This page contains the changelog for Dash Enterprise 6.0.0 and later. Please contact us for earlier changelogs.
Looking to migrate to Dash Enterprise 6? View the key differences between the Dash Enterprise 5 and 6 series here.
Important: To learn how to upgrade to a version detailed in this changelog, be sure to follow the upgrade guide. This guide contains important notices about what you can expect for specific upgrades, such as whether apps on the system will be restarted.
Added support for using deployed Dash apps as MCP servers. If enabled by an app owner or administrator, AI agents like Claude can interact with a deployed app and respond to questions about its underlying data.
Added support for the following Python versions:
Python 3.10.20
Added support for the following pip versions:
pip 26.0.0
System: Added support for selecting the nodes that Dash Enterprise runs on.
System: Added support for installing Dash Enterprise on ARM64 nodes.
Improved app build times by an average of 10%.
The default Python version set for apps and workspaces on newly installed Dash Enterprise instances is now 3.12.13. The behavior for existing apps and workspaces after an upgrade to Dash Enterprise 6.3.0 is as follows:
3.12.* globally by administrators or individually at the app level will change from 3.12.0 to 3.12.13 when next deployed.3.11.* will change from 3.11.3 to 3.11.15.Existing workspaces will change from Python 3.12.0 to Python 3.12.13 when next rebuilt.
The default pip version for deployed apps is now 26.0.1. Existing apps without a project.toml file that pins the pip version will change to pip 26.0.1 when next deployed.
The default pip version for workspaces is now 26.2.1. Existing workspaces will change to pip 26.2.1 when next rebuilt.
Secrets for managed Redis and Postgres databases (REDIS_URL or DATABASE_URL) are now stored as Kubernetes secrets instead of ConfigMaps within Dash Enterprise. Existing secrets will be migrated automatically. The environment variables will no longer appear in the App Info, but the values for REDIS_URL and DATABASE_URL can still be accessed normally in code.
When a global environment variable is added, modified, or deleted, all apps and workspaces will now restart within 30 minutes so that they automatically pick up the change.
App processes that exceed their memory limit will now enter a Stopped status and a banner will be displayed in the App Overview: “Error: Your app has been stopped because it was taking up more memory than the specified limit.”
All backups in the configured storage service will now be displayed in the backup and restore interface (backups from different Dash Enterprise versions cannot be used to restore).
After restoring Dash Enterprise from a backup, apps will now automatically be redeployed and workspaces automatically rebuilt. Note that workspaces will be rebuilt according to their original creation method, so it may be necessary to fetch the latest changes.
Security: Upgraded Gitea to v1.27.2.
Security: Upgraded Postgres (apps and system) to v17.11. The upgrade will not apply to managed Postgres databases that were created prior to the Dash Enterprise 6.3.0 version upgrade, only new Postgres databases.
Security: Upgraded Redis (apps and system) to use a hardened image based on v8.8.3. The upgrade will not apply to managed Redis databases that were created prior to the Dash Enterprise 6.3.0 version upgrade, only new Redis databases.
Marking the end of Python 3.9.* support. Any apps still using Python 3.9 will keep running, but their next rebuilds will fail until the Python version is updated. Affected apps will have a warning message displayed in the App Overview.
Significantly improved documentation search results when users’ browsers can reach Algolia (algolia.net), a third-party search experience service.
System: It is now possible to configure the StorageClass for the bunker PV (at installation time only).
System: It is now possible to apply the applicationid label to pods responsible for backup and restore.
de-proxy logs.System: Added strict hostname checking.
System: Tightened backup and restore agent RBAC by removing deletecollection on services.
System: Allowed setting of extraLabels on the temporal-setup job.
System: Resolved issue with transitioning some Dash apps / workspaces logging secret to use a Kubernetes Secret.
System: Improved handling of backups PVs to improve resiliency of Postgres.
When Dash Enterprise is unable to build an app due to insufficient memory or CPU available on the cluster, the status “Waiting for Resources” will now be displayed next to the build in the App Manager. Freeing up resources (such as by stopping or deleting apps) causes the app to resume building.
It is now possible to set custom memory limits greater than 24,576 MiB for app process, workspaces, and services in the App Manager.
System: Significantly optimized the resources used by the core system by default, leading to a 49% reduction in memory footprint and a 50.1% reduction in CPU footprint.
System: Most core system workloads now have memory requests that equal memory limits by default. Administrators with access to the Helm chart can customize these values.
System: All core system and user-created workloads now have no CPU limit by default. Administrators with access to the Helm chart can set CPU limits by copying lines such as # cpu: 1000m # uncomment for Guaranteed QoS (may impact performance) from the values.yaml file and pasting them, uncommented, in their custom values file. Uncommenting the line without changing the value causes the CPU limit to be equal to the CPU request. Setting CPU limits guarantees quality of service (QoS) (no risk of the pod getting evicted) but may negatively impact performance.
System: Updated the memory that managed database services request by default to 128 MiB.
System: It is now possible to override the default memory and CPU requests and limits of all workloads on the system.
System: All core system and user-created workloads now use a read-only filesystem. Administrators with access to the Helm chart can override this for apps that need to write to the filesystem (such as via predeploy or postdeploy scripts).
System: Changed the internal coordination system used by backup and restore to Temporal.
System: Updated the build logs implementation to match that of runtime logs (a sidecar running Fluent Bit in non-privileged mode).
System: agents.build.builder.resources is no longer used. Migrate to per-container keys if you were previously using it in your configuration override: agents.build.builder.lifecycle-build.resources, agents.build.builder.lifecycle-export.resources, and agents.build.builder.logging-sidecar.resources.
Security: Upgraded Fluent Bit to v5.0.6.
Security: Upgraded Gitea to v1.26.2.
Security: Upgraded Keycloak to v26.5.7.
Security: Upgrades Next.js to v15.5.18.
Security: Upgraded Postgres (system) to v17.10.
Security: Added additional guards to detect and prevent sensitive data from being logged.
Security: Improved support for seccompProfile: Setting a seccompProfile profile now explicitly defines it at the container level. Additionally, it is now also applied to Dash app, workspace, and service workloads.
Fixed a redirection bug when visiting Dash Enterprise over HTTP.
Fixed a synchronization bug between Dash Enterprise and Keycloak when user information was updated.
pgBackRest retention policy to fix an issue where the PV for backups could fill up and prevent further backups from being created.logging-sidecar container which could throttle app builds.Improved Dash app build time.
System: Updated resource defaults for Dash apps and workspaces.
System: It is now possible to configure the resource defaults for Dash apps (app.app.*), workspaces (app.workspace.*), and services (app.service.*) in the Helm chart. Rebuilding is required for updated defaults to be applied.
System: Updated the build agent resources and made them configurable in the Helm chart via agents.builder.resources.
System: Changed the mechanism for configuring internal CA certificates. It is now possible to set a global.internalCaCertConfigMapName to inject an internal CA certificate or self-signed certificate into Dash apps and workspaces at build time as well as at runtime. This allows Dash apps and workspaces to connect to services such as private Python package indexes that are signed with this certificate. Keycloak will also use global.internalCaCertConfigMapName unless it is overridden by auth.keycloak.internalCaCertConfigMapName (which replaces the now deprecated auth.keycloak.internalCaSecretName).
Fixed a bug where file changes in an app’s assets folder didn’t take effect (files remained cached) when the app was redeployed unless the file names were edited.
Fixed a bug where workspace rebuilds were sometimes delayed.
Fixed a bug where workspaces sometimes displayed an incorrect status for a few seconds.
System: Fixed a bug with Keycloak session cookies that caused intermittent login and logout failures.
Security: Upgraded node.js to v24.
auth.keycloak.internalCaSecretName is now deprecated.System: It is now possible to increase the size of the persistent filesystem PV beyond 25 GiB. As long as allowVolumeExpansion: true is set on the StorageClass used by the PV, administrators can use agents.persistence.storageSize in their custom values file to configure a larger size. For example:
yaml
agents:
persistence:
storageSize: 30Gi
System: Increased the de-backend initContainer memory request and limit to 768 Mi.
System: Increased the de-worker memory request and limit to 2048 Mi.
System: Set NODE_OPTIONS="--max-old-space-size=1536" for de-worker and de-backend to allow them to handle larger requests.
System: Set kafka_batch_max_bytes and kafka_request_max_bytes for Redpanda in order to prevent connection failures when it receives large requests.
Fixed a bug where WebGL figures did not render in PDFs generated from deployed apps.
Security: Upgraded frontend packages to address CVE-2026-27606.
Important note about app and workspace permissions: By default, apps and workspaces cannot use
sudoat build time nor at runtime (apps whose files rely onsudowill fail to build and/or deploy). An administrator with access to the Helm chart can configure Dash Enterprise to allow the use ofsudo.