Arcade 1.8.12

App version 89de7b5 · released 2026-06-25 · previous 1.8.11

Release notesUpgrade notesInstallMigrationsImagesSBOMsVulnerabilitiesEvent registry

Release notes

Security

  • OAuth flow cookies now expire after 1 hour instead of 7 days.

Added

  • Audit logging configuration added.
  • Microsoft OneDrive toolkit: 11 tools for browsing, searching, and sharing OneDrive files and folders.
  • Telegram toolkit can now wait for new incoming messages and present inline-button prompts.
  • Google Drive toolkit: new check_file_access pre-flight probe reports access before an operation, and the file picker accepts a file_types filter.

Changed

  • Google Docs SearchAndRetrieveDocuments runs at a lower default cost, returning more results within the same budget.

Fixed

  • MCP just-in-time tool authorization resolves and seeds OAuth scopes correctly, so tools requiring scoped auth no longer challenge with empty scopes.
  • Jira SearchIssuesWithoutJql no longer fails with invalid-JQL or resolution errors.
  • Linear resolves projects by UUID and returns clearer not-found guidance.
  • Linear get-by-id tools return a graceful not-found instead of an error when the entity is missing.
  • Gmail UpdateDraftEmail guardrail failures are now retryable.

Operator impact

  • This release rolls every app image to appVersion 89de7b5.
  • Audit logging is enabled by default. The engine publishes audit events and the coordinator persists them to its database, retained for 30 days. Tune or disable it under features.auditLog (enabled, retentionDays, streamMaxLen, cleanupWindow). It buffers events through the chart's existing Redis dependency — no new infrastructure to provision.
  • No secret, RBAC, or Kubernetes-version changes are required.

API & behavior

  • New worker toolkit: Microsoft OneDrive (11 tools).
  • New worker tool: check_file_access (Google Drive); the Drive file picker accepts a file_types filter.
  • Telegram tools can block waiting for new messages and drive inline-button prompts.
  • Google Docs SearchAndRetrieveDocuments defaults to a lower cost.
  • MCP just-in-time tool authorization seeds and resolves scopes from the default credential at challenge time.
  • OAuth flow cookies expire after 1 hour.