GoRunner docs
Search or askSearch⌘K

v2026.10.55

A security round

30 Oct 2026 · Cloud · Self-hosted · Embed

Run data stays data in a MongoDB step, a crafted workbook fails its own step, and sign-in and permissions are tighter. GoRunner is now built with Go 1.27.3, and its dependencies are updated.

What changed

  • In a MongoDB step, a value from {{ }} is a plain value, so it can’t bring an operator. See MongoDB.
  • A Spreadsheet read has limits, and a workbook past them fails its own step. See Spreadsheet.
  • An API token ends with its maker’s access, and an open invitation with the person who sent it. See Authentication.
  • Only an owner of the organization can change single sign-on or a SCIM token. SCIM can’t remove the person who owns the organization, or its last owner. See Provision people with SCIM.
  • A single sign-on finishes in the browser that started it, and one SAML response gives one session. See Set up single sign-on.
  • An address may have 15 wrong sign-in codes in 24 hours, across all its links. See Sign up and sign in.
  • A drop-down that uses a connection needs the Write permission for workflows and the Read permission for connections. See Get a field’s options.
  • A new webhook address is answered only to a token with the Run permission for workflows. See Get a new webhook address.

When you update

GoRunner’s image is private for now. With Docker, sign in to the registry first. On Kubernetes, sign Helm in and give the cluster its pull Secret. See Update for the whole procedure, or Install with Docker and Install on Kubernetes to install this version anew.

# Check the image first: its Digest must be sha256:ea3b2e78f3a207dc1c656aa6f9e9355feb8b20a7961da010198354ff23b6d743
docker buildx imagetools inspect ghcr.io/ralve-org/gorunner-selfhost:v2026.10.55

# Update
./deploy.sh v2026.10.55

Going back

To go back, run ./deploy.sh v2026.10.54. There is no migration, so no flag is needed.