This page contains the changelog for Dash Enterprise 6.0.0 and later. Please contact us for earlier changelogs.
Looking to migrate to Dash Enterprise 6? View the key differences between the Dash Enterprise 5 and 6 series here.
Important: To learn how to upgrade to a version detailed in this changelog, be sure to follow the upgrade guide. This guide contains important notices about what you can expect for specific upgrades, such as whether apps on the system will be restarted.
Significantly improved documentation search results when users’ browsers can reach Algolia (algolia.net), a third-party search experience service.
System: It is now possible to configure the StorageClass for the bunker PV (at installation time only).
System: It is now possible to apply the applicationid label to pods responsible for backup and restore.
de-proxy logs.System: Added strict hostname checking.
System: Tightened backup and restore agent RBAC by removing deletecollection on services.
System: Allowed setting of extraLabels on the temporal-setup job.
System: Resolved issue with transitioning some Dash apps / workspaces logging secret to use a Kubernetes Secret.
System: Improved handling of backups PVs to improve resiliency of Postgres.
When Dash Enterprise is unable to build an app due to insufficient memory or CPU available on the cluster, the status “Waiting for Resources” will now be displayed next to the build in the App Manager. Freeing up resources (such as by stopping or deleting apps) causes the app to resume building.
It is now possible to set custom memory limits greater than 24,576 MiB for app process, workspaces, and services in the App Manager.
System: Significantly optimized the resources used by the core system by default, leading to a 49% reduction in memory footprint and a 50.1% reduction in CPU footprint.
System: Most core system workloads now have memory requests that equal memory limits by default. Administrators with access to the Helm chart can customize these values.
System: All core system and user-created workloads now have no CPU limit by default. Administrators with access to the Helm chart can set CPU limits by copying lines such as # cpu: 1000m # uncomment for Guaranteed QoS (may impact performance) from the values.yaml file and pasting them, uncommented, in their custom values file. Uncommenting the line without changing the value causes the CPU limit to be equal to the CPU request. Setting CPU limits guarantees quality of service (QoS) (no risk of the pod getting evicted) but may negatively impact performance.
System: Updated the memory that managed database services request by default to 128 MiB.
System: It is now possible to override the default memory and CPU requests and limits of all workloads on the system.
System: All core system and user-created workloads now use a read-only filesystem. Administrators with access to the Helm chart can override this for apps that need to write to the filesystem (such as via predeploy or postdeploy scripts).
System: Changed the internal coordination system used by backup and restore to Temporal.
System: Updated the build logs implementation to match that of runtime logs (a sidecar running Fluent Bit in non-privileged mode).
System: agents.build.builder.resources is no longer used. Migrate to per-container keys if you were previously using it in your configuration override: agents.build.builder.lifecycle-build.resources, agents.build.builder.lifecycle-export.resources, and agents.build.builder.logging-sidecar.resources.
Security: Upgraded Fluent Bit to v5.0.6.
Security: Upgraded Gitea to v1.26.2.
Security: Upgraded Keycloak to v26.5.7.
Security: Upgrades Next.js to v15.5.18.
Security: Upgraded Postgres (system) to v17.10.
Security: Added additional guards to detect and prevent sensitive data from being logged.
Security: Improved support for seccompProfile: Setting a seccompProfile profile now explicitly defines it at the container level. Additionally, it is now also applied to Dash app, workspace, and service workloads.
Fixed a redirection bug when visiting Dash Enterprise over HTTP.
Fixed a synchronization bug between Dash Enterprise and Keycloak when user information was updated.
pgBackRest retention policy to fix an issue where the PV for backups could fill up and prevent further backups from being created.logging-sidecar container which could throttle app builds.Improved Dash app build time.
System: Updated resource defaults for Dash apps and workspaces.
System: It is now possible to configure the resource defaults for Dash apps (app.app.*), workspaces (app.workspace.*), and services (app.service.*) in the Helm chart. Rebuilding is required for updated defaults to be applied.
System: Updated the build agent resources and made them configurable in the Helm chart via agents.builder.resources.
System: Changed the mechanism for configuring internal CA certificates. It is now possible to set a global.internalCaCertConfigMapName to inject an internal CA certificate or self-signed certificate into Dash apps and workspaces at build time as well as at runtime. This allows Dash apps and workspaces to connect to services such as private Python package indexes that are signed with this certificate. Keycloak will also use global.internalCaCertConfigMapName unless it is overridden by auth.keycloak.internalCaCertConfigMapName (which replaces the now deprecated auth.keycloak.internalCaSecretName).
Fixed a bug where file changes in an app’s assets folder didn’t take effect (files remained cached) when the app was redeployed unless the file names were edited.
Fixed a bug where workspace rebuilds were sometimes delayed.
Fixed a bug where workspaces sometimes displayed an incorrect status for a few seconds.
System: Fixed a bug with Keycloak session cookies that caused intermittent login and logout failures.
Security: Upgraded node.js to v24.
auth.keycloak.internalCaSecretName is now deprecated.System: It is now possible to increase the size of the persistent filesystem PV beyond 25 GB. As long as allowVolumeExpansion: true is set on the StorageClass used by the PV, administrators with access to the Helm chart can use APPS_PVC_STORAGE_SIZE to configure a larger size. For example, APPS_PVC_STORAGE_SIZE=50Gi.
System: Increased the de-backend initContainer memory request and limit to 768 Mi.
System: Increased the de-worker memory request and limit to 2048 Mi.
System: Set NODE_OPTIONS="--max-old-space-size=1536" for de-worker and de-backend to allow them to handle larger requests.
System: Set kafka_batch_max_bytes and kafka_request_max_bytes for Redpanda in order to prevent connection failures when it receives large requests.
Fixed a bug where WebGL figures did not render in PDFs generated from deployed apps.
Security: Upgraded frontend packages to address CVE-2026-27606.
Important note about app and workspace permissions: By default, apps and workspaces cannot use
sudoat build time nor at runtime (apps whose files rely onsudowill fail to build and/or deploy). An administrator with access to the Helm chart can configure Dash Enterprise to allow the use ofsudo.