Release 26.5

Configuration changes

See configuration for more details.

Deployment server

• ACE_SCHEDULE_OVERRIDES (optional) - JSON object overriding the pattern, timezone and/or isEnabled of deployed schedules, keyed by schedule name. If unset, schedules deploy exactly as defined in the workspace.

Release notes

See docker images below.

ACE 26.5.2

September 11, 2026

CSV ⇄ JSON step

A new CSV ⇄ JSON step transforms CSV to JSON and back, which makes it possible to consume and produce CSV feeds directly in a flow. Supports a configurable delimiter, header handling, empty-line skipping, field trimming and flattening/rebuilding of nested objects.

• DIG2022-90644
  CSV step - parse CSV / JSON in ACE flows

Suppress HTTP errors in the REST step

The REST HTTP step has a new Suppress HTTP errors (suppressHttpErrors) option. When enabled, a non-2xx response is treated like a normal response and the flow continues to the next step, which is useful for passthrough proxies and any flow that needs to forward whatever status code the downstream returns without adding a Catch step.

• DIG2022-90858
  Add suppressHttpErrors flag for REST HTTP step

Per-environment schedule overrides

Deployed schedules can now be overridden per environment through the ACE_SCHEDULE_OVERRIDES configuration, so the same workspace artifact can run on a different cadence - or be disabled entirely - in each environment without editing the workspace. See configuration for details.

• DIG2022-85749
  Make schedule pattern configurable per environment

Bug Fixes

• DIG2022-90285
  Mixed Flow Parallel Execution Issue – Response Missing from Sub-Flow
• DIG2022-66003
  REST OAuth cache is shared between tenants
• DIG2022-60053
  Importing API with changed schema breaks schema references

Security

• DIG2022-89858
  Vulnerability fixes 36.2

Package	CVEs
xmldom	CVE-2026-83605, CVE-2026-83607, CVE-2026-83608, CVE-2026-83610, CVE-2026-83611, CVE-2026-83613, CVE-2026-83614, CVE-2026-83615, CVE-2026-83616, CVE-2026-83619
fast-uri	CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172, CVE-2026-84292
multer	CVE-2026-77037, CVE-2026-77063, CVE-2026-77078, CVE-2026-82333
tar	CVE-2026-73566
js-yaml	CVE-2026-84375
qs	CVE-2026-82417, CVE-2026-82562
joi	CVE-2026-84367, CVE-2026-84368

ACE 26.5.1

August 28, 2026

Workspace switching in ACE Designer

ACE Designer now supports working with several workspaces without re-entering repository credentials and URLs every time. Repositories and folders can be saved as a list and switched between quickly, the related settings have been reorganized, and switching back to a connection restores the branch that was last active in that connection instead of the repository's default branch. Available in both Designer Web and Designer Desktop.

• DIG2022-85282
  Allow saving multiple repositories and folders as a list
• DIG2022-85283
  Enable quick switching between multiple workspaces
• DIG2022-89772
  Restore to last active branch of connection on connection switching

ACE Designer dark theme

ACE Designer now supports a dark theme based on the official dark brand colors. The selected theme is persisted across Designer restarts on both Web and Desktop.

• DIG2022-85010
  ACE Designer - dark theme

XML response content type

APIs built in ACE can now return a true XML response instead of a JSON payload containing an XML string, which makes it possible to implement SOAP-style endpoints and mock services in ACE.

• DIG2022-87708
  Support XML response content type in ACE

Bug Fixes

• DIG2022-90107
  Expression validation incorrectly accepts invalid expressions with trailing text
• DIG2022-90108
  Redis step rejects valid TLS configurations due to incorrect schema
• DIG2022-88566
  Content search in ACE Designer - Display Search Results Issues

Security

• DIG2022-89855
  Vulnerability fixes 36.1

Package	CVEs
axios-1.16.0	CVE-2026-67320
adm-zip-0.5.18	CVE-2026-39244
nanoid-3.3.11	CVE-2026-73086
nanoid-5.1.5	CVE-2026-67214

ACE 26.5.0

August 13, 2026

Security

• DIG2022-87965
  Mend vulnerability fixes 35.3

Package	CVEs
dompurify-3.4.11	CVE-2026-66010
ip-address-10.2.0	CVE-2026-54272
brace-expansion-1.1.16, brace-expansion-2.1.2, brace-expansion-5.0.7	CVE-2026-14257
fflate-0.8.1	CVE-2026-45820
react-router-6.30.4	CVE-2026-53666, CVE-2026-53669
react-router-dom-6.30.4	CVE-2026-53668
fast-uri-3.1.3	CVE-2026-16221
systeminformation-5.31.6	CVE-2026-50289
protobufjs-7.6.4	CVE-2026-59877
body-parser-1.20.3, body-parser-2.2.1	CVE-2026-12590

Docker images

Designer Web

Hash: sha256:e1a5412527bc8aa9adf1aed09905e781c53208a65eec06f0d731aa9110865345

docker pull euadigportalcoredev02acr.azurecr.io/ace-designer:26.5.2

Runtime server

Hash: sha256:d8e926ef773ee393f745211971ae8cb4c33343abb58bb99c878a658862321bcb

docker pull euadigportalcoredev02acr.azurecr.io/ace-runtime-server:26.5.2

Deployment API server

Hash: sha256:e60c3674d345cc317c7d4de3bbdd224b4f95f6f22ace5931d9638f03b2fe5f37

docker pull euadigportalcoredev02acr.azurecr.io/ace-deployment-server:26.5.2

Scheduled job (BullMQ) administration

Hash: sha256:73b684565f78ac9198c90fa7913a7282a09cb244bfac6bd0e24a4b763ab095dc

docker pull euadigportalcoredev02acr.azurecr.io/bull-board:26.5.2

Developer API portal

Hash: sha256:cc773b52e869d4bf0c45f51c60c73c083a925b58ff569550680e4133e0cbf867

docker pull euadigportalcoredev02acr.azurecr.io/api-developer-portal:26.5.2

Designer Desktop

ACE Designer Desktop is available here