Skip to content

NodePilot 1.5.1

Choose a tag to compare

View all tags
@Sev7eNup Sev7eNup released this 16 Oct 20:16
· 115 commits to main since this release
v1.5.1
a8b6b90

Added

  • Server log on the log page. The application log, where platform errors land, is a second
    tab next to the workflow events. Repeated warnings and errors are grouped, the page says how much
    of the requested window it could read, and the daily download is a redacted export (audited as
    APP_LOG_DOWNLOADED). The MCP tool get_support_diagnostics reads it with kind='server'.
  • The Engine Switcher works without a NodePilot account. A local administrator can switch
    workflows with a machine key that only administrators can read and that the server accepts only
    from the same machine. Allowlist entries may now be quoted.
  • The executions list sorts on the server (sortBy, sortDir) across all pages and updates live.
  • The designer has a button back to the workflow list. The AI chat in the designer sees the lint
    findings of the canvas and reads scripts, SQL queries and program arguments in clear; values that
    look like secrets stay masked, and an administrator can switch this off per LLM profile.
  • Update-NodePilot.ps1 -AllowDowngrade: an update to an older version is refused without it.

Changed

  • The dashboard's running and recent-executions lists are denser: trigger badges, grouped child
    runs, duration bars, who started a run and step progress. The Prometheus telemetry tile is gone;
    /observability/summary stays.
  • The metrics pages use Grafana's 24-column grid correctly, so KPIs sit in one strip and charts are
    smaller and sorted.
  • Designer group boxes are quiet tinted frames with a corner label and nine colours instead of five.
  • enable runs the same checks as publish, including the agent configuration
    (400 invalid_agent_configuration).
  • A system restore rejects an unknown policy or section with 400 instead of skipping it.
  • Junction mode and requiredCount are validated on save (400 invalid-junction-config).
  • An invalid pattern under Logging:Redaction:Patterns now stops the start instead of being ignored.
  • Failed alert deliveries are retried after 30 s, 2, 10 and 30 minutes and keep the real failure
    reason. The "alert delivery failed" policy counts by the last try.
  • A step retry with maxDelayMs of 0 or less waits at most 30 seconds.
  • The workflow editor page was split into smaller parts; behaviour is unchanged.

Fixed

  • Cancelling a run records the running step as Cancelled and starts no follow-up step.
  • A trigger value or step output containing {{...}} is no longer resolved a second time.
  • A restApi step that hits its own timeout fails instead of cancelling the whole run.
  • Failed actions in the UI (cancel, resume, PNG export and others) show an error instead of nothing.
  • Run status, critical path and coverage in the designer survive lock, unlock and publish refetches.
  • The OIDC role mapping no longer loses focus on every keystroke; the system alert editor can clear
    a route secret; the condition builder shows not(group), trigger inputs and stale references
    instead of dropping them; the connection test resets when node, machine or credential changes.
  • The dashboard shows a retry instead of loading forever when its first request fails; errors in a
    page show the localized error screen.
  • The MCP server picks up a later np auth login without a restart.
  • The file watcher trigger no longer writes its checkpoint for every ignored file event.
  • SCIM can deprovision an administrator account that is already inactive. OIDC account creation is
    audited (USER_OIDC_JIT_CREATED).
  • The SCOrch import warns when a step with several conditional incoming links changes meaning.
  • Selection in the designer, the workflow table's sort order and the folder counts of global
    variables survive navigation and refetches.

Security

  • .NET security update. The ASP.NET Core and .NET packages move to 10.0.13 and the server setup
    bundles runtime 10.0.13. This closes the advisories Microsoft published on 2026-10-13:
    CVE-2026-70179 (Windows authentication), CVE-2026-70159 (SignalR), CVE-2026-84008 and
    CVE-2026-70162 (System.Security.Cryptography.Pkcs) and CVE-2026-96958, -96959 and -96960
    (System.Security.Cryptography.Xml). NodePilot 1.5.0 is affected; update to 1.5.1.
  • UNC paths written with mixed separators (\/server\share) are rejected by the path guards.
  • The SSRF guards always block the IPv6 cloud metadata endpoints (fd00:ec2::254, fd20:ce::254),
    also when private networks are allowed.
  • llmQuery no longer sends the profile's API key to a baseUrl that a node points elsewhere.
  • Secrets that are not strings (numbers, objects) are masked before AI calls and protected in the
    AI chat and MCP merges.
  • serviceManagement validates the service name before it reaches sc.exe.
  • StartProgram:DisallowShellExecute is read the same way everywhere; only an explicit false
    turns it off.
  • Audit and lifecycle writes land even when the request is cancelled, and audit events reach the
    SIEM only after their transaction commits.
  • The server setup no longer prints the trigger key or setup token into its log when the setup
    adapter runs it.
  • The desktop app's Electron fuses are hardened: no Node mode, no NODE_OPTIONS or inspector
    flags, cookies encrypted, and the app loads only from its integrity-checked archive.
  • The Switcher uses its configuration and the np CLI only from locations that only administrators
    can write.
  • CI runs with a read-only token.

Downloads and verification

File Purpose
NodePilot-Server-Setup-1.5.1.exe GUI installer for the server
NodePilot-Desktop-Setup-1.5.1.exe desktop installer
NodePilot-1.5.1.zip + .manifest.json + .p7s server payload with detached signed manifest
NodePilot-Deploy-Scripts-1.5.1.zip install scripts, verified before the payload is extracted
NodePilot-Switcher-1.5.1-win-x64.zip standalone Engine Switcher
nodepilot-release-signing.cer publisher certificate
NodePilot-1.5.1.SHA256SUMS.txt SHA-256 of every file above

Release signing certificate thumbprint (SHA-1): 277EAB317A581C88302CE92BE805938C86B4650D

The certificate is self-signed, so Get-AuthenticodeSignature reports UnknownError. Check that the
signer is CN=NodePilot Release Signing and that its thumbprint equals the one above. Windows
SmartScreen warns on first run because the publisher has no reputation yet.

The server setup bundles .NET runtime 10.0.13 and the PostgreSQL 16 client; the desktop setup
bundles PostgreSQL 16.6.

Testing

  • Backend: full suite, Release build, elevated: Engine 3245, Api 3130, Ai 829, CLI 630, Data 342,
    MCP 221 and Switcher 167 passed, none failed. dotnet list package --vulnerable --include-transitive is empty.
  • Frontend: lint, 3643 unit tests, 475 end-to-end tests; docs site lint, 221 tests and build;
    desktop 126 tests. CI on the release commit is green.
  • Release lab, server setup on the signed 1.5.1 artifacts: 14/14 scenarios passed, including fresh
    installs and updates from 1.5.0 for gMSA and LocalSystem against SQL Server and PostgreSQL, a
    second installation over an existing one, a remote SQL Server, a restart, a database outage
    during start-up, the CRL pre-flight refusal and AllSigned execution policy.
  • Release lab, desktop setup: 124/124 checks passed, including fresh install, restart,
    over-install with the shell open, uninstall and reinstall variants and the update from 1.5.0.
  • Workflow test suite on the long-running lab instance after updating it to 1.5.1:
    pass=38, fail=0, skipped=13 (invasive and not-configured integration workflows are disabled by
    profile; triggers are judged from their cadence).
Assets 11
Loading