v2.0.3
MinorPublished on September 22, 2026
Changelog
🚀 Features
core
77dddbcaccess-control extension point for MCP tools
worker
c6a04d9basic authentication for the worker-to-controller gRPC channel
📘 Subtasks
core
9e4f167delete the translation keys nothing renders (#19512), closes #19512
deps
c633d3dbump kotlp to 0.1.6 for process.network.io
version
269e8d0update to version '2.0.3'
🐛 Bug Fixes
ai
14b47bfrefresh the editor and retire the Apply button once a copilot draft is applied (#19713), closes #19713adc5a04icon-only AI Copilot button in the top bar utility cluster (#19538), closes #19538
assets
90d6104make namespace and type freely editable (#19575) (#19716), closes #19575 #19716c661c3caccept expressions and free-form types on output assets in the flow editor (#19311), closes #19311
core
c38fb09reclaim namespace file objects when a file is deleted1958e66recursively match simple dotfilesccabca4retry plugin catalog load instead of caching a failure for 1h (#19061) (#19592), closes #19061 #195927ac0f73prevent NPE in UnsetVariables when a nested key's parent is missing (#19480), closes #1948015e1f68logo invisible on the /api rapidoc page (#19577), closes #1 #19577 #262829e7cc59sanitize the messages of a bulk failure toast instead of rendering them raw (#19557), closes #195572353ce9let the english-copy rule accept the tenant wizard terms the model keeps in english (#19553), closes #19553d2461d5in-app links report one utm source and campaign convention (#19533), closes #19533
execution
257307ea deleted flow should not be executable via an old revision
executions
6bb33bagenerate the cURL command with 24-hour TIME inputs (#19710), closes #19367 #19710
flows
db90e60show the revision deletion toast message only once (#19663), closes #19638 #19663
plugins
780cad5load external plugins before controller and indexer start (#19612) (#19631), closes #19612 #19631
system
8fb051aa pre-2.0 worker job entry no longer stalls service liveness coordination (#19676), closes #19676
topology
8df64a9execution graph fills the viewport and zooms out far enough to fit a large flow (#19694), closes #19685 #19686 #196942c88d0fimage export covers the whole graph, not just the visible viewport (#19464), closes #15393 #19464
triggers
922cb9fpreserve the runtime disable when a trigger definition is updated, closes #19672
worker
0fa4f7cemit the trigger result at the timeout instead of waiting for the evaluation, closes #17445
🏭 Tests
core
3373afecover nested dotfile downloads
🛠 Build
core
b1b6736stage the design-system locale files only where the design system exists (#19584), closes #19582 #195840fc7a1atranslate the oldest supported release branch with the bot and keep the shared gate identical across branches (#19581), closes #195816aecc18tell a pull request from a fork how to get its translations generated (#19561), closes #19559 #19561d188925ask the authors of the english changes to review the bot translation pull request (#19552), closes #19550 #19552132377erun the unused translation key rule in the OSS jobs with the EE sources checked out (#19515), closes #19513 #19515
deps
77ffab5declare sass-embedded so vite never falls back to js sass (#19504), closes #19504
platform
c5d8ae5bump io.kestra:kotlp to 0.1.5 (#19545), closes #19545
📝 Documentation
tests
f07356esay the OSS translation jobs check the EE sources out for the unused-key rule (#19516), closes #19513 #19516
Credits
- Credit to @manus-pi for security advisory GHSA-hrr4-xg8h-5p6f
- Credit to @sondt99 for security advisory GHSA-xh2h-59mw-8qr2
Contributors
We'd like to thank the following people for their contributions: Aradhya Sharma, Barthélémy Ledoux, Claude Sonnet 5, Dhruv Shah, Florian Hussonnois, François Delbrayelle, GitHub, Loïc Mathieu, Malay Dewangan, Miloš Paunović, Nicolas K., Piyush Bhaskar, Steven Meek, brian-mulier-p, github-actions[bot], nKwiatkowski