Co-Scientist​

• Replaced the Recent shortcut in the @ mention menu with a Search context field, per-category browsing, paginated results, and status badges.

Compute environments​

• Added Use private address to Azure Batch Forge compute environments, for pool nodes without public IP addresses.
• Added the instance ID and failing command to setup script warnings in the run execution log.

Studios​

• Added a link from a Studio's details page to its compute environment.

Service accounts​

• Added service accounts: non-human identities that belong to an organization and that an agent can run as. Organization owners add, view, edit, and delete them from the new Service accounts tab under Access control.
• Added workspace roles for service accounts.
• Added organization membership rules for service accounts. Each service account counts toward the organization's member limit.
• Marked service accounts in the admin panel. The users list and the Members of organization and Workspace participants tabs show a service account badge and a distinct avatar, and the organization role column reads Service account.

General​

• Redesigned the organization, workspace, and user profile settings pages.

Bug fixes​

Co-Scientist - projects​

• Fixed the project Datasets tab showing unusable dataset actions to Launch users and non-functional buttons in empty projects.
• Fixed relaunching a run from a project's Runs tab returning to the workspace instead of the project.

Pipelines​

• Fixed Launch users being unable to resume runs of pipelines with Pull latest enabled.
• Fixed Azure data repositories selected as a run output directory producing an invalid path.
• Fixed a Fusion version selected in the launch form ignoring the compute environment's Fusion snapshots setting. A selected version with no Fusion snapshots build now fails the launch with an error.

Compute environments​

• Fixed AWS compute environments reporting an unexpected error instead of an access denial when credentials cannot reach the work directory bucket.

Credentials​

• Fixed Bitbucket Server credentials with an access token and no password being rejected when adding a pipeline or opening its launch form.

Data Explorer​

• Fixed the IGV preview losing its reference annotation track, chromosome ideogram, and gene name search.

Data lineage​

• Fixed selecting a task in global search results opening the run's Tasks tab instead of the task.

Secrets​

• Fixed pipeline secrets with underscores in their names being wrongly rejected as duplicates.

General​

• Fixed muted text using the light theme color in the dark theme.
• Fixed muted and raised surfaces being indistinguishable in the dark theme.
• Fixed pipeline and compute environment addresses in the public 12.0.0.0/8 and 172.32.0.0-172.37.255.255 ranges being rejected as private.
• Fixed screen readers not announcing a field's label together with its value.

Highlights​

• You can launch a pipeline with a specific Nextflow version, chosen from a system-wide catalog of nf-launcher images. Each compute environment type sets a minimum version. See Compute environments.
• Platform validates credentials and compute environments before launch, on a schedule, and on demand. Broken credentials surface before a run fails. This is enabled by default. See Upgrade notes.
• Actions can be triggered by a bucket event, a schedule, or a pipeline run event, can start an agent instead of a pipeline, and record a trigger history. The three triggers are enabled by default in every workspace.
• Global search, backed by the data lineage query language, searches across workspaces. It is on by default. To turn it off, set TOWER_GLOBAL_SEARCH_ENABLED to false.
• You can encrypt pipeline secrets with a customer-managed AWS Key Management Service (KMS) key, set with TOWER_AWS_SECRETS_KMS_KEY_ID.
• Enterprise deployments now send aggregate entity telemetry with the license check. This is enabled by default. See Upgrade notes.
• Co-Scientist chat is available to every organization in the installation. It is enabled by default once the Co-Scientist agent backend is configured. See Upgrade notes.
• You can configure reusable AI agents per workspace and start one from a run with Trigger agent. Each agent acts as its bound service account. Agents are enabled by default once the Co-Scientist agent backend is configured. See Upgrade notes.
• A Projects view groups a workspace's pipelines, datasets, and runs by project, and launches from a project use an essentials-only launch form. This is enabled by default in every organization workspace. See Upgrade notes.
• The standalone Co-Scientist web interface (provided by the portal-web chart) is removed. Co-Scientist is now part of Seqera Platform. See Upgrade notes.
• A component compatibility catalog records which Nextflow, Fusion, and nf-launcher artifacts work with this Platform version, with deployment-local overrides for private registries. This is enabled by default. See Upgrade notes.
• Platform can stamp the aud claim on the OIDC access tokens it issues and enforce it. Enforcement is off by default and only logs mismatches. See Upgrade notes.
• Studios support private sessions restricted to an allow-list of users, per-user favorites, and a configurable automated stop grace period.
• Route-aware OpenTelemetry tracing is available through the standard OTEL_* environment variables.
• Studios gain a Logs tab that streams a session's process log directly from the compute environment. Logs survive an ungraceful shutdown.
• The compute environment, credentials, and Actions lists are redesigned as row-card tables with attribute chips, grouping, and search.
• From 26.2, Seqera publishes one frontend container image, platform/frontend:<tag>, which runs in unprivileged mode. The -unprivileged tag alias and the -root variant, which ran as the root user, are gone. See Upgrade notes.
• Platform writes audit events only to the v2 schema. This is a breaking change for direct database consumers and ETL jobs that read the v1 tw_audit_log table. Update them to the v2 schema before you upgrade. See Upgrade notes.

Feature updates and improvements​

Pipelines​

• Added a Nextflow version selector. A system-wide catalog maps each selectable version to an nf-launcher image, sets a minimum version and launcher variant per compute environment type, and raises the floor for features that require it. The catalog defaults to Nextflow 26.04 and is not user-editable.
• Extended the Nextflow version catalog back to 23.03.0-edge, for 70 versions in total. Pipelines pinned to an older runtime remain launchable. Releases from 25.04.1 and later resolve to public.cr.seqera.io/platform/nf-launcher images. The oldest entries, which were never mirrored there, resolve to quay.io/seqeralabs/nf-launcher.
• Added synchronous pre-flight checks at launch. A launch now fails fast with an actionable reason instead of failing during execution.
• Added an output directory option to the launch form, preserved across resume.
• Aggregated launch validation failures into a single response and a multi-error failure message that reports every problem at once.
• Added launch-time settings (profiles and the Nextflow syntax parser) to the run configuration tab, and surfaced them in the workflow configuration tab.
• Validated the parameters text against the JSON-serialized size limit, using the tower.launch.config.maxSize value in the frontend validators.
• Added a component compatibility catalog that records which Nextflow, Fusion, and nf-launcher artifacts are compatible with this Platform version, and enforces that compatibility at launch. Enabled by default. To turn it off, set TOWER_CATALOG_ENABLED to false. TOWER_CATALOG_SOURCE selects the catalog source (classpath:, file:, or licman for the live License Manager source) and TOWER_CATALOG_EMBEDDED sets the fallback used when a live source is unavailable.
• Added deployment-local catalog overrides, supplied through your own application-catalog.yml. An override can remap an existing artifact to a private registry reference, add a deployment-only version, or hide a version from listings and pick validation. Overrides are marked origin: override, audited at launch, and never written back to the shared catalog. This subsumes the single TOWER_LAUNCH_CONTAINER pin.

Actions​

You can now trigger Actions with a bucket event, a schedule, or a pipeline run event. All three triggers are enabled in every workspace by default, including personal workspaces. Restrict them with TOWER_ACTIONS_BUCKET_TRIGGER_ALLOWED_WORKSPACES, TOWER_ACTIONS_CRON_TRIGGER_ALLOWED_WORKSPACES, and TOWER_ACTIONS_PIPELINE_TRIGGER_ALLOWED_WORKSPACES. See Core features. Review whether these triggers are appropriate for your installation before upgrading.

• Added the Bucket event trigger, which fires an Action when a marker file is created or deleted in an AWS S3 data repository.
• Added the Schedule trigger, which fires an Action daily, weekly, or on a custom cron expression.
• Added the Pipeline run event trigger, which fires an Action when a run of a Launchpad pipeline succeeds, fails, or is cancelled. Use it to have one pipeline launch the next.
• Added an agent target. A bucket event, schedule, or pipeline run event Action can start an existing agent instead of launching a pipeline.
• Added a Trigger history tab that lists each time an Action fired, with its status, payload, and target.
• Redesigned the action form and Action page. You can now change the trigger when you edit an Action.
• Added recorded pause reasons, shown on the Actions list and the Action page, and a Created by column on the Actions list.
• Added protection against Actions that trigger themselves: a bucket event Action that watches its own pipeline's output is rejected, and a pipeline run event Action that would close a loop is suppressed.

Compute environments​

• Redesigned the compute environment list as a row-card table, with attribute chips, a type label, an Invalid status, the compute environment ID, and grouped, searchable compute environment selects.
• Added scheduled pre-flight validation for compute environments in the AVAILABLE state.
• Added a maxCpusPerUser per-user vCPU cap.
• Added encryption of pipeline secrets with a customer-managed KMS key, configured with TOWER_AWS_SECRETS_KMS_KEY_ID. Compute environments saved before this release continue to use the AWS-managed key.
• Required spot provisioning for Fusion snapshots, and aligned the GCP provisioning interface accordingly.
• Added a scheduled cleanup that soft-deletes orphaned credentials and compute environments belonging to deleted workspaces. Off by default. To turn it on, use TOWER_WORKSPACE_ORPHAN_CLEANUP_ENABLED.
• Added TOWER_COMPUTE_ENV_LAST_USED_FLUSH_INTERVAL to control how often the last-used timestamp is flushed.
• Added new environment variables for the validation and cleanup schedules. See Configuration overview for full descriptions and defaults:
  • TOWER_CRON_CREDENTIALS_VALIDATION_*: tick rate, delay, interval, batch size, concurrency, probe delay, transient retry intervals, and maximum unverifiable attempts
  • TOWER_CRON_COMPUTE_ENV_VALIDATION_*: tick rate, delay, interval, and batch size
  • TOWER_CRON_CREDENTIALS_ORPHAN_CLEANUP_* and TOWER_CRON_COMPUTE_ENV_ORPHAN_CLEANUP_*: tick rate, delay, batch size, and concurrency

AWS​

• Added EBS volume encryption with an optional KMS key for AWS Cloud compute environments.
• Added VPC and multiple subnet selection for AWS Cloud compute environments.
• Added automatic GPU AMI selection for AWS Cloud compute environments.
• Added log group persistence, forwarded to the CloudWatch agent.
• Added security group name search to AWS dropdowns.
• Added the AWS jump-role trust policy to the credentials form.
• Added r8idn, r8idb, m8idn, m8idb, m9gd, c9gd, g7, and r9gd instance families to the NVMe list.

Azure​

• Added bring-your-own networking for Azure Cloud compute environments.
• Added OS disk size configuration for Azure Cloud compute environments.
• Added configurable boot disk size for Azure Batch pools.
• Added private Azure Container Registry image pull support for Azure Cloud.
• Reworked the Azure credentials region field, and validated Azure Batch access on the compute environment rather than the credential.
• Updated the list of available Azure regions.

GCP​

• Added VPC network and subnet selection for Google Cloud compute environments, with metadata autofill, and exposed the network fields in the API model.
• Added end-to-end Workload Identity Federation credential support for Google Cloud compute environments.
• Updated the default GPU image family to CUDA 12.9.

Credentials​

• Added a credential validation status, shown on the credentials list and detail pages, with an error alert for credentials in the INVALID state.
• Added a scheduled validation cron, a launch-time gate, and an on-demand Validate button. The cron runs every 12 hours by default.
• Added a work directory reachability probe at launch for AWS and Google Cloud credentials. Platform rejects a run whose work directory the credential cannot read before the run starts, instead of letting it fail during execution. The probe is bounded at five seconds and fails open, allowing the launch when the result is inconclusive.
• Aligned the credentials list with the compute environment card layout.
• Added workload identity federation to AWS credentials. Platform exchanges a short-lived token it signs for temporary AWS credentials through sts:AssumeRoleWithWebIdentity. The credential stores only a role ARN. Enabled by default. See Upgrade notes.
• Added per-context subjects to workload identity federation tokens for AWS and Google Cloud. A token names the kind of work making the request: platform, data, studio, or workflow. Trust and permission policies can scope access by workload, and cloud audit logs can name the acting user. See Subjects and attribution.

Studios​

• Added sharing for private Studios: the creator can allow one other workspace user to connect to and run the session. The allowed user is persisted on create and start, and exposed in the studio API response.
• Added a configurable automated stop grace period. tower.data-studio.force-stop-threshold (default 10m) sets how long a studio must be stuck in a non-final state before it is force-stopped, and tower.data-studio.approaching-expiration-threshold (default 15m) sets how long before a scheduled auto-stop the extend warning appears.
• Added persistent per-user favorites and filters that persist across navigation.
• Added the ability to cancel Studios stuck in the stopping state.
• Added a Logs tab to the Studio details page, showing the process log for the most recent session read from the compute environment's log stream. Logs are available while a session is starting and running, and after a stop or crash. They survive an ungraceful shutdown. The existing studio:read grant covers the tab, through GET /studios/{sessionId}/log. How far back logs go depends on the compute provider and its log retention.
• Added Conda packages for Studios built from a custom container image. Wave builds the packages on top of the image, and the Studio details page shows the Conda configuration.
• Added custom certificate authority configuration for Studios.
• Added checkpoint revalidation for the last checkpoint.
• Added NVIDIA environment variables for GPU Studios.
• Added a waveBuildNotification user preference controlling Wave build emails for custom Studio environments.
• Added a custom icon for a Studio, uploaded on create, start, or update and shown on the Studios list and details pages.
• Added workload identity federation for Studios on AWS and Google Cloud compute environments whose credential uses it. A session gets its own cloud identity instead of the compute environment's credentials. Requires Seqera Connect client 0.14.0 or later in the Studio's container image.

Access control​

• Added aud claim support on OIDC access tokens. TOWER_OIDC_ACCESS_TOKEN_AUDIENCE sets the audience stamped on issued tokens, and TOWER_OIDC_AUDIENCE_ENFORCEMENT_ENABLED (default false) controls whether incoming Platform-issued tokens are rejected on a mismatch or merely logged.
• Added the RFC 8693 token_exchange flow.
• Added OAuth 2.0 refresh-token rotation, with tokens hashed using truncated SHA-256.
• Added OAuth 2.0 token revocation (POST /oauth/revoke, RFC 7009) and token introspection (POST /oauth/introspect, RFC 7662), both advertised in /.well-known/openid-configuration. Revocation ends the presenting client's refresh-token family and returns 200 whether or not the token existed. Introspection is restricted to confidential clients and currently answers for refresh tokens only: every access token is reported active: false. You cannot yet use it to validate access tokens.
• Added configurable OIDC scopes via TOWER_OIDC_SCOPES.
• Added support for extra static OIDC clients, and propagated identity provider (IdP) service roles in issued OIDC tokens.
• Enabled IdP claims mapping by default for Enterprise deployments (TOWER_IDP_CLAIMS_MAPPING_ENABLED, default true), with an optional organization allow-list.
• Added Co-Scientist chat as a custom-role permission.
• Added the agent:read, agent:write, agent:execute, and agent:delete permissions, listed under AI with chat:execute in custom roles. The predefined owner, admin, and maintain workspace roles hold all four, launch and project hold agent:read and agent:execute, and connect and view hold none. A custom role also needs credentials:read to choose a GitHub App credential on the agent form.
• Added a Projects permission category and a project predefined workspace role, which grants project_view:read and withholds the broader workspace_resources:read. Both appear in the workspace role picker and in custom-role templates. The Projects view they gate is enabled by default in every organization workspace. See Upgrade notes.
• Split the data_link and data_link_object permissions.

Service accounts​

Service accounts turn on with agents. They are available in every organization once TOWER_AGENT_BACKEND_URL is set. To restrict them to specific organizations, set TOWER_AGENT_CONFIGURATION_ALLOWED_ORGANIZATIONS to a comma-separated list of organization IDs. See Upgrade notes.

• Added service accounts: non-human identities that belong to an organization and that an agent can run as. Organization owners add, view, edit, and delete them from the new Service accounts tab under Access control. A service account's page lists the workspaces it can act in, with a read-only Permissions matrix per workspace. Names follow the user-name rules and must be unique across the installation, and deleting a service account removes it from every workspace and frees its name.
• Added workspace roles for service accounts. From a service account's edit page, Assign to workspace grants it any built-in or custom role except Owner. Each role change or removal applies immediately, and Update saves only the name and description. A service account can also be added from a workspace's participants list, where it carries a service account badge and its own avatar, and it gets View when no role is specified instead of the Launch a person gets.
• Added a permission ceiling for service account role assignments. Anyone who adds a service account to a workspace or changes its role there must hold every permission that role grants in that workspace, or the request is rejected with a 403 naming the missing permissions. Root users are exempt.
• Added sign-in and token restrictions for service accounts. Every interactive login path rejects a service account, and an email login for its address shows "Service accounts cannot sign in to Seqera Platform." instead of sending a link. A service account cannot create personal access tokens and is never granted the root role through the root users list. It holds only a minimal service_account user-context role. Platform refuses user-level operations, such as creating an organization.
• Added organization membership rules for service accounts. A service account holds a fixed service_account organization role that cannot be changed or given to anyone else. It cannot join a team, be invited as a workspace collaborator, or be added or removed through the organization member endpoints, and it does not appear in the organization Members list. Each service account counts toward the organization's member limit.
• Marked service accounts in the admin panel. The users list and the Members of organization and Workspace participants tabs show a service account badge and a distinct avatar, and the organization role column reads Service account. Editing a service account there locks its generated email and hides the first and last name, avatar, and email-notification fields. Platform rejects a change to any field other than the user name, organization, and description with a 400.

Search​

• Added global search across workspaces, with infinite scroll and suggestions, backed by the data lineage query language. Enabled by default. To turn it off, set TOWER_GLOBAL_SEARCH_ENABLED to false.
• Added an administrative endpoint for lineage storage reindexing, plus a reindex schedule configurable with TOWER_CRON_LINEAGE_REINDEX_*.
• Aligned global search (⌘K / Ctrl+K) with the backend lineage search DSL: workspace scoping now uses org/name, the OR delimiter within a qualifier is now a comma (previously |), and typed input passes straight through to the backend.
• Renamed Search to Lineage search, to make clear that results cover Data Lineage records only.
• Reworked the lineage search modal: keyword filters are offered as suggestions as you type, a dismissible banner states that results cover lineage records only, and a workspace with lineage disabled gets an explanatory empty state offering to search across all workspaces instead.

Data lineage​

• Made data lineage available in every organization workspace by default: it can be limited to specific workspaces by setting a comma-separated list of workspace IDs at TOWER_LINEAGE_ALLOWED_WORKSPACES. See Upgrade notes.
• Added the lineage ID to the run info page.
• Added filtering of lineage search results by pipeline.
• Changed lineage record ingestion to consume SNS push notifications instead of polling SQS.

Data Explorer​

• Added the object last-modified timestamp to the Data Explorer file listing.
• Added re-signing of presigned URLs for a subset of parts of an in-progress multipart upload (uploadId and partNumbers). Long uploads now recover from expired signing credentials instead of failing. AWS S3 and S3-compatible storage only.

Secrets​

• Redesigned the secrets list as a row-card table.

Monitoring and observability​

• Added route-aware OpenTelemetry tracing. Tracing records nothing until you configure an exporter. The standard OTEL_* environment variables control sampling, resources, and export. Health, ping, Prometheus, metrics, OpenAPI, and favicon routes are excluded by default.
• Added aggregate entity telemetry, sent with the license check. Payload identifiers are hashed, the reporting window defaults to 7 days, and the license check is retried with the telemetry attached. Controlled by TOWER_TELEMETRY_BASIC_ENABLED and TOWER_TELEMETRY_STANDARD_ENABLED (both default true) and TOWER_TELEMETRY_WINDOW_DAYS.
• Audit log events are now written only to the v2 schema. The TOWER_AUDIT_LOG_V2_WRITE_MODE setting and the v1 write path have been removed. This is a breaking change for database consumers and ETL jobs that read the v1 tw_audit_log table. See Upgrade notes.
• Added a request correlation ID, propagated through the logging context.
• Added OAuth token metrics and a current-month CPU hours metric.
• Added audit entries for pre-flight cron status transitions, a user_updated event for authentication provider changes, and metadata on the audit log v2 state element.
• Added service accounts to the audit log. Actions a service account takes are recorded with a new service_account actor type, and creating, updating, and deleting one records service_account_created, service_account_updated, and service_account_deleted. In the admin audit log, the actor shows a Service account badge and its ID instead of its generated email, plus an Agent ID when an agent acted, which the CSV export carries in a new actorAgentId column.
• Added an action_triggered audit log event. Platform writes it for every trigger of an Action, whether the trigger launched, failed, or was suppressed, and the event names the Action that fired.
• Added dynamic axis scaling and precision to the job duration chart.

Co-Scientist​

Once TOWER_AGENT_BACKEND_URL points Seqera Platform at the Co-Scientist agent backend, chat is enabled for every organization by default. Set TOWER_AI_CHAT_ALLOWED_ORGANIZATIONS to restrict it to a list of organization IDs. See Upgrade notes.

• Added the Co-Scientist chat assistant, docked beside page content, with a close control and conversation history that can be selected and deleted.
• Added compute environment and list-page view context, retained referenced context in chat messages, and page context with screenshots.
• Added structured tool result rendering and a Co-Scientist usage display.
• Sped up the page screenshots that chat attaches as page context, and shortened the time the page is unresponsive while one is captured.

Agents​

Once TOWER_AGENT_BACKEND_URL points Seqera Platform at the Co-Scientist agent backend, agents are enabled for every organization by default, together with service accounts and the Trigger agent button. Set TOWER_AGENT_CONFIGURATION_ALLOWED_ORGANIZATIONS to restrict them to a list of organization IDs. See Upgrade notes.

• Added Agents to the AI section of the workspace navigation, for configuring reusable AI agents in a workspace. An agent has a name, an optional description, and Agent instructions, and can start from the Fix failed runs, Summarize successful runs, or Summarize failed runs template. You manage it with Pause, Resume, Edit, and Remove from the agents list or its own page. Agent configuration is stored by the Co-Scientist agent backend, and each change is recorded as an agent_created, agent_updated, agent_enabled, agent_disabled, or agent_deleted audit event.
• Added a Trigger agent button to run details, beside the execution log or in the error panel of a failed run, and to each run in a project's Runs tab. It lists the workspace's active agents, launches the one you select with the run's context, and opens the resulting session in the Co-Scientist panel. When the workspace has no agents, it offers Add agent instead. The button needs Co-Scientist chat and the agent:execute permission, and a failed launch shows the reason Platform or the agent backend returned instead of a generic error.
• Added a check of an agent's service account each time the agent is saved or launched. Platform refuses the request with a 409 that names the failed condition, instead of running the agent with the launching user's permissions. The conditions are that the service account was deleted or disabled, is not a participant in the workspace, or has a role without agent:execute. A run that passes acts as the service account, and Platform hands its credentials to the agent backend through a single-use /ephemeral URL.
• Added automatic disabling of the agents bound to a service account when that account is removed from their workspace or deleted from the organization. They then show as Inactive and drop out of Trigger agent, instead of failing at their next launch. Re-adding the service account does not re-enable them. Resume each one from the Agents page.
• Added an optional GitHub App credential to the Agent permissions section of the agent form, next to the Service account the agent runs as. The agent uses that workspace credential to clone, commit, and push. Platform rejects a credential from another workspace, of another type, or marked invalid, with a 400 on save and a 409 at launch. The form blocks saving while the bound credential is missing or invalid.
• Added a Sessions tab to the agent page, listing the agent's background runs with their Status, Trigger, Service account, and Run ID. The list refreshes while a run is in progress. Sessions can be searched by keyword, and View session opens a session in the Co-Scientist panel through a link you can share.
• Added Fork conversation to agent sessions in the Co-Scientist panel. Agent sessions open read-only there, with the notice "Agent sessions are read-only. Fork the conversation to continue it as your own chat." Forking copies the session into a chat of your own and opens it.

Projects​

The Projects view is enabled by default in every organization workspace. Set TOWER_SCIENTIST_VIEW_ALLOWED_WORKSPACES to a comma-separated list of workspace IDs to restrict it. See Upgrade notes.

• Added a Projects view, opened from a Workspace/Projects switcher in the side navigation, that groups a workspace's pipelines, datasets, and runs by project. A project is a workspace label named proj_<name>: Add project creates the label and applies it to the pipelines and datasets you choose, Edit renames it or changes those resources, and Delete removes the label and its resource associations but not the resources. Project names must be unique in the workspace, ignoring case, and each action requires the matching label permission.
• Added project pages with Runs, Datasets, and Reports tabs, each filtered to the project's label, plus a <workspace name> overview that covers the whole workspace. On Datasets, adding a dataset or version and editing dataset details happen in dialogs, and a dataset added there gets the project's label. Reports collects the reports of successful runs on the Runs pages loaded so far, with search, preview, and Download, and a run's View reports opens it filtered to that run.
• Added launching from a project. On a project's Runs tab, Launch pipeline lists only the pipelines that carry the project's label. It and a failed run's Relaunch open an essentials-only launch form: Run parameters shows only the parameters the pipeline schema marks as required, with a Show all parameters toggle, and the Advanced settings and Summary steps are left out. Runs launched from a project carry its label. On a project with no pipelines, Launch pipeline is hidden and only users with pipeline_label:write are offered Add pipeline.
• Added project awareness to the workspace Labels settings page: proj_ labels show a Project badge and link to their project, the Show filter gains a Project option, and creating, renaming, or deleting a proj_ label warns what that does to the project. The pipeline and dataset forms hide proj_ labels from their Labels field and refuse to create one there. Editing a pipeline or dataset keeps it in its projects.

General​

• Added a default workspace preference to the user profile.
• Added a panel search input to the navigation switcher, and made list pages preserve their page and search filters across item navigation.
• Made the docked sidenav the default experience, and made row cards clickable.
• Added nf-launcher 25.10.6, 25.10.7, and 26.08.0-edge to the version catalog.
• Added a startup warning when tower.oidc.pem.path is unconfigured.
• Added a compact relative date display across list views.

Bug fixes​

Pipelines​

• Fixed the output directory not being preserved on resume.
• Fixed workspace participants whose role lacks pipeline:write, such as Launch, being unable to resume a run whose launch had Pull latest enabled. The resume failed with Field 'pullLatest' is not writable: unset or use previous value.
• Fixed optimization targets not being returned verbatim on launch, and the optimization banner not appearing when relaunching a shared pipeline run.
• Fixed the custom schema being discarded when added for the first time in edit mode.
• Fixed the Nextflow syntax parser v2 toggle not being seeded from the saved launch configuration, and a Nextflow version being unselectable when the source pinned none.
• Fixed duplicate GitHub credentials being created across personal access token and GitHub App types.
• Fixed the credentials field not being mandatory in the Add data repository form.
• Fixed a path picked from an Azure data link in the launch form, for the output directory or a path parameter, including the storage account (az://<account>.<container>/…), which Nextflow cannot resolve. The picker now inserts az://<container>/…, and on an Azure compute environment it disables data links whose credentials differ from the compute environment's.

Actions​

• Fixed a pipeline action triggered by a GitHub webhook failing to launch on an HPC compute environment connected through Tower Agent, with Cannot retrieve user ID: missing authenticated user in current request context.
• Fixed a redelivered GitHub webhook launching its pipeline again. Platform now records each X-GitHub-Delivery ID and launches once per delivery unless the first launch failed.
• Fixed the action form's Add and Update buttons staying disabled after an invalid pipeline revision was corrected, which left the form unusable until the page was reloaded.

Compute environments​

• Fixed unusable credentials being accepted on a compute environment.
• Fixed the compute environment form allowing submission while invalid, and the Add credentials button missing in create mode.
• Fixed the SLURM and HPC executor message being reported as an error rather than a warning.
• Fixed the compute environment form not requiring a VPC when external IP addresses are disabled.

AWS​

• Fixed AWS Cloud head-job failures not being surfaced.
• Fixed vpcId and subnet selection not being applied to the AWS Cloud head job.
• Fixed runs being flagged for attention when a UserData script failed, and downgraded all AWS UserData-check permission denials to warnings.
• Fixed ecs:DescribeContainerInstances permission errors being logged at error level.

Azure​

• Fixed nextflowConfig not being preserved on forged Azure Cloud compute environments.
• Fixed the unsupported Fusion snapshots toggle appearing on the Azure compute environment form.
• Fixed Entra credential comparison and made the managed identity regular expression case-insensitive.

GCP​

• Fixed GOOGLE_CLOUD_PROJECT not being set on the GCP Batch head job, which prevented secret resolution.
• Fixed pipeline secrets not being pinned to the compute environment region.

Studios​

• Fixed baseline Studio capabilities not being used when the manifest is missing or the Studio version is absent from it.
• Fixed mount configuration being double-quoted on every compute environment type, which could leave a session unable to reach its mounted data.

Data lineage​

• Fixed the session ID of resumed runs not resolving without runName.
• Fixed lineage being reported as not enabled for submitted runs when it was enabled.
• Fixed the launch toggle remaining enabled when lineage settings are unset or the compute environment does not support lineage.
• Fixed the Launcher role being able to override the lineage setting.
• Fixed the launch form requesting lineage in a user workspace.

Data Explorer​

• Fixed GCS genomic file URLs not being signed with V4, which broke IGV preview.
• Fixed IGV reference genome URLs not being signed, and corrected IGV rendering.
• Fixed S3 buckets disappearing when an ACL fetch is denied.

Access control​

• Fixed IdP group mapping visibility not refreshing when SSO is toggled.
• Fixed the custom role form ignoring the selected template. Choosing a template now applies its permissions, the form preselects the template its permissions were prefilled from, and Restore defaults is renamed Reset to template.
• Fixed an uploaded avatar not persisting when an administrator creates a user.
• Fixed a new participant not being assigned the role requested for them.

General​

• Fixed the sidebar section not being preserved when switching workspace, including on redirect.
• Fixed features not being refetched after authentication.
• Fixed the default workspace preference not being cleared correctly.
• Fixed the global search keyboard shortcut hint showing ⌘K on Windows and Linux instead of Ctrl+K.
• Fixed the runs list not rendering in personal workspaces.

Upgrade notes​

Only one frontend container image is published​

From 26.2, Seqera publishes a single frontend container image. This is a breaking change for any deployment that pins a tag variant, and for any deployment that pins the plain tag and relies on the container listening on port 80.

• Seqera no longer publishes the -root or -unprivileged tag variants of the frontend image cr.seqera.io/enterprise/platform/frontend:<tag>. A manifest referencing cr.seqera.io/enterprise/platform/frontend:<tag>-unprivileged or cr.seqera.io/enterprise/platform/frontend:<tag>-root fails to pull on 26.2.

Before upgrading, point every frontend image reference at the plain tag and make the port match:

• Kubernetes: set the container ports.containerPort and the frontend service's targetPort to 8000, leaving the service port at 80.
• Docker Compose: map the host port to container port 8000, for example 8000:8000.

NGINX_LISTEN_PORT (default 8000) still overrides the listening port if you need a different one. Set targetPort, or the container side of the port mapping, to the same value. See Kubernetes deployment and Docker Compose deployment.

Telemetry on the license check​

Seqera Platform Enterprise 26.2 sends aggregate entity telemetry alongside the existing license check. Identifiers in the payload are hashed before transmission and the reporting window covers the previous 7 days by default.

This is enabled by default. The two tiers do not combine:

• TOWER_TELEMETRY_STANDARD_ENABLED (default true) reports entity-level records: one per run, Studios session, Studios audit event, day of Data Explorer activity, and workspace. Set it to false to fall back to the aggregate counters alone.
• TOWER_TELEMETRY_BASIC_ENABLED (default true) reports the aggregate usage counters Platform sent before entity-level telemetry existed. It is only consulted when standard telemetry is off.
• TOWER_TELEMETRY_WINDOW_DAYS (default 7) sets the reporting window.

To opt out entirely, set both flags to false. Platform then runs no telemetry query and sends no telemetry data. The installation still reports the opt-out, which lets Seqera tell it apart from an installation that stopped reporting. Licensing and quota retrieval are unaffected by either flag. See Telemetry.

User IDs, repository names, Studios template and image references, and organization and workspace names are hashed before they leave the installation.

Co-Scientist chat is enabled by default​

Once TOWER_AGENT_BACKEND_URL is set, Co-Scientist chat is available to every organization in the installation. To restrict it, set TOWER_AI_CHAT_ALLOWED_ORGANIZATIONS to a comma-separated list of organization IDs. The Platform Helm chart sets TOWER_AGENT_BACKEND_URL automatically when the agent-backend subchart is enabled.

Chat sends page context, including screenshots of the page the user is viewing, to the configured AI backend. Before you upgrade, check whether that is acceptable for your installation. If it is not, set the variable.

Agents, service accounts, and the Trigger agent button are enabled with the agent backend​

Once TOWER_AGENT_BACKEND_URL is set, agents, service accounts, and the Trigger agent button on run pages are available in every organization of the installation unless you restrict them. The Platform Helm chart sets the variable when the agent-backend subchart is enabled. When the subchart is disabled, all three features are off, as is Co-Scientist chat. None of them is available in a personal workspace.

TOWER_AGENT_CONFIGURATION_ALLOWED_ORGANIZATIONS is empty by default, which makes agents available in every organization. To restrict them, set it to a comma-separated list of organization IDs.

Co-Scientist web interface is removed​

The Platform Helm chart no longer includes the portal-web subchart, and the standalone Co-Scientist web interface and its CLI install endpoint are removed. Users work in the Co-Scientist panel in Seqera Platform and install the CLI from npm. When you upgrade from v26.1, remove the portal-web values and global.portalWebDomain from your helm installation values, and retire the web interface DNS record. See Install Co-Scientist.

Projects move into Seqera Platform and use proj_ labels instead of project_. Rename existing project_* labels to keep them as projects. The Projects view is enabled by default. See The Projects view is enabled by default.

The Projects view is enabled by default​

Seqera Platform Enterprise 26.2 adds the Projects view and enables it by default. To restrict the view, set TOWER_SCIENTIST_VIEW_ALLOWED_WORKSPACES to a comma-separated list of workspace IDs, or to 0 to turn it off in every workspace.

MCP server image moves to the enterprise/ registry project​

MCP server images from 1.4.3 are published only to cr.seqera.io/enterprise/mcp/server. cr.seqera.io/ai/mcp/server serves releases up to 1.4.2 and receives no new ones. Use Platform chart 1.0.4 or later, which defaults to the new repository. On an earlier chart, set mcp.image.repository: enterprise/mcp/server. If you mirror images, add enterprise/mcp/server to your mirror, and remove any mcp.image.repository: ai/mcp/server override from your values. See Install Co-Scientist.

The component compatibility catalog is enabled by default​

TOWER_CATALOG_ENABLED now defaults to true. On upgrade, with no configuration change, Platform serves the /catalog/* endpoints. The launch version picker and launch validation read the catalog instead of the built-in version list. By default, that is the bundled catalog-state.json. In 26.2, the bundled catalog lists the same Nextflow versions as the built-in list and defaults to 26.04. No previously selectable version is lost. Set TOWER_CATALOG_ENABLED to false to restore the previous behavior. See Component compatibility catalog.

Data lineage is available in every workspace by default​

Data lineage is now available in every organization workspace. In 26.1, leaving the TOWER_LINEAGE_ALLOWED_WORKSPACES environment variable unset (the default) disabled lineage everywhere. An installation that never set it gains lineage in every workspace on upgrade. Lineage is never available in personal workspaces.

• Availability alone does not turn lineage on for runs: a run records lineage by default only in a workspace whose lineage settings turn on Enable lineage by default.
• To limit lineage to specific workspaces, set TOWER_LINEAGE_ALLOWED_WORKSPACES to a comma-separated list of their IDs before upgrading. See Upgrade deployment.

Audit log v1 writes are removed​

Seqera Platform Enterprise 26.2 writes audit events only to the v2 schema. This is a breaking change for direct database consumers and custom ETL jobs that still read new events from the legacy v1 schema (tw_audit_log table).

• The TOWER_AUDIT_LOG_V2_WRITE_MODE setting is removed and has no effect. Remove it from your configuration.
• Platform writes no new rows to the v1 schema. Existing rows remain until the audit log retention period deletes them. As long as the table has records, they stay visible in the Table v1 tab of the Admin panel Audit logs page, which is hidden once the legacy table is empty.

OIDC audience enforcement​

The OIDC access tokens that Seqera Platform issues can now carry an aud claim, set with TOWER_OIDC_ACCESS_TOKEN_AUDIENCE. Enforcement is a separate switch that starts in warn-only mode. With TOWER_OIDC_AUDIENCE_ENFORCEMENT_ENABLED at its default of false, Platform logs audience and issuer violations on the OIDC access tokens it issues but still accepts the tokens. Set it to true only after confirming your clients present the expected audience. See OIDC access tokens.

Nextflow version floors per compute environment type​

The Nextflow version catalog sets a minimum Nextflow version for several compute environment types, and features that require a newer runtime raise that floor further. Compute environments pinned to an older Nextflow version may need updating. Review your pinned versions before upgrading.

Grant consolidation​

The ComputeEnvironment_Validate grant is folded into ComputeEnvironment_Write. Custom roles that held the validate grant without write access lose it on upgrade, and the built-in Maintain role can no longer validate compute environments. Add compute_environment:write to any custom role that still needs to validate.

Google Cloud pipeline secrets are now regional​

Platform now creates pipeline secrets for Google Batch and Google Cloud compute environments with user-managed replication pinned to the compute environment's region, instead of global replication. This applies to every Google Cloud compute environment, not only those in projects that enforce constraints/gcp.resourceLocations. A regional Secret Manager outage now fails secret creation where global replication would have succeeded. This is deliberate, because the job runs in the same region.

Pre-flight checks are enabled by default​

Seqera Platform Enterprise 26.2 enables pre-flight checks and credential validation by default. TOWER_PREFLIGHT_CHECK_ENABLED and TOWER_CREDENTIALS_VALIDATION_ENABLED both default to true. After upgrading, an installation that has not set either variable validates credentials on create and update, and re-validates credentials and compute environments every 12 hours. It rejects launches against INVALID credentials or compute environments with a 400, and hides INVALID credentials in the compute environment creation form.

A credential that a provider-side policy change has quietly broken therefore starts blocking launches at upgrade rather than failing the run. Review the credentials list after upgrading.

To keep the previous behavior, set both variables to false. Disable them together. With credential validation off and pre-flight checks on, Platform still rejects launches against INVALID credentials, but the Credentials page hides the INVALID status and the Validate action. See Compute environment pre-flight checks.

Compute environments reject unusable credentials​

Creating or updating a compute environment against an invalid or deleted credential previously succeeded silently and produced a compute environment that could not run. It now returns a 400. Automation that creates or updates compute environments should handle this response.

Workload identity federation is enabled by default​

Seqera Platform Enterprise 26.2 enables workload identity federation in every organization workspace. It takes effect once the OIDC provider is configured with TOWER_OIDC_PEM_PATH. To restrict it, set TOWER_IDENTITY_FEDERATION_ALLOWED_WORKSPACES to a comma-separated list of workspace IDs. See Enable workload identity federation.

This is a breaking change for Google Cloud credentials that already use workload identity. Before 26.2, they presented the workflow subject on every call. In an enabled workspace they now present platform, data, studio, or workflow, depending on the request. An impersonation binding against the exact workflow subject, or against an attribute.workload value, stops matching and the workspace loses access. Before upgrading, update those bindings to admit every subject, or leave the workspace out of TOWER_IDENTITY_FEDERATION_ALLOWED_WORKSPACES to keep the workflow subject. See Existing Google Cloud credentials.

IdP group claim handling​

Platform now treats absent IdP group claims as an empty set instead of ignoring them. A user whose claims arrive without group information loses their delegated memberships. Confirm that your identity provider sends group claims on every assertion before upgrading.

Platform API specification version​

The Platform API specification in this release is version 1.227.0 (Seqera Enterprise 26.1.5: 1.184.0). Many response properties are now declared nullable. Regenerate any client or contract test generated from an earlier specification.

Language features​

• Fixed formatter dropping the main: label when onComplete: or onError: is present by @ewels in #7346

General​

• Fixed BitbucketServerRepositoryProvider ignoring the token field by @jorgee in #7120

Dependencies​

• Bumped nf-amazon@3.4.6 by @pditommaso in 30cfdc47

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v25.10.8

Co-Scientist​

• Made Projects available in organization workspaces to roles with the Projects permission, which existing custom roles don't include.
• Added the Project workspace role, for a user who launches a project's pipelines, adds datasets, and reads run reports from the Projects view, without the workspace's Launchpad, Runs, Datasets, Compute, or Settings pages.
• Added a Projects permission category to custom roles.
• Surfaced proj_ labels as projects in Labels settings.
• Limited the launch picker on a project's Runs tab to pipelines that carry the project's label.

Pipelines​

• Added a Fusion version selector to the launch form, and limited both version lists to compatible versions.

Studios​

• Added Conda packages for custom container images under More settings.
• Shortened the browser tab title on the Studio details and connect pages to Studio: <name>.

Data Explorer​

• Added the bucket versioning state (Enabled, Suspended, Disabled, or Unknown) to the About data repository dialog for Amazon S3 and Google Cloud Storage data repositories.

Data lineage​

• Changed See in Data Explorer on the run Outputs tab to use the output directory from the run's lineage record.

Credentials​

• Added the Set up Workload Identity Federation in GCP panel to Google Workload Identity credentials created from the compute environment form.

Monitoring​

• Added a Quick launch action to the empty runs list.

Bug fixes​

Pipelines​

• Fixed the Add and Update buttons on the action and pipeline forms staying disabled after a pipeline revision failed to load.

Actions​

• Fixed a paused action that names a deleted pipeline being resumable instead of asking you to point it at a live pipeline.

Compute environments​

• Fixed Azure Batch Forge compute environment creation accepting a malformed container registry credential ID, or more than one.

Access control​

• Fixed selecting a template for a custom role not applying its permissions.

General​

• Fixed the Runs and All runs pages showing no results when opened or reloaded with a search filter in the URL.
• Fixed cancelled runs showing an empty Metrics tab.

Language features​

• Moved the type checker into nf-lang and brought static typing out of preview by @bentsherman in #7656

Google Batch​

• Deprecated Google Batch machine type selection via Cloud Info by @bentsherman in #7677

Plugins​

• Allowed a cache factory to decline a session by @jorgee in #7681

General​

• Added a hint to nextflow log and nextflow clean errors that the commands do not support the cloud cache by @bentsherman in #7676
• Removed a stray git push from the release task by @bentsherman in #7678

Bug fixes​

S3​

• Fixed S3 upload retries by making ByteBufferInputStream resettable by @jorgee in #7577

Google Batch​

• Fixed Google Batch array-child tasks reporting a null machine type by @pditommaso in #7629

Dependencies​

• Bumped Bouncy Castle to 1.85 to fix critical CVEs by @pditommaso in #7658
• Bumped pi-coding-agent to 0.84.4 to fix npm advisories by @pditommaso in #7659
• Bumped slf4j to 2.0.19 by @pditommaso in #7661
• Fixed npm advisories in the docs site dependencies by @pditommaso in #7660
• Bumped nf-agent-pi@0.5.3
• Bumped nf-amazon@3.11.1
• Bumped nf-cloudcache@0.6.2
• Bumped nf-google@1.28.1
• Bumped nf-k8s@1.6.1

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.09.1-edge

Language features​

• Added direct execution of named workflows by @jorgee in #7379
• Added workflow modules by @bentsherman in #7342
• Deprecated the storeDir directive and documented an alternative approach by @bentsherman in #7574
• Documented multiple architectures in the arch directive by @pditommaso in #7622
• Made eval output names stable across runs by @bentsherman in #7575
• Reported a syntax error for an invalid output or emit assignment by @bentsherman in #7547
• Reported an error for an aliased type include by @bentsherman in #7557
• Reported invalid escape sequences at the exact position by @bentsherman in #7608

Configuration​

• Added a directory option to resolve report paths against outputDir by @bentsherman in #7553
• Added the manifest.diagram config option by @pinin4fjords in #7578

Azure​

• Added Azure Compute Gallery image and verification options by @LennyBEL in #7338

Google Batch​

• Sped up submission of Google Batch array jobs by @thalassemia in #6847

Kubernetes​

• Changed the default k8s compute resource type to Job by @bentsherman in #7524

Plugins​

• Added extension points for task caching and object-storage access by @jorgee in #7638
• Removed support for nf-weblog by @bentsherman in #7639

General​

• Added automatic resource labels for any executor by @pditommaso in #7528
• Added a codespell CI check and fixed existing typos by @ewels in #7594
• Added configurable timeouts to SCM API requests by @robsyme in #7536
• Added deep links to migration notes by @bentsherman in #7624
• Added retries for request timeouts in the Tower and Wave HTTP clients by @pditommaso in #7604
• Adopted the shared io.seqera:lib-util-net ProxyConfig for egress proxy handling by @pditommaso in #7587
• Cleaned local task directories in hybrid runs by @bentsherman in #7611
• Cleaned up ADR prose and fixed typos by @bentsherman in #7595
• Cleaned up the 26.08.0-edge changelog by @pditommaso in #7527
• Deduplicated include URI resolution logic by @bentsherman in #7644
• Improved resilience to delayed shared file system visibility by @pditommaso in #7489
• Made NXF_AGENT_MODE an explicit override of agent mode auto-detection by @bentsherman in #7615
• Renamed SCM HTTP client timeouts to the global NXF_HTTPCLIENT_* namespace by @pditommaso in #7567
• Stopped Nextflow submitting queued tasks after the session has aborted by @Mohit-Ak in #7482

Dependencies​

• Aligned the nf-agent test Groovy dependency to 4.0.33 by @pditommaso in #7559
• Fixed Jackson, Netty, and gRPC CVEs via API-scoped dependency constraints by @jorgee in #7329

Bug fixes​

Language features​

• Fixed cloning of typed process outputs to also clone topics by @bentsherman in #7556
• Fixed formatting of legacy type annotations by @bentsherman in #7525

Configuration​

• Fixed a false warning for executor selectors by @bentsherman in #7555
• Fixed the description for process config options with method overloads by @bentsherman in #7442
• Fixed the resume config breaking other CLI commands by @bentsherman in #7581

S3​

• Fixed S3 directory upload skipping symbolic links by @jorgee in #7515
• Fixed workflow output publishing to S3 with the default path by @bentsherman in #7518

Azure​

• Fixed nf-azure plugin tier-1 bugs by @adamrtalbot in #6831

Google Batch​

• Fixed nextflow clean aborting on GCS pseudo-directories by @bentsherman in #7630
• Fixed the env config scope not applied with Google Batch by @bentsherman in #7609
• Fixed Google Batch storing symlinked task outputs as gcsfuse placeholders by @bentsherman in #7612

Plugins​

• Fixed resolution of non-core plugin dependencies from the registry by @bentsherman in #7613

General​

• Fixed a typo in the error message for an invalid LID path by @ewels in #7593
• Fixed the lineage checksum computed in standard mode regardless of label by @bentsherman in #7582
• Fixed a local executor resource accounting race by @pditommaso in #7652
• Fixed the multi-revision test failing locally by @bentsherman in #7541
• Fixed the output index file write to object storage by @bentsherman in #7635
• Improved NFS lock error handling in DefaultCacheStore by @matthdsm in #6997

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.09.0-edge

Monitoring​

• Added a live task execution timeline to the run Tasks tab, showing each task's queued and running time.

Pipelines​

• Extended the Nextflow version list back to 23.03, from a previous floor of 25.10.
• Added the pipeline diagram declared in manifest.diagram to the launchpad pipeline details page.

Studios​

• Added custom Studio icons, shown in the Studios list and on the Studios page.

Co-Scientist​

• Moved the sandbox chip into the chat composer toolbar, beside the context chips.

Data lineage​

• Made data lineage available in organization workspaces for runs on AWS compute environments.
• Added pipeline:<name> and pipelineId:<id> qualifiers to lineage search, matching a pipeline's runs, tasks, and published files.
• Added pipeline names to lineage search results and a See syntax tips link to the search modal.
• Changed data lineage ingestion from SQS polling to SNS notifications and added s3:ListBucket to the lineage IAM policy; manually configured workspaces must be reconfigured.

General​

• Added the reason an action stopped or failed to the Actions list.
• Redesigned the Actions list as a table showing each action's source, status, last event, and creator, with usage details in a dialog.
• Added guided empty states to list pages, naming the next step to take.

Bug fixes​

Co-Scientist​

• Fixed a closed Co-Scientist chat reopening on page refresh.
• Fixed the left navigation staying collapsed after closing the Co-Scientist chat.

Pipelines​

• Fixed GitHub Redeliver not retrying an action trigger whose launch failed.

Studios​

• Fixed Studios SSH authorization rate limiting applying across all sessions instead of per session.

General​

• Fixed labels beyond the first 100 missing from the launch form and label search, and label assignments dropping selections not on the current page.
• Fixed an unstable sort order that repeated or omitted labels when paging through the label list.

• Google Batch and Google Cloud compute environments now require a VPC network when Use private address is enabled, and Google Batch also requires a subnet. Both the compute environment form and the API reject a create or update request that enables private addressing without them. Previously, the environment was accepted and failed later at pipeline launch.

Feature updates and improvements​

Compute environments​

• Added the AWS r9gd instance family to the local NVMe list.
• Removed the Preview badge from Seqera Compute in the compute environment platform list.

Credentials​

• Removed the Beta notice from Azure Entra service principal credentials.
• Added a Set up Workload Identity Federation in GCP panel to Google Workload Identity credentials, listing the values to copy into your Google Cloud project: the OpenID Connect issuer URL, the google.subject mapping that makes Cloud Audit Logs trace activity back to the acting Seqera user, and a recommended attribute condition that pins the workload identity pool to your organization and workspace. The provider, service account email, and token audience fields moved to a Connect the federated identity panel.

Pipelines​

• Added deduplication of repeated GitHub webhook deliveries to an action, preventing a resend from launching the pipeline a second time. A delivery that cannot be recorded now returns 500, and GitHub offers the resend rather than reporting success.
• Added an audit log record for every action firing.
• Added a Created by column to the Actions list.
• Grouped the action form into Details, Trigger, and Target sections. The form omits the Trigger section for GitHub and Seqera sources, which a webhook endpoint drives instead.

Bug fixes​

Compute environments​

• Fixed Kubernetes, EKS, and GKE compute environment validation reporting every connection failure as Unexpected error while processing request, so connection timeouts, refused connections, DNS failures, TLS and certificate errors, and endpoints that are not a Kubernetes API server now each report what failed.
• Fixed GKE cluster discovery reporting a generic 400 for revoked keys, exceeded quotas, and unreachable API endpoints instead of the underlying Google Cloud error.
• Fixed compute environment validation reusing a cached client from a different compute environment, so correcting a field and resubmitting, or updating credentials, now validates against the new values.
• Fixed GKE compute environments that use Workload Identity Federation failing with a 500 when reading run logs or downloading files.
• Fixed Azure Cloud compute environment creation failing with an unexplained error when the credentials cannot read back a resource the forge has just created, so the error now names the resource and the missing read permission.
• Fixed pipeline additions against Tower Agent compute environments intermittently failing with Timeout waiting for command response.

Studios​

• Fixed Studios with mounted data links failing to start on Seqera Compute and on AWS Cloud, Azure Cloud, and Google Cloud compute environments.

General​

• Added support for an authenticating egress proxy for outbound HTTP clients via the shared lib-util-net ProxyConfig by @pditommaso in #1125
• Changed env-var-overridable config properties to use kebab-case keys so they can be set from environment variables by @bebosudo in #1096
• Aligned the build toolchain and runtime to Java 25 while keeping the bytecode target at Java 17 by @cristianrcv in #1077
• Allowed the Claude review agent to submit approving PR reviews by @pditommaso in #1105
• Refreshed the self-install documentation by @christopher-hakkaart in #1106

Dependencies​

• Upgraded org.postgresql:postgresql to 42.7.12 (COMP-2149) by @cristianrcv in #1112
• Upgraded io.netty:netty-bom to 4.2.17.Final (COMP-2376) by @cristianrcv in #1135
• Upgraded the jib plugin to 3.5.4 for Java 25 class file support (COMP-2511) by @munishchouhan in #1136
• Updated node dependency to v24.19.0 by @seqeralabs-renovate[bot] in #1111
• Updated node dependency to v24.20.0 by @seqeralabs-renovate[bot] in #1122
• Updated node dependency to v24.21.0 by @seqeralabs-renovate[bot] in #1134
• Updated actions/checkout action to v4.4.0 by @seqeralabs-renovate[bot] in #1103
• Updated actions/checkout action to v6.1.0 by @seqeralabs-renovate[bot] in #1104
• Updated actions/setup-java action to v4.9.1 by @seqeralabs-renovate[bot] in #1108
• Updated actions/setup-java action to v5.7.0 by @seqeralabs-renovate[bot] in #1109
• Updated aws-actions/amazon-ecr-login action to v2.1.6 by @seqeralabs-renovate[bot] in #1102
• Updated aws-actions/amazon-ecr-login action to v2.1.7 by @seqeralabs-renovate[bot] in #1121
• Updated aws-actions/configure-aws-credentials action to v6.2.3 by @seqeralabs-renovate[bot] in #1110
• Updated aws-actions/configure-aws-credentials action to v6.2.4 by @seqeralabs-renovate[bot] in #1127
• Updated docker/login-action action to v4.6.0 by @seqeralabs-renovate[bot] in #1117
• Updated anthropics/claude-code-action action to v1.0.191 by @seqeralabs-renovate[bot] in #1101
• Updated anthropics/claude-code-action action to v1.0.198 by @seqeralabs-renovate[bot] in #1116
• Updated anthropics/claude-code-action action to v1.0.206 by @seqeralabs-renovate[bot] in #1120
• Updated anthropics/claude-code-action action to v1.0.213 by @seqeralabs-renovate[bot] in #1126
• Updated anthropics/claude-code-action action to v1.0.219 by @seqeralabs-renovate[bot] in #1133

Bug fixes​

Container building​

• Fixed Kubernetes builds being reported as failed on Kubernetes 1.36 and later even though the image was built and pushed (COMP-2368) by @munishchouhan in #1128
• Fixed PATH in the Pixi Docker template so commands resolve in OCI-to-SIF converted images by @munishchouhan in #1131

General​

• Fixed blob transfer jobs reporting success after uploading a 0-byte object by surfacing transfer errors when caching blobs (COMP-2142) by @stefanoboriero in #1100

Full changelog: https://github.com/seqeralabs/wave/compare/v1.37.0...v1.38.0

Secrets​

• Migrated the workspace and user secrets lists to the shared row-card table already used by compute environments and credentials. Edit and Delete moved into the row's kebab menu, and the whole row opens the edit form for users with update permission.

Bug fixes​

Credentials​

• Fixed the inline credentials form in compute environment creation offering fewer options than the Credentials page. AWS supports role-based credentials with external ID generation, Google supports Workload Identity Federation, and Azure uses the same credential fields as that page.
• Fixed the row actions column reserving an empty strip in the compute environment and credentials lists for users without permission to act on the row.
• Fixed the credentials kebab menu opening an empty panel for users without permission to act on the row.

Pipelines​

• Fixed lineage resolution for resumed runs. Each run in a resume chain now shows its own Lineage ID, instead of every run in the chain showing the most recently indexed one. A resumed run shows - while it executes, then its own Lineage ID once it completes.

Compute environments​

• Grouped compute environment selects by platform, listed the workspace primary environment first, and added an in-panel search that matches on name, region, and platform.
• Changed the pre-selected compute environment in launch forms from the alphabetically first environment to the workspace primary environment.

General​

• Removed the count badges from the Runs, Reports, Datasets, and Projects tabs.

Bug fixes​

Credentials​

• Fixed the Password field helper text on the GitLab and Gitea credential forms to state that a personal access token must be entered in both the Access token and Password fields, and that the Password field is required for Nextflow versions before 26.04.

Pipelines​

• Fixed the launch form to preserve the output directory when resuming a run, instead of publishing to the pipeline default.
• Fixed user-typed launch parameters being discarded when a config profile or revision change re-fetched the parameters.
• Fixed schema default parameters being dropped from the submitted parameters after selecting a config profile.
• Fixed nested parameter groups being submitted as null, which disabled Launch with no way to clear the error.

Studios​

• Added filtering to the Studios list, with the selected filters persisted across navigation.

Compute environments​

• Added an OS disk size setting to Azure Cloud compute environments.
• Added an optional Region field to the Azure credential forms, with autocomplete suggestions and free-text entry for regions outside the catalog.

Pipelines​

• Added support for Nextflow v26.08.0-edge.
• Improved launch performance by reducing the number of SCM calls made on the launch path.

Data Explorer​

• Added search to the data link selector in the bucket action form.

Bug fixes​

Compute environments​

• Fixed false "region not found" warnings on Azure credentials by probing Azure Batch in the credential's own region instead of westeurope, and by validating Batch access on the compute environment rather than the credential.
• Fixed compute environment deletion being possible while creation was still in progress.
• Fixed the compute environment details page to redirect to the compute environment list after a deletion.
• Fixed forged Azure Cloud compute environments losing their Nextflow configuration.
• Fixed runs being flagged for attention when a UserData script failed.

Credentials​

• Fixed credential validation to back off and escalate probes that fail permanently, instead of retrying them at the same rate.

Monitoring and observability​

• Fixed the runs toolbar disappearing in loading and empty states.

Credits​

• Fixed the credits report download to show progress and offer a cancel control.

General​

• Fixed the default workspace preference not being cleared correctly.

Language features​

• Added an agent primitive to run AI agents as first-class Nextflow tasks by @pditommaso in #7477
• Added syntax error reporting for an unexpected character in a gstring by @bentsherman in #7353
• Updated the formatter to preserve comments by @ewels in #7346

Configuration​

• Added the seqera.executor.maxCpusPerUser config option by @jonmarti in #7367
• Added the singularity.resourceLimits config option by @bentsherman in #7352
• Split CLI config handling out of ConfigBuilder by @bentsherman in #7373

S3​

• Dropped transient object tags when publishing files to S3 by @pditommaso in #7344

Kubernetes​

• Treated a missing k8s config scope as an empty one by @pditommaso in #7452

Plugins​

• Aligned the Seqera executor maxSpotAttempts and Fusion handling by @pditommaso in #7412
• Bounded Seqera executor scheduler requests with a request timeout by @pditommaso in #7466
• Stopped fabricating a memory request for the Seqera executor by @pditommaso in #7488
• Used the Platform user identity for the Seqera executor userName label by @pditommaso in #7413
• Used registry config for plugin repos by @jorgee in #7180

General​

• Accepted the http requesting protocol for HTTPS proxy CONNECT tunnel authentication by @bentsherman in #7369
• Added --console=plain to Gradle commands in the Makefile by @pditommaso in #7400
• Added componentName to the module view command output by @pditommaso in #7385
• Added a note about AI co-authorship to CLAUDE.md by @bentsherman in #7357
• Added smolvm container engine support by @pditommaso in #7386
• Added support for authenticated forward HTTP/HTTPS proxies across the client stack by @pditommaso in #7331
• Aligned the build to the Java 25 toolchain, targeting Java 17 via --release by @pditommaso in #7370
• Cached the task context for exec tasks by @pditommaso in #7499
• Documented the exit logic in the task wrapper script by @bentsherman in #7290
• Honored COLUMNS when determining ANSI output width by @Eldergenix in #7144
• Pre-pulled the integration tests container by @pditommaso in #7432
• Refactored HubOptions from a trait into a record by @bentsherman in #7372
• Removed dead SpuriousDeps.cmdCloud reflection by @bentsherman in #7371
• Reported the task directives read while the command is rendered by @bentsherman in #7506
• Separated the CLI from the runtime by @bentsherman in #5971
• Updated the CI bucket to s3://nextflow-oss-ci by @bentsherman in #7440
• Used the WireMock self-contained distribution in nf-tower by @pditommaso in #7485
• Used command -v instead of which in the launcher Java lookup by @pditommaso in #7433

Dependencies​

• Bumped Groovy 4.0.33 by @pditommaso in #7429
• Bumped Netty and Apache HttpComponents to patched releases by @pditommaso in #7484
• Updated the docs site dependencies to patched releases by @pditommaso in #7486

Bug fixes​

Language features​

• Fixed a function call in a process directive value with the v2 parser by @bentsherman in #7374
• Fixed lint reporting of excluded paths by @bentsherman in #7354
• Fixed a parameterized type cast in a process body by @bentsherman in #7382
• Fixed a variable incorrectly resolved to an included function name by @bentsherman in #7358

Configuration​

• Fixed config rendering of nested closures by @bentsherman in #7375
• Fixed plugin blocks incorrectly merged in the v2 config parser by @bentsherman in #7350

Azure​

• Fixed detection of Azure virtual directories without a trailing slash by @adamrtalbot in #6428

Wave​

• Fixed a spurious 'Unrecognized config option' warning for wave.build.compression and wave.build.conda by @pditommaso in #7355

General​

• Fixed cache invalidation for module binaries by @FloWuenne in #6914
• Fixed independently-verified findings from a security audit by @ewels in #7503
• Fixed a negative duration error on a short run by @bentsherman in #7351
• Fixed the PBS Pro server status query by @jscgh in #7366
• Fixed the publish mode override when re-publishing an existing file by @bentsherman in #7364
• Fixed a race condition calling workflow onComplete twice by @bentsherman in #7349
• Fixed tests failing on macOS and on hosts with NXF_REGISTRY_TOKEN by @pditommaso in #7457
• Fixed workflow metadata when failOnIgnore is true by @ehsanestaji in #7356
• Guarded the trace log against string formatting errors by @bentsherman in #7347
• Prevented a world-readable race window when storing local secrets by @aknownuser in #7307
• Reverted the stream swap after the redirect to .command.out and .command.err by @tcezard in #7300

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.08.0-edge

Pipelines​

• Updated the bundled Nextflow version to 25.10.6.

Bug fixes​

Data Explorer​

• Fixed the IGV genome viewer failing to load reference genomes in Data Explorer by signing reference genome URLs.
• Fixed IGV genome viewer rendering in Data Explorer, which no longer depends on an externally hosted genome registry.
• Fixed IGV previews of Google Cloud Storage files in Data Explorer returning an authorization error, by signing those URLs with V4 signatures.
• Fixed IGV previews in Data Explorer failing at high zoom levels by signing index URLs independently of their data file URLs.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.

Compute environments​

• Added an optional KMS key ARN to AWS Batch compute environments, so pipeline secrets in AWS Secrets Manager can be encrypted with a customer-managed key instead of the AWS-managed default.

Access control​

• Updated the copy and API URL chip on the Access tokens page.

General​

• Added the page number and search terms to paginated list URLs, so list state survives back-navigation and list URLs are shareable.

Bug fixes​

Compute environments​

• Fixed AWS Cloud head job failures returning an empty log page when the compute environment's IAM instance profile has no role attached.
• Fixed compute environment create and update accepting credentials already recorded as invalid or soft-deleted, and update resetting a credential's status without checking it.
• Fixed exhausted Google Cloud IAM retries to report a meaningful error, and added jitter to the retry backoff.

Data Explorer​

• Fixed tab flicker and a full-width action button in the file browser.
• Fixed IGV reference genome URLs not being signed, and corrected IGV rendering.
• Fixed an error when listing data in workspaces with auto-discovery disabled.

Monitoring and observability​

• Fixed the Runs tab pagination being scoped incorrectly on the project details page.
• Removed the ambiguous "last run" chips from the project header.

Compute environments​

• Added a maxCpusPerUser setting to cap per-user vCPU usage in compute environments.
• Standardized head node instance type helper text across AWS, Azure, and Google Cloud compute environment forms.

Pipelines​

• Added support for Nextflow v25.10.6 and v25.10.7.

General​

• Removed the redundant Projects section from the workspace side navigation.

Bug fixes​

Studios​

• Fixed Studios row card horizontal scrolling when the sidebar is expanded on small screens.

Compute environments​

• Fixed GCP pipeline secrets to be pinned to the compute environment region.
• Fixed GCP IAM policy write conflicts during Forge compute environment creation.

Pipelines​

• Fixed shared pipeline resolution by passing the source workspace ID.

Datasets​

• Fixed dataset queries to exclude deleted runs.

Labels​

• Fixed generic label editing to no longer drop project labels.

Co-Scientist​

• Fixed the Co-Scientist portal web session link.

Compute environments​

• Added support for private Azure Container Registry (ACR) image pulls on Azure Cloud.

Studios​

• Added the ability to display logs for the latest Studio run.
• Added support for applying custom CA configuration to Studios.

Co-Scientist​

• Added the ability to select Co-Scientist conversation history.
• Added page context and screenshot sharing to Co-Scientist chat.

Projects​

• Refined project details workflows.

Credits​

• Added audit log events for the self-serve credit purchase lifecycle.
• Added a root endpoint to cancel purchases stuck in the PENDING state.

General​

• Aligned the key-value date search filter hint with its control.

Bug fixes​

Compute environments​

• Fixed duplicated AWS Batch compute environments carrying a stale ec2KeyPair value by reconciling select values against loaded options.
• Prevented orphaned agent session-expiration tasks from flooding the scheduled task pool.

Studios​

• Fixed flickering of Studio environment variables.

Seqera AI​

• Surfaced the server error reason in Co-Scientist chat.

Security​

• Redacted tokens and secrets from application logs.

General​

• Fixed dark-theme issues from the semantic color token migration.

Access control​

• Enabled IdP claims mapping by default for Enterprise.
• Added an organization allowlist to the IdP claims-mapping feature flag.
• Added a warning when revoking IdP group delegation.
• Added audit logs for SCIM token events.
• Added audit logging for team IdP group changes.
• Added configurable OIDC scopes via TOWER_OIDC_SCOPES.

Compute environments​

• Added bring-your-own networking support for Azure Cloud compute environments.

Bug fixes​

Access control​

• Fixed membership revocation by treating absent IdP group claims as empty.
• Fixed IdP group mapping visibility to refresh when toggling SSO.
• Fixed the IdP reconciler to create UserRole entries for workspace visibility.

Compute environments​

• Fixed end-to-end GCP Cloud compute environment support for Workload Identity Federation (WIF) credentials.
• Fixed GCP Batch error reporting to surface actionable API errors instead of a misleading WIF hint.
• Fixed xpack-google secret resolution by setting GOOGLE_CLOUD_PROJECT on the GCP Batch head job.

Monitoring​

• Fixed an OptimisticLockException when deleting audit log v2 records.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.

Studios​

• Added the ability to mark Studios as favorites, persisted per user.
• Added the ability to cancel Studios stuck in the stopping state.

Pipelines​

• Added a pipeline version ID column to the pipeline versions list.

Data Explorer​

• Added object last-modified timestamps in Data Explorer.

General​

• Aligned global search with the lineage query DSL.

Bug fixes​

Pipelines​

• Fixed pipeline version updates to baseline against the original compute environment.
• Fixed the optimization banner not showing when relaunching a run from a shared pipeline.
• Fixed Nextflow version selection so a version can be chosen when the source launch pinned none.

General​

• Consolidated installation capability toggles under wave.capabilities.* and added a strict environment that disables them all by @pditommaso in #1098
• Added the ability to disable the Wave direct image pull path so callers must use freeze mode by @gavinelder in #1089
• Reduced log noise from expected Platform-connectivity errors in the token watcher by @pditommaso in #1085
• Documented the workflow-bound ephemeral token lifecycle by @pditommaso in #1084

Dependencies​

• Upgraded Micronaut to 4.10.17 to patch jackson-databind (COMP-1957) by @cristianrcv in #1091

Bug fixes​

General​

• Fixed freeze and mirror images being served through the Wave proxy token path by @gavinelder in #1087
• Fixed the Wave release workflow to run only on master and release-* branches (DEVOPS-1531) by @ShahzebMahmood in #1072

Full changelog: https://github.com/seqeralabs/wave/compare/v1.36.0...v1.37.0