Deployment compatibility
For Kubernetes, deploy this prerelease together with Helm chart 0.7.0. Executor sandboxes now enforce memory with cgroup v2, and nsjail executors refuse to start without the sandbox cgroup bootstrap that chart 0.7.0 provides; do not upgrade only the application image on chart 0.6.0. TRACECAT__SANDBOX_DEFAULT_MEMORY_MB (executor.sandboxMemoryMib) is now an aggregate budget per sandbox, and the per-process address-space guard defaults to twice that budget (TRACECAT__SANDBOX_ADDRESS_SPACE_MB, executor.sandboxAddressSpaceMib). Executors using the direct backend are unaffected.
Breaking changes
- feat(agents)!: Surface underlying error as agent.executor.unclassified (#3676)
- feat(rbac+ui)!: Pin roles to their level; drop workspace RBAC pages (#3682)
- fix(engine)!: Enforce executor sandbox memory with cgroups (#3668)
- feat(engine)!: Remove legacy workflow interactions (#3716)
Security
- fix(audit): Resolve client IPs on Fargate behind Service Connect (#3695)
- fix(audit): Bypass Service Connect proxy for Fargate ALB traffic (#3696)
Case management
- feat(cases+ui): Add JSON custom field type with highlighted editor (#3711)
- feat(cases+actions): Accept short IDs for case_id inputs (#3713)
- feat(cases+tables): Add, edit and view linked rows from the case page (#3719)
- fix(ui+cases): Bound alert dialogs to the viewport and scroll (#3720)
- fix(ui+cases): Sort case tasks alphabetically (#3718)
- feat(tables+cases): Search and sort rows by column (#3728)
- docs(cases+tables): Add aggregate and search cheatsheet (#3731)
- fix(tables+cases): Keep rows visible while a row query loads (#3735)
- feat(cases+tables): View related cases for a linked table row (#3745)
Tables
- feat(tables+ui): Replace vector search status strip with header badge (#3712)
- feat(tables+ui): Show semantic search columns on badge and headers (#3727)
- feat(enterprise+tables): Gate semantic search behind an entitlement (#3730)
- fix(tables): Reject empty row updates with a 400 instead of a 500 (#3752)
Agents
- fix(agents): Retry rate-limited LLM requests in the socket proxy (#3674)
- fix(agents): Classify disabled model access as user config failure (#3673)
- feat(agents): Add output_type override to ai.preset_agent (#3666)
- fix(agents): Attribute mcp failures (#3602)
- feat(agents): Stream foreground Pi child sessions (#3618)
- feat(agents): Define mention syntax and reference contracts (#3684)
- feat(agents): Discover and subscribe to AWS Bedrock models (#3694)
- fix(agents): Block ScheduleWakeup and ListAgents Claude Code tools (#3699)
- feat(agents+enterprise): Open source approvals and inbox, gate channels (#3710)
- fix(ui): Show interrupted subagent child tools as interrupted (#3722)
- fix(agents): Run Claude Code subagents in the foreground (#3723)
- feat(agents+api): Add default agents and opt-in chat visibility (#3724)
- fix(agents): Read reasoning_effort from newer agent payloads (#3725)
- feat(agents): Allow approval-gated subagents on capable backends (#3734)
- feat(ui+agents): Redesign agent preset builder and agents list (#3751)
Tracecat MCP
- feat(mcp): Support attaching subagents to agent presets (#3650)
- fix(mcp): Default agent presets to latest subagents and skills (#3686)
Integrations
- fix(integrations): Read full S3 object body in AWS Boto3 call_api (#3677)
- perf(integrations): Read GitHub sync pulls from one commit tarball (#3688)
- feat(integrations): Expand Wazuh API coverage for detection and response (#3703)
- feat(integrations): Add Palo Alto Networks PAN-OS, Strata and Prisma Cloud templates (#3704)
- feat(integrations): Add FortiSIEM actions and event query helper (#3709)
Engine
- fix(engine): Prevent duplicate attempts overwriting stored results (#3705)
API
- fix(ui+api): Explain SAML enforcement on social login errors (#3664)
- feat(ui+rbac): Restore workspace add member button with org auto-invite (#3698)
- refactor(api): Read SAML attributes from parsed assertion (#3706)
- feat(ui+rbac): Add member access columns and invite-to-group (#3707)
- fix(api+ui): Polish secret stores ui/ux (#3701)
- fix(ui+api): AWS secret refs in Git sync, fix store setup docs (#3717)
User interface
- fix(ui): Forward client IP on integration OAuth and GitHub App installs (#3687)
- fix(ui): Show full template key names in the credential dialog (#3746)
Infrastructure
- docs(infra): Correct unified backend chart requirement (#3672)
Dependencies
- build(deps): Patch PyJWT, urllib3, oauthlib and axios advisories (#3715)
Full changelog: 1.1.0-alpha.9.1...1.1.0-alpha.10