TracecatHQ/tracecat 1.0.0

Tracecat 1.0.0

on GitHub

Breaking changes

• feat(api)!: Require an entitlement for additional workspaces (#3462)
• security(deps)!: Update runtime dependencies (#3471)
• security(agents)!: Block SSRF in MCP and custom LLM requests (#3499)

Security

• security: Fix polynomial regexes and dom xss (#3479)

Case management

• feat(cases): Add filtered case aggregation (#3419)
• feat(cases): Aggregate cases by dropdowns and tags (#3443)
• feat(cases): Add case aggregation action (#3444)
• fix(ui+cases): Drop horizontal scroll in linked rows tables (#3445)
• fix(ui+cases): Thin hover scrollbars on linked rows grids (#3446)
• fix(cases): Return validation errors for internal attachment uploads (#3460)

Tables

• feat(tables): Add table row aggregation action (#3418)

Agents

• feat(agents): Grant tools declared by attached skills (#3324)
• feat(ui): Edit skill tool metadata with a picker (#3325)
• fix(agents): Classify LLM failures and diagnose read timeouts (#3432)
• fix(agents): Avoid fatal LLM errors during proxy shutdown (#3439)
• fix(agents+docs): Expose case and table aggregation actions (#3450)
• feat(agents): Open source presets, skills, and MCP catalog connectors (#3461)
• feat(agents): Add Ollama, vLLM, LiteLLM, OpenRouter built-in providers (#3464)
• docs(agents): Mark presets, skills, secrets/variables, and MCP catalog as open source (#3465)
• refactor(agents): Unify dashboard selection and guide model setup (#3473)
• fix(agents): Preserve original errors during runtime cleanup (#3492)

Functions

• fix(functions): Extract escaped-dot defanged URLs (#3491)

Integrations

• feat(integrations): Add Vercel Security firewall templates (#3449)
• fix(ui+integrations): Label MCP OAuth picker by provider grant type (#3451)
• fix(integrations): Let RunReveal MCP connect to a self-hosted server URL (#3455)
• fix(integrations): Bound registry discovery allocator arenas (#3488)
• docs(infra): Warn to back up compose file and Caddyfile on update (#3494)
• feat(integrations): Add AWS role chaining to boto3, S3, and DuckDB (#3516)

Engine

• fix(engine): Raise executor payload limit default to 5 GiB (#3441)
• fix(engine): Preserve registry tool timeout attribution (#3452)
• fix(engine): Preserve cancellation while returning workflow results (#3456)
• feat(engine): Add unsafe knob to disable secret error withholding (#3458)
• fix(engine): Preserve registry tool cancellation (#3486)

API

• fix(api): Skip denied Temporal search attribute registration (#3426)
• fix(api): Return classified webhook failures without platform alerts (#3457)

User interface

• feat(ui): Add connected status filter and sort connected MCP servers first (#3510)

Infrastructure

• infra: Drop platform tracing from Fargate (#3403)
• docs(infra): Add Docker Compose action throughput sizing guide (#3511)
• infra: Tune Compose executor concurrency (#3513)
• infra: Pull MinIO image from quay.io instead of Docker Hub (#3517)

Observability

• fix(logging): Identify Temporal activity timeouts in Sentry (#3421)
• fix(logging): Capture platform failures at their source (#3428)
• fix(logging): Preserve registry discovery crash diagnostics (#3459)

Documentation

• docs: Add feature GIF grid to README (#3466)
• docs: Refresh air-gapped model guidance (#3493)

Dependencies

• build(deps): Patch js-yaml transitive dependencies (#3477)

Other changes

• chore: Add Codex local environment for development (#3478)
• chore: Trim AGENTS.md and move path-specific rules into nested notes (#3481)
• chore: Run uv sync and pnpm install in parallel in Codex setup (#3483)

Full changelog: 1.0.0-beta.52...1.0.0