Recent Updates

Stay up to date with the latest changes and improvements from the Runbook Automation development team.

This page shows recently merged pull requests from both the Runbook Automation product repository and the open source Rundeck repository merged since the last self-hosted release of 6.0.1 on July 15, 2026.

Recent Changes

Runner operation metrics: Busy status, live utilization bars, and expandable stat cards

Runners now expose real-time operation metrics in the Runner Management UI. Each runner and replica row shows a live utilization progress bar (running / max operations) in the new Operations column. Clicking a row expands a panel with five stat cards — Utilization %, Running, Max, Queued, and Completed — giving operators an at-a-glance view of capacity without leaving the management page.

Runners also report a new Busy health status (yellow badge) when their operation queue backs up under heavy concurrent job load. Previously this showed as Unhealthy (red) — the same signal as a broken or offline runner — making it impossible to distinguish capacity saturation from an actual failure. Older runners that don't yet report metrics show a warning in the expand panel prompting an upgrade.

Fix compact report processor silently disabled by bootstrap cleanup failures

<!--

To include as part of release notes, label as "release-notes/include" and fill in this section. Copilot can help.

-->

Fix: API REST metrics trigger SQL errors PR #10186

Fixed an issue where retrieving execution metrics through the REST API generated repeated SQL conversion errors in the logs when using the H2 database, ensuring clean logs and reliable metrics responses.

Bump linkify-it to 5.0.1+ to fix ReDoS CVEs

Addressed two security advisories (CVE-2026-48801 and CVE-2026-59887) in a third-party library used to render Markdown links in the Rundeck UI. The vulnerability could allow specially crafted text to consume excessive CPU and slow down the interface; this update upgrades the affected library to a fixed version.

Parse blankIfUnexpandable from script plugin YAML config PR #10319

Fixed an issue where shell variable references such as ${VAR} and ${VAR:-default} in scripts run by script-based step plugins could be stripped out before the shell had a chance to evaluate them, causing those variables to resolve to empty values. Script plugins can now preserve these expressions so they expand correctly at runtime.

Bump attribute-match-node-enhancer to 1.0.3 PR #10331

The bundled Attribute Match Node Enhancer plugin now supports attribute value substitution, letting you build new node attributes and tags from a node's existing attributes using ${attribute} syntax (for example, image-${ec2.imageId} or endpoint=${host}:${port}). This makes it possible to derive richer, dynamic metadata for nodes without external scripting. The update also adds a new "is present" match operator (~~), so enhancement rules can target nodes based simply on whether an attribute exists, regardless of its value, complementing the existing "not present" (!!) operator.

add date formater for api/** endpoints PR #10318

Fixed a change in API date formatting introduced by the Grails 7 / Spring Boot 3 upgrade, where date/time fields in API responses began including milliseconds (e.g. 2026-03-25T21:16:50.123Z). API date values are once again returned in second-precision UTC ISO-8601 format (e.g. 2026-03-25T21:16:50Z) across both JSON and XML and for all API versions, restoring compatibility for existing API integrations.

Jira: https://pagerduty.atlassian.net/browse/RUN-4550

This pull request standardizes the serialization of all Date values in Rundeck API responses to use second-precision W3C/ISO-8601 format in UTC (e.g., 2026-03-25T21:16:50Z), removing milliseconds. This change restores backward compatibility for API consumers after an upgrade to Grails 7 / Spring Boot 3, which began including milliseconds by default. The update is enforced for all API versions and is covered by comprehensive tests across affected endpoints.

API Date Serialization Standardization:

Introduced a custom marshaller in ApiMarshallerRegistrar to serialize all Date values in API JSON and XML responses with second-precision W3C/ISO-8601 format (no milliseconds), and registered it for every API version. [1] [2]
Updated RdExecutionController to configure Jackson's ObjectMapper to use the same date format for consistency in controller responses. [1] [2]

Test Coverage and Verification:

Added ApiDateMarshallerSpec to verify that all relevant DTOs and endpoints serialize dates without milliseconds, for both JSON and XML, across all API versions.
Updated and extended tests in ApiControllerSpec, MenuControllerSpec, and RdExecutionControllerSpec to assert that API responses do not include milliseconds in date fields. [1] [2] [3] [4] [5] [6] [7] [8]

This ensures consistent, backward-compatible date formatting for all API consumers, preventing regressions and aligning with previous API behavior.

Persist useName in job reference step to prevent UUID reversion PR #10314

Fixed an issue in the workflow editor where a Job Reference step set to reference a job by name would revert to referencing by UUID the next time the step was edited. The name-vs-UUID selection is now saved with the step and preserved across edits.

Fix label not being saved PR #10235

Fixed an issue where the label (description) on a Job Reference step was not saved—both when adding a new job reference step and when editing an existing one—causing the label to disappear or revert after saving. Job Reference step labels are now preserved correctly.

add a new index to the execution table PR #9964

Add indexes on execution, referenced_execution, and job_file_record to improve the performance of execution history queries and the Execution API.

- Fix Node UI paging to respect rundeck.gui.matchedNodesMaxCount, and a… PR #10234

Fixed incorrect paging on the Nodes page that occurred when the number of nodes shown per page was increased via the rundeck.gui.matchedNodesMaxCount setting. Page counts and the pager controls at the bottom of the page now calculate correctly based on the configured page size.

Fix System Report runner health counts always reporting 0

Fixed an issue where the System Report showed all runner health counts as zero (healthy, unhealthy, new, unknown, and down) even when runners were active and healthy. The report now accurately reflects each runner's current health status, so operators relying on the System Report get a correct view of their runner fleet.

Fix ACL policy API returning JSON instead of YAML PR #10295

Fixed an issue where the ACL policy API returned JSON with the policy wrapped in a contents field even when YAML was requested via the Accept: application/yaml header. The endpoint now correctly returns the raw YAML policy document again, restoring compatibility for ACL import, diff, and backup tooling that relies on YAML responses.

Fix i18n fallback for dynamically registered plugin messages PR #10246

Fixed an issue where plugin-provided i18n messages would show raw translation keys instead of English text for users whose locale was not en_US and a specific key was missing in their locale's message catalogue.

Fix compacted execution output API returning mixed-type entries array PR #10219

Fixed the compacted execution output API (GET /api/*/execution/{id}/output?compacted=true&format=json), which previously returned a mix of full objects and bare strings in its entries array—causing errors in clients that expected every entry to be an object with a log field. As of API v59, all compacted log entries are returned as consistent objects (omitting only unchanged fields), while API v58 and earlier keep their existing behavior for backward compatibility.

Add option to choose what value is used for GCP Resource Model hostname

The GCP resource model source now lets you choose which value is used as a discovered node's hostname—instance name, internal IP, or external IP—and set a default username for those nodes. Discovered GCP nodes also now expose both their internal IP and external IP as node attributes, making it easier to connect to instances across peered VPCs or different GCP projects.

Fix Jira plugin createmeta fallback for Jira Cloud team-managed projects

Fixed Jira issue creation failing on Jira Cloud team-managed projects with a "Failed to find issue type" error even when the issue type existed. Both the Jira "Create Issue" workflow/job step and the Jira issue-creation notification now fall back to a supported issue-type lookup so issues are created successfully in these projects, while behavior for Jira Server / Data Center is unchanged.

Bump py-winrm-plugin to 3.2.0 PR #10205

Resolved intermittent failures of Windows (WinRM) jobs using Kerberos authentication when many executions run concurrently. Previously, running large numbers of Kerberos WinRM jobs at the same time could fail with GSSError: Credential cache is empty because all executions shared a single Kerberos credential cache. Each execution now uses its own isolated credential cache, so high-concurrency WinRM workloads run reliably.

Convert adhoc page to Vue SPA PR #10138

The Commands (adhoc) page has been rebuilt as a modern Vue single-page application, available when the new NextUI option is enabled. This delivers faster, more responsive command execution and a consistent look and feel with the rest of the redesigned Rundeck interface.

Fix SSM Node Executor to use regional STS endpoints for opt-in regions

Fixed an issue where AWS SSM node command and script execution failed in opt-in regions (such as eu-central-2) when using cross-account role assumption, previously returning an InvalidClientTokenId error. A new optional ssm-sts-region setting also lets operators choose which region's STS endpoint is used for authentication, while existing configurations continue to work unchanged.

Add Configurable Group Name Attribute And Prefix Filter To Azure Group

The Azure (Entra ID) user group source can now be configured to use a specific directory attribute as the Rundeck group name (for example, onPremisesSamAccountName instead of the default displayName), and to optionally include only groups matching a name prefix. This lets administrators align group names between sign-in tokens and directory lookups—eliminating the need to maintain duplicate group names in ACLs—while existing configurations continue to behave exactly as before.

Fix Hostname -> hostname in tool tip on node filter input PR #10162

Minor fix of capitalization on the word "hostname".

Preserve accumulated data vars when secureOption storagePath uses node variable PR #10220

Fixed an edge case where data.* variables set by log filter plugins (e.g. key-value-data) were lost in subsequent workflow steps when a secure option's storage path contained a node context variable such as ${node.name}.

Add default time filter to activity/executions listing PR #10190

Adds a feature flag rundeck.feature.activityDefaultTimeFilter.enabled that, when enabled, scopes the activity/executions page to a configurable recent time window on first load. The window defaults to the last month and is configurable via gui.activity.defaultTimeFilter (accepted values: 1h, 1d, 1w, 1m).

Fix AWS Secrets Manager assume-role session expiry causing ExpiredTokenException

Fixed an issue where the AWS Secrets Manager key storage plugin, when configured with an assume-role ARN, stopped retrieving secrets after about one hour on long-running Rundeck instances and failed with ExpiredTokenException. The plugin now automatically refreshes the assumed-role session, so secrets remain accessible without needing to restart Rundeck.

Fix StorageTreeFactory stopping at first gap in provider index sequence PR #10225

Fixed an issue where key storage providers and converters configured with non-contiguous index numbers were silently skipped, making any keys stored under the skipped providers inaccessible. Rundeck now loads every configured storage provider regardless of gaps in the index sequence, so administrators no longer need to keep provider indexes perfectly consecutive when configuring key storage outside the UI (for example, via rundeck-config.properties or automated/API-driven setups).

Fixed: Failed login attempts are now audited when Rundeck is configured with rundeck.jaaslogin=true. Previously, JAAS authentication failures were silently dropped from the audit log.

Fix inline script step with Args not working with AWS SSM

Fixed a bug where inline script steps with args configured would fail with an S3 403 error when using the AWS SSM node executor. Script arguments are now correctly passed to the SSM commandLine parameter instead of being appended to the S3 URI.

Fix cannot manage user class for usernames containing slashes

Fix User Class management for usernames containing / (e.g. pronouns like He/Him). Assigning and removing User Class assignments now works correctly for these users.

Fix PagerDuty Notification Start Incident Workflow trigger

Fixed an issue where PagerDuty "Start Incident Workflow" notifications failed to trigger because the configured Incident ID and Incident Workflow ID were not being read correctly. These notifications now work as expected, and a clear error is logged if either required value is missing.

Fix legacy MySQL JDBC driver class at startup

Fixed a startup failure that occurred after upgrading when the database configuration still referenced the legacy MySQL JDBC driver class (com.mysql.jdbc.Driver or com.mysql.cj.jdbc.Driver). Rundeck now automatically substitutes the bundled MariaDB driver in these cases so the server starts successfully, and logs a warning directing operators to update their configuration.

Fix KeyStorageSelector state not resetting on reopen PR #10155

Fix PagerDuty V3 webhook: selecting a key from the Key Storage selector now correctly populates the Shared Secret Key field.

Fix job import resetting dispatch mode when node filter is empty PR #10171

Fixed an issue where jobs configured as "Dispatch to nodes" with an empty node filter were silently converted to "Execute locally" after export + reimport (via YAML, XML, Job Actions upload, SCM import, project archive import, or Terraform provider).

Fix Remote URL auth headers not appended when fetching option values PR #10152

Fixed a regression where Remote URL job options configured with API Key or Basic authentication were not sending the configured authentication headers or query parameters when fetching option values, causing the option dropdown to fail to load with an authentication error.

Remove usernames from System Report

The System Report no longer includes individual usernames or their userclass mappings. This improves privacy by ensuring user identities are not captured in generated system reports, while license allocation and usage totals continue to be reported.

Fixes bulk edit when using NextUI PR #10189

Fixed the layout of the bulk edit controls on the Jobs page when using the next-generation UI, correcting the alignment and structure of the header so bulk actions display properly.

Fix node filter attributes incorrectly wrapped in double quotes PR #10157

Fix node filter: saving a filter with multiple attributes (e.g. osFamily: unix name:localhost) no longer incorrectly wraps them in double quotes. Pre-quoted values are also preserved correctly when re-loading a saved filter.

Improve audit log userInfo.username showing null or anonymous for job runs PR #10168

Fix audit log userInfo.username for job run events. Scheduled jobs no longer show null and API/webhook-triggered jobs no longer show __grails.anonymous.user__ — both now correctly reflect the user associated with the execution.

Stay informed about Rundeck development by subscribing to a feed:

These feeds are updated regularly to highlight changes that are available in Runbook Automation SaaS and will be included in upcoming Self Hosted releases.

About These Updates

The development updates are automatically generated from both our private repository for the commercial product and the public open source repository. These changes have been merged since the last GA release and provide insight into what's coming in the next Self Hosted release.

Note: These updates reflect changes merged since the last GA release. Self-hosted customers should refer to the Release Notes section for version-specific updates applicable to their installation.

List Last updated: 2026-07-27