This release adds 8 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+4 more
ReleasePort's take
Light signalGit sync now enforces file‑size limits to stop oversized uploads. Admins must restrict repository management and block credential reuse for security.
Why it matters: Patch v1.19.0 immediately; the enforced size limit prevents corruption, while admin‑only repo access blocks credential reuse attacks.
Summary
AI summaryGit sync file size limits now respected, preventing oversized uploads.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Git repository management restricted to admins, credential reuse blocked Git repository management restricted to admins, credential reuse blocked Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Projects can be archived for organization Projects can be archived for organization Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
mTLS authentication available for edge agents mTLS authentication available for edge agents Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Automated docker API re-negotiation improves compatibility Automated docker API re-negotiation improves compatibility Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Multi-file swarm git sync with host path mapping Multi-file swarm git sync with host path mapping Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Node label management separates system and user labels Node label management separates system and user labels Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
arcane-cli supports update channels and self-updates arcane-cli supports update channels and self-updates Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Pull usage and limits displayed when applicable Pull usage and limits displayed when applicable Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Redesigned updater center for arcane self updates Redesigned updater center for arcane self updates Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Low |
Enable project archiving functionality Enable project archiving functionality Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Feature | Low |
Allow force removal of images Allow force removal of images Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Performance | Medium |
Table rendering performance improved with many rows Table rendering performance improved with many rows Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Performance | Medium |
Use in‑memory Trivy DB on 32‑bit architectures to avoid mmap failures Use in‑memory Trivy DB on 32‑bit architectures to avoid mmap failures Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Performance | Medium |
Cache environment overrides and settings in memory, removing double loading Cache environment overrides and settings in memory, removing double loading Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Bugfix | Medium |
Compose self-redeploy blocked when arcane manages itself Compose self-redeploy blocked when arcane manages itself Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Default secret and config UID/GID set prevents parsing errors Default secret and config UID/GID set prevents parsing errors Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Project status resolves using effective compose project name Project status resolves using effective compose project name Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Buildkit uses image exporter for builds Buildkit uses image exporter for builds Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Real image records not cleared for ref-aliases Real image records not cleared for ref-aliases Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Include files created with new projects Include files created with new projects Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Docker config directory set prevents configuration errors Docker config directory set prevents configuration errors Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Excluded containers skipped in auto-update pull Excluded containers skipped in auto-update pull Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
slog-gin panic prevented on tunneled requests prevents crashes slog-gin panic prevented on tunneled requests prevents crashes Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Correct checksum used for updater ensures integrity verification Correct checksum used for updater ensures integrity verification Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Git sync file size limitations properly enforced prevents corruption Git sync file size limitations properly enforced prevents corruption Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
arcane-cli replaced on PATH during update ensures proper execution arcane-cli replaced on PATH during update ensures proper execution Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Mobile image update checks resolved with correct ID Mobile image update checks resolved with correct ID Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Swarm scale mode and replicas functionality fixed Swarm scale mode and replicas functionality fixed Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
In-memory trivy database used on 32-bit architectures prevents failures In-memory trivy database used on 32-bit architectures prevents failures Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Named volume sources properly scoped to stack Named volume sources properly scoped to stack Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Agent API token fallbacks and guards implemented Agent API token fallbacks and guards implemented Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Always use dockerhub credentials if available Always use dockerhub credentials if available Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
mTLS allowed when TLS not managed by arcane mTLS allowed when TLS not managed by arcane Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
registry.gitlab.com added to trustedAuthDelegations registry.gitlab.com added to trustedAuthDelegations Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Enforce Git sync file size limitations correctly Enforce Git sync file size limitations correctly Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Bugfix | Medium |
Scope named volume sources to the owning stack in service mounts Scope named volume sources to the owning stack in service mounts Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Bugfix | Medium |
Handle directory‑sync file paths that Docker previously created as directories Handle directory‑sync file paths that Docker previously created as directories Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Bugfix | Low |
Fix misaligned card overview headers on layout Fix misaligned card overview headers on layout Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Bugfix | Low |
Show loading state immediately for swarm service actions Show loading state immediately for swarm service actions Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Bugfix | Low |
Remove duplicate verification of mTLS certificates Remove duplicate verification of mTLS certificates Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
| Bugfix | Low |
Accept non‑color values for accent color setting Accept non‑color values for accent color setting Source: granite4.1:30b@2026-05-24-audit Confidence: low |
— |
Full changelog
New features
- show pull usage and limits (if applicable) (#2458 by @kmendell)
- automated docker api re-negotiation (#2471 by @kmendell)
- implement node label management with system and user label separation (#2479 by @SplinterHead)
- allow mTLS auth for edge agents (#2116 by @kmendell)
- implement multi-file swarm git sync and host path mapping (#2457 by @SplinterHead)
- ability to archive projects (#2519 by @kmendell)
- redesigned updater center for arcane self updates (#2558 by @kmendell)
CLI - New features
- arcane-cli update channels and self-update (#2517 by @kmendell)
Bug fixes
- git sync file size limitations not being respected (#2427 by @kmendell)
- default secret and config UID/GID to "0" to prevent parsing errors (#2422 by @SplinterHead)
- resolve project status using effective compose project name (#2198 by @GiulioSavini)
- block compose self-redeploy when arcane manages itself (#2404 by @GiulioSavini)
- scope named volume sources to stack in service mounts (#2430 by @GiulioSavini)
- card overview headers missaligned on layout(5fd35e4 by @kmendell)
- include files not created with new projects (#2463 by @kmendell)
- tables are laggy when lots of rows are rendered (#2468 by @kmendell)
- buildkit not using the image exporter (#2469 by @kmendell)
- swarm scale mode and replicas fixes (#2470 by @kmendell)
- prevent slog-gin panic on tunneled requests (#2467 by @lohrbini)
- don't clear real image records when marking ref-aliases up to date (#2474 by @GiulioSavini)
- restrict git repository management to admins and block credential reuse on URL changes (#2504 by @kmendell)
- show loading state immediately on swarm service actions (#2475 by @GiulioSavini)
- allow mtls when tls is not managed by arcane (#2503 by @kmendell)
- skip excluded containers when collecting images for auto-update pull (#2473 by @GiulioSavini)
- remove double verification of mTLS certificates (#2505 by @kmendell)
- image update checks fail on mobile due to incorrect id (#2506 by @kmendell)
- add registry.gitlab.com to trustedAuthDelegations (#2507 by @kmendell)
- accent color allows non color values to be saved (#2513 by @kmendell)
- handle directory-sync file paths that Docker previously created as directories (#2508 by @kmendell)
- improve login form autofill compatibility (#2514 by @MikeO7)
- use in-memory trivy DB backend on 32-bit architectures to prevent mmap allocation failure (#2529 by @kmendell)
- allow force removing of images (#2530 by @kmendell)
- set docker config directory to avoid errors around config.json (#2557 by @kmendell)
- remove double loading of env overides and settings, use in memory cache instead (#2562 by @kmendell)
- show compose-labeled image updates in project updates (#2563 by @kmendell)
- gotify token decryption missing from auto heal and prune notifications(e28c4a4 by @kmendell)
- regenerate apikey dialog shows behind sheet(b7a8ec7 by @kmendell)
- always use dockerhub credentials if available (#2567 by @kmendell)
- agent api token fallbacks and guards (#2568 by @kmendell)
CLI - Bug fixes
- use correct checksum for updater(d645d4d by @kmendell)
- replace the arcane-cli located on PATH during update(a1e0c4a by @kmendell)
Dependencies
- bump github.com/moby/moby/client from 0.4.0 to 0.4.1 in /types (#2441 by @dependabot[bot])
- bump github.com/docker/cli from 29.4.0+incompatible to 29.4.1+incompatible in /backend (#2443 by @dependabot[bot])
- bump github.com/getarcaneapp/arcane/types from 1.17.4 to 1.18.1 in /cli (#2444 by @dependabot[bot])
- bump github.com/moby/moby/api from 1.54.1 to 1.54.2 in /backend (#2445 by @dependabot[bot])
- bump prettier from 3.8.2 to 3.8.3 (#2449 by @dependabot[bot])
- migrate to pnpm v11.0.0(4a94c5c by @kmendell)
- upgrade frontend dependencies (#2461 by @kmendell)
- bump github.com/docker/cli from 29.4.1+incompatible to 29.4.2+incompatible in /backend (#2490 by @dependabot[bot])
- bump github.com/samber/slog-gin from 1.21.0 to 1.21.1 in /backend (#2481 by @dependabot[bot])
- bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.57.1 to 1.57.2 in /backend (#2489 by @dependabot[bot])
- bump @tanstack/svelte-query from 6.1.24 to 6.1.26 (#2485 by @dependabot[bot])
- bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.15 to 1.19.16 in /backend (#2487 by @dependabot[bot])
- bump ghcr.io/devcontainers/features/node from 1.7.1 to 2.0.0 (#2480 by @dependabot[bot])
- bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 in /backend (#2482 by @dependabot[bot])
- bump pnpm to 11.0.6(0e47b40 by @kmendell)
- bump github.com/aws/aws-sdk-go-v2/config from 1.32.16 to 1.32.17 in /backend (#2536 by @dependabot[bot])
- bump github.com/shirou/gopsutil/v4 from 4.26.3 to 4.26.4 in /backend (#2542 by @dependabot[bot])
- bump golang.org/x/text from 0.36.0 to 0.37.0 in /backend (#2540 by @dependabot[bot])
- bump github.com/charmbracelet/fang from 0.4.4 to 1.0.0 in /cli (#2532 by @dependabot[bot])
- bump @codemirror/view from 6.41.1 to 6.42.1 (#2535 by @dependabot[bot])
- bump golang.org/x/time from 0.14.0 to 0.15.0 in /backend (#2538 by @dependabot[bot])
- bump react-dom from 19.2.5 to 19.2.6 (#2541 by @dependabot[bot])
- bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 in /backend in the go_modules group across 1 directory (#2544 by @dependabot[bot])
- bump sigstore/cosign-installer from 4.1.1 to 4.1.2 (#2533 by @dependabot[bot])
- bump react-email from 6.0.1 to 6.1.1 (#2537 by @dependabot[bot])
- bump golang.org/x/net from 0.53.0 to 0.54.0 in /backend (#2539 by @dependabot[bot])
- bump pnpm to v11.0.9(5f43b7e by @kmendell)
- remove react-email/preview-server(685f9c3 by @kmendell)
- bump github.com/nicholas-fedor/shoutrrr from 0.14.3 to 0.15.0 in /backend (#2547 by @dependabot[bot])
- bump github.com/docker/cli from 29.4.2+incompatible to 29.4.3+incompatible in /backend (#2548 by @dependabot[bot])
- bump golang.org/x/mod from 0.35.0 to 0.36.0 in /backend (#2550 by @dependabot[bot])
- bump google.golang.org/grpc from 1.80.0 to 1.81.0 in /backend (#2551 by @dependabot[bot])
- bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 in /backend (#2553 by @dependabot[bot])
- bump @tanstack/svelte-query from 6.1.26 to 6.1.28 (#2549 by @dependabot[bot])
Other
- make login screen padding more centered (#2429 by @kmendell)
- sidebar grouping and edge cases (#2188 by @cabaucom376)
- consolidate helpers and dedupe boilerplate code (#2437 by @kmendell)
- split ws_handler and skip pagination counts when not needed (#2440 by @kmendell)
- cleanup frontend with more universal components (#2459 by @kmendell)
- frontend ui cleanup and fixes (#2515 by @kmendell)
- use charm logging instead of logrus for arcane-cli (#2518 by @kmendell)
- move job bootstrap into job service (#2523 by @kmendell)
- streamline remote environment logic (#2524 by @kmendell)
Full Changelog: https://github.com/getarcaneapp/arcane/compare/v1.18.1...v1.19.0
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]