Skip to main content

🚀 Features

  • App Builder is the default entry screen App Builder is now the first screen you see when you open the platform.
  • Audit logging for MCP tool writes MCP tool write operations are now recorded in audit logs, and secrets are redacted from audit log entries.
  • Model selection for Prompt to Workflow You can now select the model used by Prompt to Workflow (P2W).
    • Added server API support for P2W model selection
    • Added UI support for choosing a model in P2W
  • Custom domains for published App Builder apps You can now serve a published App Builder app from a domain you own. Open the app’s settings and select the Domains tab to connect a domain.
    • The custom domain must start with the same first label as your app’s URL subdomain
    • Add the TXT record shown on _appbuilder-verify.<your-domain> to verify ownership, and the CNAME record to route traffic to your app
    • Each domain shows a status of Pending, Verifying, Live, or Failed while DNS and the certificate are set up
    • Remove custom domains before you change the app’s subdomain
    • Self-hosted deployments configure the custom-domains service with CUSTOM_DOMAINS_BASE_URL, CUSTOM_DOMAINS_API_KEY, CUSTOM_DOMAINS_WEBHOOK_SECRET, and APPGEN_CUSTOM_DOMAIN_CNAME_TARGET
  • Image compliance scan cleanup The image compliance scan job now runs a cleanup step after scanning.

🐛 Bug Fixes

  • Postgres source connection timeouts Postgres source connections now use a connect_timeout, so unreachable databases fail fast instead of hanging.
  • Sync runs fail on source connection errors A sync run now fails when the source connection errors instead of retrying.
  • Reduced noise in error reporting Expected Postgres query errors, PG::SyntaxError, and OAuth token 4xx responses from QuerySource are no longer reported to AppSignal.
  • Typed OAuth token request errors OAuth token 4xx responses now raise a typed OauthTokenRequestError.
  • HTTP Model connection checks check_connection for HTTP Models now guards against blank and invalid request_format values.
  • Model Hub usage by resource Model Hub usage by resource now counts all connector sources.
  • Enterprise workspace and organization routes Enterprise workspaces and organizations routes are now restricted to implemented actions.
  • Sandbox work protection for Agentic Coding Sandbox work is now protected with a pre-build snapshot, a separate build sandbox, and active checkpoints.
    • Sandbox calls are skipped for paused or ended agentic sessions
  • Container image scan labels npm findings in the Debian UI image are now labeled as app dependencies.
  • Quieter session cancellation during provisioning When an Agentic Coding session is destroyed while its sandbox is still provisioning, the expected cancellation is no longer reported as an error.
  • Grype errors in the image scan log Errors from Grype are now shown in the image scan log.

🛠️ Chores

  • Server Ruby version update Updated the Ruby version used by the server.
  • Server Gemfile update Bumped the integrations gem in the server Gemfile to 0.43.5.
  • AI Squared connector endpoint update Updated the endpoint used by the AI Squared connector.
  • OpenCode v2 support Added support for OpenCode v2 changes and updated the OpenTelemetry tag to the latest version for OpenCode v2.
  • Hardened container images Server and UI images are now built on hardened IronBank bases.
    • Server and UI images are scanned with Grype and OpenSCAP
    • Each Grype finding is labeled as an OS package, runtime, or app dependency
  • Repository sync fix Fixed an issue caused by unrelated history merges when syncing the same repository.
  • Evaluation as a feedback option Chatbot components in data apps and AI workflows can now use Evaluation as their feedback method, so each workflow run is evaluated automatically instead of relying on user feedback.
    • Choose the evaluation metrics to apply: Helpfulness, Groundedness, Tone, Context relevance, and Conciseness. Helpfulness and Groundedness are selected by default, and at least one metric is required.
    • Reports show evaluation results for data apps and agent workflows, including an evaluation overview and per-run evaluation details
    • Evaluation results are kept separate from human feedback counts
  • Multiple sign-in sessions per user Signing in from one place no longer signs you out everywhere else, which fixes App Builder apps logging you out when you use the same account in several sessions.
    • Signing out ends only the current session
    • Each user can have up to 10 active sessions by default. A new sign-in over the limit signs out the oldest session. Self-hosted deployments can change the limit with MAX_CONCURRENT_SESSIONS.
    • Resetting your password signs out all of your sessions
    • An hourly job removes expired session tokens
  • Large file detection on Agentic Coding pushes Git pushes from an Agentic Coding session now check for files larger than 100 MB before pushing to GitHub.
    • When a large file is found, the commit is undone and the push fails with a new push_too_large event category
    • The event lists the affected files and their sizes, with a remove_large_files remediation
  • Longer timeout for Agentic Coding Git operations Git operations that run in the sandbox now have a 180-second execution timeout.
  • Image scan baseline updates Updated the server and UI image scan baselines and documented the accepted sqlite-libs, json-glib, and mesa-libgbm findings.
  • Security alerts in Slack Dependabot and CodeQL alerts are now posted to Slack.