Arcade 1.10.1

Do not treat the patch number as a safe upgrade. This release renames a Secret, adds three values, and changes four tool contracts. If you resolve the chart through a range such as ~1.10.0 you will pick it up automatically — pin an exact version until you have read the Upgrade notes.

This release applies schema changes. Migrations run automatically on helm upgrade unless <service>.database.migrations is false.

• Engine — a renewal claim and version stamp on the stored OAuth credential tables. Required by the concurrent-renewal fix below.
• Engine — an exchange claim on the remote-MCP authorization request table. Required by the double-redeem fix below.
• Engine — two tables for gateway suggestions and supporters. Not required by anything else here; nothing reads them yet, but the upgrade runs the DDL.
• Coordinator and experience-api — none.

All three are additive, so nothing is rewritten and no meaningful lock is held. Rolling back does not run down-migrations; the new columns and tables stay and the previous engine image ignores them.

• A JWKS response marked no-store is no longer retained and re-served on a later failed refresh. A client could not previously use no-store to stop an old key being accepted once its key server became unreachable — the situation while rotating away from a compromised key.
• Concurrent credential renewals no longer replay an already-exchanged refresh token, and one remote-MCP authorization code is no longer redeemed twice. An authorization server implementing replay detection reads either as theft and revokes the whole grant, so both were silently destroying working connections.

Advisories remediated in the bundled application images since bc1509f:

• CVE-2026-39821 (GO-2026-5026) — Go standard library; bundled OpenFGA server rebuilt on go1.26.8 at v1.20.0
• CVE-2026-63072 — openssl 3.5.8-r0 in the dashboard nginx runtime image
• CVE-2026-84304 — google.golang.org/grpc 1.83.1
• CVE-2026-84445 — google.golang.org/grpc 1.83.2
• GHSA-5278-rrxc-mgf7 — OpenFGA server v1.19.0
• GHSA-vp52-pcj8-j9qc — grpc-health-probe v0.4.57, in the OpenFGA image

• Tools can carry a user interface. The engine reads MCP resources from an HTTP worker and preserves a tool's _meta, so a client that can render an interface receives one. The Math toolkit ships the first. Interfaces stay off the REST tool responses.
• experienceApi.publicCatalog.enabled serves credential-free branded tool catalog endpoints at /api/public/tool_catalog and /api/public/tools. Default false, and engine.publicCatalog.enabled must be on too. …metadataUrl defaults to the Arcade design-system CDN — repoint it for a private deployment. A branding outage degrades to null metadata; an engine outage returns 503.
• postgres.directHost / .directPort, plus per-service <service>.database.directHost / .directPort, name an endpoint reaching PostgreSQL directly past a pooler. Set them when host is PgBouncer in transaction pooling mode: migrations take a session-scoped advisory lock and CREATE DATABASE needs the postgres database, and a transaction pooler provides neither. Each falls back to host/port.
• engine.toolsListPageSize — tools per MCP tools/list page. 0 (default) keeps the engine's own default of 100.
• encrypt-execution-payloads converts tool-execution rows recorded before payload encryption was enabled, and rekey --payload-to-key rotates the two execution tables onto a new payload key.
• delete-account performs a GDPR/CCPA deletion across the identity provider, the messaging platform and both databases, dry-run until --commit.
• Every Outlook Mail and Calendar tool publishes an outputSchema. They returned an untyped object before, so a model could not see that a listed event carries an id without guessing.

• Gateway bootstrap runs in its own Job. See Upgrade notes.
• A job spanning two services reports itself not ready when either is unauthorized. It previously returned the authorized half and appended the authorization link, and agents pushed on about 90% of the time — answering from partial data while the link went stale.
• The bundled OpenFGA server moves from v1.18.3 to v1.20.0. No schema change, so the migration is a no-op and rollback is unconstrained.
• An invitation to an existing project member is refused whatever the casing or stray whitespace of the address typed. It was previously accepted whenever the spelling differed from the stored one, sending a real email and listing the person under both Members and Pending invitations.
• Shipped example configs source payload keys from paired EXECUTION_PAYLOAD_KEY_<n>_NAME / _VALUE variables, so a rotation adds a slot instead of editing one. The chart's own rendering is unchanged.
• The post-install notes no longer tell every operator to backfill authorization grants on 1.9.8 — that applies only to organizations never enrolled in operator RBAC.

• Two callers needing the same expired credential no longer destroy it. Both presented the same refresh token; where the server rotates them, the second presentation is of an already-exchanged token, indistinguishable from a stolen one, so the whole grant is revoked. Renewal is now claimed once and rejected if the credential moved underneath it. Affects tool authorization and remote MCP.
• Authorizing a remote MCP server no longer reports success then 401s every tool fetch. Waiters on several replicas adopted the same pending request and each redeemed the same single-use code. The exchange is now claimed once.
• Every OAuth-protected remote MCP server reported no valid token available, authorization required on every status poll, whatever was stored. Two causes: the authorize handler looked for a server-wide default credential rather than the caller's and built a client with no token store, and the OAuth-detection probe swapped in a throwaway client and never swapped it back. The message was manufactured locally — the credential was never read and the remote never contacted.
• The "Waiting for Authorization" spinner resolves, and the servers list stops showing Pending Auth beside authorized servers. With no status read available, waiters re-sent the authorize request, which rediscovered scopes and minted a second flow that replaced the one being polled.
• One unreachable server no longer stalls the whole servers page. Requirements are read in parallel under a short deadline, the renewal wait is sized for the call it makes, and an unreachable server renders with blank requirements while the rest of the list loads.
• Authorizing any Google tool could fail with no usable reason. GoogleDrive.SearchDrive requested a broad Drive scope unconditionally instead of honouring ARCADE_GOOGLE_DRIVE_SCOPE_MODE, and the shared Arcade Google OAuth app is not verified for it. Tool scopes are combined into one challenge, so that single tool made it refusable for every Google tool in the request, surfacing only as provider_unavailable. Removing the tool is the fix; set ARCADE_GOOGLE_DRIVE_SCOPE_MODE=full via workers[].extraEnv if you run your own verified OAuth app.
• Two engine replicas could claim the same due scheduled execution and run it twice. Only affects executions queued before this release — which are exactly the rows draining during the upgrade.
• Both the engine and the coordinator survive PgBouncer in transaction pooling mode. Neither disabled prepared-statement caching, producing intermittent prepared statement ... does not exist failures under load. Session-scoped work now routes to the direct endpoint.
• The custom-verifier test on the User Verification page no longer reports success for any URL you paste, including one that does not exist. The URL was never contacted — the flow completed against the signed-in tester's own address. It now fails after 90 seconds if nothing confirms.
• An MCP worker returning tool-result content the engine cannot represent gives a tool-level failure instead of a 500 that paged on-call.
• Outlook Calendar event windows no longer shift by an hour across a daylight-saving boundary. The offset came from the server clock rather than the date asked about. The shared Microsoft timezone handling was reworked underneath, so displayed times may shift for mailboxes that were wrong before.
• Engine SQL is visible in Datadog again — the statement text was recorded under a nested key rather than the scalar one dashboards read.
• Experience-api log records carry trace_id and span_id, closing the one hop where log-based trace correlation died.
• classification.service_domains is returned again by the public tools endpoint; it had been dropped from every tool.
• GitHub review comments attach to the pull request's current head rather than a commit from a paginated list, and a reply that succeeds while its thread resolution fails says so instead of inviting a duplicate.
• engine.extraConfig no longer silently produces an unstartable engine, and helm rollback works again across this chart version.
• The generated-keys Secret is no longer deleted and recreated on every upgrade.

• run_at on the tool-execute endpoint.
• GitHub's page and per_page arguments across every list and search tool.
• Linear's separate issue-only label listing.
• Outlook Mail's ListEmailsInFolder, ListEmailsByProperty, CreateDraftEmail and UpdateDraftEmail, each with its shared-mailbox twin.
• GoogleDrive.SearchDrive.

• Encryption keys move to <release>-encryption-keys. Anything reading the old name by string — External Secrets configs, runbooks, backup scripts — needs updating.
• New values, all defaulting off or inert: experienceApi.publicCatalog.*, postgres.directHost / .directPort (and per-service equivalents), engine.toolsListPageSize.
• engine.extraConfig is validated at render time; rbac.enabled: true renders again.
• engine.gatewayBootstrap.enabled: true renders a second Job and reconciles gateways after the release is applied rather than before.
• Three additive engine migrations, two of them required.
• Slack users must re-authorize; GitHub, Linear, Outlook Mail and Google Drive callers must migrate.

• POST /v1/tools/execute with run_at: 400 malformed_request.
• GET /v1/public/tools returns classification.service_domains again.
• New anonymous /api/public/tool_catalog and /api/public/tools on the experience API, off by default.
• Unrepresentable MCP tool-result content: tool-level failure, not 500.
• GitHub list and search: limit/offset with next_offset.
• Linear label tools: routed by label_type.
• A tool needing two services reports the whole job unauthorized when either is.