Skip to main content

v0.6.1

Released October 3, 2026. Supported until April 3, 2027.

v0.6.1 ships 2 security updates and 3 bug fixes. The most severe security issue cleared is CRITICAL.

About these release notes

A fully detailed version of these release notes (including artifact versions) is included in the Admin Console.

The full release notes are opened from the Admin Console, as described in Check the management plane version.

Upgrade and rollback​

  • The release carries no breaking change, and no operator action is required before upgrading.
  • The upgrade rolls through without dropping traffic.
  • Rollback to v0.6.0 is unconditional.

Security updates​

Consoles​

The management-plane application runtime includes Next.js 16.3.6, which fixes GHSA-vcvr-r3jv-pc5j.

The Admin Console runtime image refresh replaces vulnerable OpenSSL packages with the patched Chainguard runtime, fixing CVE-2026-14456, CVE-2026-45447, and CVE-2026-54876.

Bug fixes​

Consoles​

The project list no longer fails when the user directory denies member lookup; it shows the user count as unavailable and exposes no personally identifiable information from the directory.

The user directory is restricted to super administrators.

Admin Console audit logs load through Agent Router's authorization path, so authorized administrators can view the audit-log table and stats.

Known issues​

Gateway​

A data plane keeps enforcing project isolation after its last project gateway is deleted (the v0.3.0 last-gateway fix), but that memory lives in the gateway process. A data plane restarted while it has no project gateways comes back open, accepting any API key on any hostname for any project, until a gateway is configured again. A data plane whose last project gateway has been removed should not be restarted before a replacement gateway is in place, or should be taken out of service until one is.

Management plane API​

Corporate OpenID Connect (OIDC) sign-in with Microsoft Entra ID fails in three cases: when the identity provider's JSON Web Key Set (JWKS) omits its optional algorithm field, when the provider is registered with the tenant Authority URL as the issuer (the setup in Configure SSO), and for users whose token carries no email attribute. Fixed in v0.6.2.