Feature updates and improvements
Access control
- Allowed root administrators to remove a workspace participant from the admin panel without being blocked by agent-binding guards, and clarified the service account confirmation copy in the admin flows.
- Added support for resource-bound OAuth tokens for the Seqera MCP client, so a token issued for the MCP server can be exchanged for a separate Seqera Platform access token when one is needed.
Agents
- Renamed the agent Pause and Resume actions to Disable and Enable to match what they do: a disabled agent cannot be run manually or by an action.
Co-Scientist
- Added a Stop session control to a running, workspace-owned agent session in the Co-Scientist chat drawer, which cancels the session on the server.
- Added arrow-key navigation into and out of categories in the
@-mention panel, made Escape close the panel from the root menu, and stopped long descriptions truncating mention names.
- Improved chat responsiveness on the Launchpad and Runs pages by skipping page screenshot capture, which could stall the first keystroke.
Pipelines
- Added Nextflow 25.10.8 and 26.09.1-edge to the version catalog, making them selectable in the launch form and the API.
General
- Added a warning to a required resource select when the list is empty and the user cannot create a resource, explaining who to ask instead of leaving an unusable field.
Bug fixes
Access control
- Fixed a blank Edit page in the admin Workspaces list when another workspace in the organization matched the target workspace's name, full name, or description.
Agents
- Fixed agent actions failing without explanation when their GitHub App credential had been deleted. The reason now appears in the trigger history and the action is paused.
- Fixed an agent's Details tab omitting the bound GitHub App credential. The credential name now appears, and reads No longer available when the binding no longer resolves.
- Fixed the search box on the Agents page losing focus while results loaded, which dropped any keystrokes typed in the meantime.
- Fixed the Agents page showing an empty state when the agent list failed to load. It now shows a load error with a Retry action, and keeps the Add button and search visible.
Credentials
- Restricted uploaded Google credentials to service account keys, rejecting other credential types and requiring the token URI to be an HTTPS endpoint on a Google-owned host.
Monitoring and observability
- Fixed
fusion_throughput_bytes telemetry reporting only the first day of the current month. It now covers every day of the month so far.
Pipelines
- Fixed text-based reports (TXT, JSON, YAML, Markdown, and scripts) rendering as a blank page when opened in a new tab from the report preview dialog.
- Fixed clicking a task in global search results opening the run's Tasks tab instead of the task itself.
- Updated the bundled Nextflow version to 25.10.8, so a Bitbucket Server credential that holds a token but no password now authenticates instead of failing with "Not authorized".
- Clarified the API error and the Actions form messages shown for a pipeline that belongs to a shared workspace, which an action cannot watch or launch.
- Fixed every compute environment being disabled when resuming a run whose work directory differed from the compute environment's only by a trailing slash.
- Fixed the Fusion throughput quota never blocking a launch, because the check looked for a single monthly usage row instead of totalling the organization's daily rows for the current month.
- Fixed editing a pipeline's Seqera Platform schema failing with an "already exists" error when the pasted schema declared an
$id.
- Stopped the backend compiling a pipeline repository's
nextflow.config when reading its params, profiles, and manifest. The file is now only parsed, with no change to the values shown.
Projects
- Hid the dataset actions on the Datasets tab from roles that lack the dataset label permissions they require, which previously failed with a
403 error or left a new dataset outside the project.
- Fixed relaunching a run from a project's Runs tab returning to the workspace Runs page instead of the project's own tab.
- Fixed the Edit project page omitting project pipelines whose names sorted beyond the first 50 pipelines in the workspace.
Service accounts
- Fixed the Workspace access card for a service account with no workspaces, which showed a full empty state instead of collapsing to a header with its action.
- Blocked removing a service account from a workspace, or deleting it at organization level, while it is still bound to active agents. The request now returns a conflict error that lists the agents and workspaces involved.
General
- Constrained outbound Source Code Management requests to permitted destinations, re-validating the target on every redirect, refusing HTTPS-to-HTTP downgrades, and dropping request headers on cross-origin hops. Credential base URLs are now validated when credentials are created or updated.
- Fixed design system form controls not repainting after their value was set without emitting a change event.
- Fixed empty states rendering their title as a second top-level heading, which gave screen readers an incorrect page outline.
Upgrade notes
Outbound request protection starts in warn mode
Requests to a destination a user supplies — Source Code Management reads for pipeline schema and configuration files and Studios repositories, and credentials base-URL validation — can now be restricted from reaching private or link-local addresses. TOWER_SSRF_PROTECTION_MODE defaults to warn, which logs what would be refused but still allows it. Before switching to enforce, search the backend logs for SSRF protection warnings: each one names the refused host and the setting that would permit it.
Use TOWER_SSRF_PROTECTION_ALLOWED_HOSTS for destinations that must stay reachable in private address space, such as a self-hosted GitHub Enterprise, GitLab, Bitbucket Server, or Gitea, or an S3-compatible store named by a credential base URL. It accepts hostnames, wildcard hostnames, CIDR blocks, and the keywords loopback, private, link-local, and *. Every server configured under tower.scm.providers is allowed implicitly, except loopback hosts, which must be listed explicitly. Address an internal Git server by hostname and allowlist that hostname — a pipeline repository URL that names a private IP address directly is rejected before this setting is consulted.
Uploaded Google credentials must be service account keys
Google credentials are now parsed as service account keys only. A credential of any other type, including external_account, is rejected, and a token_uri must be an HTTPS endpoint on a Google-owned host. Review any stored Google credential that was not created from a service account key.
Source Code Management file reads have a size limit
TOWER_HTTP_URL_FETCH_MAX_BODY_BYTES sets the largest response body buffered on a full-body read of a Source Code Management schema or configuration file, and defaults to 10485760 (10 MiB). An oversized file is rejected rather than truncated, so it reports as oversized instead of as a parse error. This replaces Nextflow's NXF_GIT_RESPONSE_MAX_LENGTH for Source Code Management file reads. The ranged preview reads used by dataset import are unaffected.
Agent backend calls are bounded by new timeouts
TOWER_AGENT_BACKEND_TIMEOUT sets the per-request connect and read timeout for agent backend calls and defaults to 5s. TOWER_AGENT_BACKEND_BINDING_CHECK_BUDGET caps the per-workspace agent-binding fan-out performed when deleting a service account at organization level, and defaults to 15s; once the budget is exceeded, the deletion fails.
Resource-bound tokens apply only to the Seqera MCP client
TOWER_OIDC_MCP_CLIENT_NAME names the dynamic client registration client_name of the Seqera MCP server, and defaults to seqera-mcp. Resource-bound tokens and the user access-token exchange apply to this client alone; the resource parameter sent by any other client is ignored.
Security updates
- CVE-2026-91403: Added the eight compromised eMudhra intermediate certificate authorities to the JDK blocked certificate list. Their private keys were leaked, so anyone holding them could issue a certificate for any domain. The default trust store does not anchor these chains, so this is defence in depth for installations that use a custom trust store built from a full CA bundle.