# Changelog

What changed in each release, newest first.

To update a self-hosted installation, see [Update](https://docs.gorunner.io/self-host/update).

`v2026.10.58` · 31 Oct 2026 · Cloud · Self-hosted · Embed

## [Database columns nothing read are gone](https://docs.gorunner.io/changelog/v2026.10.58)

This release removes 18 database columns that nothing reads. On Cloud nothing changes, and on every edition runs and API answers stay as they were. A self-hosted or embedded installation must pass through v2026.10.57 on the way here, and can’t go back below it afterwards.

Before you update, see [v2026.10.58 › When you update](https://docs.gorunner.io/changelog/v2026.10.58#when-you-update).

`v2026.10.57` · 31 Oct 2026 · Cloud · Self-hosted · Embed

## [What GoRunner keeps, and for how long](https://docs.gorunner.io/changelog/v2026.10.57)

Run retention counts from when a run finished, and keeps each workflow’s newest finished run in each environment, on every edition. On Cloud, runs’ automatic credential use is kept for 90 days. A self-hosted or embedded installation keeps it unless you set `AUDIT_CREDENTIAL_USE_RETENTION_DAYS`. A step’s name can be at most 255 characters.

- Every edition: a run’s age counts from when it finished, not when it started, so one that waited for weeks keeps its full time. Each workflow keeps its newest finished run in each environment, however old, so a workflow that rarely runs keeps its run page and its failing state. See [Runs](https://docs.gorunner.io/build/runs#how-long-runs-are-kept).
- Cloud: the audit log keeps connection use by runs for 90 days, and each connection’s latest use for longer. A person’s actions and security events are kept. The first rows reach 90 days in early December. See [Audit log](https://docs.gorunner.io/build/audit-log#how-long-it-is-kept).
- Self-hosted and Embed: your audit log stays as it is until you set `AUDIT_CREDENTIAL_USE_RETENTION_DAYS`. It deletes only the credential use GoRunner itself recorded, and each connection keeps its latest use. Empty keeps everything. On Kubernetes it is `telemetry.auditCredentialUseRetentionDays`. See [Settings (.env)](https://docs.gorunner.io/self-host/settings#AUDIT_CREDENTIAL_USE_RETENTION_DAYS).
- Every edition: a step’s `name` or `displayName` over 255 characters is refused with `400` when a workflow is created, updated or imported, or a template is used, and Check a definition reports `step_name_too_long`. A run that reached such a step couldn’t save its steps. One already stored stays and gets a warning, and its runs still lose their steps until it is shortened. See [Workflow definition](https://docs.gorunner.io/api/workflow-definition#steps).
- Self-hosted and Embed: Health warns when Redis reaches 70 % of its `maxmemory`, and two new metrics report it. See [The Health page](https://docs.gorunner.io/self-host/health#services).
- Self-hosted and Embed: the check asks for `pgcrypto` only on a new database. See [Your own database, Redis and storage](https://docs.gorunner.io/self-host/own-stores#your-own-postgresql).

Before you update, see [v2026.10.57 › When you update](https://docs.gorunner.io/changelog/v2026.10.57#when-you-update).

`v2026.10.56` · 31 Oct 2026 · Cloud · Self-hosted · Embed

## [The API answers as its contract says](https://docs.gorunner.io/changelog/v2026.10.56)

Every API operation was called and compared with its contract. The contract and these docs are corrected, and these answers change. Three are new refusals.

- Set variables with no `variables` list answers `400` and changes nothing. `[]` still deletes them all. See [Replace variables](https://docs.gorunner.io/api/publish/replace-workflow-variables).
- A condition operator that doesn’t exist is refused when a workflow is created, updated or imported, or a template is used. One already stored stays. See [Workflow definition](https://docs.gorunner.io/api/workflow-definition).
- A schedule preview whose body isn’t JSON answers `400`. It used to answer the default schedule. See [Preview a schedule](https://docs.gorunner.io/api/apps/preview-schedule-next-runs).
- A webhook call whose run is cancelled while it runs answers `409`, not `500`. See [Call a workflow’s webhook](https://docs.gorunner.io/api/webhooks).
- A refused `?wait=` starts no run. It used to leave one that ran about a minute later. See [Run a workflow](https://docs.gorunner.io/api/runs/run-workflow).
- Create, duplicate and import answer `definitionRev`. See [Create a workflow](https://docs.gorunner.io/api/workflows/create-workflow).
- A saved connection’s test answers `noVerdict` and `reason`, as the draft test does. See [Test a connection](https://docs.gorunner.io/api/connections/test-connection).
- A `405` sends `Allow`. See [Errors](https://docs.gorunner.io/api/errors).
- A very large `page` is a page like any other, not a `500`. An `authType` over 50 characters and an unreadable usage `cursor` are `400`.
- The export of a workflow saved without `schemaVersion` can be imported. See [Import a workflow](https://docs.gorunner.io/api/workflows/import-workflow).
- A trigger sample of a trigger the app doesn’t have is `404`, not `500`. A resume link over 5 MiB is `413`, and the link still works.
- Check a definition warns of a **Return Response** header the run would refuse, and notes a `workflowId` it ignored. See [Check a definition](https://docs.gorunner.io/api/workflows/validate-workflow-definition).
- The Partner API’s workflow reads answer `webhookUrl`, and its AI apps list answers `pagination` beside `next`. See [Get a workflow](https://docs.gorunner.io/embed/api/workflows/get-workflow).
- An AI app’s `gorunner_list_workflows` takes `view: "summary"`. `null` on an argument reads as left out, and a definition read with `gorunner_get_workflow` can be sent back as read. See [Build tools](https://docs.gorunner.io/mcp/build-tools).
- `/oauth/token`, `/oauth/register` and `/oauth/revoke` answer `429` and `405` in OAuth’s shape. A `401` for a token that was sent names `invalid_token`. Registration answers `logo_uri` and `client_uri`. See [Sign-in for developers](https://docs.gorunner.io/mcp/oauth).
- A self-hosted installation can set `API_INFLIGHT_MB`, `GORUNNER_JSBOX_SEAL`, `GORUNNER_JSBOX_SHIP_ALL` and `WORKER_RUN_GATE` in `.env`. See [Settings (.env)](https://docs.gorunner.io/self-host/settings).

Before you update, see [v2026.10.56 › When you update](https://docs.gorunner.io/changelog/v2026.10.56#when-you-update).

`v2026.10.55` · 30 Oct 2026 · Cloud · Self-hosted · Embed

## [A security round](https://docs.gorunner.io/changelog/v2026.10.55)

Run data stays data in a MongoDB step, a crafted workbook fails its own step, and sign-in and permissions are tighter. GoRunner is now built with Go 1.27.3, and its dependencies are updated.

- In a MongoDB step, a value from `{{ }}` is a plain value, so it can’t bring an operator. See [MongoDB](https://docs.gorunner.io/apps/mongodb).
- A Spreadsheet read has limits, and a workbook past them fails its own step. See [Spreadsheet](https://docs.gorunner.io/apps/spreadsheet).
- An API token ends with its maker’s access, and an open invitation with the person who sent it. See [Authentication](https://docs.gorunner.io/api/authentication).
- Only an owner of the organization can change single sign-on or a SCIM token. SCIM can’t remove the person who owns the organization, or its last owner. See [Provision people with SCIM](https://docs.gorunner.io/build/scim).
- A single sign-on finishes in the browser that started it, and one SAML response gives one session. See [Set up single sign-on](https://docs.gorunner.io/build/single-sign-on).
- An address may have 15 wrong sign-in codes in 24 hours, across all its links. See [Sign up and sign in](https://docs.gorunner.io/build/sign-up-and-sign-in#sign-in).
- A drop-down that uses a connection needs the **Write** permission for workflows and the **Read** permission for connections. See [Get a field’s options](https://docs.gorunner.io/api/apps/resolve-dynamic-options).
- A new webhook address is answered only to a token with the **Run** permission for workflows. See [Get a new webhook address](https://docs.gorunner.io/api/publish/rotate-workflow-webhook-token).

Before you update, see [v2026.10.55 › When you update](https://docs.gorunner.io/changelog/v2026.10.55#when-you-update).

`v2026.10.54` · 30 Oct 2026 · Cloud · Self-hosted · Embed

## [A busy server says so](https://docs.gorunner.io/changelog/v2026.10.54)

When a server holds as much request data as it can, a call now waits up to 2 seconds and then answers `503 BUSY` with `Retry-After`, before anything is done. A run waits for room in the Code sandbox before it starts.

- A new answer, `503 BUSY`, for a body that doesn’t fit in the server’s in-flight budget, and for a read of a run’s large data. See [`BUSY`](https://docs.gorunner.io/errors#BUSY).

Before you update, see [v2026.10.54 › When you update](https://docs.gorunner.io/changelog/v2026.10.54#when-you-update).

`v2026.10.53` · 30 Oct 2026 · Cloud · Self-hosted · Embed

## [A run costs less to run](https://docs.gorunner.io/changelog/v2026.10.53)

Each run uses less worker CPU, memory and Redis. Nothing changes in what a run does or what the API answers.

Before you update, see [v2026.10.53 › When you update](https://docs.gorunner.io/changelog/v2026.10.53#when-you-update).

`v2026.10.52` · 30 Oct 2026 · Cloud · Self-hosted · Embed

## [Starting a run takes one database round trip](https://docs.gorunner.io/changelog/v2026.10.52)

A webhook, form or API call takes its place in the line in one round trip, and schedules are admitted per organization. Nothing changes in what the API answers.

Before you update, see [v2026.10.52 › When you update](https://docs.gorunner.io/changelog/v2026.10.52#when-you-update).

`v2026.10.51` · 30 Oct 2026 · Cloud · Self-hosted · Embed

## [Less database work for each run](https://docs.gorunner.io/changelog/v2026.10.51)

About a quarter fewer statements per run, with new indexes (migration 124). Nothing changes in what the API answers.

Before you update, see [v2026.10.51 › When you update](https://docs.gorunner.io/changelog/v2026.10.51#when-you-update).

`v2026.10.50` · 30 Oct 2026 · Cloud · Self-hosted · Embed

## [Redis does only the work it must](https://docs.gorunner.io/changelog/v2026.10.50)

Far fewer keys and far fewer background scans. Nothing changes in what the API answers.

Before you update, see [v2026.10.50 › When you update](https://docs.gorunner.io/changelog/v2026.10.50#when-you-update).

`v2026.10.49` · 30 Oct 2026 · Cloud

## [GoRunner Cloud’s settings](https://docs.gorunner.io/changelog/v2026.10.49)

Settings on GoRunner Cloud only. Nothing changes in the product or in a self-hosted installation.

Before you update, see [v2026.10.49 › When you update](https://docs.gorunner.io/changelog/v2026.10.49#when-you-update).

## Older releases

### Oct 2026

- [v2026.10.48 · A Code step’s JavaScript is checked when you save and publish](https://docs.gorunner.io/changelog/v2026.10.48): 30 Oct · Cloud · Self-hosted · Embed
- [v2026.10.47 · Code steps run in a sealed sandbox](https://docs.gorunner.io/changelog/v2026.10.47): 29 Oct · Cloud · Self-hosted · Embed
- [v2026.10.46 · AI apps are now on the MCP page](https://docs.gorunner.io/changelog/v2026.10.46): 29 Oct · Cloud · Self-hosted · Embed
- [v2026.10.45 · One stored object for each run save](https://docs.gorunner.io/changelog/v2026.10.45): 29 Oct · Cloud · Self-hosted · Embed
- [v2026.10.44 · Code over 256 KB is refused when you publish](https://docs.gorunner.io/changelog/v2026.10.44): 29 Oct · Cloud · Self-hosted · Embed
- [v2026.10.43 · Webhooks and schedules read a definition once](https://docs.gorunner.io/changelog/v2026.10.43): 28 Oct · Cloud · Self-hosted · Embed
- [v2026.10.42 · Queued runs hold a reference to their definition](https://docs.gorunner.io/changelog/v2026.10.42): 28 Oct · Cloud · Self-hosted · Embed
- [v2026.10.41 · A burst of runs costs less](https://docs.gorunner.io/changelog/v2026.10.41): 28 Oct · Cloud · Self-hosted · Embed
- [v2026.10.40 · Fixes across the apps](https://docs.gorunner.io/changelog/v2026.10.40): 28 Oct · Cloud · Self-hosted · Embed
- [v2026.10.39 · One organization can’t take the service down](https://docs.gorunner.io/changelog/v2026.10.39): 28 Oct · Cloud · Self-hosted · Embed
- [v2026.10.38 · One organization’s burst no longer starves the others](https://docs.gorunner.io/changelog/v2026.10.38): 28 Oct · Cloud · Self-hosted · Embed
- [v2026.10.37 · Shorter help in the Code step](https://docs.gorunner.io/changelog/v2026.10.37): 28 Oct · Cloud · Self-hosted · Embed
- [v2026.10.36 · New Code steps are on 2.0.0](https://docs.gorunner.io/changelog/v2026.10.36): 28 Oct · Cloud · Self-hosted · Embed
- [v2026.10.35 · Code 2.0.0 beside an unchanged 1.0.0](https://docs.gorunner.io/changelog/v2026.10.35): 28 Oct · Cloud · Self-hosted · Embed
- [v2026.10.34 · One quiet bar on each page](https://docs.gorunner.io/changelog/v2026.10.34): 27 Oct · Cloud · Self-hosted · Embed
- [v2026.10.33 · A closing panel fades once](https://docs.gorunner.io/changelog/v2026.10.33): 27 Oct · Cloud · Self-hosted · Embed
- [v2026.10.32 · The step picker searches what apps can do](https://docs.gorunner.io/changelog/v2026.10.32): 27 Oct · Cloud · Self-hosted · Embed
- [v2026.10.31 · Fixes from the docs review](https://docs.gorunner.io/changelog/v2026.10.31): 26 Oct · Cloud · Self-hosted · Embed
- [v2026.10.30 · Code steps format dates and numbers in every locale](https://docs.gorunner.io/changelog/v2026.10.30): 26 Oct · Cloud · Self-hosted · Embed
- [v2026.10.29 · A run’s page: the Trail, live follow and a clearer step record](https://docs.gorunner.io/changelog/v2026.10.29): 26 Oct · Cloud · Self-hosted · Embed
- [v2026.10.28 · Accurate run times, and the path a run took](https://docs.gorunner.io/changelog/v2026.10.28): 26 Oct · Cloud · Self-hosted · Embed
- [v2026.10.27 · Step data on sheets, and a new Data pane](https://docs.gorunner.io/changelog/v2026.10.27): 25 Oct · Cloud · Self-hosted · Embed
- [v2026.10.26 · No value line under step fields](https://docs.gorunner.io/changelog/v2026.10.26): 25 Oct · Cloud · Self-hosted · Embed
- [v2026.10.25 · Settings and side panels drawn as sheets](https://docs.gorunner.io/changelog/v2026.10.25): 25 Oct · Cloud · Self-hosted · Embed
- [v2026.10.24 · An AI app sign-in address for each account](https://docs.gorunner.io/changelog/v2026.10.24): 24 Oct · Embed
- [v2026.10.23 · Customers can sign in AI apps through your sign-in](https://docs.gorunner.io/changelog/v2026.10.23): 24 Oct · Embed
- [v2026.10.22 · AI app sign-in works with Cursor, Raycast and ChatGPT](https://docs.gorunner.io/changelog/v2026.10.22): 24 Oct · Cloud · Self-hosted · Embed
- [v2026.10.21 · Keel’s home uses the full width, and Embed matches the dashboard](https://docs.gorunner.io/changelog/v2026.10.21): 24 Oct · Cloud · Self-hosted · Embed
- [v2026.10.20 · Platform settings as tables, edited beside the page](https://docs.gorunner.io/changelog/v2026.10.20): 24 Oct · Cloud · Self-hosted
- [v2026.10.19 · Details open beside the page](https://docs.gorunner.io/changelog/v2026.10.19): 24 Oct · Cloud · Self-hosted · Embed
- [v2026.10.18 · Code steps can format dates and numbers in 11 locales](https://docs.gorunner.io/changelog/v2026.10.18): 23 Oct · Cloud · Self-hosted · Embed
- [v2026.10.17 · A Stuck state for organizations, and phone polish](https://docs.gorunner.io/changelog/v2026.10.17): 23 Oct · Cloud · Self-hosted · Embed
- [v2026.10.16 · Menus, tables and the phone header, fixed](https://docs.gorunner.io/changelog/v2026.10.16): 23 Oct · Cloud · Self-hosted · Embed
- [v2026.10.15 · The switcher, Keel’s home and empty states, finished](https://docs.gorunner.io/changelog/v2026.10.15): 22 Oct · Cloud · Self-hosted · Embed
- [v2026.10.14 · New Settings and Platform pages](https://docs.gorunner.io/changelog/v2026.10.14): 22 Oct · Cloud · Self-hosted
- [v2026.10.13 · The switcher lists everything](https://docs.gorunner.io/changelog/v2026.10.13): 21 Oct · Cloud · Self-hosted
- [v2026.10.12 · Connect an AI app, redesigned](https://docs.gorunner.io/changelog/v2026.10.12): 21 Oct · Cloud · Self-hosted
- [v2026.10.11 · Deleting workflows with long histories works](https://docs.gorunner.io/changelog/v2026.10.11): 21 Oct · Cloud · Self-hosted
- [v2026.10.10 · Connect sign-in apps from the API](https://docs.gorunner.io/changelog/v2026.10.10): 21 Oct · Cloud · Self-hosted · Embed
- [v2026.10.9 · Templates, redesigned](https://docs.gorunner.io/changelog/v2026.10.9): 21 Oct · Cloud · Self-hosted · Embed
- [v2026.10.8 · A redesigned dashboard](https://docs.gorunner.io/changelog/v2026.10.8): 20 Oct · Cloud · Self-hosted · Embed
- [v2026.10.7 · Addresses as you wrote them, and a Runs page that keeps up](https://docs.gorunner.io/changelog/v2026.10.7): 14 Oct · Cloud · Self-hosted · Embed
- [v2026.10.6 · One token dialog, and a Waiting tab](https://docs.gorunner.io/changelog/v2026.10.6): 14 Oct · Cloud · Self-hosted · Embed
- [v2026.10.5 · Fixes from a partner’s report](https://docs.gorunner.io/changelog/v2026.10.5): 13 Oct · Cloud · Self-hosted · Embed
- [v2026.10.4 · Runs are never lost, and wait in line](https://docs.gorunner.io/changelog/v2026.10.4): 13 Oct · Cloud · Self-hosted · Embed
- [v2026.10.3 · A free license, sign-in without email, and the preflight check](https://docs.gorunner.io/changelog/v2026.10.3): 11 Oct · Cloud · Self-hosted
- [v2026.10.2 · One image for every role, and Kubernetes](https://docs.gorunner.io/changelog/v2026.10.2): 4 Oct · Self-hosted
- [v2026.10.1 · An installation without a valid license pauses](https://docs.gorunner.io/changelog/v2026.10.1): 3 Oct · Self-hosted
- [v2026.10.0 · Embed for self-hosted installations](https://docs.gorunner.io/changelog/v2026.10.0): 3 Oct · Self-hosted · Embed

Source: https://docs.gorunner.io/changelog