Quarterly Release: July 2026¶

Current Versions¶

Upgrading to July Release¶

Follow the upgrade guide for details on how to successfully upgrade to the July release.

Patch history¶

August 13, 2026¶

This release fixes a scheduler bug where two active schedules on the same deployment firing at the same time could create only one flow run. Each schedule now creates its own flow run for deployments created or updated after the idempotency key format cutoff. The cutoff defaults to January 1, 2027 at 00:00 UTC. To enable the fix sooner, set PREFECT_CLOUD_ORION_SCHEDULER_NEW_IDEMPOTENCY_KEY_FORMAT_CUTOFF to a time at or after this Server image was deployed, then update or redeploy affected deployments. Runs missed before the upgrade are not restored.

• Server image: 2026.07.202608131719

August 7, 2026¶

This release closes a security finding in how JWT access/refresh tokens are signed. Previously the chart never set the HS256 signing keys, so deployments used well-known application defaults, allowing token forgery. The chart now injects the signing keys into every backend service from a new auth-token-keys secret. Keys can be provided via global.auth.accessTokenKey/global.auth.refreshTokenKey (each at least 32 characters, distinct values), via a pre-existing secret named in global.auth.existingSecret, or — when createAppSecretsInChart is true and no keys are provided — generated randomly at install time and reused on later upgrades. See auth-token-keys for setup.

• Prefect Cloud Chart 1.4.1

August 5, 2026¶

This release includes security fixes for the Server image.

• Server image: 2026.07.202608051742

August 3, 2026¶

This release includes security fixes for the Server image.

• Server image: 2026.07.202608032047

Initial Release: July 31, 2026¶

# all services
global:
  backend:
    extraEnv:
      - name: PREFECT_CLOUD_DISABLE_LOGGING_CONFIG
        value: "true"

# or a single service
auth:
  cloud2:
    extraEnv:
      - name: PREFECT_CLOUD_DISABLE_LOGGING_CONFIG
        value: "true"

Backend Updates¶

Features¶

• Higher Default Account Limits — The per-workspace automation limit has been raised from 50 to 10,000 and user slots from 50 to 1,000. Existing installations pick these up through a data migration, replacing the manual SQL workaround previously needed on every upgrade.
• Events Partition Consolidation — Installs with 32 events account partitions can consolidate down to one, leaving the Partman service to maintain a single set of daily sub-partitions instead of 32. The command is new in this release and is not available in April or earlier images. See Events Account Partitions.
• Sort Memberships by Email — The account memberships filter endpoint now supports EMAIL_ASC and EMAIL_DESC sort options.
• Structured Logs for Uvicorn Services — Services running uvicorn now emit JSON logs, so access logs and exception tracebacks are ingested as single structured events rather than one event per traceback line.

Performance¶

• Faster Flow Run Cancellation — Cancelling a flow run with many children uses a partial index for the child task-run lookup.
• Faster Team Access-Control Cleanup — Team ACL cleanup queries now use existing indexes instead of scanning.
• Faster Partition Index Creation — Index creation for partitions prechecks pg_inherits, avoiding redundant work on large partition sets.
• Bounded Events Pagination — The events offset cap is lowered to 5,000 and enforced consistently across filter bodies and page tokens, bounding the cost of deep pagination.
• Configurable Causal Ordering Poll Loop — Services can now opt in or out of the in-flight Redis poll loop individually rather than sharing a single global behavior.

Bug Fixes¶

• Profile Image Metadata Stripping — Uploaded profile images are re-encoded to strip EXIF metadata, including GPS coordinates, which was previously extractable because profile-image endpoints are public per UUID so the login screen can render avatars pre-auth. Images are downscaled server-side to 1024x1024, with the upload size cap raised to 4.5 MiB so unprocessed phone photos are not rejected.
• Concurrency Slot Accounting — Deployment concurrency slots are no longer spuriously decremented when a run moves from PENDING directly to a terminal state.
• Concurrency Validation with Unset Grace Period — Transitioning from Pending to Running no longer returns a 500 when a deployment's concurrency_options omits grace_period_seconds, which is what 3.x clients send by default.
• Flow Run Cleanup Unblocked — Removed a concurrency limit on the reaper's workspace cleanup task that could raise ConcurrencyBlocked and prevent cleanup from running at all.
• Base Job Template Validation — Validating a base job template no longer errors when a template field is None.
• Validation Error Handling — Deeply nested validation errors no longer exhaust the stack; recursion depth is now bounded.
• Invitation Guard for Inactive Members — Inactive memberships are correctly accounted for when creating invitations, preventing duplicate invites to users who already have a membership record.
• Team Access Grant Reliability — Clearing object-level access controls for a team now retries on transient failures.
• Account Freezing Observability — Account-freezing enforcement now emits observability signals, making it possible to see when and why enforcement triggered.
• Stale Block Document Cleanup — A reaper task now removes stale anonymous LocalFileSystem block documents that previously accumulated indefinitely.
• Restricted-Schema Migrations — Removed remaining hard-coded public schema references so migrations succeed in deployments where the public schema is restricted.

Maintenance¶

• Dependency Updates — Security patches and version updates across multiple dependencies, including fixes for HIGH-severity CVEs.

Frontend Updates¶

Bug Fixes¶

• Pagination Reset on Filter Change — Changing filters on the runs page now resets pagination instead of leaving you on an out-of-range page.
• Artifacts in Trace Search — Artifacts are surfaced in trace search even when the parent task run does not match the search terms.
• Copy to New Run — Copying a run to a new run now preserves the original run name.
• Artifact Request Retries — Failed artifact requests are retried rather than rendering an empty panel.
• Event Query Retries — Null getEvent responses are retried and the query window has been narrowed.
• Asset Metadata Null Safety — Asset pages no longer error when latest metadata is missing.
• SSO Error Messaging — Sign-in attempts by an inactive member now show a dedicated message instead of a generic failure.
• Schema Form Improvements — SchemaForm supports an allowOmit setting and renders markdown in field labels.
• Beta Badge Styling — Beta badges use a filled primary style for better contrast.

Maintenance¶

• Security Updates — Addressed multiple vulnerabilities across frontend dependencies, including form-data, dompurify, axios, and undici.

Helm Chart Updates¶

• Nebula Memory Request Raised — The default nebula memory request has been raised from 650Mi to 900Mi. Nebula's startup baseline grew with the April release's larger API surface, and a request below the baseline divided by the HPA's 70% memory target caused the HPA to pin the deployment at maxReplicas.
• Structured Logging Default — PREFECT_CLOUD_DISABLE_LOGGING_CONFIG now defaults to false, enabling JSON logging for uvicorn-based services.
• Traefik Auth Proxy Image — The default Traefik auth proxy image tag has been updated from 3.6.13 to 3.7.8.
• Prefect Istio Chart 1.3.0 — Bundles Istio 1.30.3, up from 1.29.1.