Arcade 1.9.0

App version 0e27ed6 · released 2026-07-02 · previous 1.8.13

Release notesUpgrade notesInstallMigrationsImagesSBOMsVulnerabilitiesEvent registry

Release notes

Added

  • Optional operator RBAC (OpenFGA). Set rbac.enabled=true to deploy an in-cluster OpenFGA policy decision point, provision its authorization store, and enforce fine-grained per-organization authorization. Off by default — a default install is unchanged.
  • Microsoft Excel toolkit (10 tools).
  • Insightly CRM toolkit (29 tools).
  • Fireflies.ai meeting-intelligence toolkit.
  • Google Calendar respond_to_event tool for meeting RSVPs.
  • When RBAC is enabled, the dashboard reflects each caller's effective permissions: project/org edit affordances, member and invitation role management, API-key write actions, and project create/delete are gated.

Changed

  • Project and organization endpoints return can_edit / can_invite capability hints so permission-aware UIs can show or hide actions per caller.
  • Org-wide /capabilities is gated on membership; when RBAC is not enabled for an org it reports the full permission set.
  • The MCP gateway session TTL is configurable.

Fixed

  • Non-dev HTTP error responses match their status code.

Security

  • Org-wide audit logs are restricted to organization owners/admins.

Operator impact

  • New rbac.* values (off by default). When enabling RBAC, install/upgrade without helm --wait (the OpenFGA store is provisioned by a post-install hook the coordinator waits on), then enable enforcement per organization via the coordinator CLI. See the chart README.
  • appVersion moves to 0e27ed6, shipping current coordinator / engine / worker / dashboard / experience-api images.

API & behavior

  • can_edit / can_invite capability hints on project and org endpoints.
  • /capabilities is membership-gated (full set reported when RBAC is off).
  • Org-wide audit-log reads limited to owners/admins.