Post-2026.1.0.52 sweep, Tier 3: diagram layout key, Linux ES resilience, SAML XXE, bug fixes - #28
Merged
Merged
Conversation
…silience, SAML XXE, bug fixes Closes out the catch-up for everything that landed on 2026.1 after 2026.1.0.52. PreserveDiagramLayoutOnViewStyleChange (CS 189995/189996/190004, ticket 67465 / WI 19310). Documented as a customer key on the Portal - it is declared AppSettingVisibility.Customer, unlike the ES/Server keys below - with the overlap caveat taken from the setting's own description. The three unconditional coordinate fixes (Arrange, drag-to-move, sticky-note resize) are noted separately, since they apply whether or not the key is set. Linux/Mono ES resilience (CS 189890/189891, ticket 67293). Described by behavior rather than by key: MinThreadPoolWorkerThreads (200), BeginExecutionMaxRetryCount (10) and BeginExecutionRetryIntervalSec (6) all take the AppSetting constructor default of AppSettingVisibility.Support, so they do not belong in the customer configuration keys repository. The user-visible facts are the wedged agent under driver-spawn bursts, the ~100s dispatch tolerance, and the Linux venv bin-vs-Scripts path fix. SAML ACS XXE (CS 189894, CWE-611) added to Security Updates - the endpoint is reachable unauthenticated, so it is called out for SSO/SAML deployments. Bug fixes: diagram duplicate resource alias (CS 189961, release note), 'Blueprint not found' loop on domain switch (CS 189991), 500 downloading a shell or provisioning script with an extensionless stored file name (CS 189989), Properties dialog end time for a non-admin on an extended sandbox (CS 190005). Deliberately not documented: the Docker ES get-pip curl/wget change (CS 189983/189984/189986) is image build plumbing whose failing builds never shipped, plus Dotfuscator, TCL/XmlToHtml generation, nightly-red and CI-only changesets. ExportBlueprintPackage/ImportBlueprintPackage (CS 189912/189917/189921) are also omitted: CS 189940 replaced them with the ExportBlueprint/ImportBlueprint pair documented in #22. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Final batch of the post-2026.1.0.52 catch-up, completing #24 and #27. Replaces #26, which GitHub auto-closed when its base branch was deleted on merge; this is the same content rebuilt on
main.Preserve diagram arrangement on View Style change
CS 189995 / 189996 / 190004 (ticket 67465, WI 19310). New
PreserveDiagramLayoutOnViewStyleChangePortal key, defaultFalse. It goes in the customer keys repository because it's declaredAppSettingVisibility.Customer— including the caveat lifted from the setting's own description, that enabling it can make Large cards overlap on a diagram arranged in a smaller View Style. The three coordinate fixes that landed unconditionally (Arrange, drag-to-move, sticky-note resize) are called out separately since they apply regardless of the key.Linux Execution Server resilience
CS 189890 / 189891 (ticket 67293). Described by behavior, not by key:
MinThreadPoolWorkerThreads(200),BeginExecutionMaxRetryCount(10) andBeginExecutionRetryIntervalSec(6) all take theAppSettingconstructor default, which isAppSettingVisibility.Support— so they don't belong in the customer keys repository. What's documented is what a user can observe: the agent wedging under driver-spawn bursts, the ~100s dispatch tolerance replacing a few seconds, and the Linux venvbin-vs-Scriptspath fix.Security
CS 189894 — unauthenticated XXE (CWE-611) on the Portal SAML ACS endpoint, added to the 2026.1 Security Updates with an explicit note for SSO/SAML deployments.
Bug fixes
Four bullets: diagram duplicate resource alias (CS 189961, has a release note), Blueprint not found loop on domain switch (CS 189991), HTTP 500 downloading a shell/provisioning script with an extensionless stored file name (CS 189989), Properties dialog end time for a non-admin on a sandbox extended past its cap (CS 190005).
Deliberately not documented
ExportBlueprintPackage/ImportBlueprintPackage(CS 189912/189917/189921) — CS 189940 replaced them with theExportBlueprint/ImportBlueprintpair already documented in Document the new ExportBlueprint/ImportBlueprint APIs (2026.1) #22, so documenting them would describe an API superseded before release.Note on the diff
An earlier version of this commit showed ~1,200 changed lines because a scripted edit rewrote two mixed-ending files as CRLF. The repo is pure LF; the commit was rebuilt so the diff is the actual 54 insertions, 0 deletions.
npx docusaurus buildpasses; the 3 broken links reported are pre-existing (intro/features/abstract-resources) and unrelated.🤖 Generated with Claude Code