Changelog
Back to All

July 2026 Release Notes

20 days ago by Ashley Nader

Highlights

Governance modeled around how enterprises are actually organized

Arthur now models the distinct personas in a governance program — org-wide governance admins, workspace-level policy managers, and read-only reviewers — and scopes each to exactly the authority their role needs. Policy ownership can be delegated across levels of the org hierarchy, so governance distributes across teams and workspaces instead of bottlenecking on a single administrator.

A tighter loop across the AI development lifecycle

This release tightens the full build-measure-improve loop teams run to take a GenAI app to production. Evaluation sets can now be curated straight from real production traffic and traced back to it, experiments hold up on larger and more realistic runs, and results are easier to read and trust. The through-line is a shorter, more dependable path from a signal in production to a measured improvement — from trace to dataset to experiment to eval.

Observability that keeps up with multimodal AI

As teams build applications that reason over images and documents, Arthur's monitoring surfaces now handle those inputs natively: Inference Deep Dive renders images and PDFs inline with thumbnails and hover previews, and the Prompts Playground lets teams attach images to messages and iterate on multimodal prompts directly. Teams can inspect and evaluate what their models actually see, not just the text around it.

Arthur Platform

Governance & Access Control

  • Organization Governance Admin permissions. Org Governance Admins can now manage groups, view policy Check History and policy-check logs, list models across all workspaces, and retrieve complete model records, enabling full policy-owner workflows out of the box.
  • Workspace Policy Manager access. Workspace Policy Managers can now reach their assigned workspace, view the Applications tab, open policy detail tabs, and see applications assigned to policies within their workspace scope without requiring additional roles.
  • Org Policy Reader role. Added the missing permissions so users with the Org Policy Reader role can access all intended policy functionality without errors and are correctly routed to governance features on login.
  • Governance role routing. Users with governance roles but no assigned workspace are now automatically redirected to the global governance view instead of being stranded at the workspace selection screen.
  • Global policy view consolidation. The global policy view now uses the organization-wide list-models API endpoint, providing consistent, centralized model information across policy management.
  • Per-entity permission flags. Governance entities now carry canUpdate and canDelete flags so the UI can accurately gate actions on each individual record.
  • Finer-grained action gating. Org Governance Admin controls are now gated per action rather than per role, giving administrators more precise control over each persona.
  • Permission-aware policy actions. Policy action controls are hidden entirely from users who lack permission to perform them, removing confusing dead-end controls.
  • Distinct applied-policy identity. Governance views now differentiate a policy's own id from the policy applied to a given model, with hardened error boundaries so views stay stable when a policy is applied in multiple places.

Multi-Tenancy & Onboarding

  • Automatic default workspace. Every newly created organization is now bootstrapped with a default workspace on the backend, and the frontend no longer mints its own, instead triggering onboarding only when no engine exists.
  • Org-scoped data planes endpoint. A new endpoint lists the data planes and engines scoped to an organization, letting onboarding detect existing infrastructure and skip redundant setup when the org already has an engine.

Model & Data Management

  • Organization-wide model discovery. A new API endpoint lets users query and retrieve all models across their entire organization, providing a unified view beyond individual workspaces.
  • Connector flow reset. Exiting the data connector configuration modal via cancel, escape, backdrop click, or automatic closure now returns all form fields, connector type, and step to a clean initial state.

Inference & Data Visualization

  • PDF support in Inference Deep Dive. Added PDF rendering with in-cell thumbnail previews and a hover preview popper, expanding Inference Deep Dive visualization beyond images.
  • Inference Deep Dive image scroll. Added scroll support to image previews in the Inference Deep Dive table for easier viewing of large or complex images.
  • Session filters for traces. Added session-based filters to the traces filtering interface, bringing feature parity with the GenAI Engine for more granular query and analysis.

Alerts & Monitoring

  • Alert card accuracy. Alert cards now display the correct underlying data.
  • Alert rule traceability. Non-compliant alert statuses now expose their policy_alert_rule_id, making it possible to trace an alert back to the exact policy rule that raised it.
  • Custom metric tag hints. Added an informational tooltip to the tag-hints input explaining its column-filtering behavior, and replaced the generic placeholder with a "No columns in dataset match selected tags" empty state for clearer feedback.

Enterprise Integration & Identity

  • OIDC integration intake form. A new customer-facing form guides enterprise customers through configuring their identity provider with Arthur, covering required SSO endpoints, optional group-based RBAC, org email-domain auto-enrollment, and PKCE requirements.

User Interface & Experience

  • Schema-config tags alphabetical order. The schema-config tags dropdown now displays options in alphabetical order, making the list predictable and scannable.
  • Dashboard UI refinements. A second round of dashboard fixes tightens layout and date-range handling for cleaner, more consistent dashboards.
  • Upsolve dashboard styling. Resolved CSS issues in the Upsolve dashboard drawer and refactored the CSS sync process, consolidating overrides for improved maintainability.
  • Seconds in the time selector. The time selector now supports seconds-level granularity.
  • Assignment modal infinite scroll. The user list in the assignment modal now loads incrementally as you scroll, so large organizations no longer hit a truncated list.
  • Links open in a new tab. Links can now be opened in a new browser tab, preserving your place in the app.

Bug Fixes

  • Fixed intermittent 500 errors in alert logging by replacing a check-then-insert with an atomic upsert.
  • Fixed Workspace Policy Manager access to policy views by reorganizing modal fetching logic and refactoring the policy card and management-button components.
  • Resolved a spurious permission-denied screen that could appear while governance data was loading.
  • Fixed the active workspace resetting when a user navigated to an app they were not authorized to access.
  • Corrected the MIME type served for .mjs files, which had caused PDF.js thumbnail generation to fail with "Expected a JavaScript-or-Wasm module script" errors.
  • Fixed the tour ripple animation to expand consistently regardless of target element size.
  • Fixed millisecond formatting in shared duration cells so sub-second timings render correctly.
  • Updated frontend third-party dependencies to resolve reported security advisories.

Arthur Engine & Toolkit

Prompts, Experiments & Evaluations

  • Multimodal prompts in Prompts Playground. Users can now attach images to user-role messages via a new "Add image" button and thumbnail UI, with attachments persisting across edits and page reloads.
  • Agent Experiments evaluation results. The Agent Experiments summary page now shows an Overall Eval Performance section with pass-rate cards and a per-test-case Evals column of color-coded status chips, at parity with Prompt Runs.
  • Built-in evaluator clarity. Built-in evaluators now display a "Built-in" pill and an informational note explaining that Arthur maintains and locks their detection logic, making them easy to distinguish from custom evaluators.
  • Prompt experiment out-of-memory fix. Fixed two independent OOM issues by flushing test cases per dataset row at create-time and streaming summaries at run-time, so large mapped dataset columns (e.g. RAG context) complete without crashing the container.
  • Guided prompt-experiment walkthrough. Refreshed the in-product guided tour for running a prompt experiment: choosing a prompt and comparing its versions side by side, selecting the dataset and version, and adding evaluators so every version is scored consistently.

Datasets & Traces

  • Bulk add traces to dataset. Users can now select multiple traces and add up to 25 at once via a new "Add to dataset" toolbar action, backed by a new /api/v2/datasets/{dataset_id}/bulk-add-traces endpoint.
  • Dataset-to-trace back-linking. Every dataset record now links back to the trace it originated from, so you can jump straight from a curated example to the full context it was captured in.
  • Dataset version restore. You can now reinstate a previous version of a dataset, making edits and imports safely reversible.
  • Dataset unsaved-changes warning. A warning now appears when navigating away from a dataset with unsaved column configuration, preventing silent loss of work on empty datasets.

Deployment & Infrastructure

  • GenAI Engine online/offline model loading toggle. Refactored model PVC support into a clean online/offline toggle via modelPVC.enabled, resolving read-only mount issues and letting users switch between Hugging Face and pre-populated PVC loading.
  • EKS Auto Mode GPU support. Documented GPU configuration for EKS Auto Mode with Karpenter, including NodePool manifests and validated Helm values for g4dn instance families.
  • Model loading on a regular PVC. Added guidance for deploying uploaded models on a regular PVC without requiring NFS.
  • ml-engine HorizontalPodAutoscaler. Added an HPA to the arthur-ml-engine Helm chart (enabled by default), scaling on CPU and memory with configurable replica bounds, bringing it to parity with arthur-genai-engine, and exposed those settings in the umbrella chart.
  • Private image repository documentation. Added step-by-step guidance for mirroring images and configuring pull secrets across all three Helm chart READMEs.
  • Ingress TLS and HTTPS documentation. Documented ingress TLS options, conditional TLS blocks, and post-install warnings for common HTTPS misconfigurations, and clarified that genaiEngineInternalIngressHost must include the https:// scheme.

Security

  • HuggingFace transformers RCE patch. Upgraded to v5.3.0 to address CVE-2026-4372 (CVSS 7.8), a critical remote-code-execution vulnerability via malicious config.json files. Note: this is a breaking change; review model-loading workflows before deploying.
  • transformers arbitrary code execution patch. Updated to v5.5.0 to address CVE-2026-5241, a critical arbitrary-code-execution vulnerability in the LightGlue model-loading path.
  • NLTK arbitrary file read patch. Updated to v3.10.0 to fix CVE-2026-54293, a critical arbitrary-file-read vulnerability in nltk.data.load().
  • axios DoS patch. Updated to v1.18.0 to fix a critical denial-of-service vulnerability (GHSA-pmv8-rq9r-6j72) in FormData field-name parsing.
  • pypdf DoS patch. Updated to v6.14.0 and then v6.14.2 to address CVE-2026-59937 and CVE-2026-59938, protecting against denial-of-service via maliciously crafted PDF files.
  • pytest tmpdir vulnerability patch. Updated to v9.0.3 to address CVE-2025-71176, a local privilege-escalation vulnerability on UNIX systems. Note: pytest v9 introduces breaking changes requiring a pytest-asyncio upgrade.
  • CycloneDX SBOM attestations. SBOM attestations are now attached to genai-engine, ml-engine, and model-upload images and published to a stable, public S3 location, replacing ephemeral GitHub Actions artifacts.
  • Transitive dependency remediation. Bumped locked transitive Python dependencies to patched versions, clearing 30 of 31 open pip Dependabot alerts, alongside a matching frontend vulnerability pass.
  • OpenVEX advisory justifications. Added OpenVEX not_affected statements justifying two critical perl-base CVEs (CVE-2026-13221, CVE-2026-57433) on the models-gcs image, so scanners no longer surface them as actionable.

User Interface

  • PROMPT span kind support. Pinned the OpenInference semantic conventions and added proper color and icon mappings for the new PROMPT span kind in the trace viewer.
  • Australian timezones. Added Brisbane, Adelaide, Darwin, and Perth to the Settings timezone selector, covering Eastern, Central, and Western Australian zones.
  • Trace annotation readability. Improved readability of annotation explanations in the trace annotations modal with a new expandable table-row component.

Bug Fixes

  • Reverted PostgreSQL from version 18 to version 16 and pinned it to prevent future breaking upgrades that caused broken data-volume mounts.
  • Fixed race conditions in model-upload manifest-commit steps across ECS, FS, and GCP workflows by staging before pulling and retrying the pull-and-push sequence.
  • Fixed the Task-card Success % for continuous evaluations to exclude non-terminal statuses (SKIPPED, PENDING, RUNNING) from the denominator, preventing artificially deflated success rates.
  • Fixed the "Add to Dataset" wizard Cancel button to correctly close the dialog.
  • Fixed a crash in add-to-dataset span search when span values are non-string types.
  • Fixed dataset search so records can now be retrieved by their Row ID.
  • Fixed the first record added to a dataset so its transform is recognized automatically, without requiring "Fill from Object".
  • Extended the unsaved-changes alert to cover leaving the dataset flow via the sidebar.
  • Moved task-list sorting and "Active in last N days" filtering server-side so relative time filters return correct results.
  • Corrected the GPU NodePool configuration example in the EKS Auto Mode Helm guide, updating the limits syntax to the v1 API.
  • Repositioned the AI Assistant button so it no longer overlaps pagination controls in the Observe tab.
  • Corrected overlapping "Last Updated" and "Actions" columns in the evaluators list.
  • Added missing umbrella values.yaml.template fields (genaiEngineSecretStoreKeyName, auditLog, gcpDiscoveryConfig, genaiEngineOpenAIVerifySSL) to prevent Helm schema validation failures, nil-pointer dereferences, and worker boot crashes on fresh installs.
  • Corrected gaps in the AWS EKS + EFS model-store documentation, including broken Terraform references, a config-copy race condition, and access-point UID/GID requirements.
  • Fixed the documented genaiEngineInternalHost Helm value to include the http:// scheme.