Arcade 1.8.4

App version 791f93c · released 2026-05-30 · previous 1.8.3

Release notesUpgrade notesInstallMigrationsImagesSBOMsVulnerabilitiesEvent registry

Release notes

Added

  • Pod and container securityContext overlays (podSecurityContext, containerSecurityContext) applied to every workload, Job, and init container. Defaults make the chart PSS-restricted-friendly (runAsNonRoot, readOnlyRootFilesystem, dropped capabilities, RuntimeDefault seccomp) once enabled; the dashboard nginx container ships writable emptyDirs so readOnlyRootFilesystem doesn't break it. Default off.
  • NetworkPolicy template (networkPolicy) with default-deny plus ingress allow-lists for namespace and pod labels, and an egress CIDR allow-list. Default off.
  • PodDisruptionBudget templates (pdb) for the core Deployments and a shared PDB covering all workers in the release. minAvailable is shared. Default off.
  • Managed-Postgres CA bundle (postgres.caBundle, postgres.sslRootCert) so sslmode=verify-full works against Aurora/RDS.
  • jobs.activeDeadlineSeconds — single override for the migration, seed, and reconcile Job deadlines. 0 keeps each Job's built-in default (300s/600s).
  • engine.environment — per-service environment override that falls back to the top-level environment when unset.

Security

  • Google Drive UploadFile validates and DNS-pins the source_url before fetching, rejecting URLs that resolve to internal, link-local, or cloud-metadata addresses. This blocks server-side request forgery from a crafted upload URL.

Fixed

  • SSO just-in-time provisioning now marks the first member of a brand-new organization as its owner. Previously an org bootstrapped entirely through SSO ended up with no owner, leaving owner-gated actions (member management, etc.) unusable.
  • PowerPoint and SharePoint slide titles and bodies now render markdown — bold, italic, links, inline code, headers, and code fences — instead of inserting the literal markup characters.

Operator impact

  • Every hardening overlay added in this release is default off. With unchanged values, helm template output is structurally identical to 1.8.3 — existing installs are unaffected until they opt in. No migration is required.
  • If you enable both postgres.caBundle and mtls.enabled, the chart fails template-time. Node services only support one NODE_EXTRA_CA_CERTS, so the two paths are mutually exclusive — pick whichever your environment needs.
  • SSO-only organizations created on 1.8.4+ get a first owner automatically. Orgs that were already provisioned ownerless on an earlier version are not retroactively updated by this change.

API & behavior

  • Google Drive UploadFile rejects internal/metadata source_url targets with a generic error (details go to the developer message).
  • Slide-creation tools (PowerPoint, SharePoint) interpret markdown in titles and bodies; unsafe link schemes fall back to plain text.