Arcade 1.7.0

App version 52e5f4c · released 2026-05-21 · previous 1.6.1

This release has upgrade notes

Read the upgrade notes before upgrading: they list what you must do before or during the upgrade.

Release notes

BYOA User Source verification harness — Coordinator now ships a verification flow for validating customer-managed identity providers registered as a User Source.
OIDC discovery validation for User Sources — issuer is validated against the OIDC discovery document on create and update.
consent_skip_client_ids in Protected Resource Metadata — the engine advertises the allowlist in PRM so clients can discover the bypass without round-tripping the consent page.
Operational and product telemetry for User Source / Gateway OAuth — coverage now spans both observability and product analytics.
Correlation IDs on every log line — emitted by the shared telemetry middleware across all Python services.
Engine --create-db flag — engine can skip CREATE DATABASE on startup when the database is provisioned out-of-band (e.g., a managed Postgres instance).
<service>.database.create values flag — already added in v1.6.1; entry re-emitted here because the v1.6.1 annotation was rejected by Artifact Hub.
Gateway connect UI in @arcadeai/ui-kit — the connect surface now lives in the shared UI kit with an MCP URL option and quick-install buttons, enabling reuse outside the dashboard.

Confluence toolkit — list_direct_children replaces the previous full-hierarchy fetch, reducing API load and improving response time on large spaces.
Per-service database block — already changed in v1.6.1; entry re-emitted here because the v1.6.1 annotation was rejected by Artifact Hub. See 1.6.1.md [blocked] for migration details.

Consent page honors the consent_skip_client_ids allowlist — v1.6.0 advertised the allowlist as shipped, but the consent page did not actually apply it. v1.7.0 wires the allowlist into the consent flow so allowlisted clients bypass the prompt end-to-end.
Coordinator Gateway API health check — now targets the correct endpoint and the dashboard receives the public engine URL via templated values.
MCP authorization endpoint query merging — query strings on the upstream authorization_endpoint are preserved when the engine appends its own parameters.
Dashboard Select trigger label rendering — the trigger now shows the option's label instead of its underlying value.
Server authorization_url clearing — emptying the field in the dashboard now persists the empty value instead of silently retaining the previous one.
Confluence list_direct_children import — switched to typing_extensions.TypedDict so the worker can load the tool on older Python runtimes.
Default environment value — already fixed in v1.6.1; entry re-emitted here because the v1.6.1 annotation was rejected by Artifact Hub.

<service>.migration.enabled — already deprecated in v1.6.1; entry re-emitted here because the v1.6.1 annotation was rejected by Artifact Hub. Switch overrides to <service>.database.migrations. The legacy field is still read as a fallback when the new field is unset.

No new values-schema changes in v1.7.0 itself. The v1.6.1 changes (<service>.database block, <service>.migration.enabled deprecation, default environment of pro) still apply if you are upgrading from a pre-v1.6.1 chart.
No RBAC, secret, or Kubernetes-version changes.
appVersion bumped from dc80c89 to 52e5f4c, picking up the app changes that landed on main since v1.6.0/v1.6.1 (coordinator, engine, dashboard, ui-kit, worker, telemetry).

Engine PRM payload now includes consent_skip_client_ids URN entries for allowlisted clients.
Consent page applies the consent_skip_client_ids allowlist so allowlisted clients bypass the prompt end-to-end.
MCP authorization endpoint URL construction preserves an existing query string on the upstream endpoint.