Feature updates and improvements​

Co-Scientist​

• Replaced the Recent shortcut in the @ mention menu with a Search context field, per-category browsing, paginated results, and status badges.

Compute environments​

• Added Use private address to Azure Batch Forge compute environments, for pool nodes without public IP addresses.
• Added the instance ID and failing command to setup script warnings in the run execution log.

Studios​

• Added a link from a Studio's details page to its compute environment.

Service accounts​

• Added service accounts: non-human identities that belong to an organization and that an agent can run as. Organization owners add, view, edit, and delete them from the new Service accounts tab under Access control.
• Added workspace roles for service accounts.
• Added organization membership rules for service accounts. Each service account counts toward the organization's member limit.
• Marked service accounts in the admin panel. The users list and the Members of organization and Workspace participants tabs show a service account badge and a distinct avatar, and the organization role column reads Service account.

General​

• Redesigned the organization, workspace, and user profile settings pages.

Bug fixes​

Co-Scientist - projects​

• Fixed the project Datasets tab showing unusable dataset actions to Launch users and non-functional buttons in empty projects.
• Fixed relaunching a run from a project's Runs tab returning to the workspace instead of the project.

Pipelines​

• Fixed Launch users being unable to resume runs of pipelines with Pull latest enabled.
• Fixed Azure data repositories selected as a run output directory producing an invalid path.
• Fixed a Fusion version selected in the launch form ignoring the compute environment's Fusion snapshots setting. A selected version with no Fusion snapshots build now fails the launch with an error.

Compute environments​

• Fixed AWS compute environments reporting an unexpected error instead of an access denial when credentials cannot reach the work directory bucket.

Credentials​

• Fixed Bitbucket Server credentials with an access token and no password being rejected when adding a pipeline or opening its launch form.

Data Explorer​

• Fixed the IGV preview losing its reference annotation track, chromosome ideogram, and gene name search.

Data lineage​

• Fixed selecting a task in global search results opening the run's Tasks tab instead of the task.

Secrets​

• Fixed pipeline secrets with underscores in their names being wrongly rejected as duplicates.

General​

• Fixed muted text using the light theme color in the dark theme.
• Fixed muted and raised surfaces being indistinguishable in the dark theme.
• Fixed pipeline and compute environment addresses in the public 12.0.0.0/8 and 172.32.0.0-172.37.255.255 ranges being rejected as private.
• Fixed screen readers not announcing a field's label together with its value.

Feature updates and improvements​

Pipelines​

• Added a timeout for workflow list and count queries. Set the timeout with TOWER_WORKFLOW_LIST_QUERY_TIMEOUT.

Bug fixes​

Compute environments​

• Fixed compute environments with Fusion snapshots enabled silently running without snapshots when a Fusion version was pinned in the launch form. The launch now resolves the snapshots manifest, and fails with an error when the pinned version has none.

Data Explorer​

• Restored the default annotation track in the IGV genome viewer, along with the cytoband ideogram, chromosome aliasing, and gene-name search.

Upgrade notes​

Workflow list queries now time out​

Workflow list and count queries are now bounded by TOWER_WORKFLOW_LIST_QUERY_TIMEOUT, which defaults to 10s. A query that exceeds it is cancelled by the database and the request fails with 503, which protects the connection pool from expensive searches that clients abandon. Set the variable to 0s to disable the timeout.

The License Manager check is disabled on air-gapped installations​

Setting LICENSE_CERTS_AIRGAPPED_BUNDLE now activates the airgapped environment, which disables the periodic License Manager check entirely. Quotas are read from tower.limits.* configuration instead, and GxP features from their own configuration properties. To keep collecting telemetry on an air-gapped installation, write it to disk with TOWER_CRON_USAGE_METRICS_FILE_COLLECTOR_ENABLED and TOWER_CRON_USAGE_METRICS_FILE_COLLECTOR_DIR.

Catalog artifact remap selectors must match exactly​

Selectors in a catalog artifact remap must now match an artifact's selectors exactly. Add snapshots: "true" to target the Fusion snapshots manifest used by compute environments with Fusion snapshots enabled. Existing single-key entries such as selectors: {arch: amd64} continue to resolve to the plain artifact and need no change.

Seqera Platform Enterprise 26.2 adds event-driven Actions, triggered by bucket events, schedules, and pipeline run events. It also adds Co-Scientist agents that run as service accounts, a Projects view, a system-wide Nextflow version selector, and pre-flight validation for credentials and compute environments. Other additions are global search backed by the data lineage query language, customer-managed KMS encryption for pipeline secrets, and route-aware OpenTelemetry tracing. For identity and access management, 26.2 adds OIDC audience enforcement, RFC 8693 token exchange, refresh-token rotation, and more SCIM auditing.

Highlights​

• You can launch a pipeline with a specific Nextflow version, chosen from a system-wide catalog of nf-launcher images. Each compute environment type sets a minimum version. See Compute environments.
• Platform validates credentials and compute environments before launch, on a schedule, and on demand. Broken credentials surface before a run fails. This is enabled by default. See Upgrade notes.
• Actions can be triggered by a bucket event, a schedule, or a pipeline run event, can start an agent instead of a pipeline, and record a trigger history. The three triggers are enabled by default in every workspace.
• Global search, backed by the data lineage query language, searches across workspaces. It is on by default. To turn it off, set TOWER_GLOBAL_SEARCH_ENABLED to false.
• You can encrypt pipeline secrets with a customer-managed AWS Key Management Service (KMS) key, set with TOWER_AWS_SECRETS_KMS_KEY_ID.
• Enterprise deployments now send aggregate entity telemetry with the license check. This is enabled by default. See Upgrade notes.
• Co-Scientist chat is available to every organization in the installation. It is enabled by default once the Co-Scientist agent backend is configured. See Upgrade notes.
• You can configure reusable AI agents per workspace and start one from a run with Trigger agent. Each agent acts as its bound service account. Agents are enabled by default once the Co-Scientist agent backend is configured. See Upgrade notes.
• A Projects view groups a workspace's pipelines, datasets, and runs by project, and launches from a project use an essentials-only launch form. This is enabled by default in every organization workspace. See Upgrade notes.
• The standalone Co-Scientist web interface (provided by the portal-web chart) is removed. Co-Scientist is now part of Seqera Platform. See Upgrade notes.
• A component compatibility catalog records which Nextflow, Fusion, and nf-launcher artifacts work with this Platform version, with deployment-local overrides for private registries. This is enabled by default. See Upgrade notes.
• Platform can stamp the aud claim on the OIDC access tokens it issues and enforce it. Enforcement is off by default and only logs mismatches. See Upgrade notes.
• Studios support private sessions restricted to an allow-list of users, per-user favorites, and a configurable automated stop grace period.
• Route-aware OpenTelemetry tracing is available through the standard OTEL_* environment variables.
• Studios gain a Logs tab that streams a session's process log directly from the compute environment. Logs survive an ungraceful shutdown.
• The compute environment, credentials, and Actions lists are redesigned as row-card tables with attribute chips, grouping, and search.
• From 26.2, Seqera publishes one frontend container image, platform/frontend:<tag>, which runs in unprivileged mode. The -unprivileged tag alias and the -root variant, which ran as the root user, are gone. See Upgrade notes.
• Platform writes audit events only to the v2 schema. This is a breaking change for direct database consumers and ETL jobs that read the v1 tw_audit_log table. Update them to the v2 schema before you upgrade. See Upgrade notes.

Feature updates and improvements​

Container building​

• Added the conda/micromamba:v3 template with layered Conda builds by @pditommaso in #1146
• Renamed the conda/micromamba:v3 template to conda/micromamba:v2-fast by @pditommaso in #1151

Singularity​

• Added multi-architecture Singularity (SIF) build support by @pditommaso in #1140

General​

• Documented multi-platform container builds by @munishchouhan in #1137

Dependencies​

• Upgraded Micronaut platform to 4.10.19 (COMP-2257) by @cristianrcv in #1142
• Upgraded bouncycastle to 1.85 (COMP-2551) by @cristianrcv in #1141
• Upgraded typespec to 1.16.0 (COMP-2378) by @cristianrcv in #1143
• Upgraded lib-pairing to 1.1.1 to accept large pairing messages by @arnaualcazar in #1144
• Updated aws-actions/configure-aws-credentials action to v6.3.0 by @seqeralabs-renovate[bot] in #1139
• Updated anthropics/claude-code-action action to v1.0.231 by @seqeralabs-renovate[bot] in #1138

Full changelog: https://github.com/seqeralabs/wave/compare/v1.38.0...v1.39.0

Fusion v2.6.10 fixes a regression introduced in v2.6.9 that failed successful snapshot tasks with exit code 174. If you run Fusion Snapshots on v2.6.9, upgrade.

How to pin this version​

fusion {
  enabled = true
  containerConfigUrl = 'https://fusionfs.seqera.io/releases/v2.6.10-amd64.json'
}

Bug fixes​

Fusion Snapshots​

• Fixed successful snapshot tasks failing with exit code 174 when the task deleted a temporary file it still had open.

Upgrade notes​

• Drop-in replacement for v2.6.9. No configuration changes required.
• If you pinned snapshot tasks to v2.6.8 to avoid the exit code 174 failures, you can unpin them.

Fusion v2.6.9 fixes three ways a healthy task could be lost in NFS service mode or on EC2: failed output uploads reported as success, a short EC2 instance metadata outage blocking S3 access, and remote I/O errors on a task relaunched from a clean start.

How to pin this version​

fusion {
  enabled = true
  containerConfigUrl = 'https://fusionfs.seqera.io/releases/v2.6.9-amd64.json'
}

Bug fixes​

NFS service mode​

• Fixed a task exiting with 0 when the final upload of its work directory failed. Fusion now retries the upload for about five minutes, then exits with 174. See Fusion exit codes.
• Fixed a Remote I/O error when a task relaunched from a clean start recreated a path the clean had removed.

AWS​

• Fixed a short gap in the EC2 instance metadata service leaving Fusion with anonymous S3 access for the rest of the task. If the work directory is still unreachable, Fusion exits with 173, which Intelligent Compute relocates to another host.

Dependencies​

• Updated dependencies and CI.

Upgrade notes​

• Drop-in replacement for v2.6.8. No configuration changes required.
• In NFS service mode, a task whose command succeeded but whose final work directory upload failed now exits with 174 instead of 0. A task whose command failed keeps its original exit code.
• On EC2, a host with no instance profile keeps using anonymous S3 access. If a host has an instance profile but no reachable instance metadata service and should use anonymous access, set AWS_EC2_METADATA_DISABLED=true.

Bug fixes​

Language features​

• Fixed formatter dropping the main: label when onComplete: or onError: is present by @ewels in #7346

General​

• Fixed BitbucketServerRepositoryProvider ignoring the token field by @jorgee in #7120

Dependencies​

• Bumped nf-amazon@3.4.6 by @pditommaso in 30cfdc47

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v25.10.8

Feature updates and improvements​

Co-Scientist​

• Made Projects available in organization workspaces to roles with the Projects permission, which existing custom roles don't include.
• Added the Project workspace role, for a user who launches a project's pipelines, adds datasets, and reads run reports from the Projects view, without the workspace's Launchpad, Runs, Datasets, Compute, or Settings pages.
• Added a Projects permission category to custom roles.
• Surfaced proj_ labels as projects in Labels settings.
• Limited the launch picker on a project's Runs tab to pipelines that carry the project's label.

Pipelines​

• Added a Fusion version selector to the launch form, and limited both version lists to compatible versions.

Studios​

• Added Conda packages for custom container images under More settings.
• Shortened the browser tab title on the Studio details and connect pages to Studio: <name>.

Data Explorer​

• Added the bucket versioning state (Enabled, Suspended, Disabled, or Unknown) to the About data repository dialog for Amazon S3 and Google Cloud Storage data repositories.

Data lineage​

• Changed See in Data Explorer on the run Outputs tab to use the output directory from the run's lineage record.

Credentials​

• Added the Set up Workload Identity Federation in GCP panel to Google Workload Identity credentials created from the compute environment form.

Monitoring​

• Added a Quick launch action to the empty runs list.

Bug fixes​

Pipelines​

• Fixed the Add and Update buttons on the action and pipeline forms staying disabled after a pipeline revision failed to load.

Actions​

• Fixed a paused action that names a deleted pipeline being resumable instead of asking you to point it at a live pipeline.

Compute environments​

• Fixed Azure Batch Forge compute environment creation accepting a malformed container registry credential ID, or more than one.

Access control​

• Fixed selecting a template for a custom role not applying its permissions.

General​

• Fixed the Runs and All runs pages showing no results when opened or reloaded with a search filter in the URL.
• Fixed cancelled runs showing an empty Metrics tab.

Fusion v2.6.8 lets Intelligent Compute relaunch a task from a clean start after a failed snapshot restore, and fixes stale file handle errors on idle files in NFS service mode.

How to pin this version​

fusion {
  enabled = true
  containerConfigUrl = 'https://fusionfs.seqera.io/releases/v2.6.8-amd64.json'
}

Feature updates and improvements​

Fusion Snapshots​

• Added FUSION_SNAPSHOT_CLEAN_START. When it is set, Fusion cleans the work directory and removes leftover snapshot data before the task starts, so a task whose snapshot restore failed can be relaunched from scratch in the same work directory. Intelligent Compute sets it when it relaunches such a task.

Bug fixes​

NFS service mode​

• Fixed files and directories left idle during a task failing with a stale file handle error.

General​

• Fixed a spurious Check available filesystem space error printed every time a mount shut down.

Dependencies​

• Updated test and CI tooling and dependencies.

Upgrade notes​

• Drop-in replacement for v2.6.7. No configuration changes required.
• FUSION_SNAPSHOT_CLEAN_START applies to NFS service mode only, and you do not need to set it yourself. Without it, Fusion behaves as in v2.6.7.
• File handles in NFS service mode stay valid while the Fusion mount keeps running. They do not survive a restart of the mount.

Feature updates and improvements​

Language features​

• Moved the type checker into nf-lang and brought static typing out of preview by @bentsherman in #7656

Google Batch​

• Deprecated Google Batch machine type selection via Cloud Info by @bentsherman in #7677

Plugins​

• Allowed a cache factory to decline a session by @jorgee in #7681

General​

• Added a hint to nextflow log and nextflow clean errors that the commands do not support the cloud cache by @bentsherman in #7676
• Removed a stray git push from the release task by @bentsherman in #7678

Bug fixes​

S3​

• Fixed S3 upload retries by making ByteBufferInputStream resettable by @jorgee in #7577

Google Batch​

• Fixed Google Batch array-child tasks reporting a null machine type by @pditommaso in #7629

Dependencies​

• Bumped Bouncy Castle to 1.85 to fix critical CVEs by @pditommaso in #7658
• Bumped pi-coding-agent to 0.84.4 to fix npm advisories by @pditommaso in #7659
• Bumped slf4j to 2.0.19 by @pditommaso in #7661
• Fixed npm advisories in the docs site dependencies by @pditommaso in #7660
• Bumped nf-agent-pi@0.5.3
• Bumped nf-amazon@3.11.1
• Bumped nf-cloudcache@0.6.2
• Bumped nf-google@1.28.1
• Bumped nf-k8s@1.6.1

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.09.1-edge