Skip to content

fix: Revise upgrade instructions for version 1.46 #588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PolinaGurinovich97 merged 3 commits into from
Aug 4, 2026
Merged

fix: Revise upgrade instructions for version 1.46 #588

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8bc8c8b
Revise upgrade instructions for version 1.46
PolinaGurinovich97 Aug 4, 2026
6fd3413
Revise upgrade instructions for version 1.46
PolinaGurinovich97 Aug 4, 2026
dae2235
Revise upgrade instructions for version 1.46
PolinaGurinovich97 Aug 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
96 changes: 29 additions & 67 deletions docs/releases/1.46/upgrade-to-1.46.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,72 +111,14 @@ This release includes **high-priority changes**. Please review the [full upgrade

---

#### ai-dial-chat `1.0.0-rc.2`
#### ai-dial-chat `0.48.0`

### New environment variables

| Variable | Required | Description | Available Values | Default values |
|---|---|---|---|---|
| `ALLOWED_IMAGE_SOURCES` | No | Whitespace-separated list of origins/hosts permitted to load images. External images in markdown are blocked by default (CSP `img-src`) to prevent data exfiltration; add any external origin that legitimately serves icons, avatars, or theme images. Same-origin, `data:`, `blob:`, and the `THEMES_CONFIG_HOST` origin are always allowed. | Any origin valid format. List of space separated URLs/hosts. | `'self' data: blob: THEMES_CONFIG_HOST` |
| `QUICK_APPS_SCHEMA_2_ID` | No | `applicationTypeSchemaId` for the Quick App v2 application type. | Any string | *(empty)* |

> [!NOTE]
> 2.0 resolves all runtime configuration server-side in `apps/chat-api`; the frontend reads none of these directly. The full env-var surface (including the per-provider auth tables and archive limits) lives in `apps/chat-api/README.md` and `docs/environment-variables-migration-guide.md`. The key operator-facing variables are listed below.

### Environment variables

| Variable | Default | Description |
| --------------------------------- | ------------------------------ | ---------------------------------------------------------------------------------------------------- |
| `DIAL_CORE_URL` | — (required) | Internal DIAL Core service URL, never exposed to clients |
| `DIAL_CORE_EXTERNAL_URL` | — | Public DIAL Core URL browsers can reach, used to build client-side MCP endpoint links |
| `DIAL_API_VERSION` | `2024-10-21` | API version query parameter sent to DIAL Core (#6996) |
| `DIAL_API_KEY` | — | Server-only key for utility-model tasks; not used for user-scoped routes |
| `DEFAULT_DEPLOYMENT` | — | Default deployment shown to users without a persisted selection |
| `FEATURED_MODEL_IDS` | `[]` | Comma-separated model/application IDs marked featured in the catalog (#7322) |
| `HIDDEN_ENTITY_TAGS` | `[]` | Comma-separated tags that hide catalog entities while keeping them visible in the Quick App 2.0 form (#7324) |
| `ALLOWED_IFRAME_ORIGINS` | `[]` | Origins allowed to embed / be embedded (CSP `frame-src`); required for Quick Apps editors and the overlay (#7711) |
| `OVERLAY_ENABLED` | `false` | Enables the chat-overlay embedded runtime (has no effect unless an origin is also allowlisted) |
| `FILE_MANAGER_AVAILABLE_TABS` | `my_files,shared,organization` | Comma-separated subset controlling which File Manager tabs are shown |
| `ASR_MODEL` | — | Deployment ID of a dedicated speech-to-text model for transcription |
| `UTILITY_MODEL` | — | Deployment ID of a utility model for server-side tasks such as conversation naming |
| `LLM_CONVERSATION_NAMING_ENABLED` | `false` | Auto-rename conversations after the first assistant reply (with `UTILITY_MODEL` + `DIAL_API_KEY`) |
| `LOG_LEVEL` | environment-dependent | Minimum backend log level: `debug`, `log`, `warn`, or `error` (#7857) |

### New feature flags

| Flag | Description |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| `features.asrEnabled` | ASR transcription; derived from `ASR_MODEL` presence, restrict to roles via `ASR_ENABLED_ROLES` |
| `features.llmConversationNaming` | LLM conversation naming; requires `UTILITY_MODEL` + `DIAL_API_KEY` + `LLM_CONVERSATION_NAMING_ENABLED=true` |
| `features.liveChatInteraction` | Interactive toolset sign-in mid-completion; toggled via `LIVE_CHAT_INTERACTION_ENABLED` (restrict via `LIVE_CHAT_INTERACTION_ENABLED_ROLES`) |

### New environment variables

| Variable | Default | Description |
| ------------------------------------ | -------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| `CONVERSATION_BODY_SIZE_LIMIT_BYTES` | `10485760` (10 MB) | Maximum JSON request-body size (in bytes) the API accepts; raised above the framework default so large conversations can be saved |
| `OVERLAY_SANDBOX_ENABLED` | `false` | Serves the overlay sandbox static app at `/overlay-sandbox/`; intended for development/test environments only |

### Behavioral changes

> [!NOTE]
> Security response headers change on upgrade: the Chat backend now sends `Cross-Origin-Opener-Policy: same-origin-allow-popups` instead of Helmet's `same-origin` default so toolset OAuth popups keep their opener reference. Frameguard / `frame-ancestors` framing behavior is unchanged.

- COOP header relaxed to `same-origin-allow-popups` to support the toolset OAuth popup flow (#8036)

### New environment variables

| Variable | Default | Description |
| ------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `ANNOUNCEMENT_HTML_MESSAGE` | (unset) | Operator-authored HTML shown in a dismissible top-of-app announcement banner; unset/empty hides it. Allowed tags: `a`, `b`, `strong`, `em`, `br`, `span`. Dismissal is keyed by message text, so changing the value re-shows the banner. |

### Behavioral changes

> [!NOTE]
> The default HTTP server port changed from `3005` to `5000`. Deployments that rely on the default (container port mappings, reverse-proxy upstreams, `AUTH_CALLBACK_BASE_URL`, health checks) must be updated; the image's `EXPOSE` is now `5000`.

- Default `PORT` changed `3005` → `5000` — the `.env.template`, `AUTH_CALLBACK_BASE_URL` example, and Docker `EXPOSE` were updated to match (#8053)

|---|:---:|---|---|---|
| `ALLOWED_IMAGE_SOURCES` | No | Space-separated list of additional origins/hosts from which images may load in Markdown and entity descriptions. External images are blocked by default to prevent data exfiltration; add any legitimate external image origin here. Same-origin, `data:`, `blob:`, and `THEMES_CONFIG_HOST` are always allowed. Sign-in provider icons and auth-provider avatar hosts are always appended. | Any space-separated URL origins or hosts | `'self' data: blob: THEMES_CONFIG_HOST https://authjs.dev/img/providers/ https://s.gravatar.com/ https://i1.wp.com/cdn.auth0.com/avatars/ https://cdn.auth0.com/avatars/` |
| `QUICK_APPS_SCHEMA_2_ID` | No | `applicationTypeSchemaId` for the Quick App v2 application type | Any string | `https://mydial.epam.com/custom_application_schemas/quickapps2` |
---

#### ai-dial-quickapps-backend `0.10.0`
Expand Down Expand Up @@ -224,14 +166,34 @@ This release includes **high-priority changes**. Please review the [full upgrade
>
> - **Tool-call file parameter formatting** — `config/predefined/skills/tool-call-file-parameter-formatting/SKILL.md` (v1.0 → v1.1) (#479)

---
#### ai-dial-core `0.46.0`

#### ai-dial-core `0.45.7`
##### Breaking changes

##### New environment variables
**MODEL and APP_TYPE_SCHEMA moved from public to platform bucket**

| Variable | Default | Required | Description |
Resources previously stored in the public bucket are now stored in the platform bucket. Any tooling, scripts, or integrations that reference these resources by their public-bucket path will break.

| Previous configuration | Required action |
|---|---|
| MODEL and APP_TYPE_SCHEMA referenced from public bucket paths | Update references to use the platform bucket paths; verify with the corrected entityId and canonical helpers |

**`owner_sub` renamed to `owner_user_id` in OBO credentials API**

The field `owner_sub` in the on-behalf-of credentials API response/request has been renamed to `owner_user_id`. Any client or integration relying on the old field name will break.

| Previous configuration | Required action |
|---|---|
| API consumers using `owner_sub` field in OBO credentials requests/responses | Update all API consumers to use `owner_user_id` instead of `owner_sub` |

##### Configuration changes

| Setting | Default | Required | Description |
|---|---|---|---|
| `unknown` | — | No | A flag to print the Authorization header in logs was added. Operator should be aware this could expose sensitive credentials if enabled. |
| `toolsets.security.allowedRedirectUris` | `[]` | Conditional | List of redirect URIs clients can provide during toolset OAuth sign-in. A URI is accepted only if it is listed here or equals the toolset's own `redirect_uri`; for dynamic client registration, all URIs from this list are registered with the authorization server. |

> [!IMPORTANT]
> **Required when more than one client can start a toolset sign-in** (e.g. DIAL Chat and the Admin panel), since a toolset can pin only one `redirect_uri` of its own. Leaving it empty in such deployments makes sign-in fail for every client whose callback URL does not match the toolset's pinned `redirect_uri`.

---
---
Loading