Changelog
Back to All

July 2026 Release Notes

about 2 hours ago by Ashley Nader

Arthur Platform

Governance & Access Control

  • Organization Governance Admin permissions. Org Governance Admins can now manage groups, view policy Check History and policy-check logs, list models across all workspaces, and retrieve complete model records—enabling full policy owner workflows out of the box.
  • Workspace Policy Manager access. Workspace Policy Managers can now access their assigned workspace, view the Applications tab, access policy detail tabs (Previous Checks, rule definitions, assignment management), and view applications assigned to policies within their workspace scope without requiring additional roles.
  • Org policy reader role. Added missing permissions so users with the org policy reader role can access all intended policy-related functionality without errors, and are correctly routed to governance features on login.
  • Governance role routing. Users with governance roles but no assigned workspace are now automatically redirected to the global governance view instead of being stuck at the workspace selection screen.
  • Global policy view consolidation. The global policy view now uses the organization-wide list models API endpoint, providing consistent, centralized model information across policy management.

Model & Data Management

  • Organization-wide model discovery. A new API endpoint allows users to query and retrieve all models across their entire organization, providing a unified view beyond individual workspaces.
  • Connector flow reset. Exiting the data connector configuration modal via cancel, escape, backdrop click, or automatic closure now returns all form fields, connector type, and step to a clean initial state.

Inference & Data Visualization

  • PDF support in Inference Deep Dive. Added PDF file rendering with a Base64Pdf component, in-cell thumbnail previews, and a hover preview popper, expanding visualization beyond images.
  • Inference Deep Dive image scroll. Scroll functionality added to image previews in the Inference Deep Dive table for easier viewing of large or complex images.
  • Session filters for traces. Session filters added to the traces filtering interface, bringing feature parity with the GenAI Engine for more granular query and analysis.

Dashboards, Alerts & Metrics

  • Dashboard date range alignment. Date range handling now consistently aligns to minute boundaries, eliminating visual misalignment between the time picker and data sent to Upsolve dashboards.
  • Alert performance chart fix. The alert performance chart now correctly renders breaches at the end of the timeline by seeding a padded context window, ensuring trailing-edge and newly-fired alerts display correctly.
  • Custom metric tag hints. Added an informational tooltip to the tag hints input explaining its column-filtering behavior, and replaced the generic placeholder with a "No columns in dataset match selected tags" empty state for clearer feedback.

Enterprise Integration & Identity

  • OIDC Integration Intake Form. A new customer-facing form guides enterprise customers through configuring their identity provider with Arthur, covering required SSO endpoints, optional group-based RBAC, org email domain auto-enrollment, and PKCE requirements.

Schema & UI

  • Schema-config tags alphabetical order. The schema-config tags dropdown now displays options in alphabetical order, making the list predictable and scannable.
  • Upsolve dashboard styling. Resolved CSS issues in the Upsolve dashboard drawer and refactored the CSS sync process, consolidating overrides and reorganizing vendor CSS generation for improved maintainability.

Bug Fixes

  • Fixed a zero division error in alert rule logging that occurred when posting an empty logs list.
  • Fixed the tour ripple animation to expand by a consistent ~16px on all sides regardless of target element size.
  • Resolved incorrect MIME type headers for .mjs files in nginx configuration that caused PDF.js thumbnail generation to fail with "Expected a JavaScript-or-Wasm module script" errors.
  • Fixed workspace policy manager access to policy views by reorganizing modal fetching logic and refactoring policy card and management button components.

Arthur Engine & Toolkit

Prompts, Experiments & Evaluations

  • Multimodal prompts in Prompts Playground. Users can now attach images to user-role messages via a new "Add image" button and thumbnail UI, with attachments persisting across edits and page reloads.
  • Agent Experiments evaluation results. The Agent Experiments summary page now displays an Overall Eval Performance section with pass-rate cards and a per-test-case Evals column with color-coded status chips.
  • Built-in evaluator clarity. Built-in evaluators now display a "Built-in" pill and an informational note explaining that Arthur maintains and locks their detection logic, making them easy to distinguish from custom evaluators.
  • Prompt experiment out-of-memory fix. Fixed two independent OOM issues in prompt experiments by flushing test cases per dataset row at create-time and streaming summaries at run-time, enabling large mapped dataset columns (e.g., RAG context) to complete without errors.

Datasets & Traces

  • Bulk add traces to dataset. Users can now select multiple traces and add up to 25 at once to a dataset via a new "Add to dataset" toolbar action, backed by a new /api/v2/datasets/{dataset_id}/bulk-add-traces endpoint.
  • Dataset unsaved changes warning. A warning alert now notifies users when navigating away from a dataset with unsaved column configurations, preventing silent loss of work on empty datasets.
  • Dataset Row ID search. Fixed dataset search so records can now be retrieved by their Row ID.

Deployment & Infrastructure

  • GenAI Engine online/offline model loading toggle. Refactored model PVC support into a clean online/offline toggle via modelPVC.enabled, resolving read-only mount issues and allowing users to switch between Hugging Face and pre-populated PVC loading.
  • EKS Auto Mode GPU support. Documented GPU configuration for EKS Auto Mode with Karpenter, including NodePool manifests and validated Helm values settings for g4dn instance families.
  • ml-engine HorizontalPodAutoscaler. Added an HPA to the arthur-ml-engine Helm chart (enabled by default), scaling on CPU (50%) and memory (80%) with configurable replica bounds of 2–10, bringing it to feature parity with arthur-genai-engine.
  • CycloneDX SBOM attestations. SBOM attestations are now attached to genai-engine, ml-engine, and model-upload images and published to a stable, public S3 location, replacing ephemeral GitHub Actions artifacts.
  • Private image repository documentation. Added step-by-step guidance for mirroring images and configuring pull secrets across all three Helm chart READMEs.
  • Ingress TLS and HTTPS documentation. Documented ingress TLS options, topology-aware config templates, conditional TLS blocks, and post-install warnings for common HTTPS misconfigurations.

Security

  • HuggingFace transformers RCE patch. Upgraded to v5.3.0 to address CVE-2026-4372 (CVSS 7.8), a critical RCE vulnerability allowing arbitrary code execution via malicious config.json files. Note: this is a breaking change; review model-loading workflows before deploying.
  • transformers arbitrary code execution patch. Updated to v5.5.0 to address CVE-2026-5241, a critical arbitrary code execution vulnerability in the LightGlue model loading path.
  • NLTK arbitrary file read patch. Updated to v3.10.0 to fix CVE-2026-54293, a critical arbitrary file read vulnerability in nltk.data.load().
  • axios DoS patch. Updated to v1.18.0 to fix a critical denial-of-service vulnerability (GHSA-pmv8-rq9r-6j72) in FormData field-name parsing.
  • pypdf DoS patch. Updated to v6.14.0 to address CVE-2026-59937 and CVE-2026-59938, protecting against denial-of-service attacks via maliciously crafted PDF files.
  • pytest tmpdir vulnerability patch. Updated to v9.0.3 to address CVE-2025-71176, a local privilege-escalation vulnerability on UNIX systems. Note: pytest v9 introduces breaking changes requiring a pytest-asyncio upgrade.

User Interface

  • PROMPT span kind support. Pinned all copies of OpenInference semantic conventions to v2.5.0 and added proper color and icon mappings for the new PROMPT span kind.
  • Australian timezones. Added Brisbane, Adelaide, Darwin, and Perth to the Settings timezone selector, covering Eastern, Central, and Western Australian zones.
  • Trace annotation readability. Improved readability of annotation explanations in the trace annotations modal with a new expandable table row component.

Bug Fixes

  • Reverted PostgreSQL from version 18 to version 16 and pinned it to prevent future breaking upgrades that caused broken data volume mounts.
  • Fixed race conditions in model-upload manifest commit steps across ECS, FS, and GCP workflows by staging before pulling and retrying the pull-and-push sequence up to five times.
  • Fixed the Task-card Success % for continuous evaluations to exclude non-terminal statuses (SKIPPED, PENDING, RUNNING) from the denominator, preventing artificially deflated success rates.
  • Fixed the "Add to Dataset" wizard Cancel button to correctly close the dialog.
  • Fixed a crash in add-to-dataset span search when span values are non-string types.
  • Corrected the GPU NodePool configuration example in the EKS Auto Mode Helm guide, updating the limits syntax to the v1 API to eliminate strict decoding errors.
  • Repositioned the AI Assistant button so it no longer overlaps pagination controls in the Observe tab.
  • Corrected overlapping "Last Updated" and "Actions" columns in the evaluators list.
  • Added missing umbrella values.yaml.template fields (genaiEngineSecretStoreKeyName, auditLog, gcpDiscoveryConfig, genaiEngineOpenAIVerifySSL) to prevent Helm schema validation failures, nil-pointer dereference errors, and worker boot crashes on fresh installs.
  • Corrected critical gaps in AWS EKS + EFS model-store documentation, including broken Terraform references, a config-copy race condition, access-point UID/GID requirements, and EFS mount target constraints.