Subscribe to our RSS feed or by email to receive automatic notifications when new releases are published.
Get notified when we ship new features and improvements.
Platform 6.4.1 is a maintenance release with security updates, bug fixes, and enhancements across Operations Manager, Studio, Configuration Manager, and Platform infrastructure. It addresses customer-reported issues and improves stability, reliability, and secure communication.
| Component | Feature | Description |
|---|---|---|
| Configuration Manager | Compliance plan view toggle (ENG-24014) | Changed how you switch between the default and classic view of compliance plans. Access the toggle on the Configuration Manager dashboard. |
| Component | Feature | Description |
|---|---|---|
| Configuration Manager | GradeComplianceReports device scope (ENG-22461) | Fixed an issue where gradeComplianceReports graded devices outside the compliance plan. The task now only grades devices included in the plan. |
| Configuration Manager | Golden config treeId on import (ENG-21919) | Fixed an issue where re-importing a golden config changed its treeId. The treeId is now preserved on import. |
| JSON Forms | Schema combination dropdown clear button (ENG-24062) | Removed the clear button from the schema combination dropdown to prevent users from setting a schema combination to an empty, invalid state. |
| Operations Manager | Scheduled trigger error logging (ENG-23176) | Fixed object readability in scheduled triggers error logging. |
| Operations Manager | Sidebar selection highlight (ENG-7784) | Fixed an issue where the left navigation sidebar did not update its selection highlight when switching between job filter views. The highlight now correctly reflects the active filter as you navigate. |
| Platform | Licensing timeout error (ENG-23266) | Fixed a licensing timeout error that caused license validation to fail on Red Hat systems. |
| Platform | Service startup with colon in server ID (ENG-22854) | Fixed an issue where colons in server IDs could silently prevent services from detecting each other after startup. Server IDs containing colons are now rejected with a descriptive error. |
| Projects | Project asset import for users outside account collection (ENG-23778) | Fixed an error that prevented importing some project assets when the user was not in the account collection. |
| Templates | Command template checkbox persistence (ENG-24271) | Fixed the Treat info and warning as pass checkbox in the command template UI so that it persists correctly when the template is saved. |
| Templates | Analytic template rename error message (ENG-10314) | Fixed an issue where renaming a MOP analytic template to an already-taken name returned an incorrect Operation canceled by the user error instead of the expected duplicate-name error. |
| Templates | Template disappears from folder tree on rename (ENG-24249) | Fixed a bug where renaming a command template or analytic template on a fresh page load would inconsistently cause it to disappear from the folder tree. |
| Templates | Template import schema validation (ENG-19450) | Fixed template import returning an unclear error when the submitted template was missing required fields or contained non-string values for string fields. |
| Workflow Engine | Task worker error object logging (ENG-23166) | Fixed an issue where error objects logged from within a task worker appeared as error=[ {} ] instead of their actual content. |
| Workflows | Child job task corruption on task reference delete (ENG-24148) | Fixed an issue where deleting a task reference corrupted the child job task in the workflow document. The workflow engine now supports starting a job for workflows in this state for backward compatibility. |
| Workflows | Debug mode keyboard shortcut propagation (ENG-16946) | Fixed an issue in Studio where browser keyboard shortcuts (such as Cmd+Opt+I and Cmd+R) were consumed when the workflow canvas was in debug mode. Shortcuts now propagate to the browser as expected. |
| Workflows | Debug mode scenario input save (ENG-16945) | Fixed an issue in debug mode where pasting JSON into a scenario input field and immediately pressing Cmd+S caused the pasted value to revert to null after save. |
| Workflows | Deprecated task icons on canvas reload (ENG-10247) | Fixed an issue where deprecated task icons and warnings disappeared from the workflow canvas after a page reload. |
| Workflows | Import dialog behavior on partial import success (ENG-11415) | Fixed an issue in the Studio import dialog where a partial import success left the dialog open and the page unrefreshed. The dialog now closes and the sidebar updates to reflect successfully imported items even when other files in the batch fail. |
| Workflows | Job variable null value on canvas start (ENG-18492) | Fixed an issue where users could not assign a null value to a job variable when starting a workflow from the canvas. |
| Workflows | Project builder name sort with prefix (ENG-16128) | Fixed an issue where name sorting in Project Builder incorrectly included the project prefix. |
| Workflows | Save Workflow API unknown _id handling (ENG-23356) | Fixed an issue in the save workflow API (POST /workflow_builder/workflows/save) where supplying an _id that did not exist in the database silently succeeded without persisting the workflow. The API now returns a clear error identifying the unknown _id. |
| Workflows | Unsaved changes dialog on tab close (ENG-6727) | Fixed a stale-closure bug that caused the Unsaved Changes navigation dialog to appear when closing a tab that had no unsaved edits. |
| Workflows | Workflow import with invalid Debug Mode scenario input (ENG-24105) | Fixed workflow import failures caused by invalid Debug Mode scenario input. Added validation to prevent users from setting invalid values in scenario input. |
| Studio | Workflow name truncation with dash character (ENG-7276) | Fixed an issue where workflow names containing a dash character were incorrectly truncated in the Studio tab label. |
| Transformations | Unsaved changes check overrides delete confirmation (ENG-7303) | Fixed an issue in Studio where deleting a document with unsaved changes triggered two confirmation dialogs back-to-back. |
| Inventory Manager | IAG4 and IAG5 device origin detection (ENG-23885) | Fixed device origin detection between IAG 4 and IAG 5 in MOP and Configuration Manager routing. |
This release includes security updates that address vulnerabilities in third-party packages and platform components.
| Component | Feature | Description |
|---|---|---|
| Inventory Manager | FastURI security vulnerability (Inventory Manager) (ENG-24190) | Fixed a FastURI security vulnerability in Inventory Manager and Adapter Inventory Manager. |
| NSO Service Manager | Cross-site scripting in Quill (NSO Manager) (ENG-22488) | Resolved a cross-site scripting (XSS) vulnerability (CVE-2025-15056) by updating Quill to a secure version in app-nso_manager. |
| NSO Service Manager | Directory traversal in fast-uri (Service Management) (ENG-24069) | Resolved a Directory Traversal vulnerability (CVE-2026-6321) by updating fast-uri to a secure version in app-service_management. |
| NSO Service Manager | HTTP cleartext transmission (NSO Adapter) (ENG-18110) | Improved HTTP request handling in adapter-nso to align with secure communication best practices. |
| NSO Service Manager | Improper index validation in UUID (NSO Adapter) (ENG-23791) | Resolved a security vulnerability (CVE-2026-41907) related to improper input offset validation by updating UUID to a secure version in adapter-nso. |
| NSO Service Manager | Improper index validation in UUID (Service Management) (ENG-23792) | Resolved a security vulnerability (CVE-2026-41907) related to improper input offset validation by updating UUID to a secure version in app-service_management. |
| Platform | Directory traversal in fast-uri (itential-utils) (ENG-23883) | Updated the fast-uri dependency in itential-utils to resolve a Directory Traversal security vulnerability. |
| Platform | Directory traversal in fast-uri (itential-utils crossfunctional) (ENG-23815) | Updated the fast-uri dependency in itential-utils to resolve a Directory Traversal security vulnerability. |
| Platform | Sensitive information exposure in follow-redirects (Core) (ENG-23371) | Updated the follow-redirects dependency in Core to fix a sensitive information exposure vulnerability. |
| Platform | Sensitive information exposure in follow-redirects (itential-utils) (ENG-23374) | Updated the follow-redirects dependency in itential-utils to fix a sensitive information exposure vulnerability. |
| Platform | Use of uninitialized resource in ws (Core) (ENG-24042) | Updated the ws subdependency in Core to resolve a use-of-uninitialized-resource security vulnerability. |
| Platform | Improper index validation in UUID (Core) (ENG-23787) | Updated the uuid dependency in Core to fix an improper index validation vulnerability. |
| Workflow Engine | Redis command timeout on startup (ENG-24065) | Updated the default redis_command_timeout configuration value to fix a timeout issue that prevented the Workflow Engine API from coming online correctly at startup. |