User Portal

Appearance

AireFlow Release Notes ​

Version: v2.41.0
Release Date: 23 September 2026

✨ New Features ​

  • Expanded Owner and Assignee Type Options (FLOW-1331)
  • Smarter HTTP Request Body Validation (FLOW-1299)
  • Direct Access to Configurator's Vault UI (FLOW-1356)

🔧 Tasks ​

  • Faster, More Reliable Pagination (FLOW-1102)

🐞 Bug Fixes ​

  • Updated Vulnerable JavaScript Libraries (FLOW-1318)
  • Fixed Verbose Server Error Messages (FLOW-1323)
  • Fixed Task Patch API Crash (FLOW-1351)
  • Fixed Incorrect API Key Policy Caching (FLOW-1355)

Detailed Changes ​

✨ New Features ​

Expanded Owner and Assignee Type Options (FLOW-1331) ​

Description

Owner Type and Assignee Type fields have been aligned with AireFrame, adding support for the full set of identifier types (User, Subject, Subject Proxy, External, Client Credentials, System and Unknown) via a dropdown, with a toggle to switch to free text. As part of this change, the Owner Type field on the API has moved from a fixed list of values to a plain string.

What this means for you

When setting an owner or assignee on a task, you can now choose from the same full range of options available in AireFrame, including client credentials, rather than being limited to a shorter dropdown or free text only.

Smarter HTTP Request Body Validation (FLOW-1299) ​

Description

The HTTP Request Task body field is now validated against the content type you select, with support for automatically closing quotes, brackets and tags, and highlighting invalid syntax. Liquid templating syntax is recognised and is no longer flagged as invalid.

What this means for you

When building HTTP Request tasks, you'll get immediate, inline feedback if your request body doesn't match the format you've selected, making it easier to spot and fix mistakes before you save.

Direct Access to Configurator's Vault UI (FLOW-1356) ​

Description

Links that previously pointed to the Vault API now open Configurator's Vault UI in a new window instead, signed in with the same tenant so you can view the current tenant's variables and secrets directly.

What this means for you

You can now jump straight into a readable, browsable view of your vault variables and secrets, instead of being shown a raw API response.

🔧 Tasks ​

Faster, More Reliable Pagination (FLOW-1102) ​

Description

Keyset-based pagination has been implemented for the UI and the AireFrame data provider, replacing offset-based paging, which could produce inconsistent results such as skipped or duplicated records on large or frequently changing lists. Offset-based pagination remains available on the API for backwards compatibility.

🐞 Bug Fixes ​

Updated Vulnerable JavaScript Libraries (FLOW-1318) ​

Description

Several third-party JavaScript libraries served by AireFlow, including DOMPurify, React, GraphQL, core-js, uuid, highlight.js and Autolinker, were flagged with known vulnerabilities during penetration testing. Dependencies have been reviewed and updated where possible to reduce the application's exposure.

Fixed Verbose Server Error Messages (FLOW-1323) ​

Description

The API was returning detailed technical error messages, including deserialisation error details, when malformed input was submitted. These verbose messages have been suppressed so that internal implementation details are no longer exposed in error responses.

Fixed Task Patch API Crash (FLOW-1351) ​

Description

Sending a PATCH request to update a task could intermittently fail with a null reference error, returning a 500 response. This has been fixed so that task updates via the API complete reliably.

Fixed Incorrect API Key Policy Caching (FLOW-1355) ​

Description

Authorisation policies were being cached incorrectly when authenticating with an API key, which could result in the wrong access policy being applied. Policy caching for API key authentication has been corrected.