Auth fix + path‑traversal guard + Pebble upgrade
Release history
kestra releases
Event Driven Orchestration & Scheduling Platform for Mission Critical Applications
All releases
81 shown
Path traversal prevention + FileSerde IO methods + Version bump
- Migrate kestra and kestra-starter charts to GCS
Full changelog
Changelog
🚀 Features
helm
- 6ecd54b migrate kestra and kestra-starter charts to GCS
📘 Subtasks
version
- ff74250 update to version '1.3.16'
🐛 Bug Fixes
core
- b8f91a7 prevent output autocompletion from including current task id (#15087), closes #14223 #15087
- fa02f74 preserve null in map rendering for Pebble templates (#15783), closes #15783
- 5ab3688 strip null bytes from JSONB values before PostgreSQL insert (#15647), closes #15647
flows
- aa4e2d8 autocomplete reliability in pebble blocks
tasks
- 97ead1b inject outputFiles into Pebble context in CommandsWrapper.render() (#15758), closes #13765 #15758
trigger
- a05e53b default Flow tenantId in TriggerEvaluationExtension
🛠 Build
- 0465cfb pass SLACK_RELEASES_WEBHOOK_URL to docker publish workflow
Contributors
We'd like to thank the following people for their contributions:
François Delbrayelle, Malay Dewangan, Miloš Paunović, Ravi kumar, Roman Acevedo, YannC, YannC., brian-mulier-p, brian.mulier, github-actions[bot]
Minor fixes and improvements.
Full changelog
design-system version 0.1.4 published to npm.\n\n To install, run: npm install @kestra-io/[email protected]
Minor fixes and improvements.
Full changelog
Kestra Open-Source Edition Changes
Changelog
📘 Subtasks
version
- 46ce3b2 update to version '0.23.32'
Contributors
We'd like to thank the following people for their contributions:
github-actions[bot]
Kestra Enterprise Edition Changes
Changelog
📘 Subtasks
version
- 1232d38 update to version '0.23.32'
🐛 Bug Fixes
migration
- c985c3c write full document to ES so taskRunList tenantId is persisted (#7600), closes #7600
Contributors
We'd like to thank the following people for their contributions:
GitHub, Nicolas K., github-actions[bot], nKwiatkowski
Minor fixes and improvements.
Full changelog
Kestra Open-Source Edition Changes
Changelog
📘 Subtasks
version
- 0caf291 update to version '0.24.20'
🐛 Bug Fixes
cli
- 96ac496 update tenant migration
tests
- 45b4f6c replace sampletestfile.com with embedded server in HTTP tests (#15646), closes #15646
Contributors
We'd like to thank the following people for their contributions:
Florian Hussonnois, YannC, github-actions[bot], nKwiatkowski
Kestra Enterprise Edition Changes
Changelog
📘 Subtasks
version
- ec59a44 update to version '0.24.20'
🐛 Bug Fixes
cli
- 36f9e81 update tenant migration
Contributors
We'd like to thank the following people for their contributions:
github-actions[bot], nKwiatkowski
Minor fixes and improvements.
Full changelog
Kestra Open-Source Edition Changes
Changelog
📘 Subtasks
version
- e2ab2c4 update to version '0.23.31'
🐛 Bug Fixes
cli
- 53505e1 update tenant migration
tests
- 910bff5 replace sampletestfile.com with embedded server in HTTP tests (#15646), closes #15646
Contributors
We'd like to thank the following people for their contributions:
Florian Hussonnois, YannC, github-actions[bot], nKwiatkowski
Kestra Enterprise Edition Changes
Changelog
📘 Subtasks
version
- 1663033 update to version '0.23.31'
🐛 Bug Fixes
cli
- 22f7b08 update tenant migration
Contributors
We'd like to thank the following people for their contributions:
github-actions[bot], nKwiatkowski
Minor fixes and improvements.
Full changelog
Kestra Open-Source Edition Changes
Changelog
📘 Subtasks
version
- 9198969 update to version '1.0.39'
🐛 Bug Fixes
core
- 92e2428 compilation issue
- cf4aa16 make deprecated taskDefaults work again
tenants
- 198324e update taskRunList tenantId during tenant migration (#15748), closes #15748
worker
- 3c0fb93 route null or blank workerGroup.key to the default worker group
- 72623da stop the thread cleanly in case of thread timeout (#15685), closes #15685
Contributors
We'd like to thank the following people for their contributions:
Florian Hussonnois, Loïc Mathieu, Nicolas K., github-actions[bot], nKwiatkowski, yuri1969
Kestra Enterprise Edition Changes
Changelog
📘 Subtasks
dev-tools
- 298917b improve OSS worktree pairing — scan all branches, enforce pairing before run (#7533), closes #7533
version
- a422f9b update to version '1.0.39'
🐛 Bug Fixes
iam
- 342c0bb wrap text at underscores in groups view (#7522), closes #7503 #7522
tenants
- bf024e7 update taskRunList tenantId during migration and prevent executor crash (#7585), closes #7585
Contributors
We'd like to thank the following people for their contributions:
GitHub, MilosPaunovic, Miloš Paunović, Nicolas K., brian-mulier-p, github-actions[bot], nKwiatkowski
- Tenant migration CLI updates
Full changelog
Kestra Open-Source Edition Changes
Changelog
🚀 Features
cli
- 7da77c1 update tenant migration
📘 Subtasks
version
- 6da4d7b update to version '1.2.17'
🐛 Bug Fixes
tenants
- b70cc9a update taskRunList tenantId during tenant migration (#15748), closes #15748
worker
- 3ed4d1f stop the thread cleanly in case of thread timeout (#15685), closes #15685
Contributors
We'd like to thank the following people for their contributions:
Nicolas K., github-actions[bot], nKwiatkowski
Kestra Enterprise Edition Changes
Changelog
🚀 Features
cli
- 64b285c update tenant migration
📘 Subtasks
version
- 8b6d0ec update to version '1.2.17'
🐛 Bug Fixes
tenants
- 024df3c update taskRunList tenantId during migration and prevent executor crash (#7585), closes #7585
Contributors
We'd like to thank the following people for their contributions:
Nicolas K., github-actions[bot], nKwiatkowski
- Inject outputFiles map into Pebble context for script tasks
- Mark secret properties as secret type
- Embedded support
Full changelog
Changelog
🚀 Features
tasks
- 4806e40 inject outputFiles map into Pebble context for script tasks (#15725), closes #13765 #15725
global
- 5c61802 mark secret properties as secret type
- c8766a7 embedded support (#15361) (#15739), closes #15361 #15739
📘 Subtasks
cicd
- 3eea1c5 remove trunk.io
version
- f2bdb0b update to version '1.3.15'
global
- f3707e2 regenerate OpenAPI spec
🐛 Bug Fixes
ai
- d19083f propagate provider base URL through chat model listener chain
core
- 83d683b make deprecated taskDefaults work again
flows
- c47fb9f fix OpenAPI spec generation for FlowController endpoints (#15482), closes #15482
tenants
- 1365045 update taskRunList tenantId during tenant migration (#15748), closes #15748
worker
- 1f62619 route null or blank workerGroup.key to the default worker group
- 8f64b18 stop the thread cleanly in case of thread timeout (#15685), closes #15685
Contributors
We'd like to thank the following people for their contributions:
Bart Ledoux, Florian Hussonnois, François Delbrayelle, GitHub, Loïc Mathieu, Ludovic DEHON, Malay Dewangan, Nicolas K., Roman Acevedo, YannC, brian-mulier-p, brian.mulier, github-actions[bot], nKwiatkowski, yuri1969
Minor fixes and improvements.
Full changelog
Kestra Open-Source Edition Changes
Changelog
📘 Subtasks
version
- a708df4 update to version '1.0.38'
- b37d920 update to version '1.0.37'
- cad7252 update to version '1.0.38'
🐛 Bug Fixes
core
- 1f21a15 compilation issue
system
- 77f96fc reemit realtime trigger
tests
- ac255a7 replace sampletestfile.com + annotate flaky tests for v1.0.x release (#15658), closes #15658
global
- af76631 replay mark non-terminated sibling attempts as killed
🏭 Tests
core
- 89aceeb cover replay restart state normalization
Contributors
We'd like to thank the following people for their contributions:
GitHub, Loïc Mathieu, Nicolas K., github-actions[bot], lizi3, nKwiatkowski
Kestra Enterprise Edition Changes
Changelog
📘 Subtasks
version
- 3ac4b08 update to version '1.0.38'
Contributors
We'd like to thank the following people for their contributions:
github-actions[bot]
Minor fixes and improvements.
Full changelog
Kestra Open-Source Edition Changes
Changelog
📘 Subtasks
version
- 10029cc update to version '1.2.16'
Contributors
We'd like to thank the following people for their contributions:
github-actions[bot]
Kestra Enterprise Edition Changes
Changelog
📘 Subtasks
version
- 4307b89 update to version '1.2.16'
🐛 Bug Fixes
iam
- 697f0bb prevent scheduled license check from silently dying on exception (#7511), closes #7511
Contributors
We'd like to thank the following people for their contributions:
GitHub, YannC, github-actions[bot]
- Patched vulnerable frontend dependencies (#15661)
Full changelog
Changelog
📘 Subtasks
version
- c759696 update to version '1.3.14'
🐛 Bug Fixes
system
- 1557cec reemit realtime trigger
- e25aa6d possible NoSuchElement exception after migratoin to 1.2, closes #15620
ui
- 8c98785 resolve monaco editor autocomplete instability (#15213), closes #15213
🛠 Build
deps
- ce9c040 bump vulnerable frontend dependencies (#15661), closes #15661
Contributors
We'd like to thank the following people for their contributions:
Barthélémy Ledoux, GitHub, Loïc Mathieu, Miloš Paunović, Piyush Bhaskar, Sumit Shandillya, github-actions[bot]
Minor fixes and improvements.
Full changelog
Kestra Open-Source Edition Changes
Changelog
📘 Subtasks
version
- 38f923a update to version '1.2.15'
- 45a34fb update to version '1.2.14'
- 4ff322e update to version '1.2.15'
🐛 Bug Fixes
executions
- 1d70f62 fix long scrolls on outputs page (#15596), closes #15596
tests
- 2d95729 replace sampletestfile.com with embedded server in HTTP tests (#15681), closes #15681
Contributors
We'd like to thank the following people for their contributions:
GitHub, Karel Krýda, Nicolas K., github-actions[bot], nKwiatkowski
Kestra Enterprise Edition Changes
Changelog
📘 Subtasks
version
- a1628be update to version '1.2.15'
Contributors
We'd like to thank the following people for their contributions:
github-actions[bot]
Minor fixes and improvements.
Full changelog
Kestra Open-Source Edition Changes
Changelog
📘 Subtasks
version
- 2113738 update to version '1.3.13'
🐛 Bug Fixes
core
- 5fcc5da warn instead of reject on plain-text secret properties (#15529), closes #15529
tests
- 3adf767 replace sampletestfile.com with embedded server in HTTP tests (#15646), closes #15646
🛠 Build
deps
- d6ec7db use netty-codec-multipart-vintage again, closes #9743
- 6444c93 bump io.micronaut.platform:micronaut-platform
Contributors
We'd like to thank the following people for their contributions:
Loïc Mathieu, Malay Dewangan, YannC, YannC., github-actions[bot], yuri1969
Kestra Enterprise Edition Changes
Changelog
📘 Subtasks
version
- bbe04cc update to version '1.3.13'
🐛 Bug Fixes
ai
- d6404aa gate App/Test copilot on isAiApiKeyConfigured in v1.3.x (#7490), closes #7490
apps
- e31f782 mark apps/view route as anonymous to unblock public apps, closes #5966 #7138
Contributors
We'd like to thank the following people for their contributions:
GitHub, Roman Acevedo, brian-mulier-p, github-actions[bot]
- Secret property type support with @PluginProperty validation in No-Code editor
- PebbleUtil for improved Pebble delimiter handling
- Plugin access through JsonSchemaGenerator
Full changelog
Kestra Open-Source Edition Changes
Changelog
🚀 Features
core
- 224dc82 add secret property type to No-Code editor
- b2fb151 add @PluginProperty(secret = true) with validation for it
- 5bda668 add PebbleUtil and replace hardcoded Pebble delimiters
system
- 23d5b3a provide access to plugins to the JsonSchemaGenerator
📘 Subtasks
version
- 94c753b update to version '1.3.12'
🐛 Bug Fixes
ai
- d24382e add isAiApiKeyConfigured flag to config and gate App/Test copilot (#15636), closes #15636
- 4786211 graceful degradation when api.kestra.io is unreachable (#15627), closes #15602 #15627
core
- 7755469 prevent ClassCastException in decodeInput for already-decrypted secret inputs (#15633), closes #15633
tests
- b125164 replace sampletestfile.com with embedded server in HTTP tests (#15646), closes #15646
global
- 15b287b replay mark non-terminated sibling attempts as killed
🏭 Tests
core
- 2be236e cover replay restart state normalization
Contributors
We'd like to thank the following people for their contributions:
GitHub, Loïc Mathieu, YannC, YannC., brian-mulier-p, brian.mulier, github-actions[bot], lizi3
Kestra Enterprise Edition Changes
Changelog
📘 Subtasks
version
- 6028d45 update to version '1.3.12'
🐛 Bug Fixes
ai
- 179c92b guard EE AiController cast to EeAiServiceInterface (#7489), closes #7458 #7489
- d6659e9 graceful degradation when api.kestra.io is unreachable (#7480), closes #7480 #15602
executions
- f8fd539 add EE override for execution-level eval endpoint with ACL checks (#7190) (#7477), closes #7186 #7190 #7477
tests
- 3a3219c remove tests using unavailable @LoadUser/@LoadUsers annotations on releases/v1.3.x
- 3891d3b Reapply "fix(executions): add EE override for execution-level eval endpoint with ACL checks (#7190) (#7477)", closes #7190 #7477
- 2ef1498 Revert "fix(executions): add EE override for execution-level eval endpoint with ACL checks (#7190) (#7477)", closes #7190 #7477
Contributors
We'd like to thank the following people for their contributions:
GitHub, YannC., brian-mulier-p, github-actions[bot]
Minor fixes and improvements.
Full changelog
Kestra Open-Source Edition Changes
Changelog
📘 Subtasks
version
- b75a14e update to version '1.3.11'
🐛 Bug Fixes
trigger
- 482456c init RunContext with flow/trigger and default tenantId
worker
- a2c0e6e prevent duplicate SubflowExecutionEnd delivery across executor JVMs
global
- 4f15503 update inputs handling (#15592), closes #15592
- 4b47002 correct libs copilot version
Contributors
We'd like to thank the following people for their contributions:
Florian Hussonnois, Malay Dewangan, Piyush Bhaskar, YannC., github-actions[bot]
Kestra Enterprise Edition Changes
Changelog
📘 Subtasks
version
- 4784ffa update to version '1.3.11'
🐛 Bug Fixes
ui
- 1dc6f49 correctly open binding drawer for SA, closes #7454
Contributors
We'd like to thank the following people for their contributions:
YannC., github-actions[bot]
- Tenant migration data exclusion capability
- Docker socket validation with fail-fast detection
- Add kestra.ai.enabled property to disable AI copilot entirely
- Respect timeWindow.default for filter time range
Fixed CLI ignoring namespace revision files during metadata migration, and prevented a race condition between database migrations and edition persistence in JDBC. Also increased test timeout for TaskObject stories UI interaction.
- Tenant migration now supports excluding specific data from the migration process.
- TenantMigrationCommand now supports a parameter to prevent queue migration — review migration scripts if you rely on default queue migration behavior during tenant migrations.
- A new option to exclude specific data from tenant migration is available; verify migration configurations to ensure desired data is included.
- Allow excluding specific data from tenant migration (both OSS and Enterprise editions).
Fixed a bug that prevented calling RunContext.services().additionalServices() on the Worker.
- Redirect logo click to welcome page
- Propagate additional request metadata to AI service
- New endpoint to list flows with deprecated tasks
- Option to exclude specific data during tenant migration
- Fixed SQL injection vulnerabilities in label search
Improved NPM build scripts for better type checking across development workflows and CI pipelines.
- Fixed SQL injection vulnerabilities in label search
Fixed issue preventing applications from being made publicly accessible through the sharing dialog.
Version update release with no significant functional changes.
- New welcome page with revamped onboarding
- Pebble filters and functions autocompletion
- Atomic namespace file operations
Fixed replay and restart operations to properly handle non-terminated parallel sibling tasks during execution recovery.
Improved label styling in UI and fixed URL restoration when filtering executions by foreach status to prevent unwanted navigation.
Added parameter to tenant migration command to prevent queue migration during schema updates, and improved CI pipeline with type checking integration.
Fixed polling trigger context rehydration to ensure environment variables are properly available during polling operations.
- Exposed Kestra services to run context
- Fixed queue polling performance
Added missing file preview options to execution overview UI for improved visibility into job outputs and artifacts.
Fixed field naming consistency by converting camel case to snake case for database ordering operations to ensure proper data sorting and filtering.
Resolved queue listener shutdown issues and fixed field ordering in database queries for improved reliability during deployment cycles.
Fixed Gantt view duration calculations, corrected execution loop restart and replay with max duration limits, updated worker queued duration metrics, and hid deprecated fields while maintaining backward compatibility.
- Disabled raw HTML in execution markdown preview
Fixed horizontal scrolling in cascader UI components for large option sets, improved SSE connection loss notifications, and added backward-compatible CANCELLED type for Exit tasks alongside deprecated CANCELED variant.
Added type checking integration in CI pipeline and fixed Kafka namespace metadata sorting for proper execution ordering in tenant-based deployments.
- AI Copilot for TestSuite, Dashboard, and Apps
- Kill switches for execution control
- HTTP digest authentication
Reactivated proxy test in CI test suite for improved test coverage.
Improved asset management with proper topology updates during asset operations, enhanced URI validation using standard Java URI parsing, fixed Docker runner task registration timing, and corrected UI permission checks.
Changed plugin categories to CORE classification and fixed asset translation key-value pair handling for proper localization support.
Improved webhook failure handling to properly report 500 status when wait is enabled and state fails, and injected local worker environments into RunContext for proper variable availability.
Improved webhook handling to fail with 500 response when wait is true and state is failed, fixed OS-incompatible file path issues, enhanced RunContext initialization, and corrected KV pagination accounting.
Improved ForEach task output display to show iteration values, fixed PDF file preview in outputs tab, corrected independent column scrolling behavior, and fixed KV pagination to account for total row count.
- Kill switches to prevent state changes for active tasks
- Improved schema properties layout
Improved error reporting in CLI flow synchronization command and fixed tenant migration script filtering for database schema compatibility.
- New update from flow source CLI command
- Upgrade to Gradle 9.3.0
- Avoid refreshing token when impersonated
- Improved error messages from FlowSynch command
- Human task validation in apps
- Improved CLI error messages
- This release involved a rollback to 0.22.39 and a redo of the 0.22.40 release. Dependency upgrades (Gradle 9.3.0, Lombok 1.18.42, com.gradleup.shadow 8.3.9) that appeared in earlier 0.22.40 attempts were reverted and are not present in the final release.
- Improved error message from FlowSynch CLI command
- Honor JDK proxies when installing plugins
- Decrypt secret output when used with on resume for pause task
- Handle flow update errors with syncFromSource command
- Handle flow update errors with syncFromSource CLI command
- Increase flow ID size to 150 for LM
- Honor JDK proxies when installing plugins
- Made PostHog tracking reliable and non-blocking
Fixed a NoSuchElementException during group synchronization and implemented user removal from groups during SCIM path updates.
- New CLI command to update from flow source
- Flows validation and namespace update endpoints now use multipart instead of YAML string body — integrations calling these endpoints directly may need to be updated.
- Flows validation and namespace updates now use multipart request bodies instead of YAML string bodies — clients or integrations that POST raw YAML directly to these endpoints may need to be updated.
Increased job name random suffix to prevent collisions under high concurrency, fixed an issue where delayed instances bypassed concurrency limit checks (both OSS and Enterprise), and addressed a possible race condition in transactional trigger processing (Enterprise only).
Kestra 1.0.22 delivers four bug fixes across open-source and enterprise editions. The open-source fix ensures Subflow and ForEachItem correctly transmit the execution kind (closes #14141). Enterprise fixes address: injection defaults being incorrectly applied when iterating over all flows, a null-pointer issue in subflow execution deduplication, and KafkaScheduler now tolerates missing flows gracefully instead of failing (closes #6386).
Fixed a regression in execution delay, resolved an issue where dashboards failed to filter on NORMAL kind, and addressed a bug where parallel tasks would fail to run in parallel mode if one task was disabled. Reverted a fix for MySQL fulltext search suffix issues.
Fixed a regression in execution delay, resolved an issue where dashboards did not filter on NORMAL kind, and addressed a bug where parallel tasks would fail to run in parallel mode if one task was disabled. Also addressed MySQL fulltext search suffix issues.
- Run the required database migration for namespace files revision history (see PR #13026) before upgrading to this version.
- Review flow logging configuration — flow logger is now disabled by default. Re-enable explicitly in config if needed.
- Update any references to the old logger name after the logger rename (commit c0f6298).
- Logger name has changed and flow logger is now disabled by default (commit c0f6298). Any configuration or tooling relying on the previous logger name will need to be updated.
- Introduction of namespace files revision history requires a database migration before upgrading (PR #13026). Migration must be run or data integrity issues may occur.
- Assets system: new UI tab, AssetShipper task, asset-execution linking, and asset management across namespaces
- Namespace files revision history with PurgeFiles task
- Concurrent trigger execution support
Kestra 1.1.13 is a bug fix release for the Open-Source Edition. Fixes include: scope no longer persists incorrectly on namespace executions and flows tab, page number is preserved when adding filter keys, a missing dot in the JDBC prefix filter is corrected, JSON exceptions in set KV value now fall back to string handling, and Flow Labels implementation is restored as an object type.