could overlap and become hard to read for Command Templates and Analytic Templates. | | Transformations | **Fixed flickering JST Designer tab titles** (ENG-26142) | Fixed an issue where the JST Designer tab title could flicker indefinitely when two open JSTs had colliding disambiguated names, such as "jst (1)" and "jst (1) (1)". | | Transformations | **Fixed silent failures connecting JST if/else branches** (ENG-26519) | Fixed an issue in the JST canvas where connecting certain branches of an if...else node could silently fail with no error shown, including when multiple else clauses needed to be connected. | | Workflow Engine | **Fixed Evaluation task Enable Query display** (ENG-3597) | Fixed an issue where the Evaluation task's Enable Query checkbox incorrectly displayed for a static operand whose value was set to null. | | Workflow Engine | **Fixed duplicate task path dispatch** (ENG-23213) | Fixed an issue where a task with both success and error transitions could dispatch both paths from a single task finish if a transient failure occurred while writing the task's outgoing data. | #### Security fixes (31) This release includes security updates that address vulnerabilities in third-party packages and platform components. | Component | Feature | Description | | ------------------- | ------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Agent Sessions | **Resource allocation security update** (ENG-26465) | Resolved an Allocation of Resources Without Limits or Throttling vulnerability with security updates. | | Core | **Resolved double decoding vulnerability in fast-uri** (ENG-27124) | Resolved a Double Decoding of the Same Data vulnerability (CVE-2026-75899) by updating the `fast-uri` package. | | Core | **Resolved prototype pollution vulnerability in browserslist** (ENG-26858) | Resolved a Prototype Pollution vulnerability (CVE-2026-73088) by updating the `browserslist` package. | | Core | **Resolved log forging vulnerability in morgan** (ENG-26690) | Updated the `morgan` package from 1.10.1 to 1.11.0 to resolve a log forging vulnerability (CVE-2026-5078) involving the `:remote-user` field. | | Core | **Resolved vulnerable installations in diff** (ENG-26689) | Updated the `diff` package to resolve a vulnerability (CVE-2026-24001) affecting three separate resolution paths. | | Core | **Resolved inefficient algorithmic complexity in js-yaml** (ENG-26623) | Resolved an Inefficient Algorithmic Complexity vulnerability by updating the `js-yaml` package. | | Core | **Resolved SSRF vulnerability in ip-address** (ENG-26529) | Resolved a Server-Side Request Forgery (SSRF) vulnerability by updating the `ip-address` package. | | Core | **Resolved infinite loop vulnerability in nanoid** (ENG-26407) | Resolved an Infinite Loop vulnerability by updating the `nanoid` package. | | Core | **Resolved interpretation conflict vulnerability in fast-uri** (ENG-26406) | Resolved an Interpretation Conflict vulnerability (CVE-2026-18446) by updating the `fast-uri` package. | | Core | **Resolved improper neutralization vulnerability in undici** (ENG-26366) | Resolved an Improper Neutralization vulnerability by updating the `undici` package. | | Core | **Resolved directory traversal vulnerability in postcss** (ENG-26174) | Upgraded the `postcss` dependency to resolve a Directory Traversal vulnerability. | | Core | **Resolved resource allocation vulnerability in brace-expansion** (ENG-26171) | Updated the `brace-expansion` package version to resolve an Allocation of Resources Without Limits or Throttling vulnerability. | | Core | **Resolved resource allocation vulnerability in axios** (ENG-26074) | Resolved an Allocation of Resources Without Limits or Throttling vulnerability by updating the `axios` package. | | Core | **Resolved resource allocation vulnerability in body-parser** (ENG-25761) | Resolved an Allocation of Resources Without Limits or Throttling vulnerability by updating the `body-parser` package. | | Core | **Resolved improper initialization vulnerability in dompurify** (ENG-24986) | Resolved an Improper Initialization vulnerability by updating the `dompurify` package. | | Inventory Manager | **Security cleanup for fast-uri and brace-expansion** (ENG-26960) | Resolved security vulnerabilities in the Inventory Adapter by updating the `fast-uri` and `brace-expansion` packages. | | Inventory Manager | **Security cleanup for nanoid, brace-expansion, and fast-uri** (ENG-26959) | Resolved security vulnerabilities in Inventory Manager by updating the `nanoid`, `brace-expansion`, and `fast-uri` packages. | | itential-utils | **Resolved resource allocation vulnerability in brace-expansion** (ENG-26171) | Updated the `brace-expansion` package version to resolve an Allocation of Resources Without Limits or Throttling vulnerability. | | Job Viewer | **Job Viewer security updates** (ENG-27243) | Resolved an Uncaught Exception vulnerability with security-related package updates. | | NSO Service Manager | **Resolved disallowed inputs vulnerability in dompurify (app-service_management)** (ENG-26641) | Resolved an Incomplete List of Disallowed Inputs vulnerability (CVE-2026-66010) by updating the `dompurify` package in `app-service_management`. | | NSO Service Manager | **Resolved interpretation conflict vulnerability in nanoid (app-service_management)** (ENG-26640) | Resolved an Interpretation Conflict vulnerability (CVE-2026-67213) by updating the `nanoid` package in `app-service_management`. | | NSO Service Manager | **Resolved interpretation conflict vulnerability in fast-uri (adapter-nso)** (ENG-26637) | Resolved an Interpretation Conflict vulnerability (CVE-2026-18446) by updating the `fast-uri` package in `adapter-nso`. | | NSO Service Manager | **Resolved resource allocation vulnerability in brace-expansion (adapter-nso)** (ENG-26636) | Resolved an Allocation of Resources Without Limits or Throttling vulnerability (CVE-2026-69152) by updating the `brace-expansion` package in `adapter-nso`. | | NSO Service Manager | **Resolved prototype pollution vulnerability in axios (adapter-nso)** (ENG-26635) | Resolved a Prototype Pollution vulnerability (CVE-2026-67320) by updating the `axios` package in `adapter-nso`. | | NSO Service Manager | **Resolved interpretation conflict vulnerability in nanoid (app-nso_manager)** (ENG-26634) | Resolved an Interpretation Conflict vulnerability (CVE-2026-67213) by updating the `nanoid` package in `app-nso_manager`. | | NSO Service Manager | **Resolved interpretation conflict vulnerability in fast-uri (app-nso_manager)** (ENG-26633) | Resolved an Interpretation Conflict vulnerability (CVE-2026-18446) by updating the `fast-uri` package in `app-nso_manager`. | | NSO Service Manager | **Resolved resource allocation vulnerability in brace-expansion (app-nso_manager)** (ENG-26632) | Resolved an Allocation of Resources Without Limits or Throttling vulnerability (CVE-2026-69152) by updating the `brace-expansion` package in `app-nso_manager`. | | NSO Service Manager | **Resolved prototype pollution vulnerability in axios (app-nso_manager)** (ENG-26631) | Resolved a Prototype Pollution vulnerability (CVE-2026-67320) by updating the `axios` package in `app-nso_manager`. | | Work Center | **Resolved algorithmic complexity vulnerabilities in Work Center** (ENG-26625) | Resolved Inefficient Algorithmic Complexity vulnerabilities with package updates. | | Work Center | **Resource allocation security update** (ENG-26465) | Resolved an Allocation of Resources Without Limits or Throttling vulnerability with security updates. | | Work Center | **Work Center security updates** (ENG-27243) | Resolved an Uncaught Exception vulnerability with security-related package updates. | #### Component versions | Component | Version | | -------------------------------- | ------- | | Configuration Manager Enterprise | 6.5.2 | | FlowAI | 1.1.0 | | Gateway Manager | 1.2.3 | | Inventory Manager | 1.2.15 | | NSO Service Manager | 6.5.2 | ## August 5, 2026 # 6.5.1 Platform 6.5.1 is a maintenance release with security updates, bug fixes, and enhancements across FlowAI (Agent Projects, Agent Sessions, Model Registry), Work Center, Studio, Configuration Manager, NSO Service Manager, and Platform infrastructure. It addresses customer-reported issues and improves stability, reliability, and security across the platform. #### Enhancements (23) | Component | Feature | Description | | ----------------------------------- | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Admin Essentials | **Updated Gateway terminology** (ENG-25258) | Updated the Gateway configuration page in Admin Essentials to use current product naming (`Itential Gateway`/`Gateway 5`) instead of `IAG`/`IAG5`. | | Agent Projects | **Stay in Agent Editor after save** (ENG-25870) | When creating a new agent, clicking **Save Agent** or **Save and Run Agent** now keeps you in Agent Editor instead of navigating to the read-only Agent Details view, matching the existing behavior when editing an agent. | | Agent Projects | **Updated Agent Details field styling** (ENG-25901) | Updated the read-only agent details view's field styling to align with the latest design, including removing lock icons and adding a tooltip explaining that changes must be made when editing an agent. | | Agent Projects | **Delete agent from Agent Editor** (ENG-25992) | You can now delete an agent directly from the agent editor, not just from the details page. | | Agent Sessions | **Left-aligned instructions link** (ENG-24952) | The link back to the top of the agent session is now left-aligned with the surrounding content. | | Agent Sessions | **Optional session token count column** (ENG-25050) | Added an optional `Total Output Token` column to the Agent Sessions table, with sorting and filtering support. | | Agent Sessions | **Custom task summary for agent-created tasks** (ENG-25051) | Agent sessions can now set a manual task's task summary, similar to existing workflow behavior, so operators see meaningful context in Work Center instead of a generic task name. | | Agent Sessions | **Smooth animation for tools/reasoning panels** (ENG-25289) | The collapse and expand transition for tools and reasoning in Agent Sessions now animates smoothly with ease-in and ease-out instead of jumping. | | Agent Sessions | **Standardized tool call and reasoning timers** (ENG-25290) | Standardized the time tracker position for tool calls and reasoning in Agent Sessions, and the timer now updates live while a tool call or reasoning step is running. | | Agent Sessions | **Anchored scroll for expanded conclusions** (ENG-25471) | Opening a completed agent session now anchors the expanded view to the top of the agent conclusion instead of opening at the bottom of a long session. | | Agent Sessions | **Faster agent session list performance** (ENG-26330) | Improved Agent Sessions list query performance with index fixes for the default view and the `trigger.source` filter, reducing multi-second load times without changing which sessions are visible. | | Configuration Manager Enterprise | **Draft mode for compliance plans** (ENG-20223) | You can now save a compliance plan as a draft and return to it later. A plan saved as a draft cannot be run until it is finalized. | | Core | **SHA checksum files for release packages** (ENG-16404) | `.sha256` checksum files are now published for the `itential-platform`, `itential-configuration_manager`, and `itential-lifecycle_manager` RPM packages, so you can verify that a downloaded package matches what we published and hasn't been altered or corrupted in transit. | | FlowAI | **OpenInference tracing endpoint** (ENG-24313) | Added an OpenInference endpoint to the FlowAI for execution tracing. | | FlowAI | **Removed Tool deny list** (ENG-25955) | Removed deny list, which previously prevented certain methods from being used as Tools. | | FlowAI | **FlowAI returns created asset ID** (ENG-26008) | FlowAI responses for asynchronous tool executions now include an `artifactId`, the ID of the created asset instance (for example, a work item, job, or session), so the execution engine can link directly to that asset. | | Gateway Manager | **Mosaic design system UI update** (ENG-21262) | Updated Gateway Manager to use Primereact Mosaic components, including the status indicator and tables. | | Gateway Manager, Inventory Manager | **Mosaic left navigation** (ENG-21962) | Inventory Manager and Gateway Manager now use the Mosaic left navigation, so these apps are no longer affected by conflicting styles across pages. | | NSO Service Manager | **Trace-id support for NSO transactions** (ENG-23913) | The NSO adapter now supports trace IDs across JSON-RPC, RESTCONF, and NETCONF request formats, improving end-to-end traceability and troubleshooting between Platform adapter calls and the corresponding NSO transaction. | | Operations Manager, Workflow Engine | **One-click session link from Run Agent task** (ENG-24778) | Added a link from the Run Agent task on canvas that opens the agent session directly in a new tab, following the same pattern as the Child Job task. | | Workflow Engine | **Task worker thread count** (ENG-23342) | You can now configure task worker thread count to control the number of background worker threads available for task processing. For more information, see [Task worker thread count](/itential-platform/studio/optimize-workflow-engine-performance/configure-rate-limiting#task-worker-thread-count) | | Work Center | **Removed standalone mode** (ENG-24850) | Removed Work Center's standalone mode. Work Center now requires integration with other Platform services. | | Work Center | **Collapsed view by default** (ENG-25742) | Work Center now defaults to a collapsed view. Details expand only when you explicitly select them. | #### Bug fixes (78) | Component | Feature | Description | | ------------------------------------------------- | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin Essentials | **403 toasts when deleting adapters on Essentials/Compliance** (ENG-25279) | Fixed an issue where deleting an adapter or integration in Admin Essentials on Essentials or Compliance tiers triggered authorization-error toasts from dependency checks in Studio and JSON Forms, even though the delete succeeded. A generic dependency warning is now shown instead. | | Agent Projects | **End Time column sort fixed** (ENG-25835) | Fixed an issue where sorting the Agent Sessions table by the `End Time` column silently sorted by `Started At` instead. Sorting by `End Time` now correctly requests `endedAt`. | | Agent Projects | **Client-side pagination for agent lists** (ENG-24653) | Added a paginated table footer to the agent list in Agent Projects instead of rendering all agents at once. | | Agent Projects | **Persistent project association labels** (ENG-24820) | Fixed an issue where an asset's project association label (for example, `Admin Workflow (from Test Admin Permission Project)`) was dropped after a page refresh. Assets that belong to a project now consistently show their project association. | | Agent Projects | **Consistent error message styling** (ENG-25015) | Fixed inconsistent styling between permission and not-found error messages in Agent Projects. | | Agent Projects | **Permission tooltips on disabled project settings** (ENG-25030) | Updated the no-permission tooltips and disabled styling for Permissions controls (checkboxes, role radio buttons, and remove/trash icons) in Agent Project Settings, so each disabled control appears dimmed and shows a tooltip explaining why it's disabled. | | Agent Projects | **Accessibility focus borders on input fields** (ENG-25093) | Focus state styling is now applied consistently across input fields in the Agent Projects UI, including Job Viewer and Insights. | | Agent Projects | **Tooltip position near screen edge** (ENG-25116) | Fixed an issue where permission tooltips in Agent Project Settings rendered off-center when a control was too close to the edge of the screen for the tooltip to center correctly. | | Agent Projects | **Decorator dialog title update** (ENG-25436) | Updated the Create Decorator dialog title from "Create a Decorator" to "Create Decorator." | | Agent Projects | **Page jump when editing long prompts** (ENG-25437) | Fixed an issue where clicking and typing near the end of a long agent prompt caused the page to scroll, landing content behind the sticky header. The Agent Editor prompt field now uses a fixed height with a scrollbar for overflow text. | | Agent Projects | **Consistent agent list action tooltips** (ENG-25440) | Fixed inconsistent tooltip styling between the delete agent and clone agent buttons in the agent list Actions column. | | Agent Projects | **Removed non-functional search parameter** (ENG-25585) | Removed the non-functional `Search` query parameter from the list FlowAI projects API. | | Agent Projects | **Persistent save confirmation toast** (ENG-25633) | The "Agent saved." toast shown after clicking **Save and Run Agent** now persists until manually dismissed instead of auto-dismissing after a few seconds. | | Agent Projects | **Fixed-height, non-resizable prompt field** (ENG-25720) | The agent prompt text field is no longer manually resizable. It now uses a fixed height of 24 rows with a scrollbar for overflow text, reducing screen overload. | | Agent Projects | **Remove unauthorized tools from an agent** (ENG-25749) | Fixed an issue where an unauthorized tool referenced by an imported or copied agent couldn't be removed from the Agent Definition in the UI. Removing an unauthorized tool is now tracked locally and persisted correctly when the agent is saved. | | Agent Sessions | **Filter bar shift on expand/collapse** (ENG-25288) | Fixed an issue where the filters in the top right of Agent Sessions shifted position when expanding or collapsing the page. | | Agent Sessions | **Fixed Checkbox and Actions columns** (ENG-25355) | Fixed an issue where the fixed `Checkbox` and `Actions` columns in the Agent Sessions table could be indirectly reordered by moving other columns around them. | | Agent Sessions | **"Today" button in Range date filter** (ENG-25433) | Fixed an issue where clicking **Today** in the End Time Range filter always set the start date, producing an empty date range. The button now correctly sets the range to 12 AM through 11:59 PM of the current day. | | Agent Sessions | **Range filter overflow for End Time** (ENG-25731) | Fixed an issue where selecting the Range filter for End Time opened past the visible page, requiring horizontal scrolling to see the cut-off filter. | | Claim Check Interface | **ClaimCheck GridFS fallback** (ENG-26106) | Fixed an issue where `ClaimCheck.store()` did not fall through to the GridFS streaming path for large payloads when MongoDB returned an `offset is out of bounds` size error, causing an unnecessary failure instead. | | Configuration Manager | **Config Manager crash from bad Agent tool call** (ENG-25486) | Fixed an issue where an invalid Agent tool call could crash Configuration Manager. | | Core | **Adapter import via Swagger UI/API** (ENG-16929) | Fixed an issue where importing an adapter through the `/adapters/import` API, as opposed to the UI, failed because the request properties were not parsed correctly. | | Core | **WebServer input session token leak** (ENG-24070) | Fixed an issue where IAP's WebServer could return the session token in place of a missing input value when an input's schema did not define `schema.properties`. | | Core | **SNMP traps for service stop and crash** (ENG-24868) | Fixed an issue where the `itenProngAppDown` and `itenProngAppCrash` SNMP traps were not sent when the platform stopped gracefully or crashed, under certain conditions. | | FlowAI | **Automatic retry for invalid tool inputs** (ENG-26007) | Fixed an intermittent issue where invalid tool inputs caused some FlowAI tool calls, including `ViewData`, to fail. Inference is now automatically retried up to 3 times after invalid tool inputs. | | FlowAI | **Search and filter for tools in a project** (ENG-25299) | Added the ability to find tools that live inside a studio or agent project through search and type filtering, instead of only being discoverable by expanding their parent project. | | FlowAI | **"Tools can't be reached" for existing IAG5 services** (ENG-25826) | Fixed an issue where Gateway Service tool reference IDs weren't stable, causing broken tool references and a "One or more tools can't be reached" warning for existing IAG5 services even when the agent showed a "Ready to Launch" status. | | FlowAI | **Null description guard for tool transformers** (ENG-25302) | Fixed an issue where tools with no description (transformations, compliance plans, agents, analytic templates, command templates, and JSON forms) stored a `null` description, which caused a 400 error from the Anthropic API and prevented sessions from starting when an agent tried to use the tool. | | Gateway Manager | **Blank GUI in Run Service task** (ENG-26217) | Fixed an issue where selecting certain services within the Run Service task in Studio caused the browser to go blank. | | Gateway Manager, Integrations | **Dynamic API-key retrieval for gateway-routed integrations** (ENG-25488) | Fixed an issue where an Integration using an API key security scheme with dynamic retrieval (`x-itential-dynamic-retrieval`) did not retrieve or refresh the token when the request was routed through a gateway, causing the target to reject the request. | | Golden Configuration | **JSON Compliance Check from Golden Configuration tree** (ENG-25673) | Fixed an issue where running a JSON Compliance check from the Golden Configuration tree reported success but failed to generate the compliance report. | | Integrations | **Authorization roles for imported Integration Models** (ENG-25174) | Fixed an issue where importing an OpenAPI-based Integration Model containing circular schema references in request bodies could silently fail to complete its setup, which prevented the corresponding Authorization role entries from being created. | | itential-utils | **CyberArk CCP secret retrieval timeout** (ENG-24156) | Fixed an issue where incorrectly configured timeouts caused failures when retrieving secrets from CyberArk CCP. | | JSON Forms | **Invalid JSON Form creation via API** (ENG-18045) | Added server-side validation to `POST /json-forms/forms` to prevent creating a JSON Form missing the required `items` property, which previously left the form in an unrecoverable, uneditable state. | | JSON Forms | **JSON form manual task payload timing** (ENG-21716) | Fixed a timing issue where a JSON form manual task could render with stale payload data when a job variable used in the form was updated shortly before the form was displayed. | | JSON Forms | **JSON form stale data across executions** (ENG-26052) | Fixed a bug in the Form Preview dialog where a JSON form with overlapping schema combinations could show stale data, including a previously selected combination option and previously entered data, from an earlier execution when the view was toggled between the form and its submitted data. | | JSON Forms, Platform | **Array table validation after row deletion** (ENG-24301) | Fixed an issue where a JSON Form array/table field retained a validation error after deleting a row with an unresolved dynamic dropdown value, which left the form unsubmittable even though the remaining data was valid. | | JSON Forms, Templates, Transformations, Workflows | **Clone dialog not closing** (ENG-24942) | Fixed an issue where the clone dialog did not close after cloning an asset from the Studio collection view. The collection view now also updates to show the newly cloned document. | | Model Registry | **Column selector icon corrected** (ENG-25123) | Corrected the icon used for the column selector button in the Model Registry profiles table so it matches the Agent Sessions table. | | Model Registry | **Profile form autofill and cursor fixes** (ENG-25125) | Prevented browser autocomplete from filling the `Name` and `API Key` fields in the Create Profile and Edit Profile dialogs, and fixed the `API Key` field showing a pointer cursor instead of a text cursor on hover. | | Model Registry | **Clearer error for invalid model variables** (ENG-25131) | Fixed an issue where saving non-object JSON in the Model Variables field showed an opaque "Failed to update profile" error with no indication that the value must be an object. | | Model Registry | **Affected Agents list sort order** (ENG-25157) | Added a default alphabetical sort order to the Affected Agents list for a model profile in Model Registry. | | Model Registry | **Updated search placeholder text** (ENG-25184) | Updated the search bar placeholder text on the Model Registry list view. | | NSO Service Manager | **NSO adapter nonexistent device cache** (ENG-25784) | Added an `enableNonExistentDeviceCache` configuration option to control the NSO adapter's negative device cache, improving device lookup reliability. This option is enabled by default. | | Operations Manager | **ForEach iteration navigation while job running** (ENG-25145) | Fixed an issue where the job details table could not navigate to a selected forEach iteration's task details while the job was still running. | | Operations Manager | **Quick Form rendering in Operations Manager** (ENG-25409) | Operations Manager now links to Work Center to complete a Quick Form manual task instead of rendering a blank page. | | Operations Manager, Workflow Engine | **View Diff task scroll sync** (ENG-8051) | Fixed a regression in the View Diff task where the two comparison panes scrolled independently instead of staying locked together, making review more difficult. | | Projects | **Component add mode option clarification** (ENG-8275) | Updated the documentation for the `POST /automation-studio/projects/{projectId}/components/add` endpoint to clarify the supported values and behavior of the `mode` option. | | Projects | **Transformations tab visibility in Project Builder** (ENG-9709) | Added a visual indicator for tab overflow in Project Builder, so it's clear when additional tabs, such as Transformations, are available but not currently visible on smaller screens. | | Projects, Transformations | **Horizontal scrollbar in Transformation functions** (ENG-22777) | Fixed an issue where the horizontal scrollbar did not appear within a Transformation function's canvas when the Transformation was created inside a Project. | | Studio | **Search bar Enter key behavior** (ENG-21750) | Fixed an issue where pressing Enter in a left-navigation search box across Platform apps could open an empty suggestions overlay. | | Studio | **Deep Merge false value rendering** (ENG-23288) | Fixed inconsistent rendering of blank, `null`, and empty object values in the Deep Merge task editor. | | Studio | **Hardcoded docs.itential.io links** (ENG-24891) | Removed hardcoded links to `docs.itential.io` and replaced them with `docs.itential.com`. | | Studio | **RBAC on task copy/paste** (ENG-25423) | Fixed an issue where users could copy or paste workflow tasks they didn't have RBAC permission to use via copy, copy selection, or Ctrl+C. Users can no longer copy tasks they lack access to at design time. | | Studio | **Debug menu overlay in new workflows** (ENG-25684) | Fixed an issue in Studio where the debug mode overlay could persist and appear on a newly created or opened workflow. | | Studio | **Workflow undo history exhaustion** (ENG-25746) | Fixed an issue where pressing Cmd+Z after exhausting the current session's undo history could remove existing task connections or reposition tasks unexpectedly, including after a page reload. | | Studio | **Concat task object variable support** (ENG-25893) | The task input type label in Studio now reflects the actual accepted schema type instead of always showing `Any`, preventing job variables of incompatible types, such as Object, from being bound to inputs that don't support them. | | Studio | **Studio crash on malformed workflow** (ENG-25966) | Fixed an issue where opening a workflow with invalid or missing task position data crashed Studio with an `Invalid arguments to Point constructor` error. | | Studio | **Stale Run Service task parameters** (ENG-26030) | Fixed an issue where changing a Gateway Manager service's decorator schema left stale, orphaned parameter keys in a saved `runService` task, which could cause execution to fail when the new decorator disallowed additional properties. | | Templates | **Duplicate requests from Edit dialog** (ENG-24363) | The Edit Details dialog's Save and Cancel buttons are now disabled while a save is in progress, preventing duplicate update requests on Analytic and Command Templates during slow-network saves. | | Transformations | **Date-time modification in Transformation** (ENG-6892) | Fixed an issue where modifying a date-time string in a Transformation, for example using `setUTCMinutes`, did not update the value as expected. | | Transformations | **JST if/else statement limit** (ENG-8449) | Fixed an issue where a JST could not correctly connect a context to more than 10 `if`/`else` conditions. | | Transformations | **Ternary operator space input** (ENG-9375) | Fixed an issue where entering a single space in the ternary operator's `exprIfTrue` or `exprIfFalse` input converted the value to `0` instead of preserving the space. | | Transformations | **Migration script for missing function names** (ENG-9944) | Fixed a regression where importing a Transformation containing a function with a missing `name` property no longer auto-generated the missing name, which caused callback dropdowns to display as `undefined`. | | Transformations | **Broken help link on query object** (ENG-12360) | Fixed a broken documentation link on the Query task's info button in JST Designer. | | Transformations | **Missing \$id validation in JST Designer** (ENG-12870) | Fixed an issue where JST Designer's warning for a missing `$id` did not display correctly, and moved the error message inside the editor to be consistent with other error messages. | | Transformations | **JST function schema type mismatch** (ENG-17988) | Fixed an issue where changing the incoming or outgoing schema of a user function dragged onto a JST canvas did not update or validate existing assignments. Changing a function's parameter type now disconnects any existing assignment and displays an error about the mismatched types. | | Work Center | **Quick Form Complete Task button state** (ENG-25291) | Fixed an issue where the Complete Task button in a Quick Form did not enable or disable immediately as required text fields were filled in or cleared. | | Work Center | **QuickForm with empty parameters** (ENG-26149) | Fixed an issue where launching a QuickForm with no rows to review left the task stuck with no visible content or Complete button. Operators can now complete these tasks normally, and when a task's configuration hides all data columns but rows are still present, the task now displays the action column with a warning message instead of an empty table. | | Work Center | **Overlapping filter dropdowns** (ENG-25849) | Fixed an issue where filter dropdowns in Job Viewer, Work Center, Insights, and Session Manager could remain open and overlap when opened sequentially. | | Work Center | **Work Center service boot failure** (ENG-26021) | Fixed an issue where Work Center Service could fail to start due to an unhandled exception from the provider `PLATFORM_PRONGHORN`, which has now been removed. | | Workflow Engine | **Deeper workflow validation** (ENG-24167) | Workflow validation now catches broken task references left over after a task is deleted, putting the workflow in draft status instead of allowing it to run with missing or incorrect data. | | Workflow Engine | **Manual task status after job completion** (ENG-25152) | Fixed an issue where a reverted job's canvas and task list could continue to display a manual task as running after the job had completed. | | Workflow Engine | **Duplicate taskErrored events** (ENG-25701) | Fixed two issues with the Workflow Engine's `taskErrored` and `taskStarted` system events: a task failure could publish a duplicate `taskErrored` event, and a non-scheduled task that failed due to a failed inline-query decorator never published its corresponding `taskStarted` event. | | Workflows | **Valid workflows not opening after mixed import** (ENG-24310) | Fixed an issue where importing multiple workflows at once, when one or more failed validation, prevented the successfully imported workflows from opening in the editor. | | Workflows | **Task palette unauthorized requests in cloud** (ENG-25351) | Fixed an issue where hovering over a task in the Studio task palette or Swap Task panel triggered an unauthenticated documentation lookup, which returned 403 errors in RBAC-restricted and cloud environments. | | Workflows | **Adapter Model job variable error** (ENG-25528) | Fixed an issue where setting an adapter task's Adapter Model to a job variable and saving the workflow produced a `Cannot find match for input: "Adapter Id"` error. | | Workflows | **Run Service task toggle caching** (ENG-25646) | Fixed an issue where the `runService` task's `Use as Variable` toggle for Gateway Cluster ID and Service reflected the state of another workflow's `runService` task when tasks shared the same task ID, for example after export/import. | #### Security fixes (35) This release includes security updates that address vulnerabilities in third-party packages and platform components. | Component | Feature | Description | | ---------------------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Agent Sessions | **Inefficient algorithmic complexity in js-yaml (Agent Sessions)** (ENG-25748) | Updated the `nestjs-platform` dependency in Agent Sessions to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59869) in `js-yaml`'s YAML merge-key handling. | | Agent Sessions | **Directory traversal in fast-uri** (ENG-25634) | Updated the `fast-uri` dependency in Agent Sessions to resolve a directory traversal vulnerability. | | Agent Sessions | **Resource allocation limit in body-parser** (ENG-25747) | Updated the `body-parser` dependency (via `express`) in Agent Sessions to resolve a vulnerability (CVE-2026-12590) that allowed unbounded request body sizes when the configured `limit` option failed to parse. | | Agent Sessions | **CRLF injection in form-data** (ENG-25798) | Updated the `form-data` dependency in Agent Sessions to resolve a CRLF injection vulnerability. | | Agent Sessions | **Interpretation conflict in fast-uri (update)** (ENG-26022) | Updated the `fast-uri` dependency in Agent Sessions to resolve an additional interpretation conflict vulnerability (CVE-2026-16221) involving backslash handling in hostnames. | | Core | **Cross-site scripting in Core** (ENG-2631) | Resolved a cross-site scripting (XSS) vulnerability in Core by improving the security of authentication failure responses so they can't be rendered as HTML by the browser. | | Core | **Interpretation conflict in fast-uri (Core)** (ENG-25399) | Updated the `fast-uri` dependency in Core to resolve an interpretation conflict vulnerability (CVE-2026-13676) that could allow host-based security policies to be bypassed via internationalized hostnames. | | Core | **Inefficient algorithmic complexity in brace-expansion (Core)** (ENG-25462) | Updated the `brace-expansion` dependency in Core to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149) that could cause excessive CPU consumption via crafted input. | | Core | **Inefficient algorithmic complexity in immutable (Core)** (ENG-25762) | Updated the `immutable` dependency in Core to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59880) in `Immutable.Map` and `Immutable.Set` hash collision handling. | | Core | **Inefficient algorithmic complexity in js-yaml (Core)** (ENG-25764) | Updated the `js-yaml` dependency in Core to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59869) in YAML merge-key handling. | | Core | **Allocation of resources without limits in ws (Core)** (ENG-25971) | Updated the `ws` dependency in Core to resolve an allocation-of-resources-without-limits vulnerability (CVE-2026-62389) that could cause memory exhaustion via incomplete fragmented WebSocket messages. | | Core | **Interpretation conflict in fast-uri (Core, backslash handling)** (ENG-26031) | Updated the `fast-uri` dependency in Core to resolve an interpretation conflict vulnerability (CVE-2026-16221) that could allow host-based validation to be bypassed via a URI containing a literal backslash. | | FlowAI | **Interpretation conflict in fast-uri** (ENG-25650) | Updated the `fast-uri` dependency in FlowAI to resolve a hostname interpretation conflict vulnerability that could allow host-based security checks to be bypassed. | | FlowAI, Model Registry | **Encrypted profile credential storage** (ENG-25554) | Resolved a security issue where FlowAI agent profile credentials (`clientSecret` and `apiKey`, including BYOL credentials passed through the gateway) were stored in MongoDB in clear text instead of encrypted. | | Inventory Manager | **Inventory Manager security cleanup** (ENG-26064) | Resolved medium-severity security vulnerabilities in Inventory Manager. | | Inventory Manager | **Inventory Adapter security cleanup** (ENG-26065) | Resolved medium-severity security vulnerabilities in the Inventory Manager adapter. | | itential-utils | **Inefficient algorithmic complexity in brace-expansion (itential-utils)** (ENG-25647) | Updated the `minimatch` and `brace-expansion` transitive dependencies under `javascript-obfuscator` in itential-utils to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149). | | itential-utils | **Interpretation conflict in fast-uri (itential-utils)** (ENG-25648) | Updated the `fast-uri` dependency in itential-utils to resolve an interpretation conflict vulnerability (CVE-2026-13676). | | NSO Service Manager | **Inefficient algorithmic complexity in brace-expansion (Service Management)** (ENG-25607) | Updated the `brace-expansion` dependency in Service Management (`app-service_management`) to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149). | | NSO Service Manager | **Interpretation conflict in fast-uri (Service Management)** (ENG-25608) | Updated the `fast-uri` dependency in Service Management (`app-service_management`) to resolve an interpretation conflict vulnerability (CVE-2026-13676). | | NSO Service Manager | **CRLF injection in form-data (Service Management)** (ENG-25609) | Updated the `form-data` dependency in Service Management (`app-service_management`) to resolve a CRLF injection vulnerability (CVE-2026-12143). | | NSO Service Manager | **Cross-site scripting in dompurify (Service Management)** (ENG-25610) | Updated the `dompurify` dependency in Service Management (`app-service_management`) to resolve a cross-site scripting vulnerability (CVE-2026-65900) in the `SAFE_FOR_TEMPLATES` function. | | NSO Service Manager | **Inefficient algorithmic complexity in brace-expansion (NSO Manager)** (ENG-25611) | Updated the `brace-expansion` dependency in `app-nso_manager` to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149). | | NSO Service Manager | **Interpretation conflict in fast-uri (NSO Manager)** (ENG-25612) | Updated the `fast-uri` dependency in `app-nso_manager` to resolve an interpretation conflict vulnerability (CVE-2026-13676). | | NSO Service Manager | **CRLF injection in form-data (NSO Manager)** (ENG-25613) | Updated the `form-data` dependency in `app-nso_manager` to resolve a CRLF injection vulnerability (CVE-2026-12143). | | NSO Service Manager | **Cross-site scripting in dompurify (NSO Manager)** (ENG-25614) | Updated the `dompurify` dependency in `app-nso_manager` to resolve a cross-site scripting vulnerability (CVE-2026-65900) in the `IN_PLACE` sanitization process. | | NSO Service Manager | **Inefficient algorithmic complexity in brace-expansion (adapter-nso)** (ENG-25615) | Updated the `brace-expansion` dependency in `adapter-nso` to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149). | | NSO Service Manager | **Interpretation conflict in fast-uri (adapter-nso)** (ENG-25616) | Updated the `fast-uri` dependency in `adapter-nso` to resolve an interpretation conflict vulnerability (CVE-2026-13676). | | NSO Service Manager | **CRLF injection in form-data (adapter-nso)** (ENG-25617) | Updated the `form-data` dependency in `adapter-nso` to resolve a CRLF injection vulnerability (CVE-2026-12143). | | Operations Manager | **Blind NoSQL injection in Operations Manager** (ENG-25628) | Resolved a blind NoSQL (MongoDB) injection vulnerability in Operations Manager's triggers and jobs APIs. | | Platform | **Interpretation conflict in fast-uri** (ENG-25649) | Updated the `fast-uri` dependency to resolve an interpretation conflict vulnerability (CVE-2026-13676). | | Work Center | **Uncontrolled recursion in multer** (ENG-25626) | Updated the `multer` dependency in Work Center Service to resolve an uncontrolled recursion vulnerability that could allow CPU and memory exhaustion via deeply nested multipart form field names. | | Work Center | **Inefficient algorithmic complexity in js-yaml (Work Center Service)** (ENG-25735) | Updated the `nestjs-platform` dependency in Work Center Service to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59869) in `js-yaml`'s YAML merge-key handling. | | Work Center | **Inefficient algorithmic complexity in js-yaml (nestjs-platform)** (ENG-25737) | Updated the `js-yaml` dependency in Work Center's `nestjs-platform` library to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59869). | | Work Center | **Allocation of resources without limits in body-parser (Work Center)** (ENG-25765) | Updated the `axios` dependency and its transitive dependencies (`qs`, `form-data`) in Work Center to resolve a medium-severity denial-of-service vulnerability (CVE-2026-12590) in `body-parser`'s request body size limit handling. No functional or behavioral changes. | #### Component versions | Component | Version | | -------------------------------- | ------- | | Configuration Manager Enterprise | 6.5.1 | | FlowAI | 1.0.1 | | Gateway Manager | 1.1.2 | | Inventory Manager | 1.2.12 | | NSO Service Manager | 6.5.1 | ## July 1, 2026 # 6.5.0 Platform 6.5.0 is a minor release that introduces FlowAI and Work Center. This release also includes security updates, bug fixes, and enhancements across Workflows, Workflow Engine, Configuration Manager, NSO Service Manager, and Platform infrastructure, including Cisco NSO 6.7 compatibility. For more information on new features introduced in this release, see [Platfrom 6.5 feature announcement](/itential-platform/release-notes/feature-announcements/650). #### Enhancements (19) | Component | Feature | Description | | -------------------------------- | ----------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin Essentials | **Exclude query parameter for config/apps API** (ENG-25095) | Added an `exclude` query parameter to the `GET /config/apps` API. You can now exclude data for `methods`, `topics`, and `views` from the API response. | | Admin Essentials | **Download Integration Model as JSON** (ENG-24611) | Added a button to the titlebar that lets you download an integration model as a JSON file while viewing it. | | Configuration Manager | **Remove service launch timeout cap** (ENG-24921) | Removed the maximum constraint on `service_launch_timeout`, previously capped at 1,200 seconds. You can now set whatever value your environment requires for extended startup migrations on large datasets. | | NSO Service Manager | **Cisco NSO 6.7 commit parameter support** (ENG-24880) | Added support for new commit parameters to improve compatibility with Cisco NSO 6.7 and later versions. | | NSO, NSO Service Manager | **Dry-run support for prepare-transaction RPC** (ENG-24791) | Updated the NETCONF prepare-transaction RPC to use the `dry-run` parameter for compatibility with Cisco NSO 6.7 and later versions. | | NSO Service Manager | **NSO version detection for Cisco NSO 6.7** (ENG-24706) | Enhanced NSO version detection and Itential-tools package resolution to support compatibility with Cisco NSO 6.7. | | Studio | **Child Job task workflow dropdown format** (ENG-24678) | The Child Job task workflow dropdown now displays selected project member workflows in the correct format: ` from `. | | NSO | **Cisco NSO 6.7 support via Unix Domain Sockets** (ENG-24607) | Added support for Cisco NSO 6.7 by updating itential-tools internal package communication from TCP to Unix Domain Sockets and aligning build requirements with Java 21. | | Core | **Context-aware helper functions for Ancestry** (ENG-24562) | Added context-aware helper functions for Ancestry. | | Gateway Manager | **Gateway Manager database import and export** (ENG-24471) | Implemented Gateway database import and export functionality in Gateway Manager via the UI, workflow tasks, and APIs. | | Operations Manager | **Agent session start error handling** (ENG-24233) | Fixed agent session start error handling in Operations Manager. The system now propagates AEE failures, guards against a missing `sessionId`, and opens a new tab when a session successfully begins. | | Configuration Manager Enterprise | **Compliance plan start and complete events** (ENG-24205) | Compliance Plans now emit events on compliance plan start and complete. | | Configuration Manager | **Throttle field for concurrent devices** (ENG-24089) | Added a throttle field that lets you limit the number of concurrent devices used during a compliance plan run. | | Workflow Engine (WFE) | **Work Center integration for manual tasks** (ENG-21708) | The Workflow Engine now integrates with Work Center when a manual task is encountered. When Work Center is installed, a work item is automatically created in Work Center as the task becomes actionable, enabling operators to view and complete manual tasks directly from Work Center. | | Workflow Engine (WFE) | **Support for async task type** (ENG-22998) | Added Workflow Engine support for `async` type tasks. | | Workflow Engine (WFE) | **onWorkItemCompletion for Work Center integration** (ENG-23247) | Added `onWorkItemCompletion` support in the Workflow Engine for Work Center integration. | | Workflow Engine (WFE) | **getWorkItemStatuses for Work Center reconciliation** (ENG-23246) | The Workflow Engine now exposes a `getWorkItemStatuses` method, enabling Work Center to automatically resolve orphaned work items during its reconciliation cycle. Work Center can now query the Workflow Engine directly to determine the current status of items that were previously stuck in a `PENDING` state and close them out as either `COMPLETED` or `CANCELED`. | | Tool Registry | **Subscribe to audit events and update tools** (ENG-22044) | Tool Registry now subscribes to audit events and updates tools accordingly. | | Gateway Manager | **Gateway Manager database import and export via JSON-RPC** (ENG-22256) | Implemented database import and export JSON-RPC methods in Gateway Manager. | #### Bug fixes (29) | Component | Feature | Description | | -------------------------------- | ---------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | NSO Service Manager | **Dry-run option format incompatibility** (ENG-25336) | Fixed a regression where the dry-run option format was incompatible with the `deleteServiceDryRun` task in the JSON-RPC adapter, causing commit failures. | | Workflows | **ForEach loop error with multiple query tasks merging** (ENG-24941) | Fixed an issue where connecting multiple query tasks to a merge task caused tasks to be unable to draw transitions to other tasks within the same loop, under certain criteria. | | Workflows | **Query not applied for child job task loop array input** (ENG-24684) | Fixed an issue where the query was not applied when calculating loop iteration count and fetching loop elements for child job task loop array input, causing runtime errors. | | Workflows | **Evaluation task UI update on delete** (ENG-24315) | Fixed an issue where the evaluation task UI didn't update correctly when you deleted an evaluation that had multiple evaluations with queries configured. | | Studio | **Workflow validation for deleted task actor references** (ENG-23820) | Added workflow validation for task actor fields that reference deleted tasks, surfacing broken references before workflow execution. | | Configuration Manager | **Toast close icon** (ENG-23765) | Fixed an issue where the toast close icon displayed incorrectly. | | Configuration Manager | **Non-compliant device read from API** (ENG-23760) | Fixed an issue where non-compliant devices weren't read correctly as returned from the API. | | Configuration Manager Enterprise | **Compliance dashboard display bugs** (ENG-23705) | Fixed issues in the compliance dashboard including device count mismatch, backup sorting, and incorrect node display. | | Projects | **Export with unsaved document changes** (ENG-23338) | Exporting a project with unsaved document changes now saves the document first before exporting. The same save-before-action behavior now applies consistently across all asset export, duplicate, and delete operations in both Automation Studio and Lifecycle Manager. | | Workflow Engine (WFE) | **Scheduled task window error messages** (ENG-23173) | Invalid scheduled task window errors now output a descriptive schema error instead of `[object Object]`. | | Configuration Manager Enterprise | **JSON compliance dynamic variables not honored** (ENG-22859) | Fixed an issue where JSON compliance dynamic variables weren't honored in workflow tasks. | | Configuration Manager Enterprise | **runComplianceForDevice scope** (ENG-22750) | Fixed an issue where `runComplianceForDevice` executed compliance against all task instances in a JSON Golden Config tree instead of only the specified device instance. | | JSON Forms | **Static dropdown label truncation** (ENG-22711) | Fixed an issue where static dropdown labels with a single option were truncated and not fully shown in the preview form. | | Workflows | **Duplicate jobs from rapid button clicks** (ENG-22327) | Fixed an issue in Automation Studio where rapidly clicking **Run**, **Duplicate**, **Delete**, or **Save** multiple times could produce duplicate jobs, clones, or deletes. These buttons are now disabled while their operations are in progress. | | Configuration Manager | **pronghorn.json reference to missing file** (ENG-21845) | Fixed a reference in Configuration Manager's `pronghorn.json` to a file that didn't exist. | | Projects | **Asset name displays internal ID prefix** (ENG-20138) | Fixed an issue where project asset names displayed an internal ID prefix (`@:`) in the delete-with-references confirmation dialog and the Edit Details name field. Asset names now display consistently with the rest of the UI. | | Workflows | **Mock data validation update button** (ENG-18464) | Fixed an issue where the update button for mock data didn't become disabled when there was a validation error in object data. The button is now grayed out until the error is resolved. | | Workflows | **Mock data error for renderJsonSchema task** (ENG-18427) | Fixed a "Cannot read properties of null" error when viewing mocked Render JSON Schema tasks in Debug Mode. | | Studio | **Navigation dialog with no unsaved changes** (ENG-18177) | Fixed an issue where navigating from the workflow editor to the Projects view incorrectly triggered an "unsaved changes" dialog when no changes had been made. | | Configuration Manager Enterprise | **Configuration parsers GBAC save failure** (ENG-15613) | Fixed an issue where configuration parsers failed to save GBAC. | | Operations Manager | **Large data download in JSON view** (ENG-13006) | Fixed the download button for large data in the JSON view. It now downloads the full data set instead of returning a "data is too large" message. | | Configuration Manager Enterprise | **Golden Configuration preview config** (ENG-11393) | Fixed an issue where the Golden Configuration preview config wasn't working. | | Studio | **DiscoverReferences parentPointer consistency** (ENG-11033) | `DiscoverReferences` now returns a consistent, concrete `parentPointer` regardless of discovery direction. Inverse references previously returned a schema-level pointer; they now resolve the actual data path using the parent model's forward reference definition. | | JSON Forms | **Sub-container expansion in Preview Form** (ENG-10827) | Subcontainers with Collapse by Default set to true and a custom container name are now expandable in Preview Form. | | Lifecycle Manager | **Missing query parameters in Swagger UI** (ENG-10616) | Fixed an issue where some API endpoints didn't show their available query parameters in the `/rest-api` Swagger UI, making it appear as though those endpoints didn't support filtering, sorting, or pagination even though they did. The Swagger UI now correctly displays all supported query parameters for affected endpoints. | | Workflows | **Unclear warning for undefined task variable references** (ENG-10597) | Added a clarifying warning when variables are set to task variables that don't exist. | | Workflows | **Error toast on integration task Details tab** (ENG-10152) | Fixed an issue where integration tasks displayed an error toast when you opened the Details tab of the Task Details panel. | | Transformations | **Stale data left behind after deleting unsaved asset** (ENG-8274) | Fixed an issue where deleting a Transformation, Template, JSON Form, Command Template, or Analytic Template with unsaved changes showed an unexpected "Confirm Navigation" dialog or left stale data in the next opened asset. | | Workflows | **Adapter ID ghost after deletion** (ENG-5905) | Fixed an issue where an integration ID left a ghost reference on a task after the integration was deleted. | #### Security fixes (13) This release includes security updates that address vulnerabilities in third-party packages and platform components. | Component | Feature | Description | | --------------------- | ------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | | Core | **CRLF injection** (ENG-24987) | Resolved a CRLF injection vulnerability in Core. | | Core | **Asymmetric resource consumption in ws** (ENG-24885) | Updated the `ws` dependency in Core to resolve an asymmetric resource consumption (amplification) vulnerability. | | Admin Essentials | **Open redirect in react-router-dom (Admin Essentials)** (ENG-24884) | Updated the `react-router-dom` dependency to address an open redirect vulnerability. | | Configuration Manager | **Open redirect in react-router-dom (Configuration Manager)** (ENG-24884) | Updated the `react-router-dom` dependency to address an open redirect vulnerability. | | Lifecycle Manager | **Open redirect in react-router-dom (Lifecycle Manager)** (ENG-24884) | Updated the `react-router-dom` dependency to address an open redirect vulnerability. | | Operations Manager | **Open redirect in react-router-dom (Operations Manager)** (ENG-24884) | Updated the `react-router-dom` dependency to address an open redirect vulnerability. | | Studio | **Open redirect in react-router-dom (Studio)** (ENG-24884) | Updated the `react-router-dom` dependency to address an open redirect vulnerability. | | NSO Service Manager | **Prototype pollution in axios (adapter-nso)** (ENG-24883) | Resolved a prototype pollution vulnerability (CVE-2026-44494) by updating `axios` to a secure version in adapter-nso. | | NSO Service Manager | **Prototype pollution in axios (app-nso_manager)** (ENG-24882) | Resolved a prototype pollution vulnerability (CVE-2026-44494) inside app-nso_manager by updating `axios` to a secure version. | | Inventory Manager | **Axios and React Router security updates** (ENG-24512) | Updated the `axios` and `react-router-dom` dependencies in Inventory Manager to resolve security vulnerabilities. | | Inventory Manager | **Axios security update (Adapter Inventory)** (ENG-24511) | Updated the `axios` dependency in Adapter Inventory to resolve a security vulnerability. | | Core | **Prototype pollution in axios (itential-utils)** (ENG-24443) | Updated the `axios` dependency in itential-utils to resolve a prototype pollution vulnerability. | | Core | **Prototype pollution in axios (iap)** (ENG-24441) | Updated the `axios` dependency to resolve a prototype pollution vulnerability. | #### Component versions | Component | Version | | -------------------------------- | ------- | | FlowAI | 1.0 | | Gateway Manager | 1.1.1 | | Inventory Manager | 1.2.8 | | Service Manager | 6.5.0 | | Configuration Manager Enterprise | 6.5.0 | ## June 3, 2026 # 6.4.1 Platform 6.4.1 is a maintenance release with security updates, bug fixes, and enhancements across Operations Manager, Studio, Configuration Manager, and Platform infrastructure. It addresses customer-reported issues and improves stability, reliability, and secure communication. #### Enhancements (1) | Component | Feature | Description | | -------------------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | Configuration Manager Enterprise | **Compliance plan view toggle** (ENG-24014) | Changed how you switch between the default and classic view of compliance plans. Access the toggle on the Configuration Manager dashboard. | #### Bug fixes (26) | Component | Feature | Description | | -------------------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Configuration Manager Enterprise | **GradeComplianceReports device scope** (ENG-22461) | Fixed an issue where `gradeComplianceReports` graded devices outside the compliance plan. The task now only grades devices included in the plan. | | Configuration Manager Enterprise | **Golden config treeId on import** (ENG-21919) | Fixed an issue where re-importing a golden config changed its `treeId`. The `treeId` is now preserved on import. | | JSON Forms | **Schema combination dropdown clear button** (ENG-24062) | Removed the clear button from the schema combination dropdown to prevent users from setting a schema combination to an empty, invalid state. | | Operations Manager | **Scheduled trigger error logging** (ENG-23176) | Fixed object readability in scheduled triggers error logging. | | Operations Manager | **Sidebar selection highlight** (ENG-7784) | Fixed an issue where the left navigation sidebar did not update its selection highlight when switching between job filter views. The highlight now correctly reflects the active filter as you navigate. | | Platform | **Licensing timeout error** (ENG-23266) | Fixed a licensing timeout error that caused license validation to fail on Red Hat systems. | | Platform | **Service startup with colon in server ID** (ENG-22854) | Fixed an issue where colons in server IDs could silently prevent services from detecting each other after startup. Server IDs containing colons are now rejected with a descriptive error. | | Projects | **Project asset import for users outside account collection** (ENG-23778) | Fixed an error that prevented importing some project assets when the user was not in the account collection. | | Templates | **Command template checkbox persistence** (ENG-24271) | Fixed the **Treat info and warning as pass** checkbox in the command template UI so that it persists correctly when the template is saved. | | Templates | **Analytic template rename error message** (ENG-10314) | Fixed an issue where renaming a MOP analytic template to an already-taken name returned an incorrect `Operation canceled by the user` error instead of the expected duplicate-name error. | | Templates | **Template disappears from folder tree on rename** (ENG-24249) | Fixed a bug where renaming a command template or analytic template on a fresh page load would inconsistently cause it to disappear from the folder tree. | | Templates | **Template import schema validation** (ENG-19450) | Fixed template import returning an unclear error when the submitted template was missing required fields or contained non-string values for string fields. | | Workflow Engine | **Task worker error object logging** (ENG-23166) | Fixed an issue where error objects logged from within a task worker appeared as `error=[ {} ]` instead of their actual content. | | Workflows | **Child job task corruption on task reference delete** (ENG-24148) | Fixed an issue where deleting a task reference corrupted the child job task in the workflow document. The workflow engine now supports starting a job for workflows in this state for backward compatibility. | | Workflows | **Debug mode keyboard shortcut propagation** (ENG-16946) | Fixed an issue in Studio where browser keyboard shortcuts (such as Cmd+Opt+I and Cmd+R) were consumed when the workflow canvas was in debug mode. Shortcuts now propagate to the browser as expected. | | Workflows | **Debug mode scenario input save** (ENG-16945) | Fixed an issue in debug mode where pasting JSON into a scenario input field and immediately pressing Cmd+S caused the pasted value to revert to null after save. | | Workflows | **Deprecated task icons on canvas reload** (ENG-10247) | Fixed an issue where deprecated task icons and warnings disappeared from the workflow canvas after a page reload. | | Workflows | **Import dialog behavior on partial import success** (ENG-11415) | Fixed an issue in the Studio import dialog where a partial import success left the dialog open and the page unrefreshed. The dialog now closes and the sidebar updates to reflect successfully imported items even when other files in the batch fail. | | Workflows | **Job variable null value on canvas start** (ENG-18492) | Fixed an issue where users could not assign a null value to a job variable when starting a workflow from the canvas. | | Workflows | **Project builder name sort with prefix** (ENG-16128) | Fixed an issue where name sorting in Project Builder incorrectly included the project prefix. | | Workflows | **Save Workflow API unknown `_id` handling** (ENG-23356) | Fixed an issue in the save workflow API (`POST /workflow_builder/workflows/save`) where supplying an `_id` that did not exist in the database silently succeeded without persisting the workflow. The API now returns a clear error identifying the unknown `_id`. | | Workflows | **Unsaved changes dialog on tab close** (ENG-6727) | Fixed a stale-closure bug that caused the `Unsaved Changes` navigation dialog to appear when closing a tab that had no unsaved edits. | | Workflows | **Workflow import with invalid Debug Mode scenario input** (ENG-24105) | Fixed workflow import failures caused by invalid Debug Mode scenario input. Added validation to prevent users from setting invalid values in scenario input. | | Studio | **Workflow name truncation with dash character** (ENG-7276) | Fixed an issue where workflow names containing a dash character were incorrectly truncated in the Studio tab label. | | Transformations | **Unsaved changes check overrides delete confirmation** (ENG-7303) | Fixed an issue in Studio where deleting a document with unsaved changes triggered two confirmation dialogs back-to-back. | | Inventory Manager | **Gateway 4 and Gateway 5 device origin detection** (ENG-23885) | Fixed device origin detection between IAG 4 and IAG 5 in MOP and Configuration Manager routing. | #### Security fixes (13) This release includes security updates that address vulnerabilities in third-party packages and platform components. | Component | Feature | Description | | ------------------- | ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Inventory Manager | **FastURI security vulnerability (Inventory Manager)** (ENG-24190) | Fixed a FastURI security vulnerability in Inventory Manager and Adapter Inventory Manager. | | NSO Service Manager | **Cross-site scripting in Quill (NSO Manager)** (ENG-22488) | Resolved a cross-site scripting (XSS) vulnerability (CVE-2025-15056) by updating Quill to a secure version in app-nso_manager. | | NSO Service Manager | **Directory traversal in fast-uri (Service Management)** (ENG-24069) | Resolved a Directory Traversal vulnerability (CVE-2026-6321) by updating fast-uri to a secure version in app-service_management. | | NSO Service Manager | **HTTP cleartext transmission (NSO Adapter)** (ENG-18110) | Improved HTTP request handling in adapter-nso to align with secure communication best practices. | | NSO Service Manager | **Improper index validation in UUID (NSO Adapter)** (ENG-23791) | Resolved a security vulnerability (CVE-2026-41907) related to improper input offset validation by updating UUID to a secure version in adapter-nso. | | NSO Service Manager | **Improper index validation in UUID (Service Management)** (ENG-23792) | Resolved a security vulnerability (CVE-2026-41907) related to improper input offset validation by updating UUID to a secure version in app-service_management. | | Platform | **Directory traversal in fast-uri (itential-utils)** (ENG-23883) | Updated the fast-uri dependency in itential-utils to resolve a Directory Traversal security vulnerability. | | Platform | **Directory traversal in fast-uri (itential-utils crossfunctional)** (ENG-23815) | Updated the fast-uri dependency in itential-utils to resolve a Directory Traversal security vulnerability. | | Platform | **Sensitive information exposure in follow-redirects (Core)** (ENG-23371) | Updated the follow-redirects dependency in Core to fix a sensitive information exposure vulnerability. | | Platform | **Sensitive information exposure in follow-redirects (itential-utils)** (ENG-23374) | Updated the follow-redirects dependency in itential-utils to fix a sensitive information exposure vulnerability. | | Platform | **Use of uninitialized resource in ws (Core)** (ENG-24042) | Updated the ws subdependency in Core to resolve a use-of-uninitialized-resource security vulnerability. | | Platform | **Improper index validation in UUID (Core)** (ENG-23787) | Updated the uuid dependency in Core to fix an improper index validation vulnerability. | | Workflow Engine | **Redis command timeout on startup** (ENG-24065) | Updated the default `redis_command_timeout` configuration value to fix a timeout issue that prevented the Workflow Engine API from coming online correctly at startup. | ## May 15, 2026 # 6.4.0 Platform 6.4.0 is a minor release featuring critical security updates, performance improvements, and new capabilities across Operations Manager, Studio, and Platform infrastructure. This release addresses customer-reported issues and introduces enhancements to improve user experience and system reliability. For an overview of the key features in this release, see the [Platform 6.4.0 feature announcement](/release-notes/feature-announcements/640). #### Enhancements (15) | Component | Feature | Description | | ------------------ | -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Gateway | **Gateway runCode method** (ENG-19351) | Implemented `runCode` method in Gateway Manager for executing custom code through gateway integrations. | | Gateway | **Gateway runCode RPC** (ENG-19350) | Added `runCode` RPC endpoint in Gateway5 for remote code execution capabilities. | | Gateway | **Proxy logic for integration worker** (ENG-21997) | Modified Integration worker to support proxy logic, enabling more flexible network configurations. | | Operations Manager | **Audit events for CRUD operations** (ENG-22043) | Added audit events for CRUD operations in their respective management applications. | | Operations Manager | **Execution ancestry implementation** (ENG-22441) | Implemented execution ancestry tracking to provide better visibility into job and task relationships across the platform. | | Operations Manager | **Job duration toggle** (ENG-19459) | Added job duration toggle option in Operations Manager Jobs Table View, allowing users to customize displayed metrics. | | Operations Manager | **Job execution path visibility** (ENG-18253) | Enhanced Operations Manager with improved job execution path visualization, making it easier to trace and debug workflow executions. | | Operations Manager | **Task details panel resize** (ENG-22691) | Added support for resizing the task details panel manually, allowing for a larger view of the code editor within the panel. | | Platform | **Itential Academy URL update** (ENG-21935) | Updated the URL of Itential Academy in Platform from Learn Upon to the new Itential Academy portal. | | Studio | **Auto-generated key name visibility** (ENG-22753) | Improved visibility of auto-generated key names when a form field label contains transformed characters such as spaces or hyphens. The Custom Key radio/text input has been replaced with a text input that displays the auto-generated key as its default value, with a tooltip describing its purpose. Applies to Checkbox, Text, Textarea, Number, Dropdown, Container, Table, and File Upload fields. | | Studio | **Code task template** (ENG-19352) | Added code task template in Studio to streamline creation of custom code execution tasks. | | Studio | **Inline query on task input** (ENG-22503) | Added support for configuring inline queries on task inputs when data comes from jobs or previous tasks. | | Studio | **Task focus indicators** (ENG-18800) | Implemented visual focus indicators for tasks, improving accessibility and navigation in workflow canvas. | | Workflow Engine | **Execution ancestry deduplication** (ENG-23188) | Fixed an issue where duplicate execution ancestry records could be inserted into the `execution_nodes` collection. | | Workflow Engine | **Inline query support** (ENG-22689) | Added inline query support to Workflow Engine task variable resolution. | #### Bug fixes (36) | Component | Feature | Description | | --------------------- | ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Integration | **OAuth integration models** (ENG-20194) | Fixed Integration Models not working with OAuth for Cisco Umbrella integrations. | | Operations Manager | **Actionable tasks CPU thrashing** (ENG-22418) | Improved query performance on getting Actionable Tasks in Operations Manager to prevent CPU thrashing. | | Operations Manager | **Warning for automation write groups** (ENG-1765) | Added warning message when assigning write groups to automation to prevent permission issues. | | Operations Manager | **Manual task retry** (ENG-14413) | Fixed issue where users could not access the manual task dialog to retry adapter tasks. Users no longer see a blank screen element when accessing this functionality. | | Operations Manager | **Tasks stuck in errored state** (ENG-19443) | Resolved issue with tasks getting stuck in "Errored" states, improving workflow reliability and error recovery. | | Operations Manager | **Triggers display limit** (ENG-22024) | Fixed issue where Operations Manager only showed 10 triggers. Banners no longer cut off the bottom of Operations Manager's screen. | | NSO | **NSO 6.4.8+ transaction comment support** (ENG-22838) | Updated deprecation handling for transaction methods (`set_comment`, `set_label`) to maintain compatibility with NSO v6.4.8 and newer releases. | | Platform | **App initialization with role mismatch** (ENG-22023) | Fixed issue where app failed to initialize completely when roles inside views did not match the global roles array. | | Platform | **Auto keying JSON forms** (ENG-22101) | Implemented auto keying when moving JSON form or template references into projects. | | Platform | **Global search templates** (ENG-5894) | Fixed issue where global search was not working for templates and JSON Forms. | | Platform | **MongoDB native calls removal** (ENG-20491) | Removed mongo native database calls and switched to using Database package for improved consistency and maintainability. | | Platform | **Node.js security** (ENG-22038) | Updated Node.js version to 20.20 to address critical security vulnerabilities in Platform 6.3.3. | | Platform | **Resource model update blocked** (ENG-22862) | Fixed an issue where updating a resource model was incorrectly blocked when all existing instances had been deleted via a canceled create action. The instance check now correctly recognizes both completed deletes and canceled creates as deleted states. | | Platform | **Redis master failover** (ENG-20713) | Fixed issue where Platform 6 was not reconnecting to the new redis master node when the actual master failed. | | Platform | **System search regex metacharacters** (ENG-22349) | Fixed issue where system search failed when query contained regex metacharacters (e.g. +, \*). | | Platform | **Vault startup hang** (ENG-18458) | Fixed issue where Vault hangs Itential Platform on startup when no network access is available, with no logs and health check passing even if password is bad. | | Projects | **New folder from selected** (ENG-4767) | Fixed issue where "New Folder From Selected" failed when selecting from multiple folders in Projects. | | Projects | **Template group concept** (ENG-4883) | Resolved issue where Template Group was not properly supported as a concept in Projects. | | Service Configuration | **Configuration descriptions** (ENG-19265) | Added support for Service Configuration Descriptions to improve configuration management and documentation. | | Studio | **Canvas search evaluation** (ENG-6310) | Fixed issue where canvas search was not finding text in evaluation descriptions. | | Studio | **Canvas task copy/paste references** (ENG-22882) | When copying or duplicating a task on the workflow canvas, variable references pointing to tasks outside the new task's ancestry are now automatically cleared instead of being carried over verbatim from the source, preventing invalid variable bindings on the pasted task. | | Studio | **Deep Merge canvas task** (ENG-2623) | Fixed an issue in the Deep Merge canvas task where entering an array value into the static input field did not display a validation error, causing the value to be silently discarded. Also fixed an issue where entering a quoted string (e.g. `"hello"`) would strip the quotes on blur, producing invalid JSON in the editor. | | Studio | **JSON form UI crash** (ENG-22554) | Fixed issue where JSON Form UI crashed when populating post body. | | Studio | **JST function replace** (ENG-2960) | Fixed missing function for 'replacement' parameter in JST function 'replace'. | | Studio | **JST tabs incorrect data** (ENG-22735) | Fixed issue where JST tabs showed incorrect data, ensuring consistent data display across transformation editor tabs. | | Studio | **JST undo/redo dirty state** (ENG-1851) | Fixed issue where using undo/redo buttons in the JST editor did not put the UI into a dirty state, causing unsaved changes to go undetected. | | Studio | **MOP template special characters** (ENG-7275) | Fixed issue where MOP Templates with special characters in name failed to import. | | Studio | **PHTreeMenu multiple context menus** (ENG-9230) | Fixed issue where PHTreeMenu allowed multiple context menus to be open at once. | | Studio | **Schema combination element reordering** (ENG-7961) | The "Schema Combination Layout" element is now draggable and reorderable in JSON Forms. Reordering now supports drag-and-drop in both directions (upward and downward). | | Studio | **Schema combinations rendering** (ENG-22569) | Fixed issue where multiple schema combinations of the same type rendered incorrectly in form preview. | | Studio | **Swap task icon functionality** (ENG-9371) | Fixed issue where swap task icon on task detail card did not work for tasks when required adapters were not installed on the system. | | Studio | **Swap task search bar** (ENG-22677) | Fixed issue where Swap Task no longer worked following usage of the search bar twice in the Swap Task UI. | | Studio | **Transformation tab display name** (ENG-10756) | Fixed incorrect display name in Transformation tab. | | Studio | **View Data text selection** (ENG-23774) | Fixed an issue in the View Data manual task that prevented individual lines of text from being selected. | | Studio | **Workflow import with SLA fields** (ENG-23004) | Added support for handling broken workflow payloads when importing workflows with newly added or updated `sla` or `preAutomationTime` fields. | | Workflow Engine | **Memory spike in child jobs** (ENG-22494) | Addressed unexplained memory spikes in Workflow Engine leading to hung status of tasks, mainly affecting Child Jobs. | #### Security fixes (19) This release includes important security updates that address vulnerabilities in third-party packages and platform components. | Component | Feature | Description | | --------- | ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | NSO | **Arbitrary code injection in lodash (Service Management)** (ENG-22893) | Updated lodash in app-service_management to resolve Arbitrary Code Injection vulnerability. | | NSO | **Arbitrary code injection in lodash-es (NSO Gateway)** (ENG-23370) | Fixed Arbitrary Code Injection security vulnerability in lodash-es. | | NSO | **Confused deputy in axios (NSO Manager)** (ENG-22845) | Fixed Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in axios for app-nso_manager. | | NSO | **Confused deputy in axios (Service Management)** (ENG-22841) | Fixed Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in axios for app-service_management. | | NSO | **Cross-site scripting (NSO Manager)** (ENG-22489) | Fixed Cross-site Scripting (XSS) vulnerability in app-nso_manager. | | NSO | **HTTP response splitting in axios (NSO Manager)** (ENG-23209) | Resolved HTTP Response Splitting vulnerability (CVE-2026-42035) by updating axios to a secure version inside app-nso_manager ([SNYK-JS-AXIOS-16298058](https://security.snyk.io/vuln/SNYK-JS-AXIOS-16298058)). | | NSO | **HTTP response splitting in axios (NSO Service Management)** (ENG-23353) | Resolved security vulnerabilities (CVE-2026-42264 and CVE-2026-42044) related to request handling by updating axios to a secure version. | | NSO | **Improper neutralization (NSO Manager)** (ENG-22488) | Fixed Improper Neutralization vulnerability in app-nso_manager. | | NSO | **Infinite loop (NSO Adapter)** (ENG-22486) | Fixed Infinite loop vulnerability in adapter-nso. | | NSO | **Infinite loop (NSO Manager)** (ENG-22487) | Fixed Infinite loop vulnerability in app-nso_manager. | | NSO | **Improper index validation in UUID (NSO Manager)** (ENG-23442) | Resolved a security vulnerability (CVE-2026-41907) related to improper validation of specified index, position, or offset in input by updating UUID to a secure version inside app-nso_manager. | | NSO | **Prototype pollution (NSO Manager)** (ENG-22490) | Fixed Prototype Pollution vulnerability in app-nso_manager. | | Platform | **Arbitrary code injection in lodash (Itential Platform)** (ENG-22665) | Updated lodash in Itential Platform to resolve Arbitrary Code Injection vulnerability. | | Platform | **Confused deputy in axios (Itential Platform)** (ENG-22619) | Fixed Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in axios for Itential Platform. | | Platform | **HTTP response splitting** (ENG-23072) | Fixed HTTP Response Splitting vulnerability by updating axios package ([SNYK-JS-AXIOS-16298058](https://security.snyk.io/vuln/SNYK-JS-AXIOS-16298058)). | | Platform | **HTTP response splitting in axios (itential-utils)** (ENG-23095) | Updated axios in itential-utils to resolve HTTP Response Splitting vulnerability ([SNYK-JS-AXIOS-16298058](https://security.snyk.io/vuln/SNYK-JS-AXIOS-16298058)). | | Platform | **Infinite loop in brace-expansion (Itential Platform)** (ENG-22281) | Updated brace-expansion package in Itential Platform to resolve Infinite loop vulnerability. | | Platform | **Infinite loop in brace-expansion (itential-utils)** (ENG-22132) | Updated brace-expansion package in itential-utils to resolve Infinite loop vulnerability. | | Platform | **XML injection in @xmldom/xmldom** (ENG-22666) | Updated @xmldom/xmldom package to resolve XML Injection vulnerability. | ## April 2, 2026 # 6.3.4 Platform 6.3.4 is a maintenance release that includes critical bug fixes, security updates, and feature enhancements. This release addresses customer-reported issues to enhance platform stability and reliability. #### Enhancements (8) | Feature | Description | | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Asset edit details modal standardization** (ENG-19875) | All "View Metadata" drawers in Studio and Lifecycle Manager are now replaced with a dialog and renamed to "Edit Details". In the projects UI, the project navigation bar (left-hand side) and asset editor titlebar (top-right) also now consistently use this dialog for editing asset details. | | **Auto keying for project asset migration** (ENG-19921) | Workflow references are updated where applicable when moving or copying assets into a project. | | **Asset more menu options update** (ENG-20100) | Updated asset titlebar more menus to provide consistent and intuitive access to asset actions throughout the platform. | | **NSO 6.5 and 6.6 certification** (ENG-17515) | Certified NSO Service Manager functions and NSO Adapter against NSO 6.5 and NSO 6.6, ensuring compatibility with the latest Cisco NSO versions. | | **Platform 6 index management enhancement** (ENG-16284) | Enhanced index management for Platform 6 upgrades to improve database performance and reduce upgrade complexity. | | **Vault namespace header support** (ENG-15973) | Implemented support for `X-Vault-Namespace` header for Vault integration, enabling multi-tenancy and namespace isolation. | | **NSO fetchData return limit adjustment** (ENG-8574) | Adjusted NSO `fetchData` return limit to handle larger datasets and improve integration performance with Cisco NSO. | | **Project thumbnail file size configuration** (ENG-10644) | Added configuration for project thumbnail file size in Settings to allow customization based on organizational requirements. | #### Bug fixes (32) | Feature | Description | | -------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Long workflow names in project automation references** (ENG-21971) | Fixed an issue where workflows in project-based automations displayed "from undefined" instead of the project name in the automation dropdown when the workflow name was very long. | | **Lifecycle manager schema reference error** (ENG-21853) | Fixed an issue where the OpenAPI specification generated by the `help/openapi` endpoint contained an invalid schema reference, which could cause customer scripts using the spec to fail. | | **MOP template last updated by field** (ENG-21803) | Fixed issue where 'Last Updated By' field always displayed 'unknown' for MOP Command/Analytic templates. Implemented proper user tracking for template modifications. | | **Transformation search with dash characters** (ENG-21768) | Resolved issue where Transformations search did not work properly for names containing dash characters. Enhanced search query parsing. | | **Workflow GBAC restrictions in global space** (ENG-21621) | Fixed issue in 6.3.3 where Workflow Group-Based Access Control (GBAC) no longer restricted users in global space. Restored proper access control enforcement. | | **Operations manager automations groups display limit** (ENG-21576) | Resolved issue where Operations Manager Automations Read/Write Groups only displayed the first 100 groups. Implemented proper pagination and group listing. | | **Form validation enumNames rejection** (ENG-21566) | Fixed backend form validation incorrectly rejecting valid forms containing enumNames due to Ajv strict mode. Adjusted validation schema to support enumNames. | | **Query task JSON view output display** (ENG-21383) | Corrected issue where Query Task Post Execution showed incorrect output when JSON View was turned off. Improved output formatting logic. | | **Validate form task JSON forms service crash** (ENG-21256) | Fixed issue where Validate Form task would crash the JSON Forms service if validation failed. Implemented proper error handling and service recovery. | | **Project thumbnail upload with workflows** (ENG-20828) | Resolved inability to upload project thumbnail when a workflow exists in the project. Fixed file upload validation logic. | | **LCM RunAction task hang on invalid data** (ENG-20227) | Fixed issue where LCM `RunAction` task hung when invalid instance data was provided. Added input validation and timeout handling. | | **ValidateJsonSchema single document limitation** (ENG-20193) | Resolved issue where `ValidateJsonSchema` task only validated a single document per schema ID. Enabled multi-document validation support. | | **Golden configuration identifier key data loss** (ENG-20147) | Fixed issue where users are not given a warning when entries are dropped. | | **Golden configuration identifier key dropdown blank** (ENG-20146) | Fixed issue where undefined array identifier crashes the page. | | **Golden configuration dialog crash on right-click** (ENG-20145) | Fixed a bug with JSON config options throwing error when the config is empty. | | **viewData inconsistent behavior** (ENG-19226) | The `viewData` task has been updated to improve consistency in how message and body content is parsed and rendered as HTML. | | **Workflow loading performance on P6** (ENG-18902) | Improved workflow loading performance on Platform 6 by optimizing data retrieval and rendering logic. | | **Manual trigger form crash with duplicate labels** (ENG-17866) | Fixed page crash when clicking on forms containing items with same label name but different types in Manual Trigger dropdown. Enhanced form validation and conflict resolution. | | **Job deletion with automation read/write groups** (ENG-16590) | Resolved issue where jobs could not be deleted when triggered by an automation with read/write groups. Corrected permission checking logic. | | **JSON form text input binding** (ENG-14982) | Fixed issue where binding for text input in JSON Forms did not work correctly. Restored proper data binding functionality. | | **JSON form element ordering** (ENG-4775) | Resolved issue where JSON form elements appeared out of order when previewing and in the Automation trigger view. Ensured consistent element ordering. | | **Project builder logo display** (ENG-4773) | Fixed issue where Itential logo did not display correctly in Project Builder. Corrected logo asset loading. | | **JSON form builder table deletion confirmation** (ENG-4712) | Added confirmation prompt when deleting tables in JSON Form Builder to prevent accidental data loss. | | **JSON form readonly field population** (ENG-4653) | Resolved inability to populate readonly fields with values in JSON Forms. Enabled value assignment for readonly fields. | | **Task swap state persistence** (ENG-4259) | Fixed issue where Swap Task state persisted when opening other tasks. Properly cleared task state on task change. | | **JST schema modification variable removal** (ENG-3873) | Resolved issue where modifying schema of JST removed any outgoing variables set in workflow. Preserved variable assignments during schema updates. | | **Duplicate form option values** (ENG-3341) | Fixed ability to create forms with duplicate values in options. Implemented duplicate value detection and validation. | | **Workflow count display accuracy** (ENG-2959) | Corrected inaccurate workflow count on the Automation Studio workflow View All page. Fixed counting logic. | | **Transformation hotkey save** (ENG-2950) | Resolved issue where saving transformation using hotkeys did not work. Restored keyboard shortcut functionality. | | **Child/parent workflow visualization** (ENG-2946) | Fixed child/parent workflow drill down visualization issue with zoom-to-fit and constellation view. Improved canvas rendering logic. | | **JST designer task execution completion** (ENG-2293) | Resolved issue where JST Designer did not complete execution of a task even when prior task produced valid output. Fixed task completion detection. | #### Security fixes (9) This release includes important security updates that address vulnerabilities in third-party packages and platform components. | Feature | Description | | -------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Data amplification in undici** (ENG-21752) | Fixed Improper Handling of Highly Compressed Data (Data Amplification) vulnerability by updating undici ([SNYK-JS-UNDICI-15518068](https://security.snyk.io/vuln/SNYK-JS-UNDICI-15518068)). | | **Prototype pollution in immutable** (ENG-21364) | Updated immutable package to resolve Prototype Pollution vulnerability ([SNYK-JS-IMMUTABLE-15423650](https://security.snyk.io/vuln/SNYK-JS-IMMUTABLE-15423650)). | | **ReDoS in ajv (JST)** (ENG-20534) | Fixed ajv Regular Expression Denial of Service (ReDoS) vulnerability by upgrading to ajv\@6.14.0 ([SNYK-JS-AJV-15274295](https://security.snyk.io/vuln/SNYK-JS-AJV-15274295)). | | **Resource allocation in qs (JST Designer)** (ENG-20532) | Fixed Allocation of Resources Without Limits or Throttling vulnerability in qs by bumping ajv to 6.14.0 and refreshing the lockfile ([SNYK-JS-QS-15268416](https://security.snyk.io/vuln/SNYK-JS-QS-15268416)). | | **ReDoS in ajv (IAP)** (ENG-20498) | Fixed ajv Regular Expression Denial of Service (ReDoS) vulnerability by updating package ([SNYK-JS-AJV-15274295](https://security.snyk.io/vuln/SNYK-JS-AJV-15274295)). | | **Resource allocation in qs (IAP)** (ENG-20475) | Upgraded qs to address Allocation of Resources Without Limits or Throttling vulnerability ([SNYK-JS-QS-15268416](https://security.snyk.io/vuln/SNYK-JS-QS-15268416)). | | **Algorithmic complexity in minimatch (IAP)** (ENG-20376) | Updated minimatch package to address Inefficient Algorithmic Complexity vulnerability ([SNYK-JS-MINIMATCH-15353389](https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15353389)). | | **ReDoS in ajv (itential-utils)** (ENG-20366) | Fixed ajv Regular Expression Denial of Service (ReDoS) vulnerability by updating package ([SNYK-JS-AJV-15274295](https://security.snyk.io/vuln/SNYK-JS-AJV-15274295)). | | **Algorithmic complexity in minimatch (itential-utils)** (ENG-20365) | Updated minimatch package to address Inefficient Algorithmic Complexity vulnerability ([SNYK-JS-MINIMATCH-15353389](https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-15353389)). | ## March 5, 2026 # 6.3.3 Platform 6.3.3 is a maintenance release containing enhancements, bug fixes, and security updates. #### Enhancements (3) | Feature | Description | | -------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | **Project description field** (ENG-19847) | Added optional description field to project creation flows in Studio, enabling better project documentation and organization. | | **Lifecycle Management action descriptions** (ENG-18926) | Enabled setting the description field for Lifecycle Management Action assets to improve asset documentation and searchability. | | **Golden configuration asset descriptions** (ENG-18925) | Enabled setting the description field for golden configuration assets in Configuration Manager, enhancing configuration documentation capabilities. | #### Bug fixes (22) | Feature | Description | | ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Asset movement from project to global** (ENG-20126) | Fixed an issue where moving an asset from project to global space did not update the asset correctly. Ensured proper asset metadata and reference updates during migration. | | **Workflow import validation errors** (ENG-19989) | Resolved validation errors occurring when importing workflows in Platform 6.3.2. Improved import validation logic to handle edge cases. | | **Custom application functionality** (ENG-19874) | Fixed custom application not working properly in 6.3 and addressed additional issues that occurred when the application did work. Improved application initialization and runtime stability. | | **Task node deselection** (ENG-19709) | Fixed an issue where the task node was automatically deselected when opening task details. Maintained selection state for improved user experience. | | **Asset duplication in projects** (ENG-19549) | Resolved an issue where assets were being duplicated within projects, causing import errors in Platform 6. Implemented proper asset uniqueness validation. | | **Project performance with external references** (ENG-19433) | Improved project loading and performance when large numbers of external references exist. Optimized reference resolution and caching mechanisms. | | **Project loading COLLSCANS** (ENG-19332) | Fixed an issue where loading projects with many components caused spikes in database COLLSCANS leading to platform slowness. Added proper database indexes and optimized queries. | | **JSON Form data binding schema error** (ENG-18622) | Resolved an issue where data binding in JSON Form gave an incorrect schema error consistently. Corrected schema validation logic. | | **Eval null value handling** (ENG-18487) | Fixed an issue where the eval task incorrectly handled null values. Improved null checking and value coercion logic. | | **Child JST renaming on import** (ENG-18187) | Resolved an issue where a referenced child JST was renamed upon workflow import. Preserved original JST names during import operations. | | **JST Designer user function cleanup** (ENG-17989) | Fixed JST Designer failure to clean up assignments from user functions, which created irrecoverably broken JST documents. Implemented proper cleanup routines. | | **Evaluation task job variable input** (ENG-17802) | Corrected an issue where the evaluation task job variable input was not functioning properly. Restored proper variable binding and evaluation. | | **AGManager adapter discovery** (ENG-17775) | Fixed AGManager error on discoverAll where the automation gateway adapter could not be found. Improved adapter registration and discovery mechanisms. | | **Task summary loading state** (ENG-17550) | Resolved an issue where task summary remained stuck in loading state on running workflows. Improved state management and error handling. | | **LCM special character sanitization** (ENG-17240) | Fixed LCM failure to sanitize special characters when invalid regex exists in action names for workflows. Enhanced input validation and sanitization. | | **Redis TLS configuration** (ENG-16926) | Resolved inability to configure Itential Platform to use TLS with Redis and Redis Sentinel. Implemented proper TLS configuration support. | | **Operations Manager job view crash** (ENG-16816) | Fixed Operations Manager job view crash when viewing child iterations of cancelled jobs or jobs without valid job object values. Added proper null checking and error handling. | | **JST import from project** (ENG-15667) | Resolved an issue where automation and JSON Form could not be imported if using a JST from a project. Fixed cross-scope JST reference resolution. | | **Legacy forms export/import** (ENG-15611) | Fixed an issue in 23.2 UAT where legacy forms failed to export/import. Ensured backward compatibility for form migration. | | **renderJsonSchema binding schema** (ENG-13749) | Fixed the bindingSchema parameter in the renderJsonSchema task that was not working correctly. Restored proper schema binding functionality. | | **JSON Form field dependency update** (ENG-12016) | Resolved an issue where a JSON Form with field dependency did not update the selected field properly. Improved dependency tracking and field updates. | | **JST Designer duplicate schema IDs** (ENG-11207) | Fixed JST Designer not warning users about duplicate schema \$id values, which allowed saves but caused misbehavior. Implemented duplicate ID detection and validation. | #### Security fixes (11) This release includes important security updates that address vulnerabilities in third-party packages and platform components. | Feature | Description | | ------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- | | **ReDoS in ajv (NSO adapter)** (ENG-19908) | Updated ajv package in NSO adapter to resolve a regular expression denial of service (ReDoS) vulnerability. Enhanced regex validation patterns. | | **ReDoS in minimatch (NSO adapter)** (ENG-19907) | Updated minimatch package in NSO adapter to address a ReDoS vulnerability. Improved pattern matching performance. | | **Prototype pollution in lodash (service management)** (ENG-19905) | Updated lodash package in app-service_management to resolve prototype pollution vulnerability. Enhanced object property validation. | | **ReDoS in ajv (service management)** (ENG-19903) | Updated ajv package in app-service_management to address a ReDoS vulnerability. Improved schema validation performance. | | **Prototype pollution in lodash (NSO Manager)** (ENG-19899) | Updated lodash package in app-nso_manager to resolve prototype pollution vulnerability. Implemented proper input sanitization. | | **ReDoS in ajv (NSO Manager)** (ENG-19898) | Updated ajv package in app-nso_manager to address a ReDoS vulnerability. Enhanced validation efficiency. | | **ReDoS in minimatch (NSO Manager)** (ENG-19897) | Updated minimatch package in app-nso_manager to resolve a ReDoS vulnerability. Improved glob pattern handling. | | **Resource allocation in axios (NSO Manager 2023.2)** (ENG-19473) | Updated axios package to address allocation of resources without limits or throttling vulnerability. Implemented proper request throttling. | | **Prototype pollution in axios (NSO Manager)** (ENG-19472) | Updated axios package in app-nso_manager to resolve prototype pollution vulnerability. Enhanced HTTP request validation. | | **Prototype pollution in csvtojson** (ENG-16644) | Updated csvtojson package to address prototype pollution vulnerability. Improved CSV parsing security. | | **Predictable value range in form-data (NSO Manager)** (ENG-15022) | Updated form-data package to address predictable value range from previous values vulnerability. Enhanced boundary generation randomness. | ## February 16, 2026 # 6.3.2 Platform 6.3.2 is a maintenance release containing enhancements, bug fixes, and security updates. #### Enhancements (5) | Feature | Description | | ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- | | **Canvas Debug Mode UI Updates** (ENG-18749) | Updated Canvas Debug Mode color scheme and icon design in both Studio and Operations Manager for improved visibility and user experience. | | **MOP Template Description Support** (ENG-18502) | Enabled setting descriptions for Command Templates and Analytic Templates during asset creation in projects, improving documentation capabilities. | | **NSO 6.5+ Transaction Comments** (ENG-18189) | Added support for NSO 6.5+ transaction comments (`set_trans_comment`) to enhance integration capabilities with Cisco NSO. | | **Principal Caching Enhancements** (ENG-18680) | Implemented principal caching security improvements to enhance authentication performance and security posture. | | **X-Forwarded-For Header Logging** (ENG-16748) | Added `X-Forwarded-For` header logging in Platform Webserver logs to improve request tracing and security auditing. | #### Bug fixes (36) | Feature | Description | | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **LCM runAction Task Recursion** (ENG-19162) | Fixed issue where using LCM's runAction task in a workflow caused discover references to infinitely recurse, crashing Studio. Improved task reference handling to prevent infinite loops. | | **Date Range Filter Crash** (ENG-19075) | Resolved Operations Manager crash caused by invalid input in Date Range Filter. Enhanced input validation to prevent system crashes. | | **Workflow Engine Scheduler Race Condition** (ENG-19016) | Fixed race condition in Workflow Engine scheduler that could cause timing-related execution issues. Improved thread safety and synchronization. | | **Run Windows Static Time Entries** (ENG-19004) | Restored functionality for static time entries in Run Windows that were non-functional in version 6.3.1. | | **Radix Argument Error** (ENG-18970) | Fixed production error "toString() radix argument must be between 2 and 36" by implementing proper input validation for number conversion operations. | | **Large File Import Size Limitation** (ENG-18953) | Addressed issues with moving assets inside folders or importing large project files due to 15MB size limitation. Improved handling for large file operations. | | **Zoom to Selection Context Menu** (ENG-18861) | Restored missing 'Zoom to Selection' option in task context menu on Operations Manager canvas. | | **Zoom to Selection Centering** (ENG-18859, ENG-16346) | Fixed issue where 'Zoom to Selection' feature did not properly center the selected items on canvas in both Studio and Operations Manager. | | **IAP UI Login Performance** (ENG-18707) | Resolved slow login performance issue inItential Platform UI that persisted after upgrade to 6.3.0. Optimized authentication workflow for improved response times. | | **MOP Template Metadata Dialog** (ENG-18501) | Fixed issue where clicking the save button on metadata dialog for MOP Command Template or Analytic Template in projects caused import failures. | | **MOP Template Description Export** (ENG-18500) | Resolved issue where descriptions for MOP Command Templates and Analytic Templates were not included during project export. | | **Workflow Description Persistence** (ENG-18497) | Fixed issue where workflow description set during asset creation did not persist, and description field was missing in global space. | | **Transformation Extract Output** (ENG-18486) | Corrected issue where Transformation task did not properly set Extract Output when outgoing schemas were modified. Ensured proper output mapping. | | **Workflow Promotion Issues** (ENG-18475) | Fixed issue where workflows were missing after promoting a project from development to staging environment. Improved project promotion reliability. | | **Studio Task Palette Filter** (ENG-18463) | Resolved task palette filter misbehavior when palette was displayed in wide mode. Improved filter behavior across different display configurations. | | **Generate Example Inputs Data Loss** (ENG-18405) | Fixed issue where clicking "Generate Example Inputs" button wiped existing user data. Implemented proper data preservation logic. | | **Project Folder Creation** (ENG-18401) | Resolved inability to create folders within projects. Restored folder creation functionality. | | **NSO 6.5+ Host Header Validation** (ENG-18156) | Improved handling of HTTP 400 errors caused by strict Host header validation in NSO 6.5+. Enhanced compatibility with newer NSO versions. | | **Studio Canvas Task Corruption** (ENG-17868) | Fixed race condition that could place corrupted tasks on Studio canvas. Improved task placement synchronization. | | **Workflow Start Error State** (ENG-17841) | Resolved error state occurring on workflow Start node when variables were empty. Improved empty variable handling. | | **SLA Duration Input Validation** (ENG-17838) | Fixed issue where duration input in workflow's SLA/Pre-Automation Fields broke on invalid inputs. Added proper input validation. | | **JSON Forms Yang Widget Rendering** (ENG-17639) | Resolved rendering failures for JSON Forms utilizing Yang Widget. Ensured proper widget initialization and display. | | **Auth Methods Access Handling** (ENG-16755) | Fixed improper failure behavior when attempting to access authentication methods without proper permissions. Improved error handling and messaging. | | **JSON Form Builder Default Value** (ENG-16304) | Fixed inability to set default value of 0 in number fields within JSON Form Builder. Corrected value validation logic. | | **Event Listener Job Multi-Cluster** (ENG-15292) | Resolved failures of eventListenerJob task in multi-IAP clusters depending on number ofItential Platform instances. Improved cluster-aware task execution. | | **Command Template Regex in Transformation** (ENG-14421) | Fixed production issue with command template regex processing in transformations. Improved regex handling and validation. | | **Run Templates Diff Task** (ENG-13661) | Addressed issues preventing proper execution of Run Templates Diff task. Restored full task functionality. | | **Child Job Data Inconsistency** (ENG-12562) | Fixed inconsistent data display between canvas and Job Details view for P6 child jobs. Ensured consistent data representation. | | **JST Schema Property Names** (ENG-12304) | Resolved JST failure when schema property names contained the `#` character. Improved special character handling in schema properties. | | **JST Step Context Order** (ENG-12294) | Fixed JST errors occurring when step context order did not match data flow. Improved context resolution logic. | | **JST Designer Infer Functionality** (ENG-11251) | Resolved inconsistencies in JST Designer infer functionality including addition of empty "" property and data type mismatches. Improved schema inference accuracy. | | **Transformation Corruption** (ENG-10647) | Fixed production issue where transformations became corrupted and non-functional. Implemented safeguards against transformation corruption. | | **Integration Thread Count Limit** (ENG-9078) | Removed maximum threshold for IAP_INTEGRATION_THREAD_COUNT configuration to allow proper scaling for high-throughput scenarios. | | **Schema Combination Option Renaming** (ENG-7533) | Fixed issue where renaming an option in a schema combination cleared all added fields for that option. Preserved field data during rename operations. | | **Transformation Canvas Scrollbar** (ENG-7413) | Resolved production issue where transformation canvas scrollbar was not viewable. Improved UI layout and scrollbar visibility. | | **Transformation Function Closure** (ENG-7269) | Fixed issue where closing a function while parent transformation was open would offset transitions. Improved state management for nested transformations. | #### Security fixes (5) This release includes important security updates that address vulnerabilities in third-party packages and platform components. | Feature | Description | | ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Prototype Pollution in axios** (ENG-19229) | Updated axios package in itential-utils to resolve prototype pollution vulnerability. Enhanced input validation to prevent prototype chain manipulation. | | **Arbitrary Code Injection in jsonpath** (ENG-19223) | Updated jsonpath package to address arbitrary code injection vulnerability. Implemented proper input sanitization for JSONPath expressions. | | **Node.js Version Upgrade** (ENG-18855) | Upgraded Node.js versions in Platform Image to address security vulnerabilities and improve runtime security posture. | | **XSS in @remix-run/router** (ENG-18425) | Updated @remix-run/router package to resolve Cross-site Scripting (XSS) vulnerability. Enhanced input sanitization in routing components. | | **Incomplete Filtering in validator** (ENG-17677) | Updated validator package to address incomplete filtering of special elements vulnerability. Improved input validation and sanitization. | ## January 29, 2026 # 6.3.1 Platform 6.3.1 is a maintenance release containing enhancements, bug fixes, and security updates. #### Enhancements (1) | Improvement | Description | | ------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Workflow Engine Schema Validation** (ENG-18679) | Fixed invalid JSON schemas in Workflow Engine that were causing error-level logging messages during platform startup, improving system diagnostics and reducing log noise. | #### Bug fixes (12) | Feature | Description | | ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **API Token Authentication** (ENG-18885) | • Fixed issue where API tokens and service accounts were incorrectly returning 403 Forbidden errors• Restored proper authentication for token-based API access• Resolved authentication failures impacting automated integrations and service accounts | | **JSON Forms Dynamic Dropdowns** (ENG-18508) | • Fixed issue where JSON Forms with dynamic dropdowns displayed "undefined" when opening the dropdown• Resolved discrepancy between successful API call in form settings and failed runtime display• Ensured proper data population for dynamic POST request dropdowns | | **Job Variable Handling** (ENG-18151) | • Fixed job error "Cannot destructure property 'location' of '\_0x2f4fa8' as it is undefined"• Improved handling of missing job variables in push to array tasks• Addressed sub-optimal missing variable behavior causing job failures | | **Code Editor Component** (ENG-18068) | • Fixed race condition in BackgroundTokenizer causing "Cannot read properties of null (reading 'getLength')" errors• Resolved issue where code editor component attempted to access document properties after unmounting• Improved editor component lifecycle management | | **OAuth Client Visibility** (ENG-17392) | • Fixed issue where OAuth Client creation option remained visible when ITENTIAL_ADMIN_AUTH_PAGES_ENABLED environment variable was set to false• Ensured proper UI behavior for Cloud customers managing service accounts through Hub interface• Aligned interface options with environment variable configuration | | **OAuth2 Integration Models** (ENG-16320) | • Fixed validation failure when creating OAuth2-capable Integration Models following documentation examples• Resolved issues preventing proper OAuth2 authentication configuration• Ensured compatibility with OAuth2-enabled API integrations | | **JST Schema Editor** (ENG-12011) | • Fixed JST Designer Schema Editor errors occurring when property names contained forward slash (/) characters with incorrect types• Resolved validation errors in betterAjv.js library when processing properties with special characters• Restored proper save button functionality in schema editor | | **Masked Job Variables** (ENG-11192) | • Fixed issue where renaming masked job variables left orphaned decorator entries in workflows• Resolved problem where old variable names appeared as masked in Operations Manager despite no longer being referenced• Ensured decorator array properly updates when job variable names change | | **JST Pointer Connections** (ENG-10280) | • Fixed issue where JST pointers did not connect as expected when building map functions• Improved pointer behavior and connection logic in transformation designer• Enhanced user experience when creating complex transformations | | **JST Nested Functions Import** (ENG-10021) | • Fixed issue where JSTs with nested functions imported incorrectly• Resolved ID conflict handling during function flattening process• Ensured proper reference resolution when moving nested functions to root level | | **Transformation Scoping** (ENG-8392) | • Fixed incorrect scoping when creating transformations directly from child job task panel in unsaved workflows within projects• Resolved URL routing issue that caused loss of unsaved workflow changes• Ensured transformations are properly scoped to their containing project | | **Transformation Comment Timestamps** (ENG-6498) | • Fixed issue where comments on transformations displayed dates one month earlier than actual creation date• Corrected date formatting logic for transformation comment timestamps• Ensured accurate timestamp display for all transformation comments | #### Security fixes (1) Platform 6.3.1 includes important security updates that address vulnerabilities in third-party packages. | Feature | Description | | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | | **Out-of-bounds write vulnerability** (ENG-18428) | Updated gnupg2/gpgv package to resolve the CWE-787 Out-of-bounds Write vulnerability (CVSS Score: 7.0). | ## January 26, 2026 # 6.3.0 Itential Platform 6.3.0 is a minor release that includes Inventory Manager integration, Automation Studio enhancements, performance improvements, security updates, and critical bug fixes. This release addresses customer-reported issues and enhances platform stability and usability. For an overview of the highlights and key features in this release, see the [Platform 6.3.0 feature announcement](/release-notes/feature-announcements/630). #### Enhancements (9) | Feature | Description | | ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Inventory Manager** (ENG-18005) | Platform 6.3.0 adds Inventory Manager to the platform sidebar, providing integrated access to inventory management capabilities directly within the automation platform. **Benefits:** • Seamless navigation between automation workflows and inventory data • Improved efficiency for operations requiring device and asset information • Unified user experience across platform modules | | **Workflow Metadata Panel Deep Linking** (ENG-17257) | Added support for URL parameters that enable direct navigation to workflow metadata panels, improving integration with external tools like Insights. **New Capabilities:** • URL parameter support for automatically opening workflow metadata panel • Works for both global and project-scoped workflows • Enhanced tooltip help text for Pre-Automation Time and SLA Per Workflow fields • Improved user guidance for workflow performance tracking **Example URL:** `https://{instance}.itential.io/{workflowId}?expandMetadataPanelOnFirstWorkflowOpen=true` **Use Cases:** • Navigate directly from Insights performance data to workflow settings • Quick access to edit Pre-Automation Time for ROI calculations • Streamlined workflow configuration updates | | **Workflow engine optimization** (ENG-15586) | Added support for configurable rate limiting to control workflow task execution rates. **Benefits:** • Prevent system overload by controlling task execution speed • Maintain stable performance during high-volume workflow processing • Scale horizontally across multiple Platform instances | | Feature | Description | | ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Platform Responsiveness with Large Role Sets** (ENG-18555) | Resolved critical performance issues affecting instances with large numbers of roles and methods, particularly impacting adapters with extensive method collections. **Improvements:** • Faster login times when using LDAP or local authentication • Improved UI responsiveness in Admin Essentials and Operations Manager • Optimized workflow execution performance • Reduced timeout incidents with load balancers **Impact:** Customers with gateway adapters containing thousands of allowed methods will experience significantly improved platform performance. | | **Nested Indexed Array Support** (ENG-9417) | Fixed issue where nested indexed array elements in JSON Schema Transformation schemas were not selectable, enabling proper transformation configuration for complex data structures. | | **Special Character Handling in JST** (ENG-11898, ENG-11954) | • Resolved issues with `%` symbol in property names causing transformation failures • Fixed schema corruption when renaming properties containing special characters • Improved URI validation and error handling | | **Enhanced JST Error Reporting** (ENG-9088) | Regular expression errors in transformations are now properly captured and displayed in the UI, providing clear feedback to users instead of silent failures. | | **JST Schema Editability Improvements** (ENG-3512) | Resolved inconsistencies in incoming schema editability, ensuring consistent behavior regardless of how transformations are accessed (via method card or sidebar navigation). | | **JST Duplicate Name Handling** (ENG-7907) | Fixed issue allowing transformation renaming to duplicate names, preventing data display inconsistencies and confusion between transformations with identical names. | #### Bug fixes (13) | Feature | Description | | ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **AD-FS Identity Provider Authentication** (ENG-17545) | • Fixed issue where AD-FS IdP login succeeded with empty username • Added validation to prevent login when UPN value is missing • Enhanced logging to identify missing identity provider values • Improved error messages for authentication failures | | **CyberArk Reference Handling** (ENG-16734) | • Resolved issue where CyberArk secret path references in adapter configurations were incorrectly encrypted • Reference paths now remain intact, preventing adapter authentication failures | | **Scheduler Task Data References** (ENG-11487) | • Updated scheduler to use new task data reference format • Ensures consistency with workflow engine task document structure • Aligns scheduled tasks with current data management architecture | | **Job View Display** (ENG-4564) | • Fixed issue where job variables appeared empty in the 2023.2+ job view interface • Restored proper display of job variable data | | **doProvision Workflow Task Schema** (ENG-18195) | • Corrected input parameter schema definition from incorrect array type to proper object type • Resolves task execution failures due to schema validation mismatches • Ensures compatibility between API and task implementations | | **Integration Deletion** (ENG-16275) | • Fixed issue preventing integration deletion when confirmation dialog appeared • Resolved blank screen issue during integration deletion workflow | | **Project Workflow Import** (ENG-17839) | • Fixed issue where imported project workflows appeared in global scope instead of project space • Ensures proper workflow organization and namespace isolation | | **JSON Forms Transformation Bindings** (ENG-17772) | • Resolved mismatch between JSON form configuration view and runtime display • Ensures consistent form rendering across configuration and preview modes | | **Project JST Export/Import** (ENG-9553) | • Fixed issue where JSTs used in childJob tasks were duplicated during project export • Resolved JST renaming issues on project import • Eliminated orphaned JST copies in database after project operations | | **Prebuilt Transformation Import** (ENG-3435) | • Fixed issue where prebuilt import did not properly overwrite existing transformations with same name • Prevents duplicate transformations with different IDs | | **Large Data in Editor** (ENG-10557) | • Resolved issue where large data in workflow editor reformatted unexpectedly • Prevents unwanted "dirty state" triggering in workflows • Improves editor performance with large datasets | | **Mock Data Workflow Import** (ENG-17907) | • Fixed issue where workflows with mock data configured did not import properly | | **LCM Reference Handling** (ENG-16401) | • Resolved failures when cloning, pulling, or branching remote projects containing invalid LCM resource references • Replaced temporary error notification with dialog offering continue/cancel options for better error handling | #### Security fixes (2) | Feature | Description | | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **js-yaml Prototype Pollution** (ENG-17654) | • **Type:** Prototype Pollution vulnerability • **CVSS Score:** 6.9 • **Impact:** Addressed vulnerability that could allow attackers to alter object prototypes through specially crafted YAML documents • **Status:** Resolved through dependency update | | **qs Package Resource Allocation** (ENG-18115) | • **Type:** Allocation of Resources Without Limits or Throttling • **CVSS Score:** 8.7 • **Impact:** Fixed vulnerability that could cause server memory exhaustion through bracket notation parameter abuse • **Status:** Resolved through dependency update | ## December 19, 2025 # 6.2.0 Platform 6.2.0 is a minor release that introduces Canvas Mock mode, along with bug fixes and security updates. For an overview of the highlights and key features in this release, see the [Platform 6.2.0 feature announcement](/release-notes/feature-announcements/620). #### Enhancements (8) | Feature | Description | | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Canvas mock data validation** (ENG-13565) | Added mock data validation to verify that test data conforms to workflow requirements before execution. The feature provides visual feedback when mock data requires updates, such as when tasks or transitions are missing or when schema mismatches occur. | | **Operations Manager failure iconography for tasks** (ENG-13432) | Updated task icons to support failure iconography in Operations Manager for query and manual tasks. | | **JSON-formatted logging API support** (ENG-15618) | Added support for JSON-formatted logging and updated the logging API to align with the HLD specification, including support for message and context objects. | | **Relocatable RPM installation support** (ENG-15941, ENG-17185) | Added support for relocatable RPM-based installation into custom directories using the --relocate flag. Multiple custom service directories can be specified with a comma-delimited list in the `service_directory` configuration property. | | **Service Manager RPM SHA256 checksums** (ENG-16405) | Added SHA256 checksums for Service Manager 6 RPM packages on both x86_64 and ARM64 architectures to verify package integrity and ensure they haven't been tampered with. | | **Automation Triggers formData wrapping label** (ENG-16440) | Updated the formData wrapping option in Automation Triggers to use clearer, feature-focused language. The term "legacy" has been removed from labels and tooltips. | | **Docker image sudo configuration removal** (ENG-16454) | Removed sudo configuration from Docker images as it is no longer needed for the TemplateBuilder jail. | | **Workflow selection area name display** (ENG-16660) | Expanded the workflow selection area to display more of the workflow's name. | For more information about our highlighted feature improvements for this release, see [Platform 6.2 Feature Release Announcement](/itential-platform/release-notes/feature-announcements/620). #### Bug fixes (55) | Feature | Description | | ------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Operations Manager auto-work reliability** (ENG-2675) | Improved the reliability of the auto work feature in Operations Manager. | | **Automatic integration model validation on upload** (ENG-2939) | Added automatic integration model validation on upload to support OpenAPI specifications like Netbox. | | **JST canvas live preview error styling** (ENG-3382) | Corrected the styling and removal of live preview errors in JST canvas. | | **Lifecycle Manager Resource Instance defaults** (ENG-3699) | Fixed an issue where sensible defaults weren't being provided to new Resource Instance forms in Lifecycle Manager, which caused save and modification failures. | | **Show JSON Form task slash in form name** (ENG-4761) | Resolved an issue where the Show JSON Form task failed when slashes were present in the form name. | | **Applications submenu missing from Studio** (ENG-5851) | Fixed an issue where the "Applications" submenu was missing from Automation Studio. | | **JSON Form import name with parentheses** (ENG-6243) | Fixed a bug where importing a JSON Form with a name containing text in parentheses caused the system to append "NaN)" to the name, leading to duplicate forms with incorrect names. | | **Search palette canvas styling when closed** (ENG-6600) | Prevented the search styling from activating when the search palette is not open in canvas. | | **isError variable exclusion from input schema** (ENG-7171) | Added a check to exclude variables with the isError flag from the input schema while maintaining them in the output schema. | | **Run window job variable schema regeneration** (ENG-7284) | Fixed a schema regeneration bug that occurred when disabling the run window with a job variable. | | **Operations Manager missing form graceful handling** (ENG-7412) | Missing forms are now gracefully handled in Operations Manager manual tasks. | | **LCM action pre-JST dollar sign encoding** (ENG-7789) | Fixed a Lifecycle Manager action pre-JST encoding bug where dollar sign (\$) characters in workflow schemas appeared as "2". | | **Job description search filter trailing characters** (ENG-7957) | Updated the job description search filter to preserve trailing dots and zeros in search queries. | | **JSON Form state sharing between tabs** (ENG-7969) | Resolved an issue where switching between different JSON forms in separate tabs caused form state to be incorrectly shared, leading to dropdown option changes in one form appearing in another. | | **Broker logging for adapter exclusion and device lookup** (ENG-7999, ENG-13934) | Enhanced broker logging to provide better diagnostics when adapters are excluded, devices cannot be found during command execution, or when communicating with Gateway over the device broker. | | **Project import duplicate ID detection** (ENG-8052, ENG-8066) | Fixed project import issues including duplicate project ID detection and preventing multiple copies from being created when "import" is clicked too quickly. | | **Task deletion transition cleanup** (ENG-8465, ENG-8490) | Improved task deletion behavior to only remove transitions to and from the deleted task and fixed validation errors that occurred when deleting tasks referenced in run window schedules or used as job references. | | **updateForm API stale data return** (ENG-8550) | Fixed the updateForm API to return updated data instead of stale data. | | **Unsaved changes dialog on workflow navigation** (ENG-9350) | Improved the unsaved changes dialog interaction during workflow navigation. | | **LCM special character sanitization in action names** (ENG-9431) | Lifecycle Manager now sanitizes special characters (&, +) in action names for workflows. Previously, it would fail to create the workflow. | | **Workflow created date typo fix** (ENG-9839) | Fixed a typo that caused incorrect created dates for new workflows in projects. | | **Integration Engine model resolution performance** (ENG-9902) | Fixed performance issues in the Integration Engine that caused extended processing times when resolving integration models. | | **Add Asset To Project continue button state** (ENG-9906) | The "Add Asset To Project" continue button now properly disables when the project selection is cleared. | | **Task Palette canvas click block when closed** (ENG-10228) | Fixed an issue where the Task Palette blocked clicking on canvas when closed. | | **RPM directory ownership correction** (ENG-10282) | RPMs are now bundled with all directories owned by itential, correcting directory ownership. | | **Automation workflow dropdown componentId update** (ENG-10378) | Selecting a new workflow in the dropdown of an automation now correctly updates both componentId and componentName in the database. | | **Manual Adapter ID entry in Studio** (ENG-10417) | Fixed Manual Entry of task Adapter IDs within Automation Studio, which was preventing users from entering Adapter IDs that are not currently present. | | **Child job orphaned JST canvas crash** (ENG-10656) | Resolved an issue where child jobs with references to orphaned or deleted JSTs would crash the canvas UI when viewing the child job's properties. | | **Automation group selection pagination limit** (ENG-10752) | Fixed pagination limits for group selection in automation properties to support more than 100 groups. | | **NPM artifact internal file inclusion** (ENG-10955) | Fixed an issue where internal files were incorrectly included with NPM artifacts. | | **LCM action execution navigation** (ENG-11413) | Resolved an issue where opening a Lifecycle Manager (LCM) action execution from workflow tasks was not navigating correctly. | | **Task documentation links to 2023.2** (ENG-11433) | Updated task documentation links to point to 2023.2 until Platform 6 documentation links are stable. | | **Studio git group-based project access** (ENG-11482) | Enhanced the git permissions verification system in Automation Studio to properly support group-based project access, ensuring users with group membership have appropriate access to git operations. | | **LCM resource model workflow identifier string type** (ENG-11709) | Added string type support to the workflow identifier in the resource model JSON schema, allowing imported LCM models with missing Action workflows to be modified. | | **Job document null variable migration crash** (ENG-12302) | Fixed an issue where incoming variable objects in jobs that were set to null would crash Workflow Engine on startup while attempting to migrate job documents. | | **Integration TLS settings on token retrieval** (ENG-12883) | Fixed an issue where integrations were not respecting TLS settings when a token retrieval step was configured. | | **Asset JSON export with unsaved changes blob** (ENG-12946) | Fixed a bug where exporting an asset as JSON would display the exported blob if the workflow had unsaved changes. | | **Syslog transport error handler** (ENG-13718) | Added an error handler to the syslog transport to prevent application crashes when the transport encounters errors. | | **Broker logging for excluded adapters and devices** (ENG-13934) | Enhanced broker logging to provide better diagnostics when adapters are excluded or devices cannot be found during command execution. | | **Evaluation task strictTypes option** (ENG-14609) | Added a "strictTypes" option to the evaluation task that skips all operand type inference when evaluating operand values, resolving comparison issues between numeric and non-numeric strings. | | **Config Manager invalid configuration crash** (ENG-14934) | Configuration Manager no longer crashes when invalid configuration is provided. | | **Config Manager manual tasks in build** (ENG-15154) | Configuration Manager manual tasks are now included in the build and can be successfully executed. | | **Loop transition validation in workflow engine** (ENG-15804) | Added loop transition validation to the backend workflow engine to prevent invalid transitions from inside a loop to outside of a loop. | | **Jinja2 template newline JSON parse error** (ENG-15926) | Fixed Jinja2 template result JSON parsing errors that occurred when newlines were present. | | **Project import asset reference conflict errors** (ENG-16090, ENG-16401, ENG-17319) | Improved project import error handling including clearer error messages for asset reference conflicts, graceful handling of missing LCM resource references with continue/cancel options, and fixed race conditions when multiple workflows reference non-existent user accounts. | | **Rename failure UI revert to original name** (ENG-16261) | Ensured that when a rename operation fails (e.g., due to duplicate names), the UI reverts to the original name and displays an appropriate error message. | | **Project iid=0 URL blank page fix** (ENG-16377) | Fixed a bug where opening a project with iid=0 in the URL showed a blank page instead of redirecting to the first available asset. | | **NSO adapter getDevicesFiltered compliance fix** (ENG-16459) | Fixed an issue in adapter-nso where getDevicesFiltered failed to return devices, causing device loading errors in Compliance Plans. | | **Automation import duplicate trigger fix** (ENG-16989) | Fixed an issue where importing an automation that already exists would duplicate triggers. | | **Dead process checker service ping suppression** (ENG-16994) | Stopped unnecessary service ping packets from being sent when the dead process checker is disabled. | | **FIPS-compliant SSH key algorithms in NSO adapter** (ENG-17044) | Added support for all FIPS-compliant SSH key algorithms in the NSO adapter, resolving connection failures on RHEL systems running in FIPS mode. Updated underlying SSH libraries to ensure compatibility without relying on non-approved keys like ssh-ed25519. | | **Render JSON Schema form display fix** (ENG-17274) | Fixed an issue where render JSON Schema wouldn't display the form. | | **Manual trigger form pre-populated data display** (ENG-17347) | Fixed manual trigger forms not displaying pre-populated data when clicking "Run Now" and restored "Save and Run" functionality to immediately execute jobs instead of opening the run window. | | **AG Manager configuration on cluster restart** (ENG-17458, ENG-17558) | Improved AG Manager configuration handling duringItential Platform cluster restarts. AG Manager now self-manages its configuration setup on application start, and Core excludes AG Manager from its initial configuration broadcast to prevent temporary loss of methods. | | **phui files restore for dynamic forms** (ENG-17596) | Re-added missing phui and supporting files to restore dynamic form functionality. | #### Security fixes (2) | Feature | Description | | -------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | **jws cryptographic signature verification** (ENG-17553) | Updated the jws dependency to resolve an improper verification of cryptographic signature vulnerability. | | **xml2js security update in NSO adapter** (ENG-17694) | Upgraded xml2js to v0.6.0 in adapter-nso, resolving parsing issues and security vulnerabilities while improving overall stability. | ## November 5, 2025 # 6.1.2 Platform 6.1.2 is a maintenance release containing enhancements, bug fixes, and security updates. #### Enhancements (3) | Feature | Description | | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Canvas Debug Mode UI enhancements** (ENG-16048, ENG-16050, ENG-16055, ENG-16056) | Improved Canvas Debug Mode usability with UI enhancements including renaming the "Mock Data" tab to "Mocked Tasks", relocating the delete scenario button, better indication of required fields, and clearer messaging for failure transition outputs. | | **AG Manager Redis-based configuration storage** (ENG-16182) | AG Manager now uses Redis-based configuration storage for automatic cluster-wide synchronization. For more information, see Automatic discovery in Gateway. | | **Mock Data failure transition output display** (ENG-16456) | Updated the failure transition type view in the Mock Data dialog to display "output is null" for improved user experience. | #### Bug fixes (18) | Feature | Description | | --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Manual tasks in MOP templates and Form Builder** (ENG-16710) | Restored functionality for manual tasks in MOP templates and Form Builder. | | **Forms blocked by failed jQuery query calls** (ENG-16481) | Resolved issue where forms were blocked by failed query calls. Forms now execute successfully within workflows despite jQuery dependency issues. | | **Integration Model OpenAPI 3.0.4 rejection** (ENG-16268) | Updated the Integration Model import process to reject OpenAPI 3.0.4 models, preventing compatibility issues. Integration Models without authentication now work as expected. | | **Template Builder without tmp directory access** (ENG-16175) | Template Builder now operates without requiring access to the `/tmp/iap_python_jail` directory or sudo chroot access to run Jinja2 templates, enabling functionality in STIG'ed and FIPS-enabled environments. | | **Asset tab workflow drag to childJob task** (ENG-15842) | Enabled dragging workflows from the Asset tab to automatically create childJob tasks with properly populated incoming variables based on the workflow's input schema. | | **Operations Manager GBAC automation import** (ENG-15672) | Fixed import issue in Operations Manager where Automations with GBAC groups that don't exist on the target system would import but remain inaccessible. Automations are now properly visible after import. | | **Save and Run button trigger execution** (ENG-15306) | Corrected the 'Save and Run' button functionality to properly execute triggers after saving. | | **Ops Manager excessive myTtl API calls** (ENG-15201) | Eliminated excessive API calls to `/myTtl` from Operations Manager. | | **Workflow rename metadata UI display** (ENG-10398) | Fixed issue where renaming a workflow from the metadata would prevent the UI from displaying tasks and connections in Automation Studio. | | **Service discovery index creation race condition** (ENG-9934) | Resolved race condition in service discovery during index creation in high availability environments. | | **Integration instance configurable timeout** (ENG-8982) | Added support for configurable timeout values on integration instances, restoring timeout functionality. | | **Studio engineer/operator role unauthorized error** (ENG-7332) | Users with default "engineer" and "operator" roles no longer see unauthorized access error messages on the Studio landing page. | | **Recent Tasks palette on workflow open** (ENG-6662) | Resolved issue where the Recent Tasks palette failed to populate when opening a workflow. | | **Project Builder sort page position** (ENG-4949) | Fixed sorting in Project Builder to maintain current page position after sorting and implement case-insensitive alphabetical ordering. | | **JST ID search crash in Studio collections** (ENG-4110) | Corrected issue where searching for a JST by ID in the Studio collections dialog caused the Itential Platform UI to crash. Search now functions as expected. | | **Job variable read-only in reference view mode** (ENG-3183) | Job variables can no longer be modified when a user is in reference view mode. | | **Project asset naming and linking in search** (ENG-2894) | Corrected naming convention for project assets in system search results and fixed linking to project assets. | | **Project asset search special character escaping** (ENG-2890) | Implemented regex expression to properly escape special characters when searching for workflows in Studio. | #### Security fixes (5) | Feature | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Multiple Snyk vulnerabilities by upgrading dependencies...** (ENG-13145, ENG-13147, ENG-16416, ENG-16642, ENG-16656, ENG-16657, ENG-16658, ENG-16673, ENG-16677) | Resolved multiple Snyk vulnerabilities by upgrading dependencies across coreItential Platform components, adapters, and applications. | | **Operations Manager automation XSS fix** (ENG-15651, ENG-15652, ENG-15653, ENG-15750, ENG-15751) | Fixed DOM-based XSS vulnerabilities in Operations Manager automation interface, DeviceGroup Titlebar component, and SVG rendering. Implemented URL sanitization in useUserGroupedAppsQuery.jsx. | | **URL component Open Redirect sanitization** (ENG-15654) | Implemented URL component sanitization to resolve Open Redirect vulnerability in src/common/utils.js. | | **axios resource allocation vulnerability** (ENG-15657, ENG-15676) | Updated axios to version 1.12.2 to address resource allocation vulnerability. | | **Path traversal vulnerability in itential-utils** (ENG-15669, ENG-16310) | Resolved path traversal vulnerabilities by enhancing file path validation in itential-utils. | ## October 8, 2025 # 6.1.1 Platform 6.1.1 is a maintenance release containing enhancements, bug fixes, and security updates. #### Enhancements (12) This release introduces the following enhancements to the Itential Platform. | Feature | Description | | --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | **Resource discovery unit tests** (ENG-9617) | Added unit tests to resource-discovery list.test.js and validate.test.js. | | **Unused files and dependencies removal** (ENG-10705) | Removed all unused files, code, and dependencies in Platform 6. | | **Child job variable masking** (ENG-11320) | Updated the Child Job task to support masking of incoming and outgoing variables. | | **Transformation task variable masking** (ENG-11321) | All input and output variables configured on a Transformation task are now individually maskable. | | **Task execution actor type restriction** (ENG-11352) | Added support for restricting task execution based on actor type. Implemented this functionality for Studio's getProject method. | | **Redis initial connection timeout config** (ENG-11965) | Added a configurable timeout parameter for initial Redis connection during Platform startup. | | **JSON Forms JST dependency removal** (ENG-12858) | Removed JSON Forms dependency on the JST library by using HTTP API calls to retrieve and run transformations in dynamic dropdowns. | | **Workflow Engine task worker rate limiting** (ENG-13929) | Added rate limiting to the Workflow Engine task worker to improve system stability under high load. | | **TLS version configuration support** (ENG-14617) | Added support for configuring minimum and maximum TLS versions (including TLS 1.3) used by theItential Platform web server. | | **Canvas transition color accessibility** (ENG-14860) | Updated Success and Loop transition line colors in Canvas to meet accessibility standards. | | **BullMQ shutdown cleanup** (ENG-14995) | Configured BullMQ cleanup on shutdown to improve resource management. | | **Web server total_time_ms log field** (ENG-15813) | Added `total_time_ms` field to webserver.log, which measures request-to-response time in milliseconds. | #### Bug fixes (27) Platform 6.1.1 release includes fixes for potential bugs and issues detected in a controlled testing environment before making the software available. | Feature | Description | | --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Studio search with special characters in names** (ENG-2571) | Fixed a search issue that prevented templates and transformations containing special characters (e.g., '`*`') from being found in the Project builder. | | **Unusable shortcuts for transformations within projects** (ENG-2891) | Removed unusable shortcuts for transformations within projects. | | **Canvas controls cut off in project editor** (ENG-3420) | Fixed an issue where Canvas controls on a transformation were partially cut off when the function tab bar was opened in the Projects editor. | | **JSON Form file upload size error message** (ENG-4769) | Improved the error message displayed when uploading files via JSON Form that exceed the maximum size limit. | | **Workflow group with project assets restriction** (ENG-4774) | Fixed an issue that incorrectly allowed users to create Workflow Groups with Project assets. | | **Studio read-only banner accuracy** (ENG-5403) | The read-only banner now displays only when users truly have read-only access to projects. | | **Device count failure handling** (ENG-8269) | Fixed an issue that caused device counts to fail when devices couldn't be found, and resolved cases where device counts of 0 were not recorded. | | **Integration instance log settings** (ENG-8932) | Fixed Integration Instances to correctly refer to their individual log settings rather than the Platform-level log configuration when logging request activity. | | **Compliance report error tooltip** (ENG-9267) | Added a tooltip to display quick error messages for items with 'error' status in compliance reports. | | **Create group API role assignment** (ENG-9372) | Fixed an issue where groups and roles added to a custom group via the create group API were not properly reflected on users in the new group. | | **Health API Vault status check** (ENG-9451) | Fixed invalid healthcheck in the Health API to ensure accurate Vault status reporting at the `/health/status` endpoint. | | **Integration model conversion error handling** (ENG-9559) | Fixed an issue where Integration Models that errored during conversion caused subsequent Integration Models to fail to load into the platform. | | **iapGetAdapterQueue debug task** (ENG-10281) | Added `iapGetAdapterQueue` task to improve debugging when the automation gateway adapter produces TimeoutOverflowWarning errors with throttling enabled. | | **JST incoming/outgoing schema issues** (ENG-10352) | Fixed multiple JST issues related to special characters in schema `$id`, property names, and function names that could prevent assignments from being drawn or cause JST runtime failures. Also improved error visibility in the schema editor and added notifications for invalid assignments. | | **Project import createdBy field failure** (ENG-10364) | Fixed an issue where projects containing workflows with a `createdBy` field would fail to import by removing this field during import. | | **Task worker shutdown scheduled task impact** (ENG-10795) | Fixed an issue where stopping the task worker affected the ability to handle scheduled tasks until the instance was restarted. | | **Transformation internal function backspace delete** (ENG-10848) | Fixed an issue where transformation internal functions disappeared when pressing backspace. | | **JST if-else conditional path evaluation** (ENG-11148) | Fixed a JST issue where adding an else-if conditional path from the if...else method did not properly update subsequent conditional paths, causing incorrect evaluation. Added a warning when opening corrupted transformations to notify users. | | **JSON schema date formatting on copy to project** (ENG-12405) | Fixed date formatting for JSON schemas when copying assets into a project space. | | **getTriggers deleted JSON form error** (ENG-14364) | Fixed an issue with the getTriggers API where schedule triggers referencing non-existent JSON forms returned errors, preventing other triggers from working. | | **Project import asset loss** (ENG-14405) | Fixed an issue that caused loss of assets when importing a project. | | **AG Manager task execution crash handling** (ENG-14483) | Added additional error handling to prevent crashes during AG Manager task executions. | | **Asset tab task outgoing variable loss** (ENG-14897) | Fixed an issue where adding a Child Job, Show JSON Form, Run Command/Analytic Template, or Apply Template task from the Assets tab stripped outgoing variables from the task. | | **Loop-to-outside transition prevention** (ENG-14970) | Prevented users from drawing transitions from inside a loop to outside a loop. | | **Operations Manager ancestor job query performance** (ENG-15013) | Fixed Operations Manager Jobs page stability issues that occurred with many jobs having more than 1,000 ancestor jobs. Updated the page to minimize database queries and resolved UI issues with the jobs table. | | **Event system and web server separation** (ENG-15227) | Separated the Platform Event System from the HTTP Web Server process to eliminate the impact of high event throughput on platform performance. | | **Duplicate key error message** (ENG-15538) | Updated error message when duplicate keys cause issues. | #### Security fixes (14) Platform 6.1.1 includes important security updates that address vulnerabilities in third-party packages and enhance data protection measures. | Feature | Description | | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **semver vulnerable version update** (ENG-11009) | Updated packages to resolve security vulnerabilities in the semver package. | | **d3-color security update** (ENG-11632) | Fixed security vulnerability in the d3-color package. | | **Config Manager XSS in export functions** (ENG-13131) | Enhanced Configuration Manager export functions with secure download functionality, including data sanitization and safer DOM manipulation to prevent XSS vulnerabilities across all export operations (device groups, backups, golden configs, templates, compliance plans, and config parsers). | | **Dev Tools repository removal** (ENG-13182) | Removed Dev Tools from the repository (not customer-impacting). | | **axios 1.11.0 security update** (ENG-15142) | Updated axios to version 1.11.0 to fix security vulnerability. | | **express and body-parser security update** (ENG-15175) | Updated express and body-parser to resolve security vulnerabilities. | | **express and body-parser security update** (ENG-15176) | Updated express and body-parser to resolve security vulnerabilities. | | **express and body-parser security update** (ENG-15177) | Updated express and body-parser to resolve security vulnerabilities. | | **express and body-parser security update** (ENG-15178) | Updated express and body-parser to resolve security vulnerabilities. | | **express and body-parser security update** (ENG-15179) | Updated express and body-parser to resolve security vulnerabilities. | | **Cookie XSS security update** (ENG-15181) | Updated express and body-parser to resolve XSS vulnerability in cookie. | | **express body-parser XSS security update** (ENG-15450) | Updated express and body-parser to resolve XSS vulnerability. | | **Emotion @babel/runtime vulnerability** (ENG-15510) | Updated emotion dependencies to fix vulnerability in @babel/runtime. | | **Emotion packages and axios security update** (ENG-15512) | Upgraded @Emotion packages (css, react, styled) and axios from 1.8.4 to 1.12.2 to address resource allocation security issues. | ## October 3, 2025 # 6.1.0 > **Warning** > > Platform 6.1.0 artifacts have been removed from the Itential Artifact Repository. We apologize for any inconvenience. Platform 6.1.0 is a minor release that introduces variable masking, along with bug fixes and security updates. For an overview of the highlights and key features in this release, see the [Platform 6.1.0 feature announcement](/release-notes/feature-announcements/610). #### Enhancements (13) | Feature | Description | | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **AG Manager dynamic config advertisement** (ENG-5655) | The AG Manager now advertises configuration changes to the Platform dynamically and waits for adapters to come online during platform startup, ensuring more reliable resource discovery without requiring restarts. | | **Resource discovery unit tests** (ENG-9617) | Added unit tests to `resource-discovery list.test.js` and `validate.test.js`. | | **Unused files and dependencies removal** (ENG-10705) | Removed all unused files, code, and dependencies in Platform 6. | | **Child job variable masking** (ENG-11320) | Updated the child job task to support masking of incoming and outgoing variables. | | **Transformation task variable masking** (ENG-11321) | All input and output variables configured on a transformation task are now individually maskable. | | **Task execution actor type restriction** (ENG-11352) | Added support for restricting task execution based on actor type. Implemented this functionality for Studio's `getProject` method. | | **Redis initial connection timeout config** (ENG-11965) | Added a configurable timeout parameter for initial Redis connection during Platform startup. | | **JSON Forms JST dependency removal** (ENG-12858) | Removed JSON Forms dependency on the JST library by using HTTP API calls to retrieve and run transformations in dynamic dropdowns. | | **rate limiting to the Workflow Engine task worker to...** (ENG-13929) | Added rate limiting to the Workflow Engine task worker to improve system stability under high load. | | **TLS version configuration support** (ENG-14617) | Added support for configuring minimum and maximum TLS versions (including TLS 1.3) used by theItential Platform web server. | | **Canvas transition color accessibility** (ENG-14860) | Updated success and loop transition line colors in Canvas to meet accessibility standards. | | **BullMQ shutdown cleanup** (ENG-14995) | Configured BullMQ cleanup on shutdown to improve resource management. | | **Web server total_time_ms log field** (ENG-15813) | Added `total_time_ms` field to `webserver.log`, which measures request-to-response time in milliseconds. | #### Bug fixes (28) | Feature | Description | | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **search issue that prevented templates and transforma...** (ENG-2571) | Fixed a search issue that prevented templates and transformations containing special characters (e.g., `*`) from being found in the project builder. | | **unusable shortcuts for transformations within projects.** (ENG-2891) | Removed unusable shortcuts for transformations within projects. | | **Canvas controls on a transformation were partially c...** (ENG-3420) | Fixed an issue where Canvas controls on a transformation were partially cut off when the function tab bar was opened in the projects editor. | | **the error message displayed when uploading files via...** (ENG-4769) | Improved the error message displayed when uploading files via JSON Form that exceed the maximum size limit. | | **that incorrectly allowed users to create workflow gr...** (ENG-4774) | Fixed an issue that incorrectly allowed users to create workflow groups with project assets. | | **The read-only banner now displays only when users tr...** (ENG-5403) | The read-only banner now displays only when users truly have read-only access to projects. | | **Device count failure handling** (ENG-8269) | Fixed an issue that caused device counts to fail when devices couldn't be found, and resolved cases where device counts of 0 were not recorded. | | **Integration instance log settings** (ENG-8932) | Fixed integration instances to correctly refer to their individual log settings rather than the Platform-level log configuration when logging request activity. | | **Compliance report error tooltip** (ENG-9267) | Added a tooltip to display quick error messages for items with 'error' status in compliance reports. | | **Create group API role assignment** (ENG-9372) | Fixed an issue where groups and roles added to a custom group via the create group API were not properly reflected on users in the new group. | | **Health API Vault status check** (ENG-9451) | Fixed invalid healthcheck in the Health API to ensure accurate Vault status reporting at the `/health/status` endpoint. | | **Integration model conversion error handling** (ENG-9559) | Fixed an issue where integration models that errored during conversion caused subsequent integration models to fail to load into the platform. | | **iapGetAdapterQueue debug task** (ENG-10281) | Added `iapGetAdapterQueue` task to improve debugging when the automation gateway adapter produces `TimeoutOverflowWarning` errors with throttling enabled. | | **JST incoming/outgoing schema issues** (ENG-10352) | Fixed multiple JST issues related to special characters in schema `$id`, property names, and function names that could prevent assignments from being drawn or cause JST runtime failures. Also improved error visibility in the schema editor and added notifications for invalid assignments. | | **Project import createdBy field failure** (ENG-10364) | Fixed an issue where projects containing workflows with a `createdBy` field would fail to import by removing this field during import. | | **Task worker shutdown scheduled task impact** (ENG-10795) | Fixed an issue where stopping the task worker affected the ability to handle scheduled tasks until the instance was restarted. | | **Transformation internal function backspace delete** (ENG-10848) | Fixed an issue where transformation internal functions disappeared when pressing backspace. | | **JST if-else conditional path evaluation** (ENG-11148) | Fixed a JST issue where adding an else-if conditional path from the `if...else` method did not properly update subsequent conditional paths, causing incorrect evaluation. Added a warning when opening corrupted transformations to notify users. | | **JSON schema date formatting on copy to project** (ENG-12405) | Fixed date formatting for JSON schemas when copying assets into a project space. | | **getTriggers deleted JSON form error** (ENG-14364) | Fixed an issue with the `getTriggers` API where schedule triggers referencing non-existent JSON forms returned errors, preventing other triggers from working. | | **Project import asset loss** (ENG-14405) | Fixed an issue that caused loss of assets when importing a project. | | **AG Manager task execution crash handling** (ENG-14483) | Added additional error handling to prevent crashes during AG Manager task executions. | | **Asset tab task outgoing variable loss** (ENG-14897) | Fixed an issue where adding a child job, show JSON form, run command/analytic template, or apply template task from the Assets tab stripped outgoing variables from the task. | | **Loop-to-outside transition prevention** (ENG-14970) | Prevented users from drawing transitions from inside a loop to outside a loop. | | **Operations Manager ancestor job query performance** (ENG-15013) | Fixed Operations Manager jobs page stability issues that occurred with many jobs having more than 1,000 ancestor jobs. Updated the page to minimize database queries and resolved UI issues with the jobs table. | | **Event system and web server separation** (ENG-15227) | Separated the Platform Event System from the HTTP Web Server process to eliminate the impact of high event throughput on platform performance. | #### Security fixes (14) | Feature | Description | | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **semver vulnerable version update** (ENG-11009) | Updated packages to resolve security vulnerabilities in the `semver` package. | | **d3-color security update** (ENG-11632) | Fixed security vulnerability in the `d3-color` package. | | **Config Manager XSS in export functions** (ENG-13131) | Enhanced Configuration Manager export functions with secure download functionality, including data sanitization and safer DOM manipulation to prevent XSS vulnerabilities across all export operations (device groups, backups, golden configs, templates, compliance plans, and config parsers). | | **Dev Tools repository removal** (ENG-13182) | Removed Dev Tools from the repository (not customer-impacting). | | **axios 1.11.0 security update** (ENG-15142) | Updated axios to version 1.11.0 to fix a security vulnerability. | | **express and body-parser security update** (ENG-15175) | Updated express and body-parser to resolve security vulnerabilities. | | **express and body-parser security update** (ENG-15176) | Updated express and body-parser to resolve security vulnerabilities. | | **express and body-parser security update** (ENG-15177) | Updated express and body-parser to resolve security vulnerabilities. | | **express and body-parser security update** (ENG-15178) | Updated express and body-parser to resolve security vulnerabilities. | | **express and body-parser security update** (ENG-15179) | Updated express and body-parser to resolve security vulnerabilities. | | **Cookie XSS security update** (ENG-15181) | Updated express and body-parser to resolve XSS vulnerability in cookie. | | **express body-parser XSS security update** (ENG-15450) | Updated express and body-parser to resolve XSS vulnerability. | | **Emotion @babel/runtime vulnerability** (ENG-15510) | Updated emotion dependencies to fix vulnerability in `@babel/runtime`. | | **Emotion packages and axios security update** (ENG-15512) | Upgraded `@Emotion` packages (css, react, styled) and axios from 1.8.4 to 1.12.2 to address resource allocation security issues. | ## September 5, 2025 # 6.0.8 Platform 6.0.8 is a maintenance release containing enhancements, bug fixes, and security updates. #### Enhancements (2) | Feature | Description | | ----------------------------------------------------------- | -------------------------------------------------------------------------------------------- | | **PEM-encoded TLS cert support** (ENG-12771) | Added support for PEM-encoded TLS certs for Redis, MongoDB, CyberArk, and Express webserver. | | **LDAP adapter custom group login restriction** (ENG-13638) | Added LDAP adapter property to restrict login to custom groups. | #### Bug fixes (6) | Feature | Description | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | | **Project homepage table scrolling** (ENG-5029) | Fixed table scrolling on the projects homepage. | | **Project template large output view** (ENG-10276) | Fixed an issue viewing templates with large outputs in projects. | | **Project asset move corruption fix** (ENG-14157) | Fixed an issue where moving assets between projects could make projects unusable. | | **SSO login NameID null handling** (ENG-14293) | Fixed a bug where logging into Itential through an SSO provider that fails to provide a `NameID` value would result in incorrect login behavior. | | **CyberArk CCP secrets provider health status** (ENG-14423) | The `/health/status` API now correctly identifies CyberArk CCP as the secrets provider. | | **SLA zero value jobSlaBreach event** (ENG-14521) | Fixed jobs where SLA set to 0 incorrectly triggered `jobSlaBreach` events. | #### Security fixes (29) | Feature | Description | | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **DOMPurify security update** (ENG-11630) | Updated `DOMPurify` dependency to address a security vulnerability. | | **Config Manager XSS in SearchDialog export** (ENG-13132) | Fixed XSS vulnerability in Configuration Manager `SearchDialog` by adding a secure download function, sanitizing remote data, and using `setAttribute` for DOM manipulation. Applied fixes to all six export functions. | | **Config Manager XSS in SearchDialog export** (ENG-13133) | Fixed XSS vulnerability in Configuration Manager `SearchDialog` by adding a secure download function, sanitizing remote data, and using `setAttribute` for DOM manipulation. Applied fixes to all six export functions. | | **Config Manager XSS in export function** (ENG-13141) | Fixed XSS vulnerability in Configuration Manager `SearchDialog` by adding a secure download function, sanitizing remote data, and using `setAttribute` for DOM manipulation. Applied fixes to all six export functions. | | **Config Manager XSS in export function** (ENG-13143) | Fixed XSS vulnerability in Configuration Manager `SearchDialog` by adding a secure download function, sanitizing remote data, and using `setAttribute` for DOM manipulation. Applied fixes to all six export functions. | | **Config Manager XSS in export function** (ENG-13144) | Fixed XSS vulnerability in Configuration Manager `SearchDialog` by adding a secure download function, sanitizing remote data, and using `setAttribute` for DOM manipulation. Applied fixes to all six export functions. | | **Config Manager exportJson XSS fix** (ENG-13161) | Fixed XSS vulnerability in Configuration Manager `exportJson` function by adding filename sanitization and using `setAttribute` instead of direct property assignment. | | **Config Manager PageContainer XSS fix** (ENG-13162) | Fixed XSS vulnerability in Configuration Manager `PageContainer` by sanitizing backup names and replacing object spread with direct prop assignment. | | **ConfirmInstances instance name XSS fix** (ENG-13163) | Fixed XSS vulnerability in `ConfirmInstances.jsx` by sanitizing `instance.name` rendering to prevent script execution. | | **Config Manager ComplianceRunReports XSS fix** (ENG-13164) | Fixed XSS vulnerability in Configuration Manager `ComplianceRunReports` by using `setAttribute` and adding filename sanitization. | | **Config Manager SearchGCCard XSS fix** (ENG-13165) | Fixed XSS vulnerability in Configuration Manager `SearchDialog/SearchGCCard` by using `setAttribute` and adding filename sanitization. | | **Config Manager exportJson XSS fix** (ENG-13166) | Fixed XSS vulnerability in Configuration Manager `exportJson` function by adding filename sanitization and using `setAttribute` instead of direct property assignment. | | **Studio notifications DOM-based XSS fix** (ENG-13167) | Fixed DOM-based XSS vulnerability in Automation Studio notifications by implementing URL origin validation. | | **Lifecycle Manager ActionTable XSS fix** (ENG-13168) | Fixed DOM-based XSS vulnerability in Lifecycle Manager `ActionTable` through explicit prop assignment. | | **Config Manager SearchDeviceTemplatesCard XSS fix** (ENG-13169) | Fixed XSS vulnerability in Configuration Manager `SearchDeviceTemplatesCard` by using `setAttribute` and adding filename sanitization. | | **SearchBackupCard filename XSS fix** (ENG-13170) | Fixed XSS vulnerability in `SearchBackupCard` by sanitizing filenames in export functionality. | | **InstanceGroupsTable XSS fix** (ENG-13172) | Fixed XSS vulnerability in `InstanceGroupsTable` component by replacing spread operator with explicit prop assignments. | | **ComplianceReportingCard filename XSS fix** (ENG-13173) | Fixed XSS vulnerability in `ComplianceReportingCard` by sanitizing filenames in export functionality. | | **Config Manager exportJson XSS fix** (ENG-13175) | Fixed XSS vulnerability in Configuration Manager `exportJson` function by adding filename sanitization and using `setAttribute` instead of direct property assignment. | | **StaticGroups XSS fix** (ENG-13178) | Fixed XSS vulnerability in `StaticGroups` component by removing dangerous object spread pattern and implementing sanitization utilities. | | **SearchCompliancePlanCard XSS fix** (ENG-13179) | Fixed XSS vulnerability in `SearchCompliancePlanCard` by sanitizing filename input before DOM manipulation. | | **ChildActionTable XSS fix** (ENG-13180) | Fixed XSS vulnerability in `ChildActionTable` component by removing spread operator that allowed unsanitized input injection. | | **setTimeout state variable naming conflict** (ENG-13181) | Renamed `setTimeout` state variable to `setTimeoutValue` to avoid naming conflict with global `setTimeout()` function. | | **DuplicateProjectDialog open redirect fix** (ENG-13188) | Fixed open redirect vulnerability in Automation Studio `DuplicateProjectDialog` through MongoDB ObjectId validation. | | **Centralized sanitization methods** (ENG-13949) | Centralized sanitization methods to resolve multiple vulnerabilities. | | **passport-saml security update** (ENG-13956) | Updated `@node-saml/passport-saml` dependency to address a security vulnerability. | | **swagger-ui-react security update** (ENG-14460) | Updated `swagger-ui-react` dependency to address a security vulnerability. | ## August 11, 2025 # 6.0.7 Platform 6.0.7 is a maintenance release containing enhancements, bug fixes, and security updates. #### Enhancements (7) | Feature | Description | | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------- | | **Unused files and dependencies removal** (ENG-10705) | Removed all unused files, code, and dependencies in Platform 6. | | **Workflow data UUID property** (ENG-12003) | A new `UUID` property has been added to workflow data to enhance data management and identification. | | **Cookie escaping and hashing security fix** (ENG-12675) | Updates were made in the Platform to fix cookie escaping and hashing, addressing low vulnerabilities that were previously identified. | | **Docker image Itential user ID standardization** (ENG-12772) | The Itential user within Docker images has now been assigned a group/user id of `1001:1001` to standardize user management. | | **CyberArk CCP secrets provider support** (ENG-12789) | Added support for CyberArk CCP as a secrets provider. | | **Network dependency addition** (ENG-13401) | A new network dependency was added to enhance the functionality and fix issues related to the Platform pipeline. | | **Gateway Manager clusterId connection deduplication** (ENG-13928) | Gateway Manager connection validation now ensures only one connection exists per clusterId during new connection handling. | #### Bug fixes (16) | Feature | Description | | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Pre-built import duplicate key race condition** (ENG-7955) | When importing a pre-built, a "duplicate key error collection" error returned. Fixed a race condition in the `processAutomations` method that occurred if multiple workflows in the imported pre-built contain the same group. This fix ensures the pre-built will no longer error the import API. | | **Admin Essentials out-of-sync banner** (ENG-8372) | The "out of sync" banner no longer persists when an application is "in sync" after a user selects an application within the Application section of Admin Essentials and refreshes the page. | | **getTimeByTimezone task with DST support** (ENG-8589) | Created a new `getTimeByTimezone` task that presents timezones by location to accommodate for time variations caused by Daylight Savings Time. Additionally, timezone input is now optional and will default to the system's timezone if not present, also accounting for Daylight Savings Time. | | **Child job loop stuck in running state** (ENG-8815) | Fixed a bug in which child job loops remained stuck in a running state when all child jobs were cancelled. | | **Parallel revert infinite loop fix** (ENG-8999) | Fixed an issue where jobs that had reverts in parallel could trigger an infinite loop that saturated the CPU. | | **convertTimezone input time default** (ENG-10315) | Fixed an issue where the `convertTimezon`e task and other time tasks would default to using the current date and time as opposed to the correct input time. | | **Transformation internal function backspace delete** (ENG-10848) | A bug was fixed where the internal functions of transformation would disappear upon pressing the backspace key, improving user experience. | | **Service memory crash and restart** (ENG-11043) | An issue was fixed where a service (application/adapter) crashed due to running out of memory and could not be restarted, ensuring better service reliability. | | **Task palette default variable keys for transformations** (ENG-12350) | The task palette has been updated to set default keys for incoming and outgoing variables specifically for transformation assets, based on the asset's schema. | | **Deep nested object task stuck in running state** (ENG-12865) | A fix was made to address an issue where tasks that utilized deeply nested objects or large arrays of objects as inputs could become stuck in a running state, resulting in a "Maximum Call Stack" error being logged. | | **Studio workflow strict validation disable** (ENG-13023) | The strict mode for Studio workflow run validation has been disabled to improve flexibility and usability during workflow execution and prevent workflow error. | | **mongo_url password masking in Admin Essentials** (ENG-13035) | Resolved an issue that exposed passwords in `mongo_url`. The `mongo_url` property is now effectively masked in the Admin Essentials Configuration view to enhance security and prevent unauthorized access. | | **JST conditional step reference breakage** (ENG-13291) | An issue was resolved in JST Transformations where adding conditionals to a step that had multiple assignments from the return would lead to a broken reference. Additionally, a fix was implemented to ensure that a new context would properly propagate from a step with multiple assignments. | | **Adapter property encryption on import** (ENG-13377) | A bug was fixed concerning the adapter properties, which were previously unencrypted upon import when the `propertySchema` did not explicitly declare the property as encrypted. | | **JST anchor assigned state after invalid transition** (ENG-13405) | Resolved issue where anchors incorrectly remained marked as assigned when drawing invalid transitions from context variables to parameters across different tasks. | | **Gateway creation service-group state** (ENG-14383) | Fixed an issue where creating a new gateway would succeed, but result in a bad service-group state. | #### Security fixes (9) | Feature | Description | | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | **semver vulnerable version update** (ENG-11009) | Packages have been updated to ensure a non-vulnerable version of `semver` is utilized across the Platform, enhancing overall security. | | **swagger-client and swagger-ui-react security update** (ENG-11611) | Updated the `swagger-client` and `swagger-ui-react` dependency versions to resolve a security vulnerability. | | **axios security update** (ENG-11626) | Updated the `axios` dependency version to fix a security vulnerability that was detected in previous versions. | | **prismjs security update** (ENG-11629) | Updated the `prismjs` dependency version to resolve a security vulnerability. | | **path-to-regexp security update** (ENG-11631) | Updated the `path-to-regexp` dependency version to address a security vulnerability. | | **cookie-parser and express-session security update** (ENG-11634) | Updated the `cookie-parser` and `express-session` versions to mitigate a security vulnerability. | | **Studio Command component XSS prevention** (ENG-13135) | Implemented XSS prevention measures by adding proper input sanitization and character escaping in the Automation Studio Command component. | | **Studio component XSS remediation** (ENG-13136) | Applied additional XSS vulnerability remediation with enhanced input validation and character escaping in Automation Studio components. | | **form-data dependency security update** (ENG-13771) | Updated the `form-data` dependency version to address a security vulnerability. | ## August 8, 2025 # 6.0.6 Platform 6.0.6 is a maintenance release containing enhancements, bug fixes, and security updates. > **Warning** > > Platform 6.0.6 artifacts have been removed from the Itential Artifact Repository. We apologize for any inconvenience. #### Enhancements (6) | Feature | Description | | ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | **Unused files and dependencies removal** (ENG-10705) | Removed all unused files, code, and dependencies in Platform 6. | | **Workflow data UUID property** (ENG-12003) | A new `UUID` property has been added to workflow data to enhance data management and identification. | | **Cookie escaping and hashing security fix** (ENG-12675) | Updates were made in the Platform to fix cookie escaping and hashing, addressing low vulnerabilities that were previously identified. | | **Docker image Itential user ID standardization** (ENG-12772) | The Itential user within Docker images has now been assigned a group/user ID of `1001:1001` to standardize user management. | | **CyberArk CCP secrets provider support** (ENG-12789) | Added support for CyberArk CCP as a secrets provider. | | **Network dependency addition** (ENG-13401) | A new network dependency was added to enhance functionality and fix issues related to the Platform pipeline. | #### Bug fixes (15) | Feature | Description | | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **When importing a pre-built, a "duplicate key error c...** (ENG-7955) | When importing a pre-built, a "duplicate key error collection" error returned. Fixed a race condition in the `processAutomations` method that occurred if multiple workflows in the imported pre-built contain the same group. This fix ensures the pre-built will no longer error the import API. | | **Admin Essentials out-of-sync banner** (ENG-8372) | The "out of sync" banner no longer persists when an application is "in sync" after a user selects an application within the Application section of Admin Essentials and refreshes the page. | | **getTimeByTimezone task with DST support** (ENG-8589) | Created a new `getTimeByTimezone` task that presents timezones by location to accommodate for time variations caused by Daylight Saving Time. Additionally, timezone input is now optional and will default to the system's timezone if not present, also accounting for Daylight Saving Time. | | **Child job loop stuck in running state** (ENG-8815) | Fixed a bug in which child job loops remained stuck in a running state when all child jobs were cancelled. | | **Parallel revert infinite loop fix** (ENG-8999) | Fixed an issue where jobs that had reverts in parallel could trigger an infinite loop that saturated the CPU. | | **convertTimezone input time default** (ENG-10315) | Fixed an issue where the `convertTimezone` task and other time tasks would default to using the current date and time as opposed to the correct input time. | | **Transformation internal function backspace delete** (ENG-10848) | A bug was fixed where the internal functions of a transformation would disappear upon pressing the backspace key. | | **Service memory crash and restart** (ENG-11043) | An issue was fixed where a service (application/adapter) crashed due to running out of memory and could not be restarted, ensuring better service reliability. | | **Task palette default variable keys for transformations** (ENG-12350) | The task palette has been updated to set default keys for incoming and outgoing variables specifically for transformation assets, based on the asset's schema. | | **Deep nested object task stuck in running state** (ENG-12865) | A fix was made to address an issue where tasks that utilized deeply nested objects or large arrays of objects as inputs could become stuck in a running state, resulting in a "Maximum Call Stack" error being logged. | | **Studio workflow strict validation disable** (ENG-13023) | The strict mode for Studio workflow run validation has been disabled to improve flexibility and usability during workflow execution and prevent workflow errors. | | **mongo_url password masking in Admin Essentials** (ENG-13035) | Resolved an issue that exposed passwords in `mongo_url`. The `mongo_url` property is now masked in the Admin Essentials Configuration view to enhance security and prevent unauthorized access. | | **JST conditional step reference breakage** (ENG-13291) | An issue was resolved in JST transformations where adding conditionals to a step that had multiple assignments from the return would lead to a broken reference. Additionally, a fix was implemented to ensure that a new context propagates correctly from a step with multiple assignments. | | **Adapter property encryption on import** (ENG-13377) | A bug was fixed concerning adapter properties, which were previously unencrypted upon import when the `propertySchema` did not explicitly declare the property as encrypted. | | **JST anchor assigned state after invalid transition** (ENG-13405) | Resolved an issue where anchors incorrectly remained marked as assigned when drawing invalid transitions from context variables to parameters across different tasks. | #### Security fixes (9) | Feature | Description | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | **semver vulnerable version update** (ENG-11009) | Packages have been updated to ensure a non-vulnerable version of `semver` is utilized across the Platform. | | **swagger-client and swagger-ui-react security update** (ENG-11611) | Updated the `swagger-client` and `swagger-ui-react` dependency versions to resolve a security vulnerability. | | **axios security update** (ENG-11626) | Updated the `axios` dependency version to fix a security vulnerability that was detected in previous versions. | | **prismjs security update** (ENG-11629) | Updated the `prismjs` dependency version to resolve a security vulnerability. | | **path-to-regexp security update** (ENG-11631) | Updated the `path-to-regexp` dependency version to address a security vulnerability. | | **cookie-parser and express-session security update** (ENG-11634) | Updated the `cookie-parser` and `express-session` versions to mitigate a security vulnerability. | | **Studio Command component XSS prevention** (ENG-13135) | Implemented XSS prevention measures by adding proper input sanitization and character escaping in the Automation Studio Command component. | | **Studio component XSS remediation** (ENG-13136) | Applied additional XSS vulnerability remediation with enhanced input validation and character escaping in Automation Studio components. | | **the `form-data` dependency version to address a secu...** (ENG-13771) | Updated the `form-data` dependency version to address a security vulnerability. | ## July 3, 2025 # 6.0.5 Platform 6.0.5 is a maintenance release containing enhancements, bug fixes, and security updates. #### Enhancements (4) | Feature | Description | | ------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Redis initial connection timeout config** (ENG-11965) | Added a configurable parameter where you can set a timeout for initial startup Redis connection. The `connectTimeout` and `handleConnectionTimeout` properties set the maximum time in milliseconds to wait for the initial Redis connection before timing out. If not set, defaults to 30000 ms (30 seconds). | | **NSO adapter global-timeout flag** (ENG-12523) | The NSO adapter has been updated to incorporate a `global-timeout` setting, which acts as a boolean flag. When set to `true`, this setting allows services to bypass local timeout values and adhere to the global timeout configuration. If not activated or set to `false`, the system reverts to either a custom value or the default timeout of 60 seconds. | | **jobStart event workflowId and projectId** (ENG-12595) | Added `workflowId` and `projectId` properties to the `jobStart` event in Workflow Engine. These unique identifiers help correlate workflow executions (jobs) and protect against unexpected event duplication. | | **Workflow Engine task event summary and description** (ENG-12662) | Added a task `summary` and `description` to Workflow Engine events. This metadata is automatically added to task events handled via the `eventSystem`, allowing users to understand the purpose and details of each event. | #### Bug fixes (11) | Feature | Description | | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **SAML SSO post-login redirect** (ENG-4213) | When the Platform was configured to authenticate users via SAML SSO, a user who was logged out from a page in the Platform would not be redirected to their original location after logging back in. Support was added for persistent redirect links across SAML SSO login flows to ensure users are restored to their original location. | | **childJob loop status in output** (ENG-7728) | Fixed an issue where the `status` for each job was not reflected in the output objects from the `childJob` task when either parallel or sequential looping was enabled. | | **Workflow canvas duplicate task definitions** (ENG-7900) | In certain circumstances, the workflow builder canvas would display duplicate task definitions in the task palette. This change eliminates possible race conditions and ensures no duplicates are added. | | **Azure/EntraID SSO disableAuthnContext toggle** (ENG-8062) | When configuring Azure/EntraID as an identity provider (IdP) in the Platform, the SSO test connection failed due to a required `Password, ProtectedTransport` authentication method. Added a "Disable Expected Auth" toggle to the SSO configuration page that gives administrators the option to control the `disableAuthnContext` configuration property. | | **JST incoming/outgoing schema issues** (ENG-10352) | A series of fixes have been implemented to address multiple issues that occurred when using an incoming or outgoing JST schema. These issues have been resolved to ensure proper functionality at runtime. | | **JST deleted step reference persistence** (ENG-10751) | Resolved a JST bug that allowed references to deleted steps to persist within the context of other steps, ensuring that the integrity of the workflow remains intact. | | **Platform early shutdown Redis connection check** (ENG-12023) | Added checks for `iap_id` and Redis connection to ensure smooth shutdowns when exiting the Platform early in the startup process and when exiting after Redis shuts down. | | **Pre-built GBAC import sidebar visibility** (ENG-12445) | When importing a pre-built automation with GBAC assigned, the imported automation did not appear in the Operations Manager side navigation bar. Fixed pre-built automation import to ensure all GBAC `id` values are strings and the automation is displayed in the side navigation bar. | | **Command template percentage selector** (ENG-12529) | The command template builder UI previously lacked the maximum accepted percentage (%) selector when performing a comparison evaluation by percentage. This issue has been rectified by re-adding the selector to the UI. | | **maxIdleTimeMS connection timeout property** (ENG-12586) | A new configurable timeout property, `maxIdleTimeMS`, has been introduced to effectively drop unused connections, with a default setting of five minutes. This enhancement is designed to reduce the total number of connections during periods of lighter usage. | | **Admin Essentials group member save button** (ENG-12616) | When adding users to a group via the UI, the save button was greyed out (disabled). The edit group dialog now enables the save button when modifying group members through the Admin Essentials UI. | _Showing the 20 most recent of 25 entries. Append `/llms.txt` to the changelog URL for the complete index._