# v2026.10.55

A security round

Run data stays data in a MongoDB step, a crafted workbook fails its own step, and sign-in and permissions are tighter. GoRunner is now built with Go 1.27.3, and its dependencies are updated.

## What changed

- In a MongoDB step, a value from `{{ }}` is a plain value, so it can’t bring an operator. See [MongoDB](https://docs.gorunner.io/apps/mongodb).
- A Spreadsheet read has limits, and a workbook past them fails its own step. See [Spreadsheet](https://docs.gorunner.io/apps/spreadsheet).
- An API token ends with its maker’s access, and an open invitation with the person who sent it. See [Authentication](https://docs.gorunner.io/api/authentication).
- Only an owner of the organization can change single sign-on or a SCIM token. SCIM can’t remove the person who owns the organization, or its last owner. See [Provision people with SCIM](https://docs.gorunner.io/build/scim).
- A single sign-on finishes in the browser that started it, and one SAML response gives one session. See [Set up single sign-on](https://docs.gorunner.io/build/single-sign-on).
- An address may have 15 wrong sign-in codes in 24 hours, across all its links. See [Sign up and sign in](https://docs.gorunner.io/build/sign-up-and-sign-in#sign-in).
- A drop-down that uses a connection needs the **Write** permission for workflows and the **Read** permission for connections. See [Get a field’s options](https://docs.gorunner.io/api/apps/resolve-dynamic-options).
- A new webhook address is answered only to a token with the **Run** permission for workflows. See [Get a new webhook address](https://docs.gorunner.io/api/publish/rotate-workflow-webhook-token).

## When you update

GoRunner’s image is private for now. With Docker, [sign in to the registry](https://docs.gorunner.io/self-host/install-docker#sign-in-to-the-registry) first. On Kubernetes, [sign Helm in and give the cluster its pull Secret](https://docs.gorunner.io/self-host/install-kubernetes#make-a-namespace). See [Update](https://docs.gorunner.io/self-host/update) for the whole procedure, or [Install with Docker](https://docs.gorunner.io/self-host/install-docker) and [Install on Kubernetes](https://docs.gorunner.io/self-host/install-kubernetes) to install this version anew.

**Docker**

```bash
# Check the image first: its Digest must be sha256:ea3b2e78f3a207dc1c656aa6f9e9355feb8b20a7961da010198354ff23b6d743
docker buildx imagetools inspect ghcr.io/ralve-org/gorunner-selfhost:v2026.10.55

# Update
./deploy.sh v2026.10.55
```

**Kubernetes**

```bash
helm upgrade gorunner oci://ghcr.io/ralve-org/charts/gorunner --version 2026.10.55 -f values.yaml
```

## Going back

To go back, run `./deploy.sh v2026.10.54`. There is no migration, so no flag is needed.

Source: https://docs.gorunner.io/changelog/v2026.10.55