v2.68.0

Added

• It's now possible to change the minimum user role needed to create organizations by setting the CVAT_ORGANIZATIONS_MIN_ROLE_TO_CREATE environment variable (#10688)

• Added attempt and request_duration fields to webhook deliveries (#10693)

• Added an audio annotation workspace with waveform controls, interval regions, and audio task creation (#10708)

Changed

• [CLI] Simplified native function agent task cache limiting to keep the last 10 task caches after task annotation stopped persisting shared chunk caches. (#10714)

• [CLI] Native function agents now download and process task image chunks incrementally for task annotation requests, reducing temporary disk usage and allowing progress updates to start sooner. (#10675)

Fixed

• Preserve annotation source in GT jobs during edit/undo/redo so annotations in GT jobs no longer displayed as GT. (#10659)

• Restricted organization workers assigned to resources from exporting datasets, annotations, or backups unless they own the resource or relevant parent resource (#10685)

• Bug which retained organization name in the list even when its deleted (#10690)

• Fixed stale unsaved-change prompts after saving audio interval annotations (#10708)

v2.67.0

Added

• [Server API] The project/task/job preview endpoints accept the Prefer: handling=empty header (RFC 7240). When set, entities without a media-derived preview (e.g. point cloud tasks) return 204 No Content instead of the default placeholder. (#10611)

Fixed

• [SDK] Fixed a PyTorch UserWarning about non-writable tensors when converting polygon masks to tensors in ExtractInstanceMasks. (#10680)

• Memory growth during schema generation (#10679)

Security

• Fixed an XSS vulnerability in annotation guide asset handling (GHSA-w6mx-95ff-72cv)

v2.66.0

Added

• [Server API] Interval annotations: new annotation type with start/stop boundaries (#10583)

• [Server API] Backup export and import for audio tasks (#10583)

• [Server API] Generic TSV dataset format for importing and exporting interval annotations (#10583)

• Added client IP address tracking to event logs (#10545)

• Added the ability to move objects between layers when z-order sorting is enabled in the object sidebar (#10613)

• Added the ability to move an object to a specific layer from the object item menu (#10613)

• Added the ability to move and merge existing layers by drag and drop (#10613)

• Added layer compaction for minimizing annotation z-order layers and re-enumerating them (#10613)

• Added z-order filtering for annotations (#10613)

• Added layer display support in canvas object details (#10613)

• Chunk download retries in case of network errors (#10651)

• [CLI] Added backup and create-from-backup commands for projects (#10618)

• [CLI] Added export-dataset and import-dataset commands for projects in cvat-cli (#10639)

• [SDK] Added an ExtractInstanceMasks PyTorch target transform for torchvision instance segmentation models. (#10654)

• Added CI to trigger build of agent images in cvat-models repo, moved code from ai-models/ to cvat-models repo (#10629)

Changed

• [SDK] ExtractBoundingBoxes now returns an empty boxes tensor with shape [0, 4] instead of [0]. (#10654)

Fixed

• Return a validation error when swapping label attribute names instead of failing with an integrity error (#10625)

• Return a validation error when renaming a label attribute to an existing attribute name instead of failing with an integrity error (#10625)

• Fixed severe truncation of label names in the annotation page Labels sidebar (#10641)

• Fixed a crash when backing up a task with no manifest that's been migrated to backing cloud storage (#10668)

v2.65.0

Added

• Support filtering by skeleton sub-label and sub-label attributes in the Filters modal (#10195)

• [Server API] The media_type field for tasks and jobs (#10538)

• [Server API] An option to create audio-based tasks (#10560)

• An option to import annotations without removing the existing ones in task and job annotation uploads. (#10573)

• [Server API] New filter parameters: read_only on /api/access_tokens; user_id and accepted on /api/invitations; org_id on /api/requests. The accepted field is now also returned by /api/invitations, and operation.org_id by /api/requests (#10569)

• Webhook deliveries are now retried automatically on 5xx, connection errors, and timeouts, with backoff 5s → 5min → 30min → 3h → 24h × 4 (#10578)

• [Server API] Ground truth jobs can now be created in audio tasks (#10582)

• [Server API] Webhook events create:export and create:backup that fire when a dataset export or a project/task backup finishes (success or failure), so subscribers no longer need to poll /api/requests for the outcome (#10585)

• Username updates are now available from the profile page (#10595)

• Added support for deleting label attributes from the label editor and REST API (#10596)

• Added support for adding, editing, and deleting skeleton element attributes after task or project creation (#10596)

• Added raw label editor warnings when removing saved attributes, including skeleton element attributes (#10596)

• Added cancellation support for export requests that are already in progress (#10600)

• A shortcut to show or hide the bitmap layer on 2D annotation view. (#10603)

Changed

• [Server API] Annotations now use 0 as the default value for groups instead of null. It worked this way already, but wasn't reflected in the server API. No behavior or logic changes. (#10522)

• Change case of 'Checkbox' var names in label editor to lower case (#10535)

-[Server API] The dimension field of tasks without data will now be empty instead of 2d (#10538)

• [Server API] Tasks without data will not report their chunk types or chunk size (#10551)

• [Server API] The minimum accepted value of image_quality in /api/tasks/<id>/data is now 1 (was 0); 0 was never a usable JPEG quality (#10551)

• [Server API] Enum-like fields (e.g. status, state, role, type, provider_type) are no longer matched by the ?search= parameter on list endpoints; use the corresponding exact-match filter instead (#10569)

• Updated Django to 5.2.x (#9896)

• The server Docker image is now based on Ubuntu 24.04 (#10597)

• Restricted updates of existing label attributes to fields that do not invalidate annotations (#10601)

• [Server API] Made the requirements for inputs representing paths in cloud storage or attached file share more strict in several endpoints; empty, .. and . components are no longer accepted and neither are leading slashes (GHSA-6f87-4g86-p9gw)

Deprecated

• [Server API] The use of null for the group field in annotations. Use 0 instead. (#10522)

• [Server API] image_quality in /api/tasks[/<id>] and /api/{tasks,jobs}/<id>/data/meta endpoints for 3D tasks (#10551)

Fixed

• Backend chunk job failures now preserve more meaningful exception details (#10495)

• S3 cloud-storage status probes now fail fast on unreachable or misconfigured endpoints (#10495)

• Helm deployments now support multiple releases in one namespace by rendering OPA, Redis, and Kvrocks wiring with release-scoped service and secret names (#10496)

• Updated psycopg2-binary to avoid local macOS test startup failures caused by older bundled libpq versions, including SCRAM authentication requires libpq version 10 or above when connecting to PostgreSQL (#10497)

• Task creation with remote_files now returns a readable validation error when a URL is unreachable or uses an unsupported scheme, instead of a 500 with a raw traceback (#10554)

• Fixed polygon/polyline auto simplification switch state is shared (#10568)

• [Server API] Improved performance of the organization, membership, and invitation endpoints (#10576)

• Show server health-check failures and timeout details when CVAT cannot reach required services (#10579)

• Clarified 3D cuboid size labels in the object details sidebar to use Length, Width, and Height terminology. (#10586)

• Fixed task backup export for tasks with media stored in cloud storage when image database rows are returned out of frame order (#10589)

Security

• Fixed multiple path traversal vulnerabilities (GHSA-6f87-4g86-p9gw)

v2.64.0

Added

• Polygon and polyline simplification to reduce the number of points. Accessible via button in object menu (or shortcut) for single object and via annotation actions for multiple objects (#10449)

• The server can now be configured to store all new eligible tasks on a particular backing cloud storage (#10514)

Removed

• The unused list chunk type. This change is not expected to affect anyone. (#10524)

Fixed

• Fixed chunk retrieval for tasks with point cloud files in the .bin format located in cloud storage (#10523)

• Fixed creating tasks from .bin files in cloud storage that are less than 16384 bytes long (#10523)

• Fixed PCDLoader incorrectly reading intensity values in some point cloud files. (#10532)

• Fixed incorrect reported per-task time in the movetasktobackingcs and movetaskfrombackingcs commands (#10533)

Security

• Fixed a cross-site scripting vulnerability in code related to annotation guides (GHSA-m2h7-6xqm-p9v5)

v2.63.0

Added

• CI for agent images + fixed CVE 2025-69720(68121) (#10423)

• [CLI] The function create-native command now allows creating functions with public visibility (#10459)

• The movetasktobackingcs and movetasktobackingcs commands can now load a list of tasks to migrate from a file (#10504)

• The movetasktobackingcs and movetasktobackingcs commands now print statistics about the transfer (#10504)

Changed

• When importing track annotations from a dataset, the last visible shape of every interval will now include 2 keyframes - the last visible shape and the outside shape. If the annotations were originally created in CVAT, the "keyframe" property can be slightly different from the original annotations after importing. (#10409)

• CVAT now verifies that the filters defined in Rego policy files call add_organization_filter when the corresponding object belongs to an organization (#10400)

• The movetasktobackingcs and movetasktobackingcs no longer exit with a failure status when the given task already has the expected backing CS (#10504)

• Updated Kvrocks to 2.15.0 (#10515)

Removed

• Log output to the /home/django/logs/supervisord.log.* files has been disabled, leaving only stdout output (#10437)

Fixed

• Added missing hover tooltips for annotation job page left toolbar controls (#10379)

• Fixed issue text scaling when zooming into an annotation via double-click (#10403)

• Imported tracks can be interpolated incorrectly (#10409)

• Added background to skeleton point state item elements for better visibility and readability on the canvas (#10430)

• Annotation score is not preserved in backups (#10445)

• Invalid date of annotations.json in backups (#10445)

• Snap to point was not working with rotated bounding boxes (#10448)

• Snap to contour is not working with rotated bounding boxes (#10457)

• New passwords are now limited to 8 to 256 characters across registration, password change, and password reset flows (#10460)

• Tasks without manifests can now use backing cloud storage (#10504)

• First drawn point was not snapping in snap to point feature (#10509)

• Prevented half-created tasks from being moved to backing cloud storage (#10513)

v2.62.0

Added

• Show success notification after saving annotation guide (#10342)

• Compose for transformers + Helm support for function name env var (#10388)

Changed

• The format for filters in Rego policy files has changed; if you have added custom policy files, you may need to update them (#10387)

• 'Remove annotations' confirmation message now more user-friendly.

• 'Delete' button renamed to 'Remove' to match the message (#10407)

• Bounding box is used as a default prompt for SAM models instead of points (#10432)

• Snap to contour and snap to point features are now accessible on the controls sidebar (#10421)

Fixed

• Width misalignment between top bars and content lists (tasks, jobs, projects, cloud storages, webhooks pages) by applying consistent scrollbar gutter spacing. (#10324)

• Content size on resource pages for smaller screens (<1000px) to provide better responsive layout (#10324)

• Exported interpolated shapes in 3D cuboid tracks can have invalid rotation (#10413)

• Fixed chunk generation in tasks with backing cloud storage where the manifest contains incomplete paths (#10429)

v2.61.0

Added

• "Snap to point" feature for polygon and polyline editing. While enabled, points being moved or drawn will automatically snap to nearby points from other shapes (#10353)

• Join tool now supports polygon shapes, allowing to merge multiple polygons into a single unified polygon. (#10362)

Changed

• Minor visual improvements on the controls sidebar (#10374)

Fixed

• Helm modifiable permissionFix paths and command (#7932)

v2.60.0

Added

• Docker + compose for YOLO (#10325)

• Interactors can now return multiple shapes instead of a single one (#10329)

• Interactors can now return a confidence attribute. If present, interaction results can be filtered in the UI (#10329)

• Added UI controls to remove point and rectangle prompts when using Interactors or OpenCV tools (#10329)

• Server may add text prompts to interactors as text_prompts field in POST: /api/lambda/functions/<id> (#10329)

Changed

• Unified the expected interactor interface to align with the /annotations API and AI detector outputs (#10329)

• Updated the IoG serverless function to support the new interactor interface (#10329)

Fixed

• Reduced memory usage by replacing JavaScript arrays with typed arrays (#10329)

• Fixed memory leaks related to unreleased object URLs in cvat-canvas (#10329)

• [SDK] Fixed a crash in TasksRepo.create_from_backup, ProjectsRepo.create_from_backup, Task.upload_data that could occur if a recoverable error occurred during chunk uploading (#10375)

v2.59.1

Fixed

• Missing escaping for string fields in .csv export (#10345)

Full Changelog: v2.59.0...v2.59.1