From 8bc8c8ba31761b43df6ad02f66ebeb7228bbbe42 Mon Sep 17 00:00:00 2001 From: Palina_Kryvasheyeva Date: Tue, 4 Aug 2026 13:32:56 +0200 Subject: [PATCH 1/3] Revise upgrade instructions for version 1.46 Updated upgrade instructions for version 1.46, including new environment variables, breaking changes, and configuration updates. --- docs/releases/1.46/upgrade-to-1.46.md | 30 ++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) diff --git a/docs/releases/1.46/upgrade-to-1.46.md b/docs/releases/1.46/upgrade-to-1.46.md index 8b584dca2..ca93eee7e 100644 --- a/docs/releases/1.46/upgrade-to-1.46.md +++ b/docs/releases/1.46/upgrade-to-1.46.md @@ -224,14 +224,34 @@ This release includes **high-priority changes**. Please review the [full upgrade > > - **Tool-call file parameter formatting** — `config/predefined/skills/tool-call-file-parameter-formatting/SKILL.md` (v1.0 → v1.1) (#479) ---- +#### ai-dial-core `0.46.0-rc.0` -#### ai-dial-core `0.45.7` +##### Breaking changes -##### New environment variables +**MODEL and APP_TYPE_SCHEMA moved from public to platform bucket** -| Variable | Default | Required | Description | +Resources previously stored in the public bucket are now stored in the platform bucket. Any tooling, scripts, or integrations that reference these resources by their public-bucket path will break. + +| Previous configuration | Required action | +|---|---| +| MODEL and APP_TYPE_SCHEMA referenced from public bucket paths | Update references to use the platform bucket paths; verify with the corrected entityId and canonical helpers | + +**`owner_sub` renamed to `owner_user_id` in OBO credentials API** + +The field `owner_sub` in the on-behalf-of credentials API response/request has been renamed to `owner_user_id`. Any client or integration relying on the old field name will break. + +| Previous configuration | Required action | +|---|---| +| API consumers using `owner_sub` field in OBO credentials requests/responses | Update all API consumers to use `owner_user_id` instead of `owner_sub` | + +##### Configuration changes + +| Setting | Default | Required | Description | |---|---|---|---| -| `unknown` | — | No | A flag to print the Authorization header in logs was added. Operator should be aware this could expose sensitive credentials if enabled. | +| `toolsets.security.allowedRedirectUris` | `[]` | Conditional | List of redirect URIs clients can provide during toolset OAuth sign-in. A URI is accepted only if it is listed here or equals the toolset's own `redirect_uri`; for dynamic client registration, all URIs from this list are registered with the authorization server. | +> [!IMPORTANT] +> **Required when more than one client can start a toolset sign-in** (e.g. DIAL Chat and the Admin panel), since a toolset can pin only one `redirect_uri` of its own. Leaving it empty in such deployments makes sign-in fail for every client whose callback URL does not match the toolset's pinned `redirect_uri`. + +--- --- From 6fd3413bd50bb1ed803f514fc7677d57c76bb4c9 Mon Sep 17 00:00:00 2001 From: Palina_Kryvasheyeva Date: Tue, 4 Aug 2026 13:40:23 +0200 Subject: [PATCH 2/3] Revise upgrade instructions for version 1.46 Updated upgrade instructions for version 1.46, including component versions, new environment variables, and breaking changes. --- docs/releases/1.46/upgrade-to-1.46.md | 68 ++------------------------- 1 file changed, 5 insertions(+), 63 deletions(-) diff --git a/docs/releases/1.46/upgrade-to-1.46.md b/docs/releases/1.46/upgrade-to-1.46.md index ca93eee7e..1e98779e7 100644 --- a/docs/releases/1.46/upgrade-to-1.46.md +++ b/docs/releases/1.46/upgrade-to-1.46.md @@ -111,72 +111,14 @@ This release includes **high-priority changes**. Please review the [full upgrade --- -#### ai-dial-chat `1.0.0-rc.2` +#### ai-dial-chat ### New environment variables | Variable | Required | Description | Available Values | Default values | -|---|---|---|---|---| -| `ALLOWED_IMAGE_SOURCES` | No | Whitespace-separated list of origins/hosts permitted to load images. External images in markdown are blocked by default (CSP `img-src`) to prevent data exfiltration; add any external origin that legitimately serves icons, avatars, or theme images. Same-origin, `data:`, `blob:`, and the `THEMES_CONFIG_HOST` origin are always allowed. | Any origin valid format. List of space separated URLs/hosts. | `'self' data: blob: THEMES_CONFIG_HOST` | -| `QUICK_APPS_SCHEMA_2_ID` | No | `applicationTypeSchemaId` for the Quick App v2 application type. | Any string | *(empty)* | - -> [!NOTE] -> 2.0 resolves all runtime configuration server-side in `apps/chat-api`; the frontend reads none of these directly. The full env-var surface (including the per-provider auth tables and archive limits) lives in `apps/chat-api/README.md` and `docs/environment-variables-migration-guide.md`. The key operator-facing variables are listed below. - -### Environment variables - -| Variable | Default | Description | -| --------------------------------- | ------------------------------ | ---------------------------------------------------------------------------------------------------- | -| `DIAL_CORE_URL` | — (required) | Internal DIAL Core service URL, never exposed to clients | -| `DIAL_CORE_EXTERNAL_URL` | — | Public DIAL Core URL browsers can reach, used to build client-side MCP endpoint links | -| `DIAL_API_VERSION` | `2024-10-21` | API version query parameter sent to DIAL Core (#6996) | -| `DIAL_API_KEY` | — | Server-only key for utility-model tasks; not used for user-scoped routes | -| `DEFAULT_DEPLOYMENT` | — | Default deployment shown to users without a persisted selection | -| `FEATURED_MODEL_IDS` | `[]` | Comma-separated model/application IDs marked featured in the catalog (#7322) | -| `HIDDEN_ENTITY_TAGS` | `[]` | Comma-separated tags that hide catalog entities while keeping them visible in the Quick App 2.0 form (#7324) | -| `ALLOWED_IFRAME_ORIGINS` | `[]` | Origins allowed to embed / be embedded (CSP `frame-src`); required for Quick Apps editors and the overlay (#7711) | -| `OVERLAY_ENABLED` | `false` | Enables the chat-overlay embedded runtime (has no effect unless an origin is also allowlisted) | -| `FILE_MANAGER_AVAILABLE_TABS` | `my_files,shared,organization` | Comma-separated subset controlling which File Manager tabs are shown | -| `ASR_MODEL` | — | Deployment ID of a dedicated speech-to-text model for transcription | -| `UTILITY_MODEL` | — | Deployment ID of a utility model for server-side tasks such as conversation naming | -| `LLM_CONVERSATION_NAMING_ENABLED` | `false` | Auto-rename conversations after the first assistant reply (with `UTILITY_MODEL` + `DIAL_API_KEY`) | -| `LOG_LEVEL` | environment-dependent | Minimum backend log level: `debug`, `log`, `warn`, or `error` (#7857) | - -### New feature flags - -| Flag | Description | -| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | -| `features.asrEnabled` | ASR transcription; derived from `ASR_MODEL` presence, restrict to roles via `ASR_ENABLED_ROLES` | -| `features.llmConversationNaming` | LLM conversation naming; requires `UTILITY_MODEL` + `DIAL_API_KEY` + `LLM_CONVERSATION_NAMING_ENABLED=true` | -| `features.liveChatInteraction` | Interactive toolset sign-in mid-completion; toggled via `LIVE_CHAT_INTERACTION_ENABLED` (restrict via `LIVE_CHAT_INTERACTION_ENABLED_ROLES`) | - -### New environment variables - -| Variable | Default | Description | -| ------------------------------------ | -------------------- | --------------------------------------------------------------------------------------------------------------------------------- | -| `CONVERSATION_BODY_SIZE_LIMIT_BYTES` | `10485760` (10 MB) | Maximum JSON request-body size (in bytes) the API accepts; raised above the framework default so large conversations can be saved | -| `OVERLAY_SANDBOX_ENABLED` | `false` | Serves the overlay sandbox static app at `/overlay-sandbox/`; intended for development/test environments only | - -### Behavioral changes - -> [!NOTE] -> Security response headers change on upgrade: the Chat backend now sends `Cross-Origin-Opener-Policy: same-origin-allow-popups` instead of Helmet's `same-origin` default so toolset OAuth popups keep their opener reference. Frameguard / `frame-ancestors` framing behavior is unchanged. - -- COOP header relaxed to `same-origin-allow-popups` to support the toolset OAuth popup flow (#8036) - -### New environment variables - -| Variable | Default | Description | -| ------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| `ANNOUNCEMENT_HTML_MESSAGE` | (unset) | Operator-authored HTML shown in a dismissible top-of-app announcement banner; unset/empty hides it. Allowed tags: `a`, `b`, `strong`, `em`, `br`, `span`. Dismissal is keyed by message text, so changing the value re-shows the banner. | - -### Behavioral changes - -> [!NOTE] -> The default HTTP server port changed from `3005` to `5000`. Deployments that rely on the default (container port mappings, reverse-proxy upstreams, `AUTH_CALLBACK_BASE_URL`, health checks) must be updated; the image's `EXPOSE` is now `5000`. - -- Default `PORT` changed `3005` → `5000` — the `.env.template`, `AUTH_CALLBACK_BASE_URL` example, and Docker `EXPOSE` were updated to match (#8053) - +|---|:---:|---|---|---| +| `ALLOWED_IMAGE_SOURCES` | No | Space-separated list of additional origins/hosts from which images may load in Markdown and entity descriptions. External images are blocked by default to prevent data exfiltration; add any legitimate external image origin here. Same-origin, `data:`, `blob:`, and `THEMES_CONFIG_HOST` are always allowed. Sign-in provider icons and auth-provider avatar hosts are always appended. | Any space-separated URL origins or hosts | `'self' data: blob: THEMES_CONFIG_HOST https://authjs.dev/img/providers/ https://s.gravatar.com/ https://i1.wp.com/cdn.auth0.com/avatars/ https://cdn.auth0.com/avatars/` | +| `QUICK_APPS_SCHEMA_2_ID` | No | `applicationTypeSchemaId` for the Quick App v2 application type | Any string | `https://mydial.epam.com/custom_application_schemas/quickapps2` | --- #### ai-dial-quickapps-backend `0.10.0` @@ -224,7 +166,7 @@ This release includes **high-priority changes**. Please review the [full upgrade > > - **Tool-call file parameter formatting** — `config/predefined/skills/tool-call-file-parameter-formatting/SKILL.md` (v1.0 → v1.1) (#479) -#### ai-dial-core `0.46.0-rc.0` +#### ai-dial-core `0.46.0` ##### Breaking changes From dae223537b413f2dd67d9333ada20eb6a41c7468 Mon Sep 17 00:00:00 2001 From: Palina_Kryvasheyeva Date: Tue, 4 Aug 2026 13:41:35 +0200 Subject: [PATCH 3/3] Revise upgrade instructions for version 1.46 Updated upgrade instructions for version 1.46, including Helm chart and component versions, general notes, release-specific notes, new environment variables, deprecated variables, and breaking changes. --- docs/releases/1.46/upgrade-to-1.46.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/releases/1.46/upgrade-to-1.46.md b/docs/releases/1.46/upgrade-to-1.46.md index 1e98779e7..6de53f2f5 100644 --- a/docs/releases/1.46/upgrade-to-1.46.md +++ b/docs/releases/1.46/upgrade-to-1.46.md @@ -111,7 +111,7 @@ This release includes **high-priority changes**. Please review the [full upgrade --- -#### ai-dial-chat +#### ai-dial-chat `0.48.0` ### New environment variables