52 posts tagged with "seqera enterprise"

Feature updates and improvements​

Pipelines​

• Added a Quick launch button to the empty state of the Runs page. Next to it, Launch pipeline appears when the workspace has pipelines, and Add pipeline when it has none.

Data Explorer​

• Added a Create folder action next to Upload in Data Explorer, which creates an empty folder in an AWS S3, Azure Blob Storage, or Google Cloud Storage data repository, including from the data picker in the launch form. Like uploading, it requires write permission on the data repository, so the Launch and View roles cannot create folders, and it is not available for public data repositories.
• Added a .azure_blob_dir marker file to each folder created in an Azure Blob Storage data repository, the convention Nextflow uses to keep an empty directory. The marker appears in the folder listing, and is not written when the folder already has content.

Bug fixes​

Studios​

• Fixed long names in the Studios list being truncated at a fixed width even when the column had room to show them.

Credentials​

• Restricted the Azure Batch and Azure Storage account names in Azure credentials to 3 to 24 letters and digits, matching Azure's account naming rules. A name with other characters, such as URL delimiters, is rejected when the credential is created or updated, before it can be used to build an Azure endpoint URL.

Pipelines​

• Fixed the Recently updated sort on the Launchpad ignoring pipelines beyond the first 60. Pipelines are now sorted on the server.
• Fixed the run details page continuing to show the previous run after you opened another run in the same workspace, for example from global search.
• Fixed adding a pipeline failing when its optional repository avatar could not be fetched. A failed avatar lookup no longer blocks pipeline creation.
• Fixed a repository request refused by outbound request protection failing with an unexpected error. The error now names the repository and why it could not be accessed.
• Fixed requests to a Git server configured with an http:// address that redirects to HTTPS losing their credentials. A redirect from HTTP to HTTPS on the same host and default ports now keeps the request headers.
• Updated the bundled Nextflow version to 25.10.9, which keeps a Bitbucket API token out of the repository clone URL.

Data Explorer​

• Fixed file lineage in the file preview failing with 503 errors, or missing resumed runs, when it looked up the run that produced a file. The run is now resolved through lineage search, and its link opens the run in its own workspace.
• Aligned the error for an AWS S3 bucket that the credentials cannot access with the other providers: Data Explorer now reports that the credentials for the bucket are missing or not valid. Other S3 bucket validation failures now return a bad request error instead of the raw S3 error.
• Fixed a zero-byte name/ folder placeholder blob in an Azure Blob Storage data repository appearing as a blank file inside the folder it represents. It is now omitted from that folder's listing and shown as a folder elsewhere.

General​

• Extended outbound request protection to every Source Code Management request for pipelines and Studios, adding branch and tag listings, repository validation, and avatar lookups to file reads. Each redirect hop is re-checked, and credentials such as a GitLab PRIVATE-TOKEN header are no longer forwarded to another host on a redirect.
• Hardened the bucket event endpoint used by pipeline actions. Every SNS message is now signature-verified, and a subscription confirmation must match the stored topic and is completed with the SNS ConfirmSubscription API instead of by fetching a URL from the message.
• Restricted the Wave pairing proxy to the Seqera Platform API endpoint. A request to any other scheme, host, port, or path is refused with 403.
• Fixed the pagination of the resource selection dialog in projects being cut off on taller screens.

Upgrade notes​

No database migrations are included in this release.

Outbound request protection covers every Source Code Management request​

TOWER_SSRF_PROTECTION_MODE and TOWER_SSRF_PROTECTION_ALLOWED_HOSTS now govern every Source Code Management request for pipelines and Studios: file reads, branch and tag listings, repository validation, and avatar lookups, each re-checked at every redirect hop. If a Git server resolves to a private address and is not allowed by TOWER_SSRF_PROTECTION_ALLOWED_HOSTS, the default warn mode now logs SSRF protection warnings for these requests too. Search the backend logs again before switching to enforce.

TOWER_HTTP_URL_FETCH_MAX_BODY_BYTES now caps the response of each of these requests, not only file reads, and replaces Nextflow's NXF_GIT_RESPONSE_MAX_LENGTH for all of them. TOWER_HTTP_URL_FETCH_TIMEOUT and TOWER_HTTP_URL_FETCH_CALL_TIMEOUT apply to them as well.

Azure credentials must use valid account names​

Azure credentials are rejected on create or update when the Batch or Storage account name is not 3 to 24 letters and digits. A stored credential with such a name now fails validation, so review existing Azure credentials before you upgrade.

API changes​

The published API contract moves from 1.228.0 to 1.229.0. It adds CreateDataLinkFolder, declares the nullable compute environment fields listed under bug fixes, and declares the account name pattern for the Azure credential batchName and storageName fields. Regenerate any OpenAPI-derived clients against 1.229.0.

Security updates​

• CVE-2026-91403, CVE-2026-113470: Updated the Java base image for the backend and database migration containers to Amazon Corretto 25.0.5, which blocks the compromised eMudhra intermediate certificates and removes the affected emSign roots.
• CVE-2023-54404 (GHSA-mrhx-c7xc-m3w5): Updated the zod dependency of the web frontend to 4.6.7. Versions before 4.6.6 could exhaust memory validating an oversized array, even when the schema set a maximum length.

This is a maintenance release. It contains no feature changes and no bug fixes.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies. No database migrations are included in this release.

Security updates​

• CVE-2026-113470: Updated the Java base image for the backend and database migration containers to Amazon Corretto 17.0.21, which removes the affected emSign roots. The compromised eMudhra intermediate certificate authorities covered by CVE-2026-91403 were already blocked in v25.3.7; Corretto 17.0.21 carries the same block.

Bug fixes​

Platform API​

• Fixed generated API clients and schema validators rejecting valid 2xx responses. Optional credential, pipeline, workflow, task, team, participant, user, and organization response properties are now declared nullable in the OpenAPI specification. Runtime serialization is unchanged.
• Fixed compute environment responses failing schema validation. Nullable AWS Batch, Forge, and common compute configuration fields are now declared, forged and deleted Forge resources are modelled as string-valued maps, and ForgeConfig.arm64Enabled, ForgeConfig.fargateHeadEnabled, and secretsKmsKeyId are nullable when a persisted configuration omits them.
• Fixed credential responses emitting null AWS and GitHub secret values. Null secrets are now omitted from the JSON response while write-only OpenAPI semantics are retained, and the conditional workspaceId requirement for workspace-owned versus user-owned credentials is documented.
• Fixed the workflow, task, load, statistics, launch, and job response contracts to match the values actually returned, and corrected LogPage.entries to an array of strings.
• Fixed the pipeline version creator metadata, repository list values, and the dataset, participant, data-link, label, and Studios response contracts to match the values actually returned.
• Fixed dataset downloads losing the stored media type, and declared CSV, TSV, and octet-stream response media types for dataset version downloads.
• Fixed the GA4GH WES endpoints returning 500 instead of 404 for a run ID that does not exist. Run describe, status, and cancel now return and document 404, and member lookup documents 404.

Monitoring and observability​

• Fixed fusion_throughput_bytes telemetry reporting only the first day of the current month for each organization. The current month now counts every day so far. Past months are unchanged.

General​

• Fixed the Fusion throughput quota never blocking a launch. The launch-time check read the current month's usage as zero because usage is stored as one row per day, so maxFusionThroughputBytes was never enforced. The check now sums the organization's daily rows for the current UTC month, which matches the figure shown on the Fusion usage dashboard.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies. No database migrations are included in this release.

API changes​

The published API contract moves from 1.184.0 to 1.192.0. Most changes correct the specification to describe responses the server already returned, with two exceptions that change responses:

• Null credential secrets are now omitted. AWS and GitHub secret keys that previously serialized as null are no longer present in credential responses. Clients that read these keys must tolerate an absent key rather than a null value.
• GA4GH WES returns 404 for unknown runs. Run describe, status, and cancel return 404 instead of 500 when the run ID does not exist.

Regenerate any OpenAPI-derived clients against 1.192.0 to pick up the corrected nullability declarations.

Behavior changes​

• The Fusion throughput quota is now enforced. Organizations with maxFusionThroughputBytes set have had no effective limit since Fusion usage moved to daily rows. Launches that exceed the configured quota are now blocked. Review configured quotas against current Fusion usage before you upgrade.
• Fusion telemetry totals increase. The fusion_throughput_bytes value reported for the current month now covers the full month to date rather than its first day.

Security updates​

• CVE-2026-42198: Updated the PostgreSQL JDBC driver to 42.7.12, which resolves a client-side denial of service during SCRAM-SHA-256 authentication, where a malicious server requests an unbounded PBKDF2 iteration count.
• CVE-2026-91403, CVE-2026-113470: Updated the Java base image for the backend and database migration containers to Amazon Corretto 17.0.21, which blocks the compromised eMudhra intermediate certificates and removes the affected emSign roots.

Feature updates and improvements​

General​

• Updated the PostgreSQL JDBC driver to 42.7.12. This resolves a denial of service in which a malicious database server could exhaust client CPU during SCRAM authentication, and a silent loss of channel-binding protection on connections that require it.

Bug fixes​

Pipelines​

• Fixed the Fusion throughput quota never blocking a launch, which let organizations run Fusion-enabled workflows beyond their configured monthly throughput limit.

Monitoring and observability​

• Fixed fusion_throughput_bytes telemetry under-reporting the current month, counting only the first day instead of every day of the month so far.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.

Security updates​

• CVE-2026-91403: Added the eight compromised eMudhra intermediate certificate authorities to the JDK blocked certificate list. Their private keys were leaked, so anyone holding them could issue a certificate for any domain. The default trust store does not anchor these chains, so this is defence in depth for installations that use a custom trust store built from a full CA bundle.

Feature updates and improvements​

Access control​

• Allowed root administrators to remove a workspace participant from the admin panel without being blocked by agent-binding guards, and clarified the service account confirmation copy in the admin flows.
• Added support for resource-bound OAuth tokens for the Seqera MCP client, so a token issued for the MCP server can be exchanged for a separate Seqera Platform access token when one is needed.

Agents​

• Renamed the agent Pause and Resume actions to Disable and Enable to match what they do: a disabled agent cannot be run manually or by an action.

Co-Scientist​

• Added a Stop session control to a running, workspace-owned agent session in the Co-Scientist chat drawer, which cancels the session on the server.
• Added arrow-key navigation into and out of categories in the @-mention panel, made Escape close the panel from the root menu, and stopped long descriptions truncating mention names.
• Improved chat responsiveness on the Launchpad and Runs pages by skipping page screenshot capture, which could stall the first keystroke.

Pipelines​

• Added Nextflow 25.10.8 and 26.09.1-edge to the version catalog, making them selectable in the launch form and the API.

General​

• Added a warning to a required resource select when the list is empty and the user cannot create a resource, explaining who to ask instead of leaving an unusable field.

Bug fixes​

Access control​

• Fixed a blank Edit page in the admin Workspaces list when another workspace in the organization matched the target workspace's name, full name, or description.

Agents​

• Fixed agent actions failing without explanation when their GitHub App credential had been deleted. The reason now appears in the trigger history and the action is paused.
• Fixed an agent's Details tab omitting the bound GitHub App credential. The credential name now appears, and reads No longer available when the binding no longer resolves.
• Fixed the search box on the Agents page losing focus while results loaded, which dropped any keystrokes typed in the meantime.
• Fixed the Agents page showing an empty state when the agent list failed to load. It now shows a load error with a Retry action, and keeps the Add button and search visible.

Credentials​

• Restricted uploaded Google credentials to service account keys, rejecting other credential types and requiring the token URI to be an HTTPS endpoint on a Google-owned host.

Monitoring and observability​

• Fixed fusion_throughput_bytes telemetry reporting only the first day of the current month. It now covers every day of the month so far.

Pipelines​

• Fixed text-based reports (TXT, JSON, YAML, Markdown, and scripts) rendering as a blank page when opened in a new tab from the report preview dialog.
• Fixed clicking a task in global search results opening the run's Tasks tab instead of the task itself.
• Updated the bundled Nextflow version to 25.10.8, so a Bitbucket Server credential that holds a token but no password now authenticates instead of failing with "Not authorized".
• Clarified the API error and the Actions form messages shown for a pipeline that belongs to a shared workspace, which an action cannot watch or launch.
• Fixed every compute environment being disabled when resuming a run whose work directory differed from the compute environment's only by a trailing slash.
• Fixed the Fusion throughput quota never blocking a launch, because the check looked for a single monthly usage row instead of totalling the organization's daily rows for the current month.
• Fixed editing a pipeline's Seqera Platform schema failing with an "already exists" error when the pasted schema declared an $id.
• Stopped the backend compiling a pipeline repository's nextflow.config when reading its params, profiles, and manifest. The file is now only parsed, with no change to the values shown.

Projects​

• Hid the dataset actions on the Datasets tab from roles that lack the dataset label permissions they require, which previously failed with a 403 error or left a new dataset outside the project.
• Fixed relaunching a run from a project's Runs tab returning to the workspace Runs page instead of the project's own tab.
• Fixed the Edit project page omitting project pipelines whose names sorted beyond the first 50 pipelines in the workspace.

Service accounts​

• Fixed the Workspace access card for a service account with no workspaces, which showed a full empty state instead of collapsing to a header with its action.
• Blocked removing a service account from a workspace, or deleting it at organization level, while it is still bound to active agents. The request now returns a conflict error that lists the agents and workspaces involved.

General​

• Constrained outbound Source Code Management requests to permitted destinations, re-validating the target on every redirect, refusing HTTPS-to-HTTP downgrades, and dropping request headers on cross-origin hops. Credential base URLs are now validated when credentials are created or updated.
• Fixed design system form controls not repainting after their value was set without emitting a change event.
• Fixed empty states rendering their title as a second top-level heading, which gave screen readers an incorrect page outline.

Upgrade notes​

Outbound request protection starts in warn mode​

Requests to a destination a user supplies — Source Code Management reads for pipeline schema and configuration files and Studios repositories, and credentials base-URL validation — can now be restricted from reaching private or link-local addresses. TOWER_SSRF_PROTECTION_MODE defaults to warn, which logs what would be refused but still allows it. Before switching to enforce, search the backend logs for SSRF protection warnings: each one names the refused host and the setting that would permit it.

Use TOWER_SSRF_PROTECTION_ALLOWED_HOSTS for destinations that must stay reachable in private address space, such as a self-hosted GitHub Enterprise, GitLab, Bitbucket Server, or Gitea, or an S3-compatible store named by a credential base URL. It accepts hostnames, wildcard hostnames, CIDR blocks, and the keywords loopback, private, link-local, and *. Every server configured under tower.scm.providers is allowed implicitly, except loopback hosts, which must be listed explicitly. Address an internal Git server by hostname and allowlist that hostname — a pipeline repository URL that names a private IP address directly is rejected before this setting is consulted.

Uploaded Google credentials must be service account keys​

Google credentials are now parsed as service account keys only. A credential of any other type, including external_account, is rejected, and a token_uri must be an HTTPS endpoint on a Google-owned host. Review any stored Google credential that was not created from a service account key.

Source Code Management file reads have a size limit​

TOWER_HTTP_URL_FETCH_MAX_BODY_BYTES sets the largest response body buffered on a full-body read of a Source Code Management schema or configuration file, and defaults to 10485760 (10 MiB). An oversized file is rejected rather than truncated, so it reports as oversized instead of as a parse error. This replaces Nextflow's NXF_GIT_RESPONSE_MAX_LENGTH for Source Code Management file reads. The ranged preview reads used by dataset import are unaffected.

Agent backend calls are bounded by new timeouts​

TOWER_AGENT_BACKEND_TIMEOUT sets the per-request connect and read timeout for agent backend calls and defaults to 5s. TOWER_AGENT_BACKEND_BINDING_CHECK_BUDGET caps the per-workspace agent-binding fan-out performed when deleting a service account at organization level, and defaults to 15s; once the budget is exceeded, the deletion fails.

Resource-bound tokens apply only to the Seqera MCP client​

TOWER_OIDC_MCP_CLIENT_NAME names the dynamic client registration client_name of the Seqera MCP server, and defaults to seqera-mcp. Resource-bound tokens and the user access-token exchange apply to this client alone; the resource parameter sent by any other client is ignored.

Security updates​

• CVE-2026-91403: Added the eight compromised eMudhra intermediate certificate authorities to the JDK blocked certificate list. Their private keys were leaked, so anyone holding them could issue a certificate for any domain. The default trust store does not anchor these chains, so this is defence in depth for installations that use a custom trust store built from a full CA bundle.

Feature updates and improvements​

Pipelines​

• Added a timeout for workflow list and count queries. Set the timeout with TOWER_WORKFLOW_LIST_QUERY_TIMEOUT.

Bug fixes​

Compute environments​

• Fixed compute environments with Fusion snapshots enabled silently running without snapshots when a Fusion version was pinned in the launch form. The launch now resolves the snapshots manifest, and fails with an error when the pinned version has none.

Data Explorer​

• Restored the default annotation track in the IGV genome viewer, along with the cytoband ideogram, chromosome aliasing, and gene-name search.

Upgrade notes​

Workflow list queries now time out​

Workflow list and count queries are now bounded by TOWER_WORKFLOW_LIST_QUERY_TIMEOUT, which defaults to 10s. A query that exceeds it is cancelled by the database and the request fails with 503, which protects the connection pool from expensive searches that clients abandon. Set the variable to 0s to disable the timeout.

The License Manager check is disabled on air-gapped installations​

Setting LICENSE_CERTS_AIRGAPPED_BUNDLE now activates the airgapped environment, which disables the periodic License Manager check entirely. Quotas are read from tower.limits.* configuration instead, and GxP features from their own configuration properties. To keep collecting telemetry on an air-gapped installation, write it to disk with TOWER_CRON_USAGE_METRICS_FILE_COLLECTOR_ENABLED and TOWER_CRON_USAGE_METRICS_FILE_COLLECTOR_DIR.

Catalog artifact remap selectors must match exactly​

Selectors in a catalog artifact remap must now match an artifact's selectors exactly. Add snapshots: "true" to target the Fusion snapshots manifest used by compute environments with Fusion snapshots enabled. Existing single-key entries such as selectors: {arch: amd64} continue to resolve to the plain artifact and need no change.

Seqera Platform Enterprise 26.2 adds event-driven Actions, triggered by bucket events, schedules, and pipeline run events. It also adds Co-Scientist agents that run as service accounts, a Projects view, a system-wide Nextflow version selector, and pre-flight validation for credentials and compute environments. Other additions are global search backed by the data lineage query language, customer-managed KMS encryption for pipeline secrets, and route-aware OpenTelemetry tracing. For identity and access management, 26.2 adds OIDC audience enforcement, RFC 8693 token exchange, refresh-token rotation, and more SCIM auditing.

Highlights​

• You can launch a pipeline with a specific Nextflow version, chosen from a system-wide catalog of nf-launcher images. Each compute environment type sets a minimum version. See Compute environments.
• Platform validates credentials and compute environments before launch, on a schedule, and on demand. Broken credentials surface before a run fails. This is enabled by default. See Upgrade notes.
• Actions can be triggered by a bucket event, a schedule, or a pipeline run event, can start an agent instead of a pipeline, and record a trigger history. The three triggers are enabled by default in every workspace.
• Global search, backed by the data lineage query language, searches across workspaces. It is on by default. To turn it off, set TOWER_GLOBAL_SEARCH_ENABLED to false.
• You can encrypt pipeline secrets with a customer-managed AWS Key Management Service (KMS) key, set with TOWER_AWS_SECRETS_KMS_KEY_ID.
• Enterprise deployments now send aggregate entity telemetry with the license check. This is enabled by default. See Upgrade notes.
• Co-Scientist chat is available to every organization in the installation. It is enabled by default once the Co-Scientist agent backend is configured. See Upgrade notes.
• You can configure reusable AI agents per workspace and start one from a run with Trigger agent. Each agent acts as its bound service account. Agents are enabled by default once the Co-Scientist agent backend is configured. See Upgrade notes.
• A Projects view groups a workspace's pipelines, datasets, and runs by project, and launches from a project use an essentials-only launch form. This is enabled by default in every organization workspace. See Upgrade notes.
• The standalone Co-Scientist web interface (provided by the portal-web chart) is removed. Co-Scientist is now part of Seqera Platform. See Upgrade notes.
• A component compatibility catalog records which Nextflow, Fusion, and nf-launcher artifacts work with this Platform version, with deployment-local overrides for private registries. This is enabled by default. See Upgrade notes.
• Platform can stamp the aud claim on the OIDC access tokens it issues and enforce it. Enforcement is off by default and only logs mismatches. See Upgrade notes.
• Studios support private sessions restricted to an allow-list of users, per-user favorites, and a configurable automated stop grace period.
• Route-aware OpenTelemetry tracing is available through the standard OTEL_* environment variables.
• Studios gain a Logs tab that streams a session's process log directly from the compute environment. Logs survive an ungraceful shutdown.
• The compute environment, credentials, and Actions lists are redesigned as row-card tables with attribute chips, grouping, and search.
• From 26.2, Seqera publishes one frontend container image, platform/frontend:<tag>, which runs in unprivileged mode. The -unprivileged tag alias and the -root variant, which ran as the root user, are gone. See Upgrade notes.
• Platform writes audit events only to the v2 schema. This is a breaking change for direct database consumers and ETL jobs that read the v1 tw_audit_log table. Update them to the v2 schema before you upgrade. See Upgrade notes.

Feature updates and improvements​

Pipelines​

• Updated the bundled Nextflow version to 25.10.6.

Bug fixes​

Data Explorer​

• Fixed the IGV genome viewer failing to load reference genomes in Data Explorer by signing reference genome URLs.
• Fixed IGV genome viewer rendering in Data Explorer, which no longer depends on an externally hosted genome registry.
• Fixed IGV previews of Google Cloud Storage files in Data Explorer returning an authorization error, by signing those URLs with V4 signatures.
• Fixed IGV previews in Data Explorer failing at high zoom levels by signing index URLs independently of their data file URLs.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.

Feature updates and improvements​

Access control​

• Enabled IdP claims mapping by default for Enterprise.
• Added an organization allowlist to the IdP claims-mapping feature flag.
• Added a warning when revoking IdP group delegation.
• Added audit logs for SCIM token events.
• Added audit logging for team IdP group changes.
• Added configurable OIDC scopes via TOWER_OIDC_SCOPES.

Compute environments​

• Added bring-your-own networking support for Azure Cloud compute environments.

Bug fixes​

Access control​

• Fixed membership revocation by treating absent IdP group claims as empty.
• Fixed IdP group mapping visibility to refresh when toggling SSO.
• Fixed the IdP reconciler to create UserRole entries for workspace visibility.

Compute environments​

• Fixed end-to-end GCP Cloud compute environment support for Workload Identity Federation (WIF) credentials.
• Fixed GCP Batch error reporting to surface actionable API errors instead of a misleading WIF hint.
• Fixed xpack-google secret resolution by setting GOOGLE_CLOUD_PROJECT on the GCP Batch head job.

Monitoring​

• Fixed an OptimisticLockException when deleting audit log v2 records.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.

Feature updates and improvements​

Pipelines​

• Added pipeline schema, commit ID, head job CPUs, and head job memory to the workflow launch form summary, plus pipeline version and lineage fields when those features are active.

Bug fixes​

Compute environments​

• Fixed AWS credential validation failing for credentials using assumeRoleArn when TOWER_ALLOW_INSTANCE_CREDENTIALS=true without an explicit role mode.

Pipelines​

• Fixed duplicate credential detection to block GitHub App creation when a personal access token credential already exists for the same repository base URL.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.