Breaking changes​

• Google Batch and Google Cloud compute environments now require a VPC network when Use private address is enabled, and Google Batch also requires a subnet. Both the compute environment form and the API reject a create or update request that enables private addressing without them. Previously, the environment was accepted and failed later at pipeline launch.

Feature updates and improvements​

Compute environments​

• Added the AWS r9gd instance family to the local NVMe list.
• Removed the Preview badge from Seqera Compute in the compute environment platform list.

Credentials​

• Removed the Beta notice from Azure Entra service principal credentials.
• Added a Set up Workload Identity Federation in GCP panel to Google Workload Identity credentials, listing the values to copy into your Google Cloud project: the OpenID Connect issuer URL, the google.subject mapping that makes Cloud Audit Logs trace activity back to the acting Seqera user, and a recommended attribute condition that pins the workload identity pool to your organization and workspace. The provider, service account email, and token audience fields moved to a Connect the federated identity panel.

Pipelines​

• Added deduplication of repeated GitHub webhook deliveries to an action, preventing a resend from launching the pipeline a second time. A delivery that cannot be recorded now returns 500, and GitHub offers the resend rather than reporting success.
• Added an audit log record for every action firing.
• Added a Created by column to the Actions list.
• Grouped the action form into Details, Trigger, and Target sections. The form omits the Trigger section for GitHub and Seqera sources, which a webhook endpoint drives instead.

Bug fixes​

Compute environments​

• Fixed Kubernetes, EKS, and GKE compute environment validation reporting every connection failure as Unexpected error while processing request, so connection timeouts, refused connections, DNS failures, TLS and certificate errors, and endpoints that are not a Kubernetes API server now each report what failed.
• Fixed GKE cluster discovery reporting a generic 400 for revoked keys, exceeded quotas, and unreachable API endpoints instead of the underlying Google Cloud error.
• Fixed compute environment validation reusing a cached client from a different compute environment, so correcting a field and resubmitting, or updating credentials, now validates against the new values.
• Fixed GKE compute environments that use Workload Identity Federation failing with a 500 when reading run logs or downloading files.
• Fixed Azure Cloud compute environment creation failing with an unexplained error when the credentials cannot read back a resource the forge has just created, so the error now names the resource and the missing read permission.
• Fixed pipeline additions against Tower Agent compute environments intermittently failing with Timeout waiting for command response.

Studios​

• Fixed Studios with mounted data links failing to start on Seqera Compute and on AWS Cloud, Azure Cloud, and Google Cloud compute environments.

Feature updates and improvements​

Secrets​

• Migrated the workspace and user secrets lists to the shared row-card table already used by compute environments and credentials. Edit and Delete moved into the row's kebab menu, and the whole row opens the edit form for users with update permission.

Bug fixes​

Credentials​

• Fixed the inline credentials form in compute environment creation offering fewer options than the Credentials page. AWS supports role-based credentials with external ID generation, Google supports Workload Identity Federation, and Azure uses the same credential fields as that page.
• Fixed the row actions column reserving an empty strip in the compute environment and credentials lists for users without permission to act on the row.
• Fixed the credentials kebab menu opening an empty panel for users without permission to act on the row.

Pipelines​

• Fixed lineage resolution for resumed runs. Each run in a resume chain now shows its own Lineage ID, instead of every run in the chain showing the most recently indexed one. A resumed run shows - while it executes, then its own Lineage ID once it completes.

Fusion v2.6.4 adds retryable and non-retryable exit codes for startup failures in NFS service mode, and new health and liveness metrics. It also fixes renamed directories and very large files on Google Cloud Storage.

How to pin this version​

fusion {
  enabled = true
  containerConfigUrl = 'https://fusionfs.seqera.io/releases/v2.6.4-amd64.json'
}

Feature updates and improvements​

NFS service mode​

• Added distinct exit codes for startup failures when Fusion runs as the NFS daemon and cannot complete its startup handshake with the control node. Fusion exits with 172 when the control node rejects the request, which is a configuration or permission problem that a retry cannot fix. Fusion exits with 173 for anything else, such as an unreachable or slow control node, and for ambiguous failures. Intelligent Compute relocates the task on 173 instead of aborting the run. See Exit codes 172 and 173.
• Added FUSION_NFS_READINESS_TIMEOUT to set how long Fusion waits for its work directory to become ready before it classifies the failure and exits. The default is 60 seconds.

Metrics​

• Added the fusion_health_* metric family to the per-task metrics file. It reports uptime, memory use split into non-overlapping categories, open file handles, cache device disk usage, mount initialization time, and shutdown flush time. Resource exhaustion is now visible after the fact.
• Added two liveness gauges that report how many file system requests are outstanding and the age of the oldest one. The age stays near zero when nothing is calling Fusion and climbs when Fusion has taken a request and not answered it. Use them to tell a stalled mount from an idle one.
• Published a schema and triage runbook for the metrics file. See Fusion task metrics.

Bug fixes​

General​

• Fixed a renamed directory dropping files and symlinks that were not yet uploaded.
• Fixed a "no such file" error on NFS daemon clusters for an input produced by another task.
• Fixed a retried task starting on leftovers from the previous attempt.
• Fixed .tbi, .csi, and .bai index files appearing older than the data they index.
• Fixed symlink targets longer than 2048 bytes being truncated on read.
• Fixed declared outputs with adjacent brace patterns being evicted at shutdown instead of persisted.
• Fixed a truncate or seek-write to an implausible offset exhausting memory and killing the mount, which is now rejected with a clear error.
• Fixed temporary files being uploaded while the task was still writing them, except on runs with snapshots enabled.

Google Cloud​

• Fixed corrupt results for very large files on Google Cloud Storage, roughly 128 GiB and above at the default chunk size.
• Added a check that rejects an object over the 5 TiB Google Cloud Storage per-object limit before uploading.

Dependencies​

• Reorganized the metrics collector, added a streaming upload endpoint on the control interface, and moved fusion-tracer onto it.
• Updated CI, build pipeline, and dependencies.

Upgrade notes​

• Drop-in replacement for v2.6.3. No configuration changes required.
• In NFS mode, fusion-tracer now sends its trace through the control interface and no longer falls back to writing it through the mount. A trace produced while the control node is unreachable is dropped. Tracing is unchanged when the control node is reachable.
• FUSION_NFS_READINESS_TIMEOUT is new and defaults to 60 seconds.

Feature updates and improvements​

Compute environments​

• Grouped compute environment selects by platform, listed the workspace primary environment first, and added an in-panel search that matches on name, region, and platform.
• Changed the pre-selected compute environment in launch forms from the alphabetically first environment to the workspace primary environment.

General​

• Removed the count badges from the Runs, Reports, Datasets, and Projects tabs.

Bug fixes​

Credentials​

• Fixed the Password field helper text on the GitLab and Gitea credential forms to state that a personal access token must be entered in both the Access token and Password fields, and that the Password field is required for Nextflow versions before 26.04.

Pipelines​

• Fixed the launch form to preserve the output directory when resuming a run, instead of publishing to the pipeline default.
• Fixed user-typed launch parameters being discarded when a config profile or revision change re-fetched the parameters.
• Fixed schema default parameters being dropped from the submitted parameters after selecting a config profile.
• Fixed nested parameter groups being submitted as null, which disabled Launch with no way to clear the error.

Feature updates and improvements​

Studios​

• Added filtering to the Studios list, with the selected filters persisted across navigation.

Compute environments​

• Added an OS disk size setting to Azure Cloud compute environments.
• Added an optional Region field to the Azure credential forms, with autocomplete suggestions and free-text entry for regions outside the catalog.

Pipelines​

• Added support for Nextflow v26.08.0-edge.
• Improved launch performance by reducing the number of SCM calls made on the launch path.

Data Explorer​

• Added search to the data link selector in the bucket action form.

Bug fixes​

Compute environments​

• Fixed false "region not found" warnings on Azure credentials by probing Azure Batch in the credential's own region instead of westeurope, and by validating Batch access on the compute environment rather than the credential.
• Fixed compute environment deletion being possible while creation was still in progress.
• Fixed the compute environment details page to redirect to the compute environment list after a deletion.
• Fixed forged Azure Cloud compute environments losing their Nextflow configuration.
• Fixed runs being flagged for attention when a UserData script failed.

Credentials​

• Fixed credential validation to back off and escalate probes that fail permanently, instead of retrying them at the same rate.

Monitoring and observability​

• Fixed the runs toolbar disappearing in loading and empty states.

Credits​

• Fixed the credits report download to show progress and offer a cancel control.

General​

• Fixed the default workspace preference not being cleared correctly.

Feature updates and improvements​

Language features​

• Added an agent primitive to run AI agents as first-class Nextflow tasks by @pditommaso in #7477
• Added syntax error reporting for an unexpected character in a gstring by @bentsherman in #7353
• Updated the formatter to preserve comments by @ewels in #7346

Configuration​

• Added the seqera.executor.maxCpusPerUser config option by @jonmarti in #7367
• Added the singularity.resourceLimits config option by @bentsherman in #7352
• Split CLI config handling out of ConfigBuilder by @bentsherman in #7373

S3​

• Dropped transient object tags when publishing files to S3 by @pditommaso in #7344

Kubernetes​

• Treated a missing k8s config scope as an empty one by @pditommaso in #7452

Plugins​

• Aligned the Seqera executor maxSpotAttempts and Fusion handling by @pditommaso in #7412
• Bounded Seqera executor scheduler requests with a request timeout by @pditommaso in #7466
• Stopped fabricating a memory request for the Seqera executor by @pditommaso in #7488
• Used the Platform user identity for the Seqera executor userName label by @pditommaso in #7413
• Used registry config for plugin repos by @jorgee in #7180

General​

• Accepted the http requesting protocol for HTTPS proxy CONNECT tunnel authentication by @bentsherman in #7369
• Added --console=plain to Gradle commands in the Makefile by @pditommaso in #7400
• Added componentName to the module view command output by @pditommaso in #7385
• Added a note about AI co-authorship to CLAUDE.md by @bentsherman in #7357
• Added smolvm container engine support by @pditommaso in #7386
• Added support for authenticated forward HTTP/HTTPS proxies across the client stack by @pditommaso in #7331
• Aligned the build to the Java 25 toolchain, targeting Java 17 via --release by @pditommaso in #7370
• Cached the task context for exec tasks by @pditommaso in #7499
• Documented the exit logic in the task wrapper script by @bentsherman in #7290
• Honored COLUMNS when determining ANSI output width by @Eldergenix in #7144
• Pre-pulled the integration tests container by @pditommaso in #7432
• Refactored HubOptions from a trait into a record by @bentsherman in #7372
• Removed dead SpuriousDeps.cmdCloud reflection by @bentsherman in #7371
• Reported the task directives read while the command is rendered by @bentsherman in #7506
• Separated the CLI from the runtime by @bentsherman in #5971
• Updated the CI bucket to s3://nextflow-oss-ci by @bentsherman in #7440
• Used the WireMock self-contained distribution in nf-tower by @pditommaso in #7485
• Used command -v instead of which in the launcher Java lookup by @pditommaso in #7433

Dependencies​

• Bumped Groovy 4.0.33 by @pditommaso in #7429
• Bumped Netty and Apache HttpComponents to patched releases by @pditommaso in #7484
• Updated the docs site dependencies to patched releases by @pditommaso in #7486

Bug fixes​

Language features​

• Fixed a function call in a process directive value with the v2 parser by @bentsherman in #7374
• Fixed lint reporting of excluded paths by @bentsherman in #7354
• Fixed a parameterized type cast in a process body by @bentsherman in #7382
• Fixed a variable incorrectly resolved to an included function name by @bentsherman in #7358

Configuration​

• Fixed config rendering of nested closures by @bentsherman in #7375
• Fixed plugin blocks incorrectly merged in the v2 config parser by @bentsherman in #7350

Azure​

• Fixed detection of Azure virtual directories without a trailing slash by @adamrtalbot in #6428

Wave​

• Fixed a spurious 'Unrecognized config option' warning for wave.build.compression and wave.build.conda by @pditommaso in #7355

General​

• Fixed cache invalidation for module binaries by @FloWuenne in #6914
• Fixed independently-verified findings from a security audit by @ewels in #7503
• Fixed a negative duration error on a short run by @bentsherman in #7351
• Fixed the PBS Pro server status query by @jscgh in #7366
• Fixed the publish mode override when re-publishing an existing file by @bentsherman in #7364
• Fixed a race condition calling workflow onComplete twice by @bentsherman in #7349
• Fixed tests failing on macOS and on hosts with NXF_REGISTRY_TOKEN by @pditommaso in #7457
• Fixed workflow metadata when failOnIgnore is true by @ehsanestaji in #7356
• Guarded the trace log against string formatting errors by @bentsherman in #7347
• Prevented a world-readable race window when storing local secrets by @aknownuser in #7307
• Reverted the stream swap after the redirect to .command.out and .command.err by @tcezard in #7300

Full changelog: https://github.com/nextflow-io/nextflow/releases/tag/v26.08.0-edge

How to pin this version​

fusion {
  enabled = true
  containerConfigUrl = 'https://fusionfs.seqera.io/releases/v2.5.14-amd64.json'
}

Bug fixes​

General​

• Fixed data loss when a file move is interrupted.
• Fixed declared outputs with brace patterns such as *.{bcf,vcf}{,.gz} not being saved.
• Fixed symbolic links not persisting their backing data.
• Fixed long symbolic link targets being truncated on read.
• Fixed temporary task files being uploaded while still being written.
• Fixed temporary working files being left behind after a retried operation.
• Fixed the advertised file system block size, which is now 1 MiB instead of 512 bytes.
• Fixed an internal cache maintenance task continuing to run after shutdown.
• Fixed an internal inode allocation check returning an identifier that was not free.

Google Cloud​

• Fixed corrupted results when assembling very large files on Google Cloud Storage.

Dependencies​

• Hardened internal tests against data races and a timing-related flake.
• Updated dependencies and GitHub Actions.

Upgrade notes​

• Drop-in replacement for v2.5.13. No configuration changes required.

Feature updates and improvements​

Pipelines​

• Updated the bundled Nextflow version to 25.10.6.

Bug fixes​

Data Explorer​

• Fixed the IGV genome viewer failing to load reference genomes in Data Explorer by signing reference genome URLs.
• Fixed IGV genome viewer rendering in Data Explorer, which no longer depends on an externally hosted genome registry.
• Fixed IGV previews of Google Cloud Storage files in Data Explorer returning an authorization error, by signing those URLs with V4 signatures.
• Fixed IGV previews in Data Explorer failing at high zoom levels by signing index URLs independently of their data file URLs.

Upgrade notes​

No breaking changes. Standard upgrade procedure applies.

Fusion v2.6.3 fixes a mount failure for task images with a non-root USER that mount the Fusion NFS export through the setuid helper.

How to pin this version​

fusion {
  enabled = true
  containerConfigUrl = 'https://fusionfs.seqera.io/releases/v2.6.3-amd64.json'
}

Bug fixes​

NFS service mode​

• Fixed mounts failing with exit code 174 when invoked through the setuid fusion-suid helper.

Upgrade notes​

• Drop-in replacement for v2.6.2. No configuration changes required.

Feature updates and improvements​

Compute environments​

• Added an optional KMS key ARN to AWS Batch compute environments, so pipeline secrets in AWS Secrets Manager can be encrypted with a customer-managed key instead of the AWS-managed default.

Access control​

• Updated the copy and API URL chip on the Access tokens page.

General​

• Added the page number and search terms to paginated list URLs, so list state survives back-navigation and list URLs are shareable.

Bug fixes​

Compute environments​

• Fixed AWS Cloud head job failures returning an empty log page when the compute environment's IAM instance profile has no role attached.
• Fixed compute environment create and update accepting credentials already recorded as invalid or soft-deleted, and update resetting a credential's status without checking it.
• Fixed exhausted Google Cloud IAM retries to report a meaningful error, and added jitter to the retry backoff.

Data Explorer​

• Fixed tab flicker and a full-width action button in the file browser.
• Fixed IGV reference genome URLs not being signed, and corrected IGV rendering.
• Fixed an error when listing data in workspaces with auto-discovery disabled.

Monitoring and observability​

• Fixed the Runs tab pagination being scoped incorrectly on the project details page.
• Removed the ambiguous "last run" chips from the project header.