What's new in 2026.3

Breaking Changes

• 10170 - Added RunbookSnapshotCreate permission and removed RunbookEdit permission from Build Server role
• 10172 - Prevent invalid process template versions from being created. You can no longer create a new version if the version number is lower than an existing one, or if the version number doesn't have a pre-release tag when the IsPreRelease flag is true. The pre-release fix is a breaking change that will require you to update either the version number or the IsPreRelease flag to match the other
• 10154 - Removed Id and Links properties and renamed TemplateSlug to ProjectTemplateSlug in ProjectTemplateParameterSetResource. This is a breaking change to this resource
• 10139 - The endpoint that retrieves deployment timelines has changed. Any call to the endpoint bff/spaces/{spaceId}/projects/{projectId}/environments/{environmentId}/deployments/timeline/ will no longer work and has been renamed to bff/spaces/{spaceId}/projects/{projectId}/environments/{environmentId}/deployments/recent/. The BFF endpoint is not a a public API and is not versioned. We are giving this breaking change notice to any customers who may be relying on this non public endpoint. We suggest that instead of using BFF endpoints, you should consider using the public Resource API Endpoints documented in Swagger at https://<yourinstance>/swaggerui
• 10067 - The audit log entry for an API key being generated now begins with "User API key" or "AI Agent API key" instead of "API key". If you have SIEM rules, dashboards, or automation parsing this audit message, you can now split your rules to handle the two cases separately. If you want a single rule that matches both old and new events, ^(?:User |AI Agent )?API key covers both

Other Changes

• 10221 - Enabled Wait for Argo CD Applications step for self hosted release
• 10206 - Add support for sourcing from GitHub Connections in Process and Project Templates
• 10207 - Fix bug where child resources deleted while the monitor is offline linger in live status until the next periodic snapshot
• 8706 - Ensure deferred package selection is available for step templates
• 10205 - Allow deleting orphaned Kubernetes resources from the live status page
• 10204 - Enabled Commit To Git step for self hosted release
• 10196 - Refresh ArgoCD Gateway after updating settings
• 10199 - Add deployment approval system
• 10200 - Enable compliance policy test evaluation before publishing
• 10201 - Waterfall view of the deployment task log
• 10198 - Added support for setting and using environment state during deployments and runbook runs
• 10195 - Added the slug for a Process and Project template to the appropriate settings page
• 10194 - Fixed an issue where the users list of favourite projects would not correctly load when the portal was launched
• 10191 - ECS steps have incorrect package references
• 10192 - Webhook triggers for triggers stored in git won't run
• 10193 - Allow start_trigger to be bound to a variable
• 10189 - Excessive memory during large deployments when using Kubernetes Object Verification
• 10177 - Support consumption of process template package parameters in the project template. Project template creator can link process template package parameter to a project template parameter or select concrete feed from Platform Hub feeds
• 10185 - Automatic deployment target management for ephemeral environments
• 10181 - Can't create custom package step template with feed bound to a variable
• 10178 - Moved the actor type selection into the New API Key drawer
• 10175 - Show "not found" when account missing, rather than endless loading page
• 10174 - Two new variable filters, AddHours and AddDays in Octostache
• 10173 - Fix OCL migration for "Deploy a Bicep template" breaking Inline Template Source Code formatting
• 10165 - Stop orphaned resources from affecting overall healthy summary
• 10171 - Fix feature flag environment drawer save button always being disabled when adding a new environment as a user with environment-scoped edit permissions
• 10167 - Project Dashboard no longer auto-refreshes releases filter dropdown
• 10168 - Added webhook triggers for runbooks
• 10166 - Saving a deployment process may fail with 'No package reference matching ' after a Bicep step is migrated
• 10179 - Resolved an issue where unexpected query strings in the URL could prevent the sign in page from loading correctly
• 10152 - Fix OCI feed package acquisition logic for multi-layered Helm manifests
• 10162 - Deployment History compliance report creates a blank CSV file.
• 10164 - Support custom inline Cloud Formation Template Parameter Overrides
• 10156 - Display publish button for runbooks when git dependencies are changed
• 8262 - Custom authentication providers (Okta, AAD, etc) now work with virtual directories
• 10160 - Patch ServiceNow Planning Fields when creating Standard Change Requests
• 10158 - Config-as-Code migration for "Deploy an ECS Service" step silently resets numeric/boolean fields to defaults
• 10155 - Octopus Server now includes HTTP rate limiting functionality
• 10151 - Allow ArgoCD Gateways to be registered across spaces, and allow space annotations to scope applications
• 10148 - Update Kubernetes Status Check to use more resilient checks to determine deployment success
• 10138 - Add support for Helm v4
• 10137 - Fixed bug preventing Octopus variables from been resolved correctly when using them in the Commit to git step's destination repository url
• 10142 - Github App Version Controlled projects may have the commit recorded as Octopus Deploy, not the user.
• 9343 - Added support for variable enumeration in bash using associative arrays. This uses the octopus_parameters field and requires the feature toggle BashParametersArrayFeatureToggle to be enabled, bash version 4.2 or later and xxd on path
• 10140 - Fixed 'A router only supports one blocker at a time' warnings
• 10141 - Update variable shapshots for DB-backed runbooks to reflect values at execution, including values entered for prompted variables
• 10135 - Server nodes are now correctly removed from the database when deleted using the delete-instance command
• 10136 - Restore right-click "open in new tab" for Deployment Target, Worker, and Argo CD instance rows
• 10133 - Upgraded Microsoft.Data.SqlClient dependency to 7.0.2
• 10128 - Allow opt-out of the docker credential helper, to support users on older versions of podman
• 10081 - Error occurs when trying to deploy again after cancelling an in progress helm deployment
• 10131 - Users can now scope an API key to read-only access. Keys created with read-only access can not perform modifications, but inherit the read permissions of the user that created them. The previous behaviour of inheriting all of the users permissions is now labelled as Full Access. For more information, see https://octopus.com/docs/octopus-rest-api/how-to-create-an-api-key#choosing-an-access-level
• 10130 - Add support for image digests when specifying docker execution container images
• 10129 - Deployments with 'Deploy a Bicep template' may fail with 'Exception has been thrown by the target of an invocation. No package has been staged'
• 10127 - Updated Wait for Argo CD Applications to exclude application sources that do not target git from the commit hash checks
• 10126 - Fixed clone detection causing upgrade failures
• 10125 - Upgraded Octopus Server's Autofac dependency to 9.3.0
• 10123 - TLS protocol used by Tentacle is now managed by default Operating System configuration
• 10117 - Remove partial support for upgrading Tentacles running on macOS/OSX
• 10122 - Added hint-based search for API keys
• 10121 - Fixed bug with advanced deployment target filters not working
• 10110 - GCR, ACR and ECR feeds not caching tokens for long enough
• 10099 - Fix scoping for JSM Precondition variable
• 10116 - Tentacle file retention - phase inheriting incorrect policy
• 10115 - Update feature flags client identifier variable name to Octopus.FeatureFlags.ClientIdentifier. The existing Octopus.FeatureToggles.ClientIdentifier will continue to work, but all new usages should use Octopus.FeatureFlags.ClientIdentifier
• 10113 - Added an "All tenants" option to Insights reports. When selected, the report automatically includes all current and future tenants in the space, without needing to manually update tenant selections
• 10109 - Add preview of compliance policy evaluations in new "Evaluations" section on the policy page
• 10106 - Updated failed login audit logs to include owning user for expired API keys
• 10105 - Replaced NullReferenceException message with a not found message when acquiring a NuGet package on the target when a package doesn't exist
• 10098 - Fixed script console page where the summary text was displaying at an oversized font
• 10108 - Fixed the Recovery Agent returning an error on every response, caused by a version mismatch in its underlying AI libraries
• 10114 - Improved performance when filtering audit logs by user
• 10090 - Adding active filters to the Users page
• 10095 - Reduced Octopus Server memory usage when monitoring Kubernetes live object status for clusters with large numbers of resources, improving stability under heavy load
• 10084 - Changing the UI option for the amount of deployment targets to be displayed doesn't change the amount displayed
• 10094 - New options for channel rules to enable "most recently published" feed sorting, and regex filtering rules
• 10064 - new dashboard filters
• 10093 - Improve error messaging when creating an invalid certificate
• 10102 - Deleting a Kubernetes deployment target now also removes its associated entries from the Kubernetes Live Object Status view. Previously, the deleted target's section continued to appear with its resources frozen at their last-reported state
• 10080 - Added support for clearing Container Feed and Project parameters in process template and project template usages
• 10087 - Update error code from Platform Hub endpoints that return Git resources to return 400 instead of 500 when no Version Control has been configured
• 10086 - Update Subscription page frontend with enhancements
• 10085 - Improved contrast between errors and warnings in task log for colorblind users
• 10082 - Add image repository and tag to containers list in Kubernetes Live Object Status Pod summary
• 10079 - Show system variables on tenant variables pages 'Insert variables' popover
• 9998 - Refresh list of Argo CD Applications at the start of each Argo CD step
• 10078 - Fixed warning about docker registry credentials during docker deployments
• 10025 - Renaming a tag in a Target-scoped TagSet silently breaks deployment target roles
• 10063 - The Kubernetes monitor status can remain as online, even when the cluster is unavailable
• 10074 - The My API Keys page (My Profile > My API Keys) is now a table matching the Manage API Keys page, with an API key type column, a purpose search, and pagination
• 10073 - Agent filters to audit log (By API keys and AI events)
• 10088 - Add support for Kubernetes agent/worker Calamari Image Volume feature. See the documentation on how to enable this feature on your agent or worker
• 10069 - Introduce Agent Service Account type
• 10071 - The Manage API Keys page (Configuration > API Keys) now has an API key type column and an API key type filter, so administrators can tell user keys and AI agent keys apart and narrow the list to either
• 10068 - Add API key hints to auditing events
• 10065 - Project Icon and Name now change in the favourites
• 10066 - API keys can now be marked as belonging to a user or an AI agent on the My Profile / My API Keys page. The actor type is shown as a tag on each existing key and exposed in the API key endpoints, so external tooling can tell the two apart