2026.11.0

New permissions added: Organization:list_webhooks, Organization:create_webhook, Organization:delete_webhook, OrganizationSettings#webhooks:view.

New permissions added: Profile:view, Profile:delete_account.

New permissions added: ProfileSettings:view, ProfileSettings#account:view, ProfileSettings#security:view.

New permission added: ProjectSettings#skills:view.

Switch to Spring AI 2.0.1

Properties ocp.role.<role>.permissions and ocp.role.project.<role>.permissions have been removed in favor of hardcoded permissions. Therefore, each downstream product doesn’t need to declare the permissions anymore if they use the same configuration as Obeo Enterprise for Sirius. In the situation where they want to customize them, new properties ocp.role.<role>.permissions.override and ocp.role.project.<role>.permissions.override have been added, following the same value format than the original properties

New permission added: Project:view_history. Custom role permission overrides must include this permission to allow history consultation.

History snapshots now use Sirius Web semantic data and representation storage. Existing snapshots are migrated automatically, and the dedicated snapshot tables and Java APIs have been removed.

New permissions added: ProjectRevision:restore. Custom role permission overrides must include this permission to allow revision restoration.

New permission added: ProjectRevision:compare, exposed through revision capabilities and granted to project readers by default. Custom role permission overrides must include this permission to allow revision comparison.

New npm package added @obeo/obeo-cloud-platform-authentication. Projects depending on @obeo/obeo-cloud-platform must add this package as a peer dependency.

New permission added: Project:merge_branch, exposed through Project.capabilities.canMergeBranch and granted only to the Administrator account role and Admin project role by default.

Contributors can now list, create, and delete project webhooks.

New branches now include the representations from main, preserving diagram layouts and portal views.

Sandbox uploaded images when accessed directly to prevent active content from accessing the application.

Revision counters now display animated placeholders while the History page is loading.

The CSP policy now authorizes the web app manifest served by the application.

CSP nonce initialization now runs before the application bundle, preventing runtime styles from being blocked when Vite splits the frontend into multiple chunks.

The revision list and revision differences on the History page now scroll independently.

The Discussions view keeps its pagination controls visible even when all discussions fit on one page, so you can always change the page size.

A new Profile structure exposes a minimal view of the authenticated user, separately from the administration-oriented Account type.

Authenticated users can now access a profile settings page with an Account tab.

Add a first version of the discussions view to create conversations attached to specific objects

Users can now delete their own account from the profile settings page.

The profile settings Security tab now lets users generate an access token. The generated token is a mock that is not persisted and cannot be used to authenticate. The Security tab is disabled by default and can be enabled by setting the application property ocp.authentication.access-tokens.enabled=true.

Project settings now includes a Skills tab to preview and locally import AI agent skills. Skills are mocked, and imports are not persisted. The tab is disabled by default and can be enabled by setting the application property ocp.ai.skills.enabled=true.

The History page now shows versions and live updates for the selected changeset. Restoring, keeping, and deleting versions apply to that changeset’s history.

The History page header now lets you return to the project editor or browse the history of another changeset.

The History page now displays revisions in a list on the left and the selected revision’s summary on the right. Select a revision to view its name, creation date, authors, and current or saved version status.

In the Notifications page, users can now select notifications to mark them as read or unread.

In the Notifications page, users can now delete selected notifications.

Add ipAddress and authenticationStrategy to the log message context. By using the Spring framework structured logging settings, it was possible to see the username (causedBy) which had caused most of our logging messages for the detection of unauthorized access and system security. It would thus be easy to detect requests performed by accounts using the Username/Password authentication strategy which would bypass a central OIDC based authentication provider.

Revision items now highlight the selected version and display a current version badge, with authors and creation date on a single line.

The History page now lets you filter revisions by name using the Find a revision field. Clear the search to display all revisions again.

Consulting history has its own permission, granted to project readers by default. The History button is displayed only when consultation is allowed. Restoring a version has its own permission, granted to project writers and administrators with the Contributor or Administrator account role by default. The restoration action is displayed only when restoration is allowed.

The selected revision summary now includes a header, a current revision badge, author and date icons, and an indication of whether the revision was saved manually or automatically.

The History page now includes a Compare panel to select an earlier revision from the same changeset alongside the selected revision. The immediately preceding revision is selected by default.

The Compare panel now includes an attribute change preview, grouped by element, with previous and current values and an attribute change count.

The Security tab now has initial GraphQL support for access tokens. The backend returns mock access tokens, and token creation does not persist the generated token.

The People page now lets you search organization members by username, regardless of case. The search applies across all pages of members.

Revision comparisons now display newly created elements with a Created badge and a separate creation count, including root elements and their new children.

Revision comparisons now display deleted elements with a red Removed badge and a separate deletion count, including root elements, their children, and elements in deleted documents.

The Skills tab retrieves all the AI agent skills for the given project. The API currently returns mocked skills, and imports remain local and are not persisted.

For technical details on this Obeo Enterprise for Sirius release, including breaking changes, please refer to changelog.