6.5.2
Platform 6.5.2 is a maintenance release with security updates, bug fixes, and enhancements across NSO Service Manager, Core, Studio, Transformations, Work Center, Gateway Manager, Projects, Lifecycle Manager, and other Platform components. It addresses customer-reported issues and improves stability, reliability, and security across the platform.
Enhancements (20)
| Component | Feature | Description |
|---|---|---|
| Core | Removed NodeJS 22 deprecation warnings (ENG-10619) | Updated code logic to remove NodeJS deprecation warnings when running on NodeJS 22. |
| FlowAI | JSON Forms API validation endpoint (ENG-26771) | Added a new /validate API to JSON Forms. |
| Gateway Manager | Virtual Clusters added to Gateway Manager (ENG-26391) | Added Virtual Clusters to Gateway Manager, along with general cleanup and checks. |
| Gateway Manager | More robust connection failure handling (ENG-26413) | Added more robust messages and handling of connection failures to prevent Gateway Manager from crashing. |
| Gateway Manager | stdout_json output for runService task (ENG-26740) | The runService task output now includes an stdout_json property when stdout is valid JSON. |
| Gateway Manager | SHA256 checksum files added to build pipeline (ENG-26755) | Added .sha256 checksum files to the build. |
| Gateway Manager | Improved virtual cluster gateway deletion (ENG-27309) | Fixed an issue with deleting gateways associated with a virtual cluster. |
| Integrations | OpenAPI 3.0.4 support for Integrations (ENG-26971) | Integration Engine now supports importing and executing Integrations built on OpenAPI 3.0.4 models. |
| Inventory Manager | SHA256 checksum files added to build pipeline (ENG-26755) | Added .sha256 checksum files to the build. |
| Inventory Manager | Fixed inventory name breadcrumb (ENG-27214) | Fixed a UI bug that affected how inventory names displayed in the breadcrumb. |
| JSON Forms | JSON Forms API validation endpoint (ENG-26771) | Added a new /validate API to JSON Forms. |
| JSON Forms | Shared header row for array and table fields (ENG-26139) | JSON Form array and table fields now show a single shared header row, including a select-all checkbox for boolean columns, instead of repeating column labels on every row. |
| Lifecycle Manager | Query nested fields in LCM GET Instance API (ENG-26782) | You can now query nested fields in instanceData and lastAction for resource model instances in Lifecycle Manager using equals, starts-with, and in. |
| Projects | Admin break-glass role for Project access (ENG-12886) | Added a new projects-admin API role that lets authorized administrators view, list, and manage any Studio Project, including reassigning membership or deleting it, independent of the project’s individual access permissions. |
| Work Center | Job description display in Work Center (ENG-25842) | Job descriptions are now displayed in Work Center. |
| Work Center | Persistent Work Center column order (ENG-26095) | Data table column orders in Work Center now persist across page refreshes. |
| Work Center | Live work item description in stepper (ENG-27040) | A work item’s parent description now updates correctly when work items are changed through the timeline component. |
| Workflow Engine | Removed NodeJS 22 deprecation warnings (ENG-10619) | Updated code logic to remove NodeJS deprecation warnings when running on NodeJS 22. |
| Workflow Engine | New workflow validation API for agents (ENG-26131) | Added a /workflows/:id/validate endpoint so agents can validate custom-created workflows before saving. |
| Workflow Engine | Generic asset body field for workflow validation (ENG-27207) | The /workflows/validate endpoint now accepts a generic asset body field alongside standard Workflow Engine roles, matching Orchestration behavior. |
Bug fixes (27)
| Component | Feature | Description |
|---|---|---|
| Configuration Manager Enterprise | Persisted JSON Compliance configuration options (ENG-24647) | Fixed an issue where the JSON Compliance Configuration Options dialog didn’t persist previously saved rule values. |
| Configuration Manager Enterprise | Fixed F5 compliance check for nested specs (ENG-26429) | Fixed an issue where the F5 config parser failed compliance checks for nested specs with similar header lines. |
| Configuration Manager Enterprise | Fixed F5 parser errors (ENG-27088) | Fixed an issue with the F5 configuration parser. |
| Core | Fixed truncated webserver log paths (ENG-18965) | Fixed truncated request paths in webserver access logs so entries include the full URI instead of the path after the mount prefix. |
| Core | Fixed Gateway Manager crashes during Redis rolling restarts (ENG-24761) | Fixed a crash in Gateway Manager and other services during Redis/ElastiCache rolling restarts and failovers. Newly promoted primaries can briefly reject writes with READONLY; IAP now retries those commands within a time budget and rebuilds affected BullMQ workers instead of exiting the process. |
| Core | Fixed crash from circular references in logs (ENG-25477) | Fixed an issue where logging an object with a circular reference caused an uncaught TypeError and terminated the process. Circular references now render as [Circular ~...] in log output instead of crashing. |
| Core | Fixed Redis Sentinel failover handling (ENG-26554) | Fixed an issue where Redis Sentinel failovers could fail IAP health checks on LOADING or crash the FlowAI Tool Executor on READONLY. Both conditions are now treated as transient. |
| FlowAI | Fixed primitive tool result handling in Agent Engine (ENG-26225) | Fixed an issue where Claim Check stored primitive tool results (numbers, booleans, and null) as inline document references instead of in the collection, causing Agent Engine to reject them. Claim Check now stores these results in the collection. |
| Integrations | Fixed inconsistent OAuth for gateway-routed Integrations (ENG-26724) | Fixed an issue where Gateway-executed Integrations used an OAuth process inconsistent with directly-executed Integrations. |
| Lifecycle Manager | Fixed LCM Model Schema comment handling (ENG-3705) | Removed the comment icon from Lifecycle Manager JSON editors and enforced treating // as invalid JSON, so schemas no longer lose commented lines. |
| Lifecycle Manager | Fixed inconsistent Save button validity on New Instance form (ENG-26336) | Fixed an issue where Save button validity was inconsistent between JSON View and Form View on the New Instance form. |
| Operations Manager | Fixed ViewHTML task rendering when started by an agent (ENG-25295) | Fixed an issue where the ViewHTML task rendered incorrectly in Work Center when started by an agent. |
| Projects | Prevented accidental project closure (ENG-4696) | Fixed an issue where clicking a project’s name closed the project. The project name is now static, non-interactive text. |
| Projects | Fixed layout issues in the delete project dialog (ENG-5657) | Fixed styling issues that occurred when entering the wrong name while deleting a project. |
| Projects | Fixed sidebar highlighting for the current asset (ENG-5659) | Fixed an issue where the Projects sidebar in Automation Studio didn’t reliably highlight the currently open asset, including when opening or creating a project or adding a new asset. |
| Projects | Fixed overflowing branch names in the Manage Branch dialog (ENG-5661) | Fixed an issue where long branch names overflowed the Manage Branch dialog’s dropdown instead of truncating with an ellipsis. |
| Projects | Improved duplicate asset error messages (ENG-6467) | Duplicate asset error messages in Projects now show only the human-readable reason instead of a raw JSON error. |
| Projects | Fixed project list order after deleting a project (ENG-25464) | Fixed an issue where the project list’s sort order swapped after a project was deleted. |
| Projects | Added pagination to the Studio Project list (ENG-26589) | Fixed an issue where the Studio Project list view showed only 20 projects with no pagination. The Projects list table view now includes pagination. |
| Studio | Closed editor tab on workflow deletion (ENG-24679) | Fixed an issue where deleting a workflow from the collection view left its editor tab open. Deleting a workflow now closes its open editor tab, if one is open. |
| Studio | Fixed stale field values on Cmd/Ctrl+S save (ENG-25708) | Fixed an issue where pressing Cmd/Ctrl+S to save a workflow while still editing a task field’s value discarded the edit and saved the field’s previous value instead. In-progress task field edits are now committed before the save shortcut runs. |
| Studio | Fixed incorrect branch execution in JST if/else and switch/case blocks (ENG-26655) | Fixed an issue where a transformation with an if/elseIf/else or switch/case block could run the wrong branch when more than one condition or case evaluated true. The transformation now consistently runs the first matching branch. |
| Studio | Fixed overlapping tab labels in the Add Existing Asset dialog (ENG-26723) | Fixed an issue where tab labels in the Add Existing Asset dialog within Studio Projects could overlap and become hard to read for Command Templates and Analytic Templates. |
| Transformations | Fixed flickering JST Designer tab titles (ENG-26142) | Fixed an issue where the JST Designer tab title could flicker indefinitely when two open JSTs had colliding disambiguated names, such as “jst (1)” and “jst (1) (1)”. |
| Transformations | Fixed silent failures connecting JST if/else branches (ENG-26519) | Fixed an issue in the JST canvas where connecting certain branches of an if…else node could silently fail with no error shown, including when multiple else clauses needed to be connected. |
| Workflow Engine | Fixed Evaluation task Enable Query display (ENG-3597) | Fixed an issue where the Evaluation task’s Enable Query checkbox incorrectly displayed for a static operand whose value was set to null. |
| Workflow Engine | Fixed duplicate task path dispatch (ENG-23213) | Fixed an issue where a task with both success and error transitions could dispatch both paths from a single task finish if a transient failure occurred while writing the task’s outgoing data. |
Security fixes (31)
This release includes security updates that address vulnerabilities in third-party packages and platform components.
| Component | Feature | Description |
|---|---|---|
| Agent Sessions | Resource allocation security update (ENG-26465) | Resolved an Allocation of Resources Without Limits or Throttling vulnerability with security updates. |
| Core | Resolved double decoding vulnerability in fast-uri (ENG-27124) | Resolved a Double Decoding of the Same Data vulnerability (CVE-2026-75899) by updating the fast-uri package. |
| Core | Resolved prototype pollution vulnerability in browserslist (ENG-26858) | Resolved a Prototype Pollution vulnerability (CVE-2026-73088) by updating the browserslist package. |
| Core | Resolved log forging vulnerability in morgan (ENG-26690) | Updated the morgan package from 1.10.1 to 1.11.0 to resolve a log forging vulnerability (CVE-2026-5078) involving the :remote-user field. |
| Core | Resolved vulnerable installations in diff (ENG-26689) | Updated the diff package to resolve a vulnerability (CVE-2026-24001) affecting three separate resolution paths. |
| Core | Resolved inefficient algorithmic complexity in js-yaml (ENG-26623) | Resolved an Inefficient Algorithmic Complexity vulnerability by updating the js-yaml package. |
| Core | Resolved SSRF vulnerability in ip-address (ENG-26529) | Resolved a Server-Side Request Forgery (SSRF) vulnerability by updating the ip-address package. |
| Core | Resolved infinite loop vulnerability in nanoid (ENG-26407) | Resolved an Infinite Loop vulnerability by updating the nanoid package. |
| Core | Resolved interpretation conflict vulnerability in fast-uri (ENG-26406) | Resolved an Interpretation Conflict vulnerability (CVE-2026-18446) by updating the fast-uri package. |
| Core | Resolved improper neutralization vulnerability in undici (ENG-26366) | Resolved an Improper Neutralization vulnerability by updating the undici package. |
| Core | Resolved directory traversal vulnerability in postcss (ENG-26174) | Upgraded the postcss dependency to resolve a Directory Traversal vulnerability. |
| Core | Resolved resource allocation vulnerability in brace-expansion (ENG-26171) | Updated the brace-expansion package version to resolve an Allocation of Resources Without Limits or Throttling vulnerability. |
| Core | Resolved resource allocation vulnerability in axios (ENG-26074) | Resolved an Allocation of Resources Without Limits or Throttling vulnerability by updating the axios package. |
| Core | Resolved resource allocation vulnerability in body-parser (ENG-25761) | Resolved an Allocation of Resources Without Limits or Throttling vulnerability by updating the body-parser package. |
| Core | Resolved improper initialization vulnerability in dompurify (ENG-24986) | Resolved an Improper Initialization vulnerability by updating the dompurify package. |
| Inventory Manager | Security cleanup for fast-uri and brace-expansion (ENG-26960) | Resolved security vulnerabilities in the Inventory Adapter by updating the fast-uri and brace-expansion packages. |
| Inventory Manager | Security cleanup for nanoid, brace-expansion, and fast-uri (ENG-26959) | Resolved security vulnerabilities in Inventory Manager by updating the nanoid, brace-expansion, and fast-uri packages. |
| itential-utils | Resolved resource allocation vulnerability in brace-expansion (ENG-26171) | Updated the brace-expansion package version to resolve an Allocation of Resources Without Limits or Throttling vulnerability. |
| Job Viewer | Job Viewer security updates (ENG-27243) | Resolved an Uncaught Exception vulnerability with security-related package updates. |
| NSO Service Manager | Resolved disallowed inputs vulnerability in dompurify (app-service_management) (ENG-26641) | Resolved an Incomplete List of Disallowed Inputs vulnerability (CVE-2026-66010) by updating the dompurify package in app-service_management. |
| NSO Service Manager | Resolved interpretation conflict vulnerability in nanoid (app-service_management) (ENG-26640) | Resolved an Interpretation Conflict vulnerability (CVE-2026-67213) by updating the nanoid package in app-service_management. |
| NSO Service Manager | Resolved interpretation conflict vulnerability in fast-uri (adapter-nso) (ENG-26637) | Resolved an Interpretation Conflict vulnerability (CVE-2026-18446) by updating the fast-uri package in adapter-nso. |
| NSO Service Manager | Resolved resource allocation vulnerability in brace-expansion (adapter-nso) (ENG-26636) | Resolved an Allocation of Resources Without Limits or Throttling vulnerability (CVE-2026-69152) by updating the brace-expansion package in adapter-nso. |
| NSO Service Manager | Resolved prototype pollution vulnerability in axios (adapter-nso) (ENG-26635) | Resolved a Prototype Pollution vulnerability (CVE-2026-67320) by updating the axios package in adapter-nso. |
| NSO Service Manager | Resolved interpretation conflict vulnerability in nanoid (app-nso_manager) (ENG-26634) | Resolved an Interpretation Conflict vulnerability (CVE-2026-67213) by updating the nanoid package in app-nso_manager. |
| NSO Service Manager | Resolved interpretation conflict vulnerability in fast-uri (app-nso_manager) (ENG-26633) | Resolved an Interpretation Conflict vulnerability (CVE-2026-18446) by updating the fast-uri package in app-nso_manager. |
| NSO Service Manager | Resolved resource allocation vulnerability in brace-expansion (app-nso_manager) (ENG-26632) | Resolved an Allocation of Resources Without Limits or Throttling vulnerability (CVE-2026-69152) by updating the brace-expansion package in app-nso_manager. |
| NSO Service Manager | Resolved prototype pollution vulnerability in axios (app-nso_manager) (ENG-26631) | Resolved a Prototype Pollution vulnerability (CVE-2026-67320) by updating the axios package in app-nso_manager. |
| Work Center | Resolved algorithmic complexity vulnerabilities in Work Center (ENG-26625) | Resolved Inefficient Algorithmic Complexity vulnerabilities with package updates. |
| Work Center | Resource allocation security update (ENG-26465) | Resolved an Allocation of Resources Without Limits or Throttling vulnerability with security updates. |
| Work Center | Work Center security updates (ENG-27243) | Resolved an Uncaught Exception vulnerability with security-related package updates. |
Component versions
| Component | Version |
|---|---|
| Configuration Manager Enterprise | 6.5.2 |
| FlowAI | 1.1.0 |
| Gateway Manager | 1.2.2 |
| Inventory Manager | 1.2.15 |
| NSO Service Manager | 6.5.2 |