Changelog

Service account OIDC identities can now check extra claims in the request token, not just the subject. This lets you set more detailed authentication conditions. Existing OIDC requests are unaffected.

AI agent tools such as Claude Code, Claude.ai, ChatGPT and GitHub Copilot can now sign in to the Remote MCP server with OAuth, using their Octopus account instead of an API key. Cloud rollout starts 9 Nov; self-hosted gets it in 2026.4.

Create an API key with a Custom access level limited to specific roles, spaces, projects or environments, using a subset of your own permissions. The Create API Key form has also been redesigned. Full scoping reaches Cloud customers from 9 Nov; self-hosted gets it in 2026.4.

Release retention and Tentacle file retention now run for projects created from project templates. They use the retention policy set on the template's lifecycle.

A new page shows the current status of an environment or tenant. The release also updates the deployment task page tabs and adds feature flag changes to the environment timeline.

The Infrastructure Overview page has a new look and more detail, including summary tables on the health of deployment targets, workers and Argo CD instances in a space. Self-hosted gets it in 2026.4.

Explore your project's deployment pipeline in one interactive view that brings together environments, triggers, lifecycles, packages, Git repositories, steps, targets and more. Self-hosted gets it in 2026.4.

Platform teams can define channels and lifecycles once in a project template so every templated project releases the same way. Variables and steps can be scoped to channels, and templated projects can't edit the channels or lifecycle. Existing templates need at least one channel, lifecycle and environment parameter before they can publish.

Platform engineers can lock a specific package to a process or project template step through an external feed. Application teams then don't need to repeat feed or package configuration when they adopt a template.

Built-in approval workflow that requires one or more people to approve a deployment before it proceeds. No need for manual intervention steps or an external ITSM tool such as ServiceNow or Jira Service Management. Rolling out to Cloud after a closed alpha.

As well as detecting orphaned Kubernetes resources, you can now clean them up from Octopus.

When updating a release's variable snapshot you can now review the differences against the project's current variables and update only the ones you choose. This lets you take a single corrected variable without pulling in unrelated changes.

Octopus Server now includes an MCP server that lets your AI assistant inspect, query and diagnose your instance. Connect at your instance's /mcp endpoint with an agent API key. The locally installed MCP server stays available but won't get new features. Admins can turn it off in Configuration > Settings.

Deployments and runbook runs can now save key/value state per project, environment and tenant, then read it back in later runs via Octopus.Environment.State[key]. Useful for ephemeral environments. Entries can be marked as URLs, which show on the ephemeral environments page and are available through the API and Remote MCP server.

Connect Octopus to Slack with OAuth. It works with subscriptions and adds a new Send a Slack Message step. Opt-in; rolling out to Cloud customers gradually.

Privileged users can configure rate limiting to protect the server from accidental or malicious floods of requests, such as a script calling the API hundreds of times a minute.

Preview which deployments and runbooks would be compliant or non-compliant under a proposed policy change before you make it active. Nothing is enforced during an evaluation.

Connect Octopus Cloud to internal tools on your private network, such as Artifactory and GitHub Enterprise. You run a lightweight Docker container in your network that opens a secure, outbound-only connection to Octopus Cloud.

Turn features on and off without redeploying. Octopus has used Feature Flags internally for two years and is now rolling them out to customers, starting with 10% of Cloud.

A new step that lets you use agentic AI operations in your workflows, with guardrails built in and least-privilege controls you can tune. Released as an experiment.

Dashboard filters have moved to a sidebar and now let you filter by tag set, hide inactive projects and filter by deployment status, so large instances only show the projects you care about.

Maintenance window documentation now says that deployments and runbook runs resume after maintenance activity. This is the last stage of the resilient deployments rollout.

Octopus Server's image and Helm chart, the Argo CD gateway and the Kubernetes agent now meet OpenShift's stricter security rules, so you can install and run them without permission failures or manual workarounds.

API keys and service accounts made specifically for AI agents, so agent activity can be traced separately from human users. Audit log and key management screens can be filtered to agent entries. On by default from 2026.3.

Create an API key limited to the read-only permissions your user or service account holds. This is the first part of scoped API keys. On by default from 2026.3.

Show a project's deployment status in external tools such as README files, wikis or dashboards. Each badge shows the latest release version for an environment.

Argo CD in Octopus now supports SSH authentication to Git, new Commit to Git and Wait for Argo CD Applications steps for advanced setups, and cleanup of redundant pull requests. You can also discard superseded queued releases and deploy straight to the latest.

The Octopus downloads page has a new design that makes it easier to install Octopus.

Octopus now flags resources left in your cluster by earlier deployments that are no longer part of what Octopus deploys. They show as Orphaned on the project's Live Status page, with a count and filter. Visibility only; nothing is deleted.

A new environment timeline shows the same deployment information as the old deployment timeline. It is reached by clicking an environment name on the project dashboard and groups deployments into time buckets so they're easier to find.

Platform teams can create templates that standardize deployment pipelines with built-in compliance and best practices. This release adds environment, target tag and tenant tag parameters, project settings, certificates and Git credentials to templates.

The Standard Change Template Name field (ServiceNow and Jira Service Management) now accepts variable expressions. Automatic transition for ServiceNow change requests now works with normal changes as well as standard changes.

Use PyPI repositories as an external feed in Octopus Deploy.

Opt-in support for loading the Calamari tooling from a container image straight into script pods, instead of the server pushing it into shared storage. Needs Kubernetes 1.35 or later.

Argo CD steps now fetch current state for the Argo CD applications at the start of each step run.

You can upload a package to the built-in feed while creating or editing a step, without leaving the step editor.

Self-hosted customers can now use GitHub Connections (via the GitHub App) instead of personal access tokens that expire. For instances behind a firewall, you can export and host the public signing keys externally and use OIDC accounts in deployments. Included in the 2026.2 LTS.

See the health of a GitOps runtime in one place, including connectivity, applications, components, Git sources and managed clusters.

Version 3 of the Kubernetes agent changes the default storage from the in-cluster NFS pod to a single-node ReadWriteOnce storage class, and the install wizard no longer asks about NFS or CSI drivers. Cloud customers are being upgraded automatically. Deprecation notice: bundling the NFS server will end in a future major version in about 6 months.

All existing target tags have moved into a default tag set scoped to targets. Tags work as before, but you can now manage them centrally and organize them with more than one tag set.

Built-in approval workflow that requires people to approve a deployment before it proceeds, with no need for manual intervention steps or an external ITSM tool. Closed alpha; enabled on one customer instance so far.

Octopus can automatically cancel queued deployment or runbook run tasks for the same project, environment and tenant that have been superseded by a newer one. On by default for new projects and runbooks, off for existing ones.

A new Compliance report shows who deployed to an environment and when.

New view access rules for GitOps applications, so access no longer depends on read access to the Git repositories where the application manifests are stored.

Traffic out of the GitHub App now goes through a fixed IP address, so you can allow-list Octopus in your GitHub organization.

Fix a broken GitHub Connection from the GitHub Connections page without having to disable it and start again. The page shows each connection's actual state and offers a fix for invalid registrations, suspended installations and uninstalled apps.

Platform Hub version control settings can now use a GitHub Connection (the GitHub App) as well as a personal access token. This helps enterprises whose security policies restrict or prohibit PATs.

A change to how the task queue sorts tasks is rolling out through April and shouldn't change behavior. A related Fairer Task Queue change for priority tasks is switched off and limited to a very small customer preview.

Installs of the GitHub App limited to selected repositories now get the same searchable repository picker as All repositories installs.

Platform teams can standardize deployment pipelines with built-in best practices and compliance, while application teams go from zero to deployed faster. Alpha: customer feedback is wanted.

Admins of self-hosted instances can capture OpenTelemetry trace data to disk and send it to Octopus to help with troubleshooting.

A guided wizard offers pre-built policies for common compliance needs and generates the policy code for you to customize, so you don't have to write Rego from scratch. Available on the Enterprise tier.

Enterprise customers can set up an Azure Private Link endpoint from their Octopus Cloud instance to private Azure services in their own tenant, and configure DNS entries, in Control Center. Enabled on request; needs a dedicated Reef.

New checks make sure only valid Octopus instances can register with the GitHub App.

OpenTelemetry- and Prometheus-compatible metrics plus ready-made Grafana dashboards show where time and resources go in your pipelines and builds.

A new Compliance report lets you pick environments across spaces and see, for each project, which users have permission to deploy to them. Self-hosted gets it when 2026.1 goes GA.

Adds PKCE (Proof Key for Code Exchange) to the GitHub App integration so intercepted authorization codes can't be exchanged for access tokens.

Use npm repositories as an external feed in Octopus Deploy.

A Git repository used in several spaces is now cloned once instead of once per repository and credential combination.

Sensitive parameters on process templates now support default values, stored securely, so secrets can be shared across spaces and projects more easily.

The runtime installation wizard, previously GitHub only, now also supports GitLab and Bitbucket Server and Cloud. It's available to all Codefresh customers.

The Name field now filters applications as you type and expands nested app groups to show matching child apps, with non-matching parent apps greyed out.

Create a new release from an existing one with the same channel, packages and Git reference, using Copy in the release's menu.

Enterprise customers can enable SCIM 2 in the Azure AD authentication provider, so Entra ID can create, update and delete Octopus users and teams automatically.

Error messages now include the reason a pre-receive hook rejected a push, so you can find and fix the problem faster.

Customers on the Free tier can now upgrade to the Professional tier themselves, completing the whole journey from sign-up to paid without talking to Sales.

When adding or changing repositories on a GitHub Connection you can now search in a modal, replacing the old checkbox list with a Load more button.

The GitHub Connections page now shows the connected GitHub user and makes the refresh, re-authorize and disconnect options easier to find.

Use the GitHub App to authenticate to repositories for Git resources, so you can use scripts from a GitHub repository without setting up passwords or tokens.

Change the Kubernetes permissions granted to the agent for each deployment, based on the project or environment it's running in.

Share deployment steps across spaces as a single source of truth, to avoid configuration drift and make it easy to follow deployment standards at scale.

Write policies as code to enforce deployment standards, such as requiring certain steps to run or that production packages are built from the default branch.

Octopus Cloud is starting to require TLS 1.2 or above for Tentacle connections, as part of retiring TLS 1.0 and 1.1. One known machine is affected and its customer has been told.

A new user authentication provider with more configuration options, so you can connect a wider range of identity providers such as Keycloak, Authentik, AD FS and Ping Identity.

A new Configuration > API Keys page helps you manage keys across the instance, and new settings control the default and maximum expiry in days.

Octopus's first in-product AI feature. It reads deployment logs, helps find the root cause of a failed deployment and suggests fixes. It is read-only and available to a first group of Cloud customers.

The manual sync dialog now explains pruning, warns when Prune is on, lists resources to be deleted at the top with a Requires pruning badge, and turns the Synchronize button red when it will delete resources.

You can now sign up for the Free tier, on Cloud or self-hosted, directly on the website.