Feature updates and improvements
Pipelines
- Added a Quick launch button to the empty state of the Runs page. Next to it, Launch pipeline appears when the workspace has pipelines, and Add pipeline when it has none.
Data Explorer
- Added a Create folder action next to Upload in Data Explorer, which creates an empty folder in an AWS S3, Azure Blob Storage, or Google Cloud Storage data repository, including from the data picker in the launch form. Like uploading, it requires write permission on the data repository, so the Launch and View roles cannot create folders, and it is not available for public data repositories.
- Added a
.azure_blob_dir marker file to each folder created in an Azure Blob Storage data repository, the convention Nextflow uses to keep an empty directory. The marker appears in the folder listing, and is not written when the folder already has content.
Bug fixes
Studios
- Fixed long names in the Studios list being truncated at a fixed width even when the column had room to show them.
Credentials
- Restricted the Azure Batch and Azure Storage account names in Azure credentials to 3 to 24 letters and digits, matching Azure's account naming rules. A name with other characters, such as URL delimiters, is rejected when the credential is created or updated, before it can be used to build an Azure endpoint URL.
Pipelines
- Fixed the Recently updated sort on the Launchpad ignoring pipelines beyond the first 60. Pipelines are now sorted on the server.
- Fixed the run details page continuing to show the previous run after you opened another run in the same workspace, for example from global search.
- Fixed adding a pipeline failing when its optional repository avatar could not be fetched. A failed avatar lookup no longer blocks pipeline creation.
- Fixed a repository request refused by outbound request protection failing with an unexpected error. The error now names the repository and why it could not be accessed.
- Fixed requests to a Git server configured with an
http:// address that redirects to HTTPS losing their credentials. A redirect from HTTP to HTTPS on the same host and default ports now keeps the request headers.
- Updated the bundled Nextflow version to 25.10.9, which keeps a Bitbucket API token out of the repository clone URL.
Data Explorer
- Fixed file lineage in the file preview failing with
503 errors, or missing resumed runs, when it looked up the run that produced a file. The run is now resolved through lineage search, and its link opens the run in its own workspace.
- Aligned the error for an AWS S3 bucket that the credentials cannot access with the other providers: Data Explorer now reports that the credentials for the bucket are missing or not valid. Other S3 bucket validation failures now return a bad request error instead of the raw S3 error.
- Fixed a zero-byte
name/ folder placeholder blob in an Azure Blob Storage data repository appearing as a blank file inside the folder it represents. It is now omitted from that folder's listing and shown as a folder elsewhere.
General
- Extended outbound request protection to every Source Code Management request for pipelines and Studios, adding branch and tag listings, repository validation, and avatar lookups to file reads. Each redirect hop is re-checked, and credentials such as a GitLab
PRIVATE-TOKEN header are no longer forwarded to another host on a redirect.
- Hardened the bucket event endpoint used by pipeline actions. Every SNS message is now signature-verified, and a subscription confirmation must match the stored topic and is completed with the SNS
ConfirmSubscription API instead of by fetching a URL from the message.
- Restricted the Wave pairing proxy to the Seqera Platform API endpoint. A request to any other scheme, host, port, or path is refused with
403.
- Fixed the pagination of the resource selection dialog in projects being cut off on taller screens.
Upgrade notes
No database migrations are included in this release.
Outbound request protection covers every Source Code Management request
TOWER_SSRF_PROTECTION_MODE and TOWER_SSRF_PROTECTION_ALLOWED_HOSTS now govern every Source Code Management request for pipelines and Studios: file reads, branch and tag listings, repository validation, and avatar lookups, each re-checked at every redirect hop. If a Git server resolves to a private address and is not allowed by TOWER_SSRF_PROTECTION_ALLOWED_HOSTS, the default warn mode now logs SSRF protection warnings for these requests too. Search the backend logs again before switching to enforce.
TOWER_HTTP_URL_FETCH_MAX_BODY_BYTES now caps the response of each of these requests, not only file reads, and replaces Nextflow's NXF_GIT_RESPONSE_MAX_LENGTH for all of them. TOWER_HTTP_URL_FETCH_TIMEOUT and TOWER_HTTP_URL_FETCH_CALL_TIMEOUT apply to them as well.
Azure credentials must use valid account names
Azure credentials are rejected on create or update when the Batch or Storage account name is not 3 to 24 letters and digits. A stored credential with such a name now fails validation, so review existing Azure credentials before you upgrade.
API changes
The published API contract moves from 1.228.0 to 1.229.0. It adds CreateDataLinkFolder, declares the nullable compute environment fields listed under bug fixes, and declares the account name pattern for the Azure credential batchName and storageName fields. Regenerate any OpenAPI-derived clients against 1.229.0.
Security updates
- CVE-2026-91403, CVE-2026-113470: Updated the Java base image for the backend and database migration containers to Amazon Corretto 25.0.5, which blocks the compromised eMudhra intermediate certificates and removes the affected emSign roots.
- CVE-2023-54404 (GHSA-mrhx-c7xc-m3w5): Updated the
zod dependency of the web frontend to 4.6.7. Versions before 4.6.6 could exhaust memory validating an oversized array, even when the schema set a maximum length.