> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/release-notes/self-managed-enterprise-edition.md).
# Self-Managed Enterprise Edition release notes
{% hint style="info" %}
**About Harness release notes**
These release notes describe recent changes to Harness Self-Managed Enterprise Edition, NextGen.
* **Security advisories:** Harness publishes security advisories for every release. Go to the [Harness Trust Center](https://trust.harness.io/?itemUid=c41ff7d5-98e7-4d79-9594-fd8ef93a2838\&source=documents_card) to request access to the security advisories.
* **More release notes:** Go to [Harness Release Notes](/release-notes/readme.md) to explore all Harness release notes, including module, delegate, FirstGen Self-Managed Enterprise Edition, and FirstGen release notes.
{% endhint %}
Subscribe via RSS
## Version at a glance
| **Release** | [**0.48.0**](#version-0480) | [**0.47.0**](#version-0470) | [**0.46.1**](#version-0461) | [**0.44.2**](#version-0442) | [**0.46.0**](#version-0460) | [**0.45.1**](#version-0451) |
| -------------------- | --------------------------- | --------------------------- | --------------------------- | --------------------------- | --------------------------- | --------------------------- |
| **Release date** | October 19, 2026 | October 1, 2026 | September 25, 2026 | September 15, 2026 | September 11, 2026 | September 9, 2026 |
| **FIPS compatible** | Yes | Yes | No | Yes | No | No |
| **Breaking changes** | Yes | No | No | No | Yes | No |
## Upgrade & compatibility notices
Breaking: Argo CD diff-ignore required for the global shared secret (0.48.0 and later)
{% hint style="danger" %}
**Breaking change: global shared secret is now the chart default**
Starting with **0.48.0**, the Harness SMP chart creates a global shared secret by default and every service references it for a shared JWT token, instead of each service creating its own secret. Upgrading to 0.48.0 causes a one-time rotation of these secrets.
If you deploy with Argo CD, add the global shared secret to your diff-ignore configuration **before** you upgrade to 0.48.0, and keep it there for every 0.48.0-and-later upgrade. Without the diff-ignore entry, Argo CD treats the chart-managed secret as drift and rotates it on every sync, not just the first one.
{% endhint %}
Breaking: NGINX Ingress deprecated, migrate to Envoy Gateway (0.46.0 and later)
{% hint style="danger" %}
**Breaking change: NGINX Ingress deprecation**
The community NGINX Ingress controller has reached end of life. Harness Self-Managed Enterprise Edition will continue to support NGINX Ingress through **0.45.0**. Starting with **0.46.0**, NGINX Ingress support will be deprecated.
As the supported replacement, Harness Self-Managed Enterprise Edition now provides **Envoy Gateway**, which routes ingress traffic through the Kubernetes Gateway API. If you still use NGINX Ingress, migrate to Envoy Gateway before you upgrade to 0.46.0 or later.
Go to [Migrate from NGINX Ingress to Envoy Gateway](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/migrate-nginx-ingress-to-envoy-gateway.md) to complete the migration.
{% endhint %}
Breaking: MongoDB 8.0 for in-cluster MongoDB (0.44.0 and later)
{% hint style="danger" %}
**Breaking changes**
**MongoDB 8.0 for in-cluster MongoDB**
* Harness SMP **0.44.0** ships **MongoDB 8.0** (`harnesssecure/mongo:8.0.26-jammy`) for in-cluster MongoDB. MongoDB 7.0 was used from 0.33.x through 0.43.x.
* MongoDB does not allow you to skip major versions. Upgrade to at least SMP 0.33.0 (MongoDB 7.0) before you upgrade to 0.44.0 (MongoDB 8.0).
* Keep the MongoDB FCV upgrade job **enabled** (`upgrades.mongoFCVUpgrade.enabled: true`, the default) so Feature Compatibility Version stays aligned with the MongoDB server during the upgrade. Argo CD users must run the FCV job manually before the main upgrade.
* Go to the [MongoDB Upgrade to Version 8.x](#mongodb-upgrade-to-version-8x-in-smp-environments) note at the top of these release notes for the full version history and upgrade path.
{% endhint %}
Warning: PostgreSQL 14 end of life (November 2026 release)
{% hint style="warning" %}
**Announcement: PostgreSQL 14 deprecation**
PostgreSQL 14 will reach end of life on November 12, 2026. Starting with the November release, Harness Self-Managed Enterprise Edition will no longer support PostgreSQL 14.
To stay on a supported version, upgrade your Harness-provided in-cluster PostgreSQL database from version 14 to version 16 before you upgrade to the November release.
Go to [Upgrade PostgreSQL 14 to 16](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/upgrade-postgresql-14-to-16.md) to complete the upgrade.
{% endhint %}
**Warning:** JEXL 3.5 expression restrictions (0.43.0 and later)
{% hint style="warning" %}
**Announcement**
### JEXL 3.5 expression compatibility changes (SMP 0.43.0 and later)
As part of improving the security posture of the platform, Harness is upgrading JEXL from version 3.0 to 3.5. This change introduces restrictions on JEXL expressions including: blocked reflection-based expressions, rewritten nested subscript expressions, disallowed global variable assignments (use `==` instead of `=` for comparisons), and ternary expressions followed by `[` must be rewritten.
Monitor pipeline executions and contact Harness Support if any issues are encountered or remediation assistance is required.
View detailed migration guidance
* **Reflection-based expressions are blocked.** Any JEXL expression that uses reflection to access classes, methods, or fields will be rejected. For example, expressions such as `<+''.getClass().forName("java.lang.Runtime")>` will no longer execute.
* **Nested subscript expressions must be rewritten.** Expressions that nest one subscript (square bracket) accessor directly inside another needs to be rewritten in a different format. For example, the following expression will fail:
```
<+pipeline.variables[<+stage.variables['test']>]>
```
Rewrite it as:
```
<+pipeline.variables["<+stage.variables['test']>"]>
```
* **JEXL global variable assignments are disallowed.** Expressions that declare global variables will fail to execute. In JEXL, the single `=` operator performs an assignment, not an equality check. Any expression that uses `=` between a variable reference and a value is treated as a global variable assignment and will be rejected in JEXL 3.5.
For example, the following expression is no longer supported:
```
ENVIRONMENT=<+env.identifier>,
REGION=<+pipeline.variables.region>
```
Rewrite the expression using local variables (prefixed with `var`) instead. For example:
```
var ENVIRONMENT=<+env.identifier>,
var REGION=<+pipeline.variables.region>
```
This restriction also affects expressions used to compare values in `when` conditions, such as:
```yaml
when:
stageStatus: Success
condition: <+stage.variables.shouldRun="Yes">
```
When `<+stage.variables.shouldRun="Yes">` is used in a `when` condition, JEXL does not interpret this as an equality check. It is parsed as a global assignment, and the expression evaluates to the assigned value (`"Yes"`). The `when` condition then coerces this value to a boolean, which is `true` for any non-empty, non-null string, so the condition appears to pass regardless of the variable's actual value. In JEXL 3.5, because global assignments are disabled, this expression fails with an error.
Replace `=` with `==` to perform an equality check:
```yaml
when:
stageStatus: Success
condition: <+stage.variables.shouldRun == "Yes">
```
* **Ternary expressions followed immediately by `[` must be rewritten.** JEXL 3.5 treats `?[` as the null-safe array access operator, so the parser consumes `?[...]` as a single token and fails to evaluate the ternary. For example, the following expression will fail:
```
<+pipeline.variables.BUILD_ENVS=="dev"?[""]:"qa">
```
Rewrite it by adding a space after `?` so the parser treats the ternary and the array literal as separate tokens:
```
<+pipeline.variables.BUILD_ENVS=="dev"? [""]:"qa">
```
Or wrap the array in parentheses to disambiguate:
```
<+pipeline.variables.BUILD_ENVS=="QAdf"?([""]):"abcds">
```
{% endhint %}
Warning: FIPS compatibility (0.44.2, 0.47.0, and 0.48.0)
{% hint style="warning" %}
**FIPS compatibility**
Releases 0.44.2, 0.47.0, and 0.48.0 are FIPS compatible. Releases 0.44.0, 0.44.1, 0.45.x, and 0.46.x are not. If your environment requires FIPS compliance, upgrade to 0.44.2, 0.47.0, or 0.48.0. Contact [Harness Support](mailto:support@harness.io) for guidance on FIPS-compatible options.
{% endhint %}
Info: MongoDB upgrade guide (version history and upgrade path)
{% hint style="info" %}
### MongoDB Upgrade to Version 8.x in SMP Environments
Starting with SMP **0.44.0**, Harness ships **MongoDB 8.0** for in-cluster MongoDB. Keep the MongoDB Feature Compatibility Version (FCV) upgrade job **enabled** during upgrades so FCV stays aligned with the MongoDB server version. Disabling the job can leave FCV behind the server version and block or break subsequent MongoDB major-version upgrades.
**MongoDB Version History:**
* MongoDB 4.0 was used in versions 0.16.x and earlier.
* MongoDB 5.0 was used in versions 0.17.x through 0.21.x.
* MongoDB 6.0 is used starting from version 0.22.x.
* MongoDB 7.0 is used starting from version 0.33.x.
* MongoDB 8.0 is used starting from version 0.44.x.
**Upgrade Path**
MongoDB does not allow you to skip major versions. Upgrade SMP in order so each MongoDB major version runs before the next.
1. Upgrade to at least SMP 0.17.0 if you are running 0.16.x or earlier. MongoDB does not allow a direct upgrade from MongoDB 4.0 to MongoDB 6.0.
2. Upgrade to at least SMP 0.22.0 if you are running 0.21.x or earlier. MongoDB does not allow a direct upgrade from MongoDB 5.0 to MongoDB 7.0.
3. Upgrade to at least SMP 0.33.0 if you are running a version earlier than 0.33.0. This moves in-cluster MongoDB to 7.0.
4. Upgrade to SMP 0.44.0 or later to move in-cluster MongoDB to 8.0. Do not jump from MongoDB 6.x (SMP 0.22.x through 0.32.x) directly to SMP 0.44.0.
**Harness-Specific Details**
1. **Helm users:** Keep `upgrades.mongoFCVUpgrade.enabled` set to `true` (the default). The job runs pre-upgrade checks and upgrades FCV to match the server version.
2. **Argo CD users:** Run the FCV upgrade job manually before the main upgrade. Do not skip this step when you move across MongoDB major versions (for example, 7.0 to 8.0).
**MongoDB FCV Upgrade Job**
To run the FCV upgrade manually (required for Argo CD users), use this job definition: [mongo-preupgradejob](https://raw.githubusercontent.com/harness/helm-charts/refs/heads/main/examples/mongo-fcv-upgrade/job.yaml).
This job runs as a pre-upgrade hook to ensure FCV is compatible with the MongoDB server version. Harness recommends that you leave the job enabled for Helm upgrades.
**Configuration**
Harness recommends that you keep the FCV upgrade job enabled:
```yaml
upgrades:
mongoFCVUpgrade:
enabled: true
```
Disable the job only if you intentionally manage FCV yourself. If you disable it, upgrade FCV manually to the MongoDB server major version before the next SMP upgrade that ships a newer MongoDB major version.
```yaml
upgrades:
mongoFCVUpgrade:
enabled: false
```
{% endhint %}
Warning: Harness Self-Managed Platform v0.36.0 is transitioning from TimescaleDB to PostgreSQL
Harness Self-Managed Platform [v0.36.0](#version-0360) is transitioning from TimescaleDB to PostgreSQL. This change is designed to improve reliability, scalability, and long-term maintainability of the platform.
Please follow the prerequisites and instructions [here](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/migrate-timescaledb-to-postgresql.md) to prepare your environment for the migration. During this transition, existing data is migrated automatically using a dedicated migration process. No manual action is required from customers during migration. However, we strongly recommend validating your deployment after the upgrade to ensure dashboards, metrics, and reports behave as expected.
If you have custom integrations, queries, or monitoring workflows that depend on TSDB-specific behavior, review them carefully after the upgrade.
**CRITICAL:** Once you have successfully upgraded to SMP 0.36.0, do not re-run the Helm upgrade command (`helm upgrade`) for version 0.36.0 again. Re-running the upgrade can cause issues with the migration process, resulting in data loss.
If you encounter any issues after the initial upgrade, contact [Harness Support](https://support.harness.io) for assistance before taking any further action.
Warning: TimescaleDB removed from version 0.37.0 onwards
**TimescaleDB has been completely Removed** starting from Harness SMP version **0.37.0**. The migration from TimescaleDB to PostgreSQL is performed in version **0.36.x**.
**Upgrading through 0.36.x is mandatory.** You cannot skip this version when upgrading to 0.37.0 or later. If you are running a version prior to 0.36.0, you must first upgrade to 0.36.x to complete the TimescaleDB-to-PostgreSQL migration before proceeding to 0.37.0 or any subsequent release.
Attempting to upgrade directly to 0.37.0 or later without passing through 0.36.x will result in an unsupported state, as the required database migration will not have been performed.
**Other upgrade notices**
These notices are not tied to a single release still shown on this page.
Breaking: Migration notice - Bitnami repository changes
````
Customers directly pulling from `docker.io` registry for Bitnami images and are currently on version `<0.32.0` are affected.
Bitnami has moved many of its container images from the default `bitnami` repository on Docker Hub to a new repository called `bitnamilegacy`.
Since Harness relies on public Bitnami images, customers pulling directly from Docker Hub must update their configuration to point to `bitnamilegacy`.
**Customers using private or air-gapped image sources are not affected.**
**Reference:** [Upcoming changes to the Bitnami catalog (effective August 28th, 2025)](https://github.com/bitnami/charts/issues/28508)
#### Required Override
To ensure compatibility, update your Harness overrides/add additional overrides in your install/upgrade commands as shown below:
```yaml
platform:
bootstrap:
database:
mongodb:
image:
repository: bitnamilegacy/mongodb
postgresql:
image:
repository: bitnamilegacy/postgresql
minio:
image:
repository: bitnamilegacy/minio
clickhouse:
image:
repository: bitnamilegacy/clickhouse
timescaledb:
tsdbarchive:
image:
repository: bitnamilegacy/minio
upgrades:
mongoFCVUpgrade:
image:
repository: bitnamilegacy/mongodb
```
After applying this change, Harness will continue pulling the required Bitnami images without disruption.
#### Example
Save the above override file as `bitnami-migration.yaml`:
```bash
helm upgrade -i harness harness/harness -f override-prod.yaml -f bitnami-migration.yaml
```
````
Info: Important instructions for Argo CD based deployments and upgrades
````
If you’re using Argo CD to deploy Harness with Custom Dashboards (Looker) enabled, you might run into issues during upgrades with the encryption/decryption key. Argo CD re-generates the Looker encryption key with every upgrade because it uses helm template to inflate resources. To avoid this, you need to ensure the key remains consistent across upgrades.
To fix this issue, follow these steps
1. Retrieve the Looker secret using this command:
```bash
kubectl get secrets looker-secrets -o yaml -n
kubectl get secrets harness-looker-secrets -o yaml -n
```
2. Copy the value of lookerMasterKey from the secret looker-secrets and decode it using the following command or any base64 decoder. You’ll need to decode it twice.
It's required to decode the secret value twice because during creation, first it's encoded by the helm function in the charts and then Kubernetes encodes it again while creating the secret.
```bash
echo "" | base64 --decode | base64 --decode
```
3. Copy the decrypted secrets for the following attributes lookerClientId lookerClientSecret lookerEmbedSecret lookerSignupUrl in harness-looker-secrets.
4. After decoding, update your Argo CD values override with the decoded key:
```yaml
platform:
looker:
secrets:
lookerMasterKey: ""
lookerClientId: ""
lookerClientSecret: ""
lookerEmbedSecret: ""
lookerSignupUrl: ""
```
By doing this, you ensure that the same lookerMasterKey is used during upgrades, avoiding encryption issues.
````
## October 2026
### Version 0.48.1
October 22, 2026
**Fixed issues**
**Platform**
* **Fixed white box overlay on SMP dashboards:** Resolved an issue where a white space appeared over the dashboard in Self-Managed Enterprise Edition, blocking access to some buttons. (UDP-5599)
### Version 0.48.0
October 19, 2026
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.161.4 | 1.161.x, 1.159.x, 1.158.x |
| | Log Service | 1.56.1 | - |
| | Test Intelligence Service | 1.80.4 | - |
| DB Devops | DB Devops Service | 1.118.0 | - |
| | Harness DB Migrator | 2.93.0 | - |
| GitOps | GitOps Service | 1.67.3 | - |
| STO | STO Core | 1.214.1 | - |
| | Ticket Service | 1.17.0 | - |
| CCM | CE Nextgen | 1.105.10 | - |
| | Batch Processing | 1.103.10 | - |
| | NG CE UI | 1.101.0 | - |
| | Anomaly Detection | 1.36.0 | - |
| | Telescopes | 1.10.0 | - |
| | Cloud Info | 1.19.0 | - |
| | Event Service | 1.21.0 | - |
| Feature Flags | Feature Flag Service | 1.1243.0 | - |
| | Feature Flag Pushpin Service | 1.1148.0 | - |
| IaCM | IACM Manager | 1.212.2 | - |
| | IAC Server | 1.505.3 | - |
| Code Repository | Code API | 1.106.2 | - |
| | Code GitRPC | 1.106.0 | - |
| | Code GitHA | 1.106.0 | - |
| | Code Search | 1.106.0 | - |
| | Code UI | 1.80.0 | - |
| SSCA | SSCA Manager | 1.74.5 | - |
| | Component Analysis Service | 1.21.1 | - |
| | Component Service | 1.23.2 | - |
| | SSCA UI | 0.60.2 | - |
| Platform | Platform Service | 1.153.0 | - |
| | Access Control | 1.348.1 | - |
| | Audit Event Streaming | 1.117.0 | - |
| | Gateway Service | 1.72.2 | - |
| | NG Auth UI | 1.39.0 | - |
| | NG Dashboard Aggregator | 1.137.0 | - |
| | Policy Management | 1.71.0 | - |
| | Resource Hierarchy Service | 1.60.1 | - |
| | Service Discovery Manager | 0.84.0 | - |
| Resilience testing | Chaos Manager | 1.103.1 | - |
| | Chaos CRD | 1.82.0 | - |
| | Chaos K8s IFS | 1.103.0 | - |
| | Chaos Linux IFC | 1.103.0 | - |
| | Chaos Linux IFS | 1.103.0 | - |
| | Chaos Machine IFS | 1.103.0 | - |
| | Chaos Machine IFC | 1.103.0 | - |
| | Chaos Web | 1.103.4 | - |
| | Load Test Manager | 1.26.0 | - |
| Continuous Delivery | NG Manager | 1.171.5 | [1.171.x](https://developer.harness.io/release-notes/continuous-delivery/continuous-delivery-continuous-delivery#version-11715), [1.169.x](https://developer.harness.io/release-notes/continuous-delivery/continuous-delivery-continuous-delivery#version-11690), [1.168.x](https://developer.harness.io/release-notes/continuous-delivery/continuous-delivery-continuous-delivery#version-11684) |
| | NG Custom Dashboards | 1.132.0 | - |
| | Pipeline Service | 1.209.1 | [1.209.x](https://developer.harness.io/release-notes/continuous-delivery/pipeline-continuous-delivery#pipeline-service-12091), [1.208.x](https://developer.harness.io/release-notes/continuous-delivery/pipeline-continuous-delivery#pipeline-service-12080), [1.207.x](https://developer.harness.io/release-notes/continuous-delivery/pipeline-continuous-delivery#pipeline-service-12071) |
| | Harness Manager | 1.170.3 | - |
| | Template Service | 1.171.0 | - |
| | Queue Service | 1.16.0 | - |
| | Debezium Service | 1.28.0 | - |
| | Delegate Proxy | 1.9.0 | - |
| | Delegate Version (Immutable) | 26.09.90107 | - |
| Others | Helm Chart | [0.48.0](https://github.com/harness/helm-charts/releases/tag/harness-0.48.0) | - |
| | Air Gap Bundle | [0.48.0](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.48.0) | - |
| | Bootstrap | 1.85.0 | - |
| | Change Data Capture | 1.68.0 | - |
| | Looker | 1.28.5 | - |
| | UI | 1.36.3 | - |
| | SCM Service | 1.67.0 | - |
| | Next Gen UI | 1.158.4 | - |
| | CV Nextgen | 1.74.1 | - |
| | LE Nextgen | 1.23.1 | - |
| | SRM UI | 1.16.2 | - |
| | Envoy Gateway | 1.14.0 | - |
| | Kafka Operator | 1.15.4 | - |
| | Kafka Platform | 2.12.1 | - |
| | Kafka Resources | 1.108.0 | - |
| | Kafka Connect Strimzi | 1.113.1 | - |
| | Schema Registry | 1.12.2 | - |
| Artifact Registry | Registry API | 1.106.2 | - |
| | Registry Async Service | 1.63.0 | - |
| | IPQS Service | 1.13.0 | - |
| | Registry Processor | 1.78.0 | - |
| Unified Data Platform | Config Service | 0.1.170 | - |
| | Schema Service | 0.24.0 | - |
| | Onboarding Service | 0.14.26 | - |
| | Query Service | 0.68.0 | - |
| | Dashboard UI | 1.94.1 | - |
| GenAI | MCP Server Internal | 1.181.0 | - |
| | MCP Server External | 1.161.0 | - |
{% hint style="info" %}
**New: GenAI MCP servers**
Harness is onboarding a new GenAI module, starting with the MCP Server Internal and MCP Server External services in this release. These services expose Harness functionality to AI assistants and agents through the Model Context Protocol (MCP).
{% endhint %}
**New features and enhancements**
**Continuous Delivery**
* **Pods tab for Kubernetes deployments:** Kubernetes Rolling, Canary, and Blue/Green steps now include a Pods tab on the pipeline execution, at the execution level and on each step, listing pod phase, readiness, restarts, and a diagnostic reason, and letting you inspect a pod's summary, status timeline, events, and logs, including after Kubernetes deleted the pod. This feature requires the feature flag `CDS_K8S_POD_LOGS`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-129791]
* **Helm Dry Run step:** Added support for the Helm Dry Run step for Native Helm deployment stages. The step runs `helm upgrade --install --dry-run` against the target cluster and returns the rendered manifests, hooks, and notes as a step outcome, without installing or changing anything in the cluster, providing parity with the Kubernetes Dry Run step. This feature requires the feature flag `CDS_HELM_DRY_RUN_STEP`. Contact [Harness Support](mailto:support@harness.io) to enable.
* **Custom Log health source for AI Verify:** Added support for a Custom Log health source. You can select a Custom Health connector and configure the query specification manually to collect logs for verification. AI-assisted setup is not available for this health source type.
* **Passed with warning execution status:** Pipelines now support a Passed with warning execution status, so a stage or step can complete with warnings instead of failing outright. This feature requires the feature flag `PIPE_ENABLE_PASSED_WITH_WARNING_STATUS`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-36928]
* **Notification-rule overrides for templates:** Templates now support notification-rule overrides, so a pipeline that uses a template can override the notification rules defined in that template without modifying the template itself. \[PIPE-36490]
* **Two-level insert nesting for pipeline YAML:** Added support for two-level insert nesting, allowing nested insert operations when constructing pipeline stages and steps dynamically. \[PIPE-36070]
**GitOps**
* **Execution Strategies panel:** The pipeline execution view now includes an Execution Strategies panel for GitOps CD stages, showing the sync strategy, sync waves, and health status of each Argo CD application involved in the deployment. \[CDS-127575]
* **Readable Argo CD AppProject names:** Harness GitOps now generates readable Argo CD AppProject names based on the Harness project and environment, instead of a generated identifier, making AppProjects easier to recognize in the Argo CD UI. To opt out and keep the previous naming behavior, enable the feature flag `CDS_GITOPS_READABLE_APP_PROJECT_NAMING_DISABLED`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-130632]
**Cloud Cost Management**
* **Hash-based cost category stamping during data ingestion:** Added support for hash-based slowly changing dimension (SCD) cost category stamping during data ingestion for AWS, GCP, and cluster data. This feature requires the feature flag `CCM_COST_CATEGORY_SCD_INGESTION`. Contact [Harness Support](mailto:support@harness.io) to enable. Without the flag, ingestion stamping works as before. The flag does not affect back-fills that you start through the API; those back-fills are controlled by the `scdEnabled` field in the request.
* **Hash-based cost category back-fill API:** Updated the `POST /ccm/api/business-mapping-back-fill/backfill-v2` API.
* Pass `"scdEnabled": true` in the request body to use hash-based stamping.
* Set `updateAllCloudProviders` to `false` and set `cloudProvider` to `AWS`, `GCP`, or `CLUSTER` to back-fill a single provider.
* For AWS, `cloudProviderAccountIds` is now optional. Omit it to back-fill every AWS account in the date range. For GCP and cluster, `cloudProviderAccountIds` is still required. Provide billing account IDs, subscription IDs, or cluster IDs.
* The API now returns immediately with an `Acknowledged` message and an execution ID. Previously, it waited until the back-fill finished. Go to `GET /ccm/api/business-mapping-back-fill/metadata-v2?executionId=` to track progress until `status` is `SUCCESS` or `FAILED`.
* Only one hash-based back-fill can run for an account at a time. Harness rejects a second request and returns the execution ID of the back-fill in progress. An entry that stays in progress for more than 12 hours no longer blocks new requests.
* `startDate` must be the first day of a month and `endDate` must be the last day of a month, in `yyyy-MM-dd` format. `accountId` in the request body must match `accountIdentifier` in the URL.
The following example starts an AWS back-fill for all accounts with hash-based stamping:
```bash
curl -X POST "https:///ccm/api/business-mapping-back-fill/backfill-v2?accountIdentifier=" \
-H "x-api-key: " \
-H "Content-Type: application/json" \
-d '{
"accountId": "",
"cloudProvider": "AWS",
"updateAllCloudProviders": false,
"startDate": "2026-08-01",
"endDate": "2026-08-31",
"scdEnabled": true
}'
```
The response contains the execution ID:
```json
{ "resource": "Acknowledged backFill request. Cost category back-fill is in progress. Execution Id: " }
```
The following example checks the progress of the back-fill:
```bash
curl "https:///ccm/api/business-mapping-back-fill/metadata-v2?accountIdentifier=&executionId=" \
-H "x-api-key: "
```
The response includes `status` (`IN_PROGRESS`, `SUCCESS`, or `FAILED`), `executionStartAt`, and `executionEndAt`.
* **GCP data pipeline job image upgrade:** Upgraded the GCP Kubernetes job image. Update the tag to `1000138` in the batch-processing service override YAML.
```yaml
imageGCPDataPipeline:
tag: "1000138"
```
**Continuous Integration**
* **Git secrets scoped to the Clone Codebase step:** Added the feature flag `CI_RESTRICT_GIT_SECRETS_TO_CLONE_STEP`. When enabled, the git secret configured on a codebase connector is scoped to the Clone Codebase step only, and is no longer exposed to other build steps in the stage. Contact [Harness Support](mailto:support@harness.io) to enable. \[CI-24647]
* **Python cache support for Cache Intelligence:** Added Python cache support to Cache Intelligence, extending zero-config caching alongside existing npm support. \[CI-24886]
* **Maven proxy settings from environment variables:** Added support for injecting Maven HTTP(S) proxy settings from environment variables, so Maven builds pick up proxy configuration automatically. \[CI-24813]
* **Native Harness Cloud Build access controls:** Added native Harness Cloud Build access controls at the account, organization, and project level, including a clearer error message when a build is denied. \[CI-24307]
* **Hide script text in execution logs:** Added the ability to hide the script text displayed in execution logs by default, so Run step script content is not shown in log output. \[CI-24063]
* **Tailscale regional routing:** Simplified Tailscale onboarding by adding support for regional routing during private connectivity setup. \[CI-24728]
**Security Testing Orchestration**
* **Exemption filters, EPSS, and bulk exemptions are now generally available:** Issue EPSS scoring, exemption filters, aggregate retry executions, aggregate chain executions, and bulk exemption creation were previously behind the feature flags `STO_ISSUE_EPSS`, `STO_EXEMPTION_FILTERS`, `STO_AGGREGATE_RETRY_EXECUTIONS`, `STO_AGGREGATE_CHAIN_EXECUTIONS`, and `STO_ENABLE_BULK_EXEMPTION`, and are now generally available. No feature flag and no opt-in is required. \[STO-13236, STO-13250]
**Database DevOps**
* **Scoped token support:** Worker Agents can now use appropriately scoped access when calling Database DevOps APIs, instead of broader credentials.
* **Liquibase lock recovery:** Added support for configuring lock stealing, so you can recover from stale Liquibase locks.
**GenAI**
* **MCP servers onboarded:** Introduced the MCP Server Internal and MCP Server External services under a new GenAI module, exposing Harness functionality to AI assistants and agents through the Model Context Protocol (MCP).
**Fixed issues**
**Continuous Delivery**
* **Delegate truststore now honored for HTTP step mTLS:** Fixed an issue where the HTTP step, when configured with a client certificate and private key for mutual TLS, validated the server certificate against the default JDK truststore and ignored the delegate JVM truststore override (`javax.net.ssl.trustStore`). The step now uses the delegate truststore, consistent with other delegate SSL tasks. \[CDS-129991, ZD-120323]
* **Google Cloud Run step can read OIDC token claims:** Fixed an issue where the Google Cloud Run step could not read OIDC token claims from a GCP connector, including the pipeline identifier, environment name, and environment type. Those claims are now available to the step, consistent with other steps that use the same connector. \[CDS-132413, ZD-123855]
* **Service Hooks respected the feature flag:** Fixed an issue where Service Hooks configuration was visible when the feature flag was disabled, and the Add Service Hook list included hook types the deployment type does not support. The Service Hooks UI now shows only when the flag is enabled, and only supported hook types appear. This fix requires the feature flag `CDS_UNIFIED_SERVICE_HOOKS`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-130834]
* **TAS artifact bundle extraction validated:** Fixed a security issue where TAS artifact bundles containing archive entries that resolve outside the extraction directory, or symlinks that point outside the bundle, were extracted without validation. Harness now validates artifact bundle extraction and logs a warning in the step logs for each affected entry. To enforce validation and fail deployments that use affected bundles, enable the feature flag `CDS_TAS_ARTIFACT_BUNDLE_PATH_VALIDATION`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-131042]
* **Artifact trigger creation for template pipelines:** Fixed an issue where creating an artifact trigger through the API failed for template pipelines that use runtime inputs for the service and artifact, because `withServiceV2` could not be set. The API now defaults `withServiceV2` to `true` when you create an artifact trigger. \[ZD-123257]
* **Helm Dry Run step command flags:** Fixed an issue where the Dry Run step with a Native Helm deployment returned an error when you saved a pipeline with command flags, and showed incorrect Command Type options. This fix requires the feature flag `CDS_HELM_DRY_RUN_STEP`. Contact [Harness Support](mailto:support@harness.io) to enable.
* **ASG Setup with mixed instances policy:** Fixed an issue where the ASG Setup step failed with an `AutoScalingException` when the ASG manifest used a `mixedInstancesPolicy`. The step now supports `mixedInstancesPolicy` during base setup. This fix requires the feature flag `CDS_ASG_MIXED_INSTANCES_POLICY`. Contact [Harness Support](mailto:support@harness.io) to enable. \[ZD-122841]
* **Email step and inherited user groups:** Fixed an issue where the Email step did not notify user groups inherited into a project from the parent organization or account scope. The step now resolves inherited user groups and notifies their members. \[ZD-121123]
* **KUBECONFIG exported for service hooks:** Fixed an issue where Kubernetes and Helm service hooks did not export the `KUBECONFIG` environment variable, so hook scripts that ran `kubectl` or `helm` directly could use the wrong cluster context. Service hooks now export `KUBECONFIG` with the kubeconfig path. \[ZD-124550]
* **Scoped connector reference for Custom Deployment:** Fixed an issue where an infrastructure variable of type connector returned only the connector identifier, without the scope, for organization-level connectors in Custom Deployment. You can now use `<+infra.variables.var_name.scopedIdentifier>` to get the scoped connector reference. \[ZD-125113]
* **AWS connector OIDC session tags via expression:** Fixed an issue where AWS connector OIDC session tags were dropped when you fetched the token using the `<+connectorInputs.get().oidcToken>` expression. The session tags configured on the connector are now forwarded. \[ZD-125101]
* **ASG phased deployment scale-down target:** Fixed an issue where an ASG phased deployment scaled down the wrong Auto Scaling Group when another pipeline used a base name with the same prefix. \[ZD-125140]
* **Pipeline execution counts in notifications:** Fixed an issue where the pipeline execution counts in a notification did not match the executions shown at the project level. \[ZD-122518]
* **Azure Cloud Provider connector default environment type:** Fixed an issue where creating an Azure Cloud Provider connector, without specifying an Azure environment type, failed with a generic JSON unmarshaling error that masked the real API failure. Harness now applies the documented default environment type, and surfaces the underlying error message and code when connector creation fails. \[ZD-123605]
* **Kustomize remote resource fetch timeout configurable:** Fixed an issue where Kustomize manifest rendering used a hardcoded 60-second timeout to fetch remote resources, causing deployments to fail when a kustomization referenced remote bases over a slow network, or large repository. You can now configure this timeout per delegate using the `KUSTOMIZE_COMMAND_TIMEOUT` environment variable. Upgrade your delegate to version 26.10.902 or later to use this setting. \[ZD-125341]
* **Re-run slideout latency with many template inputs:** Fixed an issue where re-running an execution from a failed stage with the Re-run slideout caused high latency when the pipeline used templates with many runtime inputs, because all template inputs were fetched together. Template inputs are now batched for the Re-run slideout. This fix requires the feature flag `PIPE_BATCH_TEMPLATE_INPUTS_FETCH`.
* **Nested child pipeline failure messages:** Fixed an issue where a chained pipeline that failed in a nested child pipeline showed a generic error message instead of the actual failure reason from the nested pipeline. \[ZD-121859]
* **Aborting a stuck execution:** Fixed an issue where aborting a stuck pipeline execution did not always transition the execution to the Aborted status, leaving it stuck in a running state. \[ZD-123431]
* **Auto-abort reason clarity:** Fixed an issue where the auto-abort reason shown for an execution did not clearly state why the execution was aborted. \[ZD-125211]
* **GitLab webhook events dropped during trigger rollout:** Fixed an issue where a GitLab webhook event could be dropped during a trigger rollout, causing a pipeline to fail to trigger for a valid push or merge event. \[ZD-125422]
* **Git Experience bulk reconciliation target branch validation:** Fixed an issue where Git Experience bulk reconciliation did not validate the target branch, allowing reconciliation against an invalid or non-existent branch. \[ZD-125903]
* **Execution details API reliability:** Fixed an issue where the execution details API intermittently returned a 401 and had elevated latency under load. \[ZD-123957]
* **Execute permission enforced for runtime execution inputs:** Fixed an issue where a user without execute permission on a pipeline could still trigger execution of an `<+input>.executionInput()` runtime input through the API, bypassing RBAC. \[ZD-124132]
* **Step group notification rules:** Fixed an issue where notification rules configured at the step group level did not fire for steps nested inside the step group. \[PIPE-36657]
* **Matrix strategy maxConcurrency expression:** Fixed an issue where a matrix stage strategy with an expression-based `maxConcurrency` evaluated the expression incorrectly, running more concurrent instances than intended. \[PIPE-37032, ZD-122931]
* **Barrier step deadlock with skipped parallel stage:** Fixed an issue where a barrier step used across parallel stages in a chained pipeline could deadlock when one of the stages was skipped by a conditional execution. \[PIPE-37269, ZD-123360]
* **Secret pipeline variables from step group templates:** Fixed an issue where pipeline variables of type secret were not resolved correctly when referenced from a step group template. \[PIPE-37438, ZD-124602]
* **Execution list API stale status:** Fixed an issue where the execution list API returned stale status for executions that transitioned state while the list was being fetched. \[PIPE-37510]
**GitOps**
* **gRPC dependency security fixes:** Fixed security vulnerabilities in the gRPC dependencies used by the GitOps Agent. \[CDS-132528, CDS-131480]
* **go-git cryptography vulnerability:** Fixed a cryptography vulnerability in the go-git library used by the GitOps Agent. \[CDS-130438]
* **AppProject identifier collisions:** Fixed an issue where an Argo CD AppProject identifier could collide with an existing AppProject when two Harness environments mapped to similarly named projects. \[CDS-131190]
* **Helm release name collisions through GitOps:** Fixed an issue where a Helm chart deployed through GitOps could collide with another release's Argo CD release name, causing one release to overwrite resources belonging to another. \[CDS-127100]
* **SMP GitOps chart default policy-management secret:** Fixed an issue where the SMP GitOps chart deployed with a default policy-management secret instead of requiring one to be explicitly configured. \[CDS-131895]
* **Unnecessary pod rollout annotation on sync:** Fixed an issue where Harness added an unnecessary pod rollout annotation on every sync, causing pods to restart even when no actual change was made to the workload. \[CDS-131333]
**Continuous Integration**
* **Cache Intelligence trailing space in Maven config:** Fixed an issue where Cache Intelligence wrote a trailing space into the `maven.repo.local` argument in `.mvn/maven.config`. `maven-release-plugin` validates this value verbatim, so any pipeline running `release:prepare` with Cache Intelligence enabled failed. \[CI-24805]
* **JUnit report-summary output variables dropped on failure:** Fixed an issue where a Run step configured with a JUnit `reports` block dropped its report-summary output variables (`total_tests`, `successful_tests`, `failed_tests`, `skipped_tests`, `duration_ms`) whenever the step failed. These variables are now populated on both success and failure. \[CI-24688, ZD-123950]
* **Test Intelligence skip attribution for dotnet/xUnit:** Fixed an issue where the tests dashboard showed `Skipped by TI: 0` for dotnet/xUnit tests that Test Intelligence skipped, attributing the skips to the test framework instead of TI. \[CI-24445, ZD-122775]
* **Clone Codebase step fetched PR head ref instead of branch name:** Fixed an issue where the Clone Codebase step in v1 pipelines fetched the PR head ref (`refs/pullreq//head`) instead of the source branch name, causing later steps that depend on the branch name to fail. \[CI-24516]
* **Delete cache API failure for Cache Intelligence:** Fixed an issue where the delete cache API in the CI gateway failed for Cache Intelligence caches. \[CI-24959]
* **Build and Push step DLC cache miss fallback:** Fixed an issue where the Build and Push step with Docker Layer Caching hard-failed with a "blob not found" (404) error during `COPY` instead of falling back to a cache miss. \[CI-24771, ZD-124240, ZD-125159]
* **PR number sync to dashboard widget:** Fixed an issue where PR number data did not sync to the dashboard widget for the `ci:repository` resource after PR creation. \[CI-24440]
* **Container Step timeout waiting on shutdown signal:** Fixed an issue where the Container Step could time out because the add-on waited on the container shutdown signal before reporting step status. \[CI-24625, ZD-123267]
* **GCS SaveCache step error on freshly created bucket:** Fixed an issue where the GCS SaveCache step exited with an error on the object-existence check after a cache bucket was freshly created. \[CI-25043]
**Security Testing Orchestration**
* **External Tickets with a Jira Personal Access Token connector:** Fixed an issue where, on SMP, opening External Tickets for a Jira connector that uses a Personal Access Token could leave the project list empty, because ticket-service stopped reading the token before it called Jira. This affected on-prem Jira Server and Data Center connectors, including account-scoped connectors. External Tickets now accepts that connector: project list, issue types, ticket creation, and comments use the token as a bearer token. Username-and-password connectors are unchanged. \[STO-13269]
**Self-Managed Enterprise Edition**
* **Global shared secret is now the default:** Added the global shared secret and services secrets mapping overrides in the Harness SMP chart as the default, instead of requiring an override. Previously, each service held its own JWT token in its own secret, created by that service. After this change, Harness creates a single global secret, and all services reference it for a shared JWT token, causing a one-time secret rotation for existing customers upgrading to 0.48.0. If you deploy with Argo CD, add the new global shared secret to your diff-ignore configuration before upgrading, or Argo CD will rotate these secrets on every upgrade. \[CLI-66526]
**Database DevOps**
* **Echo framework security fix:** Updated the Echo framework, addressing CVE-2026-55677.
### Version 0.47.2
October 12, 2026, Version 0.47.2
October 12, 2026
**New features and enhancements**
**Dashboards**
* **Out-of-the-box dashboards in the New Dashboard Experience:** Added dashboards for Security Testing Orchestration (STO) usage, DORA metrics, deployments, services, and build insights. \[UDP-5617]
**Feature improvements**
**Dashboards**
* **Dashboard data export controls:** Added support for disabling dashboard data exports in Self-Managed Enterprise Edition. \[UDP-5617]
### Version 0.46.2
October 8, 2026, Version 0.46.2
October 8, 2026
**Fixed issues**
**Continuous Delivery**
* **Subscription page restored after build 0.46.1 regression:** Restored the `CDS_NG_SUBSCRIPTION_PAGE_V2` feature that was inadvertently removed in build 0.46.1, which caused the subscription page to revert to the legacy experience. \[CDS-133255]
### Version 0.47.0
October 1, 2026, Version 0.47.0
October 1, 2026
{% hint style="warning" %}
**FIPS compatibility**
Releases 0.44.2, 0.47.0, and 0.48.0 are FIPS compatible. Releases 0.44.0, 0.44.1, 0.45.x, and 0.46.x are not. If your environment requires FIPS compliance, upgrade to 0.44.2, 0.47.0, or 0.48.0. Contact [Harness Support](mailto:support@harness.io) for guidance on FIPS-compatible options.
{% endhint %}
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.157.1 | [1.156.x](/release-notes/continuous-integration.md#version-11560), [1.155.x](/release-notes/continuous-integration.md#version-11550) |
| | Log Service | 1.52.3 | - |
| | Test Intelligence Service | 1.79.5 | - |
| DB Devops | DB Devops Service | 1.115.1 | [1.114.x](/release-notes/database-devops.md#release-1114x), [1.113.x](/release-notes/database-devops.md#release-1113x) |
| GitOps | GitOps Service | 1.66.5 | [1.66.x](https://developer.harness.io/release-notes/continuous-delivery/gitops-continuous-delivery#gitops-service-1665-gitops-agent-01261) |
| STO | STO Core | 1.210.3 | - |
| | Ticket Service | 1.16.0 | - |
| CCM | CE Nextgen | 1.103.6 | [1.103.0](/release-notes/cloud-cost-management.md#september-2026-version-11030) |
| | Batch Processing | 1.101.7 | - |
| | NG CE UI | 1.99.3 | - |
| | Anomaly Detection | 1.33.0 | - |
| | Telescopes | 1.10.0 | - |
| | Cloud Info | 1.19.0 | - |
| | Event Service | 1.21.0 | - |
| Feature Flags | Feature Flag Service | 1.1237.0 | - |
| | Feature Flag Pushpin Service | 1.1148.0 | - |
| IaCM | IACM Manager | 1.202.0 | - |
| | IAC Server | 1.494.0 | - |
| Code Repository | Code API | 1.103.3 | - |
| | Code GitRPC | 1.103.0 | - |
| | Code GitHA | 1.103.0 | - |
| | Code Search | 1.103.0 | - |
| | Code UI | 1.55.0 | - |
| SSCA | SSCA Manager | 1.72.5 | [v1.71.0](/release-notes/software-supply-chain-assurance.md#version-v1710-plugin-version-v0670) |
| | Component Analysis Service | 1.19.1 | - |
| | Component Service | 1.21.1 | - |
| | SSCA UI | 0.58.1 | - |
| Platform | Platform Service | 1.149.1 | [1.149.x](/release-notes/platform.md#version-1149x), [1.148.x](/release-notes/platform.md#version-1148x), [1.147.x](/release-notes/platform.md#version-1147x) |
| | Access Control | 1.342.0 | - |
| | Audit Event Streaming | 1.114.0 | - |
| | Gateway Service | 1.72.2 | - |
| | NG Auth UI | 1.39.0 | - |
| | NG Dashboard Aggregator | 1.133.0 | - |
| | Policy Management | 1.68.0 | - |
| | Service Discovery Manager | 0.82.0 | - |
| Resilience testing | Chaos Manager | 1.101.6 | - |
| | Chaos CRD | 1.82.0 | - |
| | Chaos K8s IFS | 1.101.1 | - |
| | Chaos Linux IFC | 1.101.0 | - |
| | Chaos Linux IFS | 1.101.0 | - |
| | Chaos Machine IFS | 1.101.0 | - |
| | Chaos Machine IFC | 1.101.0 | - |
| | Chaos Web | 1.101.3 | - |
| | Load Test Manager | 1.24.3 | - |
| Continuous Delivery | NG Manager | 1.167.5 | [1.167.x](https://developer.harness.io/release-notes/continuous-delivery/continuous-delivery-continuous-delivery#version-11672), [1.166.x](https://developer.harness.io/release-notes/continuous-delivery/continuous-delivery-continuous-delivery#version-11663), [1.165.x](https://developer.harness.io/release-notes/continuous-delivery/continuous-delivery-continuous-delivery#version-11655) |
| | NG Custom Dashboards | 1.130.0 | - |
| | Pipeline Service | 1.206.4 | [1.206.x](https://developer.harness.io/release-notes/continuous-delivery/pipeline-continuous-delivery#pipeline-service-12063), [1.205.x](https://developer.harness.io/release-notes/continuous-delivery/pipeline-continuous-delivery#pipeline-service-12052), [1.204.x](https://developer.harness.io/release-notes/continuous-delivery/pipeline-continuous-delivery#pipeline-service-12042) |
| | Harness Manager | 1.166.4 | - |
| | Template Service | 1.168.0 | - |
| | Queue Service | 1.16.0 | - |
| | Debezium Service | 1.28.0 | - |
| | Delegate Proxy | 1.9.0 | - |
| | Delegate Version (Immutable) | 26.08.89805 | - |
| Others | Helm Chart | [0.47.0](https://github.com/harness/helm-charts/releases/tag/harness-0.47.0) | - |
| | Air Gap Bundle | [0.47.0](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.47.0) | - |
| | Bootstrap | 1.81.0 | - |
| | Change Data Capture | 1.66.0 | - |
| | Looker | 1.28.5 | - |
| | UI | 1.36.3 | - |
| | SCM Service | 1.66.1 | - |
| | Next Gen UI | 1.154.1 | - |
| | CV Nextgen | 1.74.0 | - |
| | LE Nextgen | 1.23.1 | - |
| | SRM UI | 1.16.2 | - |
| | Envoy Gateway | 1.12.0 | - |
| | Kafka Operator | 1.15.4 | - |
| | Kafka Platform | 2.12.1 | - |
| | Kafka Resources | 1.102.2 | - |
| | Kafka Connect Strimzi | 1.102.0 | - |
| | Schema Registry | 1.12.2 | - |
| Artifact Registry | Registry API | 1.99.2 | - |
| | Registry Async Service | 1.56.2 | - |
| | IPQS Service | 1.9.0 | - |
| | Registry Processor | 1.71.1 | - |
| Unified Data Platform | Config Service | 0.1.166 | - |
| | Schema Service | 0.23.0 | - |
| | Onboarding Service | 0.12.11 | - |
| | Query Service | 0.65.0 | - |
| | Dashboard UI | 1.80.0 | - |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, go to the **Version 0.38.x and later** tab in [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) to download airgap bundles using the interactive scripts, organize the core modules and execution components, and push them to your private container registry.
**New features and enhancements**
**Harness Platform**
* Added an **Urgent** priority option when raising support tickets directly from the Harness Platform UI. Customers can now submit production-impacting outages or critical security incidents with confirmation according to the [Harness Support Policy SLA](https://www.harness.io/legal/support-policy-sla). \[PL-71151]
* Added a **Transaction History** section in the Subscriptions & Billing settings, allowing account administrators to review historical transactions and payment statuses directly in the UI. \[PL-73068]
**Continuous Delivery**
* CloudWatch health sources now support **OIDC authentication** for AWS connectors. You can authenticate using short-lived identity tokens instead of storing long-lived access keys, so Harness exchanges an OIDC token for temporary AWS credentials at runtime. This applies to both CloudWatch Logs and CloudWatch Metrics health sources. \[CDS-121876]
* ECS Blue/Green deployments (Inherit mode) now support **automatic downsizing of the old service** after 100% traffic shift. When you enable the **Downsize old service** option, Harness removes auto-scaling policies, deregisters the scalable target, and sets the desired task count to zero on the old service, eliminating idle container costs. You can optionally specify a grace period in seconds. This feature requires the feature flag `CDS_ECS_BG_TRAFFIC_SHIFT_DOWNSIZE_OLD_SERVICE`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-128836]
* Harness Continuous Verification (CV) now provides a detailed concepts guide explaining how log verification classifies errors, covering how log lines are tokenized, how Harness learns similarity patterns from your own baseline logs, how the similarity score determines a known versus a new error, and how the **Sensitivity** setting tunes that threshold. \[CDS-127731]
* Harness now supports importing an existing AI agent already running on Google Agent Runtime or AWS Agent Core as an Agent Service, without redeploying it. Harness discovers the agent on the runtime, registers it as an Agent Service, and lets users manage, promote, and roll back the agent through Harness pipelines going forward. This feature requires the feature flag `CDS_AGENT_RUNTIME_DEPLOYMENT`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-128443]
* The AI Verify (v1) step now supports a **No Data** fail-fast criteria type for metric health sources and a per-query fail-fast toggle for log health sources. For metrics, you can set a **Fail if no data until** window so verification terminates immediately if a metric produces no data points, instead of waiting out the full analysis duration. For logs, enabling the **Fail Fast** toggle on a query terminates verification immediately when an unknown log cluster is detected, instead of waiting for the complete analysis window. \[CDS-129083]
**GitOps**
* The **Update Release Repo** step now supports GitHub commit status checks, posting pipeline and stage execution status directly to pull requests so you can track deployment outcomes in your Git provider. \[CDS-116930]
* The **Deployment Repository** manifest on GitOps services is deprecated and will stop working on **October 4, 2026**. Migrate to **App Set Reference** before then. \[CDS-119470]
* The **Update Release Repo** step now automatically cleans up temporary branches after both successful and failed pipeline executions. \[CDS-125232]
* The **Update Release Repo** step now supports pattern-based **File Path** matching, so a single service can update multiple files (using `*`, `**`, and `!` patterns) and raise one PR instead of requiring a separate service per file. \[CDS-125258]
* GitOps now supports custom Helm release names for agent installations, allowing you to avoid naming conflicts across deployments. \[CDS-129687]
* GitOps now supports custom annotations and labels for clusters, enabling better organization and filtering. \[CDS-128986]
* The GitOps UI now includes an **App of Apps** tab that provides a dedicated view for managing parent-child application relationships. \[CDS-128984]
* The GitOps agent now supports JEXL expressions. \[CDS-119967]
* The GitOps agent and service now bundle ArgoCD 3.5.1. \[CDS-128064]
**Pipelines**
* Harness now supports configuring policy sets to run on your own infrastructure instead of Harness SaaS. Use this when policies need secrets or tokens for external systems, process large evaluation payloads, or use Rego network builtins such as `http.send` and `net.lookup_ip_addr`. This feature was previously behind the feature flag `OPA_RUN_ON_CUSTOMER_INFRA` and is now generally available for policy sets configured for **Pipeline** entity type with the **On Run** action. \[PIPE-37387]
* Harness now removes the Rego network builtins `http.send` and `net.lookup_ip_addr` from OPA capabilities when policies are evaluated on Harness SaaS. Policies that need these builtins must run on your own infrastructure. This behavior was previously behind the feature flag `OPA_BLOCK_NETWORK_BUILTINS` and is now generally available. \[PIPE-37414]
* Harness now shows a **Pipeline Timeout** column on the **Executions** page list view, providing visibility into each pipeline execution's configured timeout and making it easier to understand when an execution is expected to time out. \[PIPE-36313]
* Harness now strips OPA policy evaluation outputs larger than half the input size and replaces them with a placeholder recording the removed size, preventing database bloat from oversized outputs. Policy status, deny messages, severity, and evaluation results remain unaffected. This feature is behind the feature flag `PIPE_OPA_STRIP_LARGE_OUTPUT_FROM_POSTGRES`. Contact [Harness Support](mailto:support@harness.io) to enable.
**Continuous Integration**
* Added zero-config npm caching to Cache Intelligence. Node.js and npm projects are now cached automatically, with no custom path configuration required, reducing dependency install time on repeat builds. \[CI-24147]
* Added OIDC authentication support to the Artifactory Upload step. You can now upload artifacts to JFrog Artifactory using an OIDC-authenticated Artifactory connector, instead of requiring username-and-password or anonymous credentials. \[CI-24560, ZD-122881]
* Added AWS session tag support for Workload Identity. When authenticating to AWS with Workload Identity, session tags configured on the connector are now propagated to the assumed role. \[CI-24636]
**Resilience Testing**
* Made risk counts clickable, so selecting a count takes you straight to the matching filtered risks view instead of making you rebuild the filter by hand.
* Added severity sorting to the scanned risks list, so you can order risks by severity and work through the highest ones first.
* Reorganized and streamlined the risk scan statuses, so a scan reports one consistent status across the scan list, the details page, and the API.
* Updated the pipeline and infrastructure scan details pages with a reworked top-row risk card that summarizes the risks found by the scan.
* Added risk rule support to Chaos Probe templates, so a template can carry its risk rules instead of requiring you to attach them after you create the probe.
* Added access control for scans, so scan actions honor the roles and resource groups assigned in Harness.
* Added the pipeline service identity to the application manifest and to scanned risks, which ties a risk back to the service that produced it.
* Added infrastructure and environment identities for Harness CD services, so a scanned CD service resolves to the correct infrastructure and environment.
* Updated the routing from Chaos to pipelines so a pipeline opens in the unified view.
* Moved chaos timeline entity details into a right side panel instead of a bottom sheet, which leaves the timeline visible while you inspect an entity.
* Added per-endpoint and per-task statistics for k6 load tests, so a k6 run reports the same endpoint-level breakdown as the other engines.
* Added P50, P95, and P99 latencies to the load test banner for Locust and JMeter runs.
* Added color-coded request method badges to Endpoint Statistics for every load test engine, so GET, POST, PUT, and DELETE rows are distinguishable at a glance.
**Fixed issues**
**Harness Platform**
* Fixed an issue where the `HARNESS_TOKEN` was not injected during pipeline execution for users who reached their personal API key limit. \[PL-76433]
* Fixed an authorization issue where saving secrets triggered a `401 Unauthorized` error during Open Policy Agent (OPA) policy evaluation in `policy-mgmt`. \[PL-74287]
**Continuous Delivery**
* Fixed an issue where CloudFormation Stack Set deployments with many target accounts timed out due to the delegate scanning all stack instances sequentially before the deployment step started, causing the step to exceed the default timeout before it could report progress. The deployment now starts immediately and scans instances in parallel, unblocking pipelines with hundreds of target accounts. \[CDS-128201]
* Fixed an issue where an ASG blue-green deployment failed during the **Swap Target Groups** step when the pipeline included multiple Elasticache clusters in the infrastructure YAML. The step returned `StackOverflowError: null` and terminated the pipeline. \[CDS-128717]
* Fixed an issue where Azure Kubernetes Service (AKS) deployments using Azure managed identity failed with `Error while reaching Azure Resource Manager service` when the certificate associated with the managed identity expired. Harness now handles token refreshes transparently during long-lived delegate sessions. \[CDS-129385]
* Fixed an issue where the **TAS Map Route** step failed to associate a route with an application when the route was configured with a private domain, returning `Invalid URI syntax: absolute path cannot start with '0' at position 0`. Harness now correctly constructs the route path for private domains. \[CDS-129457]
* Fixed an issue where Kubernetes rolling deployments failed when a service YAML referenced more than 2000 artifacts. The Harness backend batched artifact metadata fetches and exceeded the Artifactory API's aggregate response size limit, causing the pipeline to time out during the **Fetch Files** step. \[CDS-130809]
* Fixed an issue where custom secret manager connectors returned a misleading error message (`Failed to save user metadata to vault`) when a delegate could not resolve DNS for the custom secret manager host. The error is now reported as `Failed to connect to Custom Secret Manager` with the underlying network diagnostic message. \[CDS-130859]
* Fixed an issue where Project Overview dashboard APIs intermittently returned 504 Gateway Timeout errors because the analytics database had insufficient capacity and dashboard query timeouts were not enforced correctly. The database has been resized and query timeouts now apply as configured, so the Project Overview page loads consistently. \[CDS-129106]
* Fixed an issue where the Elastigroup deployment step could hit a retry state collision and skip pre-delete validation, which could cause deployment failures. The step now correctly manages retry state and validates configuration before deleting a group. \[CDS-129666, ZD-121642]
* Fixed an issue where the ECS Blue/Green Create Service step did not apply custom tags from the ECS service definition when updating the green service. Tags now update correctly on subsequent deployments based on the service definition. This fix requires the feature flag `CDS_AWS_LAMBDA_ECS_TAG_SUPPORT`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-130466, ZD-122138]
* Fixed an issue where the Deploy, Rollback, and Shift AWS AgentCore Revision steps failed with a `NoInputsFoundFailure` error when the AWS connector used IRSA or Inherit from Delegate credentials. These steps now correctly detect and use the available credentials regardless of credential type. \[CDS-131165, ZD-120619]
* Fixed an issue where the ECS Rolling Deploy step made unnecessary AWS Application Auto Scaling API calls during the prepare-rollback phase even when the **Skip Application Scaling** option was enabled. The prepare-rollback phase now skips these calls consistently with the deploy and rollback phases. \[CDS-131474, ZD-123480]
* Fixed an issue where WinRM deployment steps could become stuck with no log output for extended periods before eventually failing, instead of failing fast with a clear error. \[CDS-129720, ZD-121565, ZD-121569, ZD-121676, ZD-121780, ZD-121965]
* Fixed an issue where containerized step groups intermittently pulled an unexpected CI Add-on image instead of the version configured at the account level, which could cause deployment failures. \[CDS-131023, ZD-122873]
* Fixed an issue where only the first Auto Scaling Group (ASG) scaling policy in a multi-policy configuration was attached during deployment, and the remaining policies were silently ignored. \[CDS-132005]
**GitOps**
* Fixed a critical security vulnerability in the GitOps agent related to golang.org/x/crypto/ssh\@v0.53.0. \[CDS-131215]
* Fixed an issue where GitOps repositories and clusters displayed incorrect or flapping connection status, alternating between Error and Success states. \[CDS-130377]
* Fixed an issue where GitOps clusters showed inconsistent health status between the list view and detailed view. \[CDS-130007]
* Fixed an RBAC security issue where multiple user-facing endpoints in the GitOps service had permission bypass vulnerabilities. \[CDS-128250]
* Fixed an issue where creating a disaster recovery PRIMARY agent with the same identifier as an existing non-DR agent caused "multiple agents found" errors. \[CDS-130205]
* Fixed an issue where the cluster status did not refresh after running a connection test. \[CDS-130284]
* Fixed an issue where GitOps calls to OPA failed with a 401 error due to a breaking change in OPA. \[CDS-130738]
* Fixed an issue where the web terminal displayed "session ended" instead of a clear message when the target shell was not supported. \[CDS-128551]
* Fixed an issue where a licensing metric correlation bug caused GitOps application counts to be double-counted or under-counted. \[CDS-129713]
**Pipelines**
* Fixed an issue where selective stage execution failed with `INVALID_REQUEST: stage selection is not allowed when insert stage is present in the pipeline` for Git-backed pipelines that used Insert Block (stage templates). Users could selectively execute stages in inline pipelines with Insert Block stages, but the same operation failed when the pipeline was stored remotely in Git. Selective stage execution now works correctly for both inline and Git-backed pipelines that contain Insert Block stages. \[PIPE-36518, ZD-121615]
* Fixed an issue where remote stage templates with nested step templates failed to reconcile, producing an `Unable to parse referenced template` error when the stage template was updated. Reconciliation logic for Insert Block stages now correctly resolves nested templates in Git-backed stage templates. \[PIPE-36616, ZD-122159]
* Fixed an issue where the pipeline execution list API returned a 500 error with `Unable to get variable metadata for stage type: Approval` when the requested pipeline contained a Jira Approval step. The API no longer fails when processing pipelines with Approval stages. \[PIPE-36981, ZD-123182]
* Fixed an issue where GitX bidirectional sync failed with a "Failed to fetch the modified file paths" error on large merges to the default branch in Bitbucket repositories. Harness now paginates the file-path lookup correctly. \[PIPE-36969, ZD-122373]
* Fixed an issue where a pipeline execution could get stuck in the initialization step without a clear error when a downstream service request hung. Harness now applies a timeout to this call, so the step fails with a clear error instead of hanging indefinitely. \[PIPE-37007, ZD-121931]
* Fixed an issue where a stage failing before reaching a shared Barrier step did not signal sibling stages already waiting at the barrier. The waiting stages ran out their full timeout and ended as Expired instead of Failed. Barrier failure now propagates correctly when a stage fails, errors, expires, or is rejected by approval, not only when it is skipped or aborted. \[PIPE-37036, ZD-122958]
* Fixed an issue where pipeline-level "Mark as Failed" set the pipeline to Failed without stopping its running or queued stages, which continued executing and could finish successfully. The pipeline is no longer marked failed while its stages are still running. \[PIPE-37156, ZD-122833]
* Fixed an issue where users saw a "core\_template\_view" permission warning when running a pipeline that did not use any templates. The warning no longer appears for pipelines without templates. \[PIPE-37165, ZD-122798]
* Fixed an issue where the input section did not display in the execution details view. \[PIPE-37227, ZD-123339]
* Fixed an issue where users could not select input sets for a pipeline using stage-based selection, even though the same pipeline had worked correctly in earlier runs. \[PIPE-37274, ZD-123433]
* Fixed an issue where the live log view for Kubernetes deployments froze at the Fetch Files step and did not advance to later command units, even though the deployment continued running and downloaded logs contained the full output. \[PIPE-37365, ZD-122843, ZD-122875, ZD-122902, ZD-123556, ZD-123841]
**Continuous Integration**
* Fixed an issue where a secret resolution failure from AWS Secrets Manager surfaced a misleading "There are no eligible delegates present" error. CI task failures now show a clearer, generic hint that points to the actual cause. \[CI-24387, ZD-117103]
* Fixed an issue where a manual branch build could intermittently succeed while `<+codebase.branch>` remained unresolved, because the codebase step silently swallowed SCM response errors. The codebase step now fails when the SCM response cannot be processed. \[CI-24617, ZD-123400]
**Resilience Testing**
* Fixed the Resilience Tests tab labeling deployment stages as Custom Stage.
* Fixed the Resilience Tests tab not calling Chaos Manager for matrix and multi-service deploy stages, which left the tab empty for those pipelines.
* Fixed scan permissions so a scan is no longer blocked or allowed against the wrong permission check.
* Fixed the probe page failing to load and timing out.
* Fixed the database migration for accounts with a large number of scanned risk documents, which previously ran too long to complete.
* Fixed the missing access control on **+ New DR Test** and on the delete option for DR tests, so both now respect your assigned permissions.
* Fixed the inability to remove an assigned risk rule from a probe.
* Fixed the load test runner sidecar image not updating in custom image mode for JMeter and k6 runs.
* Fixed k6 script upload extracting environment variable names without their fallback values.
* Fixed the load test scatter plot dropping points to zero when a GET and a POST request share the same path.
## September 2026
### Version 0.46.1
September 25, 2026, Version 0.46.1
September 25, 2026
**Fixed issues**
**Cloud Cost Management**
* **Accelerator costs now included in EKS pod billing (SCAD):** Fixed an issue where Split Cost Allocation Data (SCAD) silently excluded costs for pods running on GPU, AWS Trainium, or AWS Inferentia instances. Accelerator usage is now a cost dimension alongside CPU and memory, so pod billing amounts reflect the full instance cost. \[CCM-36454]
**Harness Delegate**
* **Reduced CCM delegate memory usage and improved restart stability:** Fixed recurring delegate restarts in large Kubernetes clusters caused by excessive heap growth. Resolved a memory leak in the internal queue component and reduced the in-memory size of watched Kubernetes objects by stripping `managedFields` metadata before publishing. \[CCM-35959, CCM-36609]
### Version 0.44.2
September 15, 2026, Version 0.44.2
September 15, 2026
{% hint style="info" %}
**FIPS compatible release**
Release 0.44.2 is FIPS compatible. If your environment requires FIPS compliance, upgrade to 0.44.2. Do not upgrade to 0.44.0, 0.44.1, 0.45.x or 0.46.x.
{% endhint %}
**Fixed issues**
**Platform**
* **Access Control no longer fails at startup in FIPS-enabled deployments:** Fixed an issue where the Access Control service crash-looped at boot in FIPS-enabled deployments with `NoSuchAlgorithmException: PKIX TrustManagerFactory not available`. A non-FIPS BouncyCastle library bundled in the service jar prevented the FIPS security provider from loading. The service now ships only the FIPS-certified BouncyCastle libraries. \[CLI-65273]
### Version 0.46.0
September 11, 2026, Version 0.46.0
September 11, 2026
{% hint style="warning" %}
**Breaking change: NGINX Ingress deprecation**
0.45.0 was the last release that supports the community NGINX Ingress controller. Starting with 0.46.0, NGINX Ingress support is deprecated. Complete the migration to Envoy Gateway before you upgrade to 0.46.0. For more information, see [Migrate from NGINX Ingress to Envoy Gateway](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/migrate-nginx-ingress-to-envoy-gateway.md).
{% endhint %}
{% hint style="warning" %}
**FIPS compatibility**
Releases 0.44.2, 0.47.0, and 0.48.0 are FIPS compatible. Releases 0.44.0, 0.44.1, 0.45.x, and 0.46.x are not. If your environment requires FIPS compliance, upgrade to 0.44.2, 0.47.0, or 0.48.0. Contact [Harness Support](mailto:support@harness.io) for guidance on FIPS-compatible options.
{% endhint %}
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.154.6 | [1.154.x](/release-notes/continuous-integration.md#version-11540), [1.153.x](/release-notes/continuous-integration.md#version-11530) |
| | Log Service | 1.52.1 | - |
| | Test Intelligence Service | 1.79.1 | - |
| DB Devops | DB Devops Service | 1.112.0 | [1.112.x](/release-notes/database-devops.md#release-1112x), [1.111.x](/release-notes/database-devops.md#release-1111x) |
| GitOps | GitOps Service | 1.65.4 | [1.65.x](https://developer.harness.io/release-notes/continuous-delivery/gitops-continuous-delivery#gitops-service-1650-gitops-agent-01250) |
| STO | STO Core | 1.208.2 | - |
| | Ticket Service | 1.15.0 | - |
| CCM | CE Nextgen | 1.102.5 | [1.102.0](/release-notes/cloud-cost-management.md#september-2026-version-11020), [1.101.0](/release-notes/cloud-cost-management.md#august-2026-version-11010), [1.100.0](/release-notes/cloud-cost-management.md#august-2026-version-11000) |
| | Batch Processing | 1.100.8 | - |
| | NG CE UI | 1.98.1 | - |
| | Anomaly Detection | 1.33.0 | - |
| | Telescopes | 1.10.0 | - |
| | Cloud Info | 1.19.0 | - |
| | Event Service | 1.21.0 | - |
| Feature Flags | Feature Flag Service | 1.1233.0 | - |
| | Feature Flag Pushpin Service | 1.1148.0 | - |
| IaCM | IACM Manager | 1.195.1 | - |
| | IAC Server | 1.482.0 | - |
| Code Repository | Code API | 1.102.2 | - |
| | Code GitRPC | 1.102.2 | - |
| | Code GitHA | 1.102.0 | - |
| | Code Search | 1.102.0 | - |
| | Code UI | 1.38.0 | - |
| SSCA | SSCA Manager | 1.70.7 | - |
| | Component Analysis Service | 1.17.1 | - |
| | Component Service | 1.20.0 | - |
| | SSCA UI | 0.56.0 | - |
| Platform | Platform Service | 1.146.1 | [1.146.x](/release-notes/platform.md#version-1146x), [1.145.x](/release-notes/platform.md#version-1145x) |
| | Access Control | 1.334.0 | - |
| | Audit Event Streaming | 1.111.0 | - |
| | Gateway Service | 1.71.0 | - |
| | NG Auth UI | 1.39.0 | - |
| | NG Dashboard Aggregator | 1.130.0 | - |
| | Policy Management | 1.65.2 | - |
| | Service Discovery Manager | 0.80.0 | - |
| Resilience testing | Chaos Manager | 1.99.9 | - |
| | Chaos CRD | 1.82.0 | - |
| | Chaos K8s IFS | 1.99.1 | - |
| | Chaos Linux IFC | 1.99.0 | - |
| | Chaos Linux IFS | 1.99.0 | - |
| | Chaos Machine IFS | 1.99.0 | - |
| | Chaos Machine IFC | 1.99.1 | - |
| | Chaos Web | 1.99.2 | - |
| | Load Test Manager | 1.22.2 | - |
| Continuous Delivery | NG Manager | 1.164.15 | [1.164.x](https://developer.harness.io/release-notes/continuous-delivery/continuous-delivery-continuous-delivery#version-116412), [1.163.x](https://developer.harness.io/release-notes/continuous-delivery/continuous-delivery-continuous-delivery#version-11635) |
| | NG Custom Dashboards | 1.124.0 | - |
| | Pipeline Service | 1.203.7 | [1.203.x](https://developer.harness.io/release-notes/continuous-delivery/pipeline-continuous-delivery#pipeline-service-12036), [1.202.x](https://developer.harness.io/release-notes/continuous-delivery/pipeline-continuous-delivery#pipeline-service-12022) |
| | Harness Manager | 1.163.3 | - |
| | Template Service | 1.165.2 | - |
| | Queue Service | 1.11.0 | - |
| | Debezium Service | 1.28.0 | - |
| | Delegate Proxy | 1.9.0 | - |
| | Delegate Version (Immutable) | 26.08.89804 | - |
| Others | Helm Chart | [0.46.0](https://github.com/harness/helm-charts/releases/tag/harness-0.46.0) | - |
| | Air Gap Bundle | [0.46.0](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.46.0) | - |
| | Bootstrap | 1.81.0 | - |
| | Change Data Capture | 1.64.0 | - |
| | Looker | 1.28.5 | - |
| | UI | 1.36.3 | - |
| | SCM Service | 1.61.0 | - |
| | Next Gen UI | 1.151.7 | - |
| | CV Nextgen | 1.71.4 | - |
| | LE Nextgen | 1.23.0 | - |
| | SRM UI | 1.16.3 | - |
| | Envoy Gateway | 1.12.0 | - |
| | Kafka Operator | 1.15.1 | - |
| | Kafka Platform | 2.11.1 | - |
| | Kafka Resources | 1.97.0 | - |
| | Kafka Connect Strimzi | 1.99.2 | - |
| | Schema Registry | 1.11.3 | - |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, go to the **Version 0.38.x and later** tab in [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) to download airgap bundles using the interactive scripts, organize the core modules and execution components, and push them to your private container registry.
**New features and enhancements**
**Harness Platform**
* Added rate limiting for user invitation emails. Each account can now send a limited number of invitation emails within a rolling 24-hour window, based on its license edition - 50 for **Free** and **Community**, 1000 for **Team**, **Startup**, and **DevOps Essentials**, and 5000 for **Enterprise** and **Essentials**. Invitations provisioned through SCIM or LDAP are exempt. \[PL-73850]
**Continuous Delivery**
* Harness CD now supports **Helm v4** as a deployment engine. You select the Helm version on a service's manifest configuration. Version 4 introduces Server-Side Apply, kstatus-based wait strategies, and an improved plugin system. Harness automatically translates deprecated Helm v3 flags to their v4 equivalents (for example, `--atomic` becomes `--rollback-on-failure`), so existing service configurations work without manual updates. \[CDS-122167]
**GitOps**
* GitOps now supports post-production rollback for applications directly from the Services dashboard. After a successful pipeline deployment, a **Rollback** button appears in the **Services** tab, allowing you to execute the pipeline's rollback steps without navigating to the pipeline or application details. The **Rollback** button becomes inactive after use. \[CDS-121668]
* The GitOps service now displays service instance details for GitOps services based on application sync operations, providing visibility into the deployment state and instance information after each sync. \[CDS-123147]
* The Harness Vault plugin now supports Kustomize manifests. You can now use the Harness Config Management Plugin with Kustomize to inject secrets from Harness Secret Manager into your Kubernetes manifests during GitOps application deployments. \[CDS-120168]
**Pipelines**
* Harness pipelines now support the **Save Blank Fields as Empty String** setting, which preserves an empty string value in an input variable when you run a pipeline with an input set, instead of converting it to null. You enable the setting at the account level. \[PIPE-35584]
* Pipeline and GitOps centralized notification rules are now available in the Harness UI. The `PIPE_CENTRALISED_NOTIFICATION` feature flag has been removed, and notification rule configuration for pipeline and GitOps application events is now enabled by default. No feature flag or opt-in is required. \[PIPE-37395]
**Continuous Integration**
* Added Harness Artifact Registry (HAR) as a container registry option in the Test Intelligence step. You can now use `registryRef` to pull test runner images from HAR instead of requiring an external Docker connector. \[CI-21929, ZD-114248]
* Added support for custom subject claims in the Azure OIDC plugin. You can now define a custom subject claim using Harness expressions when authenticating to Azure with OIDC. \[CI-20580]
* Added Workload Identity support for CI Run steps, enabling OIDC cloud authentication for AWS, GCP, Azure, and Vault without requiring a connector. You can now define an `identities` block in your Run step to mint and federate OIDC tokens directly. \[CI-23932]
* Added secret reference tracking for CI builds. Secrets referenced in CI pipelines now record their runtime usage, so you can see where a secret is consumed at the account, organization, and project levels. \[CI-24119]
* Improved codebase step logs by printing the delegate task ID used to fetch codebase details, making it easier to correlate and troubleshoot Git clone operations. \[CI-22292]
* Added internal CA certificate injection for Windows build pods. Harness now populates the Windows certificate store with your internal CA bundle, so Windows builds can trust internal HTTPS endpoints such as Artifactory without `SEC_E_UNTRUSTED_ROOT` errors. Certificates are added in a single batched operation to reduce resource usage on the build pod. \[CI-24139, CI-24495, ZD-120338, ZD-120865, ZD-122268]
* Added an `ignoreMissingPaths` option to the Save Cache steps (S3, GCS, Azure, and generic). When enabled, the step skips paths that do not exist instead of failing, making cache creation more resilient for optional or conditionally generated directories. \[CI-24067]
**Resilience Testing**
* Chaos Engineering is now **Resilience Testing**. The module is renamed across the Harness UI.
* Replaced the Chaos landing page with the Resilience Testing **Overview**. New accounts see a **Get Started** empty state. Existing accounts see an **Overview** with scans and tests, including empty states when those sections have no data.
* Added a service-risks scan step to onboarding, including skip-to-complete so you can finish onboarding without waiting on a scan.
* Pointed infrastructure creation at service-based onboarding, so creating infrastructure takes you into the same onboarding path as services.
* Added Resilience Testing activity on the service page, including disaster recovery (DR) executions for associated services.
* Added a JMeter sample load test and renamed sample button labels so Locust, k6, and JMeter samples are easier to tell apart.
* Relabeled **Load Test Type** to **Load Test Engine** so the field names the engine (JMeter, k6, Locust) rather than a generic type.
* Surfaced load-test licensing usage in IRM and usage dashboards so you can track consumption against your license.
* Replaced the split button on **Create experiment** with a dropdown for choosing how you start an experiment.
* Improved out-of-the-box Chaos dashboards and tightened **Overview** and **Get Started** copy and number formatting.
**Fixed issues**
**Continuous Delivery**
* Fixed an issue where GitHub App connectors minted a new installation token for every parallel `GitFetchFiles` delegate task, causing GitHub Enterprise Server (GHES) to return 403 errors when many stages ran in parallel and exhausted the secondary rate limit. \[CDS-129429, ZD-121175]
* Fixed an issue where Git webhook polling re-processed already-consumed webhook deliveries after a delegate restart, causing duplicate pipeline executions for the same commit. This fix requires the feature flag `CDS_DISABLE_POLLED_KEYS_EVICTION_FOR_GIT_WEBHOOK_POLLING_DOCUMENT`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-129546, ZD-120981]
* Fixed an issue where the CD license usage API returned incorrect data after the v2 UI migration, affecting Developer 360 and custom integrations. \[CDS-128336, ZD-120063]
* Fixed an issue where the chart version API returned a 400 error with the message "pipeline identifier cannot be empty" when fetching Helm chart versions on non-default Git branches. \[CDS-128590, ZD-120228]
* Fixed an issue where service rollback operations failed with an "Environment data not found" error when attempting to roll back to a previous deployment. \[CDS-129140, ZD-119629]
* Fixed an issue where role bindings with scoped Resource Groups did not correctly grant "View Services" permission during deployment, causing the service permission check to apply to all services instead of only those within the scoped resource group. \[CDS-129544, ZD-119589]
* Fixed an issue where GitOps deployments failed when using an organization-level environment with explicitly selected organization-level clusters. \[CDS-129649]
**GitOps**
* Fixed an issue where the GitOps agent failed to deliver pod logs to Harness, with the WebSocket connection closing with a protocol error shortly after the agent sent a batch of pod logs. \[CDS-128666]
* Fixed a directory traversal vulnerability in the go-git dependency used by the GitOps agent and GitOps service. \[CDS-129598, CDS-129599]
**Pipelines**
* Fixed an issue where a stage configured with a skip condition of `<+input>` in a V0 stage template was incorrectly skipped when the pipeline provided a default value of `true` via `templateInputs` and the pipeline was executed with an empty request body. \[PIPE-36066, ZD-120062]
* Fixed an issue where triggers remained in a soft-deleted state after a project was deleted and recreated with the same identifier, preventing new triggers from being created. Harness now periodically scans for and removes orphaned triggers, and exposes a lag monitor to track pipeline delete cleanup progress. \[PIPE-36271, ZD-120720]
* Fixed an issue where a step following a parallel step group was incorrectly initialized and marked as skipped before pipeline rollback was triggered when the stage used the **PipelineRollback** failure strategy. This fix requires the feature flag `PIPE_SKIP_NEXT_STEP_ON_PIPELINE_ROLLBACK`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-36558, ZD-121728]
* Fixed an issue where adding the `[skip ci]` keyword to an existing pull request suppressed PR event executions but still triggered a pipeline execution on the subsequent merge (push) event. \[PIPE-36564, ZD-121760]
* Fixed an issue where remote Git-backed pipelines could be created with identifiers containing hyphens, which are invalid per the pipeline identifier format. The same identifier validation that applies to inline pipelines now applies to remote Git-backed pipelines. \[PIPE-36701]
* Fixed an issue where pipeline executions became stuck indefinitely and did not abort properly. This fix requires the feature flag `PIE_CONTAINER_STEP_ABORT_USE_UPSERT`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-35723, ZD-118793]
* Fixed an issue where template deletion was blocked by phantom references, caused by EntitySetupUsage records incorrectly tracking references from Git-backed pipelines that never existed on the default branch. \[PIPE-36105, ZD-119637]
* Fixed an issue where the pipeline annotation API returned "unauthorized" errors for valid API keys because the endpoint requires internal lite-engine service JWT tokens, not customer API keys. The endpoint is now correctly marked as hidden and not customer-callable. \[PIPE-36412, ZD-121375]
* Fixed an issue where the backend API allowed saving invalid YAML configurations where a containerized step group contained a nested step group as a container, or included a run step inside a nested step group, bypassing frontend validations that correctly restrict this configuration. This fix requires the feature flag `CDS_CONTAINER_STEP_GROUP_REJECT_NESTED_INFRA`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-36002]
**Continuous Integration**
* Fixed an issue where OPA policy evaluation calls from CI Manager sent a JWT without principal claims, causing 401 authorization errors during step-time governance policy evaluation. \[CDS-130610]
* Fixed an issue where `HARNESS_BASE_URL` was masked in build logs because it was treated as a secret. It is now always exposed as a plain, non-secret environment variable. \[CI-24378, ZD-122148, ZD-122280, ZD-122380]
* Fixed an issue where a sparse-checkout configuration leaked into subsequent Git Clone steps, causing incomplete clones. \[CI-24388, ZD-122592]
* Fixed an issue where the `TI proxy returned an empty savings response` message was logged on every step of Kubernetes builds. The warning is now suppressed for steps that are not Test Intelligence optimized. \[CI-24551]
**Harness Delegate**
* Fixed an issue where the `rollme` annotation caused unnecessary pod restarts on every Argo CD sync. The annotation is replaced with checksum-based annotations that only trigger restarts when the configuration actually changes. \[DEL-10723]
**Resilience Testing**
* Fixed **Overview** not auto-refreshing for a new account when onboarding starts, and when you start a new scan.
* Fixed the JMeter **Script** tab showing a base64 string instead of the file list used on the load test details page.
* Fixed a blank page after you click **Go** when you start onboarding from the **Resilience Infrastructure** page.
* Replaced **Chaos Agent** with **Chaos Infrastructure** on the individual service page.
* Fixed empty **Resilience Testing Activity** on individual service pages.
* Removed **CF**, **Container**, and **K8sV2** from the category filter.
* Fixed the **Risks** empty state for services that have no scanned risks, so a zero-day message appears instead of an empty table.
* Fixed empty details in the Risks Summary **Scanned using services metadata** section.
* Fixed the **Risks** table **Source** filter returning the same data for both source types.
* Stopped the **Risks Detected** table on a pipeline scan from repeating the service name in the **Risk** column.
* Fixed risk-scan retry during service onboarding so the UI polls again instead of staying on the error until you refresh.
* Fixed the **+1** overflow for services attached to a load test on the details page.
* Reset the load test list to the first page when filters change.
* Fixed ChaosHub import of probe or action templates whose names include capital letters or spaces.
### Version 0.45.1
September 9, 2026, Version 0.45.1
September 9, 2026
**New features and enhancements**
**Cloud Cost Management**
* **New cost basis options for multi-cloud shared support allocation:** Added two new options, **Unified Cost (With Discounts minus Refund)** and **Total List Cost (GCP/AWS/Azure)**, to the **Unified Table Shared Cost Basis** dropdown in BI Dashboards. These options aggregate costs across AWS, GCP, and Azure, enabling accurate allocation of shared support costs when your support spend spans multiple cloud providers. \[CCM-35711]
**Fixed issues**
**Cloud Cost Management**
* **Faster load times for shared cost BI Dashboard tiles:** Fixed a performance issue where BI Dashboard tiles using shared cost fields took 3–5 minutes to load 90 days of data. Improvements to the underlying query logic reduce load times for shared cost configurations. \[CCM-35532]
### Version 0.42.2
September 9, 2026, Version 0.42.2
September 9, 2026
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.141.5 | [1.141.x](/release-notes/continuous-integration.md#version-11410), [1.140.x](/release-notes/continuous-integration.md#version-11400), [1.139.x](/release-notes/continuous-integration.md#version-11390), [1.138.x](/release-notes/continuous-integration.md#version-11380), [1.133.x](/release-notes/continuous-integration.md#version-11330), [1.132.x](/release-notes/continuous-integration.md#version-11320) |
| | Log Service | 1.48.1 | - |
| | Test Intelligence Service | 1.71.3 | - |
| DB Devops | DB Devops Service | 1.97.1 | [1.97.x](/release-notes/database-devops.md#release-197x), [1.96.x](/release-notes/database-devops.md#release-196x), [1.95.x](/release-notes/database-devops.md#release-195x), [1.94.x](/release-notes/database-devops.md#release-194x), [1.93.x](/release-notes/database-devops.md#release-193x), [1.92.x](/release-notes/database-devops.md#release-192x), [1.91.x](/release-notes/database-devops.md#release-191x), [1.90.x](/release-notes/database-devops.md#release-190x), [1.89.x](/release-notes/database-devops.md#release-189x) |
| GitOps | GitOps Service | 1.58.0 | [1.58.x](/university/continuous-delivery.md#gitops-service-1580-gitops-agent-01180), [1.57.x](/university/continuous-delivery.md#gitops-service-1570-gitops-agent-01170), [1.56.x](/university/continuous-delivery.md#gitops-service-1561-gitops-agent-01161) |
| STO | STO Core | 1.195.0 | [1.191.x](/release-notes/security-testing-orchestration.md#version-11912), [1.190.x](/release-notes/security-testing-orchestration.md#version-11900) |
| | Ticket Service | 1.12.0 | - |
| CCM | CE Nextgen | 1.90.11 | [1.89.6](/release-notes/cloud-cost-management.md#may-2026---version-1896) |
| | Batch Processing | 1.88.14 | - |
| | NG CE UI | 1.86.5 | - |
| | Anomaly Detection | 1.28.5 | - |
| | Telescopes | 1.7.2 | - |
| | Cloud Info | 1.16.3 | - |
| | Event Service | 1.18.1 | - |
| Feature Flags | Feature Flag Service | 1.1200.0 | - |
| | Feature Flag Pushpin Service | 1.1139.0 | - |
| IaCM | IACM Manager | 1.161.1 | - |
| | IAC Server | 1.404.0 | - |
| Code Repository | Code API | 1.87.5 | - |
| | Code GitRPC | 1.87.0 | - |
| | Code GitHA | 1.87.0 | - |
| | Code Search | 1.86.0 | - |
| SSCA | SSCA Manager | 1.61.13 | [1.59.x](/release-notes/software-supply-chain-assurance.md#version-v1590--plugin-version-v0590) |
| | Component Analysis Service | 1.10.0 | - |
| | Component Service | 1.14.0 | - |
| | SSCA UI | 0.48.5 | - |
| Platform | Platform Service | 1.130.1 | [1.130.x](/release-notes/platform.md#version-1130x-), [1.129.x](/release-notes/platform.md#version-1129x-), [1.128.x](/release-notes/platform.md#version-1128x-), [1.127.x](/release-notes/platform.md#version-1127x-), [1.126.x](/release-notes/platform.md#version-1126x-), [1.125.x](/release-notes/platform.md#version-1125x-), [1.124.x](/release-notes/platform.md#version-1124x-), [1.123.x](/release-notes/platform.md#version-1123x-), [1.122.x](/release-notes/platform.md#version-1122x-), [1.121.x](/release-notes/platform.md#version-1121x-), [1.120.x](/release-notes/platform.md#version-1120x-), [1.119.x](/release-notes/platform.md#version-1119x-), [1.118.x](/release-notes/platform.md#version-1118x-) |
| | Access Control | 1.267.0 | - |
| | Audit Event Streaming | 1.96.0 | - |
| | Gateway Service | 1.66.1 | - |
| | NG Auth UI | 1.43.0 | - |
| | NG Dashboard Aggregator | 1.116.0 | - |
| | Policy Management | 1.52.0 | - |
| | Service Discovery Manager | 0.68.1 | - |
| Resilience testing | Chaos Manager | 1.88.2 | [1.88.x](/release-notes/chaos-engineering.md#version-1880), [1.87.x](/release-notes/chaos-engineering.md#version-1870), [1.86.x](/release-notes/chaos-engineering.md#version-1860), [1.85.x](/release-notes/chaos-engineering.md#version-1853), [1.84.x](/release-notes/chaos-engineering.md#version-1842) |
| | Chaos CRD | 1.82.0 | - |
| | Chaos K8s IFS | 1.88.0 | - |
| | Chaos Linux IFC | 1.88.0 | - |
| | Chaos Linux IFS | 1.88.0 | - |
| | Chaos Machine IFS | 1.88.0 | - |
| | Chaos Machine IFC | 1.88.0 | - |
| | Chaos Web | 1.88.1 | - |
| | Load Test Manager | 1.12.2 | - |
| Continuous Delivery | NG Manager | 1.150.6 | [1.150.x](/university/continuous-delivery.md#version-11503), [1.149.x](/university/continuous-delivery.md#version-11497), [1.148.x](/university/continuous-delivery.md#version-11483), [1.144.x](/university/continuous-delivery.md#version-11440), [1.143.x](/university/continuous-delivery.md#version-11431), [1.142.x](/university/continuous-delivery.md#version-11420) |
| | NG Custom Dashboards | 1.113.0 | - |
| | Pipeline Service | 1.190.0 | - |
| | Harness Manager | 1.149.7 | - |
| | Template Service | 1.152.0 | - |
| | Queue Service | 1.10.0 | - |
| | Debezium Service | 1.27.0 | - |
| | Delegate Proxy | 1.9.0 | - |
| | Delegate Version (Immutable) | 26.05.89206 | - |
| Others | Helm Chart | [0.42.1](https://github.com/harness/helm-charts/releases/tag/harness-0.42.1) | - |
| | Air Gap Bundle | [0.42.1](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.42.1) | - |
| | Bootstrap | 1.74.1 | - |
| | Change Data Capture | 1.57.0 | - |
| | Looker | 1.18.0 | - |
| | UI | 1.36.2 | - |
| | SCM Service | 1.50.0 | - |
| | Next Gen UI | 1.137.8 | - |
| | CV Nextgen | 1.66.0 | - |
| | LE Nextgen | 1.19.0 | - |
| | SRM UI | 1.16.2 | - |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Continuous Delivery**
* Fixed an issue where Git webhook polling for triggers could re-process previously consumed webhook deliveries, causing duplicate pipeline executions for the same pull request or commit. Webhook delivery de-duplication state is now retained reliably, so each delivery is processed only once. This fix is protected by the feature flag `CDS_DISABLE_POLLED_KEYS_EVICTION_FOR_GIT_WEBHOOK_POLLING_DOCUMENT`. If you observe a regression, disable the feature flag to revert to the previous behavior. \[CDS-131709]
## August 2026
### Version 0.45.0
August 24, 2026, Version 0.45.0
August 24, 2026
{% hint style="warning" %}
**Important**
If you use Infrastructure as Code Management, follow this upgrade path.
From chart 0.45.0, the IaC server verifies before it migrates that a recently introduced internal identifier is populated on every record. If any identifier is blank, the boot aborts and names the affected scopes. The database is left untouched, so the install can be rolled back. Run the backfill on a chart that supports it, wait for it to finish, and then upgrade.
* **You are on 0.41.0 or earlier:** Backfill at **0.41.3**, then upgrade to **0.45.0**.
* **You are on 0.42.x or 0.43.x:** Backfill at **0.44.x**, then upgrade to **0.45.0**.
* **You are on 0.44.x:** Nothing to do. Upgrade to **0.45.0**.
The backfill worker runs on its own on 0.41.3 and 0.44.x with no configuration, but its first pass starts one producer interval (6 hours by default) after the pod comes up. Charts 0.41.0, 0.42.x, and 0.43.x ship the worker disabled and cannot backfill. An install below chart 0.41.0 is refused on version alone, without a scan. If an upgrade has to proceed despite being blocked, contact [Harness Support](mailto:support@harness.io). Do not bypass the gate.
{% endhint %}
{% hint style="warning" %}
**Breaking change: NGINX Ingress deprecation**
0.45.0 is the last release that supports the community NGINX Ingress controller. Starting with **0.46.0**, NGINX Ingress support is deprecated. Go to [Migrate from NGINX Ingress to Envoy Gateway](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/migrate-nginx-ingress-to-envoy-gateway.md) to complete the migration before you upgrade beyond 0.45.0.
{% endhint %}
{% hint style="warning" %}
**FIPS compatibility**
Releases 0.44.2, 0.47.0, and 0.48.0 are FIPS compatible. Releases 0.44.0, 0.44.1, 0.45.x, and 0.46.x are not. If your environment requires FIPS compliance, upgrade to 0.44.2, 0.47.0, or 0.48.0. Contact [Harness Support](mailto:support@harness.io) for guidance on FIPS-compatible options.
{% endhint %}
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.152.1 | [1.152.x](/release-notes/continuous-integration.md#version-11520), [1.151.x](/release-notes/continuous-integration.md#version-11510), [1.150.x](/release-notes/continuous-integration.md#version-11500) |
| | Log Service | 1.52.0 | - |
| | Test Intelligence Service | 1.78.0 | - |
| DB Devops | DB Devops Service | 1.110.1 | [1.110.x](/release-notes/database-devops.md#release-1110x), [1.109.x](/release-notes/database-devops.md#release-1109x), [1.108.x](/release-notes/database-devops.md#release-1108x), [1.107.x](/release-notes/database-devops.md#release-1107x), [1.106.x](/release-notes/database-devops.md#release-1106x), [1.105.x](/release-notes/database-devops.md#release-1105x), [1.104.x](/release-notes/database-devops.md#release-1104x), [1.103.x](/release-notes/database-devops.md#release-1103x), [1.102.x](/release-notes/database-devops.md#release-1102x), [1.101.x](/release-notes/database-devops.md#release-1101x) |
| GitOps | GitOps Service | 1.64.2 | - |
| STO | STO Core | 1.206.7 | [1.206.x](/release-notes/security-testing-orchestration.md#version-12066), [1.205.x](/release-notes/security-testing-orchestration.md#version-12053), [1.200.x](/release-notes/security-testing-orchestration.md#version-12002) |
| | Ticket Service | 1.15.0 | - |
| CCM | CE Nextgen | 1.99.17 | [1.99.0](/release-notes/cloud-cost-management.md#august-2026---version-1990), [1.98.0](/release-notes/cloud-cost-management.md#july-2026---version-1980), [1.97.0](/release-notes/cloud-cost-management.md#july-2026---version-1970), [1.96.0](/release-notes/cloud-cost-management.md#july-2026---version-1960), [1.95.0](/release-notes/cloud-cost-management.md#june-2026---version-1950), [1.94.12](/release-notes/cloud-cost-management.md#june-2026---version-19412) |
| | Batch Processing | 1.97.15 | - |
| | NG CE UI | 1.95.5 | - |
| | Anomaly Detection | 1.33.0 | - |
| | Telescopes | 1.10.0 | - |
| | Cloud Info | 1.19.0 | - |
| | Event Service | 1.21.0 | - |
| Feature Flags | Feature Flag Service | 1.1224.0 | - |
| | Feature Flag Pushpin Service | 1.1146.0 | - |
| IaCM | IACM Manager | 1.186.0 | - |
| | IAC Server | 1.459.2 | - |
| Code Repository | Code API | 1.99.1 | [1.92.x](/release-notes/code-repository.md#version-192x), [1.90.x](/release-notes/code-repository.md#version-190x) |
| | Code GitRPC | 1.99.0 | - |
| | Code GitHA | 1.99.0 | - |
| | Code Search | 1.99.1 | - |
| | Code UI | 1.21.1 | - |
| SSCA | SSCA Manager | 1.68.17 | [1.65.x](/release-notes/software-supply-chain-assurance.md#version-v1650--plugin-version-v0650), [1.64.x](/release-notes/software-supply-chain-assurance.md#version-v1640--plugin-version-v0630) |
| | Component Analysis Service | 1.15. | |
| | Component Service | 1.18.0 | - |
| | SSCA UI | 0.54.2 | - |
| Platform | Platform Service | 1.144.0 | [1.144.x](/release-notes/platform.md#version-1144x-), [1.143.x](/release-notes/platform.md#version-1143x-), [1.142.x](/release-notes/platform.md#version-1142x-), [1.141.x](/release-notes/platform.md#version-1141x-), [1.140.x](/release-notes/platform.md#version-1140x-), [1.139.x](/release-notes/platform.md#version-1139x-), [1.138.x](/release-notes/platform.md#version-1138x-), [1.137.x](/release-notes/platform.md#version-1137x-), [1.136.x](/release-notes/platform.md#version-1136x-) |
| | Access Control | 1.323.1 | - |
| | Audit Event Streaming | 1.109.0 | - |
| | Gateway Service | 1.71.0 | - |
| | NG Auth UI | 1.39.0 | - |
| | NG Dashboard Aggregator | 1.128.0 | - |
| | Policy Management | 1.63.3 | - |
| | Service Discovery Manager | 0.76.1 | - |
| Resilience testing | Chaos Manager | 1.96.4 | - |
| | Chaos CRD | 1.82.0 | - |
| | Chaos K8s IFS | 1.96.3 | - |
| | Chaos Linux IFC | 1.96.0 | - |
| | Chaos Linux IFS | 1.96.0 | - |
| | Chaos Machine IFS | 1.96.0 | - |
| | Chaos Machine IFC | 1.96.0 | - |
| | Chaos Web | 1.96.2 | - |
| | Load Test Manager | 1.19.1 | - |
| Continuous Delivery | NG Manager | 1.162.2 | [1.162.x](/release-notes/continuous-delivery.md#version-11622), [1.161.x](/release-notes/continuous-delivery.md#version-11611), [1.160.x](/release-notes/continuous-delivery.md#version-11604), [1.159.x](/release-notes/continuous-delivery.md#version-11593) |
| | NG Custom Dashboards | 1.124.0 | - |
| | Pipeline Service | 1.201.1 | [1.201.x](/release-notes/continuous-delivery.md#pipeline-service-12011), [1.200.x](/release-notes/continuous-delivery.md#pipeline-service-12007), [1.199.x](/release-notes/continuous-delivery.md#pipeline-service-11991), [1.198.x](/release-notes/continuous-delivery.md#pipeline-service-11982) |
| | Harness Manager | 1.161.1 | - |
| | Template Service | 1.163.2 | - |
| | Queue Service | 1.11.0 | - |
| | Debezium Service | 1.27.0 | - |
| | Delegate Proxy | 1.9.0 | - |
| | Delegate Version (Immutable) | 26.08.89804 | - |
| Others | Helm Chart | [0.45.0](https://github.com/harness/helm-charts/releases/tag/harness-0.45.0) | - |
| | Air Gap Bundle | [0.45.0](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.45.0) | - |
| | Bootstrap | 1.81.0 | - |
| | Change Data Capture | 1.64.0 | - |
| | Looker | 1.28.4 | - |
| | UI | 1.36.3 | - |
| | SCM Service | 1.61.0 | - |
| | Next Gen UI | 1.149.6 | - |
| | CV Nextgen | 1.69.1 | - |
| | LE Nextgen | 1.22.0 | - |
| | SRM UI | 1.16.2 | - |
| | Envoy Gateway | 1.12.0 | - |
| | Kafka Operator | 1.15.1 | - |
| | Kafka Platform | 2.11.1 | - |
| | Kafka Resources | 1.94.0 | - |
| | Kafka Connect Strimzi | 1.97.0 | - |
| | Schema Registry | 1.11.3 | - |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, go to the **Version 0.38.x and later** tab in [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) to download airgap bundles using the interactive scripts, organize the core modules and execution components, and push them to your private container registry.
**New features and enhancements**
**Continuous Delivery**
* Harness CD now supports **AI agent deployments** as a first-class deployment type. You define an **Agent Service**, point it at a container image, and deploy it to AWS Bedrock AgentCore or Google Vertex Agent Runtime through the same environment, infrastructure, and pipeline model you use for every other CD deployment, so agents inherit RBAC, secrets management, OPA policies, approval gates, and rollback. This feature requires the feature flag `CDS_AGENT_RUNTIME_DEPLOYMENT`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-126104]
* Harness now supports **progressive canary deployments for Kubernetes**, a sub-type of the Canary strategy that rolls out a new version in percentage-based phases (for example, 25%, 50%, and 100%) while keeping the total pod count within a fixed budget. Harness maintains two Deployments and shifts replicas between them, with verification or approval gates between phases. This feature requires the feature flag `CDS_K8S_PROGRESSIVE_CANARY`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-123216]
* Harness now enforces **onSave OPA policies on Git-backed CD entities** committed directly to Git. When you commit a service, environment, infrastructure definition, or override to Git, Harness evaluates the onSave policy, surfaces the validation result on the entity detail page, and blocks pipeline execution at the step level if the entity fails the policy check. This feature requires the feature flags `CDS_OPA_GOVERNANCE_FOR_WEBHOOK` and `PIPE_OPA_GITX_ENFORCEMENT`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-124509]
* Harness now supports **bulk post-production rollback across multiple infrastructures**. From the service dashboard you can select multiple infrastructures where a service is deployed and roll them back together, choosing the target execution for each infrastructure before you confirm. This feature requires the feature flag `CDS_BULK_POST_PROD_ROLLBACK`, with `CDC_SERVICE_DASHBOARD_REVAMP_NG` as a prerequisite. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-125628]
* The Shell Script step now supports **Harness ID tokens**. You can declare one or more named identities on the step, and Harness generates an independent OIDC ID token for each and injects it into the script at runtime as an environment variable, so a script can authenticate as the workload itself instead of through a connector. This feature requires the feature flag `PIPE_PIPELINE_IDENTITY`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-125872]
* AWS connectors that authenticate with OIDC now support **delegate selectors as session tags**. Harness includes the resolved delegate selectors as a `delegate_selectors` claim in the OIDC token, so you can write AWS IAM policy conditions that restrict access based on which delegates run a task. Harness resolves the effective selector by precedence (step, step group, stage, pipeline), and falls back to the connector-level selector when none is set in that chain. \[CDS-126728]
* AWS Auto Scaling Group (ASG) redeployments now **preserve unchanged properties** instead of deleting and recreating them. Harness compares lifecycle hooks, scaling policies, scheduled actions, load balancers, and target groups against your configuration and updates only what changed, keeping in-flight instances and their lifecycle hooks intact. This feature requires the feature flag `CDS_ASG_SKIP_UNCHANGED_PROPERTIES` and a delegate version that includes this behavior. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-124833]
* The Kubernetes cluster connector now supports the **client credentials** OIDC grant type. In addition to the existing password grant type, you can authenticate to a cluster with a client ID and client secret alone, without a username or password, which suits machine-to-machine access such as an Azure Kubernetes Service (AKS) cluster fronted by Microsoft Entra ID. Select the grant type when you configure OpenID Connect authentication on the connector. Existing connectors are unaffected and continue to use the password grant type by default. \[CDS-122829]
* Continuous Verification now supports **per-metric sensitivity override** in the Verify step. Instead of applying a single sensitivity setting to every metric in a health source, you can set the sensitivity (High, Medium, or Low) individually per metric, so a noisy metric can use a more lenient threshold while a critical metric stays strict. The applied per-metric value is shown in the execution details view. This feature is behind the feature flag `CDS_CV_PER_METRIC_SENSITIVITY`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-122395]
* The AI Verify (v1) step now supports the **`customVerificationStartTime`** configurable property. You can shift the start of the verification window to an earlier timestamp so that logs recorded by health sources such as Dynatrace at the moment a deployment starts are included in the analysis instead of falling outside the collection window. This feature is behind the feature flag `CDS_CV_INPUT_OUTPUT_VARIABLES_ENABLED`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-122347]
* The CloudWatch health source now supports **`WHERE` and `ORDER BY` clauses** in Metrics Insights queries. You can filter metrics by dimension values, for example to isolate a specific ALB target group or EC2 instance, and sort results when a query returns multiple time series. \[CDS-121852]
**Pipelines**
* Harness now supports **project-level pipeline execution concurrency**, so you can split your account-wide concurrency limit into High-Priority and Low-Priority partitions to guarantee reserved execution slots for critical projects. This feature requires the feature flags `PIPE_PROJECT_LEVEL_EXECUTION_CONCURRENCY` and `PIPE_ENABLE_QUEUE_BASED_PLAN_CREATION`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-35597]
* Harness now enforces an **account-level step concurrency limit** that caps the total number of concurrently running steps across all pipeline executions in your account, in addition to the existing per-execution limit. When the account limit is reached, new steps enter the **Queued** state and start automatically as capacity frees up. This feature is behind the feature flag `PIPE_USE_COUNTER_BASED_STEP_CONCURRENCY_GATE`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-34390]
* Harness now provides an **Executions Management page** with account-level visibility into all queued and running pipeline executions. You can see where queued executions sit in the queue, monitor running executions through the **Status** column, and abort executions you no longer need. This feature requires the feature flag `PIPE_QUEUED_PIPELINE_OBSERVABILITY`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-34977]
* Harness now supports **template overrides**. A template owner can allow specific advanced settings to be overridden, so callers can override only the values they need without editing or duplicating the template. Overrides are supported for step, stage, step group, and pipeline templates that use the v0 YAML version, on both inline and remote templates. This feature is behind the feature flag `PIPE_TEMPLATE_OVERRIDES`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-34868]
* Harness now provides a **Pipeline template usage dashboard** to track which pipelines reference each template version across your account. \[PIPE-34837]
* Harness now supports a **trigger executor identity**. You can associate a user or service account with a trigger so that a pipeline started by the trigger runs with that identity and its RBAC permissions, instead of running as the Harness system principal. This ensures a triggered pipeline is subject to the same access controls as pipelines run manually through the UI or API. This feature is behind the feature flag `PIPE_ENFORCE_TRIGGER_EXECUTOR_IDENTITY`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-35567]
* Harness now enforces **onSave OPA policies on Git-backed entities**. When you commit a change directly to a Git-backed entity such as a pipeline or template, Harness evaluates the onSave policy and blocks pipeline execution when the most recent commit fails the policy check, so entities committed directly to Git are governed the same way as entities saved in Harness. This feature is behind the feature flags `PIPE_OPA_GITX_ENFORCEMENT` and `PIPE_ENABLE_OPA_GOVERNANCE_FOR_AUTO_CREATION`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-34841]
* You can now **refresh the Git cache for remote entities on demand**. Use the **Reload from Git** option in the pipeline, input set, or template studio, or call the refresh API, to pull the latest version from Git and update the cache without waiting for a webhook. Refreshing an entity also reloads the caches of its referenced entities. This feature is behind the feature flag `PIPE_GITX_FORCE_REFRESH`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-34731]
* Harness now provides a **Webhooks monitoring page** for Git Experience. The **Events** tab shows the history of processed webhook events for troubleshooting synchronization, and the **Observability** tab monitors repository synchronization health and Git provider API rate-limit consumption. The observability views are behind the feature flags `PIPE_GITX_RATE_LIMITS_API` and `PIPE_GITX_WEBHOOK_HEALTH_PER_REPO`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-34743]
* Harness now exposes **input set expressions** at runtime. When an execution uses one or more input sets, you can reference each input set's identifier, name, description, type, tags, and scope through zero-based expressions such as `<+inputSet.details[0].name>`, for example to include an input set name in an artifact path or to log which input sets were applied. \[PIPE-34829]
* Harness now supports **multi-line string input for custom variables**. When you enable multi-line input on a pipeline-scoped or stage-scoped string variable, the value field becomes a resizable text area, which makes it easier to enter and read values that span multiple lines such as YAML configuration or a list of IP addresses. The expanded text area appears wherever the variable's value is prompted, including the run pipeline dialog and input sets. This feature is behind the feature flag `PIPE_MULTILINE_VARIABLE_INPUT`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-34821]
* Harness now detects **barrier reference cycles** and enforces unique barrier references within a stage or step group, preventing circular barrier dependencies that could deadlock a pipeline. The Barrier step documentation has also been revamped, including guidance on using multiple barriers and barriers within looping strategies. This validation is behind the feature flag `PIPE_DETECT_BARRIER_CYCLES`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-34524]
* The **Policy Sets** listing page now supports **Type** and **Action** filters, so you can narrow the policy sets list to a specific entity type or trigger action. This brings the **Policy Sets** page in line with the filters already available on the **Policy Evaluations** page. \[PIPE-34516]
* Pipeline graphs can now open zoomed to fit by default and preserve the selected zoom level when navigating between pipeline views. Zoom levels are preserved per pipeline in the browser for Pipeline Studio and pipeline execution views. This feature is behind the feature flag `PIPE_GRAPH_VIEWPORT_PERSISTENCE`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-34857]
**Continuous Integration**
* Added support for internal CA certificate injection in Windows build pods. When configured, custom CA certificates are automatically imported into the Windows certificate store during CI builds, enabling connectivity to internal registries and services behind corporate CAs. This feature is behind a feature flag. Contact [Harness Support](mailto:support@harness.io) to enable. \[CI-24139]
* Added support for resource overrides for Build Intelligence and Cache Intelligence in V1 YAML pipelines. You can now configure custom resource limits directly in V1 pipeline YAML and templates. \[CI-22033]
* Added Azure Blob Storage support for Docker Layer Caching (DLC) in V1 YAML pipelines. \[CI-24192]
**Infrastructure as Code Management**
* Module Registry is now generally available. No feature flag and no opt-in is required. You can publish modules, browse versions, and read auto-generated docs out of the box. \[IAC-7302]
* Added an **Examples** tab to registry modules, now enabled for everyone. The plugin uploads examples by default, so published modules arrive with runnable usage. \[IAC-7222]
* Provider Registry is now generally available. Host and consume your own Terraform and OpenTofu providers alongside your modules. \[IAC-7654]
* Sparse checkout is now generally available. Clone only the directories a workspace needs instead of the whole repository. \[IAC-3286]
* Removed resources are now generally available. See what a plan is about to destroy without reading raw plan output. \[IAC-7294]
* Sensitive data pruning in the UI is now generally available. Values marked sensitive stay redacted everywhere they surface. \[IAC-7293]
* Data sources are now generally available in the workspace resource view. \[IAC-3622]
* Terragrunt stacks now report human-readable drift at both the stack level and the individual resource level, with a full stack-level diff. \[IAC-7453, IAC-6937]
* Drift status and attributes moved into dedicated columns, and existing records were backfilled in a one-time migration. Drift is now filterable and sortable instead of being stored in a blob. \[IAC-7578, IAC-7579]
* The plugin now reports drift directly from the drift stage and applies sensible defaults during apply. \[IAC-7345]
* Variable sets are now shown for Terragrunt-managed workspaces, matching the Terraform experience. \[IAC-7587]
* Added support for Terragrunt 0.37.0 through 0.47.0. \[IAC-7060]
* Introduced stack-based flex billing and a provisioner-based billing strategy, so usage is counted by what you actually provisioned. \[IAC-7576, IAC-7362]
* Added new OpenTofu versions to the provisioner catalog. \[IAC-7335]
* Extended dynamic runtime install to Java, Go, and three more languages, for workspaces that need extra tooling at execution time. \[IAC-7262, IAC-7261]
* The provisioner now trusts corporate CAs, including behind a TLS-intercepting proxy, with dual-source CA trust through `HARNESS_CA_PATH`. \[IAC-7384, CI-23161]
* Added a `TOFU_CPU_PROFILE` switch for profiling long-running provisioner runs. \[IAC-7848]
* Raised the IaCM and OPA policy evaluation timeout to 90 seconds so large plans finish evaluating. \[IAC-7580]
* Moved plugin images to the Harness registry with hardened, scan-clean base images. \[IAC-6924]
**Cloud Cost Management**
* Accurate EKS cluster costs on Self-Managed Platform: Split Cost Allocation Data (SCAD) is now supported for Amazon EKS clusters. SCAD reads exact pod, node, and unallocated costs from your AWS Cost and Usage Report instead of estimating them from agent utilization. To use it, enable Split Cost Allocation Data on your AWS account and include the split cost columns in the report Harness ingests. This feature is behind the feature flag `CCM_SCAD_ENABLED_AWS`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CCM-34092]
**Code Repository**
* Added a feature flag to enable the **Code 3.0 UI** on Self-Managed Platform. Contact [Harness Support](mailto:support@harness.io) to enable.
* A hotfix to 0.45.0 adds the `CODE_PRINCIPALS_SCOPED_LISTING` and `CODE_UI_MIGRATED_VERSION` feature flags, which support migration to the new Code UI. Contact [Harness Support](mailto:support@harness.io) to enable.
**Fixed issues**
**Harness Platform**
* Updated the Harness CLI onboarding documentation and the **Get Started** wizard, which referenced commands and features that no longer work. The wizard and docs now use the currently supported CLI syntax, and broken links and unsupported commands have been removed. \[PL-67535]
**Continuous Delivery**
* Fixed an issue where Custom Deployment service and infrastructure list APIs took 2 to 5 minutes to respond for accounts with many remote entities. The APIs now persist template metadata directly instead of fetching and parsing YAML from Git on every request. This fix requires the feature flag `CDS_USE_METADATA_FOR_CUSTOM_DEPLOYMENT_LIST`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-127197, ZD-117948]
* Fixed a NullPointerException in the Jenkins build trigger step when Jenkins returns HTTP 200 without a Location header instead of 201 Created. The step now fails with a clear error message. \[CDS-128535, ZD-119752]
* Fixed a NullPointerException when deleting a service in Self-Managed Platform 0.43.1. \[CDS-128638, ZD-120407]
* Fixed an issue where approval step expressions (such as `<+approval.approvedAt>` or `<+approval.approver>`) resolved to null when re-running a pipeline past an already-approved step. Approval expressions now correctly resolve to the original approver and approval details even when the Harness Approval step is skipped during a re-run. \[CDS-129017]
* Fixed an issue where the K8s Canary Delete step failed with "Canary Deploy step is not configured" when both steps were in the same non-containerised step group and an earlier step group was skipped. \[CDS-127911]
* Fixed an issue where disabling the artifact in a stage still enforced a primary artifact reference, which prevented affected pipelines from running. \[CDS-125804, ZD-116383]
* Fixed an issue where the notification event type intermittently contained infrastructure metadata instead of the event type in notification templates. The event type now resolves to the type alone, and a separate event details value provides the descriptive information. This fix requires the feature flag `CDS_CLEAN_NOTIFICATION_EVENT_TYPE`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-126015, ZD-116200]
* Fixed an issue where secret override references generated a malformed URL when opened from the secrets page in the unified view. The links resolved correctly in the Continuous Delivery module but broke in the unified view. \[CDS-127486, ZD-118858]
* Fixed an issue where saving or cloning a service or environment to Git failed because the dialog closed unexpectedly, which also prevented moving these entities from inline to Git. \[CDS-127728, ZD-119243]
* Fixed an issue where the GitOps Sync step reported success even when the sync operation failed. The step now stops polling and fails when the sync operation fails. \[CDS-129023]
* Fixed an issue where the GitOps Update Application step applied Helm or Kustomize configuration to Argo CD applications regardless of the application's actual source type. The step now validates the application's source type before applying values and fails with a clear error if the types do not match. \[CDS-128550]
* Fixed an issue where the UpdateReleaseRepo step wrote dot-notation variable names as flat keys instead of nested objects when creating a new release repo file. \[CDS-129370, ZD-121095]
* Fixed an issue where GitOps service and environment cluster filtering returned incorrect results when multiple GitOps agents registered clusters under the same cluster identifier. Clusters belonging to some agents could be silently dropped, and tag-based filtering could pull in the wrong agent's cluster. Cluster filtering now resolves the correct agent's cluster in these scenarios. \[CDS-128253]
* Fixed an issue where GitOps sync and related PR pipeline steps failed for applications that were not in the GitOps agent's namespace. Harness now includes the application namespace in the API call, so applications outside the agent's namespace resolve correctly. \[CDS-128210, ZD-119891]
**Pipelines**
* Fixed an issue where the pipeline dry-run validation API returned an unclear system error instead of a clear validation message when required request fields were missing or sent using camelCase instead of the documented snake\_case names. The endpoint now returns clear validation errors, and the response schema matches the documentation. \[PIPE-35414, ZD-117700]
* Fixed an issue where the Harness pipeline and template pages loaded indefinitely. \[PIPE-35665, ZD-118407]
* Fixed an issue where a fast-fail (`failAll: true`) rollback action nested under the `onRetryFailure` action of a step-level Retry failure strategy caused pipeline plan creation to fail. Pipeline rollback with fast-fail now works in this configuration. \[PIPE-35748, ZD-118300]
* Fixed an issue where the entity setup usage API returned incomplete references when filtering by version label for a stable template version. \[PIPE-35753, ZD-118292]
* Fixed an issue where bulk template reconciliation failed with a null pointer error when a stable-label reference resolved to a null template entity. \[PIPE-35881, ZD-119121, ZD-119208]
* Fixed an issue where pipeline rollback steps were skipped when the `PIPE_CACHE_CURRENT_STATUS` feature flag was enabled and a CD stage with multiple services failed while conditional execution used `currentStatus` expressions. This fix is behind the feature flag `PIPE_CACHE_CURRENT_STATUS`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-35942]
* Fixed an issue where a custom webhook trigger reported a successful activation but did not start a pipeline execution, and the trigger activity details did not link to the triggered execution. Harness now handles null payloads and headers in the v1 trigger flow, so the trigger starts the pipeline and records the execution as expected. \[PIPE-35796]
* Fixed an issue where a Kubernetes deployment pipeline timed out after the Apply step because the wait-for-steady-state task progress was not shown in the UI. The progress display could stall when the Apply step's command unit progress update arrived after the wait-for-steady-state update, due to network delays and a race in the underlying database updates. Harness now adds timestamps to the delegate messages so task progress is reported correctly. \[PIPE-34973, ZD-112099]
* Fixed an issue where the Policy tile did not appear under account-level Security and Governance settings, which prevented users from enabling policies. \[PIPE-35694, ZD-118733]
* Fixed an issue where changes made to a pipeline YAML in a Bitbucket repository were not reflected in Harness because the cached copy did not refresh. This fix requires the feature flag `PIPE_DISABLE_BITBUCKET_SERVER_GITX_WEBHOOK_GIT_SUFFIX_MATCH`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-35731, ZD-118862]
* Fixed an issue where a pipeline execution ID that began with a hyphen was interpreted as a command-line flag and caused evidence upload commands to fail. Harness now ensures execution IDs do not start with a hyphen. \[PIPE-35734]
* Fixed an issue where steps in a matrix strategy displayed logs from only a single iteration. This fix is behind the feature flag `PIPE_ENABLE_STRATEGY_FOR_CHAINED_PIPELINE`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-35726]
**Continuous Integration**
* Fixed an issue where the Build and Push step failed with Kaniko 1.13.9 due to overly strict symlink validation that rejected valid symbolic links (for example, `/etc/pki/java/cacerts`) with a "resolves outside destination" error. \[CI-23751, ZD-119116, ZD-119213, ZD-120017]
* Fixed an issue where secrets were not resolved in DBOps Schema Apply clone codebase child steps on Kubernetes build infrastructure when the `db_schema_clone_script_secrets_provided_runtime` account setting was enabled. \[CI-24059]
* Resolved intermittent image pull failures affecting BuildKit-based Build and Push steps by pinning the BuildKit image to a stable version. \[CI-23987, ZD-120087, ZD-120475, ZD-120589]
* Fixed an issue where the `ci-addon` process crashed when calculating tests in parallel with Test Intelligence enabled and no matching test files were found. \[CI-23548, ZD-117896]
* Fixed an issue where Cache Intelligence selected an incorrect or default cache path instead of the user-specified source paths. Auto-detection is now disabled when custom source paths are provided. \[CI-24161, ZD-120996, ZD-121307]
* Fixed an issue where Build Intelligence did not honor the AWS connector cross-account role for the S3 backend with IAM Roles for Service Accounts (IRSA). \[CI-23624, ZD-118233]
* Fixed an issue where the `drone-git` image update to version 1.7.23 or later failed on ARM64 nodes due to incorrect multi-architecture manifest resolution, which caused an "exec format error" during Git Clone steps. \[CI-23890, ZD-119773]
* Fixed an issue where Gradle auto-injection corrupted the `gradle.properties` file when it did not end with a trailing newline, which caused build failures. \[CI-24154, ZD-121100]
* Improved hcli security by resolving known vulnerabilities. \[CI-23724, ZD-120547]
**Infrastructure as Code Management**
* Stopped retrying policy evaluations rejected for oversized payloads. Failures now surface immediately instead of consuming the run's timeout. \[IAC-7405]
* Hardened plugin image builds and cleared vulnerabilities flagged in provisioner base images. \[IAC-692, IAC-7194]
**Harness image updates**
| Image | Change | Previous Version | New Version |
| ---------------------------------------------------------------------------- | ------------------------------------ | ---------------- | ----------- |
| `harness/ci-addon` | Windows CA cert injection (CI-24139) | 1.18.27 | 1.18.29 |
| `harness/ci-lite-engine` | Windows CA cert injection (CI-24139) | 1.18.27 | 1.18.29 |
| `kaniko`, `kaniko-ecr`, `kaniko-gcr`, `kaniko-gar`, `kaniko-acr` | Symlink validation fix (CI-23751) | 1.13.9 | 1.13.10 |
| `plugins/docker`, `plugins/ecr`, `plugins/acr`, `plugins/gcr`, `plugins/gar` | Version update | 21.3.2 | 21.3.3 |
| `harness/drone-git` | ARM64 manifest fix (CI-23890) | 1.7.20 | 1.7.25 |
| `harness/harness-cache-server` | Version update | 1.7.23 | 1.7.25 |
| `plugins/cache` (all variants) | Gradle auto-injection fix (CI-24154) | 1.10.9 | 1.10.10 |
### Version 0.41.3
August 17, 2026, Version 0.41.3
August 17, 2026
{% hint style="warning" %}
**Important**
If you use Infrastructure as Code Management, follow this upgrade path.
* **You are on 0.41.x and your upgrade to 0.42.0 or later failed:** Version 0.42.0 and later introduce an IaCM database migration that requires every IaCM record to carry an internal identifier. The background job that creates these identifiers was not enabled in earlier releases, so the database was not in a state where the migration could complete, and the upgrade failed. Upgrade to **0.41.3** first. This release enables that job so it prepares the database. Allow the job time to finish before you upgrade to 0.42.0 or later. The job runs on an interval, and how long it takes depends on how much IaCM data your installation holds.
* **You upgraded successfully to 0.42.0 or 0.43.0:** Upgrade to **0.44.0** before you upgrade any further.
{% endhint %}
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.130.7 | [1.130.x](/release-notes/continuous-integration.md#version-11300), [1.129.x](/release-notes/continuous-integration.md#version-11290), [1.128.x](/release-notes/continuous-integration.md#version-11280) |
| | Log Service | 1.45.3 | - |
| | Test Intelligence Service | 1.65.1 | - |
| DB Devops | DB Devops Service | 1.88.0 | [1.88.x](/release-notes/database-devops.md#release-188x), [1.87.x](/release-notes/database-devops.md#release-187x), [1.86.x](/release-notes/database-devops.md#release-186x), [1.85.x](/release-notes/database-devops.md#release-185x) |
| GitOps | GitOps Service | 1.55.7 | [1.55.x](/university/continuous-delivery.md#gitops-service-1557-gitops-agent-01150), [1.54.x](/university/continuous-delivery.md#gitops-service-1543-gitops-agent-01142) |
| STO | STO Core | 1.188.3 | [1.187.x](/release-notes/security-testing-orchestration.md#version-11872) |
| | Ticket Service | 1.8.0 | - |
| CCM | CE Nextgen | 1.86.20 | [1.86.15](/release-notes/cloud-cost-management.md#april-2026---version-18615), [1.84.4](/release-notes/cloud-cost-management.md#march-2026---version-1844), [1.83.1](/release-notes/cloud-cost-management.md#march-2026---version-1831) |
| | Batch Processing | 1.84.11 | - |
| | NG CE UI | 1.83.7 | - |
| | Anomaly Detection | 1.26.1 | - |
| | Telescopes | 1.7.2 | - |
| | Event Service | 1.15.2 | - |
| Feature Flags | Feature Flag Service | 1.1181.0 | [1.1181.x](/release-notes/feature-flags.md#april-2026) |
| | Feature Flag Pushpin Service | 1.1139.0 | - |
| IaCM | IACM Manager | 1.138.1 | [1.138.x](/release-notes/infrastructure-as-code-management.md#april-2026) |
| | IAC Server | 1.370.2 | - |
| Code Repository | Code API | 1.81.4 | [1.80.x](/release-notes/code-repository.md#version-180x) |
| | Code GitRPC | 1.81.1 | - |
| | Code GitHA | 1.81.0 | - |
| | Code Search | 1.81.0 | - |
| SSCA | SSCA Manager | 1.58.8 | [1.57.x](/release-notes/software-supply-chain-assurance.md#version-v1570--plugin-version-v0570) |
| | Component Analysis Service | 1.7.0 | - |
| | Component Service | 1.11.3 | - |
| | SSCA UI | 0.45.2 | - |
| Platform | Platform Service | 1.117.0 | [1.117.x](/release-notes/platform.md#version-1117x-), [1.116.x](/release-notes/platform.md#version-1116x-), [1.115.x](/release-notes/platform.md#version-1115x-) |
| | Access Control | 1.240.0 | - |
| | Audit Event Streaming | 1.84.0 | - |
| | Gateway Service | 1.62.5 | - |
| | NG Auth UI | 1.39.0 | - |
| | NG Dashboard Aggregator | 1.103.0 | - |
| | Policy Management | 1.46.1 | - |
| | Service Discovery Manager | 0.63.1 | - |
| Resilience testing | Chaos Manager | 1.83.5 | [1.83.x](/release-notes/chaos-engineering.md#version-1834), [1.82.x](/release-notes/chaos-engineering.md#version-1821), [1.81.x](/release-notes/chaos-engineering.md#version-1810) |
| | Chaos CRD | 1.82.0 | - |
| | Chaos K8s IFS | 1.83.0 | - |
| | Chaos Linux IFC | 1.83.0 | - |
| | Chaos Linux IFS | 1.83.0 | - |
| | Chaos Machine IFS | 1.83.0 | - |
| | Chaos Machine IFC | 1.83.0 | - |
| | Chaos Web | 1.83.2 | - |
| Continuous Delivery | NG Manager | 1.139.3 | [1.139.x](/university/continuous-delivery.md#version-11393), [1.138.x](/university/continuous-delivery.md#version-11385), [1.137.x](/university/continuous-delivery.md#version-11370) |
| | NG Custom Dashboards | 1.105.0 | - |
| | Pipeline Service | 1.179.3 | - |
| | Harness Manager | 1.138.5 | - |
| | Template Service | 1.141.2 | - |
| | Queue Service | 1.9.0 | - |
| | Debezium Service | 1.25.3 | - |
| | Delegate Proxy | 1.9.0 | - |
| | Delegate Version (Immutable) | 26.04.88902 | - |
| Others | Helm Chart | [0.41.3](https://github.com/harness/helm-charts/releases/tag/harness-0.41.3) | - |
| | Air Gap Bundle | [0.41.3](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.41.3) | - |
| | Bootstrap | 1.71.1 | - |
| | Change Data Capture | 1.52.1 | - |
| | Looker | 1.14.1 | - |
| | UI | 1.36.0 | - |
| | SCM Service | 1.45.1 | - |
| | Next Gen UI | 1.126.2 | - |
| | CV Nextgen | 1.61.1 | - |
| | LE Nextgen | 1.18.0 | - |
| | SRM UI | 1.16.2 | - |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, go to the **Version 0.38.x and later** tab in [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) to download airgap bundles using the interactive scripts, organize the core modules and execution components, and push them to your private container registry.
**Fixed issues**
**Infrastructure as Code Management**
* Fixed an issue where some IaCM records were missing the internal identifier that the database migration in 0.42.0 and later requires, which caused that migration to fail and blocked the upgrade. The IaC server now assigns a stable identifier to these records, so the upgrade completes.
* The background job that assigns these identifiers now runs by default instead of requiring an environment variable to enable it. To turn it off, set `DISABLE_BACKFILL_JOB_PRODUCER` or `DISABLE_BACKFILL_JOB_CONSUMER` to `true` on the IaC server.
* Patched reported CVEs in the IaC server Self-Managed image.
### Version 0.44.0
August 10, 2026, Version 0.44.0
August 10, 2026
{% hint style="danger" %}
**Breaking changes**
**MongoDB 8.0 for in-cluster MongoDB**
* Harness SMP **0.44.0** ships **MongoDB 8.0** (`harnesssecure/mongo:8.0.26-jammy`) for in-cluster MongoDB. MongoDB 7.0 was used from 0.33.x through 0.43.x.
* MongoDB does not allow you to skip major versions. Upgrade to at least SMP 0.33.0 (MongoDB 7.0) before you upgrade to 0.44.0 (MongoDB 8.0).
* Keep the MongoDB FCV upgrade job **enabled** (`upgrades.mongoFCVUpgrade.enabled: true`, the default) so Feature Compatibility Version stays aligned with the MongoDB server during the upgrade. Argo CD users must run the FCV job manually before the main upgrade.
* Go to the [MongoDB Upgrade to Version 8.x](#mongodb-upgrade-to-version-8x-in-smp-environments) note at the top of these release notes for the full version history and upgrade path.
{% endhint %}
{% hint style="warning" %}
**Important**
Customers using **Security Testing Orchestration (STO)** who upgrade from SMP **0.43.x** to **0.44.0** can encounter a database migration failure that prevents `sto-core` from starting, which stops STO scans from running.
To resolve this issue, upgrade to SMP **0.44.1**.
If you cannot upgrade immediately, run the following query against the STO PostgreSQL database as a temporary workaround:
```sql
UPDATE schema_migrations
SET version = 20260608053929, dirty = false
WHERE version = 20260608053930;
```
After the query completes, restart the `sto-core` pods.
{% endhint %}
{% hint style="warning" %}
**FIPS compatibility**
Releases 0.44.2, 0.47.0, and 0.48.0 are FIPS compatible. Releases 0.44.0, 0.44.1, 0.45.x, and 0.46.x are not. If your environment requires FIPS compliance, upgrade to 0.44.2, 0.47.0, or 0.48.0. Contact [Harness Support](mailto:support@harness.io) for guidance on FIPS-compatible options.
{% endhint %}
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.149.0 | [1.149.x](/release-notes/continuous-integration.md#version-11490), [1.148.x](/release-notes/continuous-integration.md#version-11480), [1.147.x](/release-notes/continuous-integration.md#version-11470), [1.146.x](/release-notes/continuous-integration.md#version-11460), [1.145.x](/release-notes/continuous-integration.md#version-11450) |
| | Log Service | 1.48.3 | - |
| | Test Intelligence Service | 1.74.1 | - |
| DB Devops | DB Devops Service | 1.100.0 | - |
| GitOps | GitOps Service | 1.62.3 | [1.62.x](/university/continuous-delivery.md#gitops-service-1623-gitops-agent-01220), [1.61.x](/university/continuous-delivery.md#gitops-service-1610-gitops-agent-01210) |
| STO | STO Core | 1.198.3 | - |
| | Ticket Service | 1.14.0 | - |
| CCM | CE Nextgen | 1.93.7 | - |
| | Batch Processing | 1.91.10 | - |
| | NG CE UI | 1.89.8 | - |
| | Anomaly Detection | 1.29.0 | - |
| | Telescopes | 1.7.2 | - |
| | Cloud Info | 1.17.1 | - |
| | Event Service | 1.18.1 | - |
| Feature Flags | Feature Flag Service | 1.1207.0 | - |
| | Feature Flag Pushpin Service | 1.1139.0 | - |
| IaCM | IACM Manager | 1.161.1 | - |
| | IAC Server | 1.404.0 | - |
| Code Repository | Code API | 1.89.0 | - |
| | Code GitRPC | 1.89.0 | - |
| | Code GitHA | 1.89.0 | - |
| | Code Search | 1.89.1 | - |
| SSCA | SSCA Manager | 1.62.8 | - |
| | Component Analysis Service | 1.11.0 | - |
| | Component Service | 1.15.0 | - |
| | SSCA UI | 0.49.1 | - |
| Platform | Platform Service | 1.135.0 | - |
| | Access Control | 1.285.0 | - |
| | Audit Event Streaming | 1.100.0 | - |
| | Gateway Service | 1.68.0 | - |
| | NG Auth UI | 1.39.0 | - |
| | NG Dashboard Aggregator | 1.119.0 | - |
| | Policy Management | 1.55.0 | - |
| | Service Discovery Manager | 0.70.0 | - |
| Resilience testing | Chaos Manager | 1.90.5 | - |
| | Chaos CRD | 1.82.0 | - |
| | Chaos K8s IFS | 1.90.0 | - |
| | Chaos Linux IFC | 1.90.0 | - |
| | Chaos Linux IFS | 1.90.0 | - |
| | Chaos Machine IFS | 1.90.0 | - |
| | Chaos Machine IFC | 1.90.0 | - |
| | Chaos Web | 1.90.4 | - |
| | Load Test Manager | 1.13.1 | - |
| Continuous Delivery | NG Manager | 1.158.4 | [1.158.x](/university/continuous-delivery.md#version-11584), [1.157.x](/university/continuous-delivery.md#version-11574), [1.155.x](/university/continuous-delivery.md#version-11556), [1.154.x](/university/continuous-delivery.md#version-11547) |
| | NG Custom Dashboards | 1.119.0 | - |
| | Pipeline Service | 1.197.1 | [1.197.x](/university/continuous-delivery.md#pipeline-service-11971), [1.196.x](/university/continuous-delivery.md#pipeline-service-11962), [1.195.x](/university/continuous-delivery.md#pipeline-service-11954), [1.194.x](/university/continuous-delivery.md#pipeline-service-11941) |
| | Harness Manager | 1.152.4 | - |
| | Template Service | 1.155.2 | - |
| | Queue Service | 1.11.0 | - |
| | Debezium Service | 1.27.0 | - |
| | Delegate Proxy | 1.9.0 | - |
| | Delegate Version (Immutable) | 26.06.89303 | - |
| Others | Helm Chart | [0.44.0](https://github.com/harness/helm-charts/releases/tag/harness-0.44.0) | - |
| | Air Gap Bundle | [0.44.0](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.44.0) | - |
| | Bootstrap | 1.74.1 | - |
| | Change Data Capture | 1.59.0 | - |
| | Looker | 1.18.1 | - |
| | UI | 1.36.0 | - |
| | SCM Service | 1.53.0 | - |
| | Next Gen UI | 1.140.6 | - |
| | CV Nextgen | 1.66.0 | - |
| | LE Nextgen | 1.19.0 | - |
| | SRM UI | 1.16.2 | - |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**New features and enhancements**
**Continuous Delivery**
* AWS CDK steps now run on ECS-based delegates, so you can execute CDK synth and deploy steps without a Kubernetes delegate runtime. This feature requires feature flags. Contact [Harness Support](mailto:support@harness.io) to enable.
* Google Cloud Run and GKE deployments now support pause and rollout control, so you can deploy without traffic, shift a percentage of traffic, run validations, and insert a manual approval step before you shift the remaining traffic. This feature requires feature flags. Contact [Harness Support](mailto:support@harness.io) to enable.
* Harness now supports **Git Experience for monitored services**, so you can store and manage monitored service configurations in your Git repository.
* AWS Auto Scaling Group (ASG) deployments now support **MixedInstancesPolicy** for optimizing cost and improving availability. You can configure a MixedInstancesPolicy in the ASG configuration JSON to allow AWS to select from multiple instance types, enabling spot instance usage and automatic fallback during capacity constraints. Harness automatically detects and updates the launch template version within the MixedInstancesPolicy configuration during deployments. \[CDS-109802]
* Kubernetes Blue Green deployments now support **automatic scale-up during rollback** to restore the previous deployment to its original replica count. When a deployment fails and triggers a rollback, the system automatically scales up the previous (stable) deployment after swapping services, ensuring traffic routes to active pods instead of scaled-down deployments. \[CDS-107483]
* Harness now supports **adding Approval steps inside Container Step Groups** in CD pipelines. When stage timeout exceeds 24 hours, pod TTL automatically extends to support longer approval response times. This feature requires the feature flag `CDS_CONTAINER_STEP_GROUP_STAGE_TIMEOUT`. Contact [Harness Support](mailto:support@harness.io) to enable.
* Harness now supports **automatic skipping of AWS CDK Deploy steps** when no infrastructure changes are detected by a preceding CDK Diff step, reducing deployment time. This feature requires the feature flag `CDS_SKIP_CDK_DEPLOY_IF_NO_DIFF`. Contact [Harness Support](mailto:support@harness.io) to enable.
* Harness now supports **storing Policy as Code evaluation input payloads in cloud storage** (GCS/S3) to optimize database performance and support larger inputs. Evaluation input data (pipeline YAML, Terraform plans, IaCM stacks) is stored in cloud storage, while evaluation results and metadata remain in the database for fast access. A new signed URL API endpoint (`GET /api/v1/evaluations/evaluation-input-signed-url/{id}`) allows you to retrieve input data from cloud storage. \[PIPE-34221]
* Harness now supports **storing monitored services in Git using GitX**, enabling version control and code review workflows for verification configurations. This feature requires the feature flag `CDS_CV_MS_GITX`. Contact [Harness Support](mailto:support@harness.io) to enable.
* Harness now supports **Fire and Forget** email notifications for the Email step, allowing pipeline execution to continue immediately without waiting for delivery confirmation.
* Harness now supports **Preserve Directory Structure** when copying config files in the Command step. The Copy command now includes a **Preserve Directory Structure** option that maintains the original directory hierarchy when copying config files to target hosts. This prevents data loss from file overwrites when multiple files share the same name but exist in different subdirectories (for example, `env1/config.properties` and `env2/config.properties`).
* Harness now supports **command flags for the Kubernetes Dry Run step**. You can pass additional kubectl flags (such as `--server-side` and `--force-conflicts`) to the dry run validation command. This ensures your dry run output accurately reflects the actual deployment behavior, making approval gates more reliable for teams using server-side apply or strict validation modes.
**GitOps**
* The GitOps agent now bundles ArgoCD 3.4.2. \[CDS-121725]
* You can now configure source namespaces directly in the AppProject create and edit forms. The new **Source Namespaces** field accepts namespace names, shell-style wildcards (for example, `team-*`), and regex patterns, and maps to `spec.sourceNamespaces` in the AppProject resource. \[CDS-125056]
* The GitOps agent now supports interactive web terminal sessions. The agent routes `TerminalExec` tasks from the Harness UI to the target pod using `kubectl exec`, enabling terminal access to running containers without leaving the Harness interface. \[CDS-125107]
* GitOps agent pods now enforce security context restrictions aligned with EKS CIS Benchmark 1.6, improving compliance for clusters running on Amazon EKS. \[CDS-118674]
* When creating a GitOps application, the service now validates the `metadata.namespace` field to ensure it contains a valid Kubernetes namespace name, and defaults to the agent's install namespace when the field is empty. This change is backward compatible. \[CDS-125050]
* You can now roll back a GitOps application to a previous deployment directly from the Harness UI. A new **History & Rollback** tab on the application details page shows the deployment history and lets you select a version to roll back to. Rollback is also available as a pipeline step. \[CDS-124453, CDS-124458]
* GitOps now supports Applications in Any Namespace. When you configure a cluster-scoped agent, you can specify `applicationNamespaces` to allow ArgoCD Application resources to be created in namespaces other than the agent's install namespace. Namespace-scoped agents are not supported for this feature. \[CDS-125046, CDS-125047, CDS-125053, CDS-125054]
* You can now force-delete a GitOps application from Harness when the underlying ArgoCD application is unreachable, for example when the agent or ArgoCD project has been deleted. The **Delete from Harness** option removes the application record without requiring connectivity to the agent. \[CDS-125317]
* GitOps now enforces finer-grained RBAC for application resource actions. A new permission separates access to application-level operations (create, edit, delete) from Kubernetes resource actions (sync, restart, delete pod). The ArgoCD RBAC engine in the agent can also be enabled via a feature flag for users who want ArgoCD project-level RBAC enforcement. \[CDS-124556, CDS-124557]
* The GitOps agent now supports the Zero Trust Service (ZTS) for agent-to-SaaS communication, sending task parameters through the ZTS validation flow for enhanced security. \[CDS-126136]
**Pipelines**
* Harness now supports **DAG (Directed Acyclic Graph) pipelines**, which let you define explicit dependencies between stages instead of relying on sequential or parallel stage order. Each stage declares the stages that must complete before it starts through the `dependsOn` field, so independent execution paths progress as soon as their own dependencies finish.
* Pipeline chaining now supports looping strategies when a parent pipeline calls a child pipeline, so you can run a child pipeline multiple times across a matrix or repeat configuration.
* Matrix looping strategies now evaluate `exclude` conditions at the beginning of the loop, so excluded combinations are removed before iterations start rather than skipped during execution.
* Harness now documents the Bitbucket on-premise connector configuration for Self-Managed Platform (SMP).
* Harness now documents the behavior of the GitHub connector when it retrieves branches, including how to work with repositories that contain a large number of branches.
* Harness now supports **6-month retention for Policy as Code evaluation data**. Policy evaluation data is retained for a default period of 6 months. If your account has a pipeline data retention policy that exceeds 6 months, your Policy as Code evaluations retention automatically aligns with your pipeline retention window. \[PIPE-34221]
* Harness now supports **template labels** for referencing template versions using semantic names instead of fixed version numbers. This feature requires the feature flag `PIPE_TEMPLATE_LABELS_FEATURE`. Contact [Harness Support](mailto:support@harness.io) to enable.
* Harness now supports **AND/OR logic for filtering pipeline executions by tags**, enabling **Matches Any** (OR) or **Matches All** (AND) filtering options.
**Continuous Integration**
* Added Azure Blob Storage support for Docker Layer Caching (DLC). You can now use Azure-backed storage as the backend for DLC operations, expanding DLC storage options beyond S3 and GCS. \[CI-22993, CI-23139]
* Improved lite-engine resilience by adding proper handling of 3XX/4XX responses from the log service. The lite-engine HTTP client now gracefully handles redirect and error responses during log stream and upload operations. \[CI-23135]
* Added project and organization identifiers to the logs streaming payload, improving traceability for log data across multi-tenant environments. \[CI-23272]
* Reduced initialization time for CI pipelines by removing the redundant execution graph copy from the initialization payload. This optimization is enabled by default for all V0 YAML pipelines across all build infrastructure types. If you experience unexpected behavior, you can get this optimization disabled by enabling the kill-switch feature flag `CI_DISABLE_INIT_STAGE_EXECUTION_STRIP` for your account. \[CI-23660, ZD-118018]
* Added support for `HARNESS_CA_PATH` in Docker and Buildx plugins, enabling builds behind TLS-intercepting egress proxies. The Docker plugin installs the CA into the host trust store before starting the daemon. The Buildx plugin forwards proxy environment variables and the CA path to the BuildKit container, resolving `x509: certificate signed by unknown authority` errors for base-image pulls. \[CI-23743, CI-23744]
* You can now opt in to CI init reduction time at the stage level by setting the stage variable `CI_INIT_REQUIRED_FIELDS_ONLY` to `true`. This reduces init time for stages with large step configurations without requiring the account-level feature flag `CI_INIT_REQUIRED_FIELDS_ONLY` to be enabled. This allows individual teams to adopt the optimization per project after upgrading their delegate. Requires delegate version 26.06.89309 or later. \[CI-23664]
* Improved Build and Push step performance on Kubernetes by eliminating double tar serialization in the Buildx plugin. Build + Scan + Push workflows now output images directly without intermediate tar load/save steps. \[CI-22998]
**Cloud Cost Management**
* GCP project labels and tags now available for cost filtering: You can now filter and group costs by GCP project labels and GCP resource tags in Looker dashboards. Previously, only resource-level labels were available. Both project labels and tags are now ingested and exposed as dimensions in the GCP and Unified explores. \[CCM-34388]
* Few services have been excluded from custom discounting. \[CCM-34826]
* GCP Project Name and GCP Project Number dimensions added to Unified Clickhouse Explore along with a common dimension for "AWS Account Name/GCP Project Name/Azure Subscription Name. \[CCM-32999] \[CCM-34388]
* The end date for the custom discounting has been updated to 2026-12-31 across all explores. \[CCM-34983]
**Chaos Engineering**
* Added support for custom service agent based services. You can now onboard and manage services that run their own chaos service agent instead of relying only on discovery-based onboarding.
* Added infrastructure type selection during service onboarding, which associates a service with the correct infrastructure from the start.
* Probe tuning in the experiment studio now inherits probe inputs from the linked Chaos Service, so inputs are pre-populated instead of re-entered. This behavior is gated by the `CHAOS_RISK_SERVICES_ENABLED` feature flag.
* Added service linking for load tests. You can now associate a load test with a service directly from the UI.
* Added image registry support for load testing across the frontend, backend, and DDCR, so load test runs can pull images from your configured registry at runtime.
* Added load profile enforcement for JMeter load tests. The number of users, duration, and ramp-up are now surfaced and applied consistently across script, zip, and custom-image modes.
* Added Datadog probe templates to the Enterprise ChaosHub, giving you ready-made Datadog health-check probes to start from.
* Added an API to list all services associated with a probe identity, which shows where a probe is used across your services.
* Added support for `serviceId` inside `probeRef` in the experiment YAML. A probe reference can now point to a specific service.
* Moved Chaos away from embedded dashboards. Dashboards now render natively instead of through an embedded view.
* Added list and details views for pipeline scans, letting you review scan results directly in the UI.
* Added scanned risks pages that display the risks identified during scans.
* Added a template-based flow for load tests. The load step, composite load stage, and pipeline now use templates instead of inline steps.
* Removed the redundant check when confirming network map and service creation, reducing duplicate validations during onboarding.
**Breaking changes**
**Continuous Delivery**
* The deprecated V1 Environments API (`POST`, `PUT`, and `DELETE /ng/api/environments`) now enforces environment RBAC permissions on create, update, upsert, and delete operations. This change was made as part of a security fix addressing a privilege-escalation issue in the NG APIs, where these endpoints previously performed no authorization checks. Requests made by a user, service account, or API token that lacks the required permission now fail with `403 NG_ACCESS_DENIED`, even when no configuration, token, or role binding has changed. Create, update, and upsert operations require `core_environment_edit`, and delete operations require `core_environment_delete` on the target environment. Grant the relevant permission on the affected environment(s) to restore access, or migrate to the V2 Environments API, which has always enforced these checks. \[CDS-126368]
* The Service Overrides API (`PUT /ng/api/serviceOverrides`) now enforces the `core_environment_edit` permission on the target environment for environment-scoped override operations. This change was made as part of a security fix addressing a privilege-escalation issue in the NG APIs. Previously, some override operations completed without this permission. Requests made by a user, service account, or API token that lacks `core_environment_edit`, including calls made through the **Update Service Overrides** pipeline step, now fail with `403 NG_ACCESS_DENIED`, even when no configuration, token, or role binding has changed. Grant `core_environment_edit` on the affected environment(s) to the relevant user, service account, or role to restore access. \[CDS-127611]
**Fixed issues**
Fixed an issue where the PostgreSQL upgrade script failed for installations upgrading from versions earlier than 0.36.0. The script now passes the configuration file location correctly. \[CLI-63517]
**Harness Platform**
* Fixed an issue where secret values were logged in plaintext in delegate logs during Custom Secret Manager test connections by marking the output variable as sensitive. \[PL-70423]
* Fixed an issue where the List Environments API could time out due to redundant permission checks. This has been optimized to improve response time and prevent timeouts. \[PL-71149]
* Fixed an issue where OPA policy checks configured with Warn and Continue for Service Accounts and API keys did not display warnings correctly. Policy evaluation responses are now properly returned, ensuring that warnings and errors are shown as expected in the UI. \[PL-71572]
* Fixed an issue where entities (File Store folders, Secrets, Services, and Environments) could be created with reserved identifiers (`orgs`, `organizations`, `project`, `projects`) that caused problems when editing or deleting them. New entities can no longer use these reserved identifiers. Existing entities with these identifiers continue to work but may encounter issues during updates or deletions. \[PL-71702]
* Fixed an issue where user groups were not correctly sorted by "Newest" (creation date) in the UI. \[PL-72530]
* Fixed an issue where deleting a user at the organization or project scope showed an incorrect "last admin" warning. Existing behavior for account scope and valid last-admin cases remains unchanged. \[PL-72546]
* Updated module name matching to be case-insensitive, improving consistency across configurations. \[PL-72549]
**Continuous Delivery**
* Fixed an issue where the Harness Terraform Provider returned an unclear error when a delegate token name was still reserved by a revoked token. When you reapply a configuration that uses the `harness_platform_delegatetoken` resource with the same token name, the error message now clearly states that the name is reserved by a revoked token. \[CDS-126825, ZD-117850]
* Fixed an issue where a Helm rollback ran against the wrong revision when the deploy step failed during pipeline execution. The rollback now targets the correct previous revision instead of the revision before it. \[CDS-124532]
* Fixed an issue where deployments failed due to freeze even though there were no active freeze windows. The retry execution helper did not consider freeze-failed stages as failures, so it never reran those stages. The system now correctly reruns freeze-failed stages. \[CDS-126767, ZD-117787]
* Fixed an issue where the runtime YAML of a stage type ECS deployment template is not rendering fully for OPA testing framework. \[CDS-125948, ZD-113014]
* Fixed an issue where the curl progress meter in the inbuilt download artifacts command step was shown in red (stderr) even though the step succeeds. Changed output from stderr to stdout. \[CDS-126051, ZD-116716]
* Fixed an issue where custom artifact polling failed intermittently under concurrent parallel stage execution. When multiple custom artifact sources were defined on a single service (for example, primary and sidecar artifacts), delegate tasks responsible for fetching each artifact's versions ran concurrently but shared the same temporary script file path. This caused a race condition where one task would overwrite the other's script, leading to the failing task being unable to find its expected output file. The Custom Artifact resolution now generates unique temporary file names for each concurrent task, ensuring that multiple custom artifact sources on the same service are resolved independently without interfering with each other. You do not need to take any action. The fix takes effect automatically upon delegate upgrade. \[CDS-123500, ZD-113475]
* Fixed an issue where the GitOps UpdateReleaseRepo step intermittently appeared stuck when many concurrent URR steps were in progress. Under high concurrency, the mechanism to take a lock on the GitHub token to avoid concurrent updates and prevent secondary rate limiting by GitHub caused the step to appear stuck while waiting for the lock to be acquired. Harness has added a new command unit in URR for git restraint logs to provide better visibility into lock contention. To resolve this issue, enable the `disableGitRestraint` flag on the pipeline to bypass the GitHub token lock mechanism, or use different git tokens to ensure the UpdateReleaseRepo step works efficiently in high-concurrency environments. \[CDS-125451, ZD-115644]
* Fixed an issue where Kubernetes Apply failed for large GitHub CRD manifests (approximately 1.21 MB) due to SCM fetch JSON unmarshal errors, resulting in empty compiled manifests during dry run. \[CDS-125617, ZD-115404]
**GitOps**
* Fixed an issue where the GitOps service returned a socket timeout when multiple sync pipelines ran against the same sync step in parallel. \[CDS-126736]
* Fixed an issue where the GitOps overview page did not display applications for users whose access was granted through label-based RBAC, even when those applications appeared correctly in the application list. \[CDS-125748]
* Fixed an issue where GitOps ApplicationSet validation failed on the `patches[0].target.resId` field, preventing ApplicationSets with valid resource patches from being saved. \[CDS-126249]
* Fixed an issue where bulk sync and refresh operations failed with a 502 error when using older agents, caused by a key mismatch between the agent and service. \[CDS-127729]
* Fixed an incorrect service port in the GitOps Helm chart that prevented the service from correctly routing HTTP traffic. \[CDS-127565]
* Fixed an issue where newly deployed GitOps applications never received utilization snapshots when the cluster state remained stable, causing them to be excluded from license counting and the Subscriptions usage view. \[CDS-123210]
* Fixed an issue where the redeploy button on the GitOps application UI page attempted to redeploy to the HEAD of the branch instead of the commit used for the original deployment. Also fixed an inconsistency where multi-source applications sometimes displayed a single source in the sync dialog. \[CDS-126340]
**Pipelines**
* Fixed an issue where a rollback step failure prevented subsequent rollback steps configured with the `Always` condition from executing in a CD stage. All rollback steps with the `Always` condition now run regardless of a failure in a previous rollback step. \[PIPE-34274, PIPE-35612, ZD-115229]
* Fixed an issue where a stage remained stuck in the running state after its execution failed, which blocked other executions at the resource constraint step. \[PIPE-35548, ZD-118196]
* Fixed an issue where failure strategy behavior was incorrect when the `PIPE_CACHE_CURRENT_STATUS` feature flag was enabled. Leaf steps skipped their immediate parent step group when updating cached status, which broke the execution hierarchy and prevented step group failure strategies from managing retries correctly. \[PIPE-35336]
* Fixed an issue where remote template responses did not include the `cache_response_metadata` field required to display Git Sync status. Templates now return this field for parity with pipelines. \[PIPE-35685]
* Fixed an issue where links redirected to the IDP view in the Harness UI. Added priority handling in one of the flows behind a feature flag. This fix requires the feature flag `PIPE_HONOR_PIPELINE_SDK_PRIORITY_IN_EXECUTION_URL`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-33955, ZD-114059]
* Fixed an issue where the values displayed under **Input Sets Applied** did not match the actual values consumed by the input set. \[PIPE-35102, ZD-115611]
* Fixed an issue where the **Insert Stage** functionality behaved inconsistently. This fix requires the feature flag `PIPE_INSERT_STAGE_EXTENDED_SUPPORT`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-35108, ZD-116644]
* Fixed an issue where pipelines failed to deserialize `ExecutionWrapperConfig` step nodes during plan creation for CI stages using flexible templates with insert nodes. The issue did not reproduce when the pipeline was loaded from saved YAML. \[PIPE-35174, ZD-117029]
* Fixed an issue where the retention period was not taking effect for the `cacheentities` collection. The conditional logic was not handled properly after the introduction of the `CDS_CUSTOMIZE_PIPELINE_TTL` feature flag. The flow has been corrected. \[PIPE-35283, ZD-114524]
* Fixed an issue where pressing Enter in the body field of an Email step configured as a runtime input triggered pipeline execution instead of inserting a newline. \[PIPE-35407, ZD-117195]
* Fixed an issue where the Pipeline Studio became unresponsive, and keyboard controls (arrow and number keys) in the execution view stopped working. This issue affected multiple CDK users. \[PIPE-35436, ZD-117645]
* Fixed an issue where re-running a CI pipeline threw platform `ClassCastException` errors during orchestration. The system now prevents pipelines with identity plan nodes from being saved and added validation checks to avoid the "IdentityPlanNode cannot be cast to PlanNode" error. \[PIPE-35450, ZD-117853]
* Fixed an issue where the pipeline template creation page continuously refreshed or flickered and did not load. \[PIPE-35504, ZD-117915]
* Fixed an issue where a template's "referencing entities" have some wrong entries (referencing entity no longer has reference). If pipeline no longer references a template, it will be removed from referencing entities of template. Similarly, if pipeline starts referring a template, it will show up in referencing entities. \[PIPE-33491, ZD-111733]
* Fixed an issue where api to list all templates in an organization is throwing an error. Added validation in auto create flow and blocked the creation. \[PIPE-34760, ZD-115536]
* Fixed an issue with selecting the input list during step runtime. \[PIPE-35004, ZD-115945]
* Fixed an issue where Harness did not strip `.git` from the repo URL while comparing two repo URLs. Blocked customers will now be able to see webhook events of a corresponding webhook. \[PIPE-35024, ZD-114997]
* Fixed an issue where a pipeline continued executing after the user marked it as failed due to a missing interrupt check. This fix requires the feature flag `PIPE_FAIL_USER_MARKED_FAIL_ALL_INTERRUPT_WITHOUT_LEAF_NODES`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-35074, ZD-116355, ZD-116823]
* Fixed an issue where unable to create template from pipeline. This fix requires the feature flag `PIPE_PIPELINE_STAGE_PIPELINE_TEMPLATE`. Contact [Harness Support](mailto:support@harness.io) to enable. \[PIPE-35106, ZD-114977, ZD-116644]
* Fixed an issue where reconcile errors persist for failure strategies after successful save. \[PIPE-35111, ZD-116644]
* Fixed an issue where users were unable to import a template into a pipeline from Bitbucket. \[PIPE-34247, ZD-114955]
* Fixed an issue where selecting parallel environments without choosing a value in the input set caused unsaved changes to appear when just viewing the YAML (from visual view). For parallel environments and environment groups, Harness now sets the **Use from Stage** or equivalent field to `false` in the pipeline input set. \[PIPE-34316]
**Continuous Integration**
* Fixed an issue where the Test Intelligence agent download used the internal ingress controller host instead of the configured vanity URL when `CI_OVERRIDE_SERVICE_URLS` was enabled in SMP environments. \[CI-23049, ZD-115722]
* Fixed an issue where pipeline execution tags with a value-less key were incorrectly filtered out. Tags with empty key values are now preserved. \[CI-23054]
* Fixed an issue where Run steps within Custom Stages were incorrectly counted against CI build entitlements. Custom stage pipelines no longer consume CI build quota. \[CI-22888]
* Fixed an issue where secret retrieval from Hashicorp vault was failing. \[CI-23109]
* Fixed an issue where Sysdig Drift Control blocked the `drone-git` plugin execution, causing database change workflows to fail. \[CI-22635, ZD-113405]
* Fixed an issue where the expression `pipeline.sequenceId` returned null when manually running a build using a Harness Code repository with the `CI_ENABLE_BRANCH_SEQUENCE_ID` feature flag enabled. The expression now resolves correctly for both triggered and manual builds. \[CI-22819, ZD-114394]
* Fixed a database index build failure related to the pipeline branch sequence feature that occurred due to duplicate data in production. \[CI-23050]
* Fixed an issue where secret identifiers were not displayed in error messages during Initialize step failures. Secret names now appear in failure logs, improving troubleshooting visibility. \[CI-23116, ZD-116285]
* Fixed an issue where connectors configured in CI Default Settings were parsed even when Test Intelligence features were disabled, causing unnecessary processing overhead. \[CI-23314]
* Fixed an issue where Git Clone operations failed in certain advanced configurations. \[CI-23523]
* Fixed an intermittent credential issue where the Push to ECR step failed when running multiple Build and Push steps in parallel with different connectors within the same stage. \[CI-23591, ZD-118232]
* Fixed an issue where secret values were incorrectly printed as Java object references (e.g., `SecretRefData@77d2ae9e`) in logs instead of being properly masked. \[CI-23597]
* Improved CI Manager API security by enforcing stricter account-tenant isolation on API endpoints. \[CI-23645]
* Improved ci-addon security by patching known vulnerabilities in the container image. \[CI-23239]
* Improved harness-cache-server security by resolving critical and high-severity vulnerabilities. \[CI-21725]
* Improved harnesssecure/kaniko security by resolving vulnerabilities in the container image. \[CI-23227]
* Improved `harnesssecure/cache` security by resolving vulnerabilities in the container image. \[CI-23240]
* Improved `harnesssecure/artifactory` security by resolving vulnerabilities in the container image. \[CI-23241]
**Cloud Cost Management**
* GCP costs in dashboards now match GCP Cost Explorer: GCP costs in the Unified ClickHouse explore now correctly reflect your negotiated discount. Previously, the discount was applied to billed cost instead of list cost, causing discrepancies when reconciling against GCP Cost Explorer. A new Total List Cost measure is also available. \[CCM-34826]
**Security Testing Orchestration**
* Fixed an issue where the GitHub Advanced Security (GHAS) scanner always connected to api.github.com and did not allow a custom API endpoint, preventing the scanner from working with GitHub Enterprise Server. The GHA scanner step now supports configuring a custom endpoint URL. \[STO-11802]
* Fixed an issue where the tooltip for the secret value field in the Black Duck STO step showed incorrect guidance, indicating that project-level secrets required a "project." prefix. \[STO-11777]
**Chaos Engineering**
* Fixed an issue where adding a fault, probe, or action step template did not show variables or runtime inputs at the account and organization scope.
* Fixed a sync issue with action and probe templates.
* Upgraded the go-redis package in the Linux IFC infrastructure component to fix CVE-2025-29923.
## July 2026
### Version 0.43.1
July 16, 2026, Version 0.43.1
July 16, 2026
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.144.0 | [1.144.x](/release-notes/continuous-integration.md#version-11440), [1.143.x](/release-notes/continuous-integration.md#version-11430) |
| | Log Service | 1.48.3 | - |
| | Test Intelligence Service | 1.74.1 | - |
| DB Devops | DB Devops Service | 1.100.0 | [1.100.x](/release-notes/database-devops.md#release-1100x), [1.99.x](/release-notes/database-devops.md#release-199x), [1.98.x](/release-notes/database-devops.md#release-198x) |
| GitOps | GitOps Service | 1.60.1 | [1.60.x](/university/continuous-delivery.md#gitops-service-1600-gitops-agent-01200), [1.59.x](/university/continuous-delivery.md#gitops-service-1590-gitops-agent-01190) |
| STO | STO Core | 1.198.3 | [1.197.x](/release-notes/security-testing-orchestration.md#version-11970) |
| | Ticket Service | 1.14.0 | - |
| CCM | CE Nextgen | 1.93.7 | [1.93.6](/release-notes/cloud-cost-management.md#june-2026---version-1936), [1.92.0](/release-notes/cloud-cost-management.md#june-2026---version-1920), [1.91.0](/release-notes/cloud-cost-management.md#june-2026---version-1910) |
| | Batch Processing | 1.91.10 | - |
| | NG CE UI | 1.89.8 | - |
| | Anomaly Detection | 1.30.0 | - |
| | Telescopes | 1.7.2 | - |
| | Cloud Info | 1.17.1 | - |
| | Event Service | 1.18.1 | - |
| Feature Flags | Feature Flag Service | 1.1207.0 | - |
| | Feature Flag Pushpin Service | 1.1139.0 | - |
| IaCM | IACM Manager | 1.161.1 | - |
| | IAC Server | 1.404.0 | - |
| Code Repository | Code API | 1.89.0 | - |
| | Code GitRPC | 1.89.0 | - |
| | Code GitHA | 1.89.0 | - |
| | Code Search | 1.89.1 | - |
| SSCA | SSCA Manager | 1.62.8 | [1.62.x](/release-notes/software-supply-chain-assurance.md#version-v1623--plugin-version-v0610) |
| | Component Analysis Service | 1.11.0 | - |
| | Component Service | 1.15.0 | - |
| | SSCA UI | 0.49.1 | - |
| Platform | Platform Service | 1.135.0 | [1.135.x](/release-notes/platform.md#version-1135x-), [1.134.x](/release-notes/platform.md#version-1134x-), [1.133.x](/release-notes/platform.md#version-1133x-), [1.132.x](/release-notes/platform.md#version-1132x-), [1.131.x](/release-notes/platform.md#version-1131x-) |
| | Access Control | 1.285.0 | - |
| | Audit Event Streaming | 1.100.0 | - |
| | Gateway Service | 1.68.0 | - |
| | NG Auth UI | 1.39.0 | - |
| | NG Dashboard Aggregator | 1.119.0 | - |
| | Policy Management | 1.55.1 | - |
| | Service Discovery Manager | 0.70.0 | - |
| Resilience testing | Chaos Manager | 1.90.5 | [1.90.x](/release-notes/chaos-engineering.md#version-1900), [1.89.x](/release-notes/chaos-engineering.md#version-1890) |
| | Chaos CRD | 1.82.0 | - |
| | Chaos K8s IFS | 1.90.0 | - |
| | Chaos Linux IFC | 1.90.0 | - |
| | Chaos Linux IFS | 1.90.0 | - |
| | Chaos Machine IFS | 1.90.0 | - |
| | Chaos Machine IFC | 1.90.0 | - |
| | Chaos Web | 1.90.4 | - |
| | Load Test Manager | 1.13.1 | - |
| Continuous Delivery | NG Manager | 1.153.6 | [1.153.x](/university/continuous-delivery.md#version-11530), [1.152.x](/university/continuous-delivery.md#version-11525), [1.151.x](/university/continuous-delivery.md#version-11514) |
| | NG Custom Dashboards | 1.119.0 | - |
| | Pipeline Service | 1.193.3 | - |
| | Harness Manager | 1.152.4 | - |
| | Template Service | 1.155.2 | - |
| | Queue Service | 1.11.0 | - |
| | Debezium Service | 1.27.0 | - |
| | Delegate Proxy | 1.9.0 | - |
| | Delegate Version (Immutable) | 26.06.89303 | - |
| Others | Helm Chart | [0.43.1](https://github.com/harness/helm-charts/releases/tag/harness-0.43.1) | - |
| | Air Gap Bundle | [0.43.1](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.43.1) | - |
| | Bootstrap | 1.74.1 | - |
| | Change Data Capture | 1.59.0 | - |
| | Looker | 1.18.1 | - |
| | UI | 1.36.0 | - |
| | SCM Service | 1.53.0 | - |
| | Next Gen UI | 1.140.6 | - |
| | CV Nextgen | 1.66.0 | - |
| | LE Nextgen | 1.19.0 | - |
| | SRM UI | 1.16.2 | - |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, visit the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md). Once there, select the Version 0.38.x and later tab. These instructions will walk you through downloading airgap bundles via interactive scripts, organizing modules, and pushing them to your private container registry.
**Fixed issues**
**Harness Platform**
* Fixed an issue where Policy Management on the Self-Managed Platform ignored platform feature flags enabled in harness-manager if the Feature Flags service wasn't installed.
Policy Management has been updated to read these enabled flags directly from the harness-manager CG/NG Manager API. To activate this behavior, enable `APP_FEATURE_FLAGS_USE_PLATFORM_ON_SMP` in the policy-mgmt chart. \[PIPE-35641]
### Version 0.36.6
July 9, 2026, Version 0.36.6
July 9, 2026
{% hint style="info" %}
**Important**
The migration from TimescaleDB to PostgreSQL is automatically triggered as part of the Harness SMP upgrade to version 0.36.x. Before you upgrade to SMP 0.36.x, you must be running version 0.35.x. Learn more about the migration in the [migration guide](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/migrate-timescaledb-to-postgresql.md).
{% endhint %}
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.36.6](https://github.com/harness/helm-charts/releases/tag/harness-0.36.6) |
| Air Gap Bundle | [0.36.6](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.36.6) |
| Access Control | 1.184.0 |
| Anomaly Detection | 1.20.0 |
| Audit Event Streaming | 1.73.0 |
| Batch Processing | 1.75.19 |
| Bootstrap | 1.64.1 |
| CE Nextgen | 1.77.11 |
| Change Data Capture | 1.49.4 |
| Chaos CRD | 1.72.0 |
| Chaos K8s IFS | 1.72.5 |
| Chaos Linux IFC | 1.72.2 |
| Chaos Linux IFS | 1.72.2 |
| Chaos Manager | 1.72.18 |
| Chaos Machine IFS | 1.72.3 |
| Chaos Machine IFC | 1.72.2 |
| Chaos Web | 1.72.10 |
| CI Manager | 1.119.11 |
| Cloud Info | 1.13.2 |
| CV Nextgen | 1.53.1 |
| DB Devops Service | 1.76.2 |
| Debezium Service | 1.25.0 |
| Delegate Proxy | 1.6.0 |
| Delegate Version (Immutable) | 26.01.88201 |
| Event Service | 1.14.0 |
| Feature Flag Pushpin Service | 1.1132.0 |
| Feature Flag Service | 1.1148.0 |
| Gateway Service | 1.59.2 |
| GitOps Service | 1.49.1 |
| Harness Manager | 1.127.0 |
| LE Nextgen | 1.12.2 |
| Log Service | 1.38.8 |
| Looker | 1.8.9 |
| Next Gen UI | 1.114.2 |
| NG Auth UI | 1.37.4 |
| NG CE UI | 1.73.7 |
| NG Custom Dashboards | 1.98.0 |
| NG Dashboard Aggregator | 1.92.0 |
| NG Manager | 1.128.4 |
| Pipeline Service | 1.168.5 |
| Platform Service | 1.106.3 |
| Policy Management | 1.35.6 |
| SCM Service | 1.43.0 |
| Service Discovery Manager | 0.52.3 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.48.32 |
| SSCA UI | 0.37.9 |
| STO Core | 1.175.7 |
| Telescopes | 1.6.0 |
| Template Service | 1.130.0 |
| Test Intelligence Service | 1.60.4 |
| Queue Service | 1.8.0 |
| Code API | 1.73.2 |
| Code GitRPC | 1.73.1 |
| Code GitHA | 1.73.1 |
| Code Search | 1.73.1 |
| IAC Server | 1.296.0 |
| IACM Manager | 1.125.0 |
| IDP Service | 1.36.9 |
| IDP Admin | 1.36.2 |
| IDP App UI | 1.36.8 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.36.6/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.6/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.6/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.6/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.6/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.6/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.6/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.6/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.6/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.6/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.6/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.6/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.6/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.6/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.6/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.6/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.6/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.6/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.6/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.6/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Harness Platform**
* Fixed an issue where the ti-service could fail to start up due to a duplicate `createpartitioningtable` function in PostgreSQL after the TimescaleDB to PostgreSQL migration. This issue only affects deployments with the CI module enabled. \[CLI-62437]
### Version 0.43.0
July 03, 2026, Version 0.43.0
July 03, 2026
{% hint style="warning" %}
**Important announcement**
1. **PostgreSQL 16 support:** Harness Self-Managed Enterprise Edition **0.43.0** introduces support for PostgreSQL 16. If your deployment uses PostgreSQL 14, follow the [PostgreSQL 14 to 16 upgrade guide](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/upgrade-postgresql-14-to-16.md). PostgreSQL 14 will be deprecated starting with 0.48.0.
2. **JEXL 3.5 upgrade:** Starting with Harness Self-Managed Enterprise Edition **0.43.0**, Harness upgrades JEXL from version 3.0 to 3.5 to improve platform security. This update introduces stricter validation for JEXL expressions, including restrictions on reflection-based expressions, global variable assignments, nested subscript expressions, and certain ternary expression patterns. Review the [JEXL 3.5 migration guidance](#jexl-35-upgrade-smp-0430) before upgrading.
{% endhint %}
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.144.0 | [1.144.x](/release-notes/continuous-integration.md#version-11440), [1.143.x](/release-notes/continuous-integration.md#version-11430) |
| | Log Service | 1.48.3 | - |
| | Test Intelligence Service | 1.74.1 | - |
| DB Devops | DB Devops Service | 1.100.0 | [1.100.x](/release-notes/database-devops.md#release-1100x), [1.99.x](/release-notes/database-devops.md#release-199x), [1.98.x](/release-notes/database-devops.md#release-198x) |
| GitOps | GitOps Service | 1.60.1 | [1.60.x](/university/continuous-delivery.md#gitops-service-1600-gitops-agent-01200), [1.59.x](/university/continuous-delivery.md#gitops-service-1590-gitops-agent-01190) |
| STO | STO Core | 1.198.3 | [1.197.x](/release-notes/security-testing-orchestration.md#version-11970) |
| | Ticket Service | 1.14.0 | - |
| CCM | CE Nextgen | 1.93.7 | [1.93.6](/release-notes/cloud-cost-management.md#june-2026---version-1936), [1.92.0](/release-notes/cloud-cost-management.md#june-2026---version-1920), [1.91.0](/release-notes/cloud-cost-management.md#june-2026---version-1910) |
| | Batch Processing | 1.91.10 | - |
| | NG CE UI | 1.89.8 | - |
| | Anomaly Detection | 1.30.0 | - |
| | Telescopes | 1.7.2 | - |
| | Cloud Info | 1.17.1 | - |
| | Event Service | 1.18.1 | - |
| Feature Flags | Feature Flag Service | 1.1207.0 | - |
| | Feature Flag Pushpin Service | 1.1139.0 | - |
| IaCM | IACM Manager | 1.161.1 | - |
| | IAC Server | 1.404.0 | - |
| Code Repository | Code API | 1.89.0 | - |
| | Code GitRPC | 1.89.0 | - |
| | Code GitHA | 1.89.0 | - |
| | Code Search | 1.89.1 | - |
| SSCA | SSCA Manager | 1.62.8 | [1.62.x](/release-notes/software-supply-chain-assurance.md#version-v1623--plugin-version-v0610) |
| | Component Analysis Service | 1.11.0 | - |
| | Component Service | 1.15.0 | - |
| | SSCA UI | 0.49.1 | - |
| Platform | Platform Service | 1.135.0 | [1.135.x](/release-notes/platform.md#version-1135x-), [1.134.x](/release-notes/platform.md#version-1134x-), [1.133.x](/release-notes/platform.md#version-1133x-), [1.132.x](/release-notes/platform.md#version-1132x-), [1.131.x](/release-notes/platform.md#version-1131x-) |
| | Access Control | 1.285.0 | - |
| | Audit Event Streaming | 1.100.0 | - |
| | Gateway Service | 1.68.0 | - |
| | NG Auth UI | 1.39.0 | - |
| | NG Dashboard Aggregator | 1.119.0 | - |
| | Policy Management | 1.55.0 | - |
| | Service Discovery Manager | 0.70.0 | - |
| Resilience testing | Chaos Manager | 1.90.5 | [1.90.x](/release-notes/chaos-engineering.md#version-1900), [1.89.x](/release-notes/chaos-engineering.md#version-1890) |
| | Chaos CRD | 1.82.0 | - |
| | Chaos K8s IFS | 1.90.0 | - |
| | Chaos Linux IFC | 1.90.0 | - |
| | Chaos Linux IFS | 1.90.0 | - |
| | Chaos Machine IFS | 1.90.0 | - |
| | Chaos Machine IFC | 1.90.0 | - |
| | Chaos Web | 1.90.4 | - |
| | Load Test Manager | 1.13.1 | - |
| Continuous Delivery | NG Manager | 1.153.6 | [1.153.x](/university/continuous-delivery.md#version-11530), [1.152.x](/university/continuous-delivery.md#version-11525), [1.151.x](/university/continuous-delivery.md#version-11514) |
| | NG Custom Dashboards | 1.119.0 | - |
| | Pipeline Service | 1.193.3 | - |
| | Harness Manager | 1.152.4 | - |
| | Template Service | 1.155.2 | - |
| | Queue Service | 1.11.0 | - |
| | Debezium Service | 1.27.0 | - |
| | Delegate Proxy | 1.9.0 | - |
| | Delegate Version (Immutable) | 26.06.89303 | - |
| Others | Helm Chart | [0.43.0](https://github.com/harness/helm-charts/releases/tag/harness-0.43.0) | - |
| | Air Gap Bundle | [0.43.0](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.43.0) | - |
| | Bootstrap | 1.74.1 | - |
| | Change Data Capture | 1.59.0 | - |
| | Looker | 1.18.1 | - |
| | UI | 1.36.0 | - |
| | SCM Service | 1.53.0 | - |
| | Next Gen UI | 1.140.6 | - |
| | CV Nextgen | 1.66.0 | - |
| | LE Nextgen | 1.19.0 | - |
| | SRM UI | 1.16.2 | - |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, go to [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) to follow the **Version 0.38.x and later** tab instructions for downloading airgap bundles using interactive scripts, organizing modules, and pushing them to your private container registry.
**Fixed issues**
**Harness Platform**
* Fixed an issue where Audit Logs could not be accessed from Account and Organization Settings when navigating within module-specific views. \[PL-72047]
* Fixed a visual issue in the CD and GitOps modules where a white border appeared around side navigation links when selected. This improves navigation consistency and user experience. \[PL-72071]
* Fixed an issue where navigation from the context menu could open the wrong project context. Project and organization identifiers are now correctly included in navigation URLs. \[PL-71553]
* Fixed AWS Secrets Manager failing after delegate upgrade from 26.05.89102 to 26.05.89205. The issue occurred because singleton credential caching caused conflicts during background refresh. The fix replaces singleton instances with independent instances and disables background credential refresh. \[PL-71883]
**Continuous Delivery**
* Fixed an issue where the Terraform Cloud Apply step succeeded but triggered a retry due to loss of log streaming, potentially causing the apply to run more than once. The step now correctly marks a successful apply as complete and does not retry. \[CDS-125110, ZD-115187]
* Fixed an issue where Google Cloud Functions Gen2 rollback failed with a 401 error due to lost invoker permissions after rollback. \[CDS-125272, ZD-115421]
* Fixed an issue where the feature flag `CDS_ENABLE_PIPELINE_SCOPED_OIDC_SUB` did not include the pipeline ID in the OIDC sub claim for containerized step groups. The sub claim now correctly includes the pipeline ID for containerized step group executions. \[CDS-125413, ZD-115447]
* Fixed an issue where ECS scheduled scaling configurations with timezone offsets in `start_time` or `end_time` fields caused deserialization errors in the prepare rollback step. The step now correctly parses timezone-offset values. \[CDS-125473, ZD-115819]
* Fixed an issue where the GitOps step returned an incomplete `RolloutStatusResponse`, omitting some fields. The step now correctly returns all `RolloutStatusResponse` fields. \[CDS-125476]
* Fixed an issue where the Terraform provider returned a misleading "file already exists" error during concurrent pipeline creation with Git Experience. \[PIPE-33810, ZD-113331]
* Fixed an issue where `parentEntityRepo` was incorrectly set as the template repo instead of the pipeline repo. To apply this fix, enable the feature flag `PIPE_DISABLE_PARENT_REPO_NAME_CONTEXT_POPULATION_FOR_TEMPLATE`. Contact [Harness Support](mailto:support@harness.io) to enable this flag. \[PIPE-33917, ZD-113413, ZD-114657]
* Fixed an issue where deployments no longer displayed service runtime inputs under the inputs section of pipeline executions. \[PIPE-34769, ZD-115520, ZD-115608]
* Fixed an issue where Helm canary deployments failed with delegate selector AND-collision when using delegate-pinned Git connectors. This fix requires the feature flag `CDS_ASYNC_EXECUTABLE_USE_SELECTORS`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-124714, ZD-114569]
* Fixed an issue where Git configuration was missing in the OPA request payload when initially creating service, infrastructure, or environment entities. The system now includes Git configuration in OPA requests for entity creation. \[CDS-124756, ZD-114085]
* Fixed an issue where an invalid or empty cluster name in Amazon EKS infrastructure caused a misleading JSON marshalling error instead of a validation failure. The error message now clearly indicates the empty cluster in EKS infrastructure. \[CDS-124973, ZD-114328]
**GitOps**
* Fixed an issue where the recently created count on the GitOps overview page displayed a significantly inflated number. The count now accurately reflects the number of recently created applications. \[CDS-121154]
* Fixed an issue where pod logs did not appear in the GitOps UI for resources in an unhealthy state, and log downloads returned empty content. \[CDS-115348]
**Continuous Integration**
* Fixed an issue where the Build and Push step with buildx failed with a file system error due to an overlay storage driver conflict introduced in version 1.3.17. \[CI-22663]
* Fixed an issue where users were unable to override `PLUGIN_ACL` for Cache Intelligence steps. Custom ACL configurations for cached objects now apply correctly. \[CI-22408]
* Improved cache plugin security by patching known vulnerabilities in the cache image. \[CI-22506]
* Fixed an issue where `executionTags.addTag` added null values to pipeline execution tags when referencing unresolved environment variables. \[CI-22595]
* Fixed an issue where a false "CI image version outdated" warning appeared when using SHA256 digest references for ci-addon or lite-engine images instead of tags. \[CI-22628]
* Fixed an additional scenario where the Build and Push to GAR step added provenance and SBOM attestations when Docker Layer Caching (DLC) was enabled. \[CI-22576]
* Fixed an issue where logs from Containerized Step Group steps timed out during upload, causing incomplete log visibility in pipeline executions. \[CI-22272]
* Fixed an issue where public ECR image pulls hit rate limits even when an AWS connector was configured, by ensuring authenticated pulls are used when a connector is available. \[CI-20752]
* Fixed an issue where the Git Clone step failed on FIPS-compliant environments due to missing SSH algorithm support in the drone-git image. \[CI-19914]
* Improved security of the Build and Push to Docker, ACR, GCR, GAR, and ECR plugins by replacing end-of-life components in the buildx images. \[CI-21697, CI-21698, CI-21701]
* Fixed an issue where large pull requests caused codebase and SCM task timeouts during pipeline execution. \[CI-22015]
* Fixed an issue where CI pipelines experienced long initialization times on Kubernetes due to unnecessary command fields in the init step object. \[CI-22213]
* Improved drone-git image security by replacing an end-of-life component. \[CI-21716]
* Fixed an issue where the `CI_REPO_LINK` environment variable was not being passed to the build pod. \[CI-20769]
* Fixed a parsing error that caused Save and Restore Cache steps to fail when using S3 directory buckets as the mount path. \[CI-22058]
**Security Testing Orchestration**
* Fixed an issue where the Cortex Cloud scanner applied native scanner severity labels directly instead of deriving severity from the CVSS score, causing NONE and UNKNOWN severities to incorrectly appear as INFO. \[STO-11572]
* Fixed an issue where Harness Code and Container scanners continued to display an "In Trial" badge in the step palette after the trial license had expired. \[STO-11737]
**Cloud Cost Management**
* Fixed an issue where the Unified Cost measure returned $0 for GCP costs due to improper discount application. GCP costs now apply month-based discount multipliers based on invoice month, and the discount calculation properly extracts GCP billing credits including sustained use, committed use, and promotional discounts. \[CCM-32997]
**Chaos Engineering**
* Fixed high-severity vulnerabilities in chaos components, including source-probe, chaos-ddcr-faults, and chaos-ddcr. \[CHAOS-12102, CHAOS-12099, CHAOS-12098]
* Fixed worker count not being passed when running a Kubernetes load test from the list page. \[CHAOS-12087]
* Fixed a probe taking more time than the configured timeout. \[CHAOS-12074]
* Fixed optional parameters no longer being optional when set as runtime inputs in an experiment template. \[CHAOS-12006]
**New features and enhancements**
**Continuous Integration**
* CI now uses versioned hcli (Harness CLI) binaries in Lite-Engine and Docker Runner. This improves binary management and rollback capabilities. \[CI-21467]
* Improved test splitting accuracy by adding average-based timing support to the split\_tests binary. Test Intelligence can now use historical average durations for more balanced parallelism. \[CI-22062]
* Added support for caching NuGet dependencies based on the `NUGET_PACKAGES` environment variable in Cache Intelligence. \[CI-22209]
* Added support to override Azure-specific fields in Cache Intelligence settings, giving you more flexibility when configuring cache storage for Azure environments. \[CI-22026]
**Continuous Delivery**
* Harness now supports skipping AWS Application Auto Scaling API interactions in ECS Rolling deployments through the **Skip application auto scaling** option, allowing you to manage auto-scaling externally and prevent API rate limit issues when deploying multiple services in parallel. This feature requires the feature flag `CDS_ECS_SKIP_APPLICATION_SCALING` and delegate version `26.05.89205` or later. Contact [Harness Support](mailto:support@harness.io) to enable.
* Harness now supports publishing new Docker images for AWS CDK deployments with CDK version 2.1125.0. The updated images are available at [harness/aws-cdk-plugin](https://hub.docker.com/r/harness/aws-cdk-plugin/tags).
* Harness now supports publishing new Docker images for AWS SAM deployments with SAM CLI version 1.161.1. The updated images are available at [harness/aws-sam-plugin](https://hub.docker.com/r/harness/aws-sam-plugin/tags).
* Harness now supports AND semantics in cron triggers for complex scheduling where both date range and day-of-week conditions must be satisfied simultaneously, enabling precise scheduling for monthly maintenance windows, deployment schedules, and compliance tasks. This feature requires the feature flag `PIPE_CRON_TRIGGER_AND_SEMANTICS`. Contact [Harness Support](mailto:support@harness.io) to enable.
* Harness now supports OIDC authentication in the Artifactory connector, enabling credential-free federated authentication with JFrog Artifactory using short-lived JWT tokens. This feature requires the feature flag `CDS_ARTIFACTORY_OIDC_AUTHENTICATION`. Contact [Harness Support](mailto:support@harness.io) to enable.
* Harness now supports enhanced policy generation capabilities powered by the unified Harness AI agent for OPA policies, offering more accurate and context-aware policy suggestions through specialized skills trained on OPA and REGO best practices. This feature requires the feature flag `OPA_DISABLE_AIDA_INTEGRATION`. Contact [Harness Support](mailto:support@harness.io) to enable.
* Harness now supports configurable AND/OR match logic for route rules in Istio traffic routing steps through the **Match all rules** option. When enabled, all configured route rules must match for a request to be routed to the destination.
* Harness now supports environment identifiers as session tags in OIDC tokens for AWS connectors with OIDC authentication, enabling environment-specific IAM policy enforcement for resources and secrets. This feature requires the feature flag `CDS_OIDC_AWS_SESSION_TAGS`. Contact [Harness Support](mailto:support@harness.io) to enable.
* Harness now supports enabling visibility for non-approvers in approval steps, allowing users without approval permissions to view approval step details during pipeline execution while keeping approval actions disabled. This setting is configured at the project level under **Default Settings** and is disabled by default.
**Cloud Cost Management**
* SMP OnPrem customers using ClickHouse for GCP billing now get automatic Cost Category backfill after each GCP sync completes. Cost Category rules are applied to newly ingested GCP billing data without a separate manual step. \[CCM-33598]
**GitOps**
* The GitOps agent now bundles ArgoCD 3.3.10. \[CDS-125193]
* You can now select repository templates from different scopes (account, organization, or project) when you configure GitOps repositories. \[CDS-123545]
* The resource status in the application resource tree detail view now updates in real time when you open a resource. You see the current health status without a page reload. \[CDS-116119]
**Chaos Engineering**
* Added support for Linux and Windows Chaos Experiment Templates as part of the Chaos Step template in a pipeline. \[CHAOS-12117]
* Added audit trail support for the image registry, including YAML difference visualization. \[CHAOS-12054]
* Improved probe timeout, duration, and retry handling. \[CHAOS-12081]
* Added the ability to copy output variables from the timeline view node. \[CHAOS-12051]
## June 2026
### Version 0.42.1
June 22, 2026, Version 0.42.1
June 22, 2026
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.141.5 | [1.141.x](/release-notes/continuous-integration.md#version-11410), [1.140.x](/release-notes/continuous-integration.md#version-11400), [1.139.x](/release-notes/continuous-integration.md#version-11390), [1.138.x](/release-notes/continuous-integration.md#version-11380), [1.133.x](/release-notes/continuous-integration.md#version-11330), [1.132.x](/release-notes/continuous-integration.md#version-11320) |
| | Log Service | 1.48.1 | - |
| | Test Intelligence Service | 1.71.3 | - |
| DB Devops | DB Devops Service | 1.97.1 | [1.97.x](/release-notes/database-devops.md#release-197x), [1.96.x](/release-notes/database-devops.md#release-196x), [1.95.x](/release-notes/database-devops.md#release-195x), [1.94.x](/release-notes/database-devops.md#release-194x), [1.93.x](/release-notes/database-devops.md#release-193x), [1.92.x](/release-notes/database-devops.md#release-192x), [1.91.x](/release-notes/database-devops.md#release-191x), [1.90.x](/release-notes/database-devops.md#release-190x), [1.89.x](/release-notes/database-devops.md#release-189x) |
| GitOps | GitOps Service | 1.58.0 | [1.58.x](/university/continuous-delivery.md#gitops-service-1580-gitops-agent-01180), [1.57.x](/university/continuous-delivery.md#gitops-service-1570-gitops-agent-01170), [1.56.x](/university/continuous-delivery.md#gitops-service-1561-gitops-agent-01161) |
| STO | STO Core | 1.195.0 | [1.191.x](/release-notes/security-testing-orchestration.md#version-11912), [1.190.x](/release-notes/security-testing-orchestration.md#version-11900) |
| | Ticket Service | 1.12.0 | - |
| CCM | CE Nextgen | 1.90.11 | [1.89.6](/release-notes/cloud-cost-management.md#may-2026---version-1896) |
| | Batch Processing | 1.88.14 | - |
| | NG CE UI | 1.86.5 | - |
| | Anomaly Detection | 1.28.5 | - |
| | Telescopes | 1.7.2 | - |
| | Cloud Info | 1.16.3 | - |
| | Event Service | 1.18.1 | - |
| Feature Flags | Feature Flag Service | 1.1200.0 | - |
| | Feature Flag Pushpin Service | 1.1139.0 | - |
| IaCM | IACM Manager | 1.161.1 | - |
| | IAC Server | 1.404.0 | - |
| Code Repository | Code API | 1.87.5 | - |
| | Code GitRPC | 1.87.0 | - |
| | Code GitHA | 1.87.0 | - |
| | Code Search | 1.86.0 | - |
| SSCA | SSCA Manager | 1.61.13 | [1.59.x](/release-notes/software-supply-chain-assurance.md#version-v1590--plugin-version-v0590) |
| | Component Analysis Service | 1.10.0 | - |
| | Component Service | 1.14.0 | - |
| | SSCA UI | 0.48.5 | - |
| Platform | Platform Service | 1.130.1 | [1.130.x](/release-notes/platform.md#version-1130x-), [1.129.x](/release-notes/platform.md#version-1129x-), [1.128.x](/release-notes/platform.md#version-1128x-), [1.127.x](/release-notes/platform.md#version-1127x-), [1.126.x](/release-notes/platform.md#version-1126x-), [1.125.x](/release-notes/platform.md#version-1125x-), [1.124.x](/release-notes/platform.md#version-1124x-), [1.123.x](/release-notes/platform.md#version-1123x-), [1.122.x](/release-notes/platform.md#version-1122x-), [1.121.x](/release-notes/platform.md#version-1121x-), [1.120.x](/release-notes/platform.md#version-1120x-), [1.119.x](/release-notes/platform.md#version-1119x-), [1.118.x](/release-notes/platform.md#version-1118x-) |
| | Access Control | 1.267.0 | - |
| | Audit Event Streaming | 1.96.0 | - |
| | Gateway Service | 1.66.1 | - |
| | NG Auth UI | 1.43.0 | - |
| | NG Dashboard Aggregator | 1.116.0 | - |
| | Policy Management | 1.52.0 | - |
| | Service Discovery Manager | 0.68.1 | - |
| Resilience testing | Chaos Manager | 1.88.2 | [1.88.x](/release-notes/chaos-engineering.md#version-1880), [1.87.x](/release-notes/chaos-engineering.md#version-1870), [1.86.x](/release-notes/chaos-engineering.md#version-1860), [1.85.x](/release-notes/chaos-engineering.md#version-1853), [1.84.x](/release-notes/chaos-engineering.md#version-1842) |
| | Chaos CRD | 1.82.0 | - |
| | Chaos K8s IFS | 1.88.0 | - |
| | Chaos Linux IFC | 1.88.0 | - |
| | Chaos Linux IFS | 1.88.0 | - |
| | Chaos Machine IFS | 1.88.0 | - |
| | Chaos Machine IFC | 1.88.0 | - |
| | Chaos Web | 1.88.1 | - |
| | Load Test Manager | 1.12.2 | - |
| Continuous Delivery | NG Manager | 1.150.5 | [1.150.x](/university/continuous-delivery.md#version-11503), [1.149.x](/university/continuous-delivery.md#version-11497), [1.148.x](/university/continuous-delivery.md#version-11483), [1.144.x](/university/continuous-delivery.md#version-11440), [1.143.x](/university/continuous-delivery.md#version-11431), [1.142.x](/university/continuous-delivery.md#version-11420) |
| | NG Custom Dashboards | 1.113.0 | - |
| | Pipeline Service | 1.190.0 | - |
| | Harness Manager | 1.149.4 | - |
| | Template Service | 1.152.0 | - |
| | Queue Service | 1.10.0 | - |
| | Debezium Service | 1.27.0 | - |
| | Delegate Proxy | 1.9.0 | - |
| | Delegate Version (Immutable) | 26.05.89206 | - |
| Others | Helm Chart | [0.42.1](https://github.com/harness/helm-charts/releases/tag/harness-0.42.1) | - |
| | Air Gap Bundle | [0.42.1](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.42.1) | - |
| | Bootstrap | 1.74.1 | - |
| | Change Data Capture | 1.57.0 | - |
| | Looker | 1.18.0 | - |
| | UI | 1.36.2 | - |
| | SCM Service | 1.50.0 | - |
| | Next Gen UI | 1.137.8 | - |
| | CV Nextgen | 1.66.0 | - |
| | LE Nextgen | 1.19.0 | - |
| | SRM UI | 1.16.2 | - |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Harness Platform**
* Fixed an issue that could cause token rotation to fail for users with certain organization or project level permissions. \[PL-72385]
### Version 0.42.0
June 12, 2026, Version 0.42.0
June 12, 2026
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.141.5 | [1.141.x](/release-notes/continuous-integration.md#version-11410), [1.140.x](/release-notes/continuous-integration.md#version-11400), [1.139.x](/release-notes/continuous-integration.md#version-11390), [1.138.x](/release-notes/continuous-integration.md#version-11380), [1.133.x](/release-notes/continuous-integration.md#version-11330), [1.132.x](/release-notes/continuous-integration.md#version-11320) |
| Continuous Integration | Log Service | 1.48.1 | - |
| Continuous Integration | Test Intelligence Service | 1.71.3 | - |
| DB Devops | DB Devops Service | 1.97.1 | [1.97.x](/release-notes/database-devops.md#release-197x), [1.96.x](/release-notes/database-devops.md#release-196x), [1.95.x](/release-notes/database-devops.md#release-195x), [1.94.x](/release-notes/database-devops.md#release-194x), [1.93.x](/release-notes/database-devops.md#release-193x), [1.92.x](/release-notes/database-devops.md#release-192x), [1.91.x](/release-notes/database-devops.md#release-191x), [1.90.x](/release-notes/database-devops.md#release-190x), [1.89.x](/release-notes/database-devops.md#release-189x) |
| GitOps | GitOps Service | 1.58.0 | [1.58.x](/university/continuous-delivery.md#gitops-service-1580-gitops-agent-01180), [1.57.x](/university/continuous-delivery.md#gitops-service-1570-gitops-agent-01170), [1.56.x](/university/continuous-delivery.md#gitops-service-1561-gitops-agent-01161) |
| STO | STO Core | 1.195.0 | [1.191.x](/release-notes/security-testing-orchestration.md#version-11912), [1.190.x](/release-notes/security-testing-orchestration.md#version-11900) |
| STO | Ticket Service | 1.12.0 | - |
| CCM | CE Nextgen | 1.90.11 | [1.89.6](/release-notes/cloud-cost-management.md#may-2026---version-1896) |
| CCM | Batch Processing | 1.88.14 | - |
| CCM | NG CE UI | 1.86.5 | - |
| CCM | Anomaly Detection | 1.28.5 | - |
| CCM | Telescopes | 1.7.2 | - |
| CCM | Cloud Info | 1.16.3 | - |
| CCM | Event Service | 1.18.1 | - |
| Feature Flags | Feature Flag Service | 1.1200.0 | - |
| Feature Flags | Feature Flag Pushpin Service | 1.1139.0 | - |
| IaCM | IACM Manager | 1.161.1 | - |
| IaCM | IAC Server | 1.404.0 | - |
| Code Repository | Code API | 1.87.5 | - |
| Code Repository | Code GitRPC | 1.87.0 | - |
| Code Repository | Code GitHA | 1.87.0 | - |
| Code Repository | Code Search | 1.86.0 | - |
| SSCA | SSCA Manager | 1.61.13 | [1.59.x](/release-notes/software-supply-chain-assurance.md#version-v1590--plugin-version-v0590) |
| SSCA | Component Analysis Service | 1.10.0 | - |
| SSCA | Component Service | 1.14.0 | - |
| SSCA | SSCA UI | 0.48.5 | - |
| Platform | Platform Service | 1.130.1 | [1.130.x](/release-notes/platform.md#version-1130x-), [1.129.x](/release-notes/platform.md#version-1129x-), [1.128.x](/release-notes/platform.md#version-1128x-), [1.127.x](/release-notes/platform.md#version-1127x-), [1.126.x](/release-notes/platform.md#version-1126x-), [1.125.x](/release-notes/platform.md#version-1125x-), [1.124.x](/release-notes/platform.md#version-1124x-), [1.123.x](/release-notes/platform.md#version-1123x-), [1.122.x](/release-notes/platform.md#version-1122x-), [1.121.x](/release-notes/platform.md#version-1121x-), [1.120.x](/release-notes/platform.md#version-1120x-), [1.119.x](/release-notes/platform.md#version-1119x-), [1.118.x](/release-notes/platform.md#version-1118x-) |
| Platform | Access Control | 1.267.0 | - |
| Platform | Audit Event Streaming | 1.96.0 | - |
| Platform | Gateway Service | 1.66.1 | - |
| Platform | NG Auth UI | 1.43.0 | - |
| Platform | NG Dashboard Aggregator | 1.116.0 | - |
| Platform | Policy Management | 1.52.0 | - |
| Platform | Service Discovery Manager | 0.68.1 | - |
| Resilience testing | Chaos Manager | 1.88.2 | [1.88.x](/release-notes/chaos-engineering.md#version-1880), [1.87.x](/release-notes/chaos-engineering.md#version-1870), [1.86.x](/release-notes/chaos-engineering.md#version-1860), [1.85.x](/release-notes/chaos-engineering.md#version-1853), [1.84.x](/release-notes/chaos-engineering.md#version-1842) |
| Resilience testing | Chaos CRD | 1.82.0 | - |
| Resilience testing | Chaos K8s IFS | 1.88.0 | - |
| Resilience testing | Chaos Linux IFC | 1.88.0 | - |
| Resilience testing | Chaos Linux IFS | 1.88.0 | - |
| Resilience testing | Chaos Machine IFS | 1.88.0 | - |
| Resilience testing | Chaos Machine IFC | 1.88.0 | - |
| Resilience testing | Chaos Web | 1.88.1 | - |
| Resilience testing | Load Test Manager | 1.12.2 | - |
| Continuous Delivery | NG Manager | 1.150.5 | [1.150.x](/university/continuous-delivery.md#version-11503), [1.149.x](/university/continuous-delivery.md#version-11497), [1.148.x](/university/continuous-delivery.md#version-11483), [1.144.x](/university/continuous-delivery.md#version-11440), [1.143.x](/university/continuous-delivery.md#version-11431), [1.142.x](/university/continuous-delivery.md#version-11420) |
| Continuous Delivery | NG Custom Dashboards | 1.113.0 | - |
| Continuous Delivery | Pipeline Service | 1.190.0 | - |
| Continuous Delivery | Harness Manager | 1.149.4 | - |
| Continuous Delivery | Template Service | 1.152.0 | - |
| Continuous Delivery | Queue Service | 1.10.0 | - |
| Continuous Delivery | Debezium Service | 1.27.0 | - |
| Continuous Delivery | Delegate Proxy | 1.9.0 | - |
| Continuous Delivery | Delegate Version (Immutable) | 26.05.89206 | - |
| Others | Helm Chart | [0.42.0](https://github.com/harness/helm-charts/releases/tag/harness-0.42.0) | - |
| Others | Air Gap Bundle | [0.42.0](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.42.0) | - |
| Others | Bootstrap | 1.74.1 | - |
| Others | Change Data Capture | 1.57.0 | - |
| Others | Looker | 1.18.0 | - |
| Others | UI | 1.36.2 | - |
| Others | SCM Service | 1.50.0 | - |
| Others | Next Gen UI | 1.137.4 | - |
| Others | CV Nextgen | 1.66.0 | - |
| Others | LE Nextgen | 1.19.0 | - |
| Others | SRM UI | 1.16.2 | - |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Harness Platform**
* Fixed an issue where secret values were logged in plaintext in delegate logs during Custom Secret Manager test connections by marking the output variable as sensitive. \[PL-70002]
* Fixed an issue where the List Environments API could time out due to redundant permission checks. This has been optimized to improve response time and prevent timeouts. \[PL-69931]
* Updated module name matching to be case-insensitive, improving consistency across configurations. \[PL-69690]
* Fixed an issue where OPA policy checks configured with Warn and Continue for Service Accounts and API keys did not display warnings correctly. Policy evaluation responses are now properly returned, ensuring that warnings and errors are shown as expected in the UI. \[PL-69434]
* Fixed an issue where deleting a user at the organization or project scope showed an incorrect "last admin" warning. Existing behavior for account scope and valid last-admin cases remains unchanged. \[PL-68705]
* Fixed an issue where user groups were not correctly sorted by "Newest" (creation date) in the UI. \[PL-68244]
* Fixed an issue where entities (File Store folders, Secrets, Services, and Environments) could be created with reserved identifiers (orgs, organizations, project, projects) that caused problems when editing or deleting them. New entities can no longer use these reserved identifiers. Existing entities with these identifiers continue to work but may encounter issues during updates or deletions. \[PL-66764, ZD-97956]
**Continuous Delivery**
* Fixed an issue where downloading configuration files from Amazon S3 intermittently took more than 30 minutes. \[**CDS-123003**, **ZD-112705**]
* Fixed an issue where OCI Helm chart validation for pulling Helm charts from Amazon ECR did not work until a dummy chart with base path '/' was created. The chart version listing in the service YAML and Helm deployment of OCI Helm ECR manifest used to fail until a dummy repository was created. OCI Helm ECR in Native Helm Deployment now works as expected without the dummy repository workaround. \[**CDS-123082**, **ZD-113172**]
* Fixed an issue where Amazon S3 artifact triggers failed with `invalid_artifact_server` after a delegate upgrade from version 26.01.88303 to 26.05.89101. The AwsS3 migration from v1 to v2 has been fixed. \[**CDS-123533**, **ZD-114070**]
* Fixed an issue where a blank image (`""`) in Cloud Run deployments produced an `InvalidImageName` error and caused an infinite retry loop. \[**CDS-124717**, **ZD-112702**]
* Fixed an issue where a null pointer exception occurred in Cloud Run deployments when no manifests were configured. \[**CDS-124718**, **ZD-112702**]
* Fixed an issue where the saved value in YAML was not shown correctly for the **Disable Artifact Validation** setting in multi-service pipelines. \[**CDS-122779**, **ZD-112051**]
* Fixed an issue where artifact image SHA256 validation failed after moving a project to a different organization or account. The validation now checks if the digest is valid before performing mismatch operations. This fix requires the feature flag `CDS_SKIP_INVALID_SHA_DIGEST_CHECK`. Contact [Harness Support](mailto:support@harness.io) to enable. \[**CDS-122990**]
* Fixed an issue where the dashboard loaded slowly for some accounts. \[**CDS-122817**, **ZD-111610**]
* Fixed an issue where ASG rolling deploy defaulted to launch template version 1 on empty ASGs when instance refresh desired configuration was enabled. \[**CDS-122831**, **ZD-112737**]
* Fixed an issue where Cloud Run resource configuration was not honored when only a memory limit was set, and a null pointer error occurred when resource strings were blank. \[**CDS-122882**, **ZD-112702**]
* Fixed an issue where Amazon S3 artifact triggers failed with `invalid_artifact_server` after a delegate upgrade. \[**CDS-123533**, **ZD-114070**]
* Fixed an issue where a `waiting_for_user_action` event was not sent on retries due to a deduplication check that incorrectly bypassed retry handling. \[**PIPE-32878**]
* Fixed an issue where triggers with a `pipelineBranchName` set on inline pipelines could cause remote templates to resolve from the trigger branch instead of the default branch. Validation now runs at trigger creation and at trigger execution time. \[**PIPE-33744**, **ZD-112780**]
* Fixed an issue where duplicate Bitbucket webhook registrations were created during high-throughput trigger updates. \[**PIPE-33758**, **ZD-112635**, **ZD-113174**]
* Fixed an issue where container steps would get stuck when ZTS denial occurred. This fix requires the feature flag `PIE_CONTAINER_STEP_ABORT_USE_UPSERT`. Contact [Harness Support](mailto:support@harness.io) to enable. \[**PIPE-33814**, **ZD-113380**]
* Fixed an issue where artifact fetching from JFrog Artifactory Edge nodes would fail to retrieve artifacts that exist in upstream repositories. The system now automatically falls back to transitive search queries when standard queries return no results, ensuring reliable artifact resolution across distributed Artifactory deployments with geo-replicated Edge nodes. This fix requires the feature flag `CDS_USE_CACHED_REPOSITORY_SUFFIX`. Contact [Harness Support](mailto:support@harness.io) to enable. \[**CDS-121537**, **ZD-111212**]
* Fixed an issue with the child pipeline service selector in the run pipeline form. \[**CDS-122298**, **ZD-111817**]
* Fixed an issue where account-level templates displayed duplicate cards in the template listing and incorrectly marked multiple versions as Stable on the deletion page. The API response was sending duplicate items for the same template, preventing users from deleting any version through the UI. This fix requires the feature flag `PIPE_DISABLE_TEMPLATE_STABLE_VERSION_RACE_CONDITION_FIX`. Contact [Harness Support](mailto:support@harness.io) to enable. \[**PIPE-32979**, **ZD-104816**, **ZD-109677**, **ZD-112187**]
* Fixed an issue where input set overlays did not update when variable values in referenced input sets were changed. \[**PIPE-32995**, **ZD-110073**]
* Fixed an issue where when using parent level connector to create a remote pipeline, the reference is not showing up in connector references. Added the scope of connector correctly instead of defaulting it to project scope. \[**PIPE-33441**, **ZD-110735**]
* Fixed an issue where users were unable to create overlay input sets. This fix requires the feature flag `PIPE_DISABLE_DEFAULT_STORE_TYPE_TO_INLINE_FOR_INPUT_SET_CREATE_CHECK`. Contact [Harness Support](mailto:support@harness.io) to enable. \[**PIPE-33489**, **ZD-112054**]
* Fixed an issue where pipeline executions were noticeably slower (not in step details), possibly due to redis lock issues. \[**PIPE-33703**, **ZD-112720**]
* Fixed an issue where users were unable to create overlay input sets due to an incorrect store type validation error. This fix requires the feature flag `PIPE_DISABLE_DEFAULT_STORE_TYPE_TO_INLINE_FOR_INPUT_SET_CREATE_CHECK`. Contact [Harness Support](mailto:support@harness.io) to enable. \[**PIPE-33489**, **ZD-112054**]
* Fixed an issue where GitLab triggers failed with "HTTP Error Status (400 - Invalid Format) received. Unable to process JSON." When processing GitLab webhooks, Harness was fetching all enabled GitLab triggers across the entire account without repo-level filtering, causing scope resolution failures when any trigger had null or invalid org/project identifiers. \[**PIPE-33612**, **ZD-112508**]
* Fixed an issue where template resolution failed during pipeline retry when the template was stored in a non-default Git branch. The resolution logic was using deprecated checks from legacy flow. This fix requires the feature flag `PIE_USE_LEGACY_GIT_ENTITY_INFO` to be disabled (inverted flag). Contact [Harness Support](mailto:support@harness.io) to disable. \[**PIPE-29964**]
* Improved validation and UI behavior for the Azure Container Apps deployment step. Revision traffic details now validate minimum and maximum traffic values (0-100) and prevent multiple tags per traffic configuration. \[**CDS-122522**]
* Fixed an issue in the Continuous Verification (CV) AI Verify feature by removing the unnecessary requests field from the data collection infrastructure and wiring up backend APIs for Health Sources V2 and Config Agent flow for Datadog metrics and log health sources. This feature requires the feature flag `CDS_CV_HEALTH_SOURCES_ENABLED`. Contact [Harness Support](mailto:support@harness.io) to enable. \[**CDS-122674**]
* Improved performance for the Azure Container Apps managed environments API by optimizing it to be called only when its dependencies (resource group or subscription ID) change. The API now triggers on input focus during edit flows. \[**CDS-122787**]
* Improved error messaging when a Bitbucket connector hits API rate limits. Previously, rate-limit responses from Bitbucket surfaced as a generic `SCM request failed with: UNKNOWN` error. The SCM service now detects Bitbucket rate-limit responses and returns a clear error message indicating the rate limit has been exceeded. \[**PIPE-32774**, **ZD-109415**]
* Fixed an issue where HashiCorp Vault secrets with blank values produced a misleading error message stating the secret key path was invalid. When Vault returned a valid response with an empty string value, the error incorrectly read "Secret key path '...' is invalid" instead of indicating the actual problem. The error message now distinguishes between a missing or unreachable path and a path that resolves to an empty value, guiding users to check the secret's value in Vault. \[**PL-69984**, **ZD-106017**]
* Improved error handling for a `NullPointerException` that could occur during pipeline execution. Under certain transient system conditions, an internal node failure surfaced as an unhandled NPE with no actionable details. The pipeline execution engine now catches this scenario and returns a meaningful error message. \[**PIPE-32772**, **ZD-109378**]
* Fixed an issue where large Terraform plans caused a `NullPointerException` or socket timeout when the manager attempted to decrypt the plan output. The decryption process now handles large payloads correctly, preventing timeouts and NPEs during Terraform plan retrieval. \[**CDS-108748**, **ZD-110657**]
* Fixed an intermittent `FLOW_CONTROL_ERROR` (`stream was reset: FLOW_CONTROL_ERROR`) that occurred during Terraform plan and apply steps. The error was triggered by an HTTP/2 flow-control issue in the delegate-to-manager communication when decrypting Terraform plan content via the Harness Secret Manager. The HTTP/2 stream handling has been stabilized to prevent these transient resets. \[**CDS-122091**, **ZD-111505**]
* Fixed an issue where AWS ECS deployments did not honor Service Connect configuration defined in the ECS service definition. The deployment completed without errors but Service Connect was not enabled on the deployed service. ECS deployments now correctly apply Service Connect settings from the service definition. \[**CDS-121374**, **ZD-111056**]
* Fixed an issue where creating a remote template with a Git connector did not register the template as a reference on the connector. The connector's **References** tab now correctly lists remote templates that use it. \[**PIPE-33397**, **ZD-110735**]
* Fixed an issue where a Barrier step inside an **Insert Step** (step template) in a child pipeline of a chained pipeline threw a `NullPointerException`. The barrier identifier was not resolved correctly in the chained pipeline execution context, causing `BarrierExecutionInstance` to be null. Barrier identifier resolution now propagates correctly through chained pipeline and step template contexts. \[**PIPE-33169**, **ZD-110759**]
* Fixed an issue where saving a remote pipeline that used a Git connector backed by an AWS Secret Manager connector threw a `ClassCastException` (`java.lang.String cannot be cast to io.harness.encryption.SecretRefData`). The error occurred during secret reference resolution and surfaced as an unclear Java error instead of a meaningful validation message. The pipeline save flow now handles this scenario correctly and returns a user-friendly error. \[**PIPE-33212**, **ZD-109620**]
**GitOps**
* Fixed an issue where the GitOps agent WebSocket dialer did not respect the `HTTPS_PROXY` environment variable, causing pod log streaming to fail in environments with an outbound proxy configured. Log streaming now correctly routes through proxy settings. \[**CDS-123202**]
* Fixed a panic in the GitOps agent that occurred during ApplicationSet validation and generation when the repository credentials database interface was not fully implemented. \[**CDS-123150**]
* Fixed an issue where GitOps applications were not visible in the application list for users with label-scoped resource groups. The application list now correctly filters results based on label-based RBAC permissions, so users can see the applications they have access to. \[**CDS-122075**]
* Fixed an issue where integer fields in GitOps ApplicationSet definitions were converted to strings during editing and validation, causing validation errors on the ApplicationSet details page. \[**CDS-121781**, **ZD-101656**, **ZD-109107**]
* Fixed an issue where the GitOps applications list unexpectedly toggled between list and tile view when applying filters. \[**CDS-122964**, **ZD-112484**]
* Fixed an issue where deleting a GitOps agent did not automatically remove the cluster-to-environment links for clusters belonging to that agent. Clusters are now automatically unlinked from environments when their agent is deleted. \[**CDS-119831**]
* Fixed an issue where duplicate ArgoCD project mappings could be created when multiple Harness projects used the same account-level or org-level GitOps agent. The system now validates that an ArgoCD project name is not already mapped to a different Harness project before creating a new mapping. \[**CDS-121055**]
* Fixed an issue where GitOps application repository linking became permanently broken after an application was deleted and recreated, preventing re-linking even after correcting the repository URL. \[**CDS-122270**]
* Fixed an issue where repositories with empty or whitespace-only `repoUrl` values were ingested into the system, causing problems with multi-source GitOps applications. A validation check in `ReconcileRepositories` now skips repositories with empty `repoUrl` and logs a warning. \[**CDS-120193**]
* Fixed an issue where the GitOps application manifest view displayed truncated YAML on page refresh. The full manifest appeared only intermittently, while most refreshes showed incomplete YAML content. \[**CDS-122688**]
* Fixed an issue where a GitOps application repository connector binding was lost, causing authentication failures and preventing users from selecting repositories in the UI. \[**CDS-121077**, **ZD-110634**]
* Fixed an issue where the App Details page displayed a `Failed loading charts` error for GitOps applications using OCI Helm repositories. The UI attempted to fetch `index.yaml` via HTTP, which OCI registries do not serve. The chart loading logic now correctly identifies OCI repositories using `helm.IsHelmOciRepo` and skips the index fetch. \[**CDS-122214**, **ZD-111562**]
* Fixed an issue where authenticating a GitOps cluster via IRSA in the Harness UI failed when Certificate Authority Data was not provided. The UI payload did not include `"insecure": true`, causing the connection to fail. The payload now correctly sets `"insecure": true` when no CA data is provided. \[**CDS-122266**, **ZD-111657**]
**Continuous Integration**
* Fixed an issue where the Build and Push step with buildx failed with a file system error due to an overlay storage driver conflict introduced in version 1.3.17. (CI-22663)
* Fixed an issue where users were unable to override `PLUGIN_ACL` for Cache Intelligence steps. Custom ACL configurations for cached objects now apply correctly. (CI-22408)
* Improved cache plugin security by patching known vulnerabilities in the cache image. (CI-22506)
* Fixed an issue where `executionTags.addTag` added null values to pipeline execution tags when referencing unresolved environment variables. (CI-22595)
* Fixed an issue where a false "CI image version outdated" warning appeared when using SHA256 digest references for ci-addon or lite-engine images instead of tags. (CI-22628)
* Fixed an additional scenario where the Build and Push to GAR step added provenance and SBOM attestations when Docker Layer Caching (DLC) was enabled. (CI-22576)
* Fixed an issue where logs from Containerized Step Group steps timed out during upload, causing incomplete log visibility in pipeline executions. (CI-22272)
* Fixed an issue where public ECR image pulls hit rate limits even when an AWS connector was configured, by ensuring authenticated pulls are used when a connector is available. (CI-20752)
* Fixed an issue where the Git Clone step failed on FIPS-compliant environments due to missing SSH algorithm support in the drone-git image. (CI-19914)
* Improved security of the Build and Push to Docker, ACR, GCR, GAR, and ECR plugins by replacing end-of-life components in the buildx images. (CI-21697, CI-21698, CI-21701)
* Fixed an issue where large pull requests caused codebase and SCM task timeouts during pipeline execution. (CI-22015)
* Fixed an issue where CI pipelines experienced long initialization times on Kubernetes due to unnecessary command fields in the init step object. (CI-22213)
* Improved drone-git image security by replacing an end-of-life component. (CI-21716)
* Fixed an issue where the `CI_REPO_LINK` environment variable was not being passed to the build pod. (CI-20769)
* Fixed a parsing error that caused Save and Restore Cache steps to fail when using S3 directory buckets as the mount path. (CI-22058)
**Code Repository**
* Enabled Code UI 3.0 in Self-Managed Platform environments. The updated Code Repository interface is now available for SMP deployments. \[CODE-5536]
**New features and enhancements**
**Continuous Integration**
* CI now uses versioned hcli (Harness CLI) binaries in Lite-Engine and Docker Runner. This improves binary management and rollback capabilities. (CI-21467)
* Improved test splitting accuracy by adding average-based timing support to the split\_tests binary. Test Intelligence can now use historical average durations for more balanced parallelism. (CI-22062)
* Added support for caching NuGet dependencies based on the `NUGET_PACKAGES` environment variable in Cache Intelligence. (CI-22209)
* Added support to override Azure-specific fields in Cache Intelligence settings, giving you more flexibility when configuring cache storage for Azure environments. (CI-22026)
**Continuous Delivery**
* OIDC Delegate Selectors for AWS Connectors enables customers to pass delegate selector information as AWS session tags in OIDC tokens, allowing them to enforce IAM policies based on which Harness delegates execute tasks. This provides environment-level secret isolation without relying on environment naming conventions, working across all scenarios including connector validation, deployment stages, and custom stages.
* A new dry run validation API endpoint lets you validate pipeline YAML changes while editing files in Git before committing them to your repository. The endpoint performs YAML schema validation, template expansion, and OPA policy evaluation without executing the pipeline. The endpoint is available at `POST /pipeline/api/v1/orgs/{org}/projects/{project}/dry-run`.
* You can now deploy to **Azure Container Apps** directly from Harness CD. Ship microservices and containerized applications to Azure's fully managed serverless platform without managing infrastructure. Run canary deployments with progressive traffic shifting (for example, 20% to 70% to 100%), roll back instantly with automatic pre-deployment state capture, and authenticate with OIDC (keyless) or Service Principal credentials across subscriptions. Harness supports both Azure Container Registry (ACR) and Docker Hub as artifact sources. This feature requires the feature flag `CDS_AZURE_CONTAINER_APPS`. Contact [Harness Support](mailto:support@harness.io) to enable. For more information, go to [Azure Container Apps deployments](/continuous-delivery/use-continuous-delivery/deploy-services-on-different-platforms/azure/azure-container-apps.md). \[**CDS-106121**]
* Pipeline YAML and input sets stored in Git can now be referenced using Git tags in addition to branch names during trigger-based executions. You can specify a tag in the **Pipeline Reference Branch** or **Input Set Source** fields using the `$tag:` format (for example, `$tag:v1.0.0`) or use `<+"$tag:"+>` to dynamically resolve tag names from expressions like `<+"$tag:"+<+trigger.tag>>`. In your trigger YAML, use the `pipelineBranchName` and `inputSetBranchName` properties with the `$tag:` prefix to load both pipeline and input sets from the same Git tag. This enables version-controlled pipeline and input set management through Git tagging, making it easier to maintain stable configurations alongside your release workflow and enabling reliable rollbacks to previous versions. This feature supports all Git providers including GitHub, GitLab, and Bitbucket. This feature requires delegate version **26.04.89002** or later. For more information, go to [Git tag support for pipeline and input set source](/harness-platform/use-harness-platform/pipelines/input-sets.md#git-tag-support-for-pipeline-and-input-set-source).
* Harness now supports OIDC authentication for AWS GovCloud regions. The delegate automatically routes STS (Security Token Service) requests to the appropriate regional endpoint when using OIDC with AWS connectors in GovCloud. The STS region is resolved using the following priority: connector's default region, cluster/resource region, `AWS_DEFAULT_REGION` environment variable on the delegate host, or fallback to `us-east-1`. For GovCloud deployments, set the `AWS_DEFAULT_REGION` environment variable on your delegate to specify the GovCloud region (for example, `us-gov-west-1`). This feature requires delegate version **88904** or later.
* A new **Executions Management** page gives you account-level visibility into queued pipeline executions. View queue positions, filter by organization or project, and cancel individual or bulk executions from **Account Settings** > **Security and Governance** > **Executions Management**. This feature requires the feature flag `PIPE_QUEUED_PIPELINE_OBSERVABILITY`. Contact [Harness Support](mailto:support@harness.io) to enable.
* WinRM session pooling is now available for traditional Windows deployments. Harness maintains a delegate-wide session pool grouped by host and username. Command steps reuse idle sessions with matching credentials instead of opening new connections, saving 30 seconds to over a minute per connection in environments with high session initialization costs. Session pooling supports NTLM authentication only. This feature requires the feature flag `CDS_SHARED_SESSION_WINRM_NTLM_NG` and delegate version 889xx or later. Contact [Harness Support](mailto:support@harness.io) to enable. For more information, go to [WinRM session reuse](/continuous-delivery/use-continuous-delivery/deploy-services-on-different-platforms/traditional/win-rm-tutorial.md#winrm-session-reuse).
**GitOps**
* The GitOps agent now bundles ArgoCD 3.3.9. \[**CDS-123262**]
* GitOps licensing now uses service-based licensing when GitOps applications are linked to Harness services, instead of application-based licensing. \[**CDS-122212**]
**Breaking Changes and Upgrade Considerations**
**Continuous Delivery**
* PR triggers now require the linked Git connector to have API access enabled. Previously, PR triggers created with a connector without API access could successfully execute pipelines. Pipeline executions fail with an error if the connector does not have API access enabled. This change is currently behind the feature flag `PIPE_TRIGGER_SCM_FETCH_THROW_EXCEPTION` and will be automatically enabled for all accounts after a 14-day rollout period. Contact [Harness Support](mailto:support@harness.io) to enable it before the automatic rollout. \[**PIPE-30746**]
**Chaos Engineering**
**New features and enhancements**
* Added filtering support for chaos experiment list in REST API.
* Added support for editing step names in Chaos Studio.
* Added UI support for runtime input for connector.
* Updated icon for Windows infrastructure under ChaosGuard condition to Windows.
* Updated Chaos Hub filter to use pagination under the Chaos Experiment template selector modal.
* Removed expanded details and dropdown icon from the runs page.
* Deprecated Chaos GameDays.
* Optimized timeline view to better support backend's estimatedTime.
* Patched CVEs across chaos images, including source-probe, smp-chaos-web, smp-chaos-manager, smp-chaos-linux-infra-server, smp-chaos-linux-infra-controller, smp-chaos-k8s-ifs, chaos-machine-ifs, chaos-machine-ifc, chaos-log-watcher, and chaos-ddcr-faults.
**Fixed issues**
* Fixed experiment status filter not working on the V3 list experiment API.
* Fixed Chaos Experiment YAML unexpected character issue.
* Fixed Composite load test date error in pipelines.
* Fixed chaos experiment getting stuck in running state when the pod could not come up in the target infrastructure.
* Fixed pod-autoscaler fault to validate that the provided target exists.
* Fixed issue where some users were unable to access the subscriptions page.
## May 2026
### Version 0.41.2
May 12, 2026, Version 0.41.2
May 12, 2026
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.130.7 | [1.130.x](/release-notes/continuous-integration.md#version-11300), [1.129.x](/release-notes/continuous-integration.md#version-11290), [1.128.x](/release-notes/continuous-integration.md#version-11280) |
| Continuous Integration | Log Service | 1.45.3 | - |
| Continuous Integration | Test Intelligence Service | 1.65.1 | - |
| DB Devops | DB Devops Service | 1.88.0 | [1.88.x](/release-notes/database-devops.md#release-188x), [1.87.x](/release-notes/database-devops.md#release-187x), [1.86.x](/release-notes/database-devops.md#release-186x), [1.85.x](/release-notes/database-devops.md#release-185x) |
| GitOps | GitOps Service | 1.55.7 | [1.55.x](/university/continuous-delivery.md#gitops-service-1557-gitops-agent-01150), [1.54.x](/university/continuous-delivery.md#gitops-service-1543-gitops-agent-01142) |
| STO | STO Core | 1.188.3 | [1.187.x](/release-notes/security-testing-orchestration.md#version-11872) |
| STO | Ticket Service | 1.8.0 | - |
| CCM | CE Nextgen | 1.86.20 | [1.86.15](/release-notes/cloud-cost-management.md#april-2026---version-18615), [1.84.4](/release-notes/cloud-cost-management.md#march-2026---version-1844), [1.83.1](/release-notes/cloud-cost-management.md#march-2026---version-1831) |
| CCM | Batch Processing | 1.84.11 | - |
| CCM | NG CE UI | 1.83.7 | - |
| CCM | Anomaly Detection | 1.26.1 | - |
| CCM | Telescopes | 1.7.2 | - |
| CCM | Event Service | 1.15.2 | - |
| Feature Flags | Feature Flag Service | 1.1181.0 | [1.1181.x](/release-notes/feature-flags.md#april-2026) |
| Feature Flags | Feature Flag Pushpin Service | 1.1139.0 | - |
| IaCM | IACM Manager | 1.138.1 | [1.138.x](/release-notes/infrastructure-as-code-management.md#april-2026) |
| IaCM | IAC Server | 1.370.0 | - |
| Code Repository | Code API | 1.81.4 | [1.80.x](/release-notes/code-repository.md#version-180x) |
| Code Repository | Code GitRPC | 1.81.1 | - |
| Code Repository | Code GitHA | 1.81.0 | - |
| Code Repository | Code Search | 1.81.0 | - |
| SSCA | SSCA Manager | 1.58.8 | [1.57.x](/release-notes/software-supply-chain-assurance.md#version-v1570--plugin-version-v0570) |
| SSCA | Component Analysis Service | 1.7.0 | - |
| SSCA | Component Service | 1.11.3 | - |
| SSCA | SSCA UI | 0.45.2 | - |
| Platform | Platform Service | 1.117.0 | [1.117.x](/release-notes/platform.md#version-1117x-), [1.116.x](/release-notes/platform.md#version-1116x-), [1.115.x](/release-notes/platform.md#version-1115x-) |
| Platform | Access Control | 1.240.0 | - |
| Platform | Audit Event Streaming | 1.84.0 | - |
| Platform | Gateway Service | 1.62.5 | - |
| Platform | NG Auth UI | 1.39.0 | - |
| Platform | NG Dashboard Aggregator | 1.103.0 | - |
| Platform | Policy Management | 1.46.1 | - |
| Platform | Service Discovery Manager | 0.63.1 | - |
| Resilience testing | Chaos Manager | 1.83.5 | [1.83.x](/release-notes/chaos-engineering.md#version-1834), [1.82.x](/release-notes/chaos-engineering.md#version-1821), [1.81.x](/release-notes/chaos-engineering.md#version-1810) |
| Resilience testing | Chaos CRD | 1.82.0 | - |
| Resilience testing | Chaos K8s IFS | 1.83.0 | - |
| Resilience testing | Chaos Linux IFC | 1.83.0 | - |
| Resilience testing | Chaos Linux IFS | 1.83.0 | - |
| Resilience testing | Chaos Machine IFS | 1.83.0 | - |
| Resilience testing | Chaos Machine IFC | 1.83.0 | - |
| Resilience testing | Chaos Web | 1.83.2 | - |
| Continuous Delivery | NG Manager | 1.139.3 | [1.139.x](/university/continuous-delivery.md#version-11393), [1.138.x](/university/continuous-delivery.md#version-11385), [1.137.x](/university/continuous-delivery.md#version-11370) |
| Continuous Delivery | NG Custom Dashboards | 1.105.0 | - |
| Continuous Delivery | Pipeline Service | 1.179.3 | - |
| Continuous Delivery | Harness Manager | 1.138.5 | - |
| Continuous Delivery | Template Service | 1.141.2 | - |
| Continuous Delivery | Queue Service | 1.9.0 | - |
| Continuous Delivery | Debezium Service | 1.25.3 | - |
| Continuous Delivery | Delegate Proxy | 1.9.0 | - |
| Continuous Delivery | Delegate Version (Immutable) | 26.04.88902 | - |
| Others | Helm Chart | [0.41.2](https://github.com/harness/helm-charts/releases/tag/harness-0.41.2) | - |
| Others | Air Gap Bundle | [0.41.2](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.41.2) | - |
| Others | Bootstrap | 1.71.1 | - |
| Others | Change Data Capture | 1.52.1 | - |
| Others | Looker | 1.14.1 | - |
| Others | UI | 1.36.0 | - |
| Others | SCM Service | 1.45.1 | - |
| Others | Next Gen UI | 1.126.2 | - |
| Others | CV Nextgen | 1.61.1 | - |
| Others | LE Nextgen | 1.18.0 | - |
| Others | SRM UI | 1.16.2 | - |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Harness Platform**
* Improved security in CG Manager by replacing hardcoded secret values with safe placeholder values, reducing the risk of unintended exposure of sensitive information. \[PL-70698]
### Version 0.41.1
May 7, 2026, Version 0.41.1
May 7, 2026
This table lists the module, its components, its version and the release notes versions associated with it.
| Module | Services | Version | SaaS releases |
| ---------------------- | ---------------------------- | -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Continuous Integration | CI Manager | 1.130.7 | [1.130.x](/release-notes/continuous-integration.md#version-11300), [1.129.x](/release-notes/continuous-integration.md#version-11290), [1.128.x](/release-notes/continuous-integration.md#version-11280) |
| Continuous Integration | Log Service | 1.45.3 | - |
| Continuous Integration | Test Intelligence Service | 1.65.1 | - |
| DB Devops | DB Devops Service | 1.88.0 | [1.88.x](/release-notes/database-devops.md#release-188x), [1.87.x](/release-notes/database-devops.md#release-187x), [1.86.x](/release-notes/database-devops.md#release-186x), [1.85.x](/release-notes/database-devops.md#release-185x) |
| GitOps | GitOps Service | 1.55.7 | [1.55.x](/university/continuous-delivery.md#gitops-service-1557-gitops-agent-01150), [1.54.x](/university/continuous-delivery.md#gitops-service-1543-gitops-agent-01142) |
| STO | STO Core | 1.188.3 | [1.187.x](/release-notes/security-testing-orchestration.md#version-11872) |
| STO | Ticket Service | 1.8.0 | - |
| CCM | CE Nextgen | 1.86.20 | [1.86.15](/release-notes/cloud-cost-management.md#april-2026---version-18615), [1.84.4](/release-notes/cloud-cost-management.md#march-2026---version-1844), [1.83.1](/release-notes/cloud-cost-management.md#march-2026---version-1831) |
| CCM | Batch Processing | 1.84.11 | - |
| CCM | NG CE UI | 1.83.7 | - |
| CCM | Anomaly Detection | 1.26.1 | - |
| CCM | Telescopes | 1.7.2 | - |
| CCM | Event Service | 1.15.2 | - |
| Feature Flags | Feature Flag Service | 1.1181.0 | [1.1181.x](/release-notes/feature-flags.md#april-2026) |
| Feature Flags | Feature Flag Pushpin Service | 1.1139.0 | - |
| IaCM | IACM Manager | 1.138.1 | [1.138.x](/release-notes/infrastructure-as-code-management.md#april-2026) |
| IaCM | IAC Server | 1.370.0 | - |
| Code Repository | Code API | 1.81.4 | [1.80.x](/release-notes/code-repository.md#version-180x) |
| Code Repository | Code GitRPC | 1.81.1 | - |
| Code Repository | Code GitHA | 1.81.0 | - |
| Code Repository | Code Search | 1.81.0 | - |
| SSCA | SSCA Manager | 1.58.8 | [1.57.x](/release-notes/software-supply-chain-assurance.md#version-v1570--plugin-version-v0570) |
| SSCA | Component Analysis Service | 1.7.0 | - |
| SSCA | Component Service | 1.11.3 | - |
| SSCA | SSCA UI | 0.45.2 | - |
| Platform | Platform Service | 1.117.0 | [1.117.x](/release-notes/platform.md#version-1117x-), [1.116.x](/release-notes/platform.md#version-1116x-), [1.115.x](/release-notes/platform.md#version-1115x-) |
| Platform | Access Control | 1.240.0 | - |
| Platform | Audit Event Streaming | 1.84.0 | - |
| Platform | Gateway Service | 1.62.5 | - |
| Platform | NG Auth UI | 1.39.0 | - |
| Platform | NG Dashboard Aggregator | 1.103.0 | - |
| Platform | Policy Management | 1.46.1 | - |
| Platform | Service Discovery Manager | 0.63.1 | - |
| Resilience testing | Chaos Manager | 1.83.5 | [1.83.x](/release-notes/chaos-engineering.md#version-1834), [1.82.x](/release-notes/chaos-engineering.md#version-1821), [1.81.x](/release-notes/chaos-engineering.md#version-1810) |
| Resilience testing | Chaos CRD | 1.82.0 | - |
| Resilience testing | Chaos K8s IFS | 1.83.0 | - |
| Resilience testing | Chaos Linux IFC | 1.83.0 | - |
| Resilience testing | Chaos Linux IFS | 1.83.0 | - |
| Resilience testing | Chaos Machine IFS | 1.83.0 | - |
| Resilience testing | Chaos Machine IFC | 1.83.0 | - |
| Resilience testing | Chaos Web | 1.83.2 | - |
| Continuous Delivery | NG Manager | 1.139.3 | [1.139.x](/university/continuous-delivery.md#version-11393), [1.138.x](/university/continuous-delivery.md#version-11385), [1.137.x](/university/continuous-delivery.md#version-11370) |
| Continuous Delivery | NG Custom Dashboards | 1.105.0 | - |
| Continuous Delivery | Pipeline Service | 1.179.3 | - |
| Continuous Delivery | Harness Manager | 1.138.4 | - |
| Continuous Delivery | Template Service | 1.141.2 | - |
| Continuous Delivery | Queue Service | 1.9.0 | - |
| Continuous Delivery | Debezium Service | 1.25.3 | - |
| Continuous Delivery | Delegate Proxy | 1.9.0 | - |
| Continuous Delivery | Delegate Version (Immutable) | 26.04.88902 | - |
| Others | Helm Chart | [0.41.1](https://github.com/harness/helm-charts/releases/tag/harness-0.41.1) | - |
| Others | Air Gap Bundle | [0.41.1](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.41.1) | - |
| Others | Bootstrap | 1.71.1 | - |
| Others | Change Data Capture | 1.52.1 | - |
| Others | Looker | 1.14.1 | - |
| Others | UI | 1.36.0 | - |
| Others | SCM Service | 1.45.1 | - |
| Others | Next Gen UI | 1.126.2 | - |
| Others | CV Nextgen | 1.61.1 | - |
| Others | LE Nextgen | 1.18.0 | - |
| Others | SRM UI | 1.16.2 | - |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Cloud Cost Management**
* Resolved syntax errors showing up in BI Dashboards by using an alternate approach to write the queries without using looker variables. \[CCM-32470]
## April 2026
### Version 0.41.0
April 30, 2026, Version 0.41.0
April 30, 2026
This table lists the module, its components, its version and the release notes versions associated with it.
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Harness Platform**
* Fixed an issue where secret values were logged in plaintext in delegate logs during Custom Secret Manager test connections by marking the output variable as sensitive. \[PL-70002]
* Fixed an issue where the List Environments API could time out due to redundant permission checks. This has been optimized to improve response time and prevent timeouts. \[PL-69931]
* Updated module name matching to be case-insensitive, improving consistency across configurations. \[PL-69690]
* Fixed an issue where OPA policy checks configured with Warn and Continue for Service Accounts and API keys did not display warnings correctly. Policy evaluation responses are now properly returned, ensuring that warnings and errors are shown as expected in the UI. \[PL-69434]
* Fixed an issue where deleting a user at the organization or project scope showed an incorrect "last admin" warning. Existing behavior for account scope and valid last-admin cases remains unchanged. \[PL-68705]
* Fixed an issue where user groups were not correctly sorted by "Newest" (creation date) in the UI. \[PL-68244]
* Fixed an issue where entities (File Store folders, Secrets, Services, and Environments) could be created with reserved identifiers (`orgs`, `organizations`, `project`, `projects`) that caused problems when editing or deleting them. New entities can no longer use these reserved identifiers. Existing entities with these identifiers continue to work but may encounter issues during updates or deletions. \[PL-66764]
**Continuous Delivery**
* Fixed an issue where a dashboard query failed with a PostgreSQL error: "the postgresql 9.5+ database encountered an error while running this query." \[CDS-120074, ZD-109608]
* Fixed an issue where the WinRM credential **Verify Connection** displayed an incorrect default port in the error message, stating "if the port is not specified with the host, it will default to 22." \[CDS-120290, ZD-110062]
* Fixed an issue where runtime values for GitOps clusters and environment inputs were not being cleared correctly in GitOps stages. \[CDS-120345, ZD-109942]
* Fixed an issue with the context value sent in the artifact list for the Service step. \[CDS-120967, ZD-110383]
* Fixed an issue where the Helm chart version fetch did not correctly identify third-party authentication errors. When fetching Helm chart versions, if the upstream provider or connector returned a 401 (Unauthorized) or 403 (Forbidden) error, the exception was propagated as-is to the client. This caused the client to interpret the error as their own authentication failure with the Harness platform, rather than a credentials issue with the external Helm chart provider (for example, an OCI registry or HTTP Helm repo). The Helm chart version fetch now detects authentication-related errors from upstream providers and wraps them as an application-level invalid credentials exception, correctly signaling that the credentials issue is with the third-party connector. \[CDS-120992, ZD-110182]
* Fixed an issue where the overrides variable field went blank when editing it. \[CDS-121117, ZD-109880]
* Fixed an issue where the SCM service was unavailable for parsing webhook payloads. \[PIPE-32789, ZD-109306]
* Fixed an issue where newly created version or template files in GitHub were not visible in the Harness UI, and auto-creation for templates was not working. \[PIPE-32938, ZD-109360]
* Fixed an issue where GitX/GitSync did not handle a Git connector when the account-level Bitbucket URL was set to `https://bitbucket.org` without a workspace. As part of migrating `gitFileCache` to `repoURL`, the fallback has been removed since all records are now aligned with the new system. Cache upserts now use only `repoURL`. \[PIPE-33029, ZD-110158]
* Fixed an issue where pipelines were being aborted unexpectedly by a system admin user. \[PIPE-33226, ZD-110865, ZD-111008, ZD-111013]
* Fixed an issue where the compare pipeline executions view was hidden when unified UI styles loaded. \[PIPE-33237]
* Fixed an issue where a direct connector secret reference with an incorrect value caused all secrets to fail rendering in `values.yaml` during Native Helm deployments. \[PIPE-33325, ZD-105341]
* Fixed an issue where an active freeze window could be edited via API. The freeze API service did not check for active windows during edits, even though the UI does not permit it. Editing active freeze windows via API is now blocked by default. To restore the previous behavior, enable the feature flag `CDS_ALLOW_ACTIVE_FREEZE_EDIT`. Contact [Harness Support](mailto:support@harness.io) to enable this feature flag. \[CDS-114114]
* Fixed an issue where a direct connector secret reference with an incorrect value caused all secrets to fail rendering in `values.yaml` during Native Helm deployments. \[CDS-119546, ZD-105341]
* Fixed an issue where pipelines failed to pull Helm files after a delegate upgrade. When using the **Fetch files from Git using provider-specific APIs** setting, the system encountered failures for repositories with numerous files. Recent changes added additional context to gRPC responses, causing the total response size to exceed the 16KB gRPC call limit, resulting in failed file fetches and incomplete repository data retrieval. The Git file fetching feature now implements pagination, automatically splitting large file lists into batches of up to 35 files per request, ensuring each gRPC call stays within the 16KB limit while maintaining full repository access. \[CDS-120124, ZD-109714]
* Fixed an issue where GitOps steps (MergePR, RevertPR, UpdateReleaseRepo) failed with "no eligible delegates available" when delegate selectors were configured at both the connector and step/stage/pipeline levels. Delegate selector precedence now works correctly, prioritizing step-level selectors over connector-level selectors. \[CDS-120333, ZD-110105]
* Fixed an issue where auto-synced ArgoCD applications hung at the GitOps Sync step. The Sync step now detects already-running syncs (manual or auto-syncs) and tracks those syncs accurately. \[CDS-120358, ZD-110163]
* Fixed an issue where barriers were stalling for 5 minutes. \[PIPE-32301, ZD-104566, ZD-104909, ZD-109528]
* Fixed an issue where barriers were not working correctly. A barrier step with a skipped status could cause the barrier to be bypassed. \[PIPE-32701, ZD-105759, ZD-109743]
* Fixed an issue where connector validation and pipeline Git operations failed in multi-account AWS setups when a Git connector and its secret manager used different delegate selectors pointing to delegates in separate AWS accounts. The secret manager's delegate selector now takes precedence over the connector's delegate selector, ensuring the chosen delegate can decrypt secrets before Git operations proceed. This fix is behind the feature flags `PIE_GITX_EVALUATE_ENCRYPTED_CAPABILITIES` and `CDS_SECRET_MANAGER_DELEGATE_SELECTOR_PRECEDENCE`. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-118093, ZD-100682]
* Fixed an issue where Canary verification failed with "verification could not complete due to an unknown error." Prometheus queries were generated with `by (null)` during Canary verification because metrics lacking a `serviceInstanceFieldName` were silently included in the deployment data collection. A null guard has been added in `formGroupByQuery()` along with a filter in `PrometheusDataCollectionInfoMapper` to exclude metrics without a `serviceInstanceField`. \[CDS-119650, ZD-106048]
* Fixed an issue where environment group selection was broken. \[CDS-119736, ZD-109324]
* Fixed an issue where the "Get List of Executions" API documentation had undocumented or inconsistent request filters, including a missing required `filterType`, ambiguous branch fields, and a broken status enum/type. \[CDS-119814, ZD-104905]
* Fixed an issue where the Jenkins trigger stage intermittently failed because the Harness pipeline did not receive the Jenkins success status. \[CDS-119843, ZD-106159]
* Fixed an issue where non-default branches were not accessible for monitored service templates. \[CDS-119852]
**GitOps**
* Fixed an issue where multi-source GitOps applications had incorrect repository identifier mapping. The reconciler filtered out empty strings when generating the repository list, causing the source-to-repository mapping to shift and link sources to the wrong metadata. A separate logic error allowed both single-source and multi-source identifier fields to be populated at the same time. The reconciler now preserves positional alignment by keeping empty placeholders and uses strict conditional logic so only the relevant identifier field is updated. \[CDS-120193]
* Fixed an issue where the App Details page displayed a `Failed loading charts` error for GitOps applications using OCI Helm repositories. The UI attempted to fetch `index.yaml` via HTTP, which OCI registries do not serve. The chart loading logic now correctly identifies OCI repositories and skips the index fetch. \[CDS-122214, ZD-111562]
* Fixed an issue where events in the application Events panel were listed oldest-first instead of newest-first, and the heading section scrolled out of view. Events are now sorted newest-first, and the tab header remains fixed while scrolling. \[CDS-113750]
* Fixed an issue where a JSONNET object was intermittently added during GitOps application creation, causing manifest errors. \[CDS-115693]
* Fixed an issue where the OutOfSync resource filter in the UI incorrectly mapped to SyncFailed, preventing OutOfSync resources from appearing in filtered results. \[CDS-121310]
* Fixed an issue where editing an ApplicationSet's Git generator or template in the UI caused the progressive sync configuration (`spec.strategy`) to be set to `null`, effectively removing it from the manifest. Users could set progressive sync settings on initial creation, but any subsequent edit through the UI would silently strip them. The ApplicationSet editor now preserves progressive sync configuration when editing other fields. \[CDS-119828, ZD-109107]
* Fixed an infinite loop during Helm deployments when using SOPS with curated ArgoCD images (for example, `harness/argocd:x.x.x-ubi9-curated`). The Helm wrapper mount corrupted the real Helm binary due to a hard link at `/usr/local/sbin/helm`. Users on curated images using SOPS who are upgrading must apply manual migration steps to their `argocd-repo-server` deployment. Refer to the SOPS documentation for details. Users not using SOPS or on standard ArgoCD images are unaffected and require no action. \[CDS-120154]
* Fixed a panic in the GitOps Agent that caused it to crash when a WebSocket connection was closed. This could lead to intermittent agent restarts and deployment stalls in environments with many concurrent connections or unstable network conditions. \[CDS-120157, ZD-109767]
* Fixed an issue where a panic-induced GitOps Agent restart during an application sync caused the sync status to remain stuck in `Progressing` indefinitely, even after all resources had synced successfully. This caused the GitOps Sync pipeline step to time out and fail. \[CDS-119949, ZD-109423]
**Continuous Integration**
* Fixed an issue where a NullPointerException caused delays in the build intelligence step, leading to longer pipeline execution times. \[CI-21795]
* Fixed an issue where the Cache Intelligence step name was not displaying correctly for self-hosted infrastructure. \[CI-13407]
* Fixed an issue where the `CI_REPO_LINK` environment variable was not being passed to the build pod. \[CI-20769]
* Fixed a parsing error that caused Save and Restore Cache steps to fail when using S3 directory buckets as the mount path. \[CI-22058]
* Improved ci-addon and ci-lite-engine security by upgrading the Go version to address known vulnerabilities. \[CI-21826]
* Improved security of the Docker, ECR, ACR, GCR, and GAR build and push plugins by replacing an end-of-life component. \[CI-21703]
**Code Repository**
* Fixed an issue where the Commits API failed with the error "failed to close the stream" when push rules (e.g. secret scanning) were configured on a repository or its parent settings, with no error surfaced to the user. The push rule code path now safely handles a nil push-rule protection and returns a proper error response. \[CODE-5226]
* Fixed an issue where long-running pushes (\~40 minutes) failed with a 401 Unauthorized from the pre-receive hook because the service-to-service JWT between code-api and code-githa expired mid-operation. Tokens are now generated by the synchronizer at the time of each call rather than at the start of the outer operation, so long pushes complete successfully. \[CODE-4955]
* Fixed an issue where the code-api service exhausted its Redis connection pool under load, causing fetch, publish, and webhook trigger operations to fail. The Helm chart now exposes GITNESS\_REDIS\_MAX\_CONNECTIONS (default raised to 50) to prevent pool exhaustion. \[CODE-5251]
* Fixed panics raised by Google's OSV scanner library that crashed code-api during vulnerability scans. The OSV scanner is now bumped to a newer version to address the upstream issue. \[CODE-5238]
* Improved rolling-update behavior for the code service by tuning maxUnavailable so snapshot deployments of code-gitrpc no longer fail during rollout. \[CODE-5224]
* Added a configurable connectDatabase flag for init containers in the code-api Helm chart, giving operators control over whether init containers attempt the database connectivity probe in restricted environments. \[CODE-5342]
**Chaos Engineering**
* Fixed CMD probes returning the complete source specification instead of a stringified version of the spec. Enhanced the `ConvertRevisionToProbeRequest` function to correctly handle copying of properties from `KubernetesCMDProperties` and `LinuxCMDProperties` to the command probe template. \[CHAOS-11490]
* Fixed the Windows Chaos Infrastructure CLI install script not including user-configured values for log file max age. The install script now correctly appends the `-ExperimentLogFileMaxAgeDays` flag to the generated CLI command when users modify the value from its default in the setup wizard. \[CHAOS-11462]
**Cloud Cost Management**
* The ratio used to calculate CPU and memory costs from node cost has been updated from 50:50 to a 9:1 ratio (CPU:Memory). This change is controlled by the feature flag CCM\_AWS\_K8S\_CPU\_MEMORY\_COST\_RATIO. \[CCM-32096]
* Cloud Cost Management now supports routing traffic through an HTTP proxy, improving compatibility with network-restricted environments and we have resolved an issue where new GCP connectors incorrectly created malformed tables during the ingestion flow. New connectors will now provision the correct table structure automatically. \[CCM-29558]
* **Shared Cost Allocation:** You can now allocate shared or common costs across your cost categories. This enables accurate cost attribution where shared infrastructure or services (e.g., platform teams, shared clusters, central tooling) need to be distributed to the teams, projects, or business units consuming them. Define a sharing strategy by specifying:
* Source - which cost category and bucket contains the shared cost pool
* Target - which cost category's buckets should receive the allocation
* Strategy - how the cost should be split Strategy Behavior: Proportional: Each recipient bucket receives a share based on its existing spend relative to the total target category spend. A bucket responsible for 30% of the target category's cost receives 30% of the shared pool.
Equal: The shared cost pool is divided evenly across all eligible buckets in the target category.
Up to 3 sharing strategies can run simultaneously, allowing multiple shared cost pools to be distributed independently.
You can choose which cost metric drives the allocation including total cost, amortized, net amortized, blended, and discounted variants. This ensures the shared pool and proportional weights are calculated on the cost perspective most relevant to your organization.
**Important Behavior**
* Zero-sum allocation - shared costs are moved, not duplicated. The source bucket's cost is replaced by its allocated portion, while recipient buckets gain their share. Your total spend remains unchanged.
* Excluded buckets - "Unattributed" and "Cost Categories Default" buckets do not receive allocations, keeping noise out of your reports.
**New features and enhancements**
**Harness Platform**
* Introduced notifications for service account tokens, allowing you to configure alerts for events such as creation, rotation, updates, expiration, deletion, and upcoming expiration across your selected channels. \[PL-41008]
* Introduced [**project movement across organizations**](/harness-platform/use-harness-platform/organizations-and-projects/move-projects.md) (Closed Beta): Move projects between organizations seamlessly while preserving audit and execution history. \[PL-41870]
**Continuous Delivery**
* The pipeline execution listing page now displays an improved card-based layout. The **Service** and **Environment** columns have been replaced by an **Update Summary** column that shows service-to-environment mappings for CD stages and schema-to-instance mappings for Database DevOps stages. You can hover over entries to view artifact details and infrastructure information, and expand execution cards for stage-level breakdowns. For more information, go to [Pipeline execution history](/continuous-delivery/use-continuous-delivery/cd-building-blocks/executions/execution-history.md#execution-reference).
* AWS connector validation no longer requires the `ec2:DescribeRegions` IAM permission when the feature flag `CDS_AWS_DESCRIBE_REGIONS_OPTIONAL` is enabled. Harness switches to `sts:GetCallerIdentity`, which requires no IAM permissions. Requires delegate version 889xx or later. Contact [Harness Support](mailto:support@harness.io) to enable. \[CDS-92587]
* Terraform output fields marked as `sensitive = true` in your `main.tf` file are now automatically masked in the pipeline **Output** tab during a [Terraform Apply](/continuous-delivery/use-continuous-delivery/provision-infrastructure/terraform-infra/run-a-terraform-plan-with-the-terraform-apply-step.md#mask-sensitive-terraform-outputs) step execution. Non-sensitive outputs continue to appear as plain text, and sensitive outputs remain accessible in downstream steps using standard Harness expressions. \[CDS-83382]
**GitOps**
* ApplicationSet TemplatePatch is now supported in the Manifest Edit panel. Previously, TemplatePatch configuration disappeared from the UI after being set. \[CDS-120408]
**Continuous Integration**
* Added support for a stage-level override in YAML for the connector used to access cache storage in self-hosted builds. If not specified, Harness uses the connector specified in Default Settings. \[CI-21932]
**Code Repository**
* Added the ability to set a default branch at the account, organization, or project level via Space settings. Defaults apply recursively to repos within the scope, so admins no longer have to configure default branches per repository. \[CODE-5028]
* The Import from GitLab by group flow now also imports repositories from nested subgroups, so an entire group hierarchy can be onboarded in one operation. \[CODE-5172]
* Added a tag filter on the repository listing page, allowing users to narrow the repo list by one or more repo tags and reducing redundant re-renders while filtering. \[CODE-5165]
**Chaos Engineering**
* Added namespace labels filters inside the ChaosGuard condition. \[CHAOS-11412]
* Optimized LLM calls used for recommendations by processing requests in chunks instead of individual calls, improving overall performance and reducing latency. \[CHAOS-11408]
* Updated the default sorting filter to "Last Updated (New to Old)" on all infrastructure list tables. \[CHAOS-11407]
* Rendering improvements in probes and actions details page. \[CHAOS-11395]
* Added support for Docker labels-based chaos injection on ECS in-VM SSM chaos. \[CHAOS-10177]
**Harness image updates**
| Image | Change | Previous Version | New Version |
| ------------------------ | -------------- | ---------------- | --------------- |
| `harness/ci-addon` | Version update | 1.18.16 | 1.18.19 |
| `harness/ci-lite-engine` | Version update | 1.18.16 | 1.18.19 |
| `drone-git` | Version update | 1.7.16-rootless | 1.7.17-rootless |
| `plugins/docker` | Security fix | 21.2.5 | 21.2.6 |
| `plugins/ecr` | Security fix | 21.2.5 | 21.2.6 |
| `plugins/acr` | Security fix | 21.2.5 | 21.2.6 |
| `plugins/gcr` | Security fix | 21.2.5 | 21.2.6 |
| `plugins/gar` | Security fix | 21.2.5 | 21.2.6 |
| `plugins/cache` | Version update | 1.10.2 | 1.10.3 |
### Version 0.40.3
April 28, 2026, Version 0.40.3
April 28, 2026
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.40.3](https://github.com/harness/helm-charts/releases/tag/harness-0.40.3) |
| Air Gap Bundle | [0.40.3](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.40.3) |
| Access Control | 1.225.2 |
| Anomaly Detection | 1.26.1 |
| Audit Event Streaming | 1.81.0 |
| Batch Processing | 1.82.4 |
| Bootstrap | 1.71.1 |
| CE Nextgen | 1.84.5 |
| Change Data Capture | 1.51.3 |
| Chaos CRD | 1.79.0 |
| Chaos K8s IFS | 1.80.0 |
| Chaos Linux IFC | 1.80.0 |
| Chaos Linux IFS | 1.80.0 |
| Chaos Manager | 1.80.3 |
| Chaos Machine IFS | 1.80.0 |
| Chaos Machine IFC | 1.80.0 |
| Chaos Web | 1.80.1 |
| CI Manager | 1.127.4 |
| Cloud Info | 1.14.4 |
| CV Nextgen | 1.57.2 |
| DB Devops Service | 1.84.0 |
| Debezium Service | 1.25.3 |
| Delegate Proxy | 1.9.0 |
| Delegate Version (Immutable) | 26.03.88803 |
| Event Service | 1.15.2 |
| Feature Flag Pushpin Service | 1.1138.0 |
| Feature Flag Service | 1.1169.0 |
| Gateway Service | 1.62.5 |
| GitOps Service | 1.53.2 |
| Harness Manager | 1.135.3 |
| LE Nextgen | 1.13.1 |
| Log Service | 1.45.0 |
| Looker | 1.15.0 |
| Next Gen UI | 1.123.9 |
| NG Auth UI | 1.39.0 |
| NG CE UI | 1.80.8 |
| NG Custom Dashboards | 1.105.0 |
| NG Dashboard Aggregator | 1.100.0 |
| NG Manager | 1.136.2 |
| Pipeline Service | 1.176.7 |
| Platform Service | 1.114.0 |
| Policy Management | 1.43.7 |
| SCM Service | 1.45.1 |
| Service Discovery Manager | 0.60.0 |
| SRM UI | 1.16.2 |
| SSCA Manager | 1.56.3 |
| SSCA UI | 0.43.1 |
| STO Core | 1.184.1 |
| Telescopes | 1.7.2 |
| Template Service | 1.138.1 |
| Test Intelligence Service | 1.65.1 |
| Queue Service | 1.9.0 |
| Code API | 1.80.4 |
| Code GitRPC | 1.80.1 |
| Code GitHA | 1.80.0 |
| Code Search | 1.80.1 |
| IAC Server | 1.354.1 |
| IACM Manager | 1.138.0 |
| IDP Service | 1.38.6 |
| IDP Admin | 1.38.2 |
| IDP App UI | 1.38.8 |
| Ticket Service | 1.8.0 |
| Component Service | 1.10.0 |
| Component Analysis Service | 1.5.2 |
| UI | 1.34.0 |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Dashboards**
* Fixed a Looker startup failure on FIPS-compliant nodes. The container now detects FIPS-enabled hosts and adjusts accordingly.
### Version 0.40.2
April 24, 2026, Version 0.40.2
April 24, 2026
{% hint style="info" %}
**Recommended upgrade**
This is a patch release that resolves the NGUI (Next-Gen UI) version mismatch introduced in [SMP 0.40.0](#version-0400). If you are on version 0.40.0 or 0.40.1, upgrade to 0.40.2 to ensure all UI features work as expected.
{% endhint %}
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.40.2](https://github.com/harness/helm-charts/releases/tag/harness-0.40.2) |
| Air Gap Bundle | [0.40.2](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.40.2) |
| Access Control | 1.225.2 |
| Anomaly Detection | 1.26.1 |
| Audit Event Streaming | 1.81.0 |
| Batch Processing | 1.82.4 |
| Bootstrap | 1.71.1 |
| CE Nextgen | 1.84.5 |
| Change Data Capture | 1.51.3 |
| Chaos CRD | 1.79.0 |
| Chaos K8s IFS | 1.80.0 |
| Chaos Linux IFC | 1.80.0 |
| Chaos Linux IFS | 1.80.0 |
| Chaos Manager | 1.80.3 |
| Chaos Machine IFS | 1.80.0 |
| Chaos Machine IFC | 1.80.0 |
| Chaos Web | 1.80.1 |
| CI Manager | 1.127.4 |
| Cloud Info | 1.14.4 |
| CV Nextgen | 1.57.2 |
| DB Devops Service | 1.84.0 |
| Debezium Service | 1.25.3 |
| Delegate Proxy | 1.9.0 |
| Delegate Version (Immutable) | 26.03.88803 |
| Event Service | 1.15.2 |
| Feature Flag Pushpin Service | 1.1138.0 |
| Feature Flag Service | 1.1169.0 |
| Gateway Service | 1.62.5 |
| GitOps Service | 1.53.2 |
| Harness Manager | 1.135.3 |
| LE Nextgen | 1.13.1 |
| Log Service | 1.45.0 |
| Looker | 1.10.1 |
| Next Gen UI | 1.123.9 |
| NG Auth UI | 1.39.0 |
| NG CE UI | 1.80.8 |
| NG Custom Dashboards | 1.105.0 |
| NG Dashboard Aggregator | 1.100.0 |
| NG Manager | 1.136.2 |
| Pipeline Service | 1.176.7 |
| Platform Service | 1.114.0 |
| Policy Management | 1.43.7 |
| SCM Service | 1.45.1 |
| Service Discovery Manager | 0.60.0 |
| SRM UI | 1.16.2 |
| SSCA Manager | 1.56.3 |
| SSCA UI | 0.43.1 |
| STO Core | 1.184.1 |
| Telescopes | 1.7.2 |
| Template Service | 1.138.1 |
| Test Intelligence Service | 1.65.1 |
| Queue Service | 1.9.0 |
| Code API | 1.80.4 |
| Code GitRPC | 1.80.1 |
| Code GitHA | 1.80.0 |
| Code Search | 1.80.1 |
| IAC Server | 1.354.1 |
| IACM Manager | 1.138.0 |
| IDP Service | 1.38.6 |
| IDP Admin | 1.38.2 |
| IDP App UI | 1.38.8 |
| Ticket Service | 1.8.0 |
| Component Service | 1.10.0 |
| Component Analysis Service | 1.5.2 |
| UI | 1.34.0 |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Continuous Delivery**
* Fixed an NGUI version mismatch issue from [SMP 0.40.0](#version-0400) by aligning it with dependent services, restoring full functionality of newly introduced features. \[CDS-122629]
### Version 0.40.1
April 21, 2026, Version 0.40.1
April 21, 2026
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.40.1](https://github.com/harness/helm-charts/releases/tag/harness-0.40.1) |
| Air Gap Bundle | [0.40.1](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.40.1) |
| Access Control | 1.225.2 |
| Anomaly Detection | 1.26.1 |
| Audit Event Streaming | 1.81.0 |
| Batch Processing | 1.82.4 |
| Bootstrap | 1.71.1 |
| CE Nextgen | 1.84.5 |
| Change Data Capture | 1.51.3 |
| Chaos CRD | 1.79.0 |
| Chaos K8s IFS | 1.80.0 |
| Chaos Linux IFC | 1.80.0 |
| Chaos Linux IFS | 1.80.0 |
| Chaos Manager | 1.80.3 |
| Chaos Machine IFS | 1.80.0 |
| Chaos Machine IFC | 1.80.0 |
| Chaos Web | 1.80.1 |
| CI Manager | 1.127.4 |
| Cloud Info | 1.14.4 |
| CV Nextgen | 1.57.2 |
| DB Devops Service | 1.84.0 |
| Debezium Service | 1.25.3 |
| Delegate Proxy | 1.9.0 |
| Delegate Version (Immutable) | 26.03.88803 |
| Event Service | 1.15.2 |
| Feature Flag Pushpin Service | 1.1138.0 |
| Feature Flag Service | 1.1169.0 |
| Gateway Service | 1.62.5 |
| GitOps Service | 1.53.2 |
| Harness Manager | 1.135.3 |
| LE Nextgen | 1.13.1 |
| Log Service | 1.45.0 |
| Looker | 1.10.1 |
| Next Gen UI | 1.125.9 |
| NG Auth UI | 1.39.0 |
| NG CE UI | 1.80.8 |
| NG Custom Dashboards | 1.105.0 |
| NG Dashboard Aggregator | 1.100.0 |
| NG Manager | 1.136.2 |
| Pipeline Service | 1.176.7 |
| Platform Service | 1.114.0 |
| Policy Management | 1.43.7 |
| SCM Service | 1.45.1 |
| Service Discovery Manager | 0.60.0 |
| SRM UI | 1.16.2 |
| SSCA Manager | 1.56.3 |
| SSCA UI | 0.43.1 |
| STO Core | 1.184.1 |
| Telescopes | 1.7.2 |
| Template Service | 1.138.1 |
| Test Intelligence Service | 1.65.1 |
| Queue Service | 1.9.0 |
| Code API | 1.80.4 |
| Code GitRPC | 1.80.1 |
| Code GitHA | 1.80.0 |
| Code Search | 1.80.1 |
| IAC Server | 1.354.1 |
| IACM Manager | 1.138.0 |
| IDP Service | 1.38.6 |
| IDP Admin | 1.38.2 |
| IDP App UI | 1.38.8 |
| Ticket Service | 1.8.0 |
| Component Service | 1.10.0 |
| Component Analysis Service | 1.5.2 |
| UI | 1.34.0 |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Harness Platform**
* Improved security in CG Manager by replacing hardcoded secret values with safe placeholder values, reducing the risk of unintended exposure of sensitive information. \[PL-70698]
* Added vault-secrets-loader support for pipeline-service and change-data-capture in SMP environments. \[PL-70785]
### Version 0.40.0
April 14, 2026, Version 0.40.0
April 14, 2026
{% hint style="warning" %}
**Important note**
A compatibility issue was identified in SMP 0.40.0, where the NGUI (Next-Gen UI) service version was ahead of its dependent services. Due to this version mismatch, some newly introduced NGUI features were not fully functional.
This issue has been resolved in [SMP 0.40.2](#version-0402) by aligning the NGUI service with compatible versions of all dependent services.
We recommend upgrading to [SMP version 0.40.2](#version-0402) to apply this fix and ensure all features work as expected.
{% endhint %}
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.40.0](https://github.com/harness/helm-charts/releases/tag/harness-0.40.0) |
| Air Gap Bundle | [0.40.0](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.40.0) |
| Access Control | 1.225.2 |
| Anomaly Detection | 1.26.1 |
| Audit Event Streaming | 1.81.0 |
| Batch Processing | 1.82.4 |
| Bootstrap | 1.71.1 |
| CE Nextgen | 1.84.5 |
| Change Data Capture | 1.51.2 |
| Chaos CRD | 1.79.0 |
| Chaos K8s IFS | 1.80.0 |
| Chaos Linux IFC | 1.80.0 |
| Chaos Linux IFS | 1.80.0 |
| Chaos Manager | 1.80.3 |
| Chaos Machine IFS | 1.80.0 |
| Chaos Machine IFC | 1.80.0 |
| Chaos Web | 1.80.1 |
| CI Manager | 1.127.4 |
| Cloud Info | 1.14.4 |
| CV Nextgen | 1.57.2 |
| DB Devops Service | 1.84.0 |
| Debezium Service | 1.25.3 |
| Delegate Proxy | 1.9.0 |
| Delegate Version (Immutable) | 26.03.88803 |
| Event Service | 1.15.2 |
| Feature Flag Pushpin Service | 1.1138.0 |
| Feature Flag Service | 1.1169.0 |
| Gateway Service | 1.62.5 |
| GitOps Service | 1.53.2 |
| Harness Manager | 1.135.2 |
| LE Nextgen | 1.13.1 |
| Log Service | 1.45.0 |
| Looker | 1.10.1 |
| Next Gen UI | 1.125.9 |
| NG Auth UI | 1.39.0 |
| NG CE UI | 1.80.8 |
| NG Custom Dashboards | 1.105.0 |
| NG Dashboard Aggregator | 1.100.0 |
| NG Manager | 1.136.2 |
| Pipeline Service | 1.176.5 |
| Platform Service | 1.114.0 |
| Policy Management | 1.43.7 |
| SCM Service | 1.45.1 |
| Service Discovery Manager | 0.60.0 |
| SRM UI | 1.16.2 |
| SSCA Manager | 1.56.3 |
| SSCA UI | 0.43.1 |
| STO Core | 1.184.1 |
| Telescopes | 1.7.2 |
| Template Service | 1.138.1 |
| Test Intelligence Service | 1.65.1 |
| Queue Service | 1.9.0 |
| Code API | 1.80.4 |
| Code GitRPC | 1.80.1 |
| Code GitHA | 1.80.0 |
| Code Search | 1.80.1 |
| IAC Server | 1.354.1 |
| IACM Manager | 1.138.0 |
| IDP Service | 1.38.6 |
| IDP Admin | 1.38.2 |
| IDP App UI | 1.38.8 |
| Ticket Service | 1.8.0 |
| Component Service | 1.10.0 |
| Component Analysis Service | 1.5.2 |
| UI | 1.34.0 |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Harness Platform**
* Fixed an issue where secret values were logged in plaintext in delegate logs during Custom Secret Manager test connections by marking the output variable as sensitive. \[PL-70002]
* Resolved an issue where editing a Custom Secrets Manager could show a blank error popup if the referenced template had all runtime variables removed or converted to fixed values. \[PL-69874]
* Updated module name matching to be case-insensitive, improving consistency across configurations. \[PL-69690]
* Fixed an issue where OPA policy checks configured with Warn and Continue for Service Accounts and API keys did not display warnings correctly. Policy evaluation responses are now properly returned, ensuring that warnings and errors are shown as expected in the UI. \[PL-69434]
* Fixed an issue in the OIDC ID token generation flow for Vault. The flow now supports the `PL_OIDC_ENHANCED_SUBJECT_FIELD` feature flag, enabling specific values to be set for the `sub` claim. \[PL-69283]
**GitOps**
* Fixed an issue where the Helm wrapper mount in the GitOps Agent corrupted the Helm binary on curated/STIG ArgoCD images (for example, `harness/argocd:x.x.x-ubi9-curated`) due to a hard link at `/usr/local/sbin/helm`, causing an infinite loop during Helm deployments when using SOPS. Users on curated images using SOPS who are upgrading must apply manual migration steps to their `argocd-repo-server` deployment - refer to the SOPS documentation for details. Users not using SOPS or on standard ArgoCD images are unaffected and require no action. \[CDS-120154]
* Fixed an issue where AI-powered GitOps operations (AIDA/MCP) failed with permission errors. The GenAI service token was forwarded directly to the access control service, which could not validate it. Permission checks now use principal-based authorization, consistent with other Harness services. \[CDS-119578]
* Fixed a UI issue where GitOps cluster creation with TLS authentication did not validate the **Client Key** and **Client Certificate** input fields. Users could submit the form with blank values without receiving error messages. Additionally, the `insecure` flag was not included in the API payload, and the base64 encoding guidance for certificate fields was inconsistent. \[CDS-119558]
* Fixed an issue with incorrect redirection when accessing GitOps project mapping pages. \[CDS-119150]
* Fixed an issue where loading an account-scope repository triggered an incorrect `appprojectmapping` API request. \[CDS-118739]
* Fixed a UI issue where switching the source type of a GitOps application from Git to Helm did not behave correctly. \[CDS-116805]
**Continuous Delivery**
* Fixed an issue where the Harness Terraform Provider validated AWS Secrets Manager connectors using the executing delegate's IAM role instead of respecting the connector's configured delegate selector. In multi-account AWS setups with environment-level IAM isolation, running `terraform apply` from an automation delegate in one account caused connector validation to fail with an `AccessDenied` error because the automation delegate lacked cross-account trust to assume the target environment's role - even though testing the same connector in the Harness UI succeeded by routing to the correct delegate. Connector validation now respects the delegate selector configured on the connector, routing validation requests to the appropriate delegate and preserving IAM isolation across accounts. This fix is behind the feature flag `PIE_GITX_EVALUATE_ENCRYPTED_CAPABILITIES`. \[CDS-118093,ZD-100682]
* Fixed an issue where logs for the Kubernetes rollout deployment step stopped streaming in the Harness UI while the rollout was still in progress. The step appeared stuck with no new log output, even though the underlying rollout continued on the cluster. Log streaming now remains active throughout the rollout step until it completes or times out. \[CDS-119456,ZD-105726,ZD-106000]
* Fixed an issue where the Harness deploy step intermittently failed when copying an artifact. A locally cached artifact could be reused even when its size did not match the expected size, leading to corrupted or incomplete artifact transfers. The step now validates that the cached artifact size matches the expected size before reuse, falling back to a fresh download on mismatch. \[CDS-119737,ZD-105015]
* Fixed an issue where the Google Cloud Run step did not accept Docker connectors as a runtime registry connector. Users who configured a Docker connector for the registry received a validation error. The step now supports the Docker connector type for runtime registry configuration. \[CDS-119769,ZD-108876]
* Fixed an issue where the Istio **Traffic Shift** step in Kubernetes Blue/Green deployments silently dropped `destination.port` values from the generated VirtualService patch. The INHERIT configuration path rebuilt route destinations using only `host` and `weight`, discarding any port defined in the step inputs or on the cluster's existing VirtualService. Port is now preserved using a combined lookup from the cluster resource and step configuration, with step input taking precedence. \[CDS-120027,ZD-105736]
* Fixed an issue where a failed pipeline execution remained stuck in a running state and could not be cancelled or aborted. The stalled execution continued to hold a resource constraint lock, blocking all subsequent deployments of the same service to the same environment due to queuing. Pipeline executions that reach a terminal state now correctly release resource constraints, and stuck executions can be force-aborted to unblock queued deployments. \[PIPE-32369,ZD-104970,ZD-105246,ZD-105761]
* Fixed an issue where the **Barrier** step did not work correctly with looping strategies in concurrent stages. When two stages ran in parallel with a barrier in each, and one stage failed before reaching the barrier, the other stage skipped the barrier wait and continued execution instead of failing. The barrier now correctly detects when a paired stage has failed and propagates the failure to the waiting stage. \[PIPE-32701,ZD-105759,ZD-109743]
* Fixed an issue where a pipeline execution remained stuck in an active state in the UI for over a week even though the backend had already marked it as succeeded. Attempting to abort the execution returned `Execution is already finished with status: [SUCCEEDED]`, and **Mark as Failed** was unavailable, leaving the execution in a stale state that could not be cleaned up from the UI. Execution state synchronization between the backend and the UI has been corrected, and the auto-abort process now handles these stale executions. \[PIPE-32702,ZD-109196]
* Fixed an issue where the pipeline execution list did not display a clickable link to the commit ID in the trigger info column, even when the commit details were present in the execution trigger metadata. The trigger info cell now renders the commit ID as a hyperlink when commit information is available. \[PIPE-32799,ZD-105993]
* Fixed an issue where the Harness UI crashed when interacting with input sets on a remote pipeline. Editing a trigger and selecting an input set for a specific pipeline caused the page to become unresponsive. The UI now handles input set loading for remote pipelines without crashing. \[PIPE-32837,ZD-109723]
* Fixed a UI issue where the **Skip Resource Versioning** checkbox appeared greyed out and unchecked when **Enable Declarative Rollback** was enabled. This was inconsistent with the documented behavior: when declarative rollback is on, resource versioning is not supported, so the UI should show Skip Resource Versioning as checked and disabled. The checkbox is now checked and disabled when Enable Declarative Rollback is enabled, so the UI correctly reflects that versioning is skipped in this case. \[CDS-118092,ZD-102047]
* Fixed an issue where GitOps links in **Project Settings** returned a 404 error when opened from **Admin Settings** at project scope. Links under GitOps (for example, Agents, Clusters, Repositories) worked at account and organization scope from Admin Settings but failed when navigating into a project and selecting the same links. The missing redirection for project-level GitOps settings has been added, so these links now resolve correctly when accessed from Admin Settings. \[CDS-118353]
* Fixed an issue where the Helm chart version dropdown for **Harness Artifact Registry (HAR)** OCI-based charts displayed versions in the wrong order. The OCI Distribution API returns tag names as unsorted strings, and versions were shown in lexicographical ascending order (for example, 0.1.0, 0.10.0, 0.2.0, 1.0.0), forcing users to scroll to the bottom to select the latest chart. The version list for HAR is now sorted in alphanumeric descending order so the newest versions appear first. This sorting applies only to Harness Artifact Registry and does not affect other OCI Helm registries. \[CDS-118749,ZD-104284]
* Fixed an issue where the EKS cluster list API used a hardcoded STS endpoint region (us-east-1) when listing clusters with a **cross-account AWS connector**. The STS AssumeRole call for assuming the cross-account role always targeted us-east-1 instead of the region specified by the user in the infrastructure configuration. The API now uses the user-defined region for the STS endpoint when listing EKS clusters with a cross-account connector. Update your delegate to pick up this fix. \[CDS-119087,ZD-104755]
* Fixed an issue where the **Deploy to environment or infrastructure in parallel** checkbox appeared twice in the Run Pipeline UI when using environment groups. Incorrect parameters were passed for environment groups, causing the parallel-deploy field to be rendered in duplicate. The Run Pipeline form now receives the correct parameters, so the checkbox is shown only once. \[CDS-119757,ZD-105232]
* Fixed an issue where the pipeline's **Advanced Option** did not show the delegate selector configured in the pipeline template. For pipelines created from a template with a pipeline-level delegate selector (for example, `<+pipeline.variables.delegate>`), the template's Advanced Option displayed the value correctly, but the pipeline's Advanced Option sometimes did not, depending on template version. The pipeline's Advanced Option now correctly reflects the delegate selector and other advanced settings from the template. \[PIPE-32408,ZD-105256]
* Fixed an issue where the **Insert Step** in CD pipelines was incorrectly marked as failed (red) when no steps were injected. When the Insert Step injected zero steps, the execution logic did not handle empty executable responses and treated the step as failed even though there was no actual failure. The Insert Step now passes and displays green when no steps are injected. \[PIPE-32582,ZD-105701]
* Fixed an issue where **nested Harness expressions** failed to resolve on the first execution but succeeded on retry. When using expressions such as `<+execution.steps.StepGroup.steps.Step.spec.environmentVariables>` where the referenced values are themselves Harness expressions, the inner expressions were left unresolved on the first run. Resolution could halt partway due to concurrent modification while traversing map structures, causing steps to receive raw expression syntax and fail. Nested expression resolution now completes correctly on the first execution. \[PIPE-32599,ZD-106076]
* Fixed an issue where Jenkins build logs were not visible due to incorrect job URL construction. For multi-branch pipelines, branch names in the job URL were not encoded correctly, causing log retrieval to fail. The logic for constructing job URLs now directly uses the URL returned by Jenkins, which preserves the correct encoding for branch names. Update your delegate to pick up this fix. \[CDS-118936,ZD-104616,ZD-106159]
* Fixed an issue where Artifactory connectors could not be used as a plugin connector reference. Users who needed to route plugin images through Artifactory instead of public Docker Hub had to work around this limitation by using a variable reference, which prevented the UI from displaying it and broke connector dependency tracking. Artifactory connectors are now accepted as valid plugin connector references. \[CDS-118978]
* Fixed an issue where the Update Release Repo and Merge PR steps took significantly longer than expected, impacting deployment times. For large repositories, these steps were slow even after the delegate received the task. The performance of these steps has been optimized to reduce execution time. This fix is behind the feature flag `CDS_GITOPS_DELEGATE_USE_SCM_FOR_COMMIT`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[CDS-119144,ZD-104872]
* Fixed an issue where a failure to retrieve the execution graph from PostgreSQL caused unexpectedly long queue times for pipeline stages. During reruns, the system could fail to fetch the complete execution graph from the database, causing subsequent stages (such as a canary deployment stage) to stall in a queued state without an explicit queue step. Graph retrieval from PostgreSQL is now more resilient, preventing stages from stalling due to incomplete data. \[PIPE-32347,ZD-105168]
* Fixed an issue where `json.select()` JEXL expressions did not resolve correctly inside pipeline notification templates, even though the same expressions worked in Shell Script steps. The expression evaluation logic in notification templates now correctly resolves `json.select()` expressions. \[PIPE-32372,ZD-104817]
* Fixed an issue where pipeline executions triggered via Git triggers did not display Git details (codebase details) on the execution list page. Manually triggered executions showed the details correctly, but Git-triggered executions appeared without any codebase information. The execution metadata now correctly captures and displays Git details for trigger-based executions. \[PIPE-32483,ZD-105715,ZD-105993,ZD-106003,ZD-106057,ZD-106080,ZD-106101]
* Fixed an issue where selective stage execution failed with a `NullPointerException` when the pipeline contained Insert Block (injected stage templates). Running a subset of stages produced an `INVALID_REQUEST` error with the message `Cannot invoke "YamlField.getNode()" because the return value of "YamlNode.getField(String)" is null`, giving no indication of the root cause. Selective stage execution now correctly handles pipelines that use Insert Block stages. \[PIPE-32512,ZD-105316]
* Fixed an issue where Pipeline Studio displayed random strings in the UI, making the editor unusable. The stray text rendered over pipeline components and blocked normal interaction with the studio. The rendering logic has been corrected to prevent unintended strings from appearing in the Pipeline Studio. \[PIPE-32540,ZD-105914]
* Fixed an issue where output variables captured from PowerShell Shell Script steps did not preserve newline characters (`\r\n` / `\n`). Multi-line strings set via `$env:varName` in PowerShell were flattened to a single line when referenced downstream (for example, in Approval step messages), while the equivalent Bash step using `export` preserved newlines correctly. The delegate's output variable capture mechanism for PowerShell now retains newline characters, bringing behavior in line with Bash Shell Script steps. \[CDS-118883,ZD-104328]
* Fixed an issue where the Azure Create ARM Resource provisioning step failed with an `IllegalStateException: Unexpected token to begin object deserialization: STRING` error during JSON deserialization. The step could not process valid ARM templates that deployed successfully through the Azure CLI. The deserialization logic now correctly handles the ARM template and parameter formats returned by the Azure API. \[CDS-118917,ZD-104638]
* Fixed an issue where creating a service override for a specific environment failed with an "Oops, something went wrong on our end" error in the UI and timed out via the Terraform provider. This occurred when a project was deleted and recreated - orphaned records from the original project caused a `DuplicateKeyException` in MongoDB during the upsert operation. The service override upsert logic now correctly handles pre-existing records from previously deleted projects. \[CDS-119084,ZD-104999]
* Fixed an issue where the OCI Helm connector with anonymous authentication failed to fetch charts with an `invalid_reference: invalid repository` error. The internal URL construction added an extra trailing slash to the repository URL, producing a malformed OCI reference (for example, `oci://ghcr.io:443//chartpath` instead of `oci://ghcr.io:443/chartpath`). The connector now correctly constructs repository URLs without the extra slash. Update your delegate to pick up this fix. \[CDS-119172,ZD-105268]
* Fixed an issue where pipeline executions failed with a `CIStageExecutionException: Unable to get secret information` error that displayed an obfuscated secret identifier, making it impossible to determine which secret was missing or misconfigured. The error message now includes the original secret name and scope, enabling users to quickly identify and resolve the issue. This fix is behind the feature flag `PIPE_DISABLE_THROWING_ENGINE_EXPRESSION_EVALUATION_EXCEPTION`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[PIPE-31311,ZD-90976]
* Fixed an issue where the execution URL in Git status checks from Custom stages always pointed to a CI module path, causing a blank page for accounts without a CI license. The status check URL is now module-agnostic and resolves to the correct pipeline execution page regardless of the licensed modules on the account. This fix is behind the feature flag `PIPE_USE_DYNAMIC_MODULE_TYPE_IN_BUILD_DETAILS_URL`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[PIPE-31593,ZD-100070]
* Fixed an issue where the `notification.errormessage` expression in notification templates caused the template engine to fall back to the default template, and using `default()` returned the literal string `"null"` instead of the specified fallback value. Special characters in the error message were breaking the YAML parser during expression evaluation. The error message is now parsed with a dedicated object mapper that handles special characters correctly. \[PIPE-32051,ZD-101534,ZD-104538]
* Fixed an issue where the **Referencing Entities** button for organization-level step templates showed "no references found" even when references existed, and the **Compare Versions** feature failed to load the comparison side with a "template does not exist or has been deleted" error despite the version being valid. Both features now correctly resolve template references and version metadata across scopes. \[PIPE-32351,PIPE-32353,ZD-104288]
* Fixed an issue where files uploaded via the File Upload step remained downloadable for up to 7 days after deletion through the API or UI, due to a soft-delete policy on the underlying GCS bucket. Deleting an uploaded file now removes it from storage immediately, so it is no longer accessible for download after a successful delete operation. Note that the GCS bucket has a 37-day lifecycle rule - files that are not explicitly deleted are automatically removed after 37 days. \[PIPE-32337,ZD-104827]
**Continuous Integration**
* Fixed a regression where CI steps were not properly supporting EKS pod identity authentication for AWS. \[CI-21034]
* Fixed an issue where build status was not reported to Bitbucket when API access was configured with an email ID and API token. \[CI-21668]
* Fixed a cache plugin compatibility issue that caused Bazel 7 builds to fail with an unrecognized --repo\_contents\_cache option. \[CI-21575]
* Fixed an issue where Docker Layer Caching (DLC) was not working correctly with GAR, ACR, and ECR registries when using GCS as the cache backend. \[CI-21747]
* Improved addon and lite-engine security by upgrading the gRPC dependency to address a known vulnerability. \[CI-21681]
**Security Testing Orchestration**
* Fixed an issue where selecting a Build stage defined through templates during conditional stage execution disabled the manual pipeline runs. Pipelines can now be triggered manually as expected. \[STO-10932]
**Cloud Cost Management**
* Jira Ticket Comments Not Saving for CCM Recommendations: Resolved an issue where adding a comment while creating a Jira ticket for a CCM recommendation was not working. \[CCM-30525]
* Budget Amount Changing on Scroll: Fixed unexpected behavior in the budget UI where scrolling while the cursor was in a budget textbox caused the amount to change, including going negative. Scroll events are now disabled for numeric input fields. \[CCM-30434]
* Node Pool Preset UI Breaking on AWS Region Addition: Fixed an issue where editing a node pool preset and adding an AWS region caused the UI to break upon saving, preventing navigation back to the Presets page. \[CCM-31303]
* Recommendation Presets Screen Broken Due to EC2 Presets: Fixed an issue where the recommendation presets screen was broken due to new EC2 presets. AWS EC2 passthrough support is hidden until fully implemented. \[CCM-30983]
**Chaos Engineering**
* Fixed an issue where creating a fault with an org-level fault template as reference was failing when the feature flag was enabled \[CHAOS-11358]
**New features and enhancements**
**Continuous Delivery**
* Harness now supports a **Waiting for User Action** notification event for both pipeline-level and centralized notifications. A notification is sent whenever a pipeline pauses for user input, such as an Approval step, Manual Intervention, or runtime execution input.
* Harness now supports **ECS Scheduled Actions** as a new manifest type (`EcsScheduledActionDefinition`) in ECS Service deployments, enabling you to define time-based auto-scaling policies. This feature is behind the feature flag `CDS_ECS_SCHEDULED_ACTIONS`. Contact [Harness Support](mailto:support@harness.io) to enable the feature.
* **Native Helm** deployments can now expose Harness values overrides to **service hooks** before Helm runs, so you can decrypt overrides (for example with SOPS) in a **Fetch files** post-hook. Overrides are written to a per-task directory; hooks can use `VALUES_OVERRIDE_DIRECTORY` or `$MANIFEST_FILES_DIRECTORY/values-overrides`, and optionally export `OVERRIDE_FILES` with comma-separated paths for additional YAML overrides. This requires delegate version `26.03.88700` or later and is behind the feature flag `CDS_HELM_IMPROVED_SOPS_SUPPORT_FOR_SERVICE_HOOKS`. For more information, go to [SOPS and values overrides in Native Helm service hooks](/continuous-delivery/use-continuous-delivery/deploy-services-on-different-platforms/helm/native-helm-sops-overrides-service-hooks.md).
* Harness now supports a dedicated **ECS Scale** step that lets you scale ECS services up or down without running a full deployment stage. You can specify the target instance count or percentage, and optionally provide AWS connector, region, and cluster details at the step level or inherit them from the environment configuration. This feature requires delegate version `26.02.88503` or later. \[CDS-118048]
* Harness now supports **Host Groups** for Physical Data Center (PDC) WinRM deployments, letting you assign independent WinRM credentials to different groups of hosts within a single infrastructure definition. This removes the previous limitation of a single shared credential and enables environments using Just Enough Administration (JEA) with distinct endpoint configurations per server group. This feature is behind the feature flag `CDS_ENABLE_INFRA_HOST_GROUPS`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[CDS-115563]
* Google Managed Instance Group (MIG) deployments now support **Google Cloud Storage** as a manifest source for storing MIG manifests and templates.
**Continuous Integration**
* Added a restriction to prevent secrets from being mounted through Kubernetes pod spec overlay YAML. This feature is behind the feature flag `CI_K8S_OVERLAY_YAML_SECRET_RESTRICTION`. \[CI-21651]
**Cloud Cost Management**
* Cloud Billing Tags for Node Pool Recommendations: Kubernetes node pool recommendations now support cloud billing tags (such as allocation and environment tags from AWS cost data) in addition to Kubernetes node labels. \[CCM-31030]
* Tags for Node Pool and Workload Recommendations: Node pool and workload recommendations now display tags, consistent with AWS EC2 recommendations. \[CCM-30822]
**Chaos Engineering**
* Added support for viewing Harness Delegate logs and DDCI logs directly in the logs view, with a new LogsView integrated into the timeline view for improved observability during experiment runs \[CHAOS-11344, CHAOS-11343, CHAOS-11342]
* Added support for fault deprecation via Enterprise Hub Sync, allowing deprecated faults to be managed centrally through the enterprise ChaosHub \[CHAOS-11324]
* Refactored report generation to a unified data extraction pipeline and added an API to return report data as JSON \[CHAOS-11266]
* Added fallback mechanism to list Java PID for running JVM faults, improving reliability when the default discovery method is unavailable \[CHAOS-11341]
### Version 0.36.5
April 9, 2026, Version 0.36.5
April 9, 2026
{% hint style="danger" %}
**Breaking changes notice**
SMP upgrades from **0.35.x to 0.36.x or later** caused silent database index corruption, which resulted in issues in STO pipelines. This happened because the PostgreSQL container image changed its base OS from Debian to Alpine Linux, which introduced different text sorting behavior in the underlying libraries and broke existing database indexes.
This issue is fixed in the latest version of SMP. If you upgraded to **0.36.x or later**, upgrade to the latest release to resolve the issue.
Affected versions: 0.36.x, 0.37.x, 0.38.x
**Note:** This only affects customers using the internal PostgreSQL deployment. Customers using external PostgreSQL are not affected.
{% endhint %}
{% hint style="info" %}
**Important**
The migration from TimescaleDB to PostgreSQL is automatically triggered as part of the Harness SMP upgrade to version 0.36.x. Before you upgrade to SMP 0.36.x, you must be running version 0.35.x. Learn more about the migration in the [migration guide](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/migrate-timescaledb-to-postgresql.md).
{% endhint %}
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.36.5](https://github.com/harness/helm-charts/releases/tag/harness-0.36.5) |
| Air Gap Bundle | [0.36.5](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.36.5) |
| Access Control | 1.184.0 |
| Anomaly Detection | 1.20.0 |
| Audit Event Streaming | 1.73.0 |
| Batch Processing | 1.75.19 |
| Bootstrap | 1.64.1 |
| CE Nextgen | 1.77.11 |
| Change Data Capture | 1.49.4 |
| Chaos CRD | 1.72.0 |
| Chaos K8s IFS | 1.72.5 |
| Chaos Linux IFC | 1.72.2 |
| Chaos Linux IFS | 1.72.2 |
| Chaos Manager | 1.72.18 |
| Chaos Machine IFS | 1.72.3 |
| Chaos Machine IFC | 1.72.2 |
| Chaos Web | 1.72.10 |
| CI Manager | 1.119.11 |
| Cloud Info | 1.13.2 |
| CV Nextgen | 1.53.1 |
| DB Devops Service | 1.76.2 |
| Debezium Service | 1.25.0 |
| Delegate Proxy | 1.6.0 |
| Delegate Version (Immutable) | 26.01.88201 |
| Event Service | 1.14.0 |
| Feature Flag Pushpin Service | 1.1132.0 |
| Feature Flag Service | 1.1148.0 |
| Gateway Service | 1.59.2 |
| GitOps Service | 1.49.1 |
| Harness Manager | 1.127.0 |
| LE Nextgen | 1.12.2 |
| Log Service | 1.38.8 |
| Looker | 1.8.9 |
| Next Gen UI | 1.114.2 |
| NG Auth UI | 1.37.4 |
| NG CE UI | 1.73.7 |
| NG Custom Dashboards | 1.98.0 |
| NG Dashboard Aggregator | 1.92.0 |
| NG Manager | 1.128.4 |
| Pipeline Service | 1.168.5 |
| Platform Service | 1.106.3 |
| Policy Management | 1.35.6 |
| SCM Service | 1.43.0 |
| Service Discovery Manager | 0.52.3 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.48.32 |
| SSCA UI | 0.37.9 |
| STO Core | 1.175.7 |
| Telescopes | 1.6.0 |
| Template Service | 1.130.0 |
| Test Intelligence Service | 1.60.4 |
| Queue Service | 1.8.0 |
| Code API | 1.73.2 |
| Code GitRPC | 1.73.1 |
| Code GitHA | 1.73.1 |
| Code Search | 1.73.1 |
| IAC Server | 1.296.0 |
| IACM Manager | 1.125.0 |
| IDP Service | 1.36.9 |
| IDP Admin | 1.36.2 |
| IDP App UI | 1.36.8 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.36.5/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.5/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.5/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.5/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.5/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.5/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.5/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.5/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.5/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.5/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.5/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.5/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.5/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.5/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.5/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.5/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.5/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.5/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.5/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.5/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Cloud Cost Management**
* Fixed cost data ingestion failures for GCP caused by a breaking behavior change introduced in a ClickHouse version upgrade. \[CCM-31550]
* Updated proxy configuration handling in Harness overrides to support HTTP proxy compatibility. \[CCM-30796]
### Version 0.39.1
April 01, 2026, Version 0.39.1
April 01, 2026
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.39.1](https://github.com/harness/helm-charts/releases/tag/harness-0.39.1) |
| Air Gap Bundle | [0.39.1](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.39.1) |
| Access Control | 1.211.0 |
| Anomaly Detection | 1.23.0 |
| Audit Event Streaming | 1.78.0 |
| Batch Processing | 1.80.7 |
| Bootstrap | 1.71.1 |
| CE Nextgen | 1.82.5 |
| Change Data Capture | 1.51.2 |
| Chaos CRD | 1.77.0 |
| Chaos K8s IFS | 1.77.0 |
| Chaos Linux IFC | 1.77.0 |
| Chaos Linux IFS | 1.77.0 |
| Chaos Manager | 1.77.3 |
| Chaos Machine IFS | 1.77.0 |
| Chaos Machine IFC | 1.77.0 |
| Chaos Web | 1.77.1 |
| CI Manager | 1.124.3 |
| Cloud Info | 1.14.4 |
| CV Nextgen | 1.57.2 |
| DB Devops Service | 1.82.1 |
| Debezium Service | 1.25.3 |
| Delegate Proxy | 1.9.0 |
| Delegate Version (Immutable) | 26.03.88702 |
| Event Service | 1.15.2 |
| Feature Flag Pushpin Service | 1.1138.0 |
| Feature Flag Service | 1.1165.0 |
| Gateway Service | 1.62.5 |
| GitOps Service | 1.53.2 |
| Harness Manager | 1.132.2 |
| LE Nextgen | 1.13.1 |
| Log Service | 1.41.1 |
| Looker | 1.10.1 |
| Next Gen UI | 1.120.4 |
| NG Auth UI | 1.39.0 |
| NG CE UI | 1.78.5 |
| NG Custom Dashboards | 1.105.0 |
| NG Dashboard Aggregator | 1.97.0 |
| NG Manager | 1.133.6 |
| Pipeline Service | 1.173.4 |
| Platform Service | 1.111.0 |
| Policy Management | 1.38.1 |
| SCM Service | 1.45.1 |
| Service Discovery Manager | 0.57.0 |
| SRM UI | 1.16.2 |
| SSCA Manager | 1.53.14 |
| SSCA UI | 0.40.5 |
| STO Core | 1.182.1 |
| Telescopes | 1.7.2 |
| Template Service | 1.135.0 |
| Test Intelligence Service | 1.61.3 |
| Queue Service | 1.9.0 |
| Code API | 1.76.1 |
| Code GitRPC | 1.76.0 |
| Code GitHA | 1.76.0 |
| Code Search | 1.76.0 |
| IAC Server | 1.335.1 |
| IACM Manager | 1.138.0 |
| IDP Service | 1.38.6 |
| IDP Admin | 1.38.2 |
| IDP App UI | 1.38.8 |
| Ticket Service | 1.8.0 |
| Component Service | 1.8.2 |
| Component Analysis Service | 1.3.1 |
| UI | 1.34.0 |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Security Testing Orchestration**
* Introduced the `STO_USER_INFO_CACHE` feature flag to enable caching of user information in STO pipelines. When enabled, this feature caches user details to improve performance and reduce redundant lookups during security scan operations. \[STO-8871]
## March 2026
### Version 0.39.0
March 24, 2026, Version 0.39.0
March 24, 2026
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.39.0](https://github.com/harness/helm-charts/releases/tag/harness-0.39.0) |
| Air Gap Bundle | [0.39.0](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.39.0) |
| Access Control | 1.211.0 |
| Anomaly Detection | 1.23.0 |
| Audit Event Streaming | 1.78.0 |
| Batch Processing | 1.80.7 |
| Bootstrap | 1.71.1 |
| CE Nextgen | 1.82.5 |
| Change Data Capture | 1.51.2 |
| Chaos CRD | 1.77.0 |
| Chaos K8s IFS | 1.77.0 |
| Chaos Linux IFC | 1.77.0 |
| Chaos Linux IFS | 1.77.0 |
| Chaos Manager | 1.77.3 |
| Chaos Machine IFS | 1.77.0 |
| Chaos Machine IFC | 1.77.0 |
| Chaos Web | 1.77.1 |
| CI Manager | 1.124.3 |
| Cloud Info | 1.14.4 |
| CV Nextgen | 1.57.2 |
| DB Devops Service | 1.82.1 |
| Debezium Service | 1.25.3 |
| Delegate Proxy | 1.9.0 |
| Delegate Version (Immutable) | 26.03.88702 |
| Event Service | 1.15.2 |
| Feature Flag Pushpin Service | 1.1138.0 |
| Feature Flag Service | 1.1165.0 |
| Gateway Service | 1.62.5 |
| GitOps Service | 1.53.2 |
| Harness Manager | 1.132.1 |
| LE Nextgen | 1.13.1 |
| Log Service | 1.41.1 |
| Looker | 1.10.1 |
| Next Gen UI | 1.120.4 |
| NG Auth UI | 1.39.0 |
| NG CE UI | 1.78.5 |
| NG Custom Dashboards | 1.105.0 |
| NG Dashboard Aggregator | 1.97.0 |
| NG Manager | 1.133.6 |
| Pipeline Service | 1.173.4 |
| Platform Service | 1.111.0 |
| Policy Management | 1.38.1 |
| SCM Service | 1.45.1 |
| Service Discovery Manager | 0.57.0 |
| SRM UI | 1.16.2 |
| SSCA Manager | 1.53.14 |
| SSCA UI | 0.40.5 |
| STO Core | 1.182.1 |
| Telescopes | 1.7.2 |
| Template Service | 1.135.0 |
| Test Intelligence Service | 1.61.3 |
| Queue Service | 1.9.0 |
| Code API | 1.76.1 |
| Code GitRPC | 1.76.0 |
| Code GitHA | 1.76.0 |
| Code Search | 1.76.0 |
| IAC Server | 1.335.1 |
| IACM Manager | 1.138.0 |
| IDP Service | 1.38.6 |
| IDP Admin | 1.38.2 |
| IDP App UI | 1.38.8 |
| Ticket Service | 1.8.0 |
| Component Service | 1.8.2 |
| Component Analysis Service | 1.3.1 |
| UI | 1.34.0 |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Harness Platform**
* Fixed an issue in the IACM flow for generating OIDC ID tokens for Vault. The flow now also supports the `PL_OIDC_ENHANCED_SUBJECT_FIELD` feature flag, enabling more specific values for the `sub` claim. \[PL-69283]
**GitOps**
* Fixed an issue where Harness secret expressions resolved inside non-secret Kubernetes manifests (such as ConfigMaps) exposed secret values in plain text. When an environment or service variable was typed as a Secret and referenced via a Harness expression in a Helm values file, the resolved secret content appeared unmasked in the rendered manifest during GitOps app sync. Secret values are now masked in non-secret manifest types. \[CDS-119065]
* Fixed an issue where GitOps links in **Project Settings** returned a 404 error when accessed from **Admin Settings**. \[CDS-118353]
* Fixed an issue where the GitOps Rollout step failed to fetch rollout status when an Argo Rollout had more than two active ReplicaSets. \[CDS-118750, ZD-104383]
* Fixed an issue where the Argo CD application project was linked to a different organization than the one selected in the UI. \[CDS-118859, ZD-104476]
* Fixed an issue where the GitOps Rollout step failed with an unmarshalling error when processing Argo Rollouts that use custom traffic routing plugins. \[CDS-118893, ZD-104434]
* Fixed an issue where auto-created GitOps services defaulted to a GitHub connector regardless of the actual Git provider. GitOps auto-created services now detect and assign the correct Git provider type from the repository URL, ensuring proper connector selection in the Harness UI. Additionally, source repository details were incorrectly populated in the **Deployment Repo** fields instead of the **Release Repo** field; they are now correctly populated in the **Release Repo** field. \[CDS-119249, ZD-105458]
* Fixed an issue where Harness Support Group users authenticated via OKTA SSO received 403 Permission Denied errors when accessing GitOps resources. Support user tokens are now properly forwarded to the Access Control Service for elevated-access detection. \[CDS-116751]
* Fixed an issue where deleting an ApplicationSet from the resource tree context menu incorrectly called the delete application API instead of the delete ApplicationSet API, causing the deletion to fail. \[CDS-115910]
* Fixed an issue where ApplicationSets could not be deleted if the associated agent no longer existed, returning a "Permission denied: agent identifier incorrect or agent does not exist" error. Cleanup of ApplicationSets now works correctly when deleting account-level agents. \[CDS-118171]
**Continuous Delivery**
* Fixed an issue where output variables captured from PowerShell Shell Script steps did not preserve newline characters (`\r\n` / `\n`). Multi-line strings set via `$env:varName` in PowerShell were flattened to a single line when referenced downstream (for example, in Approval step messages), while the equivalent Bash step using `export` preserved newlines correctly. The delegate's output variable capture mechanism for PowerShell now retains newline characters, bringing behavior in line with Bash Shell Script steps. \[CDS-118883, ZD-104328]
* Fixed an issue where the Azure Create ARM Resource provisioning step failed with an `IllegalStateException: Unexpected token to begin object deserialization: STRING` error during JSON deserialization. The step could not process valid ARM templates that deployed successfully through the Azure CLI. The deserialization logic now correctly handles the ARM template and parameter formats returned by the Azure API. \[CDS-118917, ZD-104638]
* Fixed an issue where creating a service override for a specific environment failed with an "Oops, something went wrong on our end" error in the UI and timed out via the Terraform provider. This occurred when a project was deleted and recreated - orphaned records from the original project caused a `DuplicateKeyException` in MongoDB during the upsert operation. The service override upsert logic now correctly handles pre-existing records from previously deleted projects. \[CDS-119084, ZD-104999]
* Fixed an issue where the OCI Helm connector with anonymous authentication failed to fetch charts with an `invalid_reference: invalid repository` error. The internal URL construction added an extra trailing slash to the repository URL, producing a malformed OCI reference (for example, `oci://ghcr.io:443//chartpath` instead of `oci://ghcr.io:443/chartpath`). The connector now correctly constructs repository URLs without the extra slash. Update your delegate to pick up this fix. \[CDS-119172, ZD-105268]
* Fixed an issue where pipeline executions failed with a `CIStageExecutionException: Unable to get secret information` error that displayed an obfuscated secret identifier, making it impossible to determine which secret was missing or misconfigured. The error message now includes the original secret name and scope, enabling users to quickly identify and resolve the issue. This fix is behind the feature flag `PIPE_DISABLE_THROWING_ENGINE_EXPRESSION_EVALUATION_EXCEPTION`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[PIPE-31311, ZD-90976]
* Fixed an issue where the execution URL in Git status checks from Custom stages always pointed to a CI module path, causing a blank page for accounts without a CI license. The status check URL is now module-agnostic and resolves to the correct pipeline execution page regardless of the licensed modules on the account. This fix is behind the feature flag `PIPE_USE_DYNAMIC_MODULE_TYPE_IN_BUILD_DETAILS_URL`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[PIPE-31593, ZD-100070]
* Fixed an issue where the `notification.errormessage` expression in notification templates caused the template engine to fall back to the default template, and using `default()` returned the literal string `"null"` instead of the specified fallback value. Special characters in the error message were breaking the YAML parser during expression evaluation. The error message is now parsed with a dedicated object mapper that handles special characters correctly. \[PIPE-32051, ZD-101534, ZD-104538]
* Fixed an issue where the **Referencing Entities** button for organization-level step templates showed "no references found" even when references existed, and the **Compare Versions** feature failed to load the comparison side with a "template does not exist or has been deleted" error despite the version being valid. Both features now correctly resolve template references and version metadata across scopes. \[PIPE-32351, PIPE-32353, ZD-104288]
* Fixed an issue where files uploaded via the File Upload step remained downloadable for up to 7 days after deletion through the API or UI, due to a soft-delete policy on the underlying GCS bucket. Deleting an uploaded file now removes it from storage immediately, so it is no longer accessible for download after a successful delete operation. Note that the GCS bucket has a 37-day lifecycle rule - files that are not explicitly deleted are automatically removed after 37 days. \[PIPE-32337, ZD-104827]
* Fixed an issue where Harness dashboards failed to load data, returning a PostgreSQL error when attempting to retrieve dashboard information. \[CDS-117508, ZD-97705]
* Fixed an issue where saving a freeze window with email notifications configured in delegate mode failed with a YAML validation error. The UI-generated YAML for delegate selectors was incorrectly formatted, causing the save operation to fail even though no manual YAML edits were made. \[CDS-118870, ZD-104033]
* Fixed an issue where the **Triggered by** column in the pipeline executions list displayed a generic `Webhook()` label instead of the configured trigger name after adding a CI stage to an existing CD pipeline. The trigger name now displays consistently regardless of the stage types present in the pipeline. \[PIPE-31572, ZD-100883]
* Fixed an issue where `send status back to git` does not publish commit status when the pipeline is triggered via the Harness code trigger in custom stages. Status handling was missing in the Harness code repository because it lacks a connectorRef. Added proper handling for the code repository. \[PIPE-31736, ZD-100597]
* Fixed an issue where executing a pipeline directly from an input set failed with a validation error for a required variable, even though the variable value was already populated. This was caused by an empty pipeline identifier being sent in the input set API call. \[PIPE-32073, ZD-102863]
* Fixed an issue where the **Updated Time** column on the pipeline template's referencing entities tab displayed time in 24-hour format with an incorrect AM/PM suffix (for example, `14:11 PM`). The timestamp now uses a consistent and valid time format. \[PIPE-32114, ZD-104150]
* Fixed an issue where the **Start** button in the Infra Workspace Template creation flow was unresponsive on prod2, preventing users from creating new templates. This occurred even though the workspace templates feature was GA and enabled for the account. \[PIPE-32258, ZD-103995]
* Fixed a race condition where the built-in expression `<+project.identifier>` failed to resolve in time during parallel HTTP steps, causing a 400 error. The expression now resolves consistently across all parallel steps during pipeline execution. \[PIPE-32334, ZD-102702]
**New Features and Enhancements**
**GitOps**
* Harness AIDA now supports GitOps entities and pipeline stages. When creating or troubleshooting GitOps Applications or ApplicationSets, AIDA can diagnose common setup errors and suggest remediations - including manifest syntax errors, incorrect service or environment types, missing GitOps clusters on linked environments, incomplete Application or ApplicationSet manifests, and connectivity issues with Git or infrastructure connectors. \[CDS-115902]
**Continuous Integration**
* The Docker Build and Push plugins now automatically detect and use Harness proxy environment variables (HARNESS\_HTTP\_PROXY, HARNESS\_HTTPS\_PROXY, HARNESS\_NO\_PROXY) as build arguments when standard proxy variables are not set \[CI-20651]
* Introduced branch-based version counters, allowing build numbering to track independently per branch (requires CI\_ENABLE\_BRANCH\_SEQUENCE\_ID) \[CI-20577]
* Branch-based version counters now work with pipelines that have codebase disabled, using trigger event data to determine the branch (requires CI\_ENABLE\_BRANCH\_SEQUENCE\_ID) \[CI-21208]
* Cache Intelligence now supports Azure Blob Storage with principal authentication and OIDC-based access \[CI-21176]
* Cache Intelligence now supports Go builds on Linux, enabling automatic dependency caching for Go projects \[CI-20988]
* Container-based step groups now support real-time step status updates during execution \[CI-21113]
* Fixed a marker file permission issue in the cache proxy that caused "Failed to record build cache usage" errors with a "permission denied" message \[CI-21173]
* Fixed an issue where tag event expressions returned an empty string instead of null when no value was available (applies when CI\_ENABLE\_BRANCH\_SEQUENCE\_ID is enabled) \[CI-21207]
* Improved error logging when the Initialize step fails due to secret fetch errors, providing more actionable details in the logs \[CI-20761]
* Resolved an issue where double quotes within secrets were not handled correctly in CI Run steps \[CI-20256]
* Addressed a high severity security vulnerability (CVE-2026-24051) in the cache proxy by upgrading the OpenTelemetry SDK dependency \[CI-21042]
**Code Repository**
* Added a new API endpoint to retrieve repository language statistics, providing a breakdown of programming languages used in a repository. \[CODE-5131]
* Added backend support for updating PGP keys used for commit signature verification. \[CODE-4914]
* The fork-sync API now returns HTTP 409 status code when sync encounters merge conflicts, replacing the previous 200 response. \[CODE-5104]
* Improved Git LFS upload performance by streaming file content during OID calculation, reducing memory usage for large file uploads. \[CODE-4993]
* Fixed an issue where listing repositories in a forked repo's space would fail if the upstream (source) repository had been deleted. \[CODE-5090]
* Fixed fork-related API endpoint definitions in the OpenAPI specification to return correct status codes. \[CODE-4616]
* Fixed an issue where push rules based on repository settings incorrectly evaluated critical violation decisions. \[CODE-5067]
**Breaking Changes**
**GitOps**
This release includes an Argo CD version bump with the following breaking changes. Review these carefully before upgrading:
* **ApplicationSet CRD size limitation:** The ApplicationSet CRD layout now exceeds the Kubernetes client-side apply size limit. You must perform upgrades using Server-Side Apply (SSA) (for example, `kubectl apply --server-side --force-conflicts`) or via a self-managed Argo CD Application with `ServerSideApply=true`. Custom field modifications in manifests may be overwritten when using SSA.
* **Hydrator behavior change:** The source hydrator now tracks hydrated state using git notes rather than hydrated commits, improving repository cleanliness and reducing unnecessary commits.
* **Settings API change:** Anonymous calls to the Settings API return fewer fields (for example, sensitive data like `resourceOverrides` is hidden).
* **New environment variable:** `ARGOCD_K8S_SERVER_SIDE_TIMEOUT` has been introduced to control Kubernetes server-side API request timeouts separately from TCP timeouts.
* **Deprecated flags:** The `--self-heal-backoff-cooldown-seconds` flag in the application controller has been deprecated and will be removed in a future release.
**Upgrade instructions** Follow the official upgrade guide when applying this version bump.
For non-HA environments:
```bash
kubectl apply -n argocd --server-side --force-conflicts \
-f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.0/manifests/install.yaml
```
For HA environments:
```bash
kubectl apply -n argocd --server-side --force-conflicts \
-f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.0/manifests/ha/install.yaml
```
If you have an Argo CD Application that manages Argo CD itself, ensure it includes Server-Side Apply in the sync options:
```yaml
syncPolicy:
syncOptions:
- ServerSideApply=true
```
For the full upgrade guide, go to [Upgrading from v3.2 to v3.3](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/3.2-3.3/).
### Version 0.38.1
March 14, 2026, Version 0.38.1
March 14, 2026
{% hint style="danger" %}
**Breaking changes notice**
SMP upgrades from **0.35.x to 0.36.x or later** caused silent database index corruption, which resulted in issues in STO pipelines. This happened because the PostgreSQL container image changed its base OS from Debian to Alpine Linux, which introduced different text sorting behavior in the underlying libraries and broke existing database indexes.
This issue is fixed in the latest version of SMP. If you upgraded to **0.36.x or later**, upgrade to the latest release to resolve the issue.
Affected versions: 0.36.x, 0.37.x, 0.38.x
**Note:** This only affects customers using the internal PostgreSQL deployment. Customers using external PostgreSQL are not affected.
{% endhint %}
{% hint style="info" %}
**Important:** [**Security advisory 0.38.0**](https://github.com/iKettles/harness-gitbook/tree/main/SMP-ADVISORY/SECURITY-ADVISORY-0.38.0.HTML)
{% endhint %}
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.38.1](https://github.com/harness/helm-charts/releases/tag/harness-0.38.1) |
| Air Gap Bundle | [0.38.1](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.38.1) |
| Access Control | 1.208.0 |
| Anomaly Detection | 1.22.0 |
| Audit Event Streaming | 1.77.0 |
| Batch Processing | 1.78.5 |
| Bootstrap | 1.71.1 |
| CE Nextgen | 1.80.6 |
| Change Data Capture | 1.51.2 |
| Chaos CRD | 1.73.0 |
| Chaos K8s IFS | 1.76.0 |
| Chaos Linux IFC | 1.76.0 |
| Chaos Linux IFS | 1.76.1 |
| Chaos Manager | 1.76.2 |
| Chaos Machine IFS | 1.76.0 |
| Chaos Machine IFC | 1.76.0 |
| Chaos Web | 1.76.2 |
| CI Manager | 1.123.5 |
| Cloud Info | 1.14.4 |
| CV Nextgen | 1.57.2 |
| DB Devops Service | 1.81.0 |
| Debezium Service | 1.25.1 |
| Delegate Proxy | 1.9.0 |
| Delegate Version (Immutable) | 26.02.88404 |
| Event Service | 1.15.2 |
| Feature Flag Pushpin Service | 1.1138.0 |
| Feature Flag Service | 1.1160.0 |
| Gateway Service | 1.62.5 |
| GitOps Service | 1.51.3 |
| Harness Manager | 1.131.5 |
| LE Nextgen | 1.13.1 |
| Log Service | 1.41.1 |
| Looker | 1.10.1 |
| Next Gen UI | 1.119.5 |
| NG Auth UI | 1.38.2 |
| NG CE UI | 1.76.3 |
| NG Custom Dashboards | 1.102.0 |
| NG Dashboard Aggregator | 1.96.0 |
| NG Manager | 1.132.4 |
| Pipeline Service | 1.172.8 |
| Platform Service | 1.110.0 |
| Policy Management | 1.38.1 |
| SCM Service | 1.45.1 |
| Service Discovery Manager | 0.56.0 |
| SRM UI | 1.16.2 |
| SSCA Manager | 1.52.13 |
| SSCA UI | 0.39.2 |
| STO Core | 1.182.0 |
| Telescopes | 1.7.2 |
| Template Service | 1.134.0 |
| Test Intelligence Service | 1.61.3 |
| Queue Service | 1.9.0 |
| Code API | 1.76.1 |
| Code GitRPC | 1.76.0 |
| Code GitHA | 1.76.0 |
| Code Search | 1.76.0 |
| IAC Server | 1.329.0 |
| IACM Manager | 1.134.0 |
| IDP Service | 1.37.5 |
| IDP Admin | 1.37.2 |
| IDP App UI | 1.37.9 |
| Ticket Service | 1.8.0 |
| Component Service | 1.7.1 |
| Component Analysis Service | 1.2.1 |
| UI | 1.32.4 |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Harness Platform**
* Fixed database migration issues that caused incremental sync failures for the `stage_execution_summary_ci` table due to missing TimescaleDB columns and ti-service attempting to rerun migrations even though they were already applied. \[PL-69377]
* Updated the PostgreSQL container image base OS from Alpine Linux back to Debian. \[PL-69793]
### Version 0.37.2
March 13, 2026, Version 0.37.2
March 13, 2026
{% hint style="danger" %}
**Breaking changes notice**
SMP upgrades from **0.35.x to 0.36.x or later** caused silent database index corruption, which resulted in issues in STO pipelines. This happened because the PostgreSQL container image changed its base OS from Debian to Alpine Linux, which introduced different text sorting behavior in the underlying libraries and broke existing database indexes.
This issue is fixed in the latest version of SMP. If you upgraded to **0.36.x or later**, upgrade to the latest release to resolve the issue.
Affected versions: 0.36.x, 0.37.x, 0.38.x
**Note:** This only affects customers using the internal PostgreSQL deployment. Customers using external PostgreSQL are not affected.
{% endhint %}
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.37.2](https://github.com/harness/helm-charts/releases/tag/harness-0.37.2) |
| Air Gap Bundle | [0.37.2](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.37.2) |
| Access Control | 1.195.0 |
| Anomaly Detection | 1.21.0 |
| Audit Event Streaming | 1.74.0 |
| Batch Processing | 1.77.14 |
| Bootstrap | 1.65.2 |
| CE Nextgen | 1.79.22 |
| Change Data Capture | 1.49.7 |
| Chaos CRD | 1.73.0 |
| Chaos K8s IFS | 1.74.0 |
| Chaos Linux IFC | 1.74.0 |
| Chaos Linux IFS | 1.74.0 |
| Chaos Manager | 1.74.4 |
| Chaos Machine IFS | 1.74.0 |
| Chaos Machine IFC | 1.74.0 |
| Chaos Web | 1.74.1 |
| CI Manager | 1.120.6 |
| Cloud Info | 1.13.2 |
| CV Nextgen | 1.55.1 |
| DB Devops Service | 1.78.3 |
| Debezium Service | 1.25.1 |
| Delegate Proxy | 1.6.0 |
| Delegate Version (Immutable) | 26.02.88404 |
| Event Service | 1.14.1 |
| Feature Flag Pushpin Service | 1.1135.0 |
| Feature Flag Service | 1.1154.1 |
| Gateway Service | 1.60.3 |
| GitOps Service | 1.50.4 |
| Harness Manager | 1.128.4 |
| LE Nextgen | 1.13.0 |
| Log Service | 1.41.0 |
| Looker | 1.8.9 |
| Next Gen UI | 1.116.11 |
| NG Auth UI | 1.38.2 |
| NG CE UI | 1.75.7 |
| NG Custom Dashboards | 1.98.0 |
| NG Dashboard Aggregator | 1.93.0 |
| NG Manager | 1.129.7 |
| Pipeline Service | 1.169.5 |
| Platform Service | 1.107.0 |
| Policy Management | 1.36.5 |
| SCM Service | 1.44.0 |
| Service Discovery Manager | 0.54.0 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.50.14 |
| SSCA UI | 0.38.5 |
| STO Core | 1.180.4 |
| Telescopes | 1.6.0 |
| Template Service | 1.131.3 |
| Test Intelligence Service | 1.60.5 |
| Queue Service | 1.8.1 |
| Code API | 1.73.3 |
| Code GitRPC | 1.73.1 |
| Code GitHA | 1.73.1 |
| Code Search | 1.73.1 |
| IAC Server | 1.302.0 |
| IACM Manager | 1.128.1 |
| IDP Service | 1.36.15 |
| IDP Admin | 1.36.3 |
| IDP App UI | 1.36.11 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.37.2/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.2/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.2/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.2/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.2/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.2/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.2/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.2/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.2/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.2/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.2/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.2/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.2/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.2/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.2/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.2/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.2/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.2/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.2/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.2/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Harness Platform**
* Fixed database migration issues that caused incremental sync failures for the `stage_execution_summary_ci` table due to missing TimescaleDB columns and ti-service attempting to rerun migrations even though they were already applied. \[PL-69377]
* Updated the PostgreSQL container image base OS from Alpine Linux back to Debian. \[PL-69793]
### Version 0.36.4
March 13, 2026, Version 0.36.4
March 13, 2026
{% hint style="danger" %}
**Breaking changes notice**
SMP upgrades from **0.35.x to 0.36.x or later** caused silent database index corruption, which resulted in issues in STO pipelines. This happened because the PostgreSQL container image changed its base OS from Debian to Alpine Linux, which introduced different text sorting behavior in the underlying libraries and broke existing database indexes.
This issue is fixed in the latest version of SMP. If you upgraded to **0.36.x or later**, upgrade to the latest release to resolve the issue.
Affected versions: 0.36.x, 0.37.x, 0.38.x
**Note:** This only affects customers using the internal PostgreSQL deployment. Customers using external PostgreSQL are not affected.
{% endhint %}
{% hint style="info" %}
**Important**
The migration from TimescaleDB to PostgreSQL is automatically triggered as part of the Harness SMP upgrade to version 0.36.x. Before you upgrade to SMP 0.36.x, you must be running version 0.35.x. Learn more about the migration in the [migration guide](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/migrate-timescaledb-to-postgresql.md).
{% endhint %}
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.36.4](https://github.com/harness/helm-charts/releases/tag/harness-0.36.4) |
| Air Gap Bundle | [0.36.4](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.36.4) |
| Access Control | 1.184.0 |
| Anomaly Detection | 1.20.0 |
| Audit Event Streaming | 1.73.0 |
| Batch Processing | 1.75.18 |
| Bootstrap | 1.64.1 |
| CE Nextgen | 1.77.11 |
| Change Data Capture | 1.49.4 |
| Chaos CRD | 1.72.0 |
| Chaos K8s IFS | 1.72.5 |
| Chaos Linux IFC | 1.72.2 |
| Chaos Linux IFS | 1.72.2 |
| Chaos Manager | 1.72.18 |
| Chaos Machine IFS | 1.72.3 |
| Chaos Machine IFC | 1.72.2 |
| Chaos Web | 1.72.10 |
| CI Manager | 1.119.11 |
| Cloud Info | 1.13.2 |
| CV Nextgen | 1.53.1 |
| DB Devops Service | 1.76.2 |
| Debezium Service | 1.25.0 |
| Delegate Proxy | 1.6.0 |
| Delegate Version (Immutable) | 26.01.88201 |
| Event Service | 1.14.0 |
| Feature Flag Pushpin Service | 1.1132.0 |
| Feature Flag Service | 1.1148.0 |
| Gateway Service | 1.59.2 |
| GitOps Service | 1.49.1 |
| Harness Manager | 1.127.0 |
| LE Nextgen | 1.12.2 |
| Log Service | 1.38.8 |
| Looker | 1.8.9 |
| Next Gen UI | 1.114.2 |
| NG Auth UI | 1.37.4 |
| NG CE UI | 1.73.7 |
| NG Custom Dashboards | 1.98.0 |
| NG Dashboard Aggregator | 1.92.0 |
| NG Manager | 1.128.4 |
| Pipeline Service | 1.168.5 |
| Platform Service | 1.106.3 |
| Policy Management | 1.35.6 |
| SCM Service | 1.43.0 |
| Service Discovery Manager | 0.52.3 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.48.32 |
| SSCA UI | 0.37.9 |
| STO Core | 1.175.7 |
| Telescopes | 1.6.0 |
| Template Service | 1.130.0 |
| Test Intelligence Service | 1.60.4 |
| Queue Service | 1.8.0 |
| Code API | 1.73.2 |
| Code GitRPC | 1.73.1 |
| Code GitHA | 1.73.1 |
| Code Search | 1.73.1 |
| IAC Server | 1.296.0 |
| IACM Manager | 1.125.0 |
| IDP Service | 1.36.9 |
| IDP Admin | 1.36.2 |
| IDP App UI | 1.36.8 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.36.4/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.4/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.4/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.4/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.4/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.4/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.4/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.4/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.4/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.4/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.4/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.4/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.4/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.4/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.4/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.4/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.4/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.4/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.4/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.4/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Harness Platform**
* Fixed database migration issues that caused incremental sync failures for the `stage_execution_summary_ci` table due to missing TimescaleDB columns and ti-service attempting to rerun migrations even though they were already applied. \[PL-69377]
* Updated the PostgreSQL container image base OS from Alpine Linux back to Debian. \[PL-69793]
### Version 0.37.1
March 11, 2026, Version 0.37.1
March 11, 2026
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.37.1](https://github.com/harness/helm-charts/releases/tag/harness-0.37.1) |
| Air Gap Bundle | [0.37.1](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.37.1) |
| Access Control | 1.195.0 |
| Anomaly Detection | 1.21.0 |
| Audit Event Streaming | 1.74.0 |
| Batch Processing | 1.77.14 |
| Bootstrap | 1.65.0 |
| CE Nextgen | 1.79.22 |
| Change Data Capture | 1.49.7 |
| Chaos CRD | 1.73.0 |
| Chaos K8s IFS | 1.74.0 |
| Chaos Linux IFC | 1.74.0 |
| Chaos Linux IFS | 1.74.0 |
| Chaos Manager | 1.74.4 |
| Chaos Machine IFS | 1.74.0 |
| Chaos Machine IFC | 1.74.0 |
| Chaos Web | 1.74.1 |
| CI Manager | 1.120.5 |
| Cloud Info | 1.13.2 |
| CV Nextgen | 1.55.1 |
| DB Devops Service | 1.78.3 |
| Debezium Service | 1.25.1 |
| Delegate Proxy | 1.6.0 |
| Delegate Version (Immutable) | 26.02.88404 |
| Event Service | 1.14.1 |
| Feature Flag Pushpin Service | 1.1135.0 |
| Feature Flag Service | 1.1154.1 |
| Gateway Service | 1.60.3 |
| GitOps Service | 1.50.4 |
| Harness Manager | 1.128.4 |
| LE Nextgen | 1.13.0 |
| Log Service | 1.41.0 |
| Looker | 1.8.9 |
| Next Gen UI | 1.116.11 |
| NG Auth UI | 1.38.2 |
| NG CE UI | 1.75.7 |
| NG Custom Dashboards | 1.98.0 |
| NG Dashboard Aggregator | 1.93.0 |
| NG Manager | 1.129.7 |
| Pipeline Service | 1.169.5 |
| Platform Service | 1.107.0 |
| Policy Management | 1.36.5 |
| SCM Service | 1.44.0 |
| Service Discovery Manager | 0.54.0 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.50.14 |
| SSCA UI | 0.38.5 |
| STO Core | 1.180.4 |
| Telescopes | 1.6.0 |
| Template Service | 1.131.3 |
| Test Intelligence Service | 1.60.5 |
| Queue Service | 1.8.1 |
| Code API | 1.73.3 |
| Code GitRPC | 1.73.1 |
| Code GitHA | 1.73.1 |
| Code Search | 1.73.1 |
| IAC Server | 1.302.0 |
| IACM Manager | 1.128.1 |
| IDP Service | 1.36.15 |
| IDP Admin | 1.36.3 |
| IDP App UI | 1.36.11 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.37.1/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.1/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.1/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.1/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.1/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.1/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.1/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.1/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.1/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.1/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.1/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.1/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.1/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.1/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.1/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.1/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.1/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.1/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.1/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.1/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Harness Platform**
* Fixed an issue where the initial setup for TimescaleDB was not being performed for external PostgreSQL instances. A dedicated pre-install job has been added to handle this setup automatically. \[PL-69473]
### Version 0.38.0
March 08, 2026, Version 0.38.0
March 08, 2026
{% hint style="info" %}
**Important:** [**Security advisory 0.38.0**](https://github.com/iKettles/harness-gitbook/tree/main/SMP-ADVISORY/SECURITY-ADVISORY-0.38.0.HTML)
{% endhint %}
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.38.0](https://github.com/harness/helm-charts/releases/tag/harness-0.38.0) |
| Air Gap Bundle | [0.38.0](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.38.0) |
| Access Control | 1.208.0 |
| Anomaly Detection | 1.22.0 |
| Audit Event Streaming | 1.77.0 |
| Batch Processing | 1.78.5 |
| Bootstrap | 1.71.0 |
| CE Nextgen | 1.80.6 |
| Change Data Capture | 1.51.2 |
| Chaos CRD | 1.73.0 |
| Chaos K8s IFS | 1.76.0 |
| Chaos Linux IFC | 1.76.0 |
| Chaos Linux IFS | 1.76.1 |
| Chaos Manager | 1.76.2 |
| Chaos Machine IFS | 1.76.0 |
| Chaos Machine IFC | 1.76.0 |
| Chaos Web | 1.76.2 |
| CI Manager | 1.123.4 |
| Cloud Info | 1.14.4 |
| CV Nextgen | 1.57.2 |
| DB Devops Service | 1.81.0 |
| Debezium Service | 1.25.1 |
| Delegate Proxy | 1.9.0 |
| Delegate Version (Immutable) | 26.02.88404 |
| Event Service | 1.15.2 |
| Feature Flag Pushpin Service | 1.1138.0 |
| Feature Flag Service | 1.1160.0 |
| Gateway Service | 1.62.5 |
| GitOps Service | 1.51.3 |
| Harness Manager | 1.131.5 |
| LE Nextgen | 1.13.1 |
| Log Service | 1.41.1 |
| Looker | 1.10.1 |
| Next Gen UI | 1.119.5 |
| NG Auth UI | 1.38.2 |
| NG CE UI | 1.76.3 |
| NG Custom Dashboards | 1.102.0 |
| NG Dashboard Aggregator | 1.96.0 |
| NG Manager | 1.132.4 |
| Pipeline Service | 1.172.8 |
| Platform Service | 1.110.0 |
| Policy Management | 1.38.1 |
| SCM Service | 1.45.1 |
| Service Discovery Manager | 0.56.0 |
| SRM UI | 1.16.2 |
| SSCA Manager | 1.52.13 |
| SSCA UI | 0.39.2 |
| STO Core | 1.182.0 |
| Telescopes | 1.7.2 |
| Template Service | 1.134.0 |
| Test Intelligence Service | 1.61.3 |
| Queue Service | 1.9.0 |
| Code API | 1.76.1 |
| Code GitRPC | 1.76.0 |
| Code GitHA | 1.76.0 |
| Code Search | 1.76.0 |
| IAC Server | 1.329.0 |
| IACM Manager | 1.134.0 |
| IDP Service | 1.37.5 |
| IDP Admin | 1.37.2 |
| IDP App UI | 1.37.9 |
| Ticket Service | 1.8.0 |
| Component Service | 1.7.1 |
| Component Analysis Service | 1.2.1 |
| UI | 1.32.4 |
**Air-gap bundle download method**
{% hint style="info" %}
**Note on new airgap bundle structure**
Starting with version 0.38.x, the airgap bundle structure has been redesigned. Components are now grouped into core modules and execution components, allowing you to download exactly what you need using our new interactive scripts.
{% endhint %}
For a comprehensive guide on installing Harness Self-Managed Enterprise Edition in an air-gapped environment, see the **Version 0.38.x and later** tab in the [Install in an air-gapped environment](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/helm-installation/install-in-an-air-gapped-environment.md) documentation. It covers downloading airgap bundles using interactive scripts (or alternative methods like `gsutil` and `curl`), organizing the core modules and execution components, and securely pushing them to your private container registry.
**Fixed issues**
**Harness Platform**
* Resolved an issue where the `listPrincipalsWithAccess` API returned an exception due to stale entries in the database by adding checks to ignore those entries, ensuring the API now returns the expected response. \[PL-68559]
* Fixed the permission check to ensure it is controlled behind a feature flag. \[PL-68252]
* Replaced `InvalidCredentialsException` with a more generic `WingsException` when a user does not exist, preventing attackers from inferring valid usernames from error messages. \[PL-65508]
**GitOps**
* Fixed an issue where deleting an ApplicationSet from the resource tree context menu incorrectly called the delete application API instead of the delete ApplicationSet API, causing the deletion to fail. \[CDS-115910]
* Fixed an issue where ApplicationSets could not be deleted if the associated agent no longer existed, returning a Permission denied: agent identifier incorrect or agent does not exist error. Cleanup of ApplicationSets now works correctly when deleting account-level agents. \[CDS-118171]
**Continuous Delivery**
* Fixed an issue where Harness dashboards failed to load data, returning a PostgreSQL error when attempting to retrieve dashboard information. \[CDS-117508, ZD-97705]
* Fixed an issue where saving a freeze window with email notifications configured in delegate mode failed with a YAML validation error. The UI-generated YAML for delegate selectors was incorrectly formatted, causing the save operation to fail even though no manual YAML edits were made. \[CDS-118870, ZD-104033]
* Fixed an issue where the **Triggered by** column in the pipeline executions list displayed a generic `Webhook()` label instead of the configured trigger name after adding a CI stage to an existing CD pipeline. The trigger name now displays consistently regardless of the stage types present in the pipeline. \[PIPE-31572, ZD-100883]
* Fixed an issue where `send status back to git` does not publish commit status when the pipeline is triggered via the Harness code trigger in custom stages. Status handling was missing in the Harness code repository because it lacks a connectorRef. Added proper handling for the code repository. \[PIPE-31736, ZD-100597]
* Fixed an issue where executing a pipeline directly from an input set failed with a validation error for a required variable, even though the variable value was already populated. This was caused by an empty pipeline identifier being sent in the input set API call. \[PIPE-32073, ZD-102863]
* Fixed an issue where the **Updated Time** column on the pipeline template's referencing entities tab displayed time in 24-hour format with an incorrect AM/PM suffix (for example, `14:11 PM`). The timestamp now uses a consistent and valid time format. \[PIPE-32114, ZD-104150]
* Fixed an issue where the **Start** button in the Infra Workspace Template creation flow was unresponsive on prod2, preventing users from creating new templates. This occurred even though the workspace templates feature was GA and enabled for the account. \[PIPE-32258, ZD-103995]
* Fixed a race condition where the built-in expression `<+project.identifier>` failed to resolve in time during parallel HTTP steps, causing a 400 error. The expression now resolves consistently across all parallel steps during pipeline execution. \[PIPE-32334, ZD-102702]
* Fixed an issue where the Service step in pipelines took significantly longer than expected to complete, sometimes exceeding five minutes for operations that typically finish in under 15 seconds. This inconsistent delay affected multiple services across different projects and produced no logs during the wait period. The root cause was in the wait-notify mechanism, which has been optimized for scenarios involving more than one `notifyId`. \[PIPE-31895, ZD-100546]
* Fixed an issue where the *Enforce OAuth For Commits* setting incorrectly blocked pipeline saves for users with Bitbucket OAuth configured through a custom provider (Bitbucket Server). The enforce OAuth flow relied on the connector type (`BITBUCKET`) to fetch user OAuth profiles, but on-prem setups registered profiles as `BITBUCKET_SERVER`, preventing the correct profile from being matched. Users with Bitbucket OAuth configured can now successfully save pipelines when *Enforce OAuth For Commits* is enabled. \[PIPE-31586, ZD-95814, ZD-100787]
* Fixed an issue where Harness ASG deployments did not fail when an AWS instance refresh was manually moved to a rollback state (e.g., `RollbackInProgress`) from the AWS Console. Although Harness detected the rollback state in the execution logs, it continued the deployment instead of treating it as a failure condition. Harness now correctly fails the deploy step when an externally initiated rollback is detected during an instance refresh. \[CDS-118529, ZD-101769]
* Fixed an issue where the Jenkins step stopped working after upgrading to 2.516.1.28665. Added query params (tree) to Jenkins API calls to unblock API calls in the latest CloudBees Jenkins integration. \[CDS-117294, ZD-99947]
* Fixed an issue where the WinRM service artifact source displayed every artifact as a Docker artifact in the UI. The artifact source template now shows the actual artifact type in the icon if the user has not provided a custom icon. \[CDS-117751, ZD-101243]
* Fixed an issue where the tag dropdown was not populating with any tags generated in the last day. \[CDS-117808, ZD-101214]
* Fixed an issue where Google Cloud Run deployments did not work on rerun when a service was scaled to zero. \[CDS-118269]
* Fixed an issue where bulk reconciliation of pipelines referencing shared templates and stored in remote repositories could fail. The error occurred when the system incorrectly attempted to access a *HARNESS* branch in the remote repository. Improved logging has been added to provide better visibility into the Git branch and repository being accessed during reconciliation. \[PIPE-31123, ZD-98783]
* Fixed an issue where the account-level *Skip Git Webhook Registration* setting incorrectly restricted administrators from enabling or disabling Git webhooks. Administrators can now manage all Git webhooks, regardless of the *Skip Git Webhook Registration* setting, respecting their administrative permissions. \[PIPE-31922, ZD-102235]
* Fixed an issue where the log viewer would unexpectedly jump to the bottom, interrupting users while reviewing logs during pipeline executions. The log viewer now maintains the user's scroll position when manually scrolling or when a log section is collapsed, preventing unwanted auto-scrolling behavior. \[PIPE-32017, ZD-101156]
**Chaos Engineering**
* Fixed the issue with the load task stuck in the Pending state, and the infrastructure not receiving the load task request \[CHAOS-11121]
**Continuous Integration**
* Build and Push to Azure Container Registry (ACR) steps now support authentication using a delegate-based User Assigned Managed Identity (Azure Workload Identity). \[CI-20436]
* Introduced Save Cache to Azure and Restore Cache to Azure pipeline steps (YAML-only) to enable artifact caching with Azure Blob Storage using Microsoft identity provider authentication. \[CI-19778]
* Introduced branch-based version counters, allowing build numbering to track independently per branch. \[CI-20577]
* Container-based step groups now support real-time step status updates during execution. \[CI-21113]
* Kubernetes builds now support additional JWT claims when integrating with HashiCorp Vault for secret management. This feature is behind the feature flag `PL_ENABLE_GRANULAR_CLAIMS_FOR_VAULT`. \[CI-20662, CI-20458]
**Cloud Cost Management**
* We have fixed the subscription year calculation logic in "Subscription Details" to ensure the current year is used only if the subscription date has already passed; otherwise, the previous year is applied.\[CCM-29620]
**New features and enhancements**
**Harness Platform**
* Fixed **CVE-2026-24049** by pinning the **Jaroco** dependency in Python. \[PL-68039]
**GitOps**
**Breaking changes and upgrade considerations**
This release includes an Argo CD version bump with the following breaking changes. Review these carefully before upgrading:
* **ApplicationSet CRD size limitation:** The ApplicationSet CRD layout now exceeds the Kubernetes client-side apply size limit. You must perform upgrades using Server-Side Apply (SSA) (for example, `kubectl apply --server-side --force-conflicts`) or via a self-managed Argo CD Application with `ServerSideApply=true`. Custom field modifications in manifests may be overwritten when using SSA.
* **Hydrator behavior change:** The source hydrator now tracks hydrated state using git notes rather than hydrated commits, improving repository cleanliness and reducing unnecessary commits.
* **Settings API change:** Anonymous calls to the Settings API return fewer fields (for example, sensitive data like `resourceOverrides` is hidden).
* **New environment variable:** `ARGOCD_K8S_SERVER_SIDE_TIMEOUT` has been introduced to control Kubernetes server-side API request timeouts separately from TCP timeouts.
* **Deprecated flags:** The `--self-heal-backoff-cooldown-seconds` flag in the application controller has been deprecated and will be removed in a future release.
**Upgrade instructions** Follow the official upgrade guide when applying this version bump.
For non-HA environments:
```bash
kubectl apply -n argocd --server-side --force-conflicts \
-f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.0/manifests/install.yaml
```
For HA environments:
```bash
kubectl apply -n argocd --server-side --force-conflicts \
-f https://raw.githubusercontent.com/argoproj/argo-cd/v3.3.0/manifests/ha/install.yaml
```
If you have an Argo CD Application that manages Argo CD itself, ensure it includes Server-Side Apply in the sync options:
```yaml
syncPolicy:
syncOptions:
- ServerSideApply=true
```
For the full upgrade guide, go to [Upgrading from v3.2 to v3.3](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/3.2-3.3/).
**Continuous Delivery**
* **Google MIG Blue-Green deployment updates**: All Blue-Green deployment plugin images have been updated from `0.0.1` to `0.1.0`. This release includes the following changes:
* The `targetSize` field in the Blue-Green Deploy step no longer defaults to `1`. If not specified, Harness automatically fetches the current instance count from the stable MIG and applies it to the stage MIG. If an autoscaler is configured, the autoscaler controls the final instance count. Existing pipelines with an explicit `targetSize` value are not affected.
* A new `downsizeOldMig` flag is available in the Google MIG Traffic Shift step. When enabled, Harness scales the old MIG to zero instances after the label swap at 100% traffic shift, optimizing costs by removing unused instances. Associated autoscalers are managed automatically during the downsize operation.
* The `GoogleMigBlueGreenDeployOutcome.rollbackData.deploymentMetadata.stage.instanceTemplate` output now refers to the pre-deploy version of the instance template instead of the deployed one. To reference the currently deployed instance template, use `GoogleMigBlueGreenDeployOutcome.stageTemplate`.
For more details, go to [Blue-Green Deployment for MIG](/continuous-delivery/use-continuous-delivery/deploy-services-on-different-platforms/google-cloud-functions/mig/mig-blue-green-deployment.md).
**Continuous Integration**
* Improved GitLab merge request status updates so pipeline status now reflects execution progress in real time instead of only after stage completion. \[CI-20533, ZD-102326]
* Fixed an issue where pipeline re-runs could fail when delegate selectors were used with codebase tasks (SCM\_GIT\_REF\_TASK). \[CI-20360, ZD-101102]
* Addressed a security vulnerability in the cache-service image by updating the crypto/x509 package. \[CI-20463]
* Resolved an issue with Docker Buildx Bake environment variable handling in Kubernetes and self-hosted builds. \[CI-20510, ZD-101772]
* Improved Test Intelligence security by upgrading the underlying runtime to address known vulnerabilities. \[CI-20791]
* Improved Artifactory plugin security by upgrading the underlying runtime to address known vulnerabilities. \[CI-20916]
* Resolved an issue with the `+codebase.repoUrl` expression returning incorrect URLs in Azure Repos commit-based builds. \[CI-20559, ZD-102404]
* Improved handling of multiline-secrets used in Run step, when running on Kubernetes build infrastructure. \[CI-20498, ZD-102195]
* Improved Build and Push step error messages to display the full Dockerfile path when the file is not found. \[CI-14073]
* Improved error logging when the Initialize step fails due to secret fetch errors, providing more actionable details in the logs. \[CI-20761]
**Chaos Engineering**
* Migrated Action and Probe Variables to Inputs under Chaos Studio \[CHAOS-11103, CHAOS-11102]
* Added egress rules support for ecs network restrict fault for specific rule \[CHAOS-11101]
* Added linux chaos faults \[network, API, JVM, process, service, DNS, disk fill] in machine chaos and its templates in hub \[CHAOS-11081, CHAOS-11079, CHAOS-11078, CHAOS-11038]
* Updated ECS Fargate CPU/Memory Sidecar to Use Multi-Arch DDCR Image \[CHAOS-10978]
* Added Disaster Recovery \[DR] component support with new entity, APIs \[DRTest run, getVariables, DRComponentNodes CRUD], and DDCR execution enhancements \[CHAOS-10893, CHAOS-10887, CHAOS-10885, CHAOS-10884]
* Added permission to mitmdump in the install script \[CHAOS-11125]
### Version 0.35.17
March 5, 2026, Version 0.35.17
March 5, 2026
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | ---------------------------------------------------------------------------------------------- |
| Helm Chart | [0.35.17](https://github.com/harness/helm-charts/releases/tag/harness-0.35.17) |
| Air Gap Bundle | [0.35.17](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.35.17) |
| Access Control | 1.168.1 |
| Anomaly Detection | 1.16.3 |
| Audit Event Streaming | 1.66.0 |
| Batch Processing | 1.70.18 |
| Bootstrap | 1.60.0 |
| CE Nextgen | 1.73.8 |
| Change Data Capture | 1.49.8 |
| Chaos CRD | 1.71.0 |
| Chaos K8s IFS | 1.71.0 |
| Chaos Linux IFC | 1.71.0 |
| Chaos Linux IFS | 1.71.0 |
| Chaos Manager | 1.71.3 |
| Chaos Machine IFS | 1.71.0 |
| Chaos Machine IFC | 1.71.0 |
| Chaos Web | 1.71.6 |
| CI Manager | 1.112.2 |
| Cloud Info | 1.13.1 |
| CV Nextgen | 1.49.4 |
| DB Devops Service | 1.70.0 |
| Debezium Service | 1.25.0 |
| Delegate Proxy | 1.4.0 |
| Delegate Version | 25.11.87302 |
| Event Service | 1.13.1 |
| Feature Flag Pushpin Service | 1.1128.0 |
| Feature Flag Service | 1.1145.0 |
| Gateway Service | 1.58.2 |
| GitOps Service | 1.46.6 |
| Harness Manager | 1.120.4 |
| LE Nextgen | 1.11.1 |
| Log Service | 1.36.2 |
| Looker | 1.8.12 |
| Next Gen UI | 1.107.2 |
| NG Auth UI | 1.37.3 |
| NG CE UI | 1.69.8 |
| NG Custom Dashboards | 1.97.0 |
| NG Dashboard Aggregator | 1.85.0 |
| NG Manager | 1.121.5 |
| Pipeline Service | 1.161.5 |
| Platform Service | 1.99.0 |
| Policy Management | 1.31.3 |
| SCM Service | 1.42.1 |
| Service Discovery Manager | 0.51.0 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.46.13 |
| SSCA UI | 0.36.5 |
| STO Core | 1.170.6 |
| Ticket Service | 1.2.2 |
| Telescopes | 1.5.0 |
| Template Service | 1.123.0 |
| Test Intelligence Service | 1.58.0 |
| Queue Service | 1.7.4 |
| Code API | 1.70.2 |
| Code GitRPC | 1.70.1 |
| Code GitHA | 1.70.0 |
| Code Search | 1.70.1 |
| IAC Server | 1.283.4 |
| IACM Manager | 1.122.2 |
| IDP Service | 1.34.15 |
| IDP Admin | 1.34.2 |
| IDP App UI | 1.34.5 |
| UI | 1.32.2 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.35.17/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.17/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.17/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.17/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.17/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.17/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.17/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.17/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.17/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.17/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.17/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.17/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.17/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.17/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.17/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.17/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.17/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.17/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.17/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.17/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Continuous Delivery**
* Add support for ServiceNow step execution data and project tags in Harness dashboards. \[CDS-119457]
### Version 0.36.3
March 03, 2026, Version 0.36.3
March 03, 2026
{% hint style="info" %}
**Important**
The migration from TimescaleDB to PostgreSQL is automatically triggered as part of the Harness SMP upgrade to version 0.36.x. Before you upgrade to SMP 0.36.x, you must be running version 0.35.x. Learn more about the migration in the [migration guide](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/migrate-timescaledb-to-postgresql.md).
{% endhint %}
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.36.3](https://github.com/harness/helm-charts/releases/tag/harness-0.36.3) |
| Air Gap Bundle | [0.36.3](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.36.3) |
| Access Control | 1.184.0 |
| Anomaly Detection | 1.20.0 |
| Audit Event Streaming | 1.73.0 |
| Batch Processing | 1.75.18 |
| Bootstrap | 1.64.0 |
| CE Nextgen | 1.77.11 |
| Change Data Capture | 1.49.4 |
| Chaos CRD | 1.72.0 |
| Chaos K8s IFS | 1.72.5 |
| Chaos Linux IFC | 1.72.2 |
| Chaos Linux IFS | 1.72.2 |
| Chaos Manager | 1.72.18 |
| Chaos Machine IFS | 1.72.3 |
| Chaos Machine IFC | 1.72.2 |
| Chaos Web | 1.72.10 |
| CI Manager | 1.119.8 |
| Cloud Info | 1.13.2 |
| CV Nextgen | 1.53.1 |
| DB Devops Service | 1.76.2 |
| Debezium Service | 1.25.0 |
| Delegate Proxy | 1.6.0 |
| Delegate Version (Immutable) | 26.01.88201 |
| Event Service | 1.14.0 |
| Feature Flag Pushpin Service | 1.1132.0 |
| Feature Flag Service | 1.1148.0 |
| Gateway Service | 1.59.2 |
| GitOps Service | 1.49.1 |
| Harness Manager | 1.127.0 |
| LE Nextgen | 1.12.2 |
| Log Service | 1.38.8 |
| Looker | 1.8.9 |
| Next Gen UI | 1.114.2 |
| NG Auth UI | 1.37.4 |
| NG CE UI | 1.73.7 |
| NG Custom Dashboards | 1.98.0 |
| NG Dashboard Aggregator | 1.92.0 |
| NG Manager | 1.128.4 |
| Pipeline Service | 1.168.5 |
| Platform Service | 1.106.3 |
| Policy Management | 1.35.6 |
| SCM Service | 1.43.0 |
| Service Discovery Manager | 0.52.3 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.48.32 |
| SSCA UI | 0.37.9 |
| STO Core | 1.175.7 |
| Telescopes | 1.6.0 |
| Template Service | 1.130.0 |
| Test Intelligence Service | 1.60.4 |
| Queue Service | 1.8.0 |
| Code API | 1.73.2 |
| Code GitRPC | 1.73.1 |
| Code GitHA | 1.73.1 |
| Code Search | 1.73.1 |
| IAC Server | 1.296.0 |
| IACM Manager | 1.125.0 |
| IDP Service | 1.36.9 |
| IDP Admin | 1.36.2 |
| IDP App UI | 1.36.8 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.36.3/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.3/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.3/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.3/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.3/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.3/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.3/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.3/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.3/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.3/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.3/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.3/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.3/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.3/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.3/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.3/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.3/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.3/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.3/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.3/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Harness Platform**
* Fixed an issue where the storageClassName for the tsdb-to-psql-migrator PVC could not be customized. Users can now configure the storage class for the migrator PVC using `global.storageClass` or `platform.tsdb-to-psql-migrator.persistence.storageClass`. \[PL-69435]
## February 2026
### Version 0.37.0
February 23, 2026, Version 0.37.0
February 23, 2026
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.37.0](https://github.com/harness/helm-charts/releases/tag/harness-0.37.0) |
| Air Gap Bundle | [0.37.0](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.37.0) |
| Access Control | 1.195.0 |
| Anomaly Detection | 1.21.0 |
| Audit Event Streaming | 1.74.0 |
| Batch Processing | 1.77.14 |
| Bootstrap | 1.65.0 |
| CE Nextgen | 1.79.22 |
| Change Data Capture | 1.49.7 |
| Chaos CRD | 1.73.0 |
| Chaos K8s IFS | 1.74.0 |
| Chaos Linux IFC | 1.74.0 |
| Chaos Linux IFS | 1.74.0 |
| Chaos Manager | 1.74.4 |
| Chaos Machine IFS | 1.74.0 |
| Chaos Machine IFC | 1.74.0 |
| Chaos Web | 1.74.1 |
| CI Manager | 1.120.5 |
| Cloud Info | 1.13.2 |
| CV Nextgen | 1.55.1 |
| DB Devops Service | 1.78.3 |
| Debezium Service | 1.25.1 |
| Delegate Proxy | 1.6.0 |
| Delegate Version (Immutable) | 26.02.88404 |
| Event Service | 1.14.1 |
| Feature Flag Pushpin Service | 1.1135.0 |
| Feature Flag Service | 1.1154.1 |
| Gateway Service | 1.60.3 |
| GitOps Service | 1.50.4 |
| Harness Manager | 1.128.4 |
| LE Nextgen | 1.13.0 |
| Log Service | 1.41.0 |
| Looker | 1.8.9 |
| Next Gen UI | 1.116.11 |
| NG Auth UI | 1.38.2 |
| NG CE UI | 1.75.7 |
| NG Custom Dashboards | 1.98.0 |
| NG Dashboard Aggregator | 1.93.0 |
| NG Manager | 1.129.7 |
| Pipeline Service | 1.169.5 |
| Platform Service | 1.107.0 |
| Policy Management | 1.36.5 |
| SCM Service | 1.44.0 |
| Service Discovery Manager | 0.54.0 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.50.14 |
| SSCA UI | 0.38.5 |
| STO Core | 1.180.4 |
| Telescopes | 1.6.0 |
| Template Service | 1.131.3 |
| Test Intelligence Service | 1.60.5 |
| Queue Service | 1.8.1 |
| Code API | 1.73.3 |
| Code GitRPC | 1.73.1 |
| Code GitHA | 1.73.1 |
| Code Search | 1.73.1 |
| IAC Server | 1.302.0 |
| IACM Manager | 1.128.1 |
| IDP Service | 1.36.15 |
| IDP Admin | 1.36.3 |
| IDP App UI | 1.36.11 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.37.0/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.0/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.0/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.0/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.0/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.0/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.0/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.0/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.0/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.37.0/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.0/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.0/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.0/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.0/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.0/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.0/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.0/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.0/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.0/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.37.0/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Continuous Delivery**
* Fixed an issue where delegates encountered 404 errors during deployment, specifically when attempting to locate pods that were no longer available after a canary deployment phase. The system now avoids retrying pod lookups for non-existent pods during the event phase, preventing unnecessary errors and improving deployment stability. \[CDS-117947, ZD-101883]
* Fixed an issue where service tags were failing to load in the pipeline when deploying the SCN-PDM service, preventing users from selecting a tag during deployment. This was due to an error retrieving tags from the artifact repository. A null check was added to return a 400 error rather than a 500 error when encountering an invalid YAML configuration. \[CDS-118014, ZD-101621]
* Fixed an issue where the Service Deployment GitOps step failed when the `agentIdentifier` was not explicitly provided in the GitOps cluster configuration. The step now correctly uses the `agentIdentifier` provided by the environment, restoring previous functionality and preventing errors such as "No G..." when deploying. \[CDS-118321, ZD-102880, ZD-103034]
* Fixed an issue where pipelines were intermittently becoming stuck and failing to proceed, impacting multiple customers. This fix ensures pipelines consistently progress through all stages as configured, resolving instances where execution stalled unexpectedly. \[PIPE-31510, ZD-100762, ZD-100766, ZD-100767, ZD-100768, ZD-100777, ZD-100778, ZD-100785]
* Fixed an issue where validating Bitbucket Server (on-prem) connectors using Access Token authentication failed. This resulted in a "ClassCastException" error. Bitbucket Server connectors can now be successfully validated when using Access Token authentication. \[PIPE-31837, ZD-102262]
**GitOps**
* Fixed an issue in the GitOps UI where ApplicationSet validation was not functioning correctly. Users can no longer create ApplicationSets with invalid YAML configurations, preventing deployment errors. \[CDS-117861, ZD-101656]
* Fixed an issue in the GitOps AppSet details view where the manifest status and progressive sync strategy data were not displayed. Users can now view the correct status and progressive sync strategy information for their AppSets. \[CDS-117172]
**Chaos Engineering**
* Fixed AZ Blackhole target selection to cause chaos on all the derived subnets. \[CHAOS-10982]
* Fixed Experiment Inputs Not Visible in the Chaos Step. \[CHAOS-11001]
**Cloud Cost Management**
* **ClickHouse Upgrade Notice:** This release includes an upgraded ClickHouse version (from 24.12.4 to 25.12.5) that addresses critical CVE vulnerabilities. Due to a breaking change in ClickHouse's default compression behavior, a configuration update is required during installation.
**Required Action** When installing this release, you must add the following configuration to your ClickHouse server settings:
```xml
0
```
This should be added to the ClickHouse server's default profile in the clickhouse-users-config ConfigMap via your Helm values.
**Technical Background:** ClickHouse 25.12 changed the default value of enable\_http\_compression from 0 to 1. Without this setting, the Perspective Grid API and other ClickHouse-dependent features will fail with deserialization errors \[CCM-30208]
* **Standardized Operator Naming:** Reverted the ! IN and ! NULL operators back to the more widely recognized NOT IN and NOT NULL syntax in the Perspective and Cost Category builder for better clarity and consistency. \[CCM-25286]
* **Unallocated Cost Label:** Earlier, when the Hidden strategy was selected for Unallocated Cost in cost categories, we stamped a default label (“Cost categories default”) in the data used by the dashboard. Now, we stamp the Unallocated Cost label irrespective of what strategy is selected. This ensures that the dashboard data remains consistent even if the strategy is changed later. \[CCM-29236]
**New Features and Enhancements**
**GitOps**
* GitOps service now integrates with Open Policy Agent (OPA) for applications, enabling policy-based governance and validation for GitOps applications. \[CDS-117468]
**Chaos Engineering**
* Upgraded base image for Chaos components to RapidFort. \[CHAOS-11004]
**Security Testing Orchestration**
* Added filters to the Exemptions page for Scanner, Target, Exemption Requested By, Approved By, Rejected By, and Exemption Reason, making it easier to narrow down and manage exemption requests. This feature is behind the feature flag `STO_EXEMPTION_FILTER`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[STO-9509, STO-8511]
* Sorting on the Exemptions page now applies across all results instead of only the currently loaded page. \[STO-9509]
### Version 0.36.2
February 19, 2026, Version 0.36.2
February 19, 2026
{% hint style="info" %}
**Important**
The migration from TimescaleDB to PostgreSQL is automatically triggered as part of the Harness SMP upgrade to version 0.36.0. Before you upgrade to SMP 0.36.0, you must be running version 0.35.x. Learn more about the migration in the [migration guide](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/migrate-timescaledb-to-postgresql.md).
{% endhint %}
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.36.2](https://github.com/harness/helm-charts/releases/tag/harness-0.36.2) |
| Air Gap Bundle | [0.36.2](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.36.2) |
| Access Control | 1.184.0 |
| Anomaly Detection | 1.20.0 |
| Audit Event Streaming | 1.73.0 |
| Batch Processing | 1.75.18 |
| Bootstrap | 1.64.0 |
| CE Nextgen | 1.77.11 |
| Change Data Capture | 1.49.4 |
| Chaos CRD | 1.72.0 |
| Chaos K8s IFS | 1.72.5 |
| Chaos Linux IFC | 1.72.2 |
| Chaos Linux IFS | 1.72.2 |
| Chaos Manager | 1.72.18 |
| Chaos Machine IFS | 1.72.3 |
| Chaos Machine IFC | 1.72.2 |
| Chaos Web | 1.72.10 |
| CI Manager | 1.119.8 |
| Cloud Info | 1.13.2 |
| CV Nextgen | 1.53.1 |
| DB Devops Service | 1.76.2 |
| Debezium Service | 1.25.0 |
| Delegate Proxy | 1.6.0 |
| Delegate Version (Immutable) | 26.01.88201 |
| Event Service | 1.14.0 |
| Feature Flag Pushpin Service | 1.1132.0 |
| Feature Flag Service | 1.1148.0 |
| Gateway Service | 1.59.2 |
| GitOps Service | 1.49.1 |
| Harness Manager | 1.127.0 |
| LE Nextgen | 1.12.2 |
| Log Service | 1.38.8 |
| Looker | 1.8.9 |
| Next Gen UI | 1.114.2 |
| NG Auth UI | 1.37.4 |
| NG CE UI | 1.73.7 |
| NG Custom Dashboards | 1.98.0 |
| NG Dashboard Aggregator | 1.92.0 |
| NG Manager | 1.128.4 |
| Pipeline Service | 1.168.5 |
| Platform Service | 1.106.3 |
| Policy Management | 1.35.6 |
| SCM Service | 1.43.0 |
| Service Discovery Manager | 0.52.3 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.48.32 |
| SSCA UI | 0.37.9 |
| STO Core | 1.175.7 |
| Telescopes | 1.6.0 |
| Template Service | 1.130.0 |
| Test Intelligence Service | 1.60.4 |
| Queue Service | 1.8.0 |
| Code API | 1.73.2 |
| Code GitRPC | 1.73.1 |
| Code GitHA | 1.73.1 |
| Code Search | 1.73.1 |
| IAC Server | 1.296.0 |
| IACM Manager | 1.125.0 |
| IDP Service | 1.36.9 |
| IDP Admin | 1.36.2 |
| IDP App UI | 1.36.8 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.36.2/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.2/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.2/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.2/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.2/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.2/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.2/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.2/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.2/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.2/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.2/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.2/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.2/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.2/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.2/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.2/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.2/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.2/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.2/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.2/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Cloud Cost Management**
* Resolved missing attributes in kubernetes job which was causing failure during cost data ingestion from GCP. \[CCM-29923] \[CCM-30182]
### Version 0.36.0
February 09, 2026, Version 0.36.0
February 09, 2026
{% hint style="info" %}
**Important**
The migration from TimescaleDB to PostgreSQL is automatically triggered as part of the Harness SMP upgrade to version 0.36.0. Before you upgrade to SMP 0.36.0, you must be running version 0.35.x. Learn more about the migration in the [migration guide](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/migrate-timescaledb-to-postgresql.md).
{% endhint %}
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | -------------------------------------------------------------------------------------------- |
| Helm Chart | [0.36.0](https://github.com/harness/helm-charts/releases/tag/harness-0.36.0) |
| Air Gap Bundle | [0.36.0](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.36.0) |
| Access Control | 1.184.0 |
| Anomaly Detection | 1.20.0 |
| Audit Event Streaming | 1.73.0 |
| Batch Processing | 1.75.16 |
| Bootstrap | 1.64.0 |
| CE Nextgen | 1.77.11 |
| Change Data Capture | 1.49.4 |
| Chaos CRD | 1.72.0 |
| Chaos K8s IFS | 1.72.5 |
| Chaos Linux IFC | 1.72.2 |
| Chaos Linux IFS | 1.72.2 |
| Chaos Manager | 1.72.18 |
| Chaos Machine IFS | 1.72.3 |
| Chaos Machine IFC | 1.72.2 |
| Chaos Web | 1.72.10 |
| CI Manager | 1.119.8 |
| Cloud Info | 1.13.2 |
| CV Nextgen | 1.53.1 |
| DB Devops Service | 1.76.2 |
| Debezium Service | 1.25.0 |
| Delegate Proxy | 1.6.0 |
| Delegate Version (Immutable) | 26.01.88201 |
| Event Service | 1.14.0 |
| Feature Flag Pushpin Service | 1.1132.0 |
| Feature Flag Service | 1.1148.0 |
| Gateway Service | 1.59.2 |
| GitOps Service | 1.49.1 |
| Harness Manager | 1.127.0 |
| LE Nextgen | 1.12.2 |
| Log Service | 1.38.8 |
| Looker | 1.8.9 |
| Next Gen UI | 1.114.2 |
| NG Auth UI | 1.37.4 |
| NG CE UI | 1.73.7 |
| NG Custom Dashboards | 1.98.0 |
| NG Dashboard Aggregator | 1.92.0 |
| NG Manager | 1.128.4 |
| Pipeline Service | 1.168.5 |
| Platform Service | 1.106.3 |
| Policy Management | 1.35.6 |
| SCM Service | 1.43.0 |
| Service Discovery Manager | 0.52.3 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.48.32 |
| SSCA UI | 0.37.9 |
| STO Core | 1.175.7 |
| Telescopes | 1.6.0 |
| Template Service | 1.130.0 |
| Test Intelligence Service | 1.60.4 |
| Queue Service | 1.8.0 |
| Code API | 1.73.2 |
| Code GitRPC | 1.73.1 |
| Code GitHA | 1.73.1 |
| Code Search | 1.73.1 |
| IAC Server | 1.296.0 |
| IACM Manager | 1.125.0 |
| IDP Service | 1.36.9 |
| IDP Admin | 1.36.2 |
| IDP App UI | 1.36.8 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.36.0/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.0/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.0/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.0/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.0/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.0/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.0/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.0/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.0/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.36.0/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.0/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.0/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.0/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.0/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.0/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.0/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.0/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.0/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.0/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.36.0/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Harness Platform**
* Resolved a virtual service conflict impacting delegate resources. \[PL-67525]
* Enhanced delegate existence checks by including Delegate Group Name along with hostname and IP address, enabling the creation of delegates with identical hostnames and IPs in different infrastructures. \[PL-67497]
* Resolved an issue where ingress routes were updated as part of the change that moved Delegate APIs from ng-manager to harness-manager, but required Istio routes were missing, causing routing issues. The missing routes have now been added to ensure correct traffic routing. \[PL-67487]
* Improved secret handling by correcting metadata mismatches between secrets and their encrypted records. \[PL-67321]
* Resolved an issue where user search on the **Access Control > Users** page did not work correctly for emails containing special characters. The search query is now parsed correctly and matches user emails and names as expected. \[PL-67083]
* Resolved an issue where User Group identifiers are now enforced to be unique within the same Account, Organization, or Project scope, preventing the creation of duplicate User Groups. \[PL-65838]
* Resolved an issue where deleting a user now also removes them from all child scopes. \[PL-65635]
* Resolved an issue that now allows users to right-click and select "open link in new tab," or use Cmd+click or middle mouse click to open pages from the settings page in a new tab without leaving the current one. \[PL-65502]
* Resolved an issue where deleting a dashboard from the UI did not remove it from the dashboard listing page. This has been fixed and now dashboards are now correctly removed from the list when deleted or moved to the trash. \[PL-64817]
**GitOps**
* Improved user experience for GitOps applications updated through ApplicationSets. Setup usage events are now sent when applications are updated through ApplicationSets, providing better tracking and visibility into application lifecycle events. \[CDS-117821, ZD-101609]
* Fixed an issue where Harness Support Group users authenticated via OKTA SSO received 403 Permission Denied errors when accessing GitOps resources. The fix ensures support user tokens are properly forwarded to the Access Control Service for elevated access detection. \[CDS-116751]
* The resource view now sorts by date by default, providing a more intuitive view of resources with the most recent items appearing first. \[CDS-117862]
* Fixed an issue where the Update Release Repo step was incorrectly wrapping all YAML values, including command fields, in double quotes, causing deployments to break. The step now preserves existing values without modifying them. \[CDS-114900]
* Fixed an issue where the Fetch Linked Apps step, when filtering by service environment and cluster, did not provide sufficient logging to explain why applications were filtered out. Now, the logs include details when applications are filtered out due to agent identifier mismatches between the linked service and the application, providing better visibility into the filtering process. \[CDS-117383]
* Fixed an issue in GitOps project settings where users were incorrectly redirected when attempting to access GnuPG keys and repository certificates. Users are now directed to the correct locations for managing these settings. \[CDS-117513]
* Fixed an issue where pagination controls were not visible in the Applications list view, making it difficult to navigate through large numbers of applications. Users can now properly navigate through all applications using the pagination controls. \[CDS-117553]
* Fixed an issue where application parameters were not appearing in the GitOps UI for organization-level agents. This occurred because the system was incorrectly prefixing *org.* to the agent ID when fetching agent details, resulting in a 404 error and preventing subsequent API calls from completing. The parameters existed in the manifest and sync operations worked correctly, but the UI failed to render them. The agent ID handling has been corrected to work properly for organization-level scopes. \[CDS-117296, ZD-99840]
* Fixed an issue where the GitOps UI incorrectly displayed deployment activities as *Running* even after they had completed. This occurred in multi-source applications with multiple revisions, where the sync history was showing incorrect status. The UI now accurately reflects the completed state of deployments. \[CDS-115737, ZD-96501]
* Fixed an issue where users were unable to delete a GitOps agent from the UI. This occurred when the agent had tags configured, causing the delete operation to fail due to a tags field decoding error. The agent would remain stuck in a *deleting* state. Agents with tags can now be deleted successfully. \[CDS-116263, ZD-97644]
* Fixed the following security vulnerabilities in GitOps components:
* Fixed a high-severity vulnerability in the gitops-agent-installer-helper component. The vulnerability **CVE-2025-22874** in the crypto/x509 package (Go 1.24.2) has been resolved by upgrading to Go 1.24.4. This fix is included in gitops-agent-installer-helper v0.0.7.
* Fixed multiple high-severity vulnerabilities in the Redis component. The vulnerabilities **CVE-2022-30632** (path/filepath), **CVE-2023-29403** (runtime), and **CVE-2022-30630** (io/fs) affecting Go 1.18.2 in Redis images 7.4.1-alpine and 6.2.14-alpine have been resolved. Harness has rebuilt a custom Redis image harness/redis:7.4.7-alpine with the latest fixes.
* Fixed a high-severity vulnerability in the gitops-service component. The vulnerability **CVE-2024-25621** in containerd v1.7.28 has been resolved by upgrading to containerd v1.7.29. This fix is included in gitops-service-signed:1.45.2.
* Fixed critical and high-severity vulnerabilities in the harness/argocd component. The vulnerabilities **CVE-2024-24790** (critical, net/netip) and **CVE-2024-45338** (high, golang.org/x/net/html) have been addressed in argocd v2.14.16.
* Fixed multiple high-severity vulnerabilities in the gitops-agent component. The vulnerabilities **CVE-2025-59531**, **CVE-2025-59537**, and **CVE-2025-59538** affecting github.com/argoproj/argo-cd/v2 have been addressed in gitops-agent v0.102.0 with argo-cd v2.14.16.
* Fixed an issue where duplicate log lines appeared when viewing logs from the Resource View panel in GitOps applications. This issue affected both SaaS and SMP installations. Logs now display correctly without duplication. \[CDS-114656, ZD-94084, ZD-95360]
**Continuous Delivery**
* Fixed an issue where nexus connector experiencing 504 errors due to socket exhaustion potentially related to `http/2 → http/1.1` traffic handling. Added env variable to `DISABLE_NEXUS_DOCKER_V2_CATALOG`, `DISABLE_NEXUS_DOCKER_ARTIFACT_VALIDATION`, and `MAX_BUILD_NEXUS_TRIGGERS` to restrict the api calls to `/v2/_catalog`. \[CDS-118102, ZD-101720, ZD-102180]
* Fixed an issue where a pipeline step's *When* condition was not re-evaluated on retry attempts after an initial evaluation failure. This could lead to the step incorrectly executing on a retry. Now, the *When* condition is always re-evaluated on each retry attempt, ensuring consistent and correct execution behavior. Currently, this fix is governed by the feature flag `PIPE_SKIP_EXECUTE_WHEN_CONDITION_ON_RETRY_STEP`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[PIPE-31684, ZD-101561]
* Fixed an issue where *send status back to git* does not publish commit status when pipeline is triggered via harness code trigger in custom stages. Status handling was missing in the Harness code repository because it lacks a connector reference. Added proper handling for the code repository. \[PIPE-31736, ZD-100597]
* Fixed an issue where sensitive information was being stored in ConfigMaps within Kubernetes clusters, making it potentially accessible to unauthorized users with cluster view access. To resolve this, the release history storage logic has been updated to store release history in Secrets when pruning is enabled, providing a more secure storage mechanism. Currently, this fix is governed by the feature flag `CDS_STORE_PRUNING_RELEASE_HISTORY_IN_SECRET`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[CDS-117631]
* Fixed an issue where navigating between search results in pipeline execution logs would scroll to the log row but not to the precise location of the highlighted match. For log lines with content extending beyond the visible area, users had to manually scroll to locate the highlighted text; the search now automatically scrolls the highlighted match into view, ensuring visibility regardless of its position within long log lines. \[CDS-117728, ZD-101156]
* Fixed an issue where the environment service override API displayed a misleading error when Environment YAML was stored on a non-default Git branch. The error incorrectly stated the file was missing from the master branch, even though it existed on the selected branch. \[CDS-117803, ZD-101368]
* Fixed an issue where the service dashboard displayed an incorrect instance count in the final detail view compared to the summary rows when GitOps was enabled. \[CDS-117222, ZD-99969]
* Fixed an issue where child pipelines were incorrectly marked as failed and triggered failure notifications when the parent pipeline failed, even if the child pipeline completed successfully. This was due to the failure strategy propagating the parent pipeline's user-initiated failure status to the child pipeline. \[PIPE-30821, ZD-97666, ZD-99055]
* Fixed an issue where pipelines were not correctly identified as CI or CD pipelines in the API and SDK, causing filtering and other operations based on module type to be inaccurate. \[PIPE-30921, ZD-98003]
* Fixed an issue where interrupting a pipeline execution (for example, marking it as failed or expiring it) sometimes failed to stop all running tasks, leading to resource locking and potential pipeline stalls. The system now correctly handles these interruptions, ensuring all tasks are stopped and resources are released. This fix is behind the feature flag `PIPE_FAIL_USER_MARKED_FAIL_ALL_INTERRUPT_WITHOUT_LEAF_NODES`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[PIPE-31334, ZD-99055]
* Fixed an issue where pipelines failed to start with a generic error message when the pipeline YAML exceeded the size limit. A clear error message is now displayed indicating the size limit and suggesting mitigation steps. \[PIPE-31336, ZD-99604, ZD-100342]
* Fixed an issue where pipelines were unexpectedly stuck and failing to proceed, preventing deployments from completing for some customers. \[PIPE-31510, ZD-100762, ZD-100766, ZD-100767, ZD-100768, ZD-100777, ZD-100778, ZD-100785]
* Fixed an issue where the *Deploy to All* setting appeared as an unsaved change in the UI, even after being initially set. \[CDS-116815, ZD-72196, ZD-98671]
* Fixed an issue where the *Services* page for some customers loaded very slowly on the first visit. The initial loading time has been significantly improved, even with a large number of services. \[CDS-116985, ZD-99097]
* Fixed an issue where the Fetch Linked App step didn't provide details about why applications were filtered out, making it difficult to troubleshoot linked service configurations with agent identifier mismatches. Logs now include information about applications filtered out due to agent identifier mismatches, improving troubleshooting. \[CDS-117383, ZD-100157]
* Fixed an issue where artifact paths were not being listed for artifacts configured with the production Artifactory instance, preventing users from selecting the correct artifact during runtime. \[CDS-116713, ZD-98601]
* Fixed an issue where the *Create Github Repo* step failed with an error when used within an insert step in a templated pipeline, preventing users from templating approval flows. \[CDS-117231, ZD-99763]
* Fixed an issue where pipeline execution status was not being sent to Git, preventing users from monitoring pipeline progress within their Git repository. This was due to a Git connector configuration issue, which has now been resolved. \[PIPE-30761, ZD-97158, ZD-99034]
* Fixed an issue where the repository list failed to populate when creating a new remote pipeline, requiring users to manually enter the repository name. \[PIPE-31217, ZD-98885, ZD-99375, ZD-99394, ZD-99657, ZD-99963, ZD-100020]
* Fixed an issue where Air Canada's Serverless Deployments were failing in the production environment. The issue was isolated to one production cluster and has been resolved. \[CDS-117323, ZD-100051]
* Fixed an issue where account-level templates could have duplicate identifiers and multiple stable versions, leading to conflicts and unexpected behavior. This has been resolved to ensure template identifiers are unique and only one stable version exists per template. \[PIPE-30923, ZD-97931, ZD-98071, ZD-99525]
* Fixed an issue where dynamic stages failed to parse Base64 encoded YAML configurations when the encoded string contained multiline formatting. This prevented users from deploying pipelines using dynamically generated configurations in certain formats. \[PIPE-31041, ZD-98187]
* Fixed an issue where environment details were truncated in the Harness UI, preventing users from seeing the complete information. \[PIPE-31194, ZD-99027]
* Fixed an issue where the repository list failed to populate when creating a new remote pipeline, requiring users to manually enter the repository name. \[PIPE-31217, ZD-98885, ZD-99375, ZD-99394, ZD-99657, ZD-99963, ZD-100020]
* Fixed an issue where rerunning a pipeline from the last failed stage or a specific stage failed when the pipeline YAML was stored in a non-default branch. The rerun now correctly uses the original branch for pipeline execution. \[PIPE-31293, ZD-98968, ZD-99377, ZD-99465, ZD-99565, ZD-99595, ZD-99596, ZD-99652, ZD-99935]
* Fixed an issue where the error message displayed during environment branch selection in service overrides was misleading when using InputSet triggers. The error message has been improved to provide clearer guidance on the actual issue. This feature is behind the feature flag `PIPE_USE_ENV_REF_BRANCH_IN_SERVICE_OVERRIDE_FOR_INPUTSET_TRIGGER`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[CDS-113820, ZD-89141]
* Fixed an issue where policy evaluation displayed *No Policy Set Description* even when the referenced PolicySet had a proper description, specifically when enforcement was applied at the service level. The description is now correctly included in the response for CD entities. \[CDS-116824, ZD-97171]
* Fixed an issue where the Microsoft Teams approval notification link was malformed due to improper special character handling. The notification URL generation has been corrected to ensure approval links work properly in MS Teams. \[CDS-116863, ZD-97579, ZD-98879]
* Fixed an issue where post-production rollback failed when selecting an environment from the pipeline execution page. The rollback workflow now correctly handles environment selection during the post-production rollback process. \[CDS-117023, ZD-98881]
* Fixed an issue where the GAR (Google Artifact Registry) artifact runtime package path was being returned in an encoded format, causing pipeline failures. The package value is now properly decoded to display correct values in the UI. \[CDS-116703, ZD-98357]
* Fixed an issue where Azure ARM Template deployments failed with NPE (Null Pointer Exception) and template parsing errors when no parameters file was provided. The parameters file field is now optional. \[CDS-116706, ZD-98571]
* Fixed an issue where pipelines were hard failing due to secrets referencing null expressions. This occurred when expressions evaluated to null, causing unexpected failures. The "Fail on missing secrets" functionality has been adjusted to restore the previous soft-fail behavior. \[CDS-116786, ZD-98673]
* Fixed an issue where the Wiz security scanning step was failing intermittently in containerized step groups. This occurred because the StageId was being generated as a UUID, which caused regex matching failures for the STO API calls. The StageId is now set to the stage name for consistent behavior. This fix is behind the feature flag `CDS_CONTAINER_STEP_USE_STAGE_IDENTIFIER`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[CDS-116801, ZD-98547, ZD-98911]
* Fixed an issue where pipeline executions were being auto-aborted unexpectedly, even when auto-abort was disabled on the trigger. This occurred because the auto-abort feature was terminating all executions with the same execution tag, regardless of which trigger initiated them. The feature now only aborts executions that were fired from the same trigger. This fix is behind the feature flag `PIPE_ABORT_ONLY_TRIGGERED_BY_SAME_TRIGGER`. Contact [Harness Support](mailto:support@harness.io) to enable it. \[PIPE-30843, ZD-97860, ZD-98660]
**Security Testing Orchestration**
* Removed the dind step from the Harness SCA scanner \[STO-10662].
* Fixed an issue where Sonar Scan output variables were not populated when executed as part of a template, causing OPA policies to evaluate against null data. Scan results are now correctly available \[STO-10561]
* Fixed an issue where External Policies on the Default Settings page could be saved without a severity. Severity is now mandatory to save \[STO-10555]
* Removed the Target Language field from the Harness SCA Scanner, as it is not required to scan the container images \[STO-10541].
* Fixed an issue where an invalid value was selected when no option was chosen in External Policy failure settings \[STO-10641]
**Continuous Integration**
* Fixed gRPC retry issues that were causing unnecessary retries. \[CI-19192]
* Fixed Run step issues for Docker/VM infrastructure with Delegate 3.0. \[CI-20070]
* Fixed log streaming for parallel build stages. \[CI-18653]
* Fixed race conditions in pipeline state transitions (queued to running). \[CI-19974]
* Fixed dynamic parallelism behavior. \[CI-20317]
* Fixed double-quoted secrets in expressions causing Run step failures. \[CI-20256]
* Security patches for Artifactory and S3 plugins. \[CI-20217]
* Security vulnerability patches for Kaniko plugins. \[CI-20230]
* Security vulnerability patch for Artifactory plugin. \[CI-20462]
**Chaos Engineering**
* Fixed an issue where Node Network faults were not impacting node network connectivity and were instead affecting only the helper pod running the `tc` command. \[CHAOS-10652]
* Fixed an issue where the Prometheus APM Probe did not apply TLS configuration during experiment execution. \[CHAOS-10720]
* Fixed an issue where the Chaos step checks API returned a 500 error when a pipeline stage included parallel steps or a string-type resilience score. \[CHAOS-10721]
* Fixed an issue with New Relic Connector ID derivation during execution. \[CHAOS-10735]
* Fixed an issue with template preview when using org- or account-scoped templates within a project-scoped template. \[CHAOS-10785]
* Fixed an issue in Datadog metric evaluation where the Datadog Probe succeeded even when the raise condition was not met. \[CHAOS-8960]
**New Features and Enhancements**
**Harness Platform**
* We’ve added support for using external secrets directly through an [External Secret Manager (currently available only for HashiCorp Vault)](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/advanced-configuration/configure-hashicorp-vault.md). \[PL-64589]
* Upgraded yq to version 4.50.1 in the base image to address CVE-2025-61729. \[PL-67706]
* Upgraded the Java OpenJDK to version 17.0.17 to improve stability, security, and performance. \[PL-67529]
* Updated the Bouncy Castle (BC) libraries to version 1.80 in the Docker configuration and associated scripts. \[PL-67468]
* The **Renewal Interval (minutes)** field has been removed from the **App Role** authentication method in the HashiCorp Vault connector, as token caching now depends solely on the vault's native TTL. This change enhances clarity and eliminates an unnecessary setting. \[PL-66935]
* Improved audit logging now captures failed login attempts across all authentication methods, offering improved visibility into security events. \[PL-66585]
* Implemented reference creation between user groups and notification channels at the project scope, ensuring user groups cannot be deleted while they are referenced by one or more notification channels. \[PL-66281]
* OPA policies are now enforced during token rotation, ensuring rotated tokens follow policy limits and do not use long expiration times. \[PL-65141]
* User group `Manage` permission is now split into granular permissions for improved access control, including `Create`, `Edit (Metadata)`, `Delete`, `Manage Notifications`, `Manage SSO`, `Manage SCIM`, `Manage Users`, and `Manage Role Assignments`. \[PL-58021]
* **Feature Flags:**
* `PL_USER_GROUPS_MANAGE_PERMISSION_SPLIT_MIGRATION`: Migrates existing roles with `Manage` permission to include all new granular permissions by default
* `PL_USER_GROUPS_MANAGE_PERMISSION_SPLIT_ENFORCE`: Enforces the new granular permissions across all user group operations (enable after migration is complete)
**GitOps**
* GitOps services with multiple environments now execute in separate stages per service and environment combination, matching the behavior of CD multi-environment execution. This prevents variable clashes between services and environments when using overrides, eliminating unexpected behavior that could occur when aggregating cluster details from each environment in a single stage. \[CDS-114264, ZD-91288]
* The GitOps sync step now supports server-side apply, which helps prevent errors when dealing with large manifests. The step also respects ignore-diff configurations, providing more control over how resources are synchronized. \[CDS-117361]
* **ArgoCD Upgraded to 3.1.8**\
Harness GitOps has upgraded to ArgoCD 3.1.8 (from 2.x), bringing significant security improvements, enhanced functionality, and updated tooling. This major version upgrade includes:
**Security Enhancements:**
* **Symlink Protection:** The API server's `--staticassets` directory is now protected against out-of-bounds symlinks to prevent symlink attacks
* **Sanitized Project API Response:** Project API responses have been sanitized to remove sensitive information (addresses GHSA-786q-9hcg-v9ff)
* **Enhanced OpenID Connect Flow:** The authorization code flow with PKCE is now handled server-side instead of in the UI, improving security and consistency
**Tool Updates:**
* **Helm:** Upgraded to version 3.18.4 (from previous version)
* **Kustomize:** Upgraded to version 5.7.0 (from previous version)
**API Changes:**
* The `/api/v1/applications/{name}/resource/actions` endpoint is deprecated in favor of `/api/v1/applications/{name}/resource/actions/v2`. Users should migrate to the new v2 endpoint
For complete details on the ArgoCD upgrade, refer to the official ArgoCD upgrade documentation:
* [Upgrading from v2.14 to v3.0](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/2.14-3-0/)
* [Upgrading from v3.0 to v3.1](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/3.0-3.1/)
* **ArgoCD Helm Chart Upgraded to 9.0.0**\
The GitOps Helm chart has been upgraded from version 7.x to 9.0.0 to align with the ArgoCD 3.1.8 release. This update incorporates necessary configuration changes and improvements for the new ArgoCD version. For detailed information on the Helm chart changes, see the [argo-cd Helm chart release notes](https://github.com/argoproj/argo-helm/releases).
For more information about this major ArgoCD upgrade, including breaking changes and compatibility considerations, see [ArgoCD 3.1.8 upgrade](/continuous-delivery/use-gitops/gitops-entities/agents/argocd-3-upgrade.md).
* **GitOps ApplicationSets as First-Class Entities**\
Harness now supports GitOps ApplicationSets as first-class entities, enabling you to create and manage multiple GitOps applications from a single template through an intuitive UI wizard. Key capabilities include:
* Full CRUD operations via UI and API
* Support for all Argo CD generator types (List, Git, Cluster, Matrix, and more)
* Seamless integration with Harness Services and Environments
* Import existing ApplicationSets from your Argo CD instances
* PR pipeline integration for automated configuration updates
* Automatic generation and sync of child applications with configurable lifecycle policies
This provides a scalable solution for multi-environment and multi-cluster deployments. Currently, this feature is controlled by Feature Flag `GITOPS_APPLICATIONSET_FIRST_CLASS_SUPPORT`. Please contact [Harness Support](mailto:support@harness.io) to enable this feature flag. For more information, go to [ApplicationSets](/continuous-delivery/use-gitops/applicationsets.md). \[CDS-105825]
* **Harness Secret Expressions in Application Manifests**: You can now use Harness secret expressions directly in Kubernetes manifests using `<+secrets.getValue()>` syntax. Secrets are resolved and decrypted during manifest rendering for Kubernetes `Secret` objects. Supports account, org, and project-level secrets configured in HashiCorp Vault or Harness Secret Manager. This feature requires Feature Flag `CDS_GITOPS_SECRET_RESOLUTION_ENABLED` and enabling the Argo CD Harness Plugin during agent installation. Please contact [Harness Support](mailto:support@harness.io) to enable this feature. For more information, go to [Harness Secret Expressions in Application Manifests](/continuous-delivery/use-gitops/application/manage-gitops-applications.md#harness-secret-expressions-in-application-manifests).
* Added an **Allow Syncing** toggle switch to the Agent Details page for managing system-managed sync windows during disaster recovery (DR) switchover workflows. This enhancement provides better control over automated sync window management without affecting user-configured windows. \[CDS-115196]
**Continuous Delivery**
* Harness now supports Blue-Green deployments to [**Google Cloud Platform Managed Instance Groups**](/continuous-delivery/use-continuous-delivery/deploy-services-on-different-platforms/google-cloud-functions/mig.md). Deploy GCP VM workloads with zero downtime, gradual traffic shifting using Cloud Service Mesh, and instant rollback. \[CDS-114547]
* Harness now supports **multi-account deployments for AWS CDK**, allowing you to deploy to different AWS accounts using a single connector by overriding the region and assuming a different IAM role at the step level. \[CDS-114915]
* Harness now supports **GCP connector credentials for Terraform steps**, enabling authentication with Google Cloud Platform using Manual Credentials, Inherit From Delegate, or OIDC Authentication methods. This feature requires delegate version 88303 or later. \[CDS-115648]
* Harness now supports **cross-project access for Google Cloud Operations health sources**. You can now specify a GCP Project ID to query metrics and logs from a different project than your connector's default, eliminating the need to create separate connectors for each GCP project. \[CDS-114447]
* Harness now supports **Git-based pipeline YAMLs in Dynamic Stages**, allowing you to execute pipeline YAMLs stored in Git repositories in addition to inline and runtime-provided YAML. You can optionally specify a commit hash to use a specific version of the file. \[PIPE-30849]
* Harness now supports a new **"Waiting for User Action" pipeline notification event**. You can configure pipeline notifications that are sent whenever a pipeline pauses for user input, such as approvals, manual interventions, or file uploads. \[PIPE-24734]
* Harness has improved **trigger evaluation resilience**. A failure in one trigger no longer blocks or skips the evaluation of other triggers, ensuring all eligible triggers are evaluated independently when an event is received. \[PIPE-31331]
* **Harness Artifact Registry now supported as an artifact source** for all CD deployment types (except Helm). HAR provides native integration for both container images and packaged artifacts (Maven, npm, NuGet, generic). For more information, go to [Harness Artifact Registry](/continuous-delivery/use-continuous-delivery/cd-building-blocks/services/artifact-sources.md#harness-artifact-registry).
* Continuous Verification now supports custom webhook notifications for verification sub-tasks, providing real-time updates on data collection, analysis, and verification status with correlation IDs for event tracking. This feature is behind the feature flag `CDS_CV_SUB_TASK_CUSTOM_WEBHOOK_NOTIFICATIONS_ENABLED`. Contact [Harness Support](mailto:support@harness.io) to enable it. For more information, go to [Sub-Task Notifications](/continuous-delivery/use-continuous-delivery/verify-deployments/configure-cv/verify-deployments.md#sub-task-notifications).
* Continuous Verification now supports custom webhook notifications for verification sub-tasks, enabling real-time monitoring of data collection, analysis, and verification results. Notifications include correlation IDs for tracking related events and can be delivered via Platform or Delegate with custom headers support. This feature is behind the feature flag `CDS_CV_SUB_TASK_CUSTOM_WEBHOOK_NOTIFICATIONS_ENABLED`. Contact [Harness Support](mailto:support@harness.io) to enable it. For more information, go to [Sub-Task Notifications](/continuous-delivery/use-continuous-delivery/verify-deployments/configure-cv/verify-deployments.md#sub-task-notifications).
* ECS Blue-Green deployments now automatically discover the correct stage target group when not explicitly provided, preventing production outages caused by manual selection errors. Harness identifies the target group with 0% traffic and validates distribution patterns before deployment. For more information, go to [ECS Blue-Green Traffic Shifting](/continuous-delivery/use-continuous-delivery/deploy-services-on-different-platforms/aws/ecs/traffic-shifting.md).
* New Docker images are now available for AWS SAM and Serverless Framework deployments. These updated plugin images provide improved performance and stability. For more information, see the [AWS SAM plugin](https://hub.docker.com/r/harness/aws-sam-plugin/tags) and [Serverless plugin](https://hub.docker.com/r/harness/serverless-plugin/tags) images on Docker Hub.
**Security Testing Orchestration**
* Added a new setting at the account level to treat External Policy failures from scanners as Vulnerabilities (Critical, High, Medium, Low). \[STO-9122]
**Continuous Integration**
* Pod failure error messages now stream directly to the console UI, improving visibility into Kubernetes build failures. \[CI-19573]
* CI now skips git status updates when custom pipeline-level status reporting is enabled. \[CI-19762]
* Build Intelligence now works on Windows containers on Kubernetes. \[CI-17571]
* Cache step improvements for Docker infrastructure with Delegate 3.0. \[CI-20100]
* Added additional debug logging for troubleshooting. \[CI-19193]
* Flex compute option removed from Build stage UI (YAML configuration still supported). \[CI-20286]
* Enhanced log streaming for builds. \[CI-19389]
* Harness CLI can now reach Kubernetes infrastructure. \[CI-20279]
* Added support for HCLI 0.4 in custom delegates. \[CI-19522]
* Enhanced logging for SCM operations. \[CI-20370]
* Improved expression resolution for codebase configurations. \[CI-20053]
* Build Intelligence templates are now fetched with `enabled:true` for v1 YAML. \[CI-20340]
* Build Intelligence logs now stream live during stage execution. \[CI-17104]
* Kubernetes pod YAML size optimization using ConfigMap (behind `CI_COMMON_ENV_POD` feature flag). \[CI-20022]
* Step execution improvements for local runner. \[CI-19863]
**Chaos Engineering**
* Added support for Windows command probes in the v1beta1 experiment type. \[CHAOS-10789]
* Enabled runtime inputs for metric queries used in APM probes. \[CHAOS-10733]
* Introduced support for using chaos templates during step template creation. \[CHAOS-10754, CHAOS-10753]
* Added Harness as an event source for the Datadog annotation event action. \[CHAOS-10677]
* Enabled HSM secrets to be used in environment variables for Probes and Actions. \[CHAOS-10667]
* Added a whitelist-based SSH filter for the aws-ec2-network-chaos experiment. \[CHAOS-10566]
**Cloud Cost Management**
* Default Folder Visibility: Perspectives moved to Default folder after a folder deletion will now show up during the creation of a new folder \[CCM-26370]
* Recommendations Breakdown: We’ve added realized savings from Recommendations to the Recommendations Breakdown widget on the CCM Overview page. \[CCM-26915]“Others” cost preference now supports negative values: Previously, when Show Others (not in top 12) was enabled, negative costs in the “Others” category were shown as zero. We’ve fixed this - negative values will now display correctly in Perspectives. \[CCM-28678]
* Perspective chart x-axis now shows only valid dates: Fixed an issue where extra dates appeared at the beginning and end of the chart timeline. The x-axis now reflects only the dates present in the dataset. \[CCM-28640]
* Accurate Budget Reporting: Refined budget spend calculations to show true costs-to-date by excluding future pre-allocated costs. This provides more accurate and actionable "Spend till date" values for better financial planning. \[CCM-27253]
* Perspective Cloning: Implemented perspective cloning capability, allowing users to create copies of existing perspectives with custom names and save them to their preferred destination folders. \[CCM-25667]
**Internal Developer Platform**
* Introduced hierarchy and layout support in Catalog entities for improved organization and version visualization (IDP-7817, IDP-7741).
* Enhanced Self Service Workflow performance and responsiveness for environment creation and dropdown-triggered APIs (IDP-7733, IDP-7732).
* Strengthened rule computation and aggregation logic within Scorecards for accurate metric rollups (IDP-7130, IDP-7259).
* Enhanced Git Experience with better YAML error messaging, consistent identifier logic, and improved commit dialog (IDP-7667, IDP-7451).
* Expanded Plugin capabilities with CMDB Integration UI, IACM plugin upgrade, and Kafka onboarding (IDP-7588, IDP-7624, IDP-7682).
* Resolved issues in rule computation and aggregation rollups for Scorecards, ensuring accurate multi-scope evaluations (IDP-7721, IDP-7127).
* Fixed YAML import and validation failures in Git-based workflows (IDP-7667).
* Addressed inconsistencies in identifier generation between UI and IDP services (IDP-7700).
### Version 0.35.12
February 3, 2026, Version 0.35.12
February 3, 2026
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | ---------------------------------------------------------------------------------------------- |
| Helm Chart | [0.35.12](https://github.com/harness/helm-charts/releases/tag/harness-0.35.12) |
| Air Gap Bundle | [0.35.12](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.35.12) |
| Access Control | 1.168.1 |
| Anomaly Detection | 1.16.3 |
| Audit Event Streaming | 1.66.0 |
| Batch Processing | 1.70.18 |
| Bootstrap | 1.60.0 |
| CE Nextgen | 1.73.8 |
| Change Data Capture | 1.49.3 |
| Chaos CRD | 1.71.0 |
| Chaos K8s IFS | 1.71.0 |
| Chaos Linux IFC | 1.71.0 |
| Chaos Linux IFS | 1.71.0 |
| Chaos Manager | 1.71.3 |
| Chaos Machine IFS | 1.71.0 |
| Chaos Machine IFC | 1.71.0 |
| Chaos Web | 1.71.6 |
| CI Manager | 1.112.2 |
| Cloud Info | 1.13.1 |
| CV Nextgen | 1.49.4 |
| DB Devops Service | 1.70.0 |
| Debezium Service | 1.25.0 |
| Delegate Proxy | 1.4.0 |
| Delegate Version | 25.11.87302 |
| Event Service | 1.13.1 |
| Feature Flag Pushpin Service | 1.1128.0 |
| Feature Flag Service | 1.1145.0 |
| Gateway Service | 1.58.2 |
| GitOps Service | 1.46.6 |
| Harness Manager | 1.120.4 |
| LE Nextgen | 1.11.1 |
| Log Service | 1.36.2 |
| Looker | 1.8.8 |
| Next Gen UI | 1.107.2 |
| NG Auth UI | 1.37.3 |
| NG CE UI | 1.69.8 |
| NG Custom Dashboards | 1.97.0 |
| NG Dashboard Aggregator | 1.85.0 |
| NG Manager | 1.121.5 |
| Pipeline Service | 1.161.4 |
| Platform Service | 1.99.0 |
| Policy Management | 1.31.3 |
| SCM Service | 1.42.1 |
| Service Discovery Manager | 0.51.0 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.46.13 |
| SSCA UI | 0.36.5 |
| STO Core | 1.170.6 |
| Ticket Service | 1.2.2 |
| Telescopes | 1.5.0 |
| Template Service | 1.123.0 |
| Test Intelligence Service | 1.58.0 |
| Queue Service | 1.7.4 |
| Code API | 1.70.2 |
| Code GitRPC | 1.70.1 |
| Code GitHA | 1.70.0 |
| Code Search | 1.70.1 |
| IAC Server | 1.283.4 |
| IACM Manager | 1.122.2 |
| IDP Service | 1.34.15 |
| IDP Admin | 1.34.2 |
| IDP App UI | 1.34.5 |
| UI | 1.32.2 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.35.12/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.12/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.12/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.12/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.12/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.12/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.12/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.12/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.12/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.12/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.12/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.12/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.12/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.12/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.12/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.12/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.12/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.12/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.12/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.12/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Cloud Cost Management**
* Resolved issue for dashboard slowness. \[CCM-29708]
## January 2026
### Version 0.35.11
January 24, 2026, Version 0.35.11
January 24, 2026
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | ---------------------------------------------------------------------------------------------- |
| Helm Chart | [0.35.11](https://github.com/harness/helm-charts/releases/tag/harness-0.35.11) |
| Air Gap Bundle | [0.35.11](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.35.11) |
| Access Control | 1.168.1 |
| Anomaly Detection | 1.16.3 |
| Audit Event Streaming | 1.66.0 |
| Batch Processing | 1.70.17 |
| Bootstrap | 1.60.0 |
| CE Nextgen | 1.73.8 |
| Change Data Capture | 1.49.3 |
| Chaos CRD | 1.71.0 |
| Chaos K8s IFS | 1.71.0 |
| Chaos Linux IFC | 1.71.0 |
| Chaos Linux IFS | 1.71.0 |
| Chaos Manager | 1.71.3 |
| Chaos Machine IFS | 1.71.0 |
| Chaos Machine IFC | 1.71.0 |
| Chaos Web | 1.71.6 |
| CI Manager | 1.112.2 |
| Cloud Info | 1.13.1 |
| CV Nextgen | 1.49.4 |
| DB Devops Service | 1.70.0 |
| Debezium Service | 1.25.0 |
| Delegate Proxy | 1.4.0 |
| Delegate Version | 25.11.87302 |
| Event Service | 1.13.1 |
| Feature Flag Pushpin Service | 1.1128.0 |
| Feature Flag Service | 1.1145.0 |
| Gateway Service | 1.58.2 |
| GitOps Service | 1.46.6 |
| Harness Manager | 1.120.4 |
| LE Nextgen | 1.11.1 |
| Log Service | 1.36.2 |
| Looker | 1.8.8 |
| Next Gen UI | 1.107.2 |
| NG Auth UI | 1.37.3 |
| NG CE UI | 1.69.8 |
| NG Custom Dashboards | 1.97.0 |
| NG Dashboard Aggregator | 1.85.0 |
| NG Manager | 1.121.5 |
| Pipeline Service | 1.161.4 |
| Platform Service | 1.99.0 |
| Policy Management | 1.31.3 |
| SCM Service | 1.42.1 |
| Service Discovery Manager | 0.51.0 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.46.13 |
| SSCA UI | 0.36.5 |
| STO Core | 1.170.6 |
| Ticket Service | 1.2.2 |
| Telescopes | 1.5.0 |
| Template Service | 1.123.0 |
| Test Intelligence Service | 1.58.0 |
| Queue Service | 1.7.4 |
| Code API | 1.70.2 |
| Code GitRPC | 1.70.1 |
| Code GitHA | 1.70.0 |
| Code Search | 1.70.1 |
| IAC Server | 1.283.4 |
| IACM Manager | 1.122.2 |
| IDP Service | 1.34.15 |
| IDP Admin | 1.34.2 |
| IDP App UI | 1.34.5 |
| UI | 1.32.2 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.35.11/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.11/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.11/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.11/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.11/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.11/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.11/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.11/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.11/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.11/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.11/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.11/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.11/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.11/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.11/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.11/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.11/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.11/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.11/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.11/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Cloud Cost Management**
* BI Dashboard: Updated Unified Cost measure to use Amortised Cost instead of Effective Cost. This resolves null costs for lineItemTypes other than DiscountedUsage. \[CCM-29070]
**Security Testing Orchestration**
* Security Testing Dashboard: Fixed queries referencing the deprecated org\_id field. \[STO-10623]
### Version 0.35.10
January 12, 2026, Version 0.35.10
January 12, 2026
{% hint style="info" %}
No new enhancements, features, or bug fixes were introduced between versions 0.35.4 and 0.35.9.
{% endhint %}
This release includes the following Harness module and component versions.
| **Name** | **Version** |
| ---------------------------- | ---------------------------------------------------------------------------------------------- |
| Helm Chart | [0.35.10](https://github.com/harness/helm-charts/releases/tag/harness-0.35.10) |
| Air Gap Bundle | [0.35.10](https://console.cloud.google.com/storage/browser/smp-airgap-bundles/harness-0.35.10) |
| Access Control | 1.168.1 |
| Anomaly Detection | 1.16.3 |
| Audit Event Streaming | 1.66.0 |
| Batch Processing | 1.70.17 |
| Bootstrap | 1.60.0 |
| CE Nextgen | 1.73.8 |
| Change Data Capture | 1.49.3 |
| Chaos CRD | 1.71.0 |
| Chaos K8s IFS | 1.71.0 |
| Chaos Linux IFC | 1.71.0 |
| Chaos Linux IFS | 1.71.0 |
| Chaos Manager | 1.71.3 |
| Chaos Machine IFS | 1.71.0 |
| Chaos Machine IFC | 1.71.0 |
| Chaos Web | 1.71.6 |
| CI Manager | 1.112.2 |
| Cloud Info | 1.13.1 |
| CV Nextgen | 1.49.4 |
| DB Devops Service | 1.70.0 |
| Debezium Service | 1.25.0 |
| Delegate Proxy | 1.4.0 |
| Delegate Version | 25.11.87302 |
| Event Service | 1.13.1 |
| Feature Flag Pushpin Service | 1.1128.0 |
| Feature Flag Service | 1.1145.0 |
| Gateway Service | 1.58.2 |
| GitOps Service | 1.46.6 |
| Harness Manager | 1.120.4 |
| LE Nextgen | 1.11.1 |
| Log Service | 1.36.2 |
| Looker | 1.8.7 |
| Next Gen UI | 1.107.2 |
| NG Auth UI | 1.37.3 |
| NG CE UI | 1.69.8 |
| NG Custom Dashboards | 1.97.0 |
| NG Dashboard Aggregator | 1.85.0 |
| NG Manager | 1.121.5 |
| Pipeline Service | 1.161.4 |
| Platform Service | 1.99.0 |
| Policy Management | 1.31.3 |
| SCM Service | 1.42.1 |
| Service Discovery Manager | 0.51.0 |
| SRM UI | 1.16.0 |
| SSCA Manager | 1.46.13 |
| SSCA UI | 0.36.5 |
| STO Core | 1.170.6 |
| Ticket Service | 1.2.2 |
| Telescopes | 1.5.0 |
| Template Service | 1.123.0 |
| Test Intelligence Service | 1.58.0 |
| Queue Service | 1.7.4 |
| Code API | 1.70.2 |
| Code GitRPC | 1.70.1 |
| Code GitHA | 1.70.0 |
| Code Search | 1.70.1 |
| IAC Server | 1.283.4 |
| IACM Manager | 1.122.2 |
| IDP Service | 1.34.15 |
| IDP Admin | 1.34.2 |
| IDP App UI | 1.34.5 |
| UI | 1.32.2 |
**Alternative air gap bundle download method**
Some admins might not have Google account access to download air gap bundles. As an alternative, you can use either **`gsutil`** or **`curl`**.
**Option 1: Using `gsutil`**
````
For `gsutil` installation instructions, go to [Install gsutil](https://cloud.google.com/storage/docs/gsutil_install) in the Google Cloud documentation.
```bash
gsutil -m cp \
"gs://smp-airgap-bundles/harness-0.35.10/ccm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.10/cdng_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.10/ce_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.10/cet_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.10/ci_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.10/ff_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.10/platform_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.10/sto_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.10/iacm_images.tgz" \
"gs://smp-airgap-bundles/harness-0.35.10/idp_images.tgz" \
.
```
````
**Option 2: Using `curl`**
````
You can also download the images directly using curl:
```bash
curl -f -s -L -o smp-airgap-bundles/ccm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.10/ccm_images.tgz
curl -f -s -L -o smp-airgap-bundles/cdng_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.10/cdng_images.tgz
curl -f -s -L -o smp-airgap-bundles/ce_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.10/ce_images.tgz
curl -f -s -L -o smp-airgap-bundles/cet_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.10/cet_images.tgz
curl -f -s -L -o smp-airgap-bundles/ci_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.10/ci_images.tgz
curl -f -s -L -o smp-airgap-bundles/ff_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.10/ff_images.tgz
curl -f -s -L -o smp-airgap-bundles/platform_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.10/platform_images.tgz
curl -f -s -L -o smp-airgap-bundles/sto_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.10/sto_images.tgz
curl -f -s -L -o smp-airgap-bundles/iacm_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.10/iacm_images.tgz
curl -f -s -L -o smp-airgap-bundles/idp_images.tgz https://app.harness.io/public/harness-airgap-bundle/harness-0.35.10/idp_images.tgz
```
````
{% hint style="info" %}
**Note**
Ensure that the `smp-airgap-bundles/` directory exists before running the command.
{% endhint %}
**Fixed issues**
**Harness Platform**
* Resolved an issue where deleting a user now also removes them from all child scopes. \[PL-65635]
* Resolved an issue that now allows users to right-click and select "open link in new tab," or use Cmd+click or middle mouse click to open pages from the settings page in a new tab without leaving the current one. \[PL-65502]
* Resolved an issue where deleting a dashboard from the UI did not remove it from the dashboard listing page. This has been fixed and now dashboards are now correctly removed from the list when deleted or moved to the trash. \[PL-64817]
* Fixed an issue that used the restricted keyword "organizations" as an identifier for when creating folders, but editing and deleting operations caused an issue. Now, no [restricted keywords can be used as identifier](/release-notes/platform.md#important-feature-change-notice). \[PL-67141]
**GitOps**
* Resolved an issue in GitOps instance deletion where simultaneous deletion of all pods for a service, project, or organization was not reflected in the instance summaries for services and environments. \[CDS-114318]
**Important Update - GitOps MongoDB User Permissions**
To prevent deployment failures during MongoDB migration, the GitOps MongoDB user now requires extended permissions:
* **For standard MongoDB deployments**: The GitOps user must have the `dbAdminAnyDatabase` role
* **For MongoDB Atlas deployments**: The GitOps user must have the `atlasAdmin` role
This is required because MongoDB migration executes `collMod` operations on the applications collection. Without these extended permissions, the gitops-service will fail to deploy.
**Action Required**: Update your GitOps MongoDB user permissions before upgrading to ensure successful deployment.
**Continuous Delivery**
* Fixed an issue where account-level templates could have duplicate identifiers and multiple stable versions, leading to conflicts and unexpected behavior. This has been resolved to ensure template identifiers are unique and only one stable version exists per template. \[PIPE-30923, ZD-97931, ZD-98071, ZD-99525]
* Fixed an issue where post-production rollback failed when selecting an environment from the pipeline execution page. The rollback workflow now correctly handles environment selection during the post-production rollback process. \[CDS-117023, ZD-98881]
* Fixed an issue where the Wiz security scanning step was failing intermittently in containerized step groups. This occurred because the StageId was being generated as a UUID, which caused regex matching failures for the STO API calls. The StageId is now set to the stage name for consistent behavior. This fix is behind the feature flag `CDS_CONTAINER_STEP_USE_STAGE_IDENTIFIER`. Contact Harness Support to enable it. \[CDS-116801, ZD-98547, ZD-98911]
* Fixed an issue where Azure ARM Template deployments failed with NPE (Null Pointer Exception) and template parsing errors when no parameters file was provided. The parameters file field is now optional. \[CDS-116706, ZD-98571]
* Fixed an issue where the GAR (Google Artifact Registry) artifact runtime package path was being returned in an encoded format, causing pipeline failures. The package value is now properly decoded to display correct values in the UI. \[CDS-116703, ZD-98357]
* Resolved a race condition in `getGlobalFreezeSummary` caused by concurrent creation of the same global freeze, resulting in `DuplicateEntityException`. This was addressed by adding exception and verified the fix with unit tests. \[CDS-116402]
* Enhanced unresolved expression error reporting by including contextual details for errors originating in custom secret manager scripts. \[CDS-112390]
**Internal Developer Portal**
* Added support for storing Jenkins plugin secrets in non-Harness secret managers for the IDP Jenkins Plugin. \[IDP-7287]
* The `cloneCodebase` option has been hidden for `idpStage`, which was earlier introduced for the IDP module.\[IDP-7223]
**Cloud Cost Management**
* Improved the billing export experience by showing billing setup steps when adding a new export, even if other features are selected. Added visibility into the service account used for Inventory. Additionally, when billing data is sourced from an existing connector, users are now required to select at least one additional feature to continue. \[CCM-28120]
* Connector validation may fail for newer AWS regions due to limitations in the current AWS SDK version. This does not affect synchronization, which continues to function correctly. As a workaround, you can specify the region using the YAML builder. \[CCM-28018]
* BI Dashboards:
* Unified Cost has been updated to use Cost After RI Chargeback when cloud provider is AWS.
* Fixed discounting of cluster cost in all the total cost measures. \[CCM-29070]
**New Features and Enhancements**
**Harness Platform**
* The Renewal Interval (minutes) field has been removed from the App Role authentication method in the HashiCorp Vault connector, as token caching now depends solely on the vault's native TTL. This change enhances clarity and eliminates an unnecessary setting. \[PL-66935]
* Improved audit logging now captures failed login attempts across all authentication methods, offering improved visibility into security events. \[PL-66585]
* The embedded MongoDB version in Harness SMP has been updated to address CVE-2025-14847 (MongoBleed), a high-severity vulnerability that could permit unauthenticated memory disclosure and potential data leakage. \[PL-67625]
### Older releases
Go to [Older Self-Managed Enterprise Edition releases](/release-notes/self-managed-enterprise-edition/self-managed-enterprise-edition.md) for 2025, 2024, and earlier release notes.
{% @harness-feedback/feedback module="release-notes" pagePath="release-notes/self-managed-enterprise-edition" %}