A Fusion version selected in the launch form or saved on a pipeline no longer takes effect on its own. Runs use the Fusion version from the Nextflow launcher container unless the Fusion version override is enabled on the compute environment.

Feature updates and improvements​

Co-Scientist​

• Moved the current page out of the status bar and onto a Context chip in the composer, where it stays visible after a page screenshot is skipped or dismissed.
• Added arrow-key navigation into and out of a category in the @ mention menu.
• Changed Esc at the top level of the @ mention menu to close the panel instead of reopening it.

Agents​

• Added the bound GitHub App credential to an agent's Details tab.
• Added a message to the Service account picker on the agent form when the workspace has no service account.

Actions​

• Added a link from an action's Target card to the agent it runs.
• Added a message to the Agent picker on the action form when the workspace has no agent.

Bug fixes​

Compute environments​

• Fixed cancelling a run on Google Batch failing and leaving its task jobs running.
• Fixed runs on EC2 instance types without live console output being marked unknown and dropped from monitoring.

Pipelines​

• Fixed resuming a run disabling every compute environment when the environment's work directory ends in a slash.

Language features​

• Addressed limitations in agent inputs and outputs by @bentsherman in #7750
• Checked typed output names and allowed single named outputs by @bentsherman in #7769
• Deprecated the process when section in favor of the process.when config setting by @bentsherman in #7746
• Inferred the element type of empty channels, lists, and maps from first use by @bentsherman in #7774
• Made exit() graceful and reported an error for return statements in the workflow body by @bentsherman in #7570

Configuration​

• Allowed run-level cpus and memory limits for grid executors by @raphaelbetschart in #7783

General​

• Added a deprecations page to the docs by @bentsherman in #7766
• Improved the error message for local paths in module commands by @bentsherman in #7779

Bug fixes​

Language features​

• Fixed nullable workflow emits wrapping null in a dataflow value by @bentsherman in #7760
• Fixed static typing issues found while migrating a pipeline by @bentsherman in #7722

Google Batch​

• Fixed Google Batch array status polling for arrays of 500+ tasks by @robsyme in #7767
• Fixed Google Batch array task status cache never matching by @robsyme in #7778
• Fixed Google Batch task listing not retrying errors after the first page by @robsyme in #7768
• Fixed retried Google Batch job submissions failing with ALREADY_EXISTS by @pditommaso in #7762

General​

• Fixed interactive CLI prompts when stdin is not a terminal by @pditommaso in #7641
• Fixed the main thread exiting before the flow completes when aborted on another thread by @stefanoboriero in #7781
• Fixed IllegalThreadStateException aborting the session on task timeout by @Mohit-Ak in #7571
• Fixed invalid JSON sent to Seqera Platform when a value fails to serialize in TowerJsonGenerator by @pinin4fjords in #7772

Dependencies​

• Bumped nf-agent@0.2.0
• Bumped nf-agent-pi@0.6.0
• Bumped nf-amazon@3.12.0
• Bumped nf-google@1.29.0
• Bumped nf-tower@1.32.0

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.10.0

General​

• Migrated wave-cli into the Wave repository by @pditommaso in #1156
• Enabled Renovate for all dependencies by @arnaualcazar in #1155

Dependencies​

• Pinned @typespec/openapi to 1.16.0 by @pditommaso in #1173
• Bumped Micronaut to 4.10.20 by @pditommaso in #1171
• Bumped condasplit frontend Go dependencies to fix vulnerabilities by @pditommaso in #1172
• Updated GitHub Actions by @seqeralabs-renovate[bot] in #1168
• Updated cr.seqera.io/public/nf-jdk Docker tag to v25.0.4 by @seqeralabs-renovate[bot] in #1166
• Bumped logback to 1.5.34 by @pditommaso in #1174
• Overrode vulnerable transitive JVM dependencies by @pditommaso in #1175
• Bumped Micronaut to 4.10.21 by @pditommaso in #1176

Full changelog: https://github.com/seqeralabs/wave/compare/v1.40.0...v1.40.1

Language features​

• Fixed error checking in workflow emits by @bentsherman in #7058
• Fixed the formatter dropping the main: label when onComplete: or onError: is present by @ewels in #7346

Configuration​

• Fixed config rendering of nested closures by @bentsherman in #7375

S3​

• Fixed S3 directory upload skipping symbolic links by @jorgee in #7515

Dependencies​

• Bumped vulnerable dependencies to patched releases by @jorgee in #7598
• Bumped nf-amazon@3.9.3
• Bumped nf-azure@1.22.7
• Bumped nf-codecommit@0.5.4
• Bumped nf-google@1.27.4
• Bumped nf-k8s@1.5.5
• Bumped nf-seqera@0.21.2
• Bumped nf-tower@1.28.3

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.04.7

Language features​

• Added pipeline composition by @bentsherman in #7213
• Allowed any return type for a closure with a boolean signature by @bentsherman in #7688
• Added type checking for the type arguments of call arguments by @bentsherman in #7728
• Improved lint errors for common gotchas by @bentsherman in #7742
• Moved v1 process output resolution to TaskOutputResolverV1 by @bentsherman in #7036
• Published workflow outputs with FilePublisher by @bentsherman in #7745
• Added recognition of Record::subMap() in the type checker by @bentsherman in #7743
• Added an error for a closure or function that returns no value by @bentsherman in #7714
• Added an error for a missing return statement in a closure or function by @bentsherman in #7738
• Changed invalid script definitions to report the real syntax error by @bentsherman in #7675
• Added a type error for record field assignment by @bentsherman in #7718
• Skipped argument checks for plugin functions in typed scripts by @bentsherman in #7726
• Added support for a map of source-to-target pairs in the output path directive by @bentsherman in #7646
• Changed unnamed typed process outputs to use the inferred type by @pditommaso in #7757
• Added runtime validation of record fields for process record inputs by @bentsherman in #7692

Configuration​

• Added the seqera.executor.machineRequirement.onDemandCostRatio option by @pditommaso in #7710

Wave​

• Added conda/micromamba:v2-fast and conda/pixi:v1-fast to the wave.build.template docs by @pditommaso in #7727

General​

• Centralized shared dependency versions in gradle.properties by @pditommaso in #7704
• Made HashBuilder.isAssetFile public by @jorgee in #7723
• Changed CSV output to quote values only when required by @xHaMMaDy in #7377
• Changed lineage to record only tasks that completed by @jorgee in #7664
• Replaced LockManager with Guava Striped locks by @pditommaso in #7736
• Changed sched multi-attempt tasks to report the final attempt's start time by @pditommaso in #7755
• Changed the console log to go to stderr when ANSI logging is disabled by @bentsherman in #7741
• Added CI validation of agent examples against a staged runner image by @pditommaso in #7761

Bug fixes​

Language features​

• Fixed formatting of directives with a list argument by @bentsherman in #7679
• Fixed lineage path references for typed processes by @jorgee in #7713
• Fixed an NPE when all publish statements in a workflow output are no-ops by @bentsherman in #7674
• Fixed an NPE when publishing an external file with a publish statement by @bentsherman in #7721
• Fixed record cast of non-local Path values by @bentsherman in #7684
• Fixed serialization of dataflow params by @pinin4fjords in #7759
• Fixed the params block breaking piped operators in the entry workflow by @bentsherman in #7405

Plugins​

• Fixed plugin functions that return or take a channel by @bentsherman in #7715

General​

• Fixed a grep broken pipe error when reading the CPU model in the trace script by @bentsherman in #7672
• Fixed stale ANSI log lines when COLUMNS does not match the terminal width by @pditommaso in #7705
• Fixed the launcher Java version cache and md5 fallback by @ewels in #7695
• Fixed LsfExecutor.parseJobId() swallowing submit failures by @Arthur031221 in #7730
• Fixed the validate.sh image override with a relative results directory and Wave images by @pditommaso in #7763

Dependencies​

• Bumped Jackson to 2.21.7 and 2.18.11 to fix security advisories by @jorgee in #7732
• Bumped nf-agent-pi to 0.5.4 with pi-coding-agent 1.0.2 so the catalog includes GPT-6 Luna by @edmundmiller in #7748
• Bumped pi-coding-agent to 0.86.1 to fix undici advisories by @jorgee in #7733
• Bumped sched-client to 0.100.0 in nf-seqera by @pditommaso in fe446ce6d
• Bumped slf4j to 2.0.20 by @pditommaso in #7703
• Bumped nf-agent@0.1.2
• Bumped nf-agent-pi@0.5.4
• Bumped nf-azure@1.24.1
• Bumped nf-google@1.28.2
• Bumped nf-seqera@0.26.0
• Bumped nf-tower@1.31.0
• Bumped nf-wave@1.22.2

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.09.2-edge

Co-Scientist​

• Replaced the Recent shortcut in the @ mention menu with a Search context field, per-category browsing, paginated results, and status badges.

Compute environments​

• Added Use private address to Azure Batch Forge compute environments, for pool nodes without public IP addresses.
• Added the instance ID and failing command to setup script warnings in the run execution log.

Studios​

• Added a link from a Studio's details page to its compute environment.

Service accounts​

• Added service accounts: non-human identities that belong to an organization and that an agent can run as. Organization owners add, view, edit, and delete them from the new Service accounts tab under Access control.
• Added workspace roles for service accounts.
• Added organization membership rules for service accounts. Each service account counts toward the organization's member limit.
• Marked service accounts in the admin panel. The users list and the Members of organization and Workspace participants tabs show a service account badge and a distinct avatar, and the organization role column reads Service account.

General​

• Redesigned the organization, workspace, and user profile settings pages.

Bug fixes​

Co-Scientist - projects​

• Fixed the project Datasets tab showing unusable dataset actions to Launch users and non-functional buttons in empty projects.
• Fixed relaunching a run from a project's Runs tab returning to the workspace instead of the project.

Pipelines​

• Fixed Launch users being unable to resume runs of pipelines with Pull latest enabled.
• Fixed Azure data repositories selected as a run output directory producing an invalid path.
• Fixed a Fusion version selected in the launch form ignoring the compute environment's Fusion snapshots setting. A selected version with no Fusion snapshots build now fails the launch with an error.

Compute environments​

• Fixed AWS compute environments reporting an unexpected error instead of an access denial when credentials cannot reach the work directory bucket.

Credentials​

• Fixed Bitbucket Server credentials with an access token and no password being rejected when adding a pipeline or opening its launch form.

Data Explorer​

• Fixed the IGV preview losing its reference annotation track, chromosome ideogram, and gene name search.

Data lineage​

• Fixed selecting a task in global search results opening the run's Tasks tab instead of the task.

Secrets​

• Fixed pipeline secrets with underscores in their names being wrongly rejected as duplicates.

General​

• Fixed muted text using the light theme color in the dark theme.
• Fixed muted and raised surfaces being indistinguishable in the dark theme.
• Fixed pipeline and compute environment addresses in the public 12.0.0.0/8 and 172.32.0.0-172.37.255.255 ranges being rejected as private.
• Fixed screen readers not announcing a field's label together with its value.

Highlights​

• You can launch a pipeline with a specific Nextflow version, chosen from a system-wide catalog of nf-launcher images. Each compute environment type sets a minimum version. See Compute environments.
• Platform validates credentials and compute environments before launch, on a schedule, and on demand. Broken credentials surface before a run fails. This is enabled by default. See Upgrade notes.
• Actions can be triggered by a bucket event, a schedule, or a pipeline run event, can start an agent instead of a pipeline, and record a trigger history. The three triggers are enabled by default in every workspace.
• Global search, backed by the data lineage query language, searches across workspaces. It is on by default. To turn it off, set TOWER_GLOBAL_SEARCH_ENABLED to false.
• You can encrypt pipeline secrets with a customer-managed AWS Key Management Service (KMS) key, set with TOWER_AWS_SECRETS_KMS_KEY_ID.
• Enterprise deployments now send aggregate entity telemetry with the license check. This is enabled by default. See Upgrade notes.
• Co-Scientist chat is available to every organization in the installation. It is enabled by default once the Co-Scientist agent backend is configured. See Upgrade notes.
• You can configure reusable AI agents per workspace and start one from a run with Trigger agent. Each agent acts as its bound service account. Agents are enabled by default once the Co-Scientist agent backend is configured. See Upgrade notes.
• A Projects view groups a workspace's pipelines, datasets, and runs by project, and launches from a project use an essentials-only launch form. This is enabled by default in every organization workspace. See Upgrade notes.
• The standalone Co-Scientist web interface (provided by the portal-web chart) is removed. Co-Scientist is now part of Seqera Platform. See Upgrade notes.
• A component compatibility catalog records which Nextflow, Fusion, and nf-launcher artifacts work with this Platform version, with deployment-local overrides for private registries. This is enabled by default. See Upgrade notes.
• Platform can stamp the aud claim on the OIDC access tokens it issues and enforce it. Enforcement is off by default and only logs mismatches. See Upgrade notes.
• Studios support private sessions restricted to an allow-list of users, per-user favorites, and a configurable automated stop grace period.
• Route-aware OpenTelemetry tracing is available through the standard OTEL_* environment variables.
• Studios gain a Logs tab that streams a session's process log directly from the compute environment. Logs survive an ungraceful shutdown.
• The compute environment, credentials, and Actions lists are redesigned as row-card tables with attribute chips, grouping, and search.
• From 26.2, Seqera publishes one frontend container image, platform/frontend:<tag>, which runs in unprivileged mode. The -unprivileged tag alias and the -root variant, which ran as the root user, are gone. See Upgrade notes.
• Platform writes audit events only to the v2 schema. This is a breaking change for direct database consumers and ETL jobs that read the v1 tw_audit_log table. Update them to the v2 schema before you upgrade. See Upgrade notes.

Feature updates and improvements​

Pipelines​

• Added a Nextflow version selector. A system-wide catalog maps each selectable version to an nf-launcher image, sets a minimum version and launcher variant per compute environment type, and raises the floor for features that require it. The catalog defaults to Nextflow 26.04 and is not user-editable.
• Extended the Nextflow version catalog back to 23.03.0-edge, for 70 versions in total. Pipelines pinned to an older runtime remain launchable. Releases from 25.04.1 and later resolve to public.cr.seqera.io/platform/nf-launcher images. The oldest entries, which were never mirrored there, resolve to quay.io/seqeralabs/nf-launcher.
• Added synchronous pre-flight checks at launch. A launch now fails fast with an actionable reason instead of failing during execution.
• Added an output directory option to the launch form, preserved across resume.
• Aggregated launch validation failures into a single response and a multi-error failure message that reports every problem at once.
• Added launch-time settings (profiles and the Nextflow syntax parser) to the run configuration tab, and surfaced them in the workflow configuration tab.
• Validated the parameters text against the JSON-serialized size limit, using the tower.launch.config.maxSize value in the frontend validators.
• Added a component compatibility catalog that records which Nextflow, Fusion, and nf-launcher artifacts are compatible with this Platform version, and enforces that compatibility at launch. Enabled by default. To turn it off, set TOWER_CATALOG_ENABLED to false. TOWER_CATALOG_SOURCE selects the catalog source (classpath:, file:, or licman for the live License Manager source) and TOWER_CATALOG_EMBEDDED sets the fallback used when a live source is unavailable.
• Added deployment-local catalog overrides, supplied through your own application-catalog.yml. An override can remap an existing artifact to a private registry reference, add a deployment-only version, or hide a version from listings and pick validation. Overrides are marked origin: override, audited at launch, and never written back to the shared catalog. This subsumes the single TOWER_LAUNCH_CONTAINER pin.

Actions​

You can now trigger Actions with a bucket event, a schedule, or a pipeline run event. All three triggers are enabled in every workspace by default, including personal workspaces. Restrict them with TOWER_ACTIONS_BUCKET_TRIGGER_ALLOWED_WORKSPACES, TOWER_ACTIONS_CRON_TRIGGER_ALLOWED_WORKSPACES, and TOWER_ACTIONS_PIPELINE_TRIGGER_ALLOWED_WORKSPACES. See Core features. Review whether these triggers are appropriate for your installation before upgrading.

• Added the Bucket event trigger, which fires an Action when a marker file is created or deleted in an AWS S3 data repository.
• Added the Schedule trigger, which fires an Action daily, weekly, or on a custom cron expression.
• Added the Pipeline run event trigger, which fires an Action when a run of a Launchpad pipeline succeeds, fails, or is cancelled. Use it to have one pipeline launch the next.
• Added an agent target. A bucket event, schedule, or pipeline run event Action can start an existing agent instead of launching a pipeline.
• Added a Trigger history tab that lists each time an Action fired, with its status, payload, and target.
• Redesigned the action form and Action page. You can now change the trigger when you edit an Action.
• Added recorded pause reasons, shown on the Actions list and the Action page, and a Created by column on the Actions list.
• Added protection against Actions that trigger themselves: a bucket event Action that watches its own pipeline's output is rejected, and a pipeline run event Action that would close a loop is suppressed.

Compute environments​

• Redesigned the compute environment list as a row-card table, with attribute chips, a type label, an Invalid status, the compute environment ID, and grouped, searchable compute environment selects.
• Added scheduled pre-flight validation for compute environments in the AVAILABLE state.
• Added a maxCpusPerUser per-user vCPU cap.
• Added encryption of pipeline secrets with a customer-managed KMS key, configured with TOWER_AWS_SECRETS_KMS_KEY_ID. Compute environments saved before this release continue to use the AWS-managed key.
• Required spot provisioning for Fusion snapshots, and aligned the GCP provisioning interface accordingly.
• Added a scheduled cleanup that soft-deletes orphaned credentials and compute environments belonging to deleted workspaces. Off by default. To turn it on, use TOWER_WORKSPACE_ORPHAN_CLEANUP_ENABLED.
• Added TOWER_COMPUTE_ENV_LAST_USED_FLUSH_INTERVAL to control how often the last-used timestamp is flushed.
• Added new environment variables for the validation and cleanup schedules. See Configuration overview for full descriptions and defaults:
  • TOWER_CRON_CREDENTIALS_VALIDATION_*: tick rate, delay, interval, batch size, concurrency, probe delay, transient retry intervals, and maximum unverifiable attempts
  • TOWER_CRON_COMPUTE_ENV_VALIDATION_*: tick rate, delay, interval, and batch size
  • TOWER_CRON_CREDENTIALS_ORPHAN_CLEANUP_* and TOWER_CRON_COMPUTE_ENV_ORPHAN_CLEANUP_*: tick rate, delay, batch size, and concurrency

AWS​

• Added EBS volume encryption with an optional KMS key for AWS Cloud compute environments.
• Added VPC and multiple subnet selection for AWS Cloud compute environments.
• Added automatic GPU AMI selection for AWS Cloud compute environments.
• Added log group persistence, forwarded to the CloudWatch agent.
• Added security group name search to AWS dropdowns.
• Added the AWS jump-role trust policy to the credentials form.
• Added r8idn, r8idb, m8idn, m8idb, m9gd, c9gd, g7, and r9gd instance families to the NVMe list.

Azure​

• Added bring-your-own networking for Azure Cloud compute environments.
• Added OS disk size configuration for Azure Cloud compute environments.
• Added configurable boot disk size for Azure Batch pools.
• Added private Azure Container Registry image pull support for Azure Cloud.
• Reworked the Azure credentials region field, and validated Azure Batch access on the compute environment rather than the credential.
• Updated the list of available Azure regions.

GCP​

• Added VPC network and subnet selection for Google Cloud compute environments, with metadata autofill, and exposed the network fields in the API model.
• Added end-to-end Workload Identity Federation credential support for Google Cloud compute environments.
• Updated the default GPU image family to CUDA 12.9.

Credentials​

• Added a credential validation status, shown on the credentials list and detail pages, with an error alert for credentials in the INVALID state.
• Added a scheduled validation cron, a launch-time gate, and an on-demand Validate button. The cron runs every 12 hours by default.
• Added a work directory reachability probe at launch for AWS and Google Cloud credentials. Platform rejects a run whose work directory the credential cannot read before the run starts, instead of letting it fail during execution. The probe is bounded at five seconds and fails open, allowing the launch when the result is inconclusive.
• Aligned the credentials list with the compute environment card layout.
• Added workload identity federation to AWS credentials. Platform exchanges a short-lived token it signs for temporary AWS credentials through sts:AssumeRoleWithWebIdentity. The credential stores only a role ARN. Enabled by default. See Upgrade notes.
• Added per-context subjects to workload identity federation tokens for AWS and Google Cloud. A token names the kind of work making the request: platform, data, studio, or workflow. Trust and permission policies can scope access by workload, and cloud audit logs can name the acting user. See Subjects and attribution.

Studios​

• Added sharing for private Studios: the creator can allow one other workspace user to connect to and run the session. The allowed user is persisted on create and start, and exposed in the studio API response.
• Added a configurable automated stop grace period. tower.data-studio.force-stop-threshold (default 10m) sets how long a studio must be stuck in a non-final state before it is force-stopped, and tower.data-studio.approaching-expiration-threshold (default 15m) sets how long before a scheduled auto-stop the extend warning appears.
• Added persistent per-user favorites and filters that persist across navigation.
• Added the ability to cancel Studios stuck in the stopping state.
• Added a Logs tab to the Studio details page, showing the process log for the most recent session read from the compute environment's log stream. Logs are available while a session is starting and running, and after a stop or crash. They survive an ungraceful shutdown. The existing studio:read grant covers the tab, through GET /studios/{sessionId}/log. How far back logs go depends on the compute provider and its log retention.
• Added Conda packages for Studios built from a custom container image. Wave builds the packages on top of the image, and the Studio details page shows the Conda configuration.
• Added custom certificate authority configuration for Studios.
• Added checkpoint revalidation for the last checkpoint.
• Added NVIDIA environment variables for GPU Studios.
• Added a waveBuildNotification user preference controlling Wave build emails for custom Studio environments.
• Added a custom icon for a Studio, uploaded on create, start, or update and shown on the Studios list and details pages.
• Added workload identity federation for Studios on AWS and Google Cloud compute environments whose credential uses it. A session gets its own cloud identity instead of the compute environment's credentials. Requires Seqera Connect client 0.14.0 or later in the Studio's container image.

Access control​

• Added aud claim support on OIDC access tokens. TOWER_OIDC_ACCESS_TOKEN_AUDIENCE sets the audience stamped on issued tokens, and TOWER_OIDC_AUDIENCE_ENFORCEMENT_ENABLED (default false) controls whether incoming Platform-issued tokens are rejected on a mismatch or merely logged.
• Added the RFC 8693 token_exchange flow.
• Added OAuth 2.0 refresh-token rotation, with tokens hashed using truncated SHA-256.
• Added OAuth 2.0 token revocation (POST /oauth/revoke, RFC 7009) and token introspection (POST /oauth/introspect, RFC 7662), both advertised in /.well-known/openid-configuration. Revocation ends the presenting client's refresh-token family and returns 200 whether or not the token existed. Introspection is restricted to confidential clients and currently answers for refresh tokens only: every access token is reported active: false. You cannot yet use it to validate access tokens.
• Added configurable OIDC scopes via TOWER_OIDC_SCOPES.
• Added support for extra static OIDC clients, and propagated identity provider (IdP) service roles in issued OIDC tokens.
• Enabled IdP claims mapping by default for Enterprise deployments (TOWER_IDP_CLAIMS_MAPPING_ENABLED, default true), with an optional organization allow-list.
• Added Co-Scientist chat as a custom-role permission.
• Added the agent:read, agent:write, agent:execute, and agent:delete permissions, listed under AI with chat:execute in custom roles. The predefined owner, admin, and maintain workspace roles hold all four, launch and project hold agent:read and agent:execute, and connect and view hold none. A custom role also needs credentials:read to choose a GitHub App credential on the agent form.
• Added a Projects permission category and a project predefined workspace role, which grants project_view:read and withholds the broader workspace_resources:read. Both appear in the workspace role picker and in custom-role templates. The Projects view they gate is enabled by default in every organization workspace. See Upgrade notes.
• Split the data_link and data_link_object permissions.

Service accounts​

Service accounts turn on with agents. They are available in every organization once TOWER_AGENT_BACKEND_URL is set. To restrict them to specific organizations, set TOWER_AGENT_CONFIGURATION_ALLOWED_ORGANIZATIONS to a comma-separated list of organization IDs. See Upgrade notes.

• Added service accounts: non-human identities that belong to an organization and that an agent can run as. Organization owners add, view, edit, and delete them from the new Service accounts tab under Access control. A service account's page lists the workspaces it can act in, with a read-only Permissions matrix per workspace. Names follow the user-name rules and must be unique across the installation, and deleting a service account removes it from every workspace and frees its name.
• Added workspace roles for service accounts. From a service account's edit page, Assign to workspace grants it any built-in or custom role except Owner. Each role change or removal applies immediately, and Update saves only the name and description. A service account can also be added from a workspace's participants list, where it carries a service account badge and its own avatar, and it gets View when no role is specified instead of the Launch a person gets.
• Added a permission ceiling for service account role assignments. Anyone who adds a service account to a workspace or changes its role there must hold every permission that role grants in that workspace, or the request is rejected with a 403 naming the missing permissions. Root users are exempt.
• Added sign-in and token restrictions for service accounts. Every interactive login path rejects a service account, and an email login for its address shows "Service accounts cannot sign in to Seqera Platform." instead of sending a link. A service account cannot create personal access tokens and is never granted the root role through the root users list. It holds only a minimal service_account user-context role. Platform refuses user-level operations, such as creating an organization.
• Added organization membership rules for service accounts. A service account holds a fixed service_account organization role that cannot be changed or given to anyone else. It cannot join a team, be invited as a workspace collaborator, or be added or removed through the organization member endpoints, and it does not appear in the organization Members list. Each service account counts toward the organization's member limit.
• Marked service accounts in the admin panel. The users list and the Members of organization and Workspace participants tabs show a service account badge and a distinct avatar, and the organization role column reads Service account. Editing a service account there locks its generated email and hides the first and last name, avatar, and email-notification fields. Platform rejects a change to any field other than the user name, organization, and description with a 400.

Search​

• Added global search across workspaces, with infinite scroll and suggestions, backed by the data lineage query language. Enabled by default. To turn it off, set TOWER_GLOBAL_SEARCH_ENABLED to false.
• Added an administrative endpoint for lineage storage reindexing, plus a reindex schedule configurable with TOWER_CRON_LINEAGE_REINDEX_*.
• Aligned global search (⌘K / Ctrl+K) with the backend lineage search DSL: workspace scoping now uses org/name, the OR delimiter within a qualifier is now a comma (previously |), and typed input passes straight through to the backend.
• Renamed Search to Lineage search, to make clear that results cover Data Lineage records only.
• Reworked the lineage search modal: keyword filters are offered as suggestions as you type, a dismissible banner states that results cover lineage records only, and a workspace with lineage disabled gets an explanatory empty state offering to search across all workspaces instead.

Data lineage​

• Made data lineage available in every organization workspace by default: it can be limited to specific workspaces by setting a comma-separated list of workspace IDs at TOWER_LINEAGE_ALLOWED_WORKSPACES. See Upgrade notes.
• Added the lineage ID to the run info page.
• Added filtering of lineage search results by pipeline.
• Changed lineage record ingestion to consume SNS push notifications instead of polling SQS.

Data Explorer​

• Added the object last-modified timestamp to the Data Explorer file listing.
• Added re-signing of presigned URLs for a subset of parts of an in-progress multipart upload (uploadId and partNumbers). Long uploads now recover from expired signing credentials instead of failing. AWS S3 and S3-compatible storage only.

Secrets​

• Redesigned the secrets list as a row-card table.

Monitoring and observability​

• Added route-aware OpenTelemetry tracing. Tracing records nothing until you configure an exporter. The standard OTEL_* environment variables control sampling, resources, and export. Health, ping, Prometheus, metrics, OpenAPI, and favicon routes are excluded by default.
• Added aggregate entity telemetry, sent with the license check. Payload identifiers are hashed, the reporting window defaults to 7 days, and the license check is retried with the telemetry attached. Controlled by TOWER_TELEMETRY_BASIC_ENABLED and TOWER_TELEMETRY_STANDARD_ENABLED (both default true) and TOWER_TELEMETRY_WINDOW_DAYS.
• Audit log events are now written only to the v2 schema. The TOWER_AUDIT_LOG_V2_WRITE_MODE setting and the v1 write path have been removed. This is a breaking change for database consumers and ETL jobs that read the v1 tw_audit_log table. See Upgrade notes.
• Added a request correlation ID, propagated through the logging context.
• Added OAuth token metrics and a current-month CPU hours metric.
• Added audit entries for pre-flight cron status transitions, a user_updated event for authentication provider changes, and metadata on the audit log v2 state element.
• Added service accounts to the audit log. Actions a service account takes are recorded with a new service_account actor type, and creating, updating, and deleting one records service_account_created, service_account_updated, and service_account_deleted. In the admin audit log, the actor shows a Service account badge and its ID instead of its generated email, plus an Agent ID when an agent acted, which the CSV export carries in a new actorAgentId column.
• Added an action_triggered audit log event. Platform writes it for every trigger of an Action, whether the trigger launched, failed, or was suppressed, and the event names the Action that fired.
• Added dynamic axis scaling and precision to the job duration chart.

Co-Scientist​

Once TOWER_AGENT_BACKEND_URL points Seqera Platform at the Co-Scientist agent backend, chat is enabled for every organization by default. Set TOWER_AI_CHAT_ALLOWED_ORGANIZATIONS to restrict it to a list of organization IDs. See Upgrade notes.

• Added the Co-Scientist chat assistant, docked beside page content, with a close control and conversation history that can be selected and deleted.
• Added compute environment and list-page view context, retained referenced context in chat messages, and page context with screenshots.
• Added structured tool result rendering and a Co-Scientist usage display.
• Sped up the page screenshots that chat attaches as page context, and shortened the time the page is unresponsive while one is captured.

Agents​

Once TOWER_AGENT_BACKEND_URL points Seqera Platform at the Co-Scientist agent backend, agents are enabled for every organization by default, together with service accounts and the Trigger agent button. Set TOWER_AGENT_CONFIGURATION_ALLOWED_ORGANIZATIONS to restrict them to a list of organization IDs. See Upgrade notes.

• Added Agents to the AI section of the workspace navigation, for configuring reusable AI agents in a workspace. An agent has a name, an optional description, and Agent instructions, and can start from the Fix failed runs, Summarize successful runs, or Summarize failed runs template. You manage it with Pause, Resume, Edit, and Remove from the agents list or its own page. Agent configuration is stored by the Co-Scientist agent backend, and each change is recorded as an agent_created, agent_updated, agent_enabled, agent_disabled, or agent_deleted audit event.
• Added a Trigger agent button to run details, beside the execution log or in the error panel of a failed run, and to each run in a project's Runs tab. It lists the workspace's active agents, launches the one you select with the run's context, and opens the resulting session in the Co-Scientist panel. When the workspace has no agents, it offers Add agent instead. The button needs Co-Scientist chat and the agent:execute permission, and a failed launch shows the reason Platform or the agent backend returned instead of a generic error.
• Added a check of an agent's service account each time the agent is saved or launched. Platform refuses the request with a 409 that names the failed condition, instead of running the agent with the launching user's permissions. The conditions are that the service account was deleted or disabled, is not a participant in the workspace, or has a role without agent:execute. A run that passes acts as the service account, and Platform hands its credentials to the agent backend through a single-use /ephemeral URL.
• Added automatic disabling of the agents bound to a service account when that account is removed from their workspace or deleted from the organization. They then show as Inactive and drop out of Trigger agent, instead of failing at their next launch. Re-adding the service account does not re-enable them. Resume each one from the Agents page.
• Added an optional GitHub App credential to the Agent permissions section of the agent form, next to the Service account the agent runs as. The agent uses that workspace credential to clone, commit, and push. Platform rejects a credential from another workspace, of another type, or marked invalid, with a 400 on save and a 409 at launch. The form blocks saving while the bound credential is missing or invalid.
• Added a Sessions tab to the agent page, listing the agent's background runs with their Status, Trigger, Service account, and Run ID. The list refreshes while a run is in progress. Sessions can be searched by keyword, and View session opens a session in the Co-Scientist panel through a link you can share.
• Added Fork conversation to agent sessions in the Co-Scientist panel. Agent sessions open read-only there, with the notice "Agent sessions are read-only. Fork the conversation to continue it as your own chat." Forking copies the session into a chat of your own and opens it.

Projects​

The Projects view is enabled by default in every organization workspace. Set TOWER_SCIENTIST_VIEW_ALLOWED_WORKSPACES to a comma-separated list of workspace IDs to restrict it. See Upgrade notes.

• Added a Projects view, opened from a Workspace/Projects switcher in the side navigation, that groups a workspace's pipelines, datasets, and runs by project. A project is a workspace label named proj_<name>: Add project creates the label and applies it to the pipelines and datasets you choose, Edit renames it or changes those resources, and Delete removes the label and its resource associations but not the resources. Project names must be unique in the workspace, ignoring case, and each action requires the matching label permission.
• Added project pages with Runs, Datasets, and Reports tabs, each filtered to the project's label, plus a <workspace name> overview that covers the whole workspace. On Datasets, adding a dataset or version and editing dataset details happen in dialogs, and a dataset added there gets the project's label. Reports collects the reports of successful runs on the Runs pages loaded so far, with search, preview, and Download, and a run's View reports opens it filtered to that run.
• Added launching from a project. On a project's Runs tab, Launch pipeline lists only the pipelines that carry the project's label. It and a failed run's Relaunch open an essentials-only launch form: Run parameters shows only the parameters the pipeline schema marks as required, with a Show all parameters toggle, and the Advanced settings and Summary steps are left out. Runs launched from a project carry its label. On a project with no pipelines, Launch pipeline is hidden and only users with pipeline_label:write are offered Add pipeline.
• Added project awareness to the workspace Labels settings page: proj_ labels show a Project badge and link to their project, the Show filter gains a Project option, and creating, renaming, or deleting a proj_ label warns what that does to the project. The pipeline and dataset forms hide proj_ labels from their Labels field and refuse to create one there. Editing a pipeline or dataset keeps it in its projects.

General​

• Added a default workspace preference to the user profile.
• Added a panel search input to the navigation switcher, and made list pages preserve their page and search filters across item navigation.
• Made the docked sidenav the default experience, and made row cards clickable.
• Added nf-launcher 25.10.6, 25.10.7, and 26.08.0-edge to the version catalog.
• Added a startup warning when tower.oidc.pem.path is unconfigured.
• Added a compact relative date display across list views.

Bug fixes​

Pipelines​

• Fixed the output directory not being preserved on resume.
• Fixed workspace participants whose role lacks pipeline:write, such as Launch, being unable to resume a run whose launch had Pull latest enabled. The resume failed with Field 'pullLatest' is not writable: unset or use previous value.
• Fixed optimization targets not being returned verbatim on launch, and the optimization banner not appearing when relaunching a shared pipeline run.
• Fixed the custom schema being discarded when added for the first time in edit mode.
• Fixed the Nextflow syntax parser v2 toggle not being seeded from the saved launch configuration, and a Nextflow version being unselectable when the source pinned none.
• Fixed duplicate GitHub credentials being created across personal access token and GitHub App types.
• Fixed the credentials field not being mandatory in the Add data repository form.
• Fixed a path picked from an Azure data link in the launch form, for the output directory or a path parameter, including the storage account (az://<account>.<container>/…), which Nextflow cannot resolve. The picker now inserts az://<container>/…, and on an Azure compute environment it disables data links whose credentials differ from the compute environment's.

Actions​

• Fixed a pipeline action triggered by a GitHub webhook failing to launch on an HPC compute environment connected through Tower Agent, with Cannot retrieve user ID: missing authenticated user in current request context.
• Fixed a redelivered GitHub webhook launching its pipeline again. Platform now records each X-GitHub-Delivery ID and launches once per delivery unless the first launch failed.
• Fixed the action form's Add and Update buttons staying disabled after an invalid pipeline revision was corrected, which left the form unusable until the page was reloaded.

Compute environments​

• Fixed unusable credentials being accepted on a compute environment.
• Fixed the compute environment form allowing submission while invalid, and the Add credentials button missing in create mode.
• Fixed the SLURM and HPC executor message being reported as an error rather than a warning.
• Fixed the compute environment form not requiring a VPC when external IP addresses are disabled.

AWS​

• Fixed AWS Cloud head-job failures not being surfaced.
• Fixed vpcId and subnet selection not being applied to the AWS Cloud head job.
• Fixed runs being flagged for attention when a UserData script failed, and downgraded all AWS UserData-check permission denials to warnings.
• Fixed ecs:DescribeContainerInstances permission errors being logged at error level.

Azure​

• Fixed nextflowConfig not being preserved on forged Azure Cloud compute environments.
• Fixed the unsupported Fusion snapshots toggle appearing on the Azure compute environment form.
• Fixed Entra credential comparison and made the managed identity regular expression case-insensitive.

GCP​

• Fixed GOOGLE_CLOUD_PROJECT not being set on the GCP Batch head job, which prevented secret resolution.
• Fixed pipeline secrets not being pinned to the compute environment region.

Studios​

• Fixed baseline Studio capabilities not being used when the manifest is missing or the Studio version is absent from it.
• Fixed mount configuration being double-quoted on every compute environment type, which could leave a session unable to reach its mounted data.

Data lineage​

• Fixed the session ID of resumed runs not resolving without runName.
• Fixed lineage being reported as not enabled for submitted runs when it was enabled.
• Fixed the launch toggle remaining enabled when lineage settings are unset or the compute environment does not support lineage.
• Fixed the Launcher role being able to override the lineage setting.
• Fixed the launch form requesting lineage in a user workspace.

Data Explorer​

• Fixed GCS genomic file URLs not being signed with V4, which broke IGV preview.
• Fixed IGV reference genome URLs not being signed, and corrected IGV rendering.
• Fixed S3 buckets disappearing when an ACL fetch is denied.

Access control​

• Fixed IdP group mapping visibility not refreshing when SSO is toggled.
• Fixed the custom role form ignoring the selected template. Choosing a template now applies its permissions, the form preselects the template its permissions were prefilled from, and Restore defaults is renamed Reset to template.
• Fixed an uploaded avatar not persisting when an administrator creates a user.
• Fixed a new participant not being assigned the role requested for them.

General​

• Fixed the sidebar section not being preserved when switching workspace, including on redirect.
• Fixed features not being refetched after authentication.
• Fixed the default workspace preference not being cleared correctly.
• Fixed the global search keyboard shortcut hint showing ⌘K on Windows and Linux instead of Ctrl+K.
• Fixed the runs list not rendering in personal workspaces.

Upgrade notes​

Only one frontend container image is published​

From 26.2, Seqera publishes a single frontend container image. This is a breaking change for any deployment that pins a tag variant, and for any deployment that pins the plain tag and relies on the container listening on port 80.

• Seqera no longer publishes the -root or -unprivileged tag variants of the frontend image cr.seqera.io/enterprise/platform/frontend:<tag>. A manifest referencing cr.seqera.io/enterprise/platform/frontend:<tag>-unprivileged or cr.seqera.io/enterprise/platform/frontend:<tag>-root fails to pull on 26.2.

Before upgrading, point every frontend image reference at the plain tag and make the port match:

• Kubernetes: set the container ports.containerPort and the frontend service's targetPort to 8000, leaving the service port at 80.
• Docker Compose: map the host port to container port 8000, for example 8000:8000.

NGINX_LISTEN_PORT (default 8000) still overrides the listening port if you need a different one. Set targetPort, or the container side of the port mapping, to the same value. See Kubernetes deployment and Docker Compose deployment.

Telemetry on the license check​

Seqera Platform Enterprise 26.2 sends aggregate entity telemetry alongside the existing license check. Identifiers in the payload are hashed before transmission and the reporting window covers the previous 7 days by default.

This is enabled by default. The two tiers do not combine:

• TOWER_TELEMETRY_STANDARD_ENABLED (default true) reports entity-level records: one per run, Studios session, Studios audit event, day of Data Explorer activity, and workspace. Set it to false to fall back to the aggregate counters alone.
• TOWER_TELEMETRY_BASIC_ENABLED (default true) reports the aggregate usage counters Platform sent before entity-level telemetry existed. It is only consulted when standard telemetry is off.
• TOWER_TELEMETRY_WINDOW_DAYS (default 7) sets the reporting window.

To opt out entirely, set both flags to false. Platform then runs no telemetry query and sends no telemetry data. The installation still reports the opt-out, which lets Seqera tell it apart from an installation that stopped reporting. Licensing and quota retrieval are unaffected by either flag. See Telemetry.

User IDs, repository names, Studios template and image references, and organization and workspace names are hashed before they leave the installation.

Co-Scientist chat is enabled by default​

Once TOWER_AGENT_BACKEND_URL is set, Co-Scientist chat is available to every organization in the installation. To restrict it, set TOWER_AI_CHAT_ALLOWED_ORGANIZATIONS to a comma-separated list of organization IDs. The Platform Helm chart sets TOWER_AGENT_BACKEND_URL automatically when the agent-backend subchart is enabled.

Chat sends page context, including screenshots of the page the user is viewing, to the configured AI backend. Before you upgrade, check whether that is acceptable for your installation. If it is not, set the variable.

Agents, service accounts, and the Trigger agent button are enabled with the agent backend​

Once TOWER_AGENT_BACKEND_URL is set, agents, service accounts, and the Trigger agent button on run pages are available in every organization of the installation unless you restrict them. The Platform Helm chart sets the variable when the agent-backend subchart is enabled. When the subchart is disabled, all three features are off, as is Co-Scientist chat. None of them is available in a personal workspace.

TOWER_AGENT_CONFIGURATION_ALLOWED_ORGANIZATIONS is empty by default, which makes agents available in every organization. To restrict them, set it to a comma-separated list of organization IDs.

Co-Scientist web interface is removed​

The Platform Helm chart no longer includes the portal-web subchart, and the standalone Co-Scientist web interface and its CLI install endpoint are removed. Users work in the Co-Scientist panel in Seqera Platform and install the CLI from npm. When you upgrade from v26.1, remove the portal-web values and global.portalWebDomain from your helm installation values, and retire the web interface DNS record. See Install Co-Scientist.

Projects move into Seqera Platform and use proj_ labels instead of project_. Rename existing project_* labels to keep them as projects. The Projects view is enabled by default. See The Projects view is enabled by default.

The Projects view is enabled by default​

Seqera Platform Enterprise 26.2 adds the Projects view and enables it by default. To restrict the view, set TOWER_SCIENTIST_VIEW_ALLOWED_WORKSPACES to a comma-separated list of workspace IDs, or to 0 to turn it off in every workspace.

MCP server image moves to the enterprise/ registry project​

MCP server images from 1.4.3 are published only to cr.seqera.io/enterprise/mcp/server. cr.seqera.io/ai/mcp/server serves releases up to 1.4.2 and receives no new ones. Use Platform chart 1.0.4 or later, which defaults to the new repository. On an earlier chart, set mcp.image.repository: enterprise/mcp/server. If you mirror images, add enterprise/mcp/server to your mirror, and remove any mcp.image.repository: ai/mcp/server override from your values. See Install Co-Scientist.

The component compatibility catalog is enabled by default​

TOWER_CATALOG_ENABLED now defaults to true. On upgrade, with no configuration change, Platform serves the /catalog/* endpoints. The launch version picker and launch validation read the catalog instead of the built-in version list. By default, that is the bundled catalog-state.json. In 26.2, the bundled catalog lists the same Nextflow versions as the built-in list and defaults to 26.04. No previously selectable version is lost. Set TOWER_CATALOG_ENABLED to false to restore the previous behavior. See Component compatibility catalog.

Data lineage is available in every workspace by default​

Data lineage is now available in every organization workspace. In 26.1, leaving the TOWER_LINEAGE_ALLOWED_WORKSPACES environment variable unset (the default) disabled lineage everywhere. An installation that never set it gains lineage in every workspace on upgrade. Lineage is never available in personal workspaces.

• Availability alone does not turn lineage on for runs: a run records lineage by default only in a workspace whose lineage settings turn on Enable lineage by default.
• To limit lineage to specific workspaces, set TOWER_LINEAGE_ALLOWED_WORKSPACES to a comma-separated list of their IDs before upgrading. See Upgrade deployment.

Audit log v1 writes are removed​

Seqera Platform Enterprise 26.2 writes audit events only to the v2 schema. This is a breaking change for direct database consumers and custom ETL jobs that still read new events from the legacy v1 schema (tw_audit_log table).

• The TOWER_AUDIT_LOG_V2_WRITE_MODE setting is removed and has no effect. Remove it from your configuration.
• Platform writes no new rows to the v1 schema. Existing rows remain until the audit log retention period deletes them. As long as the table has records, they stay visible in the Table v1 tab of the Admin panel Audit logs page, which is hidden once the legacy table is empty.

OIDC audience enforcement​

The OIDC access tokens that Seqera Platform issues can now carry an aud claim, set with TOWER_OIDC_ACCESS_TOKEN_AUDIENCE. Enforcement is a separate switch that starts in warn-only mode. With TOWER_OIDC_AUDIENCE_ENFORCEMENT_ENABLED at its default of false, Platform logs audience and issuer violations on the OIDC access tokens it issues but still accepts the tokens. Set it to true only after confirming your clients present the expected audience. See OIDC access tokens.

Nextflow version floors per compute environment type​

The Nextflow version catalog sets a minimum Nextflow version for several compute environment types, and features that require a newer runtime raise that floor further. Compute environments pinned to an older Nextflow version may need updating. Review your pinned versions before upgrading.

Grant consolidation​

The ComputeEnvironment_Validate grant is folded into ComputeEnvironment_Write. Custom roles that held the validate grant without write access lose it on upgrade, and the built-in Maintain role can no longer validate compute environments. Add compute_environment:write to any custom role that still needs to validate.

Google Cloud pipeline secrets are now regional​

Platform now creates pipeline secrets for Google Batch and Google Cloud compute environments with user-managed replication pinned to the compute environment's region, instead of global replication. This applies to every Google Cloud compute environment, not only those in projects that enforce constraints/gcp.resourceLocations. A regional Secret Manager outage now fails secret creation where global replication would have succeeded. This is deliberate, because the job runs in the same region.

Pre-flight checks are enabled by default​

Seqera Platform Enterprise 26.2 enables pre-flight checks and credential validation by default. TOWER_PREFLIGHT_CHECK_ENABLED and TOWER_CREDENTIALS_VALIDATION_ENABLED both default to true. After upgrading, an installation that has not set either variable validates credentials on create and update, and re-validates credentials and compute environments every 12 hours. It rejects launches against INVALID credentials or compute environments with a 400, and hides INVALID credentials in the compute environment creation form.

A credential that a provider-side policy change has quietly broken therefore starts blocking launches at upgrade rather than failing the run. Review the credentials list after upgrading.

To keep the previous behavior, set both variables to false. Disable them together. With credential validation off and pre-flight checks on, Platform still rejects launches against INVALID credentials, but the Credentials page hides the INVALID status and the Validate action. See Compute environment pre-flight checks.

Compute environments reject unusable credentials​

Creating or updating a compute environment against an invalid or deleted credential previously succeeded silently and produced a compute environment that could not run. It now returns a 400. Automation that creates or updates compute environments should handle this response.

Workload identity federation is enabled by default​

Seqera Platform Enterprise 26.2 enables workload identity federation in every organization workspace. It takes effect once the OIDC provider is configured with TOWER_OIDC_PEM_PATH. To restrict it, set TOWER_IDENTITY_FEDERATION_ALLOWED_WORKSPACES to a comma-separated list of workspace IDs. See Enable workload identity federation.

This is a breaking change for Google Cloud credentials that already use workload identity. Before 26.2, they presented the workflow subject on every call. In an enabled workspace they now present platform, data, studio, or workflow, depending on the request. An impersonation binding against the exact workflow subject, or against an attribute.workload value, stops matching and the workspace loses access. Before upgrading, update those bindings to admit every subject, or leave the workspace out of TOWER_IDENTITY_FEDERATION_ALLOWED_WORKSPACES to keep the workflow subject. See Existing Google Cloud credentials.

IdP group claim handling​

Platform now treats absent IdP group claims as an empty set instead of ignoring them. A user whose claims arrive without group information loses their delegated memberships. Confirm that your identity provider sends group claims on every assertion before upgrading.

Platform API specification version​

The Platform API specification in this release is version 1.227.0 (Seqera Enterprise 26.1.5: 1.184.0). Many response properties are now declared nullable. Regenerate any client or contract test generated from an earlier specification.

Container building​

• Added the conda/micromamba:v3 template with layered Conda builds by @pditommaso in #1146
• Renamed the conda/micromamba:v3 template to conda/micromamba:v2-fast by @pditommaso in #1151

Singularity​

• Added multi-architecture Singularity (SIF) build support by @pditommaso in #1140

General​

• Documented multi-platform container builds by @munishchouhan in #1137

Dependencies​

• Upgraded Micronaut platform to 4.10.19 (COMP-2257) by @cristianrcv in #1142
• Upgraded bouncycastle to 1.85 (COMP-2551) by @cristianrcv in #1141
• Upgraded typespec to 1.16.0 (COMP-2378) by @cristianrcv in #1143
• Upgraded lib-pairing to 1.1.1 to accept large pairing messages by @arnaualcazar in #1144
• Updated aws-actions/configure-aws-credentials action to v6.3.0 by @seqeralabs-renovate[bot] in #1139
• Updated anthropics/claude-code-action action to v1.0.231 by @seqeralabs-renovate[bot] in #1138

Full changelog: https://github.com/seqeralabs/wave/compare/v1.38.0...v1.39.0

How to pin this version​

fusion {
  enabled = true
  containerConfigUrl = 'https://fusionfs.seqera.io/releases/v2.6.10-amd64.json'
}

Bug fixes​

Fusion Snapshots​

• Fixed successful snapshot tasks failing with exit code 174 when the task deleted a temporary file it still had open.

Upgrade notes​

• Drop-in replacement for v2.6.9. No configuration changes required.
• If you pinned snapshot tasks to v2.6.8 to avoid the exit code 174 failures, you can unpin them.

How to pin this version​

fusion {
  enabled = true
  containerConfigUrl = 'https://fusionfs.seqera.io/releases/v2.6.9-amd64.json'
}

Bug fixes​

NFS service mode​

• Fixed a task exiting with 0 when the final upload of its work directory failed. Fusion now retries the upload for about five minutes, then exits with 174. See Fusion exit codes.
• Fixed a Remote I/O error when a task relaunched from a clean start recreated a path the clean had removed.

AWS​

• Fixed a short gap in the EC2 instance metadata service leaving Fusion with anonymous S3 access for the rest of the task. If the work directory is still unreachable, Fusion exits with 173, which Intelligent Compute relocates to another host.

Dependencies​

• Updated dependencies and CI.

Upgrade notes​

• Drop-in replacement for v2.6.8. No configuration changes required.
• In NFS service mode, a task whose command succeeded but whose final work directory upload failed now exits with 174 instead of 0. A task whose command failed keeps its original exit code.
• On EC2, a host with no instance profile keeps using anonymous S3 access. If a host has an instance profile but no reachable instance metadata service and should use anonymous access, set AWS_EC2_METADATA_DISABLED=true.

Language features​

• Fixed formatter dropping the main: label when onComplete: or onError: is present by @ewels in #7346

General​

• Fixed BitbucketServerRepositoryProvider ignoring the token field by @jorgee in #7120

Dependencies​

• Bumped nf-amazon@3.4.6 by @pditommaso in 30cfdc47

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v25.10.8

Co-Scientist​

• Made Projects available in organization workspaces to roles with the Projects permission, which existing custom roles don't include.
• Added the Project workspace role, for a user who launches a project's pipelines, adds datasets, and reads run reports from the Projects view, without the workspace's Launchpad, Runs, Datasets, Compute, or Settings pages.
• Added a Projects permission category to custom roles.
• Surfaced proj_ labels as projects in Labels settings.
• Limited the launch picker on a project's Runs tab to pipelines that carry the project's label.

Pipelines​

• Added a Fusion version selector to the launch form, and limited both version lists to compatible versions.

Studios​

• Added Conda packages for custom container images under More settings.
• Shortened the browser tab title on the Studio details and connect pages to Studio: <name>.

Data Explorer​

• Added the bucket versioning state (Enabled, Suspended, Disabled, or Unknown) to the About data repository dialog for Amazon S3 and Google Cloud Storage data repositories.

Data lineage​

• Changed See in Data Explorer on the run Outputs tab to use the output directory from the run's lineage record.

Credentials​

• Added the Set up Workload Identity Federation in GCP panel to Google Workload Identity credentials created from the compute environment form.

Monitoring​

• Added a Quick launch action to the empty runs list.

Bug fixes​

Pipelines​

• Fixed the Add and Update buttons on the action and pipeline forms staying disabled after a pipeline revision failed to load.

Actions​

• Fixed a paused action that names a deleted pipeline being resumable instead of asking you to point it at a live pipeline.

Compute environments​

• Fixed Azure Batch Forge compute environment creation accepting a malformed container registry credential ID, or more than one.

Access control​

• Fixed selecting a template for a custom role not applying its permissions.

General​

• Fixed the Runs and All runs pages showing no results when opened or reloaded with a search filter in the URL.
• Fixed cancelled runs showing an empty Metrics tab.

How to pin this version​

fusion {
  enabled = true
  containerConfigUrl = 'https://fusionfs.seqera.io/releases/v2.6.8-amd64.json'
}

Feature updates and improvements​

Fusion Snapshots​

• Added FUSION_SNAPSHOT_CLEAN_START. When it is set, Fusion cleans the work directory and removes leftover snapshot data before the task starts, so a task whose snapshot restore failed can be relaunched from scratch in the same work directory. Intelligent Compute sets it when it relaunches such a task.

Bug fixes​

NFS service mode​

• Fixed files and directories left idle during a task failing with a stale file handle error.

General​

• Fixed a spurious Check available filesystem space error printed every time a mount shut down.

Dependencies​

• Updated test and CI tooling and dependencies.

Upgrade notes​

• Drop-in replacement for v2.6.7. No configuration changes required.
• FUSION_SNAPSHOT_CLEAN_START applies to NFS service mode only, and you do not need to set it yourself. Without it, Fusion behaves as in v2.6.7.
• File handles in NFS service mode stay valid while the Fusion mount keeps running. They do not survive a restart of the mount.

Language features​

• Moved the type checker into nf-lang and brought static typing out of preview by @bentsherman in #7656

Google Batch​

• Deprecated Google Batch machine type selection via Cloud Info by @bentsherman in #7677

Plugins​

• Allowed a cache factory to decline a session by @jorgee in #7681

General​

• Added a hint to nextflow log and nextflow clean errors that the commands do not support the cloud cache by @bentsherman in #7676
• Removed a stray git push from the release task by @bentsherman in #7678

Bug fixes​

S3​

• Fixed S3 upload retries by making ByteBufferInputStream resettable by @jorgee in #7577

Google Batch​

• Fixed Google Batch array-child tasks reporting a null machine type by @pditommaso in #7629

Dependencies​

• Bumped Bouncy Castle to 1.85 to fix critical CVEs by @pditommaso in #7658
• Bumped pi-coding-agent to 0.84.4 to fix npm advisories by @pditommaso in #7659
• Bumped slf4j to 2.0.19 by @pditommaso in #7661
• Fixed npm advisories in the docs site dependencies by @pditommaso in #7660
• Bumped nf-agent-pi@0.5.3
• Bumped nf-amazon@3.11.1
• Bumped nf-cloudcache@0.6.2
• Bumped nf-google@1.28.1
• Bumped nf-k8s@1.6.1

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.09.1-edge

Language features​

• Added direct execution of named workflows by @jorgee in #7379
• Added workflow modules by @bentsherman in #7342
• Deprecated the storeDir directive and documented an alternative approach by @bentsherman in #7574
• Documented multiple architectures in the arch directive by @pditommaso in #7622
• Made eval output names stable across runs by @bentsherman in #7575
• Reported a syntax error for an invalid output or emit assignment by @bentsherman in #7547
• Reported an error for an aliased type include by @bentsherman in #7557
• Reported invalid escape sequences at the exact position by @bentsherman in #7608

Configuration​

• Added a directory option to resolve report paths against outputDir by @bentsherman in #7553
• Added the manifest.diagram config option by @pinin4fjords in #7578

Azure​

• Added Azure Compute Gallery image and verification options by @LennyBEL in #7338

Google Batch​

• Sped up submission of Google Batch array jobs by @thalassemia in #6847

Kubernetes​

• Changed the default k8s compute resource type to Job by @bentsherman in #7524

Plugins​

• Added extension points for task caching and object-storage access by @jorgee in #7638
• Removed support for nf-weblog by @bentsherman in #7639

General​

• Added automatic resource labels for any executor by @pditommaso in #7528
• Added a codespell CI check and fixed existing typos by @ewels in #7594
• Added configurable timeouts to SCM API requests by @robsyme in #7536
• Added deep links to migration notes by @bentsherman in #7624
• Added retries for request timeouts in the Tower and Wave HTTP clients by @pditommaso in #7604
• Adopted the shared io.seqera:lib-util-net ProxyConfig for egress proxy handling by @pditommaso in #7587
• Cleaned local task directories in hybrid runs by @bentsherman in #7611
• Cleaned up ADR prose and fixed typos by @bentsherman in #7595
• Cleaned up the 26.08.0-edge changelog by @pditommaso in #7527
• Deduplicated include URI resolution logic by @bentsherman in #7644
• Improved resilience to delayed shared file system visibility by @pditommaso in #7489
• Made NXF_AGENT_MODE an explicit override of agent mode auto-detection by @bentsherman in #7615
• Renamed SCM HTTP client timeouts to the global NXF_HTTPCLIENT_* namespace by @pditommaso in #7567
• Stopped Nextflow submitting queued tasks after the session has aborted by @Mohit-Ak in #7482

Dependencies​

• Aligned the nf-agent test Groovy dependency to 4.0.33 by @pditommaso in #7559
• Fixed Jackson, Netty, and gRPC CVEs via API-scoped dependency constraints by @jorgee in #7329

Bug fixes​

Language features​

• Fixed cloning of typed process outputs to also clone topics by @bentsherman in #7556
• Fixed formatting of legacy type annotations by @bentsherman in #7525

Configuration​

• Fixed a false warning for executor selectors by @bentsherman in #7555
• Fixed the description for process config options with method overloads by @bentsherman in #7442
• Fixed the resume config breaking other CLI commands by @bentsherman in #7581

S3​

• Fixed S3 directory upload skipping symbolic links by @jorgee in #7515
• Fixed workflow output publishing to S3 with the default path by @bentsherman in #7518

Azure​

• Fixed nf-azure plugin tier-1 bugs by @adamrtalbot in #6831

Google Batch​

• Fixed nextflow clean aborting on GCS pseudo-directories by @bentsherman in #7630
• Fixed the env config scope not applied with Google Batch by @bentsherman in #7609
• Fixed Google Batch storing symlinked task outputs as gcsfuse placeholders by @bentsherman in #7612

Plugins​

• Fixed resolution of non-core plugin dependencies from the registry by @bentsherman in #7613

General​

• Fixed a typo in the error message for an invalid LID path by @ewels in #7593
• Fixed the lineage checksum computed in standard mode regardless of label by @bentsherman in #7582
• Fixed a local executor resource accounting race by @pditommaso in #7652
• Fixed the multi-revision test failing locally by @bentsherman in #7541
• Fixed the output index file write to object storage by @bentsherman in #7635
• Improved NFS lock error handling in DefaultCacheStore by @matthdsm in #6997

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.09.0-edge

Monitoring​

• Added a live task execution timeline to the run Tasks tab, showing each task's queued and running time.

Pipelines​

• Extended the Nextflow version list back to 23.03, from a previous floor of 25.10.
• Added the pipeline diagram declared in manifest.diagram to the launchpad pipeline details page.

Studios​

• Added custom Studio icons, shown in the Studios list and on the Studios page.

Co-Scientist​

• Moved the sandbox chip into the chat composer toolbar, beside the context chips.

Data lineage​

• Made data lineage available in organization workspaces for runs on AWS compute environments.
• Added pipeline:<name> and pipelineId:<id> qualifiers to lineage search, matching a pipeline's runs, tasks, and published files.
• Added pipeline names to lineage search results and a See syntax tips link to the search modal.
• Changed data lineage ingestion from SQS polling to SNS notifications and added s3:ListBucket to the lineage IAM policy; manually configured workspaces must be reconfigured.

General​

• Added the reason an action stopped or failed to the Actions list.
• Redesigned the Actions list as a table showing each action's source, status, last event, and creator, with usage details in a dialog.
• Added guided empty states to list pages, naming the next step to take.

Bug fixes​

Co-Scientist​

• Fixed a closed Co-Scientist chat reopening on page refresh.
• Fixed the left navigation staying collapsed after closing the Co-Scientist chat.

Pipelines​

• Fixed GitHub Redeliver not retrying an action trigger whose launch failed.

Studios​

• Fixed Studios SSH authorization rate limiting applying across all sessions instead of per session.

General​

• Fixed labels beyond the first 100 missing from the launch form and label search, and label assignments dropping selections not on the current page.
• Fixed an unstable sort order that repeated or omitted labels when paging through the label list.

How to pin this version​

fusion {
  enabled = true
  containerConfigUrl = 'https://fusionfs.seqera.io/releases/v2.6.7-amd64.json'
}

Bug fixes​

NFS service mode​

• Fixed retried tasks timing out with exit code 173 on every host after an interruption.
• Fixed a work directory emptied by an earlier attempt failing to prepare.
• Halved the storage listings needed to prepare a work directory.

Dependencies​

• Updated build tooling and dependencies.

Upgrade notes​

• Drop-in replacement for v2.6.6. No configuration changes required.
• The regression affects Fusion in NFS mode on v2.6.6 only. Earlier v2.6 releases are unaffected.
• Two limitations remain. A work directory reused without being cleaned is not swept, and leftover names can persist there. Snapshot restore in NFS mode is still under active work. Do not assume every restore path is covered.

How to pin this version​

fusion {
  enabled = true
  containerConfigUrl = 'https://fusionfs.seqera.io/releases/v2.6.6-amd64.json'
}

Bug fixes​

Fusion Snapshots​

• Fixed snapshot restore failing for a task relaunched after its instance was reclaimed.
• Fixed Fusion Snapshots never writing a checkpoint on Google Cloud VMs launched by Intelligent Compute.

NFS service mode​

• Fixed tasks losing their NFS export when a Google Cloud or Azure host was reclaimed.

Dependencies​

• Fixed CI and updated dependencies.

Upgrade notes​

• Drop-in replacement for v2.6.5. No configuration changes required.
• The permissions fix resolves restore failures for a task relaunched after a reclaim. Snapshot restore in NFS mode is still under active work. If you rely on snapshots, do not assume every restore path is covered.

How to pin this version​

fusion {
  enabled = true
  containerConfigUrl = 'https://fusionfs.seqera.io/releases/v2.6.5-amd64.json'
}

Bug fixes​

Fusion Snapshots​

• Fixed a relaunched task not finding the checkpoint its previous attempt took.
• Fixed a snapshot missing files from the task work directory in NFS mode.

General​

• Fixed a renamed directory stranding files that were still uploading.
• Added a timeout to the first lookup of a bucket region.
• Fixed mounts never removing their working folder under the cache location.

Dependencies​

• Updated the Go toolchain to 1.27.1.
• Removed dead code and updated CI and dependencies.

Upgrade notes​

• Drop-in replacement for v2.6.4. No configuration changes required.
• The snapshot restore fix covers a task relaunched on a different instance, which is what happens when an instance is reclaimed. A task relaunched against the same still-running Fusion daemon that drained the previous attempt still fails to restore.

• Google Batch and Google Cloud compute environments now require a VPC network when Use private address is enabled, and Google Batch also requires a subnet. Both the compute environment form and the API reject a create or update request that enables private addressing without them. Previously, the environment was accepted and failed later at pipeline launch.

Feature updates and improvements​

Compute environments​

• Added the AWS r9gd instance family to the local NVMe list.
• Removed the Preview badge from Seqera Compute in the compute environment platform list.

Credentials​

• Removed the Beta notice from Azure Entra service principal credentials.
• Added a Set up Workload Identity Federation in GCP panel to Google Workload Identity credentials, listing the values to copy into your Google Cloud project: the OpenID Connect issuer URL, the google.subject mapping that makes Cloud Audit Logs trace activity back to the acting Seqera user, and a recommended attribute condition that pins the workload identity pool to your organization and workspace. The provider, service account email, and token audience fields moved to a Connect the federated identity panel.

Pipelines​

• Added deduplication of repeated GitHub webhook deliveries to an action, preventing a resend from launching the pipeline a second time. A delivery that cannot be recorded now returns 500, and GitHub offers the resend rather than reporting success.
• Added an audit log record for every action firing.
• Added a Created by column to the Actions list.
• Grouped the action form into Details, Trigger, and Target sections. The form omits the Trigger section for GitHub and Seqera sources, which a webhook endpoint drives instead.

Bug fixes​

Compute environments​

• Fixed Kubernetes, EKS, and GKE compute environment validation reporting every connection failure as Unexpected error while processing request, so connection timeouts, refused connections, DNS failures, TLS and certificate errors, and endpoints that are not a Kubernetes API server now each report what failed.
• Fixed GKE cluster discovery reporting a generic 400 for revoked keys, exceeded quotas, and unreachable API endpoints instead of the underlying Google Cloud error.
• Fixed compute environment validation reusing a cached client from a different compute environment, so correcting a field and resubmitting, or updating credentials, now validates against the new values.
• Fixed GKE compute environments that use Workload Identity Federation failing with a 500 when reading run logs or downloading files.
• Fixed Azure Cloud compute environment creation failing with an unexplained error when the credentials cannot read back a resource the forge has just created, so the error now names the resource and the missing read permission.
• Fixed pipeline additions against Tower Agent compute environments intermittently failing with Timeout waiting for command response.

Studios​

• Fixed Studios with mounted data links failing to start on Seqera Compute and on AWS Cloud, Azure Cloud, and Google Cloud compute environments.