GoRunner docs
Search or askSearch⌘K

Changelog

What changed in each release, newest first.

To update a self-hosted installation, see Update.

v2026.10.58 · 31 Oct 2026 · Cloud · Self-hosted · Embed

Database columns nothing read are gone

This release removes 18 database columns that nothing reads. On Cloud nothing changes, and on every edition runs and API answers stay as they were. A self-hosted or embedded installation must pass through v2026.10.57 on the way here, and can’t go back below it afterwards.

Before you update, see v2026.10.58 › When you update.

v2026.10.57 · 31 Oct 2026 · Cloud · Self-hosted · Embed

What GoRunner keeps, and for how long

Run retention counts from when a run finished, and keeps each workflow’s newest finished run in each environment, on every edition. On Cloud, runs’ automatic credential use is kept for 90 days. A self-hosted or embedded installation keeps it unless you set AUDIT_CREDENTIAL_USE_RETENTION_DAYS. A step’s name can be at most 255 characters.

  • Every edition: a run’s age counts from when it finished, not when it started, so one that waited for weeks keeps its full time. Each workflow keeps its newest finished run in each environment, however old, so a workflow that rarely runs keeps its run page and its failing state. See Runs.
  • Cloud: the audit log keeps connection use by runs for 90 days, and each connection’s latest use for longer. A person’s actions and security events are kept. The first rows reach 90 days in early December. See Audit log.
  • Self-hosted and Embed: your audit log stays as it is until you set AUDIT_CREDENTIAL_USE_RETENTION_DAYS. It deletes only the credential use GoRunner itself recorded, and each connection keeps its latest use. Empty keeps everything. On Kubernetes it is telemetry.auditCredentialUseRetentionDays. See Settings (.env).
  • Every edition: a step’s name or displayName over 255 characters is refused with 400 when a workflow is created, updated or imported, or a template is used, and Check a definition reports step_name_too_long. A run that reached such a step couldn’t save its steps. One already stored stays and gets a warning, and its runs still lose their steps until it is shortened. See Workflow definition.
  • Self-hosted and Embed: Health warns when Redis reaches 70 % of its maxmemory, and two new metrics report it. See The Health page.
  • Self-hosted and Embed: the check asks for pgcrypto only on a new database. See Your own database, Redis and storage.

Before you update, see v2026.10.57 › When you update.

v2026.10.56 · 31 Oct 2026 · Cloud · Self-hosted · Embed

The API answers as its contract says

Every API operation was called and compared with its contract. The contract and these docs are corrected, and these answers change. Three are new refusals.

  • Set variables with no variables list answers 400 and changes nothing. [] still deletes them all. See Replace variables.
  • A condition operator that doesn’t exist is refused when a workflow is created, updated or imported, or a template is used. One already stored stays. See Workflow definition.
  • A schedule preview whose body isn’t JSON answers 400. It used to answer the default schedule. See Preview a schedule.
  • A webhook call whose run is cancelled while it runs answers 409, not 500. See Call a workflow’s webhook.
  • A refused ?wait= starts no run. It used to leave one that ran about a minute later. See Run a workflow.
  • Create, duplicate and import answer definitionRev. See Create a workflow.
  • A saved connection’s test answers noVerdict and reason, as the draft test does. See Test a connection.
  • A 405 sends Allow. See Errors.
  • A very large page is a page like any other, not a 500. An authType over 50 characters and an unreadable usage cursor are 400.
  • The export of a workflow saved without schemaVersion can be imported. See Import a workflow.
  • A trigger sample of a trigger the app doesn’t have is 404, not 500. A resume link over 5 MiB is 413, and the link still works.
  • Check a definition warns of a Return Response header the run would refuse, and notes a workflowId it ignored. See Check a definition.
  • The Partner API’s workflow reads answer webhookUrl, and its AI apps list answers pagination beside next. See Get a workflow.
  • An AI app’s gorunner_list_workflows takes view: "summary". null on an argument reads as left out, and a definition read with gorunner_get_workflow can be sent back as read. See Build tools.
  • /oauth/token, /oauth/register and /oauth/revoke answer 429 and 405 in OAuth’s shape. A 401 for a token that was sent names invalid_token. Registration answers logo_uri and client_uri. See Sign-in for developers.
  • A self-hosted installation can set API_INFLIGHT_MB, GORUNNER_JSBOX_SEAL, GORUNNER_JSBOX_SHIP_ALL and WORKER_RUN_GATE in .env. See Settings (.env).

Before you update, see v2026.10.56 › When you update.

v2026.10.55 · 30 Oct 2026 · Cloud · Self-hosted · Embed

A security round

Run data stays data in a MongoDB step, a crafted workbook fails its own step, and sign-in and permissions are tighter. GoRunner is now built with Go 1.27.3, and its dependencies are updated.

  • In a MongoDB step, a value from {{ }} is a plain value, so it can’t bring an operator. See MongoDB.
  • A Spreadsheet read has limits, and a workbook past them fails its own step. See Spreadsheet.
  • An API token ends with its maker’s access, and an open invitation with the person who sent it. See Authentication.
  • Only an owner of the organization can change single sign-on or a SCIM token. SCIM can’t remove the person who owns the organization, or its last owner. See Provision people with SCIM.
  • A single sign-on finishes in the browser that started it, and one SAML response gives one session. See Set up single sign-on.
  • An address may have 15 wrong sign-in codes in 24 hours, across all its links. See Sign up and sign in.
  • A drop-down that uses a connection needs the Write permission for workflows and the Read permission for connections. See Get a field’s options.
  • A new webhook address is answered only to a token with the Run permission for workflows. See Get a new webhook address.

Before you update, see v2026.10.55 › When you update.

v2026.10.54 · 30 Oct 2026 · Cloud · Self-hosted · Embed

A busy server says so

When a server holds as much request data as it can, a call now waits up to 2 seconds and then answers 503 BUSY with Retry-After, before anything is done. A run waits for room in the Code sandbox before it starts.

  • A new answer, 503 BUSY, for a body that doesn’t fit in the server’s in-flight budget, and for a read of a run’s large data. See BUSY.

Before you update, see v2026.10.54 › When you update.

v2026.10.53 · 30 Oct 2026 · Cloud · Self-hosted · Embed

A run costs less to run

Each run uses less worker CPU, memory and Redis. Nothing changes in what a run does or what the API answers.

Before you update, see v2026.10.53 › When you update.

v2026.10.51 · 30 Oct 2026 · Cloud · Self-hosted · Embed

Less database work for each run

About a quarter fewer statements per run, with new indexes (migration 124). Nothing changes in what the API answers.

Before you update, see v2026.10.51 › When you update.

Older releases

Oct 2026