Arcade 1.8.7

App version 01a49f0 · released 2026-06-09 · previous 1.8.6

Release notesUpgrade notesInstallMigrationsImagesSBOMsVulnerabilitiesEvent registry

Release notes

Security

  • Experience-api proxy: block absolute-URL SSRF — proxy targets must be relative paths.
  • Worker (MongoDB toolkit): block $function and $accumulator aggregation operators that allowed server-side JavaScript execution.
  • Engine: Playground and other Arcade-identity-authenticated callers always use the Arcade verifier — a project-configured custom verifier URL is ignored for these flows. MCP account callers authenticated via the Intermediate AS continue to honor the project's custom verifier.

Added

  • Coordinator: operator-configurable allowlist of trusted OAuth/OIDC metadata hosts that bypass the public-IP SSRF gate. Set auth.trustedOauthHosts to a list of scheme://host[:port] entries for IDPs reachable only via PrivateLink or split-horizon DNS.
  • Worker: new toolkits — DiscordBot (20 tools, bot-token auth), Datadog observability, Vercel (23 tools), Customer.io, Apollo.io sales intelligence, Freshdesk customer support, and Ashby recruiting/ATS.
  • Worker (Google Sheets toolkit): create_or_edit_spreadsheet typed batch create-or-edit engine, and GetSpreadsheetEditHistory for spreadsheet revision history.
  • Worker (Gmail toolkit): local file attachments work end-to-end in Cursor and other MCP clients.

Changed

  • Worker (Google Sheets toolkit): inspect_spreadsheet replaces get_spreadsheet and get_spreadsheet_metadata. The new tool has a structure mode for a cheap workbook overview and a read mode with server-side filters, column projection, markdown/CSV/TSV export, a next_range pagination cursor, and a cell-budget guard for oversized tabs. See Upgrade notes.
  • Worker (Google Flights toolkit): SearchFlights returns booking deep links alongside fare data.

Fixed

  • Experience-api: fix OpenTelemetry initialization bug on boot.
  • Dashboard: static loader matches the configured brand and theme.
  • Dashboard: selected server-type tab is readable in dark mode.
  • Dashboard: brand-accent text is readable in light mode.

Removed

  • dashboard.byoaUi Helm value. See Upgrade notes.
  • Worker (Google Sheets toolkit): legacy get_spreadsheet and get_spreadsheet_metadata tools. See Upgrade notes.

Operator impact

  • New optional Helm value: auth.trustedOauthHosts (default []). Required for IDPs reachable only via PrivateLink or split-horizon DNS.
  • Removed Helm value: dashboard.byoaUi. Drop from any overrides — Helm silently ignores it.
  • No other values.yaml changes are required to upgrade.

API & behavior

  • Google Sheets tool surface changed — inspect_spreadsheet replaces get_spreadsheet and get_spreadsheet_metadata. New create_or_edit_spreadsheet and GetSpreadsheetEditHistory tools available.
  • Google Flights SearchFlights results include booking deep links.
  • Arcade-identity-authenticated OAuth flows (Playground) ignore project-configured custom verifier URLs; MCP account callers via the Intermediate AS are unaffected.