Arcade 1.8.5

App version 5b6043d · released 2026-06-03 · previous 1.8.4

Release notesUpgrade notesInstallMigrationsImagesSBOMsVulnerabilitiesEvent registry

Release notes

Added

  • User Source supports configurable upstream OIDC scopes per source. New sources default to openid profile email; existing sources are backfilled to today's openid behavior. Unblocks Microsoft Entra ID flows that require profile to receive the oid claim.
  • Worker ships a Resend transactional email toolkit (send_email, get_email, update_email, cancel_email). Authenticates via the RESEND_API_KEY secret.
  • Outlook Mail toolkit adds move_email_to_folder and shared_mailbox_move_email_to_folder for moving messages by well-known folder name or custom folder ID.
  • Coordinator emits audit events for User Source create, update, and delete. A new AuditContext framework propagates audit_source, caller_identity, and client_ip without threading them through service-method signatures.
  • ChatGPT is selectable in the dashboard MCP gateway client picker alongside Claude, Cursor, Goose, VS Code, and Codex.

Changed

  • Primary brand color swapped from red to lime across the UI and server-rendered templates; a new --link token replaces ad-hoc link styling.

Fixed

  • Helm chart normalizes a bracketed global.bindAddress ([::]) so Python listeners (coordinator, worker) receive the unbracketed form their getaddrinfo callers require, while Go listeners keep the bracketed form. Resolves CrashLoopBackOff on IPv6 and dual-stack clusters.
  • The "sign out and return to login" button on the /auth-error page now redirects to the dashboard's /login (previously a 404). The chart auto-templates the new DASHBOARD_PUBLIC_URL env from the existing dashboard URL helper.
  • OIDC sign-in form action is built from BASE_URL rather than the inbound request, so self-hosted deployments behind a TLS-terminating reverse proxy no longer redirect users to an internal pod URL the browser cannot reach.
  • Mixed-case user emails are now validated correctly during tool calls, where they were previously rejected.
  • Dashboard slugifies the gateway name when generating the claude mcp add command, so gateways whose display name contains spaces (e.g. My Gateway) produce a valid identifier (my-gateway).

Operator impact

  • No values.yaml changes required. The new experience-api DASHBOARD_PUBLIC_URL env is templated automatically from the existing dashboard URL helper.
  • IPv6 / dual-stack operators previously setting global.bindAddress: "[::]" no longer need to work around Python crashloops — the chart now normalizes per language.
  • New worker toolkit secret: set RESEND_API_KEY if you want the Resend toolkit available to agents.

API & behavior

  • Worker exposes a Resend toolkit and two new Outlook Mail move-email tools.
  • User Source CRUD now produces audit events; downstream consumers of the audit stream will see new resource entries.
  • OIDC sign-in form action URL is derived from BASE_URL, not the request.
  • Dashboard MCP picker registry adds a ChatGPT entry.