# 3.17.3 Release Notes Squirro 3.17.3 was released on October 14, 2026. Learn more about the [Squirro Release Process](../squirro-release-process.md#getting-squirro-process). > **Notes for administrators** > > This release introduces important changes that may require adjustments to your existing setup. [Learn more](#breaking-changes) Release summary Squirro Neo can be embedded in any website or app, bringing its chat and document search to customer portals and intranets, styled to match the site. Neo connectors to external tools stay signed in when their access expires, and can run under a shared service account or an API key. Neo users can share a link to a document, export or delete all their chats at once, and ask questions containing formatted text and code. Squirro can connect to its databases and caches on Azure and AWS with cloud identities, without stored passwords. Customers using custom Neo interfaces, embedded chat, or custom plugins need to update their scripts as part of the upgrade. ## What’s New - **Squirro Neo SDK** The new `@squirro/neo-sdk` package embeds the Neo chat and document search in any website or app, as script-tag elements or React components. It supports theming, inline and floating layouts, page context, and lifecycle events, and comes with a ready-made chat proxy that keeps the Squirro credentials out of the browser. ## Improvements ### Neo Tasks - Automatic renewal of OAuth access tokens for Neo MCP connectors, without asking users to sign in again. - Service account authentication for Neo MCP connectors with the `client_credentials` auth type, shared by every user of the project. - API key and HTTP basic authentication for Neo MCP connectors, with the `api_key` and `basic` auth types. - Pre-registered OAuth clients for Neo MCP connectors, supporting providers such as Google that cannot register a client dynamically. - Optional OAuth redirect middleman for Neo MCP connectors with a pre-registered client, set with `SQ_GENAI_V1_EXTERNAL_MCP_OAUTH_MIDDLEMAN_URL`. - Neo MCP servers that sign users in through a separate identity provider supported. - Endpoint for project administrators to reset the registered OAuth clients of a Neo MCP server. - Shared `auth` block for Neo MCP servers, with `auth_mode` and `bearer_handle` deprecated but still supported. - Publish errors for Neo connector authentication settings that cannot work, such as an unsupported auth type or an `Authorization` API key without a `scheme`. ### Neo Interface - Previews of attachments in the Neo side panel, covering Office documents, PDFs, CSV tables, images, audio, video, and text. - Markdown, tables, and code blocks in sent Neo questions, with live code blocks and a language picker in the message box. - Chats section in the Neo sidebar, with a collapsible Recent group and a count of new answers. - Export all chats and Delete all chats options in a new Chat data section of the Neo settings. - Share action on Neo search results and in the document side panel, copying a link that opens the document in full screen. - Scroll-to-latest button in Neo conversations, shown while the newest message is out of view. - Neo sidebar floating over the conversation on narrow windows, and collapsing to its icon rail when the conversation gets too narrow. - Expanded or collapsed state of the Neo sidebar remembered per browser. - Warning notice above the Neo message box when a question fails to send, with the question restored for another try. - Images the selected Neo model cannot accept marked as not used in the message box, with messages naming the model. - Retry option in the Neo message box when the assistant catalog fails to load. - Attachment tiles in the Neo message box wrapping onto new rows, with the message box scrolling on short screens. - Tap on the empty part of the Neo chat header on phones, scrolling back to the first message. - External images in Neo answers and document snippets shown as placeholders instead of being loaded. - Stricter sandboxing of HTML artifact previews in Neo. - JavaScript inside PDF documents turned off in every Neo document viewer. - Neo sidebar rows re-rendered only when their own conversation changes. ### Neo CLI - `--groups` option documented in `neo-ui create dashboard --help`, with matching instructions for AI agents in new bundles. - Project ID checked by `neo-ui deploy --project` before the bundle is uploaded. - Core version shown by `neo-ui catalog`, with a warning when the bundle uses a different one. - All `.env*` files and `.npmrc` ignored by git in bundles created with `neo-ui create bundle`. ### Neo Core Library - `useChatActions()` in `@squirro/neo-core/chat`, sending questions, stopping answers, and downloading the conversation from a bundle’s own interface. - Read hooks such as `useSelectedAgent`, `useStreamingState`, and `useAgents` exported from `@squirro/neo-core/chat`. - Extension points used by the Neo SDK exported from `@squirro/neo-core`, including chat link handlers, items pagination, and query builders. - Types used in the public signatures of `@squirro/neo-core` importable by name, with smaller published declarations and a `CHANGELOG.md` of breaking changes. - `Spinner` component exported from `@squirro/neo-core/components`. - `aiGenerated` option on `exportToCSV`, `SquirroMarkdown`, and `FullscreenModal`, and `onRunFailed` handler on `StreamHandlers`. - Send failures shown as a notice above the message box by `InputField`, no longer passed to `ChatCallbacks.onNotify`. - Generated export references in the Claude skills shipped with each Neo bundle. ### Squirro Interface - `frontend.userapp.external-link-warning` project setting, making links in PDF documents clickable and confirming before external links open. - Note in Project Export stating that data source credentials are not exported. ### Squirro Chat Widget - Agent pickers in embedded chat offering only the agents the embed account can run. - Conversation titles and Batch Q&A summaries in embedded chat generated through an active Chat with LLM agent offered to embedded chat. ### Platform - Keyless authentication with cloud identities: Microsoft Entra ID for PostgreSQL, Redis, and Azure OpenAI, and AWS IAM for Amazon ElastiCache. - XLSX source previews reading only the header and the first ten rows, with a private `[dataloader] preview_snapshot_directory` setting. - Elasticsearch and Filebeat 9.5.5, and OpenSearch 3.9.0. - Neo project access decisions cached for up to 60 seconds, tunable with `SQ_GENAI_V1_PROJECT_AUTH_TTL_SECONDS`. - `SQ_SECURITY_WORKSPACES` no longer required by the GenAI service, defaulting to `false`. - Start time on every content block of a Neo conversation, returned as `started_at`. - Obsolete `thumbler` service removed. ### Containerized Deployments - Technical Preview - Neo web client included in containerized deployments, with single sign-on. - Technical Preview - Fluent Bit sending the ingestion and error recovery logs of containerized deployments to the Monitoring project, with OpenSearch support. - Technical Preview - Upgrades through the `squirro_containers` Ansible role keeping secrets across versions, supporting EL8 hosts, and removing old bundles and images. ## Bug Fixes ### Neo Tasks - Neo MCP connector credentials appearing in error messages and logs. - Authorizing a Neo MCP connector whose OAuth client handle is not bound returning a 502 error instead of naming the handle. - Credentials mounted from a file keeping a trailing newline, breaking knowledge graph authentication, model API keys, and code interpreter backends. ### Neo Interface - Downloading a file or artifact from the Neo assistant failing at random with an authentication error. - Switching to another conversation right after sending a question losing the answer and leaving its sidebar spinner on. - Answer finishing in another conversation keeping the sidebar spinner instead of showing the New answer dot. - Chat sent right after an answer finished disappearing from the Neo sidebar until its own answer completed. - Failed Neo answers shown as empty successful answers reading “No steps available”. - Neo conversation showing different thinking steps after a reload. - Failed rename, delete, or Delete All Conversations in the Neo sidebar giving no feedback and changing the list until a reload. - Pressing Enter on the cancel or skip button of a tool approval card approving the tool call. - Custom answer typed for one tool action on an approval card carried over to the next action. - Regenerate, edit, and retry actions available in a Neo conversation while a tool approval was waiting. - Neo conversation drifting away from the message box when the window or the message box changed height. - Neo message box taking focus from another field on the page when an answer finished. - Neo citations opening a PDF on the first highlight instead of the cited page. - Neo PDF viewer failing when a second document opened. - Long or malformed formulas in Neo answers painting over the surrounding content, and numbered `align` and `gather` environments shown as source. - Restored Neo saved searches changing their query when a filter value contained several words, parentheses, or the word NOT. - Raw highlight tags shown in Neo search results, the document side panel, and toasts. - Neo search filter dropdown staying empty until a reload after its values failed to load. - Neo task links briefly showing “Task not found”, or offering a Retry that could never succeed for a missing task. - Neo landing on the chat after single sign-on instead of the page the user came from. - CSV exports of Neo tables from search results or fetched documents marked as AI-generated. - Toasts, file-type chips, the Send button, and some Neo text ignoring dark mode or white-label colors. - Incognito toggle on the Neo welcome screen not clickable when the content is top-aligned. - Escape in the Neo conversation rename field also closing the side panel. - Neo message box and AI disclaimer cut off at the bottom on phones. - Neo chat header scrolling off screen after a follow-up question on phones. - Neo welcome screen not scrollable on short phone screens, hiding the Send button. - Artifact title squeezed to a few letters in the Neo artifact viewer on phones. - Keyboard and screen reader issues in Neo, including locked Connectors switches unreachable with Tab and an unnamed account menu button. ### Neo CLI - `neo-ui create dashboard` stopping at a prompt when run without a terminal. - `neo-ui doctor` and `neo-ui upgrade` warning about core versions and duplicate core copies in ways that could not be cleared. - `neo-ui dev` proxy accepting requests from opaque origins. ### Neo Core Library - Neo bundles rendering blank answers under React StrictMode. - Chat stream promise resolving when the stream opened instead of when it ended. ### Squirro Interface - Logout ending in a reload loop, or failing with an expired access token. - Login and logout disrupted after opening an embedded chat. - Facet values missing from the Labels widget and search bar suggestions when an ACL relevancy plugin is used. - Deleting the last prompt in a Prompt Library category leaving an empty screen. - Failed file uploads in Studio forms, such as the Documents connector, always reported as too big. - Missing thumbnail height in paragraph-level search results. ### Squirro Chat Widget - Every Chat widget request failing at once when `frontend.sqgpt.default-timeout` was set to a very large value. - Source references opening the PDF on an earlier page that repeats the cited text. - Misleading “no data” indicator in embedded chat when source metadata is withheld. ### Platform - Project permissions and ACL query templates not applied consistently on Neo and item routes. - Project owners refused on the Neo project administration routes. - Neo answers that failed partway or resumed after an approval leaving steps shown as still running. - Stopping a Neo answer logging an error for a turn that ended correctly. - OAuth data sources such as SharePoint, Salesforce, or Dropbox stopping after a fixed period while still reporting Completed. - Large custom asset uploads, such as Neo UI bundles, failing with a 413 or 504 error. - Quantized embeddings losing accuracy, with some values flipping sign. ### KEE - KEE geo tokenization failing with the 3.17.2 toolbox. ### Containerized Deployments - Technical Preview - API requests failing in containerized deployments after a single service was redeployed, until nginx was restarted. - Technical Preview - Sign-up timing out in containerized deployments. ## Breaking Changes ### Neo Tasks - OAuth sign-in and token renewal for Neo MCP connectors require HTTPS. A connector whose authorization server or token endpoint uses plain HTTP, other than `localhost`, stops working. Serve these endpoints over HTTPS before upgrading. ### Neo Core Library - `ChatStrings` and `ItemsStrings` in `@squirro/neo-core` gain required keys, such as `composerRegionLabel`, `errorSendFailed`, `moreAttachments`, and `itemDetailErrorTitle`. Add them to a custom Neo interface that builds either set in full, or pass a partial set instead. - `sanitizeBody` strips `class` and `id` attributes, bare `#fragment` links, and URL schemes other than `http`, `https`, and `mailto` from item bodies, and opens every link in a new tab. Update any custom Neo interface that relies on them. - `extractFootnotesFromMarkdown` returns one entry per source link, so two entries can share a `number`. Key a rendered footnote list by `number` and `id` together. - `ItemDetailProps` no longer takes `sanitizeHtml`, and `AttachmentCard` no longer takes `canEdit`. Remove `sanitizeHtml` from custom code, and use `onEdit` instead of `canEdit`. - `ChatDataSource.getCatalog` rejects with `CatalogError` when the catalog cannot be loaded, instead of resolving `null`. Handle the rejection in custom code that calls it directly. - The empty-state area of `ChatPanel` is a scrolling flex column. Check the layout of a custom `welcomeContent`. ### Squirro Chat Widget - The shared embed account and embed tokens reach only the endpoints embedded chat needs, and custom agents and embedded Batch Q&A summaries need an active agent offered to embedded chat. Offer the agents used in embeds to embedded chat, and move any other integration to its own credentials. ### Platform - `python-jose` and `ecdsa` are no longer installed with the platform, and upgrading an RPM host removes `python-jose`. Move a custom Studio plugin, pipelet, or data loader plugin that imports `jose` to PyJWT, or list `python-jose` in its `requirements.txt`, and upload it again. - The configuration service no longer serves the legacy `/v1/namespace` and `/v1/name` routes. Update any client that calls them. - With the `thumbler` service removed, `cleanup_html()` in `squirro.lib.cleanup` no longer accepts `add_data_hash`, and the frontend configuration no longer includes `thumblerAPIRoot`. Remove both from custom code. - XLSX previews in the Excel data loader plugin require the `xlsx_preview` package of the data loader SDK and a private, disk-backed `[dataloader] preview_snapshot_directory`. Upgrade the SDK together with the plugin, and provision the directory before rolling it out. - Downloads from the Neo assistant fail if `/etc/nginx/conf.d/genai.conf` was edited by hand. Merge the `genai.conf.rpmnew` file left by the upgrade into it. ### Containerized Deployments - Technical Preview - The GenAI service of a containerized deployment reads `SQ_SECURITY_WORKSPACES` as `false` when it is not set. Set it for deployments that use workspaces. ## Installation and Upgrade For new installations, find step-by-step instructions on the [Install and Manage Squirro with Ansible](../../install/ansible/index.md#ansible) page (recommended) and [Installing Squirro on Linux](../../install/linux.md#install-linux) pages. To upgrade an existing installation, see the [Upgrading Squirro](../../install/upgrade.md#install-upgrade) page.