6.7.0
This release includes changes that require action before, during, and after you upgrade. Review Upgrade actions before you start, or you could lose trigger changes, audit logs, or user access.
Platform 6.7.0 is a minor release that introduces Service Requests and Trigger Service. Service Requests lets users browse available services, submit requests, and schedule them. Trigger Service now runs the triggers that Operations Manager previously ran. This release also includes security updates, bug fixes, and enhancements across Core, Operations Manager, Studio, Work Center, and NSO Service Manager.
For more information on new features introduced in this release, see Platform 6.7 feature announcement.
Upgrade actions
Before you upgrade
- Keycloak adapter (ENG-31121): The Keycloak adapter now verifies that a token’s issuer exactly matches the configured Keycloak URL and realm. Make sure your
keycloak_urlandrealmsettings match the issuer that Keycloak uses. Otherwise, users get a 403 error when they log in. - Redis Sentinel (ENG-28062): If you use Redis Sentinel, grant the Sentinel user the
+subscribeACL permission so Platform can detect failovers. - Audit logging (ENG-30684): Platform now honors the
audit_enabledsetting, which defaults tofalse. If you never set it, Platform stops writingaudit.logafter you upgrade. To keep audit logging, setaudit_enabledtotrueon each node. The setting takes effect at startup.
During the upgrade
- Trigger migration (ENG-32440): Don’t create, edit, or delete triggers or automations while you upgrade. Platform moves existing triggers to Trigger Service during the upgrade, and changes you make during the upgrade aren’t carried over. Trigger management API calls return a 503 error until the migration finishes.
After you upgrade
- Trigger event subscribers (ENG-30978): Platform moves existing triggers to Trigger Service during the upgrade, and changes made during the upgrade may not be carried over.
Change in functionality
BullMQ Pro queue names (ENG-24035)
Platform 6.7.0 upgrades BullMQ Pro from version 6 to version 7. BullMQ no longer allows colons (:) in queue names, so Platform now encodes queue names at the network layer. A tilde (~) becomes ~0 and a colon (:) becomes ~1. This encoding avoids name collisions and removes the colon.
When each server starts, it renames its persisted queues to the encoded form and deletes its other leftover queues from Redis. Platform recreates the deleted queues with the new encoding when listeners start.
Be aware of the following possible upgrade issues:
- Lost events: If an
eventListenerJobtask is in progress during the upgrade and its event is emitted during the upgrade window, the event might be lost. - Orphaned queues: If a migration step fails, or if a server ID or Gateway5 cluster name contains a colon or tilde, unencoded queues can remain in Redis. Leftover non-persisted queues have no writers or listeners, so they have no functional impact. If Platform can’t rename a persisted queue, it logs a warning and doesn’t process the queue’s jobs until you resolve the issue.
Enhancements (22)
| Component | Feature | Description |
|---|---|---|
| Admin Essentials | Integration Models page redesign (ENG-31187) | Updated the Integration Models page to the Mosaic UI and added links to each model’s integration instances. |
| Admin Essentials | Integration Instances page redesign (ENG-30420) | Updated the Integration Instances page to the Mosaic UI. Configuration settings now appear on separate tabs, and the page includes a revert button and a link to the integration model. |
| Agent Sessions, Work Center | Schedule labels for agent sessions and work items (ENG-30981) | Labels that show what started an agent session or work item now describe every schedule type. Weekly, periodic, and monthly schedules list their weekdays or months, such as “Weekly on Thu, Fri” or “Monthly on Jan, Apr.” Cron schedules show their expression, one-time schedules show “Once,” and unrecognized schedules show “Scheduled.” |
| Automation Hub | Container base image updates (ENG-31344) | Updated the Automation Hub container base images, including Node.js 22, Go 1.26, and current Alpine and Debian images. Also refreshed the CA certificate bundle to address the eMudhra certificate authority vulnerability. |
| Configuration Manager Enterprise | Device group search APIs (ENG-29952) | Added APIs to search device groups and get device group details, with support for pagination, sorting, and filtering. |
| Configuration Manager Enterprise | Tag-based device targeting (ENG-31243, ENG-28543, ENG-28542) | Added support for targeting devices by their Inventory Manager tags. Device groups now store the operating system mix of their devices. |
| Core | Container base image update (ENG-31439) | Updated the container base image to Node.js 22.23.4 and refreshed CA certificates to address the eMudhra certificate authority vulnerability. |
| Core | Node.js 22.23.4 required for the Keycloak adapter (ENG-31347) | The Keycloak adapter (adapter-keycloak) now requires Node.js 22.23.4 or later, which includes the eMudhra CA fix. Node.js 20 is no longer supported for this adapter. |
| Core, Gateway Manager | BullMQ Pro 7 upgrade (ENG-24035) | Upgraded BullMQ Pro from version 6 to version 7 to address security concerns. Queue names can no longer contain colons (:), so Platform now encodes queue names automatically and migrates existing queues at startup. |
| Core, Operations Manager | Pre-built triggers imported to Trigger Service (ENG-29925) | When you install or update a pre-built that contains an automation, Platform now sends its triggers to Trigger Service. Platform validates the triggers first and rejects the entire pre-built if Trigger Service refuses them. Install and update responses include a triggerNotes list that reports renamed triggers, disabled routes, missing forms, and failed syncs. If the trigger import fails after the automations are written, the error explains how to finish by reimporting with overwrite. |
| FlowAI | Agent input rules in Agent Builder (ENG-31082) | Added support for optional inputs, default values, single-level nesting, and descriptions for agent inputs. You can create, edit, and delete these rules in the Agent Builder editor. |
| Lifecycle Manager | Resource model triggers run through Trigger Service (ENG-30979, ENG-29398) | Trigger Service now runs resource model triggers through Lifecycle Manager. A resource model trigger stores a Lifecycle Manager action and either a target instance or group, or the option to choose the target when the trigger runs. Runs started by Trigger Service show <automation name>: <trigger name> as their initiator and link to the automation. You can find these runs with the initiator filter on the Dashboard. Previously recorded runs are unchanged. |
| Operations Manager | Trigger migration to Trigger Service (ENG-32440, ENG-31232, ENG-30647) | When you upgrade, Platform moves existing Operations Manager triggers to Trigger Service and backs up the triggers collection to triggers_archive. During an HA rolling upgrade, schedules move to Trigger Service, and API, event, and manual triggers continue to run on both versions until you upgrade the last node. Trigger management API calls return a 503 error while the migration runs. Don’t create, edit, or delete triggers or automations during the upgrade, because those changes aren’t carried over. |
| Operations Manager | Agent input rules in Operations Manager (ENG-31317) | Operations Manager now displays and supports the agent input rules you define in Agent Builder. |
| Operations Manager | Trigger Service IDs in trigger events (ENG-30978) | Trigger Service now publishes the failedTrigger and missedJobs events. Platform sends failedTrigger when a trigger run fails, or when a scheduled run fails after all retries. It sends missedJobs when a scheduled run is late. The triggerId in both events is now the Trigger Service ID, including for migrated triggers. Update any subscribers that filter on Operations Manager trigger IDs. |
| Operations Manager | Trigger API served by Trigger Service (ENG-30921, ENG-30649, ENG-30648) | The Operations Manager trigger API now runs on Trigger Service, including create, edit, enable, disable, delete, export, import, clone, and run requests. Responses keep their existing shapes, but _id is now the Trigger Service ID. Migrated triggers keep their original ID as legacyId, and the API accepts either ID. Trigger names must be unique, so cloned triggers are named <original name> - Cloned <timestamp>. Exports that use a Trigger Service ID can’t be imported into earlier Platform versions. |
| Operations Manager | Access group and asset sync with Trigger Service (ENG-30660, ENG-28676) | When you change an automation’s asset or its read and write access groups, Operations Manager now sends the change to Trigger Service, which applies it to the automation’s triggers. A group you remove from an automation loses access to its triggers, and a group you add gains access. Existing requests keep the access groups they started with. If the sync fails, Platform logs the failure and still saves the automation update. |
| Operations Manager | Automation imports through Trigger Service (ENG-29923) | Automation imports now write triggers to Trigger Service instead of Operations Manager. |
| Platform | Tool Decorators UI text (ENG-28544) | Updated the text in the Tool Decorators UI to match the current design. |
| Studio | Full json-query syntax for inline queries (ENG-31081) | Inline queries in task inputs now support full json-query syntax, including data filtering and manipulation. |
| Studio | Trigger references read from Trigger Service (ENG-31001) | Studio now reads trigger information from Trigger Service. The References panel still lists the triggers that reference an automation, form, or transformation, and accepts both migrated and new trigger IDs. Projects exported before the migration now import without reporting missing triggers. While Trigger Service finishes migrating, the References panel shows a message that trigger references are unavailable, and project export fails with the same message. |
| Workflow engine | getJobStatuses method (ENG-30689) | Added a getJobStatuses method that returns the status of multiple jobs by job ID. |
Bug fixes (30)
| Component | Feature | Description |
|---|---|---|
| Agent Projects | Date range filter width (ENG-25787) | Widened the date range picker in the Agent Projects table filter so it shows two full months side by side. |
| Agent Projects, Agent Sessions, Gateway Manager, Inventory Manager, Model Registry, Work Center | Side navigation scrolling (ENG-32478) | Fixed an issue where the side navigation didn’t scroll when there were more apps than fit on the screen, which made apps at the bottom unreachable. The side navigation now scrolls and shows a scrollbar when you hover over it. |
| Core | Audit logging when audit is turned off (ENG-30684) | Fixed an issue where Platform wrote audit events to audit.log even when audit logging was turned off. Platform now honors the audit_enabled setting (ITENTIAL_AUDIT_ENABLED or auditProps.audit) on each node at startup. Because audit_enabled defaults to false, installations that never set it no longer write audit.log. To keep audit logging, set audit_enabled to true on each node. |
| Core | Audit Logger output to standard output (ENG-30580) | Fixed an issue where the Audit Logger threw an error when it wrote to standard output symlinks such as /dev/stdout, /proc/self/fd/1, and /dev/fd/1. |
| Core | Case-sensitive authorization header prefixes (ENG-29895) | Fixed an issue where the Basic and Bearer prefixes in authorization headers were case sensitive. |
| Core | Gateway tasks unavailable after workflow engine restart (ENG-28652) | Fixed an issue where Gateway tasks were unavailable after the workflow engine restarted, until ag_manager restarted or ran another discovery. |
| Core | Redis out-of-memory errors (ENG-28481) | Fixed an issue where Platform services crashed when Redis returned an out-of-memory (OOM) error. Services now log the error and keep running. |
| Core | Vault secret references during first startup (ENG-28432) | Fixed an issue where integration passwords stored as Vault references ($SECRET) were saved as clear text during Platform’s first startup on a database preseeded with service configurations, such as a database restore. Platform now preserves secret references. With a read-only Vault or CyberArk, references stay unchanged. With a writable Vault, Platform stores them as references in its own Vault secret. If Platform can’t reach or write to Vault, the migration stops and retries at the next startup instead of leaving secret fields blank. |
| Core | Redis Sentinel failover recovery (ENG-28062) | Fixed an issue where Platform didn’t reconnect to Redis after a Sentinel failover when the connection to the previous primary closed without a signal, such as during a network partition. Platform now detects failovers on all Redis connections. If you use Redis Sentinel, grant the Sentinel user the +subscribe ACL permission. |
| FlowAI | Tool Registry duplicate key errors (ENG-30664) | Fixed an issue where the Tool Registry logged duplicate key errors for workflow tools when a workflow’s UUID changed but its document ID stayed the same. |
| Gateway Manager | Missing distribution_mode parameter for virtual clusters (ENG-30473) | Fixed an issue where the distribution_mode parameter was missing from the Gateway Manager pronghorn.json file, which prevented you from setting it when you created or updated virtual clusters. |
| Gateway Manager | Gateway tasks missing after adapter restart (ENG-28651) | Fixed an issue where Gateway tasks disappeared after a Gateway 4 adapter restarted. ag_manager now waits for adapters to finish starting before it runs discovery. |
| JSON forms | JSON form export failures (ENG-30762) | Fixed an issue where JSON forms failed to export because binding data was saved with the form. Platform no longer saves binding data with forms. |
| JSON forms | Duplicate options in dynamic dropdowns (ENG-28569) | Fixed an issue where dynamic dropdowns in forms returned an error when options had duplicate values, such as projects with the same name. |
| JSON forms | Duplicate dynamic parameter (ENG-20077) | Fixed a duplicate entry in the Dynamic Parameter dropdown of the dynamic validation configurator. |
| Legacy Forms | Imported forms not displaying (ENG-16705) | Fixed an issue where an imported form didn’t display until you refreshed the page. |
| NSO | Custom NSO IPC paths in Itential Tools (ENG-26397) | Fixed an issue where Itential Tools for NSO 6.7 always used the default IPC path. Itential Tools now supports the NCS_IPC_PATH environment variable and falls back to TCP when a local IPC socket isn’t available. |
| NSO Service Manager | addToAuthGroup rejects valid device names (ENG-30659) | Fixed an issue where the addToAuthGroup task in adapter-nso rejected valid device names, including names that contain special characters. |
| Operations Manager | Job filters clear after one selection (ENG-32575) | Fixed an issue where job filters cleared after you selected one option, which prevented multiple selections. |
| Operations Manager | Manual trigger save fails with dynamic dropdown forms (ENG-31050) | Fixed a 6.6 regression where saving a manual trigger failed with a “schema is invalid” error when the selected form contained a dynamic dropdown. |
| Operations Manager | Copy error on the job canvas (ENG-28270) | Fixed an issue where pressing Ctrl+C or Cmd+C on the read-only job canvas showed a misleading permission error. The job canvas doesn’t support copying tasks, so Platform now ignores the shortcut. |
| Operations Manager | Duplicate jobs from schedule triggers (ENG-25636) | Fixed an issue where a schedule trigger could start multiple jobs for the same run in multi-node deployments. Each scheduled run now starts one job. |
| Platform, Studio | Toast width with custom browser font sizes (ENG-13839) | Fixed an issue where the browser’s font size setting controlled the width of notification toasts, which caused formatting problems. |
| Studio | Project membership after import (ENG-31976) | Fixed an issue where imported projects could receive a duplicate project ID, which caused “Insufficient permissions to view project” errors. Platform now reconciles the project ID counter with the highest existing project ID on import. |
| Workflow engine | Mocked asynchronous tasks don’t finish (ENG-30811) | Fixed an issue where mocked asynchronous tasks, such as a MOP reattempt, stayed in a running status. |
| Workflow engine | Child jobs not canceled (ENG-29010) | Fixed an issue where canceling a job didn’t always cancel all of its child jobs. |
| Workflow engine | Duplicate task completion events in nested loops (ENG-16211) | Fixed duplicate task completion events in nested forEach loops. Platform now clears a task’s finish_state when the task runs again. |
| Workflows | Canvas crash on nested error messages (ENG-30707) | Fixed an issue where the canvas crashed when it displayed nested error messages. |
| Workflows | Status bubbles on transitions (ENG-15210) | Fixed an issue where status bubbles appeared randomly on transitions in the workflow canvas. |
| Workflows | Component group caching in the Studio side navigation (ENG-2953) | Fixed an issue where the Studio side navigation fetched component groups every time you opened the Workflows section instead of caching them. |
Security fixes (39)
This release includes security updates that address vulnerabilities in third-party packages and Platform components.
| Component | Feature | Description |
|---|---|---|
| Core | ReDoS in joi (ENG-32265) | Updated joi to 18.3.1 to resolve a regular expression denial-of-service (ReDoS) vulnerability (CVE-2026-118772) in email validation. Platform doesn’t use the affected validation option. |
| Core | ReDoS in decode-uri-component (ENG-31945) | Updated decode-uri-component to resolve a ReDoS vulnerability. |
| Core | Improper output encoding in qs (ENG-31784) | Updated qs to 6.16.2 to resolve a vulnerability (CVE-2026-110910) where qs.stringify didn’t encode keys that contain special characters when allowEmptyArrays was enabled. Platform doesn’t use that option. |
| Core | XSS in DOMPurify (ENG-31411) | Updated dompurify from 3.4.13 to 3.4.17 to resolve a cross-site scripting (XSS) vulnerability (SNYK-JS-DOMPURIFY-21460653). |
| Core | Uncaught exception in body-parser (ENG-31410) | Updated body-parser to 1.20.9, and the copy that the NestJS platform uses to 2.4.0, to resolve a high-severity vulnerability (CVE-2026-111181). A compressed request body with trailing bytes could crash the Platform process. |
| Core | Sensitive information exposure in follow-redirects (ENG-31129) | Updated follow-redirects to 1.16.2 or later to resolve an improper removal of sensitive information vulnerability. |
| Core | Path equivalence in fast-uri (ENG-31125) | Updated fast-uri, a transitive dependency of ajv, to 3.1.9 to resolve a medium-severity path equivalence vulnerability (CVE-2026-110725). |
| Core | JWT issuer verification in the Keycloak adapter (ENG-31121) | The Keycloak adapter (adapter-keycloak) now verifies that a JWT’s issuer (iss) exactly matches the configured Keycloak URL and realm (<keycloak_url>/realms/<realm>). It no longer fetches signing keys from a location named in the token. Previously, the adapter checked only the Keycloak host, so it could accept a token from a different realm with a client of the same name. If your keycloak_url or realm setting doesn’t match the issuer Keycloak uses, users get a 403 error at login. Update the settings to match. This update also resolves vulnerabilities in axios, fast-uri, follow-redirects, and form-data. |
| Core | Improper certificate validation in undici (ENG-30892) | Updated undici to 6.29.1 to resolve multiple vulnerabilities, including improper certificate validation. |
| Core | Denial of service in source-map-js (ENG-30734) | Updated source-map-js to resolve a denial-of-service vulnerability (CVE-2026-93749). |
| Core | query-string vulnerability (ENG-30731) | Updated query-string from 7.1.3 to 9.5.1, which also updates decode-uri-component from 0.2.2 to 0.5.0, to resolve CVE-2026-45822. One edge case changed in Studio, Lifecycle Manager, and Operations Manager: when a query parameter is read as a comma-separated list, a single value with an encoded comma (for example, a=a%2Cb) is now read as a,b instead of as two items. |
| Core | Uncaught exception in qs (ENG-30706) | Updated qs to 6.16.1 to resolve a high-severity uncaught exception in qs.stringify (SNYK-JS-QS-20943482). |
| Core | Verbose error responses (ENG-26732) | Error responses for malformed requests, such as invalid JSON bodies, now return a concise JSON message. |
| Gateway Manager, Inventory Manager | Third-party dependency updates (ENG-31958, ENG-31954) | Updated dompurify, follow-redirects, fast-uri, and ip-address to resolve vulnerabilities, including XSS, sensitive information exposure, URI parsing issues, and ReDoS. |
| NSO Service Manager | Infinite loop in uri-js (adapter-nso) (ENG-32568) | Resolved an infinite loop vulnerability (CVE-2026-93690) by updating uri-js in adapter-nso. |
| NSO Service Manager | Sensitive information exposure in follow-redirects (adapter-nso) (ENG-32489) | Resolved an insertion of sensitive information into sent data vulnerability (CVE-2026-116689) by updating follow-redirects to a secure version in adapter-nso. |
| NSO Service Manager | Uncontrolled recursion in brace-expansion (adapter-nso) (ENG-32488) | Resolved an uncontrolled recursion vulnerability (CVE-2026-102276) by updating brace-expansion to a secure version in adapter-nso. |
| NSO Service Manager | SSRF in axios (adapter-nso) (ENG-32487) | Resolved a server-side request forgery (SSRF) vulnerability (CVE-2026-101898) by updating axios to a secure version in adapter-nso. |
| NSO Service Manager | Double decoding in fast-uri (adapter-nso) (ENG-32285) | Resolved a double decoding vulnerability (CVE-2026-75899) by updating fast-uri to a secure version in adapter-nso. |
| NSO Service Manager | Improper input validation in fast-uri (app-service_management) (ENG-32414, ENG-31755) | Resolved an improper validation of specified quantity in input vulnerability (CVE-2026-110180) by updating fast-uri to a secure version in app-service_management. |
| NSO Service Manager | Sensitive information exposure in follow-redirects (app-service_management) (ENG-32413) | Resolved an insertion of sensitive information into sent data vulnerability (CVE-2026-116689) by updating follow-redirects to a secure version in app-service_management. |
| NSO Service Manager | Improper input validation in fast-uri (app-nso_manager) (ENG-32172) | Resolved an improper validation of specified quantity in input vulnerability (CVE-2026-110180) by updating fast-uri to a secure version in app-nso_manager. |
| NSO Service Manager | Sensitive information exposure in follow-redirects (app-nso_manager) (ENG-32077, ENG-31939) | Resolved an insertion of sensitive information into sent data vulnerability (CVE-2026-116689) by updating follow-redirects to a secure version in app-nso_manager. |
| NSO Service Manager | XSS in DOMPurify (app-nso_manager) (ENG-31788) | Resolved an XSS vulnerability by updating DOMPurify to a secure version in app-nso_manager. |
| NSO Service Manager | XSS in DOMPurify (app-service_management) (ENG-31627) | Resolved an XSS vulnerability by updating DOMPurify to a secure version in app-service_management. |
| Platform | js-yaml in @nestjs/swagger (ENG-31679) | Updated @nestjs/swagger to 11.4.8 in platform-core and work-center-service. This updates the bundled js-yaml from 5.3.0 to 5.5.0 to resolve XRAY-1062447. Also updated swagger-ui-dist to 5.34.1. |
| Platform | dompurify and follow-redirects in Work Center UI (ENG-30742) | Rebuilt Work Center UI to resolve vulnerabilities in dompurify and follow-redirects (CVE-2023-54404). |
| Platform | yaml vulnerability (ENG-30738) | Updated yaml from 1.10.2 to 1.10.3 to resolve CVE-2026-33532. Itential code didn’t reach the vulnerable parser. |
| Platform | primereact vulnerability (ENG-30730) | Updated primereact to resolve a security vulnerability. |
| Platform | morgan vulnerabilities (ENG-30728) | Updated morgan from 1.11.0 to 1.12.1 to resolve CVE-2026-15603 and CVE-2026-87859. No configuration changes are required. |
| Platform | ip-address vulnerability (ENG-30727) | Updated the transitive ip-address dependency to resolve a security vulnerability. |
| Studio | Infinite loop in uri-js (ENG-28235) | Resolved an infinite loop vulnerability in uri-js in the Platform UI library and the repositories that use it. |
| Work Center | ReDoS in joi (ENG-32258) | Updated joi in Work Center service to 18.3.1 to resolve a high-severity ReDoS vulnerability (SNYK-JS-JOI-22114209). Work Center service doesn’t use the affected email validation option. |
| Work Center | Sensitive information exposure in follow-redirects (ENG-31946) | Updated follow-redirects in Work Center UI from 1.16.1 to 1.16.2 to resolve a vulnerability (CVE-2026-116689) that could forward sensitive headers to a redirect target. |
| Work Center | Uncaught exception in body-parser (Work Center UI) (ENG-31408) | Updated body-parser in the Work Center UI embedded server to 2.4.0 to resolve a vulnerability (CVE-2026-111181) where a crafted compressed request body could crash the Node.js process. |
| Work Center | Uncaught exception in multer (ENG-31407) | Updated multer in Work Center service to 2.5.0 to resolve a vulnerability (CVE-2026-113872) where a late error during file upload could crash the service process. |
| Work Center | Uncaught exception in body-parser (Work Center service) (ENG-31406) | Updated body-parser in Work Center service to 2.4.0 to resolve a vulnerability (CVE-2026-111181) where a crafted compressed request body could crash the service process. |
| Work Center | Third-party dependency updates (ENG-31122, ENG-29756, ENG-29404, ENG-27226, ENG-27222, ENG-26214, ENG-26190) | Updated third-party dependencies to resolve vulnerabilities, including cross-site request forgery (CSRF), SSRF, XSS, uncontrolled resource allocation, and sensitive information exposure. |
| Work Center | Uncaught exception in qs (ENG-30703, ENG-30699) | Updated qs in Work Center service to 6.16.1 to resolve a high-severity vulnerability (CVE-2026-110816) where certain serialization input could cause an uncaught exception. |
Component versions
| Component | Version |
|---|---|
| FlowAI | 1.3.0 |
| Gateway Manager | 1.18.8 |
| Inventory Manager | 1.2.23 |
| NSO Service Manager | 6.7.0 |
| Configuration Manager Enterprise | 6.7.0 |