Made Projects available in organization workspaces to roles with the Projects permission, which existing custom roles don't include.
Added the Project workspace role, for a user who launches a project's pipelines, adds datasets, and reads run reports from the Projects view, without the workspace's Launchpad, Runs, Datasets, Compute, or Settings pages.
Added a Projects permission category to custom roles.
Surfaced proj_ labels as projects in Labels settings.
Limited the launch picker on a project's Runs tab to pipelines that carry the project's label.
Added the bucket versioning state (Enabled, Suspended, Disabled, or Unknown) to the About data repository dialog for Amazon S3 and Google Cloud Storage data repositories.
Made data lineage available in organization workspaces for runs on AWS compute environments.
Added pipeline:<name> and pipelineId:<id> qualifiers to lineage search, matching a pipeline's runs, tasks, and published files.
Added pipeline names to lineage search results and a See syntax tips link to the search modal.
Changed data lineage ingestion from SQS polling to SNS notifications and added s3:ListBucket to the lineage IAM policy; manually configured workspaces must be reconfigured.
Google Batch and Google Cloud compute environments now require a VPC network when Use private address is enabled, and Google Batch also requires a subnet. Both the compute environment form and the API reject a create or update request that enables private addressing without them. Previously, the environment was accepted and failed later at pipeline launch.
Removed the Beta notice from Azure Entra service principal credentials.
Added a Set up Workload Identity Federation in GCP panel to Google Workload Identity credentials, listing the values to copy into your Google Cloud project: the OpenID Connect issuer URL, the google.subject mapping that makes Cloud Audit Logs trace activity back to the acting Seqera user, and a recommended attribute condition that pins the workload identity pool to your organization and workspace. The provider, service account email, and token audience fields moved to a Connect the federated identity panel.
Added deduplication of repeated GitHub webhook deliveries to an action, preventing a resend from launching the pipeline a second time. A delivery that cannot be recorded now returns 500, and GitHub offers the resend rather than reporting success.
Added an audit log record for every action firing.
Added a Created by column to the Actions list.
Grouped the action form into Details, Trigger, and Target sections. The form omits the Trigger section for GitHub and Seqera sources, which a webhook endpoint drives instead.
Fixed Kubernetes, EKS, and GKE compute environment validation reporting every connection failure as Unexpected error while processing request, so connection timeouts, refused connections, DNS failures, TLS and certificate errors, and endpoints that are not a Kubernetes API server now each report what failed.
Fixed GKE cluster discovery reporting a generic 400 for revoked keys, exceeded quotas, and unreachable API endpoints instead of the underlying Google Cloud error.
Fixed compute environment validation reusing a cached client from a different compute environment, so correcting a field and resubmitting, or updating credentials, now validates against the new values.
Fixed GKE compute environments that use Workload Identity Federation failing with a 500 when reading run logs or downloading files.
Fixed Azure Cloud compute environment creation failing with an unexplained error when the credentials cannot read back a resource the forge has just created, so the error now names the resource and the missing read permission.
Fixed pipeline additions against Tower Agent compute environments intermittently failing with Timeout waiting for command response.
Migrated the workspace and user secrets lists to the shared row-card table already used by compute environments and credentials. Edit and Delete moved into the row's kebab menu, and the whole row opens the edit form for users with update permission.
Fixed the inline credentials form in compute environment creation offering fewer options than the Credentials page. AWS supports role-based credentials with external ID generation, Google supports Workload Identity Federation, and Azure uses the same credential fields as that page.
Fixed the row actions column reserving an empty strip in the compute environment and credentials lists for users without permission to act on the row.
Fixed the credentials kebab menu opening an empty panel for users without permission to act on the row.
Fixed lineage resolution for resumed runs. Each run in a resume chain now shows its own Lineage ID, instead of every run in the chain showing the most recently indexed one. A resumed run shows - while it executes, then its own Lineage ID once it completes.
Grouped compute environment selects by platform, listed the workspace primary environment first, and added an in-panel search that matches on name, region, and platform.
Changed the pre-selected compute environment in launch forms from the alphabetically first environment to the workspace primary environment.
Fixed the Password field helper text on the GitLab and Gitea credential forms to state that a personal access token must be entered in both the Access token and Password fields, and that the Password field is required for Nextflow versions before 26.04.
Fixed false "region not found" warnings on Azure credentials by probing Azure Batch in the credential's own region instead of westeurope, and by validating Batch access on the compute environment rather than the credential.
Fixed compute environment deletion being possible while creation was still in progress.
Fixed the compute environment details page to redirect to the compute environment list after a deletion.
Fixed forged Azure Cloud compute environments losing their Nextflow configuration.
Fixed runs being flagged for attention when a UserData script failed.
Added an optional KMS key ARN to AWS Batch compute environments, so pipeline secrets in AWS Secrets Manager can be encrypted with a customer-managed key instead of the AWS-managed default.
Fixed AWS Cloud head job failures returning an empty log page when the compute environment's IAM instance profile has no role attached.
Fixed compute environment create and update accepting credentials already recorded as invalid or soft-deleted, and update resetting a credential's status without checking it.
Fixed exhausted Google Cloud IAM retries to report a meaningful error, and added jitter to the retry backoff.