Feature updates and improvements​

Language features​

• Added an agent primitive to run AI agents as first-class Nextflow tasks by @pditommaso in #7477
• Added syntax error reporting for an unexpected character in a gstring by @bentsherman in #7353
• Updated the formatter to preserve comments by @ewels in #7346

Configuration​

• Added the seqera.executor.maxCpusPerUser config option by @jonmarti in #7367
• Added the singularity.resourceLimits config option by @bentsherman in #7352
• Split CLI config handling out of ConfigBuilder by @bentsherman in #7373

S3​

• Dropped transient object tags when publishing files to S3 by @pditommaso in #7344

Kubernetes​

• Treated a missing k8s config scope as an empty one by @pditommaso in #7452

Plugins​

• Aligned the Seqera executor maxSpotAttempts and Fusion handling by @pditommaso in #7412
• Bounded Seqera executor scheduler requests with a request timeout by @pditommaso in #7466
• Stopped fabricating a memory request for the Seqera executor by @pditommaso in #7488
• Used the Platform user identity for the Seqera executor userName label by @pditommaso in #7413
• Used registry config for plugin repos by @jorgee in #7180

General​

• Accepted the http requesting protocol for HTTPS proxy CONNECT tunnel authentication by @bentsherman in #7369
• Added --console=plain to Gradle commands in the Makefile by @pditommaso in #7400
• Added componentName to the module view command output by @pditommaso in #7385
• Added a note about AI co-authorship to CLAUDE.md by @bentsherman in #7357
• Added smolvm container engine support by @pditommaso in #7386
• Added support for authenticated forward HTTP/HTTPS proxies across the client stack by @pditommaso in #7331
• Aligned the build to the Java 25 toolchain, targeting Java 17 via --release by @pditommaso in #7370
• Cached the task context for exec tasks by @pditommaso in #7499
• Documented the exit logic in the task wrapper script by @bentsherman in #7290
• Honored COLUMNS when determining ANSI output width by @Eldergenix in #7144
• Pre-pulled the integration tests container by @pditommaso in #7432
• Refactored HubOptions from a trait into a record by @bentsherman in #7372
• Removed dead SpuriousDeps.cmdCloud reflection by @bentsherman in #7371
• Reported the task directives read while the command is rendered by @bentsherman in #7506
• Separated the CLI from the runtime by @bentsherman in #5971
• Updated the CI bucket to s3://nextflow-oss-ci by @bentsherman in #7440
• Used the WireMock self-contained distribution in nf-tower by @pditommaso in #7485
• Used command -v instead of which in the launcher Java lookup by @pditommaso in #7433

Dependencies​

• Bumped Groovy 4.0.33 by @pditommaso in #7429
• Bumped Netty and Apache HttpComponents to patched releases by @pditommaso in #7484
• Updated the docs site dependencies to patched releases by @pditommaso in #7486

Bug fixes​

Language features​

• Fixed a function call in a process directive value with the v2 parser by @bentsherman in #7374
• Fixed lint reporting of excluded paths by @bentsherman in #7354
• Fixed a parameterized type cast in a process body by @bentsherman in #7382
• Fixed a variable incorrectly resolved to an included function name by @bentsherman in #7358

Configuration​

• Fixed config rendering of nested closures by @bentsherman in #7375
• Fixed plugin blocks incorrectly merged in the v2 config parser by @bentsherman in #7350

Azure​

• Fixed detection of Azure virtual directories without a trailing slash by @adamrtalbot in #6428

Wave​

• Fixed a spurious 'Unrecognized config option' warning for wave.build.compression and wave.build.conda by @pditommaso in #7355

General​

• Fixed cache invalidation for module binaries by @FloWuenne in #6914
• Fixed independently-verified findings from a security audit by @ewels in #7503
• Fixed a negative duration error on a short run by @bentsherman in #7351
• Fixed the PBS Pro server status query by @jscgh in #7366
• Fixed the publish mode override when re-publishing an existing file by @bentsherman in #7364
• Fixed a race condition calling workflow onComplete twice by @bentsherman in #7349
• Fixed tests failing on macOS and on hosts with NXF_REGISTRY_TOKEN by @pditommaso in #7457
• Fixed workflow metadata when failOnIgnore is true by @ehsanestaji in #7356
• Guarded the trace log against string formatting errors by @bentsherman in #7347
• Prevented a world-readable race window when storing local secrets by @aknownuser in #7307
• Reverted the stream swap after the redirect to .command.out and .command.err by @tcezard in #7300

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.08.0-edge

Feature updates and improvements​

Pipelines​

• Updated the bundled Nextflow version to 25.10.6.

Bug fixes​

Data Explorer​

• Fixed the IGV genome viewer failing to load reference genomes in Data Explorer by signing reference genome URLs.
• Fixed IGV genome viewer rendering in Data Explorer, which no longer depends on an externally hosted genome registry.
• Fixed IGV previews of Google Cloud Storage files in Data Explorer returning an authorization error, by signing those URLs with V4 signatures.
• Fixed IGV previews in Data Explorer failing at high zoom levels by signing index URLs independently of their data file URLs.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.

Feature updates and improvements​

Compute environments​

• Added an optional KMS key ARN to AWS Batch compute environments, so pipeline secrets in AWS Secrets Manager can be encrypted with a customer-managed key instead of the AWS-managed default.

Access control​

• Updated the copy and API URL chip on the Access tokens page.

General​

• Added the page number and search terms to paginated list URLs, so list state survives back-navigation and list URLs are shareable.

Bug fixes​

Compute environments​

• Fixed AWS Cloud head job failures returning an empty log page when the compute environment's IAM instance profile has no role attached.
• Fixed compute environment create and update accepting credentials already recorded as invalid or soft-deleted, and update resetting a credential's status without checking it.
• Fixed exhausted Google Cloud IAM retries to report a meaningful error, and added jitter to the retry backoff.

Data Explorer​

• Fixed tab flicker and a full-width action button in the file browser.
• Fixed IGV reference genome URLs not being signed, and corrected IGV rendering.
• Fixed an error when listing data in workspaces with auto-discovery disabled.

Monitoring and observability​

• Fixed the Runs tab pagination being scoped incorrectly on the project details page.
• Removed the ambiguous "last run" chips from the project header.

Feature updates and improvements​

Compute environments​

• Added a maxCpusPerUser setting to cap per-user vCPU usage in compute environments.
• Standardized head node instance type helper text across AWS, Azure, and Google Cloud compute environment forms.

Pipelines​

• Added support for Nextflow v25.10.6 and v25.10.7.

General​

• Removed the redundant Projects section from the workspace side navigation.

Bug fixes​

Studios​

• Fixed Studios row card horizontal scrolling when the sidebar is expanded on small screens.

Compute environments​

• Fixed GCP pipeline secrets to be pinned to the compute environment region.
• Fixed GCP IAM policy write conflicts during Forge compute environment creation.

Pipelines​

• Fixed shared pipeline resolution by passing the source workspace ID.

Datasets​

• Fixed dataset queries to exclude deleted runs.

Labels​

• Fixed generic label editing to no longer drop project labels.

Co-Scientist​

• Fixed the Co-Scientist portal web session link.

Feature updates and improvements​

Compute environments​

• Added support for private Azure Container Registry (ACR) image pulls on Azure Cloud.

Studios​

• Added the ability to display logs for the latest Studio run.
• Added support for applying custom CA configuration to Studios.

Co-Scientist​

• Added the ability to select Co-Scientist conversation history.
• Added page context and screenshot sharing to Co-Scientist chat.

Projects​

• Refined project details workflows.

Credits​

• Added audit log events for the self-serve credit purchase lifecycle.
• Added a root endpoint to cancel purchases stuck in the PENDING state.

General​

• Aligned the key-value date search filter hint with its control.

Bug fixes​

Compute environments​

• Fixed duplicated AWS Batch compute environments carrying a stale ec2KeyPair value by reconciling select values against loaded options.
• Prevented orphaned agent session-expiration tasks from flooding the scheduled task pool.

Studios​

• Fixed flickering of Studio environment variables.

Seqera AI​

• Surfaced the server error reason in Co-Scientist chat.

Security​

• Redacted tokens and secrets from application logs.

General​

• Fixed dark-theme issues from the semantic color token migration.

Feature updates and improvements​

Access control​

• Enabled IdP claims mapping by default for Enterprise.
• Added an organization allowlist to the IdP claims-mapping feature flag.
• Added a warning when revoking IdP group delegation.
• Added audit logs for SCIM token events.
• Added audit logging for team IdP group changes.
• Added configurable OIDC scopes via TOWER_OIDC_SCOPES.

Compute environments​

• Added bring-your-own networking support for Azure Cloud compute environments.

Bug fixes​

Access control​

• Fixed membership revocation by treating absent IdP group claims as empty.
• Fixed IdP group mapping visibility to refresh when toggling SSO.
• Fixed the IdP reconciler to create UserRole entries for workspace visibility.

Compute environments​

• Fixed end-to-end GCP Cloud compute environment support for Workload Identity Federation (WIF) credentials.
• Fixed GCP Batch error reporting to surface actionable API errors instead of a misleading WIF hint.
• Fixed xpack-google secret resolution by setting GOOGLE_CLOUD_PROJECT on the GCP Batch head job.

Monitoring​

• Fixed an OptimisticLockException when deleting audit log v2 records.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.

Feature updates and improvements​

Studios​

• Added the ability to mark Studios as favorites, persisted per user.
• Added the ability to cancel Studios stuck in the stopping state.

Pipelines​

• Added a pipeline version ID column to the pipeline versions list.

Data Explorer​

• Added object last-modified timestamps in Data Explorer.

General​

• Aligned global search with the lineage query DSL.

Bug fixes​

Pipelines​

• Fixed pipeline version updates to baseline against the original compute environment.
• Fixed the optimization banner not showing when relaunching a run from a shared pipeline.
• Fixed Nextflow version selection so a version can be chosen when the source launch pinned none.

Feature updates and improvements​

General​

• Consolidated installation capability toggles under wave.capabilities.* and added a strict environment that disables them all by @pditommaso in #1098
• Added the ability to disable the Wave direct image pull path so callers must use freeze mode by @gavinelder in #1089
• Reduced log noise from expected Platform-connectivity errors in the token watcher by @pditommaso in #1085
• Documented the workflow-bound ephemeral token lifecycle by @pditommaso in #1084

Dependencies​

• Upgraded Micronaut to 4.10.17 to patch jackson-databind (COMP-1957) by @cristianrcv in #1091

Bug fixes​

General​

• Fixed freeze and mirror images being served through the Wave proxy token path by @gavinelder in #1087
• Fixed the Wave release workflow to run only on master and release-* branches (DEVOPS-1531) by @ShahzebMahmood in #1072

Full changelog: https://github.com/seqeralabs/wave/compare/v1.36.0...v1.37.0

Feature updates and improvements​

Studios​

• Added the Studios allowed-user table and data model.
• Implemented DataStudioAllowedUserService to persist allowed users on Studio create and start.
• Authorized allow-listed users to connect to and run private Studios.
• Exposed the allowlist in the Studios API response.
• Added revalidation of the last checkpoint in Studios.

Compute environments​

• Added a Nextflow version selector, including feature-based version requirements and its specification.
• Disabled Nextflow version selection when a custom launcher container is pinned.
• Added persistence of the AWS Cloud log group and forwarding to the CloudWatch agent.
• Added clickable row cards with new hover tokens.
• Added root-only admin validate endpoints.

Pipelines​

• Added a toggle for the Nextflow syntax parser v2.

Access control​

• Added the foundation for OAuth 2.0 refresh-token rotation.
• Added an organization allowlist to the IdP claims-mapping feature flag.
• Added audit image support for team IdP groups.
• Added audit logs for SCIM tokens.

Monitoring and observability​

• Added a current-month CPU hours metric.

General​

• Enhanced the global search UI with infinite scroll and suggestions.

Bug fixes​

Compute environments​

• Surfaced actionable GCP Batch API errors instead of a misleading WIF hint.
• Set GOOGLE_CLOUD_PROJECT on the GCP Batch head job for xpack-google secret resolution.
• Fixed selecting a Nextflow version when the source pinned none.
• Added retries for AWS forge calls under IAM throttling.
• Fixed a deadlock on last_used updates.
• Avoided a full table rebuild in the m158 cost-retrieval migration.
• Added INSTANT-safe overrides for algorithm-pinned migrations.
• Removed a redundant compute environment work-directory pre-flight check.
• Restored inner target="_blank" links under wtSmartNav.

Data explorer​

• Fixed stale REFRESH_IN_PROGRESS states by timing them out so Data explorer self-heals.

Access control​

• Fixed disabled personal workspaces remaining accessible through their URL.
• Fixed the IdP reconciler to create UserRole entries for workspace visibility.

Platform API​

• Corrected the managed credentials path parameter.

Feature updates and improvements​

Language features​

• Added a Semantics reference page to the docs by @bentsherman in #7271

Configuration​

• Added the docker.cpuLimits config option by @bentsherman in #7289
• Added the seqera.executor.providerConfig option by @pditommaso in #7335

Google Batch​

• Added a docs note about IAM roles for google.batch.serviceAccountEmail by @bentsherman in #7291

Plugins​

• Sent pipeline-secret references to the Seqera Scheduler from nf-seqera by @pditommaso in #7314
• Skipped nf-tower when superseded by nf-seqera by @jorgee in #7283
• Reverted "Consolidate nf-tower plugin into nf-seqera (#7252)" by @pditommaso in da5afcfe9
• Reverted "Skip nf-tower when superseded by nf-seqera (#7283)" by @pditommaso in c5dec3b4e

General​

• Added a graceful fallback for the array directive with unsupported executors by @bentsherman in #7296
• Added two Indian scientists to NameGenerator by @deepmind11 in #7079
• Clarified Bitbucket API token auth requirements in the docs by @pditommaso in #7279
• Clarified the override behavior of the resourceLabels directive in the docs by @bentsherman in #7287
• Dropped the dead oss.sonatype.org repository by @pditommaso in #7282
• Showed the absolute path in the missing main script error by @bentsherman in #7286
• Used the scheduler API exit code, falling back to the .exitcode file by @jordeu in #7273

Dependencies​

• Bumped jackson 2.21.1 to 2.21.4 to fix high-severity CVEs by @pditommaso in #7274
• Bumped jackson-databind to patched versions to fix deserialization CVEs by @jorgee in #7322
• Replaced the discontinued bcprov-ext with bcprov-jdk18on 1.84 to fix CVE-2025-14813 by @pditommaso in #7284
• Used the wiremock self-contained distribution to drop vulnerable handlebars by @pditommaso in #7275
• Pinned Docusaurus dependencies by @seqeralabs-renovate in #7324
• Updated the actions/checkout action to v6.0.3 by @seqeralabs-renovate in #7325
• Updated the anthropics/claude-code-action action to v1.0.168 by @seqeralabs-renovate in #7326
• Updated ch.qos.logback:logback-classic to v1.5.37 by @seqeralabs-renovate in #7327
• Updated ch.qos.logback:logback-core to v1.5.35 (security) by @seqeralabs-renovate in #7297
• Updated com.azure:azure-compute-batch to v1.0.0-beta.6 by @seqeralabs-renovate in #7128
• Bumped nf-amazon@3.10.1
• Bumped nf-azure@1.23.1
• Bumped nf-google@1.27.4
• Bumped nf-k8s@1.5.5
• Bumped nf-seqera@0.23.0
• Bumped nf-tower@1.29.1
• Bumped nf-wave@1.21.1

Bug fixes​

Language features​

• Fixed error checking in workflow emits by @bentsherman in #7058
• Fixed path input for exec processes by @bentsherman in #7272

Configuration​

• Excluded null config environment entries from the task environment by @bentsherman in #7294

AWS Batch​

• Fixed containerOptions --opt=value parsing for AWS Batch by @bentsherman in #7288
• Rounded up CPUs to the nearest valid value for AWS Batch Fargate by @bentsherman in #7295

Azure​

• Tolerated stale or transient resize errors on autoscale Azure Batch pools by @jorgee in #7312

Fusion​

• Keyed the Fusion license token cache by product and version by @robsyme in #7320

General​

• Fixed a high-severity form-data CRLF injection in the docs site by @pditommaso in #7276
• Fixed a Kryo deserialization error with enum types by @bentsherman in #7277
• Fixed URL percent-encoding lost on resume for HTTP/FTP paths by @bentsherman in #7333
• Force-created staged input symlinks to allow task re-runs by @bentsherman in #7285

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.07.0-edge