# 3.17.1 Release Notes Squirro 3.17.1 was released on September 16, 2026. Learn more about the [Squirro Release Process](../squirro-release-process.md#getting-squirro-process). > **Notes for administrators** > > This release introduces important changes that may require adjustments to your existing setup. [Learn more](#breaking-changes) ## What’s New - **Squirro CLI** Manages a Squirro instance from a configuration directory kept in version control, pulling instance configuration into JSON files and applying local edits back. Built to be driven by an AI coding assistant, with a machine-readable configuration schema and a preview before every change. Distributed through the Squirro Registry to selected customers and partners. [Learn more](../../../technical/cli/index.md#squirro-cli) - Device page for approving a command-line login with the short code the tool displays, off by default behind `device_authorization` in the `[security]` section of `common.ini`. - OAuth device-authorization grant (RFC 8628) on the platform token endpoint, through `POST /api/user/oauth2/device_authorization` and a `device_code` grant type on `/oauth2/token`. ## Improvements ### Search - `fields` parameter applied to recommendations seeded with `external_id`, matching `item_id` seeds. ### Platform - Technical Preview - OpenSearch snapshot repositories for `s3`, `azure`, and `gcs`, in addition to the read-only `repository-url`. - Tokens minted by an approved device login listed and revocable under My Account, API Access. - Device-login limits in the `[user]` section of `user.ini`, covering the poll interval, the outstanding-code cap, rate limits, and the verification URI. ## Bug Fixes - Project ACL query templates not applied consistently across item, note, entity, and recommendation routes. - Entity deletion by `external_id` not fully authorized against the parent documents involved. - Recommendations seeded by `external_id` resolving to a different document than the seed. - Unknown recommendation seeds returning 500 instead of 404, and an unknown `method` returning 500 instead of 501. - Login and token refresh timing out on instances with a large `access_tokens` table. - Sorting the Data Ingestion Logs by Body, Title, or Summary silently doing nothing, with existing records sortable once their index rolls over or is reindexed. - Technical Preview - Dataloader job logs not rotated or cleaned up in containerized deployments. ## Breaking Changes - On a project with an ACL query template, requests naming an item the caller may not see now return 404 on `GET`, `PUT`, and `DELETE` on `/items/{item_id}`, bulk `PUT /items`, `POST` and `PUT` on `/notes`, `POST /items/recommend`, and the four `/entities` verbs. Identifiers that merely do not exist behave as before. `POST /items/exist` reports such items as `false` rather than returning 404, and `/notes/query` trims hidden documents silently. Update any client that treats a 404 on these routes as a missing item. - On a project whose ACL template keys on `user_values`, such as `acl_user_id` or group membership, `/entities/query` and `/entities/properties` return narrower results than before. Review any report or integration that depends on the previous, wider result set. - The User API nginx include now sets `fastcgi_param REMOTE_ADDR`, which the device-authorization flow requires. A cluster carrying a locally edited copy of `/etc/nginx/conf.d/user-fastcgi.inc` receives an `.rpmnew` file instead of an updated one. Merge it and reload nginx, otherwise device-login initiation answers `429 temporarily_unavailable`. Clusters that leave the flow turned off are unaffected. ## Project Neo Technical Preview | [Learn more](../../../technical/neo/index.md#neo) ### Improvements - `genai login` completing through a browser approval instead of a pasted token, with `--manual` keeping the paste flow. - Scheduled tasks running as a chosen agent instead of the project configuration, set with `agent_id` on the tasks API. - `agent_id` on the `tasks` tool create and update commands, and `--agent` on `genai task create` and `genai task update`. - Explicit null `agent_id` on a `PATCH` clearing the agent, spelled `clear_agent: true` on the `tasks` tool and `--agent ""` on the CLI. - `agent_id` naming an agent the project does not offer refused with 422 `unknown_agent` when the task is saved, with the valid identifiers. - Running a task by hand against a stale agent refused with 409 `stale_task_agent`, listing the valid agents. - Task whose agent has been retired failing its run and naming the missing agent, with the schedule keeping its place. - Project-authored upload limits on the `genai_config` snapshot, with `max_file_size_bytes`, `max_storage_bytes`, and `max_attachments_per_turn` falling back to the deployment default. - Default cap of 20 files per message, with a turn over the project’s cap refused with 422 `too_many_attachments`. - `max_attachments_per_turn` published by `GET /files/config`. - Upload and file configuration refused with 503 `file_policy_unavailable` when the project’s policy cannot be read. - `thumbnail_url` returned by the files API as an inline WebP data URI for PNG, JPEG, and WebP uploads. - Attachment picker refusing files past the per-message cap and naming them, keeping those that still fit. - Server refusal message for an over-cap turn shown instead of the generic retry toast. - Reason a turn stopped short or broke shown in the conversation, translated in English, German, French, and Italian. - Try again offered only for failures another attempt can resolve, and repeated as the next turn on the thread. - Answer that was produced but not recorded reported while it is still on screen. - Regenerate offered from the turn as the service records it, rather than from what the client witnessed. - File steps named for what happened to the file, rather than for the raw tool identifier. - Anchored edits and appends showing their replacement text as it streams. - Write refused mid-answer reported as a pause while it is retried, and as failed once it is given up on. - Answer feedback bound to the turn that earned it, carrying the vote, reason, and comment only. - Feedback already given shown on reload, surviving branch navigation and regenerate, with a resubmission replacing it. - Feedback reason stored as a stable key rather than as the displayed wording. - Page at `/neo` on instances without the Neo web client, stating that Project Neo is unavailable and directing the user to their administrator. - Response at `/neo` keeping its 404 status while serving the unavailable page. ### Bug Fixes - `genai` CLI crashing on an unreachable cluster, and a revoked login not saying to run `genai login` again. - `genai` CLI crashing on a malformed cluster URL, and `genai init` saving one it cannot use. - Manual `genai login` flow opening a page that does not exist. - Agent identifier longer than 64 characters accepted when the configuration was published, then cut short where a conversation or task recorded it. - Regenerated turn losing an attachment silently when the file had been deleted since the original message. - Stopped turn starting to generate again after switching away from the conversation and back. - Failed turn removing its question and its empty answer from the screen. - Conversation whose first turn was stopped spinning in the sidebar indefinitely. - “Generation stopped by user” written into the answer body, and copied along with the answer. - Provider error text shown verbatim on a failed turn, untranslated and carrying account, model, or infrastructure detail. - Branch numbering ordered by completion time rather than by the order the attempts were submitted. - Turn stopped before producing anything reporting “No steps available”. - Send refused by the service leaving the client requesting a conversation that was never created. - Feedback submission failing with 401 in token dev mode. - Scaffolded bundle carrying a non-compiling import path, a `neo-ui` command that does not exist, and an `RSBUILD_PORT` default that resolves to `NaN`. ## Installation and Upgrade For new installations, find step-by-step instructions on the [Install and Manage Squirro with Ansible](../../install/ansible/index.md#ansible) page (recommended) and [Installing Squirro on Linux](../../install/linux.md#install-linux) pages. To upgrade an existing installation, see the [Upgrading Squirro](../../install/upgrade.md#install-upgrade) page.