Access control​

• Enabled IdP claims mapping by default for Enterprise.
• Added an organization allowlist to the IdP claims-mapping feature flag.
• Added a warning when revoking IdP group delegation.
• Added audit logs for SCIM token events.
• Added audit logging for team IdP group changes.
• Added configurable OIDC scopes via TOWER_OIDC_SCOPES.

Compute environments​

• Added bring-your-own networking support for Azure Cloud compute environments.

Bug fixes​

Access control​

• Fixed membership revocation by treating absent IdP group claims as empty.
• Fixed IdP group mapping visibility to refresh when toggling SSO.
• Fixed the IdP reconciler to create UserRole entries for workspace visibility.

Compute environments​

• Fixed end-to-end GCP Cloud compute environment support for Workload Identity Federation (WIF) credentials.
• Fixed GCP Batch error reporting to surface actionable API errors instead of a misleading WIF hint.
• Fixed xpack-google secret resolution by setting GOOGLE_CLOUD_PROJECT on the GCP Batch head job.

Monitoring​

• Fixed an OptimisticLockException when deleting audit log v2 records.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.

General​

• Consolidated installation capability toggles under wave.capabilities.* and added a strict environment that disables them all by @pditommaso in #1098
• Added the ability to disable the Wave direct image pull path so callers must use freeze mode by @gavinelder in #1089
• Reduced log noise from expected Platform-connectivity errors in the token watcher by @pditommaso in #1085
• Documented the workflow-bound ephemeral token lifecycle by @pditommaso in #1084

Dependencies​

• Upgraded Micronaut to 4.10.17 to patch jackson-databind (COMP-1957) by @cristianrcv in #1091

Bug fixes​

General​

• Fixed freeze and mirror images being served through the Wave proxy token path by @gavinelder in #1087
• Fixed the Wave release workflow to run only on master and release-* branches (DEVOPS-1531) by @ShahzebMahmood in #1072

Full changelog: https://github.com/seqeralabs/wave/compare/v1.36.0...v1.37.0

Studios​

• Added the Studios allowed-user table and data model.
• Implemented DataStudioAllowedUserService to persist allowed users on Studio create and start.
• Authorized allow-listed users to connect to and run private Studios.
• Exposed the allowlist in the Studios API response.
• Added revalidation of the last checkpoint in Studios.

Compute environments​

• Added a Nextflow version selector, including feature-based version requirements and its specification.
• Disabled Nextflow version selection when a custom launcher container is pinned.
• Added persistence of the AWS Cloud log group and forwarding to the CloudWatch agent.
• Added clickable row cards with new hover tokens.
• Added root-only admin validate endpoints.

Pipelines​

• Added a toggle for the Nextflow syntax parser v2.

Access control​

• Added the foundation for OAuth 2.0 refresh-token rotation.
• Added an organization allowlist to the IdP claims-mapping feature flag.
• Added audit image support for team IdP groups.
• Added audit logs for SCIM tokens.

Monitoring and observability​

• Added a current-month CPU hours metric.

General​

• Enhanced the global search UI with infinite scroll and suggestions.

Bug fixes​

Compute environments​

• Surfaced actionable GCP Batch API errors instead of a misleading WIF hint.
• Set GOOGLE_CLOUD_PROJECT on the GCP Batch head job for xpack-google secret resolution.
• Fixed selecting a Nextflow version when the source pinned none.
• Added retries for AWS forge calls under IAM throttling.
• Fixed a deadlock on last_used updates.
• Avoided a full table rebuild in the m158 cost-retrieval migration.
• Added INSTANT-safe overrides for algorithm-pinned migrations.
• Removed a redundant compute environment work-directory pre-flight check.
• Restored inner target="_blank" links under wtSmartNav.

Data explorer​

• Fixed stale REFRESH_IN_PROGRESS states by timing them out so Data explorer self-heals.

Access control​

• Fixed disabled personal workspaces remaining accessible through their URL.
• Fixed the IdP reconciler to create UserRole entries for workspace visibility.

Platform API​

• Corrected the managed credentials path parameter.

Language features​

• Added a Semantics reference page to the docs by @bentsherman in #7271

Configuration​

• Added the docker.cpuLimits config option by @bentsherman in #7289
• Added the seqera.executor.providerConfig option by @pditommaso in #7335

Google Batch​

• Added a docs note about IAM roles for google.batch.serviceAccountEmail by @bentsherman in #7291

Plugins​

• Sent pipeline-secret references to the Seqera Scheduler from nf-seqera by @pditommaso in #7314
• Skipped nf-tower when superseded by nf-seqera by @jorgee in #7283
• Reverted "Consolidate nf-tower plugin into nf-seqera (#7252)" by @pditommaso in da5afcfe9
• Reverted "Skip nf-tower when superseded by nf-seqera (#7283)" by @pditommaso in c5dec3b4e

General​

• Added a graceful fallback for the array directive with unsupported executors by @bentsherman in #7296
• Added two Indian scientists to NameGenerator by @deepmind11 in #7079
• Clarified Bitbucket API token auth requirements in the docs by @pditommaso in #7279
• Clarified the override behavior of the resourceLabels directive in the docs by @bentsherman in #7287
• Dropped the dead oss.sonatype.org repository by @pditommaso in #7282
• Showed the absolute path in the missing main script error by @bentsherman in #7286
• Used the scheduler API exit code, falling back to the .exitcode file by @jordeu in #7273

Dependencies​

• Bumped jackson 2.21.1 to 2.21.4 to fix high-severity CVEs by @pditommaso in #7274
• Bumped jackson-databind to patched versions to fix deserialization CVEs by @jorgee in #7322
• Replaced the discontinued bcprov-ext with bcprov-jdk18on 1.84 to fix CVE-2025-14813 by @pditommaso in #7284
• Used the wiremock self-contained distribution to drop vulnerable handlebars by @pditommaso in #7275
• Pinned Docusaurus dependencies by @seqeralabs-renovate in #7324
• Updated the actions/checkout action to v6.0.3 by @seqeralabs-renovate in #7325
• Updated the anthropics/claude-code-action action to v1.0.168 by @seqeralabs-renovate in #7326
• Updated ch.qos.logback:logback-classic to v1.5.37 by @seqeralabs-renovate in #7327
• Updated ch.qos.logback:logback-core to v1.5.35 (security) by @seqeralabs-renovate in #7297
• Updated com.azure:azure-compute-batch to v1.0.0-beta.6 by @seqeralabs-renovate in #7128
• Bumped nf-amazon@3.10.1
• Bumped nf-azure@1.23.1
• Bumped nf-google@1.27.4
• Bumped nf-k8s@1.5.5
• Bumped nf-seqera@0.23.0
• Bumped nf-tower@1.29.1
• Bumped nf-wave@1.21.1

Bug fixes​

Language features​

• Fixed error checking in workflow emits by @bentsherman in #7058
• Fixed path input for exec processes by @bentsherman in #7272

Configuration​

• Excluded null config environment entries from the task environment by @bentsherman in #7294

AWS Batch​

• Fixed containerOptions --opt=value parsing for AWS Batch by @bentsherman in #7288
• Rounded up CPUs to the nearest valid value for AWS Batch Fargate by @bentsherman in #7295

Azure​

• Tolerated stale or transient resize errors on autoscale Azure Batch pools by @jorgee in #7312

Fusion​

• Keyed the Fusion license token cache by product and version by @robsyme in #7320

General​

• Fixed a high-severity form-data CRLF injection in the docs site by @pditommaso in #7276
• Fixed a Kryo deserialization error with enum types by @bentsherman in #7277
• Fixed URL percent-encoding lost on resume for HTTP/FTP paths by @bentsherman in #7333
• Force-created staged input symlinks to allow task re-runs by @bentsherman in #7285

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.07.0-edge

General​

• Reduced response contents to remove unneeded fields by @gavinelder in #1073
• Added progressive container expiration extension by @pditommaso in #782

Dependencies​

• Pinned Postgres containers and bumped test containers by @gavinelder in #1080

Full changelog: https://github.com/seqeralabs/wave/compare/v1.35.1...v1.36.0

Studios​

• Added NVIDIA environment variables for GPU Studios.

Compute environments​

• Added bring-your-own networking support for Azure Cloud compute environments.

Pipelines​

• Added pipeline secrets support for scheduler-backed Cloud compute environments, covering both storage and the launch form.
• Disabled Nextflow version selection when a custom launcher container is pinned.
• Updated Nextflow launcher to v26.04.6.

Security​

• Redacted full user email addresses from logs.

Bug fixes​

Compute environments​

• Added retries for AWS Forge calls under IAM throttling.
• Fixed xpack-google secret resolution by setting GOOGLE_CLOUD_PROJECT on the GCP Batch head job.
• Fixed work directory validation for legacy Seqera Compute configurations.
• Surfaced actionable GCP Batch API errors instead of the misleading Workload Identity Federation hint.

Container building​

• Fixed which availability for R (bioconda) post-links in Conda v2 builds by @pditommaso in #1070

General​

• Bumped claude-code-action to v1.0.87 to fix 404 model error by @ShahzebMahmood in #1078

Full changelog: https://github.com/seqeralabs/wave/compare/v1.35.0...v1.35.1

• Bumped nf-seqera@0.21.1
• Bumped nf-tower@1.28.2

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.04.6

General​

• Added GPU metrics to workflow-level execution summary by @cristianrcv in #7229
• Propagated Seqera Intelligent Compute scheduler run identifier to Platform by @jorgee in #7228

Bug fixes​

Language features​

• Fixed flatMap tuple error for dataflow value by @bentsherman in #7254

Dependencies​

• Bumped nf-seqera@0.22.0
• Bumped nf-tower@1.29.0

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.04.5

Compute environments​

• Added the compute environment ID to the compute environment row card.
• Added the c9gd instance family to the NVMe instance list.
• Updated the list of available Azure regions.

Bug fixes​

Compute environments​

• Added a clear error message when Azure Batch pool deletion fails.
• Disabled compute environment form submission while the form is invalid.

Data explorer​

• Signed GCS genomic file URLs with V4 for IGV preview.

General​

• Added SSRF host validation using lib-util-net by @pditommaso in #1061
• Added the waveBuildNotification user preference for build email notifications by @robnewman in #1069

Bug fixes​

Container building​

• Fixed conda/micromamba:v2 builds to use the micromamba 2 image by @pditommaso in #1065

Full changelog: https://github.com/seqeralabs/wave/compare/v1.34.0...v1.35.0

Language features​

• Clarified storeDir caveats with env, eval, and stdout outputs by @bentsherman in #7235

Azure​

• Added docs tip for relocating Docker storage on Azure Batch nodes by @adamrtalbot in #6937

Fusion​

• Added a clear error when Fusion is enabled without an access token by @jorgee in #7263

Plugins​

• Consolidated the nf-tower plugin into nf-seqera by @pditommaso in #7252

General​

• Added Fibonacci and Pareto to the run name generator by @bentsherman in #7255
• Normalized version callouts in the docs by @bentsherman in #7256
• Propagated the Seqera Intelligent Compute scheduler run identifier to Platform by @jorgee in #7228
• Removed uncommitted specs by @bentsherman in #7267

Dependencies​

• Bumped nf-seqera@1.0.0

Bug fixes​

Language features​

• Fixed docs example for record operations by @bentsherman in #7250
• Fixed flatMap tuple error for dataflow value by @bentsherman in #7254

General​

• Fixed failing unit tests with clean build by @bentsherman in #7264
• Lowered trace-access.nf memory to fit CI runner capacity by @pditommaso in #7266

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.06.0-edge

Compute environments​

• Added VPC and multiple subnet selection to AWS Cloud compute environments.
• Added the number of instances provisioned per run to the run page, sourced from the Scheduler run summary.
• Added the g7 instance family to the NVMe list.
• Required Spot provisioning for Fusion snapshots and aligned the GCP provisioning interface.
• Refined the compute environment list with a type label, Cloud feature hiding, and an Invalid status.

Pipelines​

• Updated Nextflow to v26.04.4.

Access control​

• Split the data_link and data_link_object permissions into separate scopes. Workspace members with View, Connect, or Launch roles can now download files and generate download URLs from data-links. Upload and delete file operations remain restricted to Maintain and above.
• Added pre-filling of first and last name from GitHub signup.
• Added a groups scope to SSO connections.
• Added handling for malformed groups claims.
• Rejected group creation with commas when Auth0 is enabled.

Monitoring and observability​

• Added audit entries for pre-flight cron status transitions.

General​

• Added a default workspace preference to the user profile.
• Listed avatar and username rows in the avatar-group popover.

Bug fixes​

Pipelines​

• Fixed lineage incorrectly showing as not enabled for submitted runs when it was enabled.

Access control​

• Fixed detection of a personal access token as a duplicate when creating a GitHub App with the same credentials.

General​

• Fixed uploaded avatars not persisting when an admin creates a user.
• Fixed unknown workspace sub-routes to redirect to the workspace root.
• Fixed the favicon to follow the OS light and dark color scheme.
• Fixed several UI issues across the run page, Data Explorer, and search.

Pipelines​

• Added pipeline schema, commit ID, head job CPUs, and head job memory to the workflow launch form summary, plus pipeline version and lineage fields when those features are active.

Bug fixes​

Compute environments​

• Fixed AWS credential validation failing for credentials using assumeRoleArn when TOWER_ALLOW_INSTANCE_CREDENTIALS=true without an explicit role mode.

Pipelines​

• Fixed duplicate credential detection to block GitHub App creation when a personal access token credential already exists for the same repository base URL.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.

Language features​

• Removed the deprecated echo process directive by @pditommaso in #7206
• Added support for record type input with dot-notation CLI params by @jorgee in #7170

Azure​

• Improved Azure Batch VM image diagnostics and fixed stale 24.04 docs by @pditommaso in #7200

Plugins​

• Added workflow DAG reporting to the nf-tower plugin by @ewels in #7218
• Allowed the plugin version to be specified when running a plugin command by @JosuaCarl in #7113
• Added subcommand listing to nextflow plugins -help by @ewels in #7197

General​

• Added -help as an alias for -h in top-level CLI options by @ewels in #7238
• Added GPU metrics to the workflow-level execution summary by @cristianrcv in #7229
• Added hidden plural/singular aliases for noun subcommands by @ewels in #7239
• Added Nextflow module info to the lineage TaskRun entry by @jorgee in #7160
• Added seqera:// data-links support to the nf-tower filesystem by @jorgee in #7070
• Added a shellEnabled option and per-task prediction model to the Seqera executor by @pditommaso in #7204
• Added the nextflow logfile command by @ewels in #7177
• Added a data lineage architecture decision record (ADR) by @bentsherman in #7187
• Changed stdout outputs to stderr to avoid breaking piped output by @ewels in #7121
• Clarified the distinction between modules and script inclusion in the docs by @bentsherman in #7217
• Migrated the docs to the new build by @christopher-hakkaart in #7119
• Improved Tower telemetry error handling on transient gateway failures by @pditommaso in #7190
• Mirrored test containers to public.cr.seqera.io to harden CI against quay.io outages by @pditommaso in #7195
• Promoted the latest stable channel by version comparison instead of branch name by @pditommaso in b5ac62e0c
• Refactored changelog.txt to CHANGELOG.md by @ewels in #7179
• Added support for the accelerator directive in the local executor by @bentsherman in #5850
• Used a stop flag instead of a thread interrupt to shut down the logs checkpoint by @pditommaso in #7193

Bug fixes​

Language features​

• Fixed "No such variable" in typed output block with job arrays by @jorgee in #7221
• Fixed cast and instanceof with record types by @bentsherman in #7185
• Fixed staging of Path fields of included record types by @robsyme in #7226

Plugins​

• Preserved the order of plugin declarations in config by @jagedn in #7227

General​

• Fixed workflow completion handler being called twice by @bentsherman in #7191
• Fixed lineage records for stub-run and eval outputs by @jorgee in #7211
• Fixed netty CVE-2026-44249 via an AWS SDK bump and azure-core-http-netty pin by @jorgee in #7223
• Fixed nxf_date for uutils coreutils (Ubuntu 26.04+) by @robsyme in #7118
• Fixed nxf_date to sample seconds and nanoseconds atomically by @pditommaso in #7207

Dependencies​

• Bumped nf-amazon@3.10.0
• Bumped nf-azure@1.23.0
• Bumped nf-codecommit@0.6.0
• Bumped nf-seqera@0.22.0
• Bumped nf-tower@1.29.0

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.05.0-edge

Compute environments​

• Redesigned the compute environment list as a row-card table.
• Added attribute chips to the compute environment list.
• Added an on-demand credentials validation button.

Plugins​

• Bumped the default plugin create template to v0.4.0 by @pditommaso in #7234

General​

• Added Nextflow module info to lineage TaskRun entry by @jorgee in #7160

Bug fixes​

Language features​

• Fixed "No such variable" in typed output block with job arrays by @jorgee in #7221
• Fixed cast and instanceof with record types by @bentsherman in #7185
• Fixed staging of Path fields of included record types by @robsyme in #7226

Plugins​

• Preserved order of plugin declarations in config by @jagedn in #7227

General​

• Fixed workflow completion handler being called twice by @bentsherman in #7191
• Fixed nxf_date for uutils coreutils (Ubuntu 26.04+) by @robsyme in #7118
• Fixed nxf_date to sample seconds and nanoseconds atomically by @pditommaso in #7207

Dependencies​

• Bumped nf-amazon@3.9.2
• Bumped nf-azure@1.22.6
• Bumped nf-codecommit@0.5.3
• Bumped nf-seqera@0.21.0
• Bumped nf-tower@1.28.1

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.04.4

Compute environments​

• Added AWS Cloud compute environment EBS volume encryption with an optional KMS key.
• Added the m9gd instance family to the NVMe list.

Pipelines​

• Added a launch output directory option to the launch form.
• Added a shareable deep link to the task details view.
• Showed the metrics tab for canceled workflow runs.

Bug fixes​

Monitoring​

• Included gpuMetrics in task JSON serialization so GPU usage is now visible in the task payload.

Pipelines​

• Fixed an unexpected error when the workflow limiter canceled a newly launched workflow.
• Preserved a custom schema when added for the first time in pipeline edit mode.

Container building​

• Made micromamba/v2 the default build template for Conda packages by @pditommaso in #1024

Dependencies​

• Bumped io.netty:netty-bom to 4.2.13.Final by @cristianrcv in #1053

General​

• Made the server listening port configurable via the WAVE_SERVER_PORT environment variable by @bebosudo in #1029
• Made the STDOUT log pattern configurable via WAVE_LOG_STDOUT_PATTERN by @munishchouhan in #1055
• Removed git tag --force from the Wave release CI by @ShahzebMahmood in #1056
• Removed the legacy wave/app ECR push by @ShahzebMahmood in #1057
• Used an OIDC role for Maven publishing by @ShahzebMahmood in #1059
• Added Wave features documentation by @christopher-hakkaart in #1040

Bug fixes​

General​

• Ported the Wave CI release flow with a non-enterprise jibRepo fix by @ShahzebMahmood in #1046

Full changelog: https://github.com/seqeralabs/wave/compare/v1.33.6...v1.34.0

Azure​

• Updated default Azure Batch pool image to Ubuntu 24.04 by @pditommaso in 114d0e4c

General​

• Pinned rnaseq-nf to v2.3 in Azure validation script by @pditommaso in 8f7e5780

Bug fixes​

S3​

• Fixed S3FileSystemProvider.newInputStream() draining full object on close by @jorgee in #7046

General​

• Fixed world-readable seqera-auth.config credential file by @arnaualcazar in #7182
• Fixed LogsCheckpoint thread interrupt race condition by @pditommaso in #6939

Dependencies​

• Bumped nf-amazon@3.4.5 by @pditommaso in b9074b2d
• Bumped nf-tower@1.17.7 by @pditommaso in da09f092
• Bumped nf-azure@1.20.3 by @pditommaso in 1e000afe

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v25.10.6