Breaking changes​

• Google Batch and Google Cloud compute environments now require a VPC network when Use private address is enabled, and Google Batch also requires a subnet. Both the compute environment form and the API reject a create or update request that enables private addressing without them. Previously, the environment was accepted and failed later at pipeline launch.

Feature updates and improvements​

Compute environments​

• Added the AWS r9gd instance family to the local NVMe list.
• Removed the Preview badge from Seqera Compute in the compute environment platform list.

Credentials​

• Removed the Beta notice from Azure Entra service principal credentials.
• Added a Set up Workload Identity Federation in GCP panel to Google Workload Identity credentials, listing the values to copy into your Google Cloud project: the OpenID Connect issuer URL, the google.subject mapping that makes Cloud Audit Logs trace activity back to the acting Seqera user, and a recommended attribute condition that pins the workload identity pool to your organization and workspace. The provider, service account email, and token audience fields moved to a Connect the federated identity panel.

Pipelines​

• Added deduplication of repeated GitHub webhook deliveries to an action, preventing a resend from launching the pipeline a second time. A delivery that cannot be recorded now returns 500, and GitHub offers the resend rather than reporting success.
• Added an audit log record for every action firing.
• Added a Created by column to the Actions list.
• Grouped the action form into Details, Trigger, and Target sections. The form omits the Trigger section for GitHub and Seqera sources, which a webhook endpoint drives instead.

Bug fixes​

Compute environments​

• Fixed Kubernetes, EKS, and GKE compute environment validation reporting every connection failure as Unexpected error while processing request, so connection timeouts, refused connections, DNS failures, TLS and certificate errors, and endpoints that are not a Kubernetes API server now each report what failed.
• Fixed GKE cluster discovery reporting a generic 400 for revoked keys, exceeded quotas, and unreachable API endpoints instead of the underlying Google Cloud error.
• Fixed compute environment validation reusing a cached client from a different compute environment, so correcting a field and resubmitting, or updating credentials, now validates against the new values.
• Fixed GKE compute environments that use Workload Identity Federation failing with a 500 when reading run logs or downloading files.
• Fixed Azure Cloud compute environment creation failing with an unexplained error when the credentials cannot read back a resource the forge has just created, so the error now names the resource and the missing read permission.
• Fixed pipeline additions against Tower Agent compute environments intermittently failing with Timeout waiting for command response.

Studios​

• Fixed Studios with mounted data links failing to start on Seqera Compute and on AWS Cloud, Azure Cloud, and Google Cloud compute environments.

Feature updates and improvements​

General​

• Added support for an authenticating egress proxy for outbound HTTP clients via the shared lib-util-net ProxyConfig by @pditommaso in #1125
• Changed env-var-overridable config properties to use kebab-case keys so they can be set from environment variables by @bebosudo in #1096
• Aligned the build toolchain and runtime to Java 25 while keeping the bytecode target at Java 17 by @cristianrcv in #1077
• Allowed the Claude review agent to submit approving PR reviews by @pditommaso in #1105
• Refreshed the self-install documentation by @christopher-hakkaart in #1106

Dependencies​

• Upgraded org.postgresql:postgresql to 42.7.12 (COMP-2149) by @cristianrcv in #1112
• Upgraded io.netty:netty-bom to 4.2.17.Final (COMP-2376) by @cristianrcv in #1135
• Upgraded the jib plugin to 3.5.4 for Java 25 class file support (COMP-2511) by @munishchouhan in #1136
• Updated node dependency to v24.19.0 by @seqeralabs-renovate[bot] in #1111
• Updated node dependency to v24.20.0 by @seqeralabs-renovate[bot] in #1122
• Updated node dependency to v24.21.0 by @seqeralabs-renovate[bot] in #1134
• Updated actions/checkout action to v4.4.0 by @seqeralabs-renovate[bot] in #1103
• Updated actions/checkout action to v6.1.0 by @seqeralabs-renovate[bot] in #1104
• Updated actions/setup-java action to v4.9.1 by @seqeralabs-renovate[bot] in #1108
• Updated actions/setup-java action to v5.7.0 by @seqeralabs-renovate[bot] in #1109
• Updated aws-actions/amazon-ecr-login action to v2.1.6 by @seqeralabs-renovate[bot] in #1102
• Updated aws-actions/amazon-ecr-login action to v2.1.7 by @seqeralabs-renovate[bot] in #1121
• Updated aws-actions/configure-aws-credentials action to v6.2.3 by @seqeralabs-renovate[bot] in #1110
• Updated aws-actions/configure-aws-credentials action to v6.2.4 by @seqeralabs-renovate[bot] in #1127
• Updated docker/login-action action to v4.6.0 by @seqeralabs-renovate[bot] in #1117
• Updated anthropics/claude-code-action action to v1.0.191 by @seqeralabs-renovate[bot] in #1101
• Updated anthropics/claude-code-action action to v1.0.198 by @seqeralabs-renovate[bot] in #1116
• Updated anthropics/claude-code-action action to v1.0.206 by @seqeralabs-renovate[bot] in #1120
• Updated anthropics/claude-code-action action to v1.0.213 by @seqeralabs-renovate[bot] in #1126
• Updated anthropics/claude-code-action action to v1.0.219 by @seqeralabs-renovate[bot] in #1133

Bug fixes​

Container building​

• Fixed Kubernetes builds being reported as failed on Kubernetes 1.36 and later even though the image was built and pushed (COMP-2368) by @munishchouhan in #1128
• Fixed PATH in the Pixi Docker template so commands resolve in OCI-to-SIF converted images by @munishchouhan in #1131

General​

• Fixed blob transfer jobs reporting success after uploading a 0-byte object by surfacing transfer errors when caching blobs (COMP-2142) by @stefanoboriero in #1100

Full changelog: https://github.com/seqeralabs/wave/compare/v1.37.0...v1.38.0

Feature updates and improvements​

Secrets​

• Migrated the workspace and user secrets lists to the shared row-card table already used by compute environments and credentials. Edit and Delete moved into the row's kebab menu, and the whole row opens the edit form for users with update permission.

Bug fixes​

Credentials​

• Fixed the inline credentials form in compute environment creation offering fewer options than the Credentials page. AWS supports role-based credentials with external ID generation, Google supports Workload Identity Federation, and Azure uses the same credential fields as that page.
• Fixed the row actions column reserving an empty strip in the compute environment and credentials lists for users without permission to act on the row.
• Fixed the credentials kebab menu opening an empty panel for users without permission to act on the row.

Pipelines​

• Fixed lineage resolution for resumed runs. Each run in a resume chain now shows its own Lineage ID, instead of every run in the chain showing the most recently indexed one. A resumed run shows - while it executes, then its own Lineage ID once it completes.

Feature updates and improvements​

Compute environments​

• Grouped compute environment selects by platform, listed the workspace primary environment first, and added an in-panel search that matches on name, region, and platform.
• Changed the pre-selected compute environment in launch forms from the alphabetically first environment to the workspace primary environment.

General​

• Removed the count badges from the Runs, Reports, Datasets, and Projects tabs.

Bug fixes​

Credentials​

• Fixed the Password field helper text on the GitLab and Gitea credential forms to state that a personal access token must be entered in both the Access token and Password fields, and that the Password field is required for Nextflow versions before 26.04.

Pipelines​

• Fixed the launch form to preserve the output directory when resuming a run, instead of publishing to the pipeline default.
• Fixed user-typed launch parameters being discarded when a config profile or revision change re-fetched the parameters.
• Fixed schema default parameters being dropped from the submitted parameters after selecting a config profile.
• Fixed nested parameter groups being submitted as null, which disabled Launch with no way to clear the error.

Feature updates and improvements​

Studios​

• Added filtering to the Studios list, with the selected filters persisted across navigation.

Compute environments​

• Added an OS disk size setting to Azure Cloud compute environments.
• Added an optional Region field to the Azure credential forms, with autocomplete suggestions and free-text entry for regions outside the catalog.

Pipelines​

• Added support for Nextflow v26.08.0-edge.
• Improved launch performance by reducing the number of SCM calls made on the launch path.

Data Explorer​

• Added search to the data link selector in the bucket action form.

Bug fixes​

Compute environments​

• Fixed false "region not found" warnings on Azure credentials by probing Azure Batch in the credential's own region instead of westeurope, and by validating Batch access on the compute environment rather than the credential.
• Fixed compute environment deletion being possible while creation was still in progress.
• Fixed the compute environment details page to redirect to the compute environment list after a deletion.
• Fixed forged Azure Cloud compute environments losing their Nextflow configuration.
• Fixed runs being flagged for attention when a UserData script failed.

Credentials​

• Fixed credential validation to back off and escalate probes that fail permanently, instead of retrying them at the same rate.

Monitoring and observability​

• Fixed the runs toolbar disappearing in loading and empty states.

Credits​

• Fixed the credits report download to show progress and offer a cancel control.

General​

• Fixed the default workspace preference not being cleared correctly.

Feature updates and improvements​

Language features​

• Added an agent primitive to run AI agents as first-class Nextflow tasks by @pditommaso in #7477
• Added syntax error reporting for an unexpected character in a gstring by @bentsherman in #7353
• Updated the formatter to preserve comments by @ewels in #7346

Configuration​

• Added the seqera.executor.maxCpusPerUser config option by @jonmarti in #7367
• Added the singularity.resourceLimits config option by @bentsherman in #7352
• Split CLI config handling out of ConfigBuilder by @bentsherman in #7373

S3​

• Dropped transient object tags when publishing files to S3 by @pditommaso in #7344

Kubernetes​

• Treated a missing k8s config scope as an empty one by @pditommaso in #7452

Plugins​

• Aligned the Seqera executor maxSpotAttempts and Fusion handling by @pditommaso in #7412
• Bounded Seqera executor scheduler requests with a request timeout by @pditommaso in #7466
• Stopped fabricating a memory request for the Seqera executor by @pditommaso in #7488
• Used the Platform user identity for the Seqera executor userName label by @pditommaso in #7413
• Used registry config for plugin repos by @jorgee in #7180

General​

• Accepted the http requesting protocol for HTTPS proxy CONNECT tunnel authentication by @bentsherman in #7369
• Added --console=plain to Gradle commands in the Makefile by @pditommaso in #7400
• Added componentName to the module view command output by @pditommaso in #7385
• Added a note about AI co-authorship to CLAUDE.md by @bentsherman in #7357
• Added smolvm container engine support by @pditommaso in #7386
• Added support for authenticated forward HTTP/HTTPS proxies across the client stack by @pditommaso in #7331
• Aligned the build to the Java 25 toolchain, targeting Java 17 via --release by @pditommaso in #7370
• Cached the task context for exec tasks by @pditommaso in #7499
• Documented the exit logic in the task wrapper script by @bentsherman in #7290
• Honored COLUMNS when determining ANSI output width by @Eldergenix in #7144
• Pre-pulled the integration tests container by @pditommaso in #7432
• Refactored HubOptions from a trait into a record by @bentsherman in #7372
• Removed dead SpuriousDeps.cmdCloud reflection by @bentsherman in #7371
• Reported the task directives read while the command is rendered by @bentsherman in #7506
• Separated the CLI from the runtime by @bentsherman in #5971
• Updated the CI bucket to s3://nextflow-oss-ci by @bentsherman in #7440
• Used the WireMock self-contained distribution in nf-tower by @pditommaso in #7485
• Used command -v instead of which in the launcher Java lookup by @pditommaso in #7433

Dependencies​

• Bumped Groovy 4.0.33 by @pditommaso in #7429
• Bumped Netty and Apache HttpComponents to patched releases by @pditommaso in #7484
• Updated the docs site dependencies to patched releases by @pditommaso in #7486

Bug fixes​

Language features​

• Fixed a function call in a process directive value with the v2 parser by @bentsherman in #7374
• Fixed lint reporting of excluded paths by @bentsherman in #7354
• Fixed a parameterized type cast in a process body by @bentsherman in #7382
• Fixed a variable incorrectly resolved to an included function name by @bentsherman in #7358

Configuration​

• Fixed config rendering of nested closures by @bentsherman in #7375
• Fixed plugin blocks incorrectly merged in the v2 config parser by @bentsherman in #7350

Azure​

• Fixed detection of Azure virtual directories without a trailing slash by @adamrtalbot in #6428

Wave​

• Fixed a spurious 'Unrecognized config option' warning for wave.build.compression and wave.build.conda by @pditommaso in #7355

General​

• Fixed cache invalidation for module binaries by @FloWuenne in #6914
• Fixed independently-verified findings from a security audit by @ewels in #7503
• Fixed a negative duration error on a short run by @bentsherman in #7351
• Fixed the PBS Pro server status query by @jscgh in #7366
• Fixed the publish mode override when re-publishing an existing file by @bentsherman in #7364
• Fixed a race condition calling workflow onComplete twice by @bentsherman in #7349
• Fixed tests failing on macOS and on hosts with NXF_REGISTRY_TOKEN by @pditommaso in #7457
• Fixed workflow metadata when failOnIgnore is true by @ehsanestaji in #7356
• Guarded the trace log against string formatting errors by @bentsherman in #7347
• Prevented a world-readable race window when storing local secrets by @aknownuser in #7307
• Reverted the stream swap after the redirect to .command.out and .command.err by @tcezard in #7300

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.08.0-edge

Feature updates and improvements​

Pipelines​

• Updated the bundled Nextflow version to 25.10.6.

Bug fixes​

Data Explorer​

• Fixed the IGV genome viewer failing to load reference genomes in Data Explorer by signing reference genome URLs.
• Fixed IGV genome viewer rendering in Data Explorer, which no longer depends on an externally hosted genome registry.
• Fixed IGV previews of Google Cloud Storage files in Data Explorer returning an authorization error, by signing those URLs with V4 signatures.
• Fixed IGV previews in Data Explorer failing at high zoom levels by signing index URLs independently of their data file URLs.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.

Feature updates and improvements​

Compute environments​

• Added an optional KMS key ARN to AWS Batch compute environments, so pipeline secrets in AWS Secrets Manager can be encrypted with a customer-managed key instead of the AWS-managed default.

Access control​

• Updated the copy and API URL chip on the Access tokens page.

General​

• Added the page number and search terms to paginated list URLs, so list state survives back-navigation and list URLs are shareable.

Bug fixes​

Compute environments​

• Fixed AWS Cloud head job failures returning an empty log page when the compute environment's IAM instance profile has no role attached.
• Fixed compute environment create and update accepting credentials already recorded as invalid or soft-deleted, and update resetting a credential's status without checking it.
• Fixed exhausted Google Cloud IAM retries to report a meaningful error, and added jitter to the retry backoff.

Data Explorer​

• Fixed tab flicker and a full-width action button in the file browser.
• Fixed IGV reference genome URLs not being signed, and corrected IGV rendering.
• Fixed an error when listing data in workspaces with auto-discovery disabled.

Monitoring and observability​

• Fixed the Runs tab pagination being scoped incorrectly on the project details page.
• Removed the ambiguous "last run" chips from the project header.

Feature updates and improvements​

Compute environments​

• Added a maxCpusPerUser setting to cap per-user vCPU usage in compute environments.
• Standardized head node instance type helper text across AWS, Azure, and Google Cloud compute environment forms.

Pipelines​

• Added support for Nextflow v25.10.6 and v25.10.7.

General​

• Removed the redundant Projects section from the workspace side navigation.

Bug fixes​

Studios​

• Fixed Studios row card horizontal scrolling when the sidebar is expanded on small screens.

Compute environments​

• Fixed GCP pipeline secrets to be pinned to the compute environment region.
• Fixed GCP IAM policy write conflicts during Forge compute environment creation.

Pipelines​

• Fixed shared pipeline resolution by passing the source workspace ID.

Datasets​

• Fixed dataset queries to exclude deleted runs.

Labels​

• Fixed generic label editing to no longer drop project labels.

Co-Scientist​

• Fixed the Co-Scientist portal web session link.

Feature updates and improvements​

Compute environments​

• Added support for private Azure Container Registry (ACR) image pulls on Azure Cloud.

Studios​

• Added the ability to display logs for the latest Studio run.
• Added support for applying custom CA configuration to Studios.

Co-Scientist​

• Added the ability to select Co-Scientist conversation history.
• Added page context and screenshot sharing to Co-Scientist chat.

Projects​

• Refined project details workflows.

Credits​

• Added audit log events for the self-serve credit purchase lifecycle.
• Added a root endpoint to cancel purchases stuck in the PENDING state.

General​

• Aligned the key-value date search filter hint with its control.

Bug fixes​

Compute environments​

• Fixed duplicated AWS Batch compute environments carrying a stale ec2KeyPair value by reconciling select values against loaded options.
• Prevented orphaned agent session-expiration tasks from flooding the scheduled task pool.

Studios​

• Fixed flickering of Studio environment variables.

Seqera AI​

• Surfaced the server error reason in Co-Scientist chat.

Security​

• Redacted tokens and secrets from application logs.

General​

• Fixed dark-theme issues from the semantic color token migration.