Arcade 1.8.6

App version 5684cc4 · released 2026-06-04 · previous 1.8.5

Release notesUpgrade notesInstallMigrationsImagesSBOMsVulnerabilitiesEvent registry

Release notes

Added

  • Per-service telemetry overrides — each of engine.telemetryOverrides, experienceApi.telemetryOverrides, and coordinator.telemetryOverrides accepts logs, traces, metrics, otlpEndpoint, logLevel, logFormat, and logMaxBytes keys that override the global telemetry.* block on a per-pillar, per-service basis.
  • Google Calendar toolkit supports recurring events. create_event accepts a recurrence parameter and update_event accepts updated_recurrence, both taking RFC 5545 RRULE strings (e.g. RRULE:FREQ=WEEKLY;BYDAY=MO,WE,FR).
  • GitHub toolkit ships Github_SearchCode for cross-org code search via GitHub's /search/code endpoint, returning matched files with inline fragments.
  • Coordinator ships a new engine-identity-gated POST /v1/auth/internal/confirm_user endpoint as a feature-flagged parallel to POST /confirm_user. Disabled by default; enable by setting ENABLE_VERIFIER_CONFIRM_USER_ENDPOINT=true on the coordinator.

Changed

  • Engine: new worker deployments default to a 60s call timeout (was 10s), and the retries default now persists to the database (the dashboard previously displayed 0). Existing deployments are unchanged.
  • Google Flights toolkit rebuilt from a single one-way search into four tools: SearchFlights (one-way or round-trip with cabin, passenger, and connection filters), LookupFlight, MultiCity, and ResolveVendor. Existing SearchFlights callers will see a new request schema.

Fixed

  • Worker: Google toolkit outbound API timeouts capped at 30s so a slow tool call no longer holds the pod open past its SIGTERM grace period (which previously triggered a SIGKILL / exit-137).
  • Dashboard: project and organization rows no longer display 12/31/1969 — created_at is now threaded from the coordinator API response through to the project/org tables.

Security

  • Engine: SSE stream handlers (tool-execution and deployment-log streams) no longer emit a wildcard Access-Control-Allow-Origin: * header. CORS is now handled exclusively by the engine's global middleware; existing operator CORS configuration is unaffected.
  • Coordinator: SSRF guard added to the JWKS URI fetch path. In non-dev environments the coordinator rejects JWKS URIs that resolve to private or loopback addresses and bounds response bodies at 1 MiB, preventing memory exhaustion from hostile or misconfigured identity providers.

Operator impact

  • No values.yaml changes required to upgrade. The new <service>.telemetryOverrides block is opt-in — leaving it unset preserves the global telemetry.* behavior from 1.8.5.
  • New worker deployments created under 1.8.6 get a 60s call timeout and a persisted retry default; deployments created under 1.8.5 or earlier keep their existing values.
  • The new /v1/auth/internal/confirm_user endpoint is disabled by default. Operators deploying in-cluster verifier sidecars must set ENABLE_VERIFIER_CONFIRM_USER_ENDPOINT=true on the coordinator to activate it.
  • The SSRF guard and CORS hardening are transparent for standard deployments — no configuration changes are required.

API & behavior

  • Google Calendar create_event/update_event accept RRULE recurrence strings.
  • Google Flights surface expands from one tool to four; the existing SearchFlights request schema changes — agents calling it will need to re-bind to the new signature.
  • New worker tool Github_SearchCode.
  • Worker outbound Google API timeouts are now bounded at 30s.
  • New coordinator endpoint POST /v1/auth/internal/confirm_user (engine-identity-gated, feature-flagged off by default).
  • JWKS URI fetches now reject private/loopback addresses in non-dev environments; response body is capped at 1 MiB.