Pipelines​

• Added a Quick launch button to the empty state of the Runs page. Next to it, Launch pipeline appears when the workspace has pipelines, and Add pipeline when it has none.

Data Explorer​

• Added a Create folder action next to Upload in Data Explorer, which creates an empty folder in an AWS S3, Azure Blob Storage, or Google Cloud Storage data repository, including from the data picker in the launch form. Like uploading, it requires write permission on the data repository, so the Launch and View roles cannot create folders, and it is not available for public data repositories.
• Added a .azure_blob_dir marker file to each folder created in an Azure Blob Storage data repository, the convention Nextflow uses to keep an empty directory. The marker appears in the folder listing, and is not written when the folder already has content.

Bug fixes​

Studios​

• Fixed long names in the Studios list being truncated at a fixed width even when the column had room to show them.

Credentials​

• Restricted the Azure Batch and Azure Storage account names in Azure credentials to 3 to 24 letters and digits, matching Azure's account naming rules. A name with other characters, such as URL delimiters, is rejected when the credential is created or updated, before it can be used to build an Azure endpoint URL.

Pipelines​

• Fixed the Recently updated sort on the Launchpad ignoring pipelines beyond the first 60. Pipelines are now sorted on the server.
• Fixed the run details page continuing to show the previous run after you opened another run in the same workspace, for example from global search.
• Fixed adding a pipeline failing when its optional repository avatar could not be fetched. A failed avatar lookup no longer blocks pipeline creation.
• Fixed a repository request refused by outbound request protection failing with an unexpected error. The error now names the repository and why it could not be accessed.
• Fixed requests to a Git server configured with an http:// address that redirects to HTTPS losing their credentials. A redirect from HTTP to HTTPS on the same host and default ports now keeps the request headers.
• Updated the bundled Nextflow version to 25.10.9, which keeps a Bitbucket API token out of the repository clone URL.

Data Explorer​

• Fixed file lineage in the file preview failing with 503 errors, or missing resumed runs, when it looked up the run that produced a file. The run is now resolved through lineage search, and its link opens the run in its own workspace.
• Aligned the error for an AWS S3 bucket that the credentials cannot access with the other providers: Data Explorer now reports that the credentials for the bucket are missing or not valid. Other S3 bucket validation failures now return a bad request error instead of the raw S3 error.
• Fixed a zero-byte name/ folder placeholder blob in an Azure Blob Storage data repository appearing as a blank file inside the folder it represents. It is now omitted from that folder's listing and shown as a folder elsewhere.

General​

• Extended outbound request protection to every Source Code Management request for pipelines and Studios, adding branch and tag listings, repository validation, and avatar lookups to file reads. Each redirect hop is re-checked, and credentials such as a GitLab PRIVATE-TOKEN header are no longer forwarded to another host on a redirect.
• Hardened the bucket event endpoint used by pipeline actions. Every SNS message is now signature-verified, and a subscription confirmation must match the stored topic and is completed with the SNS ConfirmSubscription API instead of by fetching a URL from the message.
• Restricted the Wave pairing proxy to the Seqera Platform API endpoint. A request to any other scheme, host, port, or path is refused with 403.
• Fixed the pagination of the resource selection dialog in projects being cut off on taller screens.

Upgrade notes​

No database migrations are included in this release.

Outbound request protection covers every Source Code Management request​

TOWER_SSRF_PROTECTION_MODE and TOWER_SSRF_PROTECTION_ALLOWED_HOSTS now govern every Source Code Management request for pipelines and Studios: file reads, branch and tag listings, repository validation, and avatar lookups, each re-checked at every redirect hop. If a Git server resolves to a private address and is not allowed by TOWER_SSRF_PROTECTION_ALLOWED_HOSTS, the default warn mode now logs SSRF protection warnings for these requests too. Search the backend logs again before switching to enforce.

TOWER_HTTP_URL_FETCH_MAX_BODY_BYTES now caps the response of each of these requests, not only file reads, and replaces Nextflow's NXF_GIT_RESPONSE_MAX_LENGTH for all of them. TOWER_HTTP_URL_FETCH_TIMEOUT and TOWER_HTTP_URL_FETCH_CALL_TIMEOUT apply to them as well.

Azure credentials must use valid account names​

Azure credentials are rejected on create or update when the Batch or Storage account name is not 3 to 24 letters and digits. A stored credential with such a name now fails validation, so review existing Azure credentials before you upgrade.

API changes​

The published API contract moves from 1.228.0 to 1.229.0. It adds CreateDataLinkFolder, declares the nullable compute environment fields listed under bug fixes, and declares the account name pattern for the Azure credential batchName and storageName fields. Regenerate any OpenAPI-derived clients against 1.229.0.

Security updates​

• CVE-2026-91403, CVE-2026-113470: Updated the Java base image for the backend and database migration containers to Amazon Corretto 25.0.5, which blocks the compromised eMudhra intermediate certificates and removes the affected emSign roots.
• CVE-2023-54404 (GHSA-mrhx-c7xc-m3w5): Updated the zod dependency of the web frontend to 4.6.7. Versions before 4.6.6 could exhaust memory validating an oversized array, even when the schema set a maximum length.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies. No database migrations are included in this release.

Security updates​

• CVE-2026-113470: Updated the Java base image for the backend and database migration containers to Amazon Corretto 17.0.21, which removes the affected emSign roots. The compromised eMudhra intermediate certificate authorities covered by CVE-2026-91403 were already blocked in v25.3.7; Corretto 17.0.21 carries the same block.

Platform API​

• Fixed generated API clients and schema validators rejecting valid 2xx responses. Optional credential, pipeline, workflow, task, team, participant, user, and organization response properties are now declared nullable in the OpenAPI specification. Runtime serialization is unchanged.
• Fixed compute environment responses failing schema validation. Nullable AWS Batch, Forge, and common compute configuration fields are now declared, forged and deleted Forge resources are modelled as string-valued maps, and ForgeConfig.arm64Enabled, ForgeConfig.fargateHeadEnabled, and secretsKmsKeyId are nullable when a persisted configuration omits them.
• Fixed credential responses emitting null AWS and GitHub secret values. Null secrets are now omitted from the JSON response while write-only OpenAPI semantics are retained, and the conditional workspaceId requirement for workspace-owned versus user-owned credentials is documented.
• Fixed the workflow, task, load, statistics, launch, and job response contracts to match the values actually returned, and corrected LogPage.entries to an array of strings.
• Fixed the pipeline version creator metadata, repository list values, and the dataset, participant, data-link, label, and Studios response contracts to match the values actually returned.
• Fixed dataset downloads losing the stored media type, and declared CSV, TSV, and octet-stream response media types for dataset version downloads.
• Fixed the GA4GH WES endpoints returning 500 instead of 404 for a run ID that does not exist. Run describe, status, and cancel now return and document 404, and member lookup documents 404.

Monitoring and observability​

• Fixed fusion_throughput_bytes telemetry reporting only the first day of the current month for each organization. The current month now counts every day so far. Past months are unchanged.

General​

• Fixed the Fusion throughput quota never blocking a launch. The launch-time check read the current month's usage as zero because usage is stored as one row per day, so maxFusionThroughputBytes was never enforced. The check now sums the organization's daily rows for the current UTC month, which matches the figure shown on the Fusion usage dashboard.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies. No database migrations are included in this release.

API changes​

The published API contract moves from 1.184.0 to 1.192.0. Most changes correct the specification to describe responses the server already returned, with two exceptions that change responses:

• Null credential secrets are now omitted. AWS and GitHub secret keys that previously serialized as null are no longer present in credential responses. Clients that read these keys must tolerate an absent key rather than a null value.
• GA4GH WES returns 404 for unknown runs. Run describe, status, and cancel return 404 instead of 500 when the run ID does not exist.

Regenerate any OpenAPI-derived clients against 1.192.0 to pick up the corrected nullability declarations.

Behavior changes​

• The Fusion throughput quota is now enforced. Organizations with maxFusionThroughputBytes set have had no effective limit since Fusion usage moved to daily rows. Launches that exceed the configured quota are now blocked. Review configured quotas against current Fusion usage before you upgrade.
• Fusion telemetry totals increase. The fusion_throughput_bytes value reported for the current month now covers the full month to date rather than its first day.

Security updates​

• CVE-2026-42198: Updated the PostgreSQL JDBC driver to 42.7.12, which resolves a client-side denial of service during SCRAM-SHA-256 authentication, where a malicious server requests an unbounded PBKDF2 iteration count.
• CVE-2026-91403, CVE-2026-113470: Updated the Java base image for the backend and database migration containers to Amazon Corretto 17.0.21, which blocks the compromised eMudhra intermediate certificates and removes the affected emSign roots.

Container building​

• Documented CA certificates in Pixi images by @pditommaso in #1211
• Documented nested packages build options in the container API by @pditommaso in #1208
• Added a dedicated Build with Pixi documentation section by @MichaelTansiniSeqera in #1150
• Added the Pixi build template to the Nextflow configuration reference by @MichaelTansiniSeqera in #1148

Dependencies​

• Updated node dependency to v24.22.0 by @seqeralabs-renovate[bot] in #1214
• Updated github.com/moby/buildkit module to v0.34.1 by @seqeralabs-renovate[bot] in #1213
• Updated public.cr.seqera.io/seqeralabs/nf-jdk:corretto-25.0.4-al2023-jemalloc Docker digest to 15e35e9 by @seqeralabs-renovate[bot] in #1212
• Updated Gradle minor and patch dependencies by @seqeralabs-renovate[bot] in #1215

General​

• Removed the Comodo AAA root certificate from the Wave CLI native trust store (CVE-2026-91403) by @pditommaso in #1205
• Changed the workflow lookup to request the minimal workflow record and stop renewing on any 4xx reply by @pditommaso in #1209
• Pulled the docs-previewer image from public.cr.seqera.io instead of Harbor by @ShahzebMahmood in #1206
• Changed the base image to public.cr.seqera.io/seqeralabs/nf-jdk by @pditommaso in #1207
• Aligned the repository CI with the squad baseline by @cristianrcv in #1204
• Changed the Homebrew tap release to use the JRELEASER_HOMEBREW_GITHUB_TOKEN secret by @munishchouhan in #1217
• Stopped copying the release image to the legacy ECR by @ShahzebMahmood in #1216

New contributors​

• @MichaelTansiniSeqera made their first contribution in #1150

Full changelog: https://github.com/seqeralabs/wave/compare/v1.42.1...v1.42.2

Language features​

• Allowed a list of columns for the splitCsv header in the type checker by @bentsherman in #7871
• Checked equality between records, maps, lists, and tuples by @bentsherman in #7852
• Detected input file name collisions in typed processes by @bentsherman in #7859
• Highlighted the entire token on parse error by @bentsherman in #7877
• Staged files in record collection inputs by @bentsherman in #7866

Configuration​

• Typed the process.secret config option as a list by @bentsherman in #7911

Plugins​

• Documented -patchN plugin versions for stable releases and hardened the release job by @bentsherman in #7876
• Preserved the generic return type in plugin function specs by @bentsherman in #7910

Wave​

• Made Wave optional for the Seqera executor and skipped the Wave Fusion layer by @pditommaso in #7744
• Retried Wave validation tasks when Docker exits 125 by @edmundmiller in #7898

General​

• Built plain and dind launchers for e2e tests by @pditommaso in #7835
• Capped the lifetime of Azure Batch jobs created by CI by @pinin4fjords in #7935
• Improved redaction of sensitive values in logs by @jorgee in #7879
• Prevented leaking environment secrets in CI by @jorgee in #7873

Bug fixes​

Language features​

• Fixed task hash of records returned by typed functions by @bentsherman in #7887
• Fixed type checking of comparator closures on lists of tuples by @bentsherman in #7869
• Fixed type checking of key and value properties on map entries by @bentsherman in #7875

Azure​

• Fixed Azure Batch pool creation when the pool does not exist by @pinin4fjords in #7904

Google Batch​

• Stripped trailing slash from task output paths on GCS by @bentsherman in #7888

Plugins​

• Fixed serial input files metrics computation in nf-seqera by @jordeu in #7899

Dependencies​

• Bumped nf-azure@1.24.3
• Bumped nf-k8s@1.6.2
• Bumped nf-seqera@0.26.1
• Bumped nf-tower@1.32.2
• Bumped nf-wave@1.22.4
• Bumped sched-client to 0.111.0 in nf-seqera

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.10.4

General​

• Updated the PostgreSQL JDBC driver to 42.7.12. This resolves a denial of service in which a malicious database server could exhaust client CPU during SCRAM authentication, and a silent loss of channel-binding protection on connections that require it.

Bug fixes​

Pipelines​

• Fixed the Fusion throughput quota never blocking a launch, which let organizations run Fusion-enabled workflows beyond their configured monthly throughput limit.

Monitoring and observability​

• Fixed fusion_throughput_bytes telemetry under-reporting the current month, counting only the first day instead of every day of the month so far.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.

Security updates​

• CVE-2026-91403: Added the eight compromised eMudhra intermediate certificate authorities to the JDK blocked certificate list. Their private keys were leaked, so anyone holding them could issue a certificate for any domain. The default trust store does not anchor these chains, so this is defence in depth for installations that use a custom trust store built from a full CA bundle.

General​

• Improved redaction of sensitive values in logs by @jorgee in #7879

Dependencies​

• Bumped nf-google@1.27.3-patch1
• Bumped nf-k8s@1.5.4-patch1

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.04.9

Access control​

• Allowed root administrators to remove a workspace participant from the admin panel without being blocked by agent-binding guards, and clarified the service account confirmation copy in the admin flows.
• Added support for resource-bound OAuth tokens for the Seqera MCP client, so a token issued for the MCP server can be exchanged for a separate Seqera Platform access token when one is needed.

Agents​

• Renamed the agent Pause and Resume actions to Disable and Enable to match what they do: a disabled agent cannot be run manually or by an action.

Co-Scientist​

• Added a Stop session control to a running, workspace-owned agent session in the Co-Scientist chat drawer, which cancels the session on the server.
• Added arrow-key navigation into and out of categories in the @-mention panel, made Escape close the panel from the root menu, and stopped long descriptions truncating mention names.
• Improved chat responsiveness on the Launchpad and Runs pages by skipping page screenshot capture, which could stall the first keystroke.

Pipelines​

• Added Nextflow 25.10.8 and 26.09.1-edge to the version catalog, making them selectable in the launch form and the API.

General​

• Added a warning to a required resource select when the list is empty and the user cannot create a resource, explaining who to ask instead of leaving an unusable field.

Bug fixes​

Access control​

• Fixed a blank Edit page in the admin Workspaces list when another workspace in the organization matched the target workspace's name, full name, or description.

Agents​

• Fixed agent actions failing without explanation when their GitHub App credential had been deleted. The reason now appears in the trigger history and the action is paused.
• Fixed an agent's Details tab omitting the bound GitHub App credential. The credential name now appears, and reads No longer available when the binding no longer resolves.
• Fixed the search box on the Agents page losing focus while results loaded, which dropped any keystrokes typed in the meantime.
• Fixed the Agents page showing an empty state when the agent list failed to load. It now shows a load error with a Retry action, and keeps the Add button and search visible.

Credentials​

• Restricted uploaded Google credentials to service account keys, rejecting other credential types and requiring the token URI to be an HTTPS endpoint on a Google-owned host.

Monitoring and observability​

• Fixed fusion_throughput_bytes telemetry reporting only the first day of the current month. It now covers every day of the month so far.

Pipelines​

• Fixed text-based reports (TXT, JSON, YAML, Markdown, and scripts) rendering as a blank page when opened in a new tab from the report preview dialog.
• Fixed clicking a task in global search results opening the run's Tasks tab instead of the task itself.
• Updated the bundled Nextflow version to 25.10.8, so a Bitbucket Server credential that holds a token but no password now authenticates instead of failing with "Not authorized".
• Clarified the API error and the Actions form messages shown for a pipeline that belongs to a shared workspace, which an action cannot watch or launch.
• Fixed every compute environment being disabled when resuming a run whose work directory differed from the compute environment's only by a trailing slash.
• Fixed the Fusion throughput quota never blocking a launch, because the check looked for a single monthly usage row instead of totalling the organization's daily rows for the current month.
• Fixed editing a pipeline's Seqera Platform schema failing with an "already exists" error when the pasted schema declared an $id.
• Stopped the backend compiling a pipeline repository's nextflow.config when reading its params, profiles, and manifest. The file is now only parsed, with no change to the values shown.

Projects​

• Hid the dataset actions on the Datasets tab from roles that lack the dataset label permissions they require, which previously failed with a 403 error or left a new dataset outside the project.
• Fixed relaunching a run from a project's Runs tab returning to the workspace Runs page instead of the project's own tab.
• Fixed the Edit project page omitting project pipelines whose names sorted beyond the first 50 pipelines in the workspace.

Service accounts​

• Fixed the Workspace access card for a service account with no workspaces, which showed a full empty state instead of collapsing to a header with its action.
• Blocked removing a service account from a workspace, or deleting it at organization level, while it is still bound to active agents. The request now returns a conflict error that lists the agents and workspaces involved.

General​

• Constrained outbound Source Code Management requests to permitted destinations, re-validating the target on every redirect, refusing HTTPS-to-HTTP downgrades, and dropping request headers on cross-origin hops. Credential base URLs are now validated when credentials are created or updated.
• Fixed design system form controls not repainting after their value was set without emitting a change event.
• Fixed empty states rendering their title as a second top-level heading, which gave screen readers an incorrect page outline.

Upgrade notes​

Outbound request protection starts in warn mode​

Requests to a destination a user supplies — Source Code Management reads for pipeline schema and configuration files and Studios repositories, and credentials base-URL validation — can now be restricted from reaching private or link-local addresses. TOWER_SSRF_PROTECTION_MODE defaults to warn, which logs what would be refused but still allows it. Before switching to enforce, search the backend logs for SSRF protection warnings: each one names the refused host and the setting that would permit it.

Use TOWER_SSRF_PROTECTION_ALLOWED_HOSTS for destinations that must stay reachable in private address space, such as a self-hosted GitHub Enterprise, GitLab, Bitbucket Server, or Gitea, or an S3-compatible store named by a credential base URL. It accepts hostnames, wildcard hostnames, CIDR blocks, and the keywords loopback, private, link-local, and *. Every server configured under tower.scm.providers is allowed implicitly, except loopback hosts, which must be listed explicitly. Address an internal Git server by hostname and allowlist that hostname — a pipeline repository URL that names a private IP address directly is rejected before this setting is consulted.

Uploaded Google credentials must be service account keys​

Google credentials are now parsed as service account keys only. A credential of any other type, including external_account, is rejected, and a token_uri must be an HTTPS endpoint on a Google-owned host. Review any stored Google credential that was not created from a service account key.

Source Code Management file reads have a size limit​

TOWER_HTTP_URL_FETCH_MAX_BODY_BYTES sets the largest response body buffered on a full-body read of a Source Code Management schema or configuration file, and defaults to 10485760 (10 MiB). An oversized file is rejected rather than truncated, so it reports as oversized instead of as a parse error. This replaces Nextflow's NXF_GIT_RESPONSE_MAX_LENGTH for Source Code Management file reads. The ranged preview reads used by dataset import are unaffected.

Agent backend calls are bounded by new timeouts​

TOWER_AGENT_BACKEND_TIMEOUT sets the per-request connect and read timeout for agent backend calls and defaults to 5s. TOWER_AGENT_BACKEND_BINDING_CHECK_BUDGET caps the per-workspace agent-binding fan-out performed when deleting a service account at organization level, and defaults to 15s; once the budget is exceeded, the deletion fails.

Resource-bound tokens apply only to the Seqera MCP client​

TOWER_OIDC_MCP_CLIENT_NAME names the dynamic client registration client_name of the Seqera MCP server, and defaults to seqera-mcp. Resource-bound tokens and the user access-token exchange apply to this client alone; the resource parameter sent by any other client is ignored.

Security updates​

• CVE-2026-91403: Added the eight compromised eMudhra intermediate certificate authorities to the JDK blocked certificate list. Their private keys were leaked, so anyone holding them could issue a certificate for any domain. The default trust store does not anchor these chains, so this is defence in depth for installations that use a custom trust store built from a full CA bundle.

Bug fixes​

General​

• Removed the Bitbucket API token from git clone URLs and logs by @bentsherman in #7870
• Prevented leaking environment secrets in CI by @jorgee in #7873

Dependencies​

• Bumped nf-azure@1.20.4
• Bumped nf-k8s@1.2.3
• Bumped nf-tower@1.17.8

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v25.10.9

Bug fixes​

General​

• Removed the Bitbucket API token from git clone URLs and logs by @bentsherman in #7870
• Prevented leaking environment secrets in CI by @jorgee in #7873

Dependencies​

• Bumped nf-azure@1.22.8
• Bumped nf-k8s@1.5.6
• Bumped nf-tower@1.28.4

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.04.8

Bug fixes​

Language features​

• Applied Harshil alignment to trailing comments, not annotations by @bentsherman in #7832
• Fixed cascading type errors from inconsistently typed expressions by @bentsherman in #7851
• Fixed hang in preview mode with workflow outputs by @bentsherman in #7838
• Fixed onError section in entry workflow by @bentsherman in #7831
• Fixed stdlib typos by @bentsherman in #7863
• Fixed type checking of function calls that omit default params by @bentsherman in #7860
• Fixed type of task.label in language definitions by @bentsherman in #7857

Configuration​

• Fixed unrecognized config warnings for nextflow.retryPolicy options by @pditommaso in #7843

General​

• Escaped control characters in task metadata and job names by @arnaualcazar in #7764
• Removed the Bitbucket API token from git clone URLs and logs by @bentsherman in #7870

Dependencies​

• Updated Grengine to 3.1.2 (group ID and package ch.grengine) by @alainstalder in #7842

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.10.3

Google credentials now accept only service account keys. Creating or updating a credential with a key of another type, a non-Google token URI, or a universe domain other than googleapis.com fails, and a stored credential that fails the same check becomes invalid at its next validation. Workload Identity Federation credentials are unchanged.

Feature updates and improvements​

Compute environments​

• Added Fusion version and Fusion snapshots settings to the compute environment, pipeline, and launch forms.

Studios​

• Added a capacity check that blocks a Studio when its AWS Batch compute environment is full, and reports a session waiting for resources.

Agents​

• Renamed the agent Pause and Resume actions to Disable and Enable.

Co-Scientist​

• Changed a new conversation to bill the organization of the workspace it starts from, rather than one inferred from the page.

Datasets​

• Moved the datasets table to the comfortable layout, with taller rows and more space in each cell.
• Added a View hint to the runs link on a dataset row.

Pipelines​

• Added Nextflow 26.10.0 to the version catalog.

Data Explorer​

• Added a specific error for a bucket the selected credentials cannot access, in place of a generic failure.
• Moved the Data Explorer list from row cards to a headed table in the comfortable layout. Hidden now sits next to a repository's name, beside Public.

Bug fixes​

Compute environments​

• Fixed a Google Cloud head VM staying up when its first self-delete was refused. It now retries for up to an hour.
• Fixed an Azure Cloud run that ends before Nextflow reports its start giving no diagnosis. The error now points to the head's launcher output.
• Fixed AWS Forge leaving s3:AbortMultipartUpload out of the policy it writes for the work directory bucket, where a failed or canceled multipart upload left incomplete parts behind. Compute environments created before this release keep their existing policy.
• Fixed a Studio on a Google Cloud compute environment failing to pull a private container image from Artifact Registry or Container Registry. The head VM now authenticates to the registry with its own identity.

Pipelines​

• Fixed the launch form leaving nested run parameters empty when a config profile set them.
• Fixed a long version name misaligning the columns of the Launchpad list.
• Fixed editing a pipeline's Seqera Platform schema failing with an "already exists" error when the schema declares an $id.

Co-Scientist​

• Fixed a conversation showing no feedback while its transcript loaded.

Agents​

• Fixed a failed agents list showing the "No agents configured yet" empty state instead of an error.

Projects​

• Fixed the project edit form omitting project pipelines that sorted past the first page.

Data Explorer​

• Fixed the data picker offering Upload to users without permission to upload.

Credits​

• Fixed storage and network usage not being priced, so it never drew from credit grants.

Monitoring and observability​

• Fixed a run with no output directory showing a lineage message on its Outputs tab.
• Fixed folders on a run's Outputs tab not expanding. The pipeline outputs list is now always a tree.

Studios​

• Fixed long Studio names truncating in the Studios list while the name column still had room.

General​

• Fixed form controls not repainting after a silent value update.
• Fixed the Fusion throughput quota never applying at launch.

General​

• Moved job queues to lib-data-workqueue, fixed duplicate job processing, and drained the queues on shutdown by @pditommaso in #1201
• Named the Wave image path in the self-install guides by @robsyme in #1179

Dependencies​

• Updated postgres Docker tag to v16.15 by @seqeralabs-renovate[bot] in #1198
• Updated npm minor and patch dependencies by @seqeralabs-renovate[bot] in #1197
• Updated GitHub Actions by @seqeralabs-renovate[bot] in #1195

Full changelog: https://github.com/seqeralabs/wave/compare/v1.41.0...v1.42.0

General​

• Pulled the nf-jdk base image from public.cr.seqera.io by @ShahzebMahmood in #1200
• Published work queue metrics for the job queues by @pditommaso in #1203

Full changelog: https://github.com/seqeralabs/wave/compare/v1.42.0...v1.42.1

Container building​

• Kept only the platform's Fusion snapshot layer in multi-arch images by @pditommaso in #1191
• Dropped the other platform's layers from frozen multi-arch container files by @pditommaso in #1193

General​

• Matched registry credentials by repository path by @cristianrcv in #1165
• Disabled SSRF protection by default by @pditommaso in #1192
• Published condasplit with the Wave release and checked that its default matches VERSION by @pditommaso in #1188

Dependencies​

• Bumped condasplit to v2 and checked the VERSION bump on pull requests by @pditommaso in #1187
• Overrode the vulnerable jackson on the Gradle plugins classpath by @pditommaso in #1194

Bug fixes​

Container building​

• Stripped stray leading blank line from extracted Conda lock file by @pinin4fjords in #1082

New contributors​

• @pinin4fjords made their first contribution in #1082

Full changelog: https://github.com/seqeralabs/wave/compare/v1.40.4...v1.41.0

Google Batch​

• Fetched Google Batch task status once per trace record by @bentsherman in #7807
• Retried INTERNAL errors from the Google Batch API by @bentsherman in #7805

Plugins​

• Loaded the config files in the plugin commands session by @pditommaso in #7815

General​

• Retried foreign file staging on connection reset by @pditommaso in #7799

Bug fixes​

Language features​

• Fixed file-handling bugs in native processes by @bentsherman in #7789
• Fixed workflow output path closure returning an empty map by @bentsherman in #7823
• Fixed workflow variables named published or owner by @pinin4fjords in #7814

Google Batch​

• Fixed Google Batch array job deleted when a single array task is killed by @pditommaso in #7808

Fusion​

• Skipped Fusion .fusion directories when publishing directories by @pditommaso in #7811

General​

• Fixed unit tests that depend on global state from other tests by @bentsherman in #7804

Dependencies​

• Bumped nf-amazon@3.12.1
• Bumped nf-azure@1.24.2
• Bumped nf-google@1.29.1

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.10.1

Plugins​

• Built plugin commands config in the CLI by @pditommaso in #7834

Bug fixes​

Language features​

• Fixed formatter treating comment-like GString text as a comment by @bentsherman in #7828

Dependencies​

• Bumped nf-tower@1.32.1
• Bumped nf-wave@1.22.3

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.10.2

General​

• Published multi-arch (amd64 and arm64) Wave image on release and preview by @pditommaso in #1180

Dependencies​

• Updated github.com/moby/go-archive module to v0.3.0 (security) by @seqeralabs-renovate[bot] in #1177
• Bumped lib-cache-tiered-redis to 1.1.1 by @pditommaso in #1182
• Bumped lib-pairing to 1.2.0 by @pditommaso in #1184

Bug fixes​

General​

• Fixed token watcher head-of-line blocking on slow Platform endpoints by @jordeu in #1181

Full changelog: https://github.com/seqeralabs/wave/compare/v1.40.2...v1.40.3

Full changelog: https://github.com/seqeralabs/wave/compare/v1.40.3...v1.40.4

A Fusion version selected in the launch form or saved on a pipeline no longer takes effect on its own. Runs use the Fusion version from the Nextflow launcher container unless the Fusion version override is enabled on the compute environment.

Feature updates and improvements​

Co-Scientist​

• Moved the current page out of the status bar and onto a Context chip in the composer, where it stays visible after a page screenshot is skipped or dismissed.
• Added arrow-key navigation into and out of a category in the @ mention menu.
• Changed Esc at the top level of the @ mention menu to close the panel instead of reopening it.

Agents​

• Added the bound GitHub App credential to an agent's Details tab.
• Added a message to the Service account picker on the agent form when the workspace has no service account.

Actions​

• Added a link from an action's Target card to the agent it runs.
• Added a message to the Agent picker on the action form when the workspace has no agent.

Bug fixes​

Compute environments​

• Fixed cancelling a run on Google Batch failing and leaving its task jobs running.
• Fixed runs on EC2 instance types without live console output being marked unknown and dropped from monitoring.

Pipelines​

• Fixed resuming a run disabling every compute environment when the environment's work directory ends in a slash.