Skip to main content
Version: 2026.07

2026.07.01 Release Notes

Download installers, container images, Helm charts, and other release assets from the Istari Customer Portal.

Assets​

Docker Images​

  • Registry Service: istaridigital.jfrog.io/customer-docker/registry-service:10.22.0
  • Secure Connection Service: istaridigital.jfrog.io/customer-docker/secure-connection-service:10.22.0
  • Frontend Service: istaridigital.jfrog.io/customer-docker/frontend-service:8.35.4
  • MCP Service: istaridigital.jfrog.io/customer-docker/mcp-service:0.6.0
  • Docs Service: istaridigital.jfrog.io/customer-docker/docs-service:6.14.3
  • Identity Service: istaridigital.jfrog.io/customer-docker/identity-service:1.2.1
  • Dgraph SEC: istaridigital.jfrog.io/customer-docker/dgraph-sec:v25.3.7-sec.0.2.2
  • SpiceDB: istaridigital.jfrog.io/customer-docker/istaridigital.com/spicedb-fips:v1.51.1
  • SpiceDB Operator: istaridigital.jfrog.io/customer-docker/istaridigital.com/spicedb-operator-fips:v1.24.0
  • Zitadel (main image): istaridigital.jfrog.io/customer-docker/istaridigital.com/zitadel:v3.4.7
  • Zitadel (setup job): istaridigital.jfrog.io/customer-docker/istaridigital.com/kubectl-iamguarded-fips:1.33.9

Note: The SpiceDB, SpiceDB Operator, and Zitadel images listed above use Chainguard hardened images. Chainguard images are minimal, security-hardened container images with significantly reduced CVE exposure.

  • NATS images (bundled with the NATS subchart in the Istari-Platform Chart; tags pinned by the chart):

    • NATS Server: istaridigital.jfrog.io/customer-docker/istaridigital.com/nats-fips:2.14.1
    • NATS Config Reloader: istaridigital.jfrog.io/customer-docker/istaridigital.com/nats-server-config-reloader-fips:0.23.0
    • NATS Prometheus Exporter: istaridigital.jfrog.io/customer-docker/istaridigital.com/prometheus-nats-exporter-fips:0.19.2
    • NATS Box: istaridigital.jfrog.io/customer-docker/istaridigital.com/nats-box-fips:0.19.5

  • Other bundled images (pinned by the Istari-Platform Chart):

    • Jaeger: istaridigital.jfrog.io/customer-docker/istaridigital.com/jaeger-fips:2.20.0
    • Caddy (API Gateway): istaridigital.jfrog.io/customer-docker/istaridigital.com/caddy-fips:2.11.4

Helm Charts​

  • SpiceDB Operator: helm pull --repo https://bushelpowered.github.io/spicedb-operator-chart spicedb-operator --version 2.6.0
  • Zitadel: helm pull --repo https://charts.zitadel.com zitadel --version 8.13.4
  • Istari-Platform Chart: helm pull oci://istaridigital.jfrog.io/customer-charts/istari-platform --version 5.1.1 --username ${ISTARI_ARTIFACTORY_USERNAME} --password ${ISTARI_ARTIFACTORY_PASSWORD}
  • Zitadel Configurator: helm pull oci://istaridigital.jfrog.io/customer-charts/istari-zitadel-configurator --version 1.10.0 --username ${ISTARI_ARTIFACTORY_USERNAME} --password ${ISTARI_ARTIFACTORY_PASSWORD}

SDK Clients​

Agent​

CLI​

Integrations​

Updates for the July 2026 Release​

Module NameVersion
Dassault Systèmes 3DExperience CATIA (v6)1.4.2
Dassault Systèmes 3DExperience ENOVIA1.4.0
Dassault Systèmes Cameo Enterprise Architect4.3.4
IBM Rational DOORS Module1.2.2
Jira & Confluence Data Extraction Module1.2.1
Luminary Cloud CFD1.1.1
Open Spreadsheet2.3.11
Open Text1.0.10

All Compatible Modules​

Click to expand full module compatibility list for the July 2026 release of the Istari Platform
ModuleVersion
ANSYS HFSS1.1.2
Atlassian Jira1.0.9
C-Infinity AutoAssembler Module1.0.1
Dassault Systèmes 3DExperience CATIA (v6)1.4.2
Dassault Systèmes 3DExperience ENOVIA1.4.0
Dassault Systèmes Cameo Enterprise Architect4.3.4
Dassault Systèmes CATIA V52.5.6
Google Slides0.2.3
Google Workspace1.3.2
Hexagon MSC Nastran2.4.7
Hexagon Nastran Extract2.4.10
IBM Rational DOORS Module1.2.2
Jira & Confluence Data Extraction Module1.2.1
Luminary Cloud CFD1.1.1
MathWorks MATLAB (Base)2.3.7
MathWorks MATLAB Simulink1.3.10
Microsoft Office 3651.5.10
Microsoft Office Excel2.4.3
Microsoft Office PowerPoint1.1.2
Microsoft Office Word2.3.9
nTop0.4.11
Open CAD1.1.8
Open PDF1.7.8
Open Spreadsheet2.3.11
Open SysML1.0.10
Open Text1.0.10
PTC Creo Parametric3.3.4
Siemens NX1.5.3
SysGit SysML v2 Tools1.0.1
Zoo.dev1.0.3

Change Log​

Istari Platform​

New Features​

  • Version control is now generally available. Branches, commits, and change requests let teams iterate on systems in parallel while staying in control:
    • Create a branch off any existing branch to isolate in-progress work; archive and restore branches as work winds down.
    • Every save to a branch creates a commit — the Commit history panel shows who changed what and when, and opening a commit shows the system exactly as it was at that point.
    • Open a change request to review the delta between branches — resources added, removed, or changed — then merge it into the base branch.
    • Everything is also available programmatically through the Python SDK for automated pipelines.
    • See Version Control (User Guide) for details.
  • Folders (preview). Organize the files in a system into a folder hierarchy, so large systems read like a familiar directory tree instead of a flat list. Folder layouts are per branch, and folder changes are saved as commits. Available behind an opt-in toggle under Application Settings → Experimental Features → Folders. See Folders (User Guide).
  • System Webhooks (Preview). Systems now support outbound webhooks, letting external pipelines react to platform events without polling. Register an HTTPS endpoint on a System and the platform delivers a signed JSON payload each time a subscribed event fires. This feature is in preview and its API may change in future releases.
    • This release ships one event, system.snapshot.created, which fires when a snapshot is created on a subscribed System. Additional event types will follow in future releases.
    • Webhooks are managed per System through the API (/api/v2/systems/{system_id}/webhooks), with up to 10 webhooks per System. Creating or modifying webhooks requires Editor or Admin access on the System.
    • Every delivery is signed: the Istari-Signature header carries an HMAC-SHA256 signature of the request body, alongside Istari-Delivery and Istari-Event headers. The per-webhook signing secret (whsec_…) is returned once at creation time — use it to verify that deliveries originate from Istari.
    • Failed deliveries retry automatically on a fixed backoff schedule (30 seconds, 2 minutes, 10 minutes, 1 hour) with a 10-second per-attempt timeout. A 410 Gone response from the target disables the webhook.
    • Each webhook exposes a deliveries endpoint listing delivery attempts, response status, and retry timing. Delivery records are retained for 30 days.
    • Webhook targets must be HTTPS endpoints resolving to public addresses; credentials and signing secrets are encrypted at rest.
    • Webhooks are disabled by default — see Migration Notes for the configuration required to enable them.
  • Secure Connection revocation has launched. Unsharing a resource from a Secure Connection now revokes it end to end:
    • When a sending organization revokes a previously shared resource, the receiving platform tombstones its downstream copy, deleting the file's content and clearing its metadata so the copy becomes an inert placeholder.
    • Propagation is best-effort across the transfer boundary: the receiving side retries until the tombstone lands.
    • Every step is recorded in the Secure Connection audit logs and reflected in the connection's sync status.
    • Revocation does not delete data from the receiving partner's storage inbox.
    • See Secure Connections (User Guide) and Secure Connections (Admin Guide) for details.
  • Identity Service available (optional) — The platform ships an Identity Service for the first time this release. It authenticates users, SDK clients, and agents, then issues short-lived, signed platform tokens, enabling key-based authentication as an alternative to Personal Access Tokens. It is off by default (identity.enabled: false). Enabling it deploys the service only; moving existing clients onto it is a separate step, controlled by identity.clientIntegration.enabled. See the Identity Service: Install & Configure guide for setup steps.
  • API Gateway (optional) — The Istari-Platform chart can now deploy an API Gateway that fronts the platform's services behind a single URL. It is off by default (apiGateway.enabled: false). Adopting it means setting apiGateway.apiUrl in the chart and ISTARI_DIGITAL_API_URL in client tools (SDK, CLI, agents), so they address the platform through the gateway instead of each service's own hostname. See the API Gateway guide for setup steps.

Fixes and Improvements​

  • Failed jobs now tell you why they failed — The web UI now surfaces the diagnostic message recorded with a failed job, so you no longer need to read agent logs to find out what went wrong:

    • In the Job Details dialog, the Status History shows the message beneath any status entry that carries one — at minimum the FAILED transition.
    • In the Activity panel, hovering over a failed job's status chip shows the latest diagnostic message as a tooltip.

    Failure messages come from the agent (see the Istari Digital Agent section below). For jobs reported by older agents that do not yet supply failure detail, the platform records a diagnostic in their place — identifying the reporting agent and its version, noting that no failure detail was provided, and recommending an agent upgrade — instead of the uninformative placeholder ("Agent User updated job status to FAILED") recorded previously. Platform administrators can track how many failures still arrive without detail, broken down by agent version, via the new messageless_failed_job_transitions_total metric on the Registry Service, and use it to prioritize agent upgrades across their fleet.

    See View Job Details for details.

Search received a major overhaul this release (Search, Files, Systems):

  • Search bar filters are tokenized — filters render as removable pills (e.g. status:active) with autocomplete, kept in sync with the results page and URL.
  • Filtered resource searches are precise and live — structured filters (owner, status, type, …) are honored exactly, and a filter alone now returns results without a search term.
  • System configuration file search — relevance-ranked, matches file name or display name, and significantly faster.
  • Files page filters — File Name and Description use substring matching (previously exact-only), and File Name matches display names too.
  • Unparented Artifacts view — now respects filters and loads incrementally.
  • Subsystem search — searches all systems server-side, not just the 100 most recently created.
  • Fixed — Agent-scope searches now land on the Agents page with the scope selector in sync.
  • Known limitation — the tag filter is temporarily removed while an accuracy issue is addressed.
  • Admin Page — Agents now provision and register their own keys. The previous Encryption Keys admin page for registering keys has been removed.

Istari Digital Agent​

New Features​

  • Tool Integration Credentials — Each integration now supports two kinds of credential — an organization-wide service account and a per-user linked account.
  • OAuth2/OIDC support — OAuth2/OIDC auth servers for TWC Authentication Server and Windchill are now supported.

Fixes​

  • Actionable messages on every job failure — The agent now attaches a human-readable diagnostic message to every FAILED job status transition, explaining what went wrong instead of failing silently. These messages appear in the web UI (see Failed jobs now tell you why they failed above) and on the job's status history in the SDK. Jobs run by agents older than this release continue to receive a platform-synthesized generic diagnostic until the agent is upgraded.

Integrations​

  • Jira & Confluence Data Extraction Module 1.2.1 — Now supports Jira and Confluence on both Atlassian Cloud and on-prem Server/DC deployments in a single module. Adds TLS/CA trust for private PKI environments.
  • IBM Rational DOORS Module 1.2.2 — Expanded to support IBM DOORS Classic, DOORS Next, ELM EWM (work items and iterations), and ELM ETM (test plans, cases, execution records, and results).
  • Dassault Systèmes 3DExperience ENOVIA 1.4.0 — Adds Logical APIs for Cameo-to-3DExperience integration (create_log_item, extract_log_item, log_item_search, create_log_instance).
  • Dassault Systèmes Cameo Enterprise Architect 4.3.4 — TWC OIDC authentication support, optional diagram format selection, and deterministic extract ordering.
  • Dassault Systèmes 3DExperience CATIA (v6) 1.4.2 — Tool-specific metadata extension to avoid collision with ENOVIA metadata.
  • Luminary Cloud CFD 1.1.1 — CFD scheduling and GPU controls, simulation reuse, and configurable wait timeouts.
  • Open Spreadsheet 2.3.11 — Row extraction by index and by filter; UTF-8 CSV encoding fix.
  • Open Text 1.0.10 — Adds parse_json_fields_separate for structured field extraction.
  • Integration module dependency security updates — Twenty-five integration modules ship updated versions this release with patched third-party dependencies (setuptools, altgraph, Pillow, Jackson, and Magick.NET). See the Updates for the July 2026 Release table and the All Compatible Modules list for pinned versions.

Release Timeline​

2026-07-01:

  • Initial July 2026 release

Migration Notes​

System Webhooks configuration (Preview)​

Webhooks are a preview feature and are disabled by default. To enable them on the registry service, add these keys to the istari-fileservice Kubernetes secret (values are strings):

  1. Set the webhook master secret: Add FILE_SERVICE_WEBHOOK_MASTER_SECRET. This key encrypts webhook credentials and signing secrets at rest and must never change over the lifetime of the installation.
  2. Set the instance URL: Add FILE_SERVICE_ISTARI_INSTANCE_URL with the base URL of your Istari instance. This value is used in webhook payloads and deep links.
  3. Enable the feature: Set FILE_SERVICE_FEATURE_FLAGS__WEBHOOKS_ENABLED to "true". Webhooks require eventing — startup will fail unless FILE_SERVICE_FEATURE_FLAGS__EVENTING_ENABLED is also "true" and NATS (FILE_SERVICE_NATS_URL/FILE_SERVICE_NATS_TOKEN) is configured.

This release also includes an automatic database migration that reshapes the legacy (feature-flagged, unused) webhook tables to the new System-scoped schema. No action is required.

Retroactive revocation of previously unshared resources​

Receiving-side tombstoning is new in this release, so revocations that were issued before upgrading were never acted on by the receiving platform. When you upgrade to the July 2026 release, the Secure Connection Service will automatically revoke every resource that has previously been unshared — the receiving platform tombstones each downstream copy (deleting its content and clearing its metadata) to bring it in line with the sending side.

  • This is expected behavior, not a defect. It is a one-time reconciliation of the backlog of past unshares against the newly supported receiving-side behavior.
  • No action is required. Revocation is best-effort and eventually consistent: the sending side re-emits each revocation per sync cycle and the receiving side retries until every tombstone lands.
  • Consistent with all revocation, this does not remove data from a receiving partner's storage inbox or anything already exported, downloaded, or forwarded outside the platform.
  • Each tombstone is recorded in the Secure Connection audit logs. See Secure Connections (Admin Guide) and Secure Connections (User Guide).

Breaking Change​

  • App Integrations must be re-created through the new Add integration dialog (Name → Application → Auth standard); the old Add App + Auth Providers form is gone.
  • SDK code that created app/auth integrations or published tenant public keys no longer applies.