> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.itential.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server. # 6.5.1 Platform 6.5.1 is a maintenance release with security updates, bug fixes, and enhancements across FlowAI (Agent Projects, Agent Sessions, Model Registry), Work Center, Studio, Configuration Manager, NSO Service Manager, and Platform infrastructure. It addresses customer-reported issues and improves stability, reliability, and security across the platform. #### Enhancements (23) | Component | Feature | Description | | ----------------------------------- | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Admin Essentials | **Updated Gateway terminology** (ENG-25258) | Updated the Gateway configuration page in Admin Essentials to use current product naming (`Itential Gateway`/`Gateway 5`) instead of `IAG`/`IAG5`. | | Agent Projects | **Stay in Agent Editor after save** (ENG-25870) | When creating a new agent, clicking **Save Agent** or **Save and Run Agent** now keeps you in Agent Editor instead of navigating to the read-only Agent Details view, matching the existing behavior when editing an agent. | | Agent Projects | **Updated Agent Details field styling** (ENG-25901) | Updated the read-only agent details view's field styling to align with the latest design, including removing lock icons and adding a tooltip explaining that changes must be made when editing an agent. | | Agent Projects | **Delete agent from Agent Editor** (ENG-25992) | You can now delete an agent directly from the agent editor, not just from the details page. | | Agent Sessions | **Left-aligned instructions link** (ENG-24952) | The link back to the top of the agent session is now left-aligned with the surrounding content. | | Agent Sessions | **Optional session token count column** (ENG-25050) | Added an optional `Total Output Token` column to the Agent Sessions table, with sorting and filtering support. | | Agent Sessions | **Custom task summary for agent-created tasks** (ENG-25051) | Agent sessions can now set a manual task's task summary, similar to existing workflow behavior, so operators see meaningful context in Work Center instead of a generic task name. | | Agent Sessions | **Smooth animation for tools/reasoning panels** (ENG-25289) | The collapse and expand transition for tools and reasoning in Agent Sessions now animates smoothly with ease-in and ease-out instead of jumping. | | Agent Sessions | **Standardized tool call and reasoning timers** (ENG-25290) | Standardized the time tracker position for tool calls and reasoning in Agent Sessions, and the timer now updates live while a tool call or reasoning step is running. | | Agent Sessions | **Anchored scroll for expanded conclusions** (ENG-25471) | Opening a completed agent session now anchors the expanded view to the top of the agent conclusion instead of opening at the bottom of a long session. | | Agent Sessions | **Faster agent session list performance** (ENG-26330) | Improved Agent Sessions list query performance with index fixes for the default view and the `trigger.source` filter, reducing multi-second load times without changing which sessions are visible. | | Configuration Manager Enterprise | **Draft mode for compliance plans** (ENG-20223) | You can now save a compliance plan as a draft and return to it later. A plan saved as a draft cannot be run until it is finalized. | | Core | **SHA checksum files for release packages** (ENG-16404) | `.sha256` checksum files are now published for the `itential-platform`, `itential-configuration_manager`, and `itential-lifecycle_manager` RPM packages, so you can verify that a downloaded package matches what we published and hasn't been altered or corrupted in transit. | | FlowAI | **OpenInference tracing endpoint** (ENG-24313) | Added an OpenInference endpoint to the FlowAI for execution tracing. | | FlowAI | **Removed Tool deny list** (ENG-25955) | Removed deny list, which previously prevented certain methods from being used as Tools. | | FlowAI | **FlowAI returns created asset ID** (ENG-26008) | FlowAI responses for asynchronous tool executions now include an `artifactId`, the ID of the created asset instance (for example, a work item, job, or session), so the execution engine can link directly to that asset. | | Gateway Manager | **Mosaic design system UI update** (ENG-21262) | Updated Gateway Manager to use Primereact Mosaic components, including the status indicator and tables. | | Gateway Manager, Inventory Manager | **Mosaic left navigation** (ENG-21962) | Inventory Manager and Gateway Manager now use the Mosaic left navigation, so these apps are no longer affected by conflicting styles across pages. | | NSO Service Manager | **Trace-id support for NSO transactions** (ENG-23913) | The NSO adapter now supports trace IDs across JSON-RPC, RESTCONF, and NETCONF request formats, improving end-to-end traceability and troubleshooting between Platform adapter calls and the corresponding NSO transaction. | | Operations Manager, Workflow Engine | **One-click session link from Run Agent task** (ENG-24778) | Added a link from the Run Agent task on canvas that opens the agent session directly in a new tab, following the same pattern as the Child Job task. | | Workflow Engine | **Task worker thread count** (ENG-23342) | You can now configure task worker thread count to control the number of background worker threads available for task processing. For more information, see [Task worker thread count](/itential-platform/studio/optimize-workflow-engine-performance/configure-rate-limiting#task-worker-thread-count) | | Work Center | **Removed standalone mode** (ENG-24850) | Removed Work Center's standalone mode. Work Center now requires integration with other Platform services. | | Work Center | **Collapsed view by default** (ENG-25742) | Work Center now defaults to a collapsed view. Details expand only when you explicitly select them. | #### Bug fixes (78) | Component | Feature | Description | | ------------------------------------------------- | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin Essentials | **403 toasts when deleting adapters on Essentials/Compliance** (ENG-25279) | Fixed an issue where deleting an adapter or integration in Admin Essentials on Essentials or Compliance tiers triggered authorization-error toasts from dependency checks in Studio and JSON Forms, even though the delete succeeded. A generic dependency warning is now shown instead. | | Agent Projects | **End Time column sort fixed** (ENG-25835) | Fixed an issue where sorting the Agent Sessions table by the `End Time` column silently sorted by `Started At` instead. Sorting by `End Time` now correctly requests `endedAt`. | | Agent Projects | **Client-side pagination for agent lists** (ENG-24653) | Added a paginated table footer to the agent list in Agent Projects instead of rendering all agents at once. | | Agent Projects | **Persistent project association labels** (ENG-24820) | Fixed an issue where an asset's project association label (for example, `Admin Workflow (from Test Admin Permission Project)`) was dropped after a page refresh. Assets that belong to a project now consistently show their project association. | | Agent Projects | **Consistent error message styling** (ENG-25015) | Fixed inconsistent styling between permission and not-found error messages in Agent Projects. | | Agent Projects | **Permission tooltips on disabled project settings** (ENG-25030) | Updated the no-permission tooltips and disabled styling for Permissions controls (checkboxes, role radio buttons, and remove/trash icons) in Agent Project Settings, so each disabled control appears dimmed and shows a tooltip explaining why it's disabled. | | Agent Projects | **Accessibility focus borders on input fields** (ENG-25093) | Focus state styling is now applied consistently across input fields in the Agent Projects UI, including Job Viewer and Insights. | | Agent Projects | **Tooltip position near screen edge** (ENG-25116) | Fixed an issue where permission tooltips in Agent Project Settings rendered off-center when a control was too close to the edge of the screen for the tooltip to center correctly. | | Agent Projects | **Decorator dialog title update** (ENG-25436) | Updated the Create Decorator dialog title from "Create a Decorator" to "Create Decorator." | | Agent Projects | **Page jump when editing long prompts** (ENG-25437) | Fixed an issue where clicking and typing near the end of a long agent prompt caused the page to scroll, landing content behind the sticky header. The Agent Editor prompt field now uses a fixed height with a scrollbar for overflow text. | | Agent Projects | **Consistent agent list action tooltips** (ENG-25440) | Fixed inconsistent tooltip styling between the delete agent and clone agent buttons in the agent list Actions column. | | Agent Projects | **Removed non-functional search parameter** (ENG-25585) | Removed the non-functional `Search` query parameter from the list FlowAI projects API. | | Agent Projects | **Persistent save confirmation toast** (ENG-25633) | The "Agent saved." toast shown after clicking **Save and Run Agent** now persists until manually dismissed instead of auto-dismissing after a few seconds. | | Agent Projects | **Fixed-height, non-resizable prompt field** (ENG-25720) | The agent prompt text field is no longer manually resizable. It now uses a fixed height of 24 rows with a scrollbar for overflow text, reducing screen overload. | | Agent Projects | **Remove unauthorized tools from an agent** (ENG-25749) | Fixed an issue where an unauthorized tool referenced by an imported or copied agent couldn't be removed from the Agent Definition in the UI. Removing an unauthorized tool is now tracked locally and persisted correctly when the agent is saved. | | Agent Sessions | **Filter bar shift on expand/collapse** (ENG-25288) | Fixed an issue where the filters in the top right of Agent Sessions shifted position when expanding or collapsing the page. | | Agent Sessions | **Fixed Checkbox and Actions columns** (ENG-25355) | Fixed an issue where the fixed `Checkbox` and `Actions` columns in the Agent Sessions table could be indirectly reordered by moving other columns around them. | | Agent Sessions | **"Today" button in Range date filter** (ENG-25433) | Fixed an issue where clicking **Today** in the End Time Range filter always set the start date, producing an empty date range. The button now correctly sets the range to 12 AM through 11:59 PM of the current day. | | Agent Sessions | **Range filter overflow for End Time** (ENG-25731) | Fixed an issue where selecting the Range filter for End Time opened past the visible page, requiring horizontal scrolling to see the cut-off filter. | | Claim Check Interface | **ClaimCheck GridFS fallback** (ENG-26106) | Fixed an issue where `ClaimCheck.store()` did not fall through to the GridFS streaming path for large payloads when MongoDB returned an `offset is out of bounds` size error, causing an unnecessary failure instead. | | Configuration Manager | **Config Manager crash from bad Agent tool call** (ENG-25486) | Fixed an issue where an invalid Agent tool call could crash Configuration Manager. | | Core | **Adapter import via Swagger UI/API** (ENG-16929) | Fixed an issue where importing an adapter through the `/adapters/import` API, as opposed to the UI, failed because the request properties were not parsed correctly. | | Core | **WebServer input session token leak** (ENG-24070) | Fixed an issue where IAP's WebServer could return the session token in place of a missing input value when an input's schema did not define `schema.properties`. | | Core | **SNMP traps for service stop and crash** (ENG-24868) | Fixed an issue where the `itenProngAppDown` and `itenProngAppCrash` SNMP traps were not sent when the platform stopped gracefully or crashed, under certain conditions. | | FlowAI | **Automatic retry for invalid tool inputs** (ENG-26007) | Fixed an intermittent issue where invalid tool inputs caused some FlowAI tool calls, including `ViewData`, to fail. Inference is now automatically retried up to 3 times after invalid tool inputs. | | FlowAI | **Search and filter for tools in a project** (ENG-25299) | Added the ability to find tools that live inside a studio or agent project through search and type filtering, instead of only being discoverable by expanding their parent project. | | FlowAI | **"Tools can't be reached" for existing IAG5 services** (ENG-25826) | Fixed an issue where Gateway Service tool reference IDs weren't stable, causing broken tool references and a "One or more tools can't be reached" warning for existing IAG5 services even when the agent showed a "Ready to Launch" status. | | FlowAI | **Null description guard for tool transformers** (ENG-25302) | Fixed an issue where tools with no description (transformations, compliance plans, agents, analytic templates, command templates, and JSON forms) stored a `null` description, which caused a 400 error from the Anthropic API and prevented sessions from starting when an agent tried to use the tool. | | Gateway Manager | **Blank GUI in Run Service task** (ENG-26217) | Fixed an issue where selecting certain services within the Run Service task in Studio caused the browser to go blank. | | Gateway Manager, Integrations | **Dynamic API-key retrieval for gateway-routed integrations** (ENG-25488) | Fixed an issue where an Integration using an API key security scheme with dynamic retrieval (`x-itential-dynamic-retrieval`) did not retrieve or refresh the token when the request was routed through a gateway, causing the target to reject the request. | | Golden Configuration | **JSON Compliance Check from Golden Configuration tree** (ENG-25673) | Fixed an issue where running a JSON Compliance check from the Golden Configuration tree reported success but failed to generate the compliance report. | | Integrations | **Authorization roles for imported Integration Models** (ENG-25174) | Fixed an issue where importing an OpenAPI-based Integration Model containing circular schema references in request bodies could silently fail to complete its setup, which prevented the corresponding Authorization role entries from being created. | | itential-utils | **CyberArk CCP secret retrieval timeout** (ENG-24156) | Fixed an issue where incorrectly configured timeouts caused failures when retrieving secrets from CyberArk CCP. | | JSON Forms | **Invalid JSON Form creation via API** (ENG-18045) | Added server-side validation to `POST /json-forms/forms` to prevent creating a JSON Form missing the required `items` property, which previously left the form in an unrecoverable, uneditable state. | | JSON Forms | **JSON form manual task payload timing** (ENG-21716) | Fixed a timing issue where a JSON form manual task could render with stale payload data when a job variable used in the form was updated shortly before the form was displayed. | | JSON Forms | **JSON form stale data across executions** (ENG-26052) | Fixed a bug in the Form Preview dialog where a JSON form with overlapping schema combinations could show stale data, including a previously selected combination option and previously entered data, from an earlier execution when the view was toggled between the form and its submitted data. | | JSON Forms, Platform | **Array table validation after row deletion** (ENG-24301) | Fixed an issue where a JSON Form array/table field retained a validation error after deleting a row with an unresolved dynamic dropdown value, which left the form unsubmittable even though the remaining data was valid. | | JSON Forms, Templates, Transformations, Workflows | **Clone dialog not closing** (ENG-24942) | Fixed an issue where the clone dialog did not close after cloning an asset from the Studio collection view. The collection view now also updates to show the newly cloned document. | | Model Registry | **Column selector icon corrected** (ENG-25123) | Corrected the icon used for the column selector button in the Model Registry profiles table so it matches the Agent Sessions table. | | Model Registry | **Profile form autofill and cursor fixes** (ENG-25125) | Prevented browser autocomplete from filling the `Name` and `API Key` fields in the Create Profile and Edit Profile dialogs, and fixed the `API Key` field showing a pointer cursor instead of a text cursor on hover. | | Model Registry | **Clearer error for invalid model variables** (ENG-25131) | Fixed an issue where saving non-object JSON in the Model Variables field showed an opaque "Failed to update profile" error with no indication that the value must be an object. | | Model Registry | **Affected Agents list sort order** (ENG-25157) | Added a default alphabetical sort order to the Affected Agents list for a model profile in Model Registry. | | Model Registry | **Updated search placeholder text** (ENG-25184) | Updated the search bar placeholder text on the Model Registry list view. | | NSO Service Manager | **NSO adapter nonexistent device cache** (ENG-25784) | Added an `enableNonExistentDeviceCache` configuration option to control the NSO adapter's negative device cache, improving device lookup reliability. This option is enabled by default. | | Operations Manager | **ForEach iteration navigation while job running** (ENG-25145) | Fixed an issue where the job details table could not navigate to a selected forEach iteration's task details while the job was still running. | | Operations Manager | **Quick Form rendering in Operations Manager** (ENG-25409) | Operations Manager now links to Work Center to complete a Quick Form manual task instead of rendering a blank page. | | Operations Manager, Workflow Engine | **View Diff task scroll sync** (ENG-8051) | Fixed a regression in the View Diff task where the two comparison panes scrolled independently instead of staying locked together, making review more difficult. | | Projects | **Component add mode option clarification** (ENG-8275) | Updated the documentation for the `POST /automation-studio/projects/{projectId}/components/add` endpoint to clarify the supported values and behavior of the `mode` option. | | Projects | **Transformations tab visibility in Project Builder** (ENG-9709) | Added a visual indicator for tab overflow in Project Builder, so it's clear when additional tabs, such as Transformations, are available but not currently visible on smaller screens. | | Projects, Transformations | **Horizontal scrollbar in Transformation functions** (ENG-22777) | Fixed an issue where the horizontal scrollbar did not appear within a Transformation function's canvas when the Transformation was created inside a Project. | | Studio | **Search bar Enter key behavior** (ENG-21750) | Fixed an issue where pressing Enter in a left-navigation search box across Platform apps could open an empty suggestions overlay. | | Studio | **Deep Merge false value rendering** (ENG-23288) | Fixed inconsistent rendering of blank, `null`, and empty object values in the Deep Merge task editor. | | Studio | **Hardcoded docs.itential.io links** (ENG-24891) | Removed hardcoded links to `docs.itential.io` and replaced them with `docs.itential.com`. | | Studio | **RBAC on task copy/paste** (ENG-25423) | Fixed an issue where users could copy or paste workflow tasks they didn't have RBAC permission to use via copy, copy selection, or Ctrl+C. Users can no longer copy tasks they lack access to at design time. | | Studio | **Debug menu overlay in new workflows** (ENG-25684) | Fixed an issue in Studio where the debug mode overlay could persist and appear on a newly created or opened workflow. | | Studio | **Workflow undo history exhaustion** (ENG-25746) | Fixed an issue where pressing Cmd+Z after exhausting the current session's undo history could remove existing task connections or reposition tasks unexpectedly, including after a page reload. | | Studio | **Concat task object variable support** (ENG-25893) | The task input type label in Studio now reflects the actual accepted schema type instead of always showing `Any`, preventing job variables of incompatible types, such as Object, from being bound to inputs that don't support them. | | Studio | **Studio crash on malformed workflow** (ENG-25966) | Fixed an issue where opening a workflow with invalid or missing task position data crashed Studio with an `Invalid arguments to Point constructor` error. | | Studio | **Stale Run Service task parameters** (ENG-26030) | Fixed an issue where changing a Gateway Manager service's decorator schema left stale, orphaned parameter keys in a saved `runService` task, which could cause execution to fail when the new decorator disallowed additional properties. | | Templates | **Duplicate requests from Edit dialog** (ENG-24363) | The Edit Details dialog's Save and Cancel buttons are now disabled while a save is in progress, preventing duplicate update requests on Analytic and Command Templates during slow-network saves. | | Transformations | **Date-time modification in Transformation** (ENG-6892) | Fixed an issue where modifying a date-time string in a Transformation, for example using `setUTCMinutes`, did not update the value as expected. | | Transformations | **JST if/else statement limit** (ENG-8449) | Fixed an issue where a JST could not correctly connect a context to more than 10 `if`/`else` conditions. | | Transformations | **Ternary operator space input** (ENG-9375) | Fixed an issue where entering a single space in the ternary operator's `exprIfTrue` or `exprIfFalse` input converted the value to `0` instead of preserving the space. | | Transformations | **Migration script for missing function names** (ENG-9944) | Fixed a regression where importing a Transformation containing a function with a missing `name` property no longer auto-generated the missing name, which caused callback dropdowns to display as `undefined`. | | Transformations | **Broken help link on query object** (ENG-12360) | Fixed a broken documentation link on the Query task's info button in JST Designer. | | Transformations | **Missing \$id validation in JST Designer** (ENG-12870) | Fixed an issue where JST Designer's warning for a missing `$id` did not display correctly, and moved the error message inside the editor to be consistent with other error messages. | | Transformations | **JST function schema type mismatch** (ENG-17988) | Fixed an issue where changing the incoming or outgoing schema of a user function dragged onto a JST canvas did not update or validate existing assignments. Changing a function's parameter type now disconnects any existing assignment and displays an error about the mismatched types. | | Work Center | **Quick Form Complete Task button state** (ENG-25291) | Fixed an issue where the Complete Task button in a Quick Form did not enable or disable immediately as required text fields were filled in or cleared. | | Work Center | **QuickForm with empty parameters** (ENG-26149) | Fixed an issue where launching a QuickForm with no rows to review left the task stuck with no visible content or Complete button. Operators can now complete these tasks normally, and when a task's configuration hides all data columns but rows are still present, the task now displays the action column with a warning message instead of an empty table. | | Work Center | **Overlapping filter dropdowns** (ENG-25849) | Fixed an issue where filter dropdowns in Job Viewer, Work Center, Insights, and Session Manager could remain open and overlap when opened sequentially. | | Work Center | **Work Center service boot failure** (ENG-26021) | Fixed an issue where Work Center Service could fail to start due to an unhandled exception from the provider `PLATFORM_PRONGHORN`, which has now been removed. | | Workflow Engine | **Deeper workflow validation** (ENG-24167) | Workflow validation now catches broken task references left over after a task is deleted, putting the workflow in draft status instead of allowing it to run with missing or incorrect data. | | Workflow Engine | **Manual task status after job completion** (ENG-25152) | Fixed an issue where a reverted job's canvas and task list could continue to display a manual task as running after the job had completed. | | Workflow Engine | **Duplicate taskErrored events** (ENG-25701) | Fixed two issues with the Workflow Engine's `taskErrored` and `taskStarted` system events: a task failure could publish a duplicate `taskErrored` event, and a non-scheduled task that failed due to a failed inline-query decorator never published its corresponding `taskStarted` event. | | Workflows | **Valid workflows not opening after mixed import** (ENG-24310) | Fixed an issue where importing multiple workflows at once, when one or more failed validation, prevented the successfully imported workflows from opening in the editor. | | Workflows | **Task palette unauthorized requests in cloud** (ENG-25351) | Fixed an issue where hovering over a task in the Studio task palette or Swap Task panel triggered an unauthenticated documentation lookup, which returned 403 errors in RBAC-restricted and cloud environments. | | Workflows | **Adapter Model job variable error** (ENG-25528) | Fixed an issue where setting an adapter task's Adapter Model to a job variable and saving the workflow produced a `Cannot find match for input: "Adapter Id"` error. | | Workflows | **Run Service task toggle caching** (ENG-25646) | Fixed an issue where the `runService` task's `Use as Variable` toggle for Gateway Cluster ID and Service reflected the state of another workflow's `runService` task when tasks shared the same task ID, for example after export/import. | #### Security fixes (35) This release includes security updates that address vulnerabilities in third-party packages and platform components. | Component | Feature | Description | | ---------------------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Agent Sessions | **Inefficient algorithmic complexity in js-yaml (Agent Sessions)** (ENG-25748) | Updated the `nestjs-platform` dependency in Agent Sessions to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59869) in `js-yaml`'s YAML merge-key handling. | | Agent Sessions | **Directory traversal in fast-uri** (ENG-25634) | Updated the `fast-uri` dependency in Agent Sessions to resolve a directory traversal vulnerability. | | Agent Sessions | **Resource allocation limit in body-parser** (ENG-25747) | Updated the `body-parser` dependency (via `express`) in Agent Sessions to resolve a vulnerability (CVE-2026-12590) that allowed unbounded request body sizes when the configured `limit` option failed to parse. | | Agent Sessions | **CRLF injection in form-data** (ENG-25798) | Updated the `form-data` dependency in Agent Sessions to resolve a CRLF injection vulnerability. | | Agent Sessions | **Interpretation conflict in fast-uri (update)** (ENG-26022) | Updated the `fast-uri` dependency in Agent Sessions to resolve an additional interpretation conflict vulnerability (CVE-2026-16221) involving backslash handling in hostnames. | | Core | **Cross-site scripting in Core** (ENG-2631) | Resolved a cross-site scripting (XSS) vulnerability in Core by improving the security of authentication failure responses so they can't be rendered as HTML by the browser. | | Core | **Interpretation conflict in fast-uri (Core)** (ENG-25399) | Updated the `fast-uri` dependency in Core to resolve an interpretation conflict vulnerability (CVE-2026-13676) that could allow host-based security policies to be bypassed via internationalized hostnames. | | Core | **Inefficient algorithmic complexity in brace-expansion (Core)** (ENG-25462) | Updated the `brace-expansion` dependency in Core to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149) that could cause excessive CPU consumption via crafted input. | | Core | **Inefficient algorithmic complexity in immutable (Core)** (ENG-25762) | Updated the `immutable` dependency in Core to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59880) in `Immutable.Map` and `Immutable.Set` hash collision handling. | | Core | **Inefficient algorithmic complexity in js-yaml (Core)** (ENG-25764) | Updated the `js-yaml` dependency in Core to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59869) in YAML merge-key handling. | | Core | **Allocation of resources without limits in ws (Core)** (ENG-25971) | Updated the `ws` dependency in Core to resolve an allocation-of-resources-without-limits vulnerability (CVE-2026-62389) that could cause memory exhaustion via incomplete fragmented WebSocket messages. | | Core | **Interpretation conflict in fast-uri (Core, backslash handling)** (ENG-26031) | Updated the `fast-uri` dependency in Core to resolve an interpretation conflict vulnerability (CVE-2026-16221) that could allow host-based validation to be bypassed via a URI containing a literal backslash. | | FlowAI | **Interpretation conflict in fast-uri** (ENG-25650) | Updated the `fast-uri` dependency in FlowAI to resolve a hostname interpretation conflict vulnerability that could allow host-based security checks to be bypassed. | | FlowAI, Model Registry | **Encrypted profile credential storage** (ENG-25554) | Resolved a security issue where FlowAI agent profile credentials (`clientSecret` and `apiKey`, including BYOL credentials passed through the gateway) were stored in MongoDB in clear text instead of encrypted. | | Inventory Manager | **Inventory Manager security cleanup** (ENG-26064) | Resolved medium-severity security vulnerabilities in Inventory Manager. | | Inventory Manager | **Inventory Adapter security cleanup** (ENG-26065) | Resolved medium-severity security vulnerabilities in the Inventory Manager adapter. | | itential-utils | **Inefficient algorithmic complexity in brace-expansion (itential-utils)** (ENG-25647) | Updated the `minimatch` and `brace-expansion` transitive dependencies under `javascript-obfuscator` in itential-utils to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149). | | itential-utils | **Interpretation conflict in fast-uri (itential-utils)** (ENG-25648) | Updated the `fast-uri` dependency in itential-utils to resolve an interpretation conflict vulnerability (CVE-2026-13676). | | NSO Service Manager | **Inefficient algorithmic complexity in brace-expansion (Service Management)** (ENG-25607) | Updated the `brace-expansion` dependency in Service Management (`app-service_management`) to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149). | | NSO Service Manager | **Interpretation conflict in fast-uri (Service Management)** (ENG-25608) | Updated the `fast-uri` dependency in Service Management (`app-service_management`) to resolve an interpretation conflict vulnerability (CVE-2026-13676). | | NSO Service Manager | **CRLF injection in form-data (Service Management)** (ENG-25609) | Updated the `form-data` dependency in Service Management (`app-service_management`) to resolve a CRLF injection vulnerability (CVE-2026-12143). | | NSO Service Manager | **Cross-site scripting in dompurify (Service Management)** (ENG-25610) | Updated the `dompurify` dependency in Service Management (`app-service_management`) to resolve a cross-site scripting vulnerability (CVE-2026-65900) in the `SAFE_FOR_TEMPLATES` function. | | NSO Service Manager | **Inefficient algorithmic complexity in brace-expansion (NSO Manager)** (ENG-25611) | Updated the `brace-expansion` dependency in `app-nso_manager` to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149). | | NSO Service Manager | **Interpretation conflict in fast-uri (NSO Manager)** (ENG-25612) | Updated the `fast-uri` dependency in `app-nso_manager` to resolve an interpretation conflict vulnerability (CVE-2026-13676). | | NSO Service Manager | **CRLF injection in form-data (NSO Manager)** (ENG-25613) | Updated the `form-data` dependency in `app-nso_manager` to resolve a CRLF injection vulnerability (CVE-2026-12143). | | NSO Service Manager | **Cross-site scripting in dompurify (NSO Manager)** (ENG-25614) | Updated the `dompurify` dependency in `app-nso_manager` to resolve a cross-site scripting vulnerability (CVE-2026-65900) in the `IN_PLACE` sanitization process. | | NSO Service Manager | **Inefficient algorithmic complexity in brace-expansion (adapter-nso)** (ENG-25615) | Updated the `brace-expansion` dependency in `adapter-nso` to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-13149). | | NSO Service Manager | **Interpretation conflict in fast-uri (adapter-nso)** (ENG-25616) | Updated the `fast-uri` dependency in `adapter-nso` to resolve an interpretation conflict vulnerability (CVE-2026-13676). | | NSO Service Manager | **CRLF injection in form-data (adapter-nso)** (ENG-25617) | Updated the `form-data` dependency in `adapter-nso` to resolve a CRLF injection vulnerability (CVE-2026-12143). | | Operations Manager | **Blind NoSQL injection in Operations Manager** (ENG-25628) | Resolved a blind NoSQL (MongoDB) injection vulnerability in Operations Manager's triggers and jobs APIs. | | Platform | **Interpretation conflict in fast-uri** (ENG-25649) | Updated the `fast-uri` dependency to resolve an interpretation conflict vulnerability (CVE-2026-13676). | | Work Center | **Uncontrolled recursion in multer** (ENG-25626) | Updated the `multer` dependency in Work Center Service to resolve an uncontrolled recursion vulnerability that could allow CPU and memory exhaustion via deeply nested multipart form field names. | | Work Center | **Inefficient algorithmic complexity in js-yaml (Work Center Service)** (ENG-25735) | Updated the `nestjs-platform` dependency in Work Center Service to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59869) in `js-yaml`'s YAML merge-key handling. | | Work Center | **Inefficient algorithmic complexity in js-yaml (nestjs-platform)** (ENG-25737) | Updated the `js-yaml` dependency in Work Center's `nestjs-platform` library to resolve an inefficient algorithmic complexity vulnerability (CVE-2026-59869). | | Work Center | **Allocation of resources without limits in body-parser (Work Center)** (ENG-25765) | Updated the `axios` dependency and its transitive dependencies (`qs`, `form-data`) in Work Center to resolve a medium-severity denial-of-service vulnerability (CVE-2026-12590) in `body-parser`'s request body size limit handling. No functional or behavioral changes. | #### Component versions | Component | Version | | -------------------------------- | ------- | | Configuration Manager Enterprise | 6.5.1 | | FlowAI | 1.0.1 | | Gateway Manager | 1.1.2 | | Inventory Manager | 1.2.12 | | NSO Service Manager | 6.5.1 |