Welcome to the Appmixer changelog! 👋 Explore comprehensive release notes and detailed migration guides to keep your Appmixer instance up to date and running smoothly.

Latest version

Other versions

Helm Chart latest version

Migration guide

Version 6.5 is compatible with 6.4. It operates on the same stack and custom components should function without modification.

Migration Guide

Appmixer 6 operates on the same stack (Node.js version, MongoDB version, etc.), so all custom components should function without modification.

There are no breaking changes in the API. However, one small change worth noting is that if a flow is running, its database document cannot be updated unless ?forceUpdate=true is added to the request. You can read more about this in the changelog.

An important database change in Appmixer 6 is the introduction of a flow type. A new property, type, is now present on each flow document, and a migration script will automatically execute when Appmixer 6 is deployed to assign a type to each flow in the system. More information about the types can be found in this section of the changelog. While this change isn’t breaking, SDK widgets now use this by default to display certain flow types. For instance, the appmixer.ui.FlowManager widget shows flows with type: automation. This default behavior can be modified using the customFilter, as described in the Appmixer SDK documentation. Similarly, the appmixer.ui.Integrations widget uses type to distinguish integration templates from integration instances.

The most significant update in the main UI (not the SDK) is the split of all flows into two categories: Automations and Integrations. More details can be found in.

Appmixer 6 introduces several new garbage collectors, with additional information available in. Be sure to review the garbage collector for continuity scopes (the continuity scope feature is described in). These scopes are now deleted after 100 days by default (modifiable). If you’re using flows with continuity scopes and expect a webhook after 100 days, then you have to increase the value. For any custom components that rely on this feature, you can use the new context.setMaxWait function to set a specific expiration time, as explained in.

Finally, please review the, as several settings now have new default values.

• The main menu has been redesigned and a Dashboard page with links to the most important tutorials has been added:

• Automations and Integrations. The biggest change in Appmixer 6. Automations (internal business process/workflow automations) and Integrations (integration templates for end-users) are split into two separate views for better navigation.

• Expandable main menu.

• New menu options in Automation Designer, Integration Designer, Automations, and Integrations pages.

• Integration designer now displays a magic wand button next to each field. You can now easily add any field to the integration wizard for your end-users simply by clicking on the magic wand button.

• Go to “Edit Wizard” to see the live preview of the final wizard as your end-users would see it:

• A new test flow has been added allowing you to test integration templates before publishing:

• Starting a test opens the end-user Wizard allowing you to see and test how the integration configuration would look for your end-users:

Explore logs of a running test and repeat stop/edit/start/delete cycle until you’re ready to publish your integration template to your end-users.

• Publishing popup has been redesigned and simplified:

• You can now update all existing integration instances running for your end-users when publishing an update to your integration templates:

• Log panel automatically opens when the flow starts.

• The log panel toggle button is now visible in Designer:

• The log panel can be extended to full screen.

• A search bar was added to the log panel allowing a full-text search in logs.

• Correlation ID added to each log. You can now copy this correlation ID, add it to the search bar to see logs from the same flow “run”.

• Expression expand option in the source.

• Show a hint to the user, guiding them to create a new flow in Flow Manager if no flows are found.

• New trigger and action marker icons have been added to the component selector in the Inspector panel to make it easier to differentiate triggers from actions.

• A new trigger selector popup automatically opens by default when a new flow is created or the last trigger is deleted. This guides the user to select a trigger first. This behaviour can be optionally turned off when using the SDK. See

• A new icon for variables makes it more visually clear that a variable can be modified by clicking on it.

• Render brackets [] at the end of all array type of variables (for variables with JSON schema defined in the component manifest file):

• Silent sign-in when passing the access token in the URL.

• The active tab is highlighted in the appmixer.ui.Integrations widget.

• Support Native Web Components in Custom Inspector Fields.

• Font size increased in the Studio for better readability.

• Introduce the email argument as the third optional argument in api.signupUser(username, password, email).

• New options for the appmixer.ui.InsightsLogs widget (customFilter, showHistogram, filterLayout, logFilter).

• New appmixer.api.sendAppEvent(). This allows you to trigger automations and integrations from your apps using a “named” event as opposed to using a generic webhook. See for more information.

• Timeouts (created by context.setTimeout()) are automatically deleted after they are processed. In the previous version, timeouts might not have been correctly garbage collected in some cases (their consumption by components failed 30 times in which case they moved into the unprocessedMessages collection). In Appmixer 6.0 timeouts are correctly deleted in this scenario.

• Garbage collector for continuity scopes (Mongo collection continuityScopes). Newly, continuity scopes are deleted after 100 days. This can be changed by GARBAGE_COLLECTOR_CONTINUITY_SCOPES_TTL (default value 100) and GARBAGE_COLLECTOR_CONTINUITY_SCOPES_TTL_UNIT (default value "days"). A component can increase the TTL of the continuity scope with context.setMaxWait()

• POST|GET /logs API supports a new searchAfter query parameter, an example in

• A running flow cannot be updated via the API without ?forceUpdate=true in the query parameter.

• You can now inject a PWD-type account via API.

• New options to control the webhooks sent to the WEBHOOK_FLOW_COMPONENT_ERROR URL.

  • WEBHOOK_FLOW_COMPONENT_ERROR_INCLUDE_RETRY (false by default). If a message fails and is scheduled for a retry, a webhook is not sent by default to the WEBHOOK_FLOW_COMPONENT_ERROR URL.

  • WEBHOOK_FLOW_COMPONENT_ERROR_INCLUDE_QUOTA (false by default). If a message cannot be processed due to insufficient quota, a webhook is not sent by default to the WEBHOOK_FLOW_COMPONENT_ERROR URL.

• Incoming webhooks are not counted in the telemetry.

• Added type property to flows. There are now 5 types of flows:

  • automation … Automation.

  • integration-template … Final published integration template.

The appmixer.ui.FlowManager shows only the flows with type:automation, for example. The Integrations page displays flows with type:integration-draft. Once a draft is published, an integration-template flow is created, and then every instance of the integration-template has type:integration-instance.

• Context Quotas and a Slow Queue are described in

• AuthHub. Appmixer now features a central Authentication Hub, functioning as an authentication proxy, which simplifies the setup process by eliminating the need to register your own OAuth credentials with third-party services. The Authentication Hub is enabled for all hosted Appmixer tenants. In self-managed installations, the Authentication Hub has to be explicitly set. See for more details.

• Older (but compatible) versions of a connector can now be installed.

• A custom scope can now be assigned to users in the Backoffice.

• A connector that has been side-loaded from a filesystem can now be downloaded, same as connectors installed via the Appmixer marketplace.

• Showing the installed version of a connector.

• Fixed every log query failing against an OpenSearch cluster — On OpenSearch, all log reads returned HTTP 400 with "The client noticed that the server is not Elasticsearch and we do not support this unknown product". From 7.14.0 onwards the Elasticsearch client performs a product check before its first request and then refuses to talk to a server that does not identify itself as Elasticsearch, so every request was rejected by the client itself before it ever reached the cluster. The client had been pinned below that version deliberately; a dependency sweep lifted the pin, which shipped in 6.5.0. It is pinned again, with the reason recorded next to it. This restores the log APIs, log deletion, flow insights, Automation Hub analytics, the Designer's example variables (which also feed AI Copilot) and the test-mode log fallback. Only deployments backed by OpenSearch were affected, and only on 6.5.0 through 6.5.2 — 6.4.11 and earlier are unaffected. A cluster that forbids anonymous GET / also masked the problem, because the client skips its product check when that request is rejected.

• Fixed log records being dropped by Elasticsearch when they carried an _id field — Log extras are flattened into the top level of the log record, and Elasticsearch reserves leading-underscore keys there for its own metadata, so any log call passing _id had its whole document rejected with a 400 and never indexed. The MinIO GridFS migrator was doing exactly that in its Skipping file with missing metadata warning (which fires on every plugin start for interrupted uploads), so those warnings were lost. The field has been renamed, and log record creation now moves any reserved key under a prefixed name (_id → extra_id) instead of letting the record be dropped — this also protects log calls in customer-written system plugins.

• Refactored ElasticSearch indices usage for multitenant AWS deployments, improving index organization and isolation.

• Introduced multi-tenancy support with prefixed Redis keys, ensuring proper data isolation between tenants.

• Added folder support for S3 files, enabling better file organization and management in object storage.

• Added REDIS_PASSWORD environment variable support for Redis Sentinel authentication, fixing "NOAUTH Authentication required" errors. The ioredis library now properly authenticates to both Redis master/data nodes and Sentinel nodes. In typical Bitnami deployments, both use the same password from REDIS_PASSWORD. For special cases where passwords differ, REDIS_SENTINEL_PASSWORD can still be used.

Migration guide

Version 6.3 is compatible with 6.2.

Bug Fixes

• Fixed the GridFS to S3 file migration retrying failed files indefinitely — A file that failed to migrate was retried in a loop, flooding the logs and preventing the migration from completing. Each file is now attempted once per run and retried on the next startup.

• Fixed discarded message log not being properly sliced, preventing excessive log accumulation and reducing disk space usage.

Bug Fixes

• Fixed variable modifiers being lost on key-value rows — In the key-value style component fields, only one row's variable modifiers survived editing: the shared modifier map was bound through a single pass-through, so entering a variable with a modifier in one row could drop or overwrite the modifiers recorded for the others. Each row now keeps its own modifiers through the whole edit chain.

Migration guide

Version 6.2 is compatible with 6.1.

• Updated check assertions library.

• Resolved an issue where accounts were not automatically connected when integrations were updated.

• Enhanced the uploader lock mechanism to improve reliability and prevent race conditions.

• Added support for RFC 6839 JSON variant content types in webhook routes, expanding webhook compatibility.

• Fixed the missing Forgot Password button on the login screen.

What's new

• Added APPMIXER_USERFLOW_TOKEN and APPMIXER_GOOGLE_TAG_MANAGER_ID Env variables to the frontend Dockerfile.

• Added a cluster-wide system drain mode for safe RabbitMQ migrations. When activated (POST /config with the key SYSTEM_DRAIN_MODE), external message entry points — webhooks, polling, store triggers and retry/timeout jobs — are blocked while in-flight messages cascade to completion, so the RabbitMQ queues can be drained to empty before a migration without data loss. The setting propagates to all nodes instantly, and the new GET /system/drain-status endpoint reports the drain progress.

• Fixed integrations update bug where the wizard would attempt to auto-connect non-existing components multiple times when updating integration instances.

• Fixed icon caching issues where connector icons were being requested repeatedly without proper browser caching.

• Fixed orphaned components in wizard account fields by pruning invalid component references when components are removed from integration templates.

• Added Pino logger integration and LOG_STDOUT_ONLY configuration option to enable direct stdout logging for seamless integration with Vector and other log aggregation systems.

• Optimized search index building for dialogs, significantly improving UI performance when opening trigger and action selection popups.

• Fixed discarded message log not being properly sliced, preventing excessive log accumulation and reducing disk space usage.

• Fix for Unknown target: dispatcher error introduced in 6.1.0.

• Fixed uploader transaction failures when installing large modules.

• Fixed flow synchronization. The issue could occur during flow start when a worker pod had an outdated cached version of a component.

• Added tenant ID prefix to getModuleIndexParam for improved multi-tenant ElasticSearch index isolation, ensuring complete data separation between tenants.

• Implemented rate-limiting for NewRelic "invalid parent id" uncaught exceptions to prevent log flooding and improve monitoring stability.

• Fixed REDIS_SENTINEL environment variable parsing to properly handle Sentinel configuration.

• Axios library in the SDK upgraded to the latest version 1.8.2.

• Allow non-admin users to publish and update integration templates (not the integration instances).

Migration guide

Version 6.4 is compatible with 6.3.

• Fixes a bug where, when a change to an integration draft is published to all integration instances, the integration's userId is overwritten with the userId of the integration template’s owner.

• Fixes broken flow:validation even in the appmixer.ui.Wizard widget.

• Fixes broken static variables with non-string values not detected by the

• The engine can load Component Plugins from both the file system and the database. The database now takes priority, and if the same plugin exists in both locations, it is loaded only once.

• Added definition support to the GET /flows/{flowId}/validate API.

• Improved InputQueue circuit breaker resilience — The input-queue circuit breaker now stores all of its polling state directly in Redis as the single source of truth, so new or restarted pods automatically pick up the shared state with no manual sync or startup restore. The INPUT_QUEUE_STATUS job now runs on both worker and API nodes (a distributed lock ensures only one run per cycle), and the circuit breaker state (state, message count, bytes, reason) is now exposed via the /system/health API.

• Fixed RabbitMQ consumer ack-timeout that could stall input-queue consumption — When many slow-running messages are being processed, messages prefetched from RabbitMQ could sit un-acked in the in-memory Throttle queue long enough to trip RabbitMQ's

• System Drain Mode for RabbitMQ Queue Migration — New cluster-wide SYSTEM_DRAIN_MODE config flag that blocks all external message entry points (webhooks, polling, store triggers, retry/timeout/slow-queue jobs) while allowing in-flight messages to cascade to completion through the flow DAG. Activate via POST /config with {"key": "SYSTEM_DRAIN_MODE", "value": "true"} — propagated to all nodes instantly, no pod restart needed. Monitor queue drain progress with the new GET /system/drain-status endpoint.

• Removed legacy classic RabbitMQ queues, improving stability and preventing connection breaks when Rabbit pods with classic queues go down.

• Handling PRECONDITION_FAILED - unknown delivery tag error. When the RabbitMQ was restarted and some messages were being processed, their acknowledgment failed with the PRECONDITION_FAILED exception, which resulted in a broken RabbitMQ connection.

• Improved sandbox around the JavaScript modifier and the context.evalJavaScript function.

• New optional ENV variable INTERNAL_API_URL. If set, HTTP requests like will be sent to this URL, instead of the APPMIXER_API_URL.

• In the Appmixer SDK, encode URI characters before sending requests to the . This fixes a bug when creating Storage keys failed with certain characters.

• The order of the Integration Wizard fields was reversed in the Firefox browser. This is fixed now.

• Handling PRECONDITION_FAILED - unknown delivery tag error. When the RabbitMQ was restarted and some messages were being processed, their acknowledgment failed with the PRECONDITION_FAILED exception, which resulted in a broken RabbitMQ connection.

• Improved sandbox around the JavaScript modifier and the context.evalJavaScript function.

• MongoDB driver was updated to the newest version to support MongoDB up to version 7.0.

• Fix for token refresh for the pwd authentication type https://docs.appmixer.com/appmixer/component-definition/authentication#password The username/password can be exchanged for a token that can have an expiration date. This update fixes the refresh of the token.

• New redirectUri option for the Microsoft OneDrive module. If defined, the OneDrivePicker (used by UploadFile and ExportFile connectors) will use it instead of the default redirectUri (which is https://[your-appmixer-api-url] /plugins/appmixer/microsoft/onedrive/picker).

Version 6.1 is compatible with 6.0. However, there are some new , features you should be aware of before upgrading—namely, the new retry mechanism and the new garbage collector(s).

What's new

• Axios library upgraded from 1.6.0 to 1.7.9

What's new

• The engine can load Component Plugins from both the file system and the database. The database now takes priority, and if the same plugin exists in both locations, it is loaded only once.

• Fixed a bug introduced in 6.3.7 that blocked messages from being processed while a flow starts. This issue broke triggers such as microsoft.mail.NewEmail that require incoming webhook processing during flow startup.

New in 5.2.2

• MongoDB driver was updated to the newest version to support MongoDB up to version 7.0.

• Fix for token refresh for the pwd authentication type https://docs.appmixer.com/appmixer/component-definition/authentication#password The username/password can be exchanged for a token that can have an expiration date. This update fixes the refresh of the token.

New Features

• Flow Image on Automation Hub Tiles — Automation Hub tiles now render a flow image when available, replacing the default connector icon strip. Tiles without a flow image continue to display the icon strip as before.

• Sync Categories to Integration Templates on Save — Categories assigned in an integration draft are now propagated directly to the linked integration template when clicking Save Changes, without requiring a full Publish Changes.

Bug Fixes

• Fixed log search queries using the @timestamp field which only exists in Elasticsearch+Logstash setups but not in OpenSearch+Vector setups. All log search queries, sort parameters, and aggregations now use gridTimestamp — the application-level timestamp present in both infrastructures.

• Made logstash queue definition optional to provide more flexibility in deployment configurations.

• Removed a global CSS rule affecting ordered lists (ol) in the frontend application to fix styling conflicts.

Bug Fixes

• Fixed originalContent reconstruction from scope — When originalContent is stripped from messages (6.4+) and reconstructed from scope, getOriginalContent() could return undefined in several edge cases. Filter components (IsNotEmpty, Equal, Contains, etc.) would then fail with a "Missing JSON" error. The scope compression cache is now cleared before re-compressing in enqueueMessage to prevent source component scope entries from being lost, ensuring originalContent can always be reconstructed.

• Fixed unprocessed messages not being saved on input port validation errors — When a message failed input port validation, it was not saved to the unprocessedMessages collection. This has been fixed so that failed messages are correctly persisted.

Release notes for the Appmixer Helm chart (appmixer-helm).

• Fixed critical issue with uploading connectors that include packages and plugins, resolving deployment failures and ensuring proper connector installation.

What's new

• Added Component JSON Schema output port definition support to the GET /flows/{flowId}/validate API.

New in 5.2.3

• New redirectUri option for the Microsoft OneDrive module. If defined, the OneDrivePicker (used by UploadFile and ExportFile connectors) will use it instead of the default redirectUri (which is https://[your-appmixer-api-url] /plugins/appmixer/microsoft/onedrive/picker).

• context.loadOutputSchemaProperties function used by the Each component fixed. Did not work properly if a component with dynamic output port options was connected to the Each.

• If a module has .npmrc file, it is now used for the automatic rebuild that is triggered if Appmixer is started with a newer version of Node.

New in 5.2.9

The system API POST /system/encrypt-tokens can encrypt API keys and passwords, too. In the previous version, it could encrypt only OAuth1,2 access tokens.

• Upgraded Axios from version 1.8.2 to the latest release to address a reported high-severity vulnerability.

• Modified the MongoDB indexing script to run asynchronously in the background, ensuring it no longer blocks pod startup.

• Removed the script that deleted an obsolete RabbitMQ polling queue (introduced in 6.2.0); the queue itself will be preserved to avoid unintended side effects during deployments.

What's new

• Pin Elasticsearch client to version 7.13.0, as it is the last version compatible with AWS OpenSearch.

What's new

• Publishing an Integration update no longer replaces the Webhook (or a FormTrigger, or any other component with a URL in the Inspector) URL in the Integration Template with the URL from the Integration Draft flow.

• Added support to change the limit (page size) in the appmixer.ui.Integrations widget.

const integrations = appmixer.ui.Integrations({ el: '#widget' });

integrations.state('query', {
    ...integrations.state('query'),
    limit: 3,
});

Features

• Configurable MongoDB connection pool with idle-connection reaping — DB_POOL_SIZE once again sets only the maximum pool size, restoring the semantics that were in place before the MongoDB 7 driver migration (which had mapped the single value to both the minimum and the maximum, permanently pinning every Mongo-connecting process to exactly 5 open connections while also capping it at 5 concurrent operations). Three new options replace it:

  • DB_MAX_POOL_SIZE — maximum pooled connections. No default; takes precedence over DB_POOL_SIZE when set.

  • DB_MIN_POOL_SIZE — minimum warm connections, default 1.

  • DB_MAX_IDLE_TIME_MS — default 120000; pooled connections above the minimum that sit idle for longer than this are closed. The driver default of 0 (never close) is why pools never shrank before.

  DB_POOL_SIZE is deprecated but still honoured as a backward-compatible alias, with its default raised from 5 to 10. With all defaults, a process now keeps 1 warm connection, can burst to 10, and shrinks back within roughly 2 minutes. Set DB_MIN_POOL_SIZE higher for deployments where reconnect latency matters. This matters most in multitenant deployments against a shared DocumentDB, where the pinned pool wasted a large number of permanently idle connections.

• node_modules is now reinstalled only on a Node.js major version change — The reinstall exists for native addons, whose ABI changes only across major Node.js releases, but the previous check compared the full version string. Every patch or minor image bump therefore triggered a cluster-wide npm install plus a GridFS re-upload of every plugin's and component's node_modules, and mixed-version clusters during a rolling deploy could ping-pong reinstalls. Only the major version segment is compared now; stored metadata keeps the full version, so no migration is needed.

• Node.js upgraded to 24.19.0 — Base images across the engine, auth-hub, quota, frontend and Backoffice move from 24.6.0 to 24.19.0, and engines.node is raised to >=24.19.0. Beyond being the latest 24.x LTS, this fixes outbound TLS failures (UNABLE_TO_GET_ISSUER_CERT_LOCALLY) to endpoints whose certificate chains to Let's Encrypt's ISRG Root YR, which is absent from 24.6.0's compiled-in root CA store.

• Fixed slow webhook retry lookups under load — The { url: 1 } index on the webhookRetries collection could serve the webhook circuit-breaker's half-open probe filter but not its due sort, forcing an in-memory sort over every retry recorded for that URL. It is replaced by a compound { url: 1, due: 1 } index, which serves both and — being a prefix superset — still covers every existing url-only query. The obsolete index is dropped automatically on startup, so no manual migration is required.

• API warning alerts are no longer shown to non-admin users — Neither the

• Fixes a bug from 6.1.3 when a certain type of flow errors are not visible in the UI.

• select-button-group input type can display larger content.

• Links to docs in the Backoffice ACL section fixed.

New in 5.2.6

• Backoffice Insights page - To Date fixed to include the last day of the month.

• date-time picker fixed, when the selected date was cleared, it ended in an invalid state.

• context.service functions (loadState, stateSet, …) are available in the Flow design phase (not only during the flow runtime), so they can be used in the auxiliary components called from component.json (using the source “static calls”).

• If an OAuth2 refreshAccessToken function returns 400, 401, or 403, the token is marked as invalid (and no more attempts to refresh it will be executed).

• Improved logs of Axios exceptions (size reduced).

• The security of the component authentication pages (/auth-service and /auth-pre) have been improved by changing how the configuration was passed onto the pages. Previously, configuration was passed via URL query parameters. Newly, this configuration is rendered directly by the backend (Appmixer engine) making it impossible for external malicious injections.

New in 5.2.5

• date-time picker fixed, when the selected date was cleared, it ended in an invalid state.

• context.service functions (loadState, stateSet, …) are available in the Flow design phase (not only during the flow runtime), so they can be used in the auxiliary components called from component.json (using the source “static calls”).

• If an OAuth2 refreshAccessToken function returns 400, 401, or 403, the token is marked as invalid (and no more attempts to refresh it will be executed).

• Improved logs of Axios exceptions (size reduced).

• The security of the component authentication pages (/auth-service and /auth-pre) has been improved by changing how the configuration was passed onto the pages. Previously, configuration was passed via URL query parameters. Newly, this configuration is rendered directly by the backend (Appmixer engine) making it impossible for external malicious injections.

New in 5.1.2

• Fix for manifest markers in the component.json (https://docs.appmixer.com/appmixer/component-definition/manifest/marker).

• Fix for checking the component’s output port message size. The output port message size is limited to 15MB, in certain cases, an input message for the component and its size was incorrectly covered in the limit, too.

• Fixed bug in the context.loadOutputSchemaProperties() introduced in 5.1.1

• Fixed a bug in clearing node cache before requiring component’s codes into memory.

• Fix for UI/SDK code freeze in case of a large number of links/connectors in certain scenarios.

• PUT /flows/{flowId} API endpoint was optimized and significantly improved performance (especially with large flows) by avoiding variables scopes check with each update.

New in 5.0.2

• Fix for GET /variables under certain conditions resulting in - 500 - Maximum call stack size exceeded.

• Wizard variables of descendants not reloaded when account changes:

• Wizard Fieldset inputs did not work with variables.

• Validation in Integrations Wizard did not work properly when using variables.

Features

• Performance optimizations for the variables, auth, and coordinator APIs — A range of optimizations to component loading and execution:

  • Constructor module loading now avoids excessive filesystem exists checks and eliminates redundant require.resolve() calls, with improved findModulePath/require-cache handling.

  • The Loader now uses streaming zip extraction (yauzl) with batched directory creation instead of AdmZip, and no longer skips writing regular files on component re-upload.

  • The Variables Synchronizer can now batch sync() per component instead of per partial. This behavior is configurable via VARIABLES_SYNCHRONIZER_ENABLED (default off).

• Fixed module cache miss that reloaded components from the database on every request — A caching bug caused components to be re-downloaded from the database on each request (most visibly on /auth); they are now served from cache, significantly improving response times.

• Fixed OAuth account testing with custom credentials — Testing an account (POST /accounts/:id/test) that uses custom, user-level OAuth credentials now correctly resolves those credentials instead of falling through to missing system credentials. Auth module creation failures are now re-thrown during the auth callback so the user sees a real error instead of a false success, and componentIds is handled as both a string and an array.

New in 5.1.3

• Fix for Googlepicker. It did not open if it was used in an Integration Wizard (bug introduced in 5.1.1).

• Modifiers are now applied in static calls - source (in the flow design phase). An example:

Consider a component with a dynamic input port inspector. The inspector definition is returned by calling the SourceWithModifiers component and sending it a few parameters. The entityType parameter is taken from properties and passed to the input in port of the source component. Based on the value of the user provided property entityType, the SourceWithModifiers component returns different input fields of the inspector. Now assume that the entityType value is defined with a variable and even a modifier can be applied to it.

In this example, the entityType is taken from the flow’s custom fields (and a modifier JSONPath is applied to it). In the previous versions of Appmixer the value propagated to the source component (SourceWithModifiers in this case) was not resolved, i.e. the potential variables and modifiers applied to the propagated parameter where not correctly evaluated when they reached the source component (SourceWithModifiers).

• Copilot can be enabled for selected user scopes only — COPILOT_ENABLED_SCOPES (copilot.enabledScopes) is a comma-separated allow-list of the user scopes Copilot is available to. It lives in the live, DB-backed Copilot configuration, so an admin changes it from the Backoffice without restarting a pod. Unset or empty means enabled for everyone, so the upgrade is a no-op until the list is set.

• Prompt caching on the direct Anthropic provider path — Copilot's stable prompt prefix (its tool definitions and roughly 20k tokens of system prompt) and its per-step conversation prefix are now marked with ephemeral cache_control breakpoints, so every agent step after the first reads them from the provider cache instead of re-processing them on each of up to

• messageId added to the context.getWebhookUrl(). This fixes scenarios such as the one shown in the picture below. In this scenario, a Continuity Scope webhook component (RequestApprovalEmail) is used behind Each component. All messages coming from the Each component have the same correlationId, but a different messageId. When a webhook arrives to the RequestApprovalEmail, the messageId and correlationId is used to find the exact scope and the flow can continue to the SendChannelMessage with the correct context (data/variables).

• Admins can now see the sharedWith

• Introduced custom OAuth support, allowing users to create and manage named OAuth configurations that can be reused across multiple accounts and components within the same service.

• Introduced custom OAuth configuration management UI with support for creating, updating, and deleting OAuth app configurations.

App version: 6.3.11

• Self-hosted ECR setup simplified — The chart now includes a CronJob and an init Job that automatically create and refresh the ECR registry secret when selfhosted.enabled: true. Previously, users had to manually create ServiceAccount, Role, RoleBinding, CronJob, and related YAML. Now, only a single aws-ecr-credentials Secret needs to be created manually; everything else is managed by the chart.

• ECR secret init Job — A new ecr-secret-init-job.yaml

• New optional query parameter for webhooks API - enqueueOnly. If true then the webhook will be enqueued and 202 returned immediately to the caller.

• Possibility to override redirect/callbackUrl per service.

• Node version updated to 18.16.1 and the OS switched from Linux Alpine to Debian which resolved the DNS issues for some Salesforce sandbox URLs.

• Fix for GET /files?filter=userId:XYZ and GET /files/count?filter=userId:XYZ. These endpoints did not return correct results if the userId was specified in the filter and the user was not admin.

• Filepicker input type shows only files created by the signed-in user. Before this, the admin users saw all the files there, but when a file that does not belong to the owner (admin) is used in a flow, the component working with that file returns an error.

• Appmixer is now fully compatible with AWS managed services - tested with OpenSearch 2.7, DocumentDB 4.0.0, Amazon MQ 3.8.34, Amazon ElastiCache 6.2.6 and logstash 7.6.12 with OpenSearch plugin

• Optional token (API keys, OAuth tokens, …) encryption (self-managed Appmixer only).

• User files (files created in flows, or through the /files API) can be stored in MinIO/S3 storage (self-managed Appmixer only).

• Possibility to secure the create user (POST /user) API endpoint. This helps prevent external API calls (possibly malicious) from creating users without any authentication. Newly, a user scope can be defined using the API_USER_CREATE_SCOPE system variable which will be required when calling the POST /user endpoint. Typically, an “admin” scope is set so that only admin users can create new user accounts. See for more information.

• New connector context function context.loadOutputSchemaProperties(), which is now used by the Each connector (Controls module version 1.4.4). This fixes a few issues:

• Security: Upgraded axios to 1.16.1 (CVE-2026-42044) — Bumped axios across all packages (engine, UI SDK, backoffice) to address a critical Prototype Pollution vulnerability (CVSS 9.1).

• Removed read-write locks (RWLocks) from the component factory and uploader. The locks were no longer necessary and could cause contention under concurrent component operations.

• Added userId query parameter to the GET /stats/component-usage admin API, allowing filtering of component usage statistics for a specific user.

• Fixed an issue that caused the counter to remain stuck in Redis under certain conditions.

• A memory issue is fixed. In some cases, the memory usage was going up and the engine had to be restarted regularly. This was caused by an upgrade (in Appmixer 5) of one of the libraries (Ajv) and the way that the library caches JSON schemas.

• Storage.OnItem[Added|Removed|Updated] connectors had a critical bug preventing normal operation that was fixed.

• A little change in the way the engine looks for a compatible connector version. This only applies to connectors located in the file system (not published/updated through the API/CLI/Backoffice). Before this change, when upgrading to a newer version of Appmixer (to a newer Docker image with connectors), you could have seen an error: &#xNAN;

New Features

AI Copilot

• Copilot now persists the flow while it builds it — Instead of assembling a flow descriptor and submitting it only at the end, Copilot saves the flow to the database as it goes and runs a save → validate → fix loop against the stored flow. The flow is an ordinary flow from the first save, not a draft, and later conversation turns update that same flow. Persistence goes through the platform's own API, so ACL, storage quotas, flow and component limits, payload schema validation and audit all apply exactly as they do to a flow built by hand. Running flows are never modified — the flow must be stopped first. Set INTERNAL_API_URL to the in-cluster engine URL so these self-calls do not route through the external load balancer; it falls back to APPMIXER_API_URL.

• Copilot connects accounts and reads live variables while building — Copilot can connect a user's available account to a component and load real variable values during construction, rather than leaving accounts unconnected and variables unresolved until the user opens the flow. Sizing is bounded by COPILOT_VARIABLES_MAX_* limits.

• Copilot is configurable from the Backoffice, with hot reload — The Copilot system plugin's configuration moves into the cluster configuration, editable via the Backoffice and applied without restarting a pod. This covers the LLM endpoint (COPILOT_LLM_URL), the customer prompt extensions below, and the variable size caps.

• Custom context and tone of response — Two optional settings extend the Copilot system prompt: COPILOT_CUSTOM_CONTEXT for customer-specific use cases, connectors and data specifics, and COPILOT_TONE_OF_RESPONSE for the tone, vocabulary and register of replies. Both are unset by default. Values are injected as delimited, lower-authority operator configuration — they can refine behaviour and tone but cannot override Copilot's core role, its safety rules or its flow-building rules, nor reveal the system prompt.

• aiDescription for connectors and components — component.json, module and service manifests accept an optional aiDescription field (up to 1000 characters) written for the model rather than for the Designer UI, where description is deliberately kept short. Copilot's discovery tools prefer it and fall back to description, so connectors without the field behave exactly as before. Useful for steering Copilot on custom connectors:

• Dangling variable references are rejected before a flow is saved — Copilot validates the descriptor's variable references before anything is persisted: every {{{token}}} in a lambda must have a matching entry in that field's modifiers group, and a raw $.… path used inside braces or as plain lambda text is rejected with the exact correction to make. Legacy components carrying no modifiers object are only flagged when a reference is provably broken, so a Designer-built component re-submitted during an edit can never fail a save. Rejecting before persisting leaves the last valid save intact.

• Opt-in account auto-connection on flow save and clone — A new autoConnectAccounts parameter connects the user's available account after a flow is saved or cloned. Copilot-built flows use it so they preselect an account exactly as manual flow building does, including when the user has more than one account available.

• Reworked navigation menu — The main navigation is now a flyout in the collapsed rail, keeps a single group open at a time, and is visually unified with the workspace switcher.

• Copilot: one request owns the flow it is changing — Concurrent Copilot requests could interleave writes to the same flow. A run is now owned by the Designer for its duration: the canvas is locked while a request is in flight, the target flow is nominated before the prompt is sent, the backend writes only that flow and only one write at a time, and the run is reconciled at its end rather than mid-stream. The composer explains why it is blocked instead of silently refusing input, a request survives the panel being closed, and the History button is visibly disabled while Copilot writes.

• Copilot: a refused save is no longer hidden — The Designer now surfaces a save that Copilot refused instead of swallowing it, no longer re-saves a flow that Copilot has already persisted, and reports the backend's mid-turn write on every handoff route. The pre-Copilot snapshot is taken in the plugin and reported to the client, so it is no longer captured too late.

• Copilot: an empty canvas is no longer versioned before the first write

• Node.js upgraded to 24.19.0 — Base images across the engine, frontend and Backoffice move to Node.js 24.19.0. This also fixes outbound TLS failures (UNABLE_TO_GET_ISSUER_CERT_LOCALLY) to endpoints whose certificate chains to Let's Encrypt's ISRG Root YR, which is absent from the older image's compiled-in root CA store.

• node_modules is reinstalled only on a Node.js major version change — Previously every patch or minor Node.js image bump triggered a cluster-wide npm install and a GridFS re-upload of every plugin's and component's node_modules. Only the major version segment is compared now, since that is what native addon ABI compatibility depends on.

Flow Designer Improvements

Add Notes on the canvas

You can add notes on the Designer canvas - just right click and select "Add new note". They support markdown, can be dragged around and resized. You can even place notes within other notes.

Limit access to Modifiers and Variables in the Wizard Builder

Ability to limit access to modifiers and variables in the Wizard Builder. This can be useful when you want to create Integration Templates and you want to prevent users from adding or removing variables or from using modifiers (our built-in data transformer functions) in the Template Wizard.

Required fields and validations

Validation messages shown for fields in the inspector panel (where you configure connectors) are transformed into a tooltip, which is less instrusive. Required fields are now clearly marked with an asterisk and a red higlight of the field outline. These improvements also apply to the interface of the Template Wizard - the form used to configure Integration Templates in the embedded marketplace.

Zoom in and out

You can now Ctrl/Cmd + scroll or use touchpad gestures to zoom in and out on the canvas.

Clear app naming

All components used on the canvas have the connector (app) name included for clarity.

When a flow that contains connectors that are no longer available (were removed, or the ACL changed) is displayed, new placeholder connectors are shown in the UI instead of the unavailable connectors. Before, the unavailable connectors were just removed from the flow.

The Appmixer SDK implements Trusted Types now, according to the , to secure DOM injection sinks.

You can now configure SSO with OIDC or SAML protocols to manage access to Appmixer Studio. Read more about how to set up SSO for your organization:

Audit logs capture all actions taken in the Appmixer Studio - creating, updating or deleting flows; installing or removing connectors; publishing templates and user logins - everything is logged. Access Audit Logs in the System settings in the Backoffice of Appmixer Studio.

• Upgrade from Node 18 to Node 24.6.

• Fully compatible with Mongo 8, ElasticSearch 9, Rabbit 3.13, and Redis 7.

• The Engine can be started as an API node or as a Worker node. This allows you to create a separate cluster of API nodes and another cluster of Worker nodes.

• Implemented local DNS cache for the Quota server requests.

New Features

Automation Hub - New UI widget

Simplified Embedding with an all-in-one widget

New embeddable widget to offer automations to your users (formerly the integration marketplace). This simplified widget combines all automation hub functionality with easy configuration options, widget events, and streamlined embed code generation.

Embed your own Hub to allow users to:

• Browse and start Automations pre-built by your team

• Customize pre-built Automations

• Manage Logs and Accounts for their Automations

Your team can easily manage the Hub:

• Organize automations into categories (shown as tabs in the Hub)

• Adjust the look and feel and instantly preview the Hub

• Monitor health and statistics of Hub Automations

• Define who can access specific automations

.

Automation Hub Categories

Organize your integration templates using categories in the hub widget. Create and manage categories through the new Categories API, assign templates to multiple categories, and use them to create custom tabs and filters in your embedded automation hub. Categories are system-wide resources with admin-only management.

Automation Hub Settings & Analytics

Configure and customize your Automation Hub directly in Studio with the new Hub Settings page. Access theme settings, branding options, and generate embed code. The new Analytics Dashboard provides insights into template adoption, usage metrics, user engagement data, and performance through dedicated API endpoints.

Shareable Links with Email Allow List

Automation Hub now supports shareable links with OTP (One-Time Password) authentication and configurable email allow lists. This allows you to share your automation hub with specific users or domains while maintaining security through virtual user management and TTL configuration. Configure sharing options directly in Hub Settings, including regex patterns and wildcard domains for email validation.

Introducing User Groups (Workspaces) - a major new collaboration system that enables shared resources and team collaboration. Create workspaces, add members, share flows, and integrations across your team. Manage groups through the new User Groups API, Studio UI workspace switcher, and Backoffice admin interface.

Template Instance Updates

Edit and update running integration template instances without stopping them. The new draft workflow allows you to make changes to live integrations while they continue processing data, then publish updates when ready.

Account Sharing & Variable Restrictions

Share connector accounts from templates to instances. Restrict which variables are exposed in the Template Wizard with a new checkbox option for component selection and validation.

Integration Instance Drafts

Work with integration drafts to create editable versions of running integrations without affecting the original. Make changes to integration instances while the original continues to run.

Execution-Based Logs

Completely redesigned the Logs interface with execution-based viewing. Browse logs by execution, view component inputs and outputs, use correlation IDs for tracking across components, and toggle between simplified and detailed views. All component logs now include correlation IDs and message IDs for comprehensive debugging.

SDK Event System Modernization

Support for custom event handlers: The SDK event system has been modernized to support custom event handlers. Events now use a new contract with .data and .next() pattern, allowing custom handlers while maintaining backward compatibility. Note that typeof checks now return 'object' instead of primitive types, and strict equality checks (===) no longer work with primitives.

Designer Loading Event

New loading-finished event in the Designer widget allows you to trigger actions when the designer has fully loaded and is ready for interaction.

Dashboard & Navigation Redesign

Refreshed dashboard design with reorganized navigation menu in the Build space. New Templates section layout and Flows section redesign improve the overall user experience and make it easier to find and manage your flows and automation templates.

New panel dedicated to the Automation Hub with basic steps (can be minimized) and Preview and Share buttons.

Automatic Flow Naming

Flows are now automatically named based on the components they contain, making it easier to identify flows at a glance without manual naming.

Wizard Builder Enhancements

• Custom placeholder options for form fields in wizard builder

• Custom tooltip support with auto-hide for empty tooltips

• Drag and drop field reordering in wizard builder

• Magic wand replaced with a checkbox for clearer UX when selecting fields for template wizard

Additional UI Improvements

• Published/Unpublished filter in Automation Templates section

• Manage Categories option in the context menu of templates

• Updated explainer panels explaining the Automation Hub and Templates

• Confirmation dialog for revoking connections

Comprehensive resource management system for controlling storage and flow limits. per user or scope, set capacity thresholds.

• Waiting queues migrated from RabbitMQ to MongoDB for better performance

• Redesigned the retry mechanism with improved

• Default maximum message size (LIMIT_MESSAGE_MAX_BYTES) lowered from 15MB to 2MB.

• RabbitMQ 4.x compatibility confirmed and tested

API & Security Improvements

• Rate limiting for the

• Improved admin user validation in the admin API with token revocation

• Dynamic CORS origin reflection support

• Correlation IDs in all ERROR logs for better debugging

Configuration

• support scope-specific configuration

• The Wizard configuration now offers enhanced flexibility, allowing the inclusion of the following new sections (as opposed to just inspector fields which was the case in the previous versions of Appmixer):

• Account: allows you to add an account field manually. Previously, account fields were automatically added which made it easier to configure wizards but did not allow you to: add different account sections for different components (imagine you have a flow with 2 GDrive components to upload files. Previously, you could only create a wizard that uploads to one GDrive account. Newly, you can add 2 account sections allowing the end-user to upload files to two different GDrive accounts.

• New Studio Dashboard tiles.

• Step selector on output ports.

Which opens a new Component selector.

New Features

New Diagram

A new, modern diagram for the flow builder canvas: more responsive, with new effects and animations, and new features such as auto-connect and auto-align. It also provides more visual feedback, especially when testing — you can see the status of each component and view its log data directly on the canvas by hovering over it.

An empty canvas now shows a placeholder that guides you to the two ways of starting a flow: adding a trigger manually or building the flow with AI.

The new diagram currently only supports the left to right layout. Customers using the top to bottom layout will automatically keep seeing the old diagram. We strongly recommend switching to the new diagram to get all of the new upgrades and features — after switching from top to bottom to left to right, the auto-align button (brush icon) in the lower left toolbar makes it easy to align your flows.

Flow Versioning & Drafts

Versioning Panel

A new side panel in the Designer lets you manage the version history of a flow: save named snapshots, rename, restore, clone a version into a new flow, or delete versions. A status bar above the canvas shows which historical version you are browsing.

Draft System for Running Flows

Running flows can now be edited safely through drafts. Clicking Edit on a running flow creates a draft; the live flow keeps running unchanged while you make your changes. Publish Changes merges the draft back into the original flow and automatically creates a version snapshot of the pre-publish state.

Restore for Running Flows

Versions can be restored even while a flow is running — the version is restored into a draft (an existing draft is replaced), never directly into the live flow. Restoring a stopped flow without a draft restores it in place and creates an automatic restore point first.

Flow Versions API

The new Flow Versions API powers all of the above: version CRUD, draft-aware restore, cloning a version into a new independent flow, version types (manual, autosave, publish, restore-point) and automatic garbage collection with configurable retention.

Test Flow in the Designer

A new Test flow button executes a single test run of the current flow without starting it. Per-component progress is streamed live onto the canvas with status badges and connector colours; clicking a component's result badge opens its output, and the results link into the flow logs. Test runs never change the flow's stage and never touch production state.

Trigger Test Inputs

Dedicated test-input surfaces for common trigger types: a JSON payload dialog for Webhook triggers (with the option to load a recent live run), a conversational side panel for Chat triggers, and a form dialog for Form triggers rendering the trigger's configured fields.

Test Data Resolution

When no test data is supplied, the engine resolves the trigger's output using a fallback chain — the trigger's new test(context) method (real data), past runs from the flow logs, or a sample generated from the output port JSON schema — and reports which data source was used (real, logs, dummy, manual) so the Designer can inform the user.

Test Runs API & Logs

The test mechanism is available via a new SSE endpoint (POST /flows/{flowId}/test) with an abort endpoint. All log records produced by a test run — component outputs, context.log() output, static component calls and component errors — are marked with a testRunId, and the Logs API accepts a testRunId filter, so test executions are clearly marked and filterable in the Logs. In the UI, a consistent test-run indicator is shown in the Insights logs (in a dedicated column), the log detail, the Designer flow logs and the executions list.

Connector developers can implement the new test(context) virtual method to provide real sample data for their triggers.

• The validation sidebar in the Designer has been replaced with a floating validation panel attached to the Start flow / Test flow buttons.

• The Flow Validation API now reports components that require authentication but have no connected account — such flows fail validation instead of failing at runtime with "Missing access token".

• Required fields inside expression-type inspector fields are now validated as well.

Each step in a flow can now define its own error handling (Designer: cogwheel → Error handling; API: the errorHandling component descriptor property):

• Automatic retry toggle with a configurable number of retries.

• On error action once retries are exhausted: route the error to a virtual error output port that can be wired to any downstream component (with error details and flow data available as variables), stop the flow, or store the message as unprocessed (the previous behaviour, still the default).

A new AI assistant built into the Designer that builds, edits and explains flows from natural language. Copilot designs flows directly on the canvas — selecting connectors, wiring components and filling in parameters — and can read the open flow to modify, remap or explain it. For running flows, Copilot works on a draft.

• Ships as an engine system plugin (SYSTEM_PLUGINS=copilot) with configurable LLM provider, model and base URL (COPILOT_LLM_URL) — so Copilot can also target an Anthropic-compatible LLM gateway or proxy.

• Conversation is retained per flow and restored when the panel is reopened; replies render as Markdown.

• The panel is resizable — drag its edge to change the width, double-click the resize handle to reset it.

AI Usage Monitoring

The Insights menu is now split into two sections: Flow activity (the flow execution logs) and AI usage (visible to administrators only). The AI usage dashboard shows Copilot spend: summary cards with an input/output token breakdown, a daily consumption chart, and a paged, searchable per-user / per-group / per-scope cost breakdown with drill-down into individual LLM requests — backed by new admin usage API endpoints.

The usage API supports optional offset/limit paging with a totalCount in the response (totals always describe the whole reporting window). Cost computation handles multiple models correctly: requests made with models missing from the pricing table report their token counts but add zero cost instead of invalidating the total, and group/scope breakdowns include a per-user breakdown.

Component behaviour files can now be written in TypeScript. The engine runs them using Node.js native type stripping — no build step required, upload .ts files the same way as .js files.

Fields in a connector's authentication dialog can now declare a display precondition with the when property (eq/neq operators), so a field is only shown when another field has (or does not have) a specific value — for example, showing an AWS region field only when the Amazon Bedrock provider is selected. Hidden fields are excluded from validation and from the submitted credentials.

Filters in the Flow Manager and Integrations manager now clearly indicate when they are applied and can easily be reset: each filter renders as a chip with a Group: value label that is highlighted when active, an × button clears a single filter group, and every filter menu offers an All option with a checkmark marking the active choice — in both grid and list layouts.

Resource Transfer

New admin endpoint PUT /resources/transfer transfers all resources (flows, accounts, tokens, data stores, files, ...) from a user or group to another user or group as a background task — for example when an employee leaves. Deleting a group that still owns flows is now rejected unless its resources are transferred first (or ?force=true is used).

Progressive Component Loading

GET /components accepts a selectors[] query parameter to request multiple component patterns in a single call, and the new GET /flows/{flowId}/components endpoint returns only the manifests used by a flow — so clients can load manifests progressively instead of fetching the full catalogue.

AI Agent Tools Observability

The static component call API accepts a new log flag that records the call in the execution logs (component identity, input/output, status, duration, correlation) — used to make AI Agent tool calls observable in the Logs UI.

Automation Hub tiles now render a flow image in the card body when the flow's image field is set, instead of the connector icon strip.

Opt-in OpenTelemetry instrumentation for HTTP, MongoDB, Redis and RabbitMQ across all engine services. Enable it by pointing OTEL_EXPORTER_OTLP_ENDPOINT at your collector; individual instrumentations can be toggled with env vars, with zero overhead when disabled.

• Faster Designer load — the Designer loading sequence was reworked to significantly speed up opening flows.

• Module preloader — API nodes prebuild the most recently used component module caches right after startup, removing cold-start latency from component and variables endpoints. Shared node_modules are loaded once per component version, and preloading recovers gracefully from individual module failures.

• Faster GET /variables — eliminated excessive filesystem checks and redundant module resolution in component loading; component synchronization is now enabled by default with batched writes.

• New diagram polish & performance — fixed theming regressions and dark-mode contrast issues, sped up flow thumbnail capture on larger flows, removed the canvas scrollbars, improved note editing focus behaviour, added fallback icons with proper loading states for connector images, and restored the full zoom-out range and unbounded Zoom to fit so large flows can be brought fully into view.

• Flow thumbnails — thumbnails are now captured also for flows whose content is written on the server: flows built by AI Copilot, restored versions and published drafts previously ended up with a missing or stale thumbnail in the Flow Manager.

• Component names without a manifest — components whose connector manifest cannot be resolved (a removed connector, or one hidden by an ACL change) now display a readable name derived from the component type instead of a raw component ID — most visibly in the Wizard Builder.

• The Insights Chart Editor and Insights Dashboard SDK widgets (appmixer.ui.InsightsChartEditor, appmixer.ui.InsightsDashboard) have been removed, together with the histogram section of the Insights Logs widget. The Charts REST API remains available for existing chart data.