--- title: Turbine Cloud 26.5.0 Release slug: turbine-release-notes/UmvT-turbine-cloud-2650-release docTags: createdAt: 2026-10-15T14:13:31.337Z --- # Build Faster. Connect Smartly with AI. Scale Further. Turbine **26.5.0** includes new features, enhancements, and bug fixes focused on high-volume automation, a more capable Hero AI Companion, and a smoother builder experience. This release extends Hero AI so Companion can call tools from registered MCP servers, and so external AI clients can call selected Turbine components through a Turbine MCP server. Application Builder now includes Build with Hero AI, so you can add or change fields, layout, and workflow from the same Companion panel. The release also improves scale for large data sets. Performance Applications, Bulk mode for Create Record, Update/Create Record, and Delete Records, and the Big Data native action are supported for the Vulnerability Response Management (VRM) solution. These capabilities are not supported on Turbine On-Prem. Performance Applications support high-volume workloads such as vulnerability management. Create Record, Update/Create Record, and Delete Records can run in bulk. Canvas includes a Big Data native action so playbooks can run PySpark on mapped file attachments. This release also makes it easier to distribute content across multiple tenants. A single content package can be deployed to multiple or all accessible tenants in one operation, eliminating the need to repeat the deployment for each tenant. Search Records, Hero AI, and HTTP actions can retry when a first attempt is empty or hits a transient error. Overall, Turbine **26.5.0** helps teams run larger automations more reliably and connect Hero AI to the tools they already use. ## What's New in This Release? ### External MCP Tools in Hero AI Companion Hero AI now supports the Model Context Protocol (MCP), an open standard for connecting AI to external tools and data sources. Administrators configure and manage those connections in Turbine so Companion can use specialized tools for lookups and follow-up actions instead of switching to another product. This capability is available for Turbine Cloud and On-Prem. You add a remote server under External MCP Servers, enter a name and HTTPS URL, and choose authentication: No Auth, API Key, Bearer Token, or Basic Auth. You can add query parameters or extra headers when the remote server requires them. OAuth is not available in this release. On View Tools, Turbine discovers the advertised tools. Resources and prompts from the remote server are not supported. If discovery fails, you can still save the server and retry later. Discovered tools are not available in Companion until you allow them on Hero AI Companion Configuration (up to 15). Companion users open the allowed list from the wrench in the chat header (Hero AI Context & Tools). If External MCP Servers is missing from the Administrator rail, the Host capability is not enabled for the tenant. ### Turbine MCP Server for External AI Clients You can run Turbine as an MCP server so a non-Swimlane AI application or assistant can call selected tenant components as tools. Administrators create one or more servers at the tenant, choose exactly which components each server publishes, and monitor server status. Component runs that start from an MCP server are labeled in Operational Health. Authentication uses a generated URL and a Turbine personal access token in the Private-Token header. Role-based access control still applies to the published components. You do not type the URL. Turbine generates it and provides a JSON configuration snippet to paste into the client. The copied snippet includes `"type": "http"` so Claude Desktop and Claude CLI accept the configuration. Cursor, ChatGPT, and Gemini CLI use the same snippet. Swimlane is not listed in public MCP connector catalogs. Add the snippet in Cursor under Settings, Tools & MCP, Add Custom MCP, or in a custom Claude MCP file. Replace the placeholder with your personal access token. Do not put the token in the URL. If the client supports only OAuth catalog connectors, it cannot call a Turbine MCP server in this release. Regenerating the URL invalidates any URL you already shared. ### Application Builder: Build with Hero AI Application Builder includes a Hero AI application builder agent so you can change an application that is already open using natural-language prompts. The agent does not create a new application. You can ask Companion to add or update fields, adjust the layout, or set up workflow rules. Select Build with Hero AI to enter Application Building Mode. The Workflow and Application builders stay on the same page, and Preview shows the record form before you save. Preview does not create a record. Hero AI highlights modified fields and presents a change summary so you can review AI-assisted updates before you keep them. Undo and Redo remain available while you edit. This keeps drafting, preview, and review in one workspace instead of moving between a separate chat and Application Builder. ### Performance Applications Performance Applications are built for high-volume workloads such as vulnerability risk management, where records do not need the full Swimlane processing lifecycle (correlation, workflows, notifications, and similar processing). They store and process large data sets with less overhead so ingestion, transformation, and analytics can run at higher throughput. This capability is supported for the Vulnerability Response Management (VRM) solution. It is not supported on Turbine On-Prem. You create a Performance Application by importing a package from the Swimlane Solution Provider or Marketplace. The applications list does not include a create-from-scratch Performance Application action. In Application Builder, a bolt icon and the hover text Optimized for high data volumes identify the application. Built-in fields support search and sorting. You can hide built-in fields you do not need and add custom fields; custom fields do not support search and sorting in the application. **Note:** Performance Applications are behind a feature flag and must be enabled; to enable this feature, contact Swimlane Support. ### Bulk Mode for Record Actions Create Record, Update/Create Record, and Delete Records now support Bulk mode so playbooks can process an array of records instead of looping one record at a time. Automation engineers can pass datasets such as arrays of objects or JSON into the native Create and Update actions, and can delete many records in one step. Use Bulk mode when the target is a Performance Application. This capability is supported for the Vulnerability Response Management (VRM) solution. It is not supported on Turbine On-Prem. On Inputs, turn on Bulk mode, map the Bulk Input Source, select the Performance Application, and map the create or update fields. Required application fields stay required; map each one from the bulk source or a playbook property. Restrictions are not supported in Bulk mode. Configure restrictions on a single-record run, or apply them outside bulk. **Note:** Bulk mode is behind a feature flag and must be enabled; to enable this feature, contact Swimlane Support. ### Big Data Native Action Canvas includes a Big Data native action for high-volume processing that a record-by-record Script or Transform Data step cannot keep up with. The action uses a distributed batch engine so playbooks can filter, normalize, enrich, or deduplicate large inputs in one optimized run instead of iterating row by row. Typical uses include vulnerability risk management and other large-file or large-array workloads. This capability is supported for the Vulnerability Response Management (VRM) solution. It is not supported on Turbine On-Prem. Add **Big Data** from the native actions panel. On **Inputs**, add an **Attachment** property, then map it with **Add Playbook Property** or **Add Expression**. Write a PySpark script on **Script**, then map outputs on **Outputs**. The script environment includes the familiar Script globals plus a Spark session and helpers for CSV and JSON attachments. Use **Big Data** when you need batch compute. Use the Script native action for sandboxed Python on a single action run. **Note:** The Big Data native action is behind a feature flag and must be enabled; to enable this feature, contact Swimlane Support. ### Bulk Content Deployment Across Multiple Tenants Turbine Library now makes it easier to distribute content across multiple tenants. A single content package can be deployed to multiple or all accessible tenants in one operation, eliminating the need to repeat the deployment for each tenant. Users can select the target tenants, monitor deployment progress, and choose to **overwrite or skip** content that is already deployed. Deployment results and failures are available for follow-up, helping simplify content distribution across large multi-tenant environments. ### Retry Mechanism for Search Records, Hero AI, and HTTP Actions Search Records and Hero AI previously ran once. In asynchronous pipelines a Search could run before the record existed and return empty results, and Hero AI could fail on a transient error. Those cases required Sleep steps or extra playbook logic. This release exposes the existing retry framework on Search Records and Hero AI. You configure retry count, interval, and conditions in the action. Search Records retries until a record is found. Hero AI retries until the action succeeds with no error. HTTP already had retry; this release adds a preset default condition so HTTP retry works without extra setup. Retry is not added for Update/Create, Create, or Delete Record in this release. ### Unified Record Activity The Activity feed is now the default record history. It provides a centralized audit trail for record updates from manual edits, playbook actions, widgets or API calls, and background workflows, with each change attributed to its source. Related playbook and workflow activity can group together and show metadata such as playbook name, run ID, and action ID so you can open the execution that produced the change. Field changes include updates that were previously omitted, such as restricted fields. Commit-style summaries and chronological filtering support troubleshooting and enterprise compliance review. ### OpenSSL 4.0 Upgrade OpenSSL in Swimlane Turbine is upgraded to OpenSSL 4.0. This upgrade limits some weak cryptographic functions. It is recommended that you use SHA-256 in your scripts instead of MD5 or SHA-1. ## Addressed Issues The following issues are addressed in this release. ### Canvas - **Advanced Transform Looked Unsaved When You Only Opened It** — Fixed an issue where opening an existing Advanced Transform enabled Apply and Cancel asked you to discard changes even when you did not edit anything. Opening the editor no longer marks the transform as changed. Real edits still keep Apply available. - **Deleting an Orchestration Task Disabled the Playbook** — Fixed an issue where deleting an orchestration task (including leftover duplicate-button cleanup) silently turned the playbook off. Application buttons still looked correct, but the flow did not run until someone enabled the playbook again. Deleting the task no longer changes the enabled state. - **Upsert Did Not Clear a Field When You Sent an Empty Value** — Fixed an issue where Update/Create Record left the existing field value in place when you used Clear. The field was omitted from the update, so the record did not change. Providing an empty value now clears the field. - **Playbook Export Failed When a Transform Used a Wildcard Asset Path** — Fixed an issue where exporting a playbook failed if a Transform Data action used a JSONata wildcard such as `assets.*.Tenant_Details`. The export reported that it could not find an asset named `*`. Those expressions now export successfully. - **Hero AI Stayed Available After It Was Disabled** — Fixed an issue where Hero AI remained visible and usable after it was disabled, including after cache clear and first login, until you refreshed the playbook. Disabled Hero AI no longer appears for those users. - **Delete Connector Playbook Link Opened a Missing Page** — Fixed an issue where the playbook link on the connector delete confirmation opened a missing page. The link now opens the playbook. - **Retry Logic Labels Were Reversed** — Fixed an issue where retry configuration text said when an action would retry in one place and until in another, which did not match how retry works. The labels now describe retry until the condition is met. - **Deleting a List Item in an Asset Shifted Remaining Fields** — Fixed an issue where deleting an item from a list in the JSON builder (including nested lists or objects, and lists that contain password fields) renumbered or shifted the remaining items so saved values no longer matched the UI. Remaining items now keep the correct nested content after delete. - **Condition Builder Dropped the Second Variable After Reopen** — Fixed an issue where a numeric variable-to-variable comparison showed both variables after Apply, then hid the second variable when you reopened the condition and treated it as text. Both variables now stay visible when you reopen the condition. - **Attachment Fields Could Be Added to Conditions** — Fixed an issue where Condition Builder let you pick an attachment field even though attachments are not supported in conditions, which left a broken comparison. Condition Builder now states that attachment fields are not supported. - **Property References Corrupted Text in a String Input** — Fixed an issue where inserting a property reference into a string input scrambled the surrounding text. Property references now insert without changing the rest of the string. - **Transform Data Failed With a Null Object Error** — Fixed an issue where Transform Data failed with Cannot convert undefined or null to object when a JSONata expression used $sift() or referenced a missing property. Valid expressions complete, and invalid paths return a clear transform error. ### Dashboards and Reports - **Dashboard Metrics Changed After Switching Dashboards** — Fixed an issue where metric cards showed the correct values on first open, then showed wrong values after you opened another dashboard and returned. A full-page refresh restored the correct numbers. Switching dashboards no longer keeps the previous dashboard date filter, so unfiltered metrics match a full refresh. - **Dashboard First Load Ignored the Time Filter** — Fixed an issue where the first load of a dashboard showed all records and ignored the saved date and time filter (for example, Today so far). Re-applying the same filter corrected the view. Dashboards now apply the saved filter on first load. - **Scheduled Dashboard Emails Showed Incorrect Data** — Fixed an issue where a scheduled dashboard PDF or email showed the wrong dashboard, omitted filters, or mixed in another schedule when several jobs ran close together. Scheduled dashboard output now matches the intended dashboard and filters. - **Dashboard Preview and Download Ignored Dashboard Filters** — Fixed an issue where Preview, Download, Email, and Schedule used the report filters on the card instead of the dashboard filters you saved. Preview and download now match the dashboard you see, including dashboard-level and date-range filters. - **Dashboard Card Was Empty After Add Chart from a Report** — Fixed an issue where creating a dashboard card with Add Chart during report creation produced an empty card, including when the chart had no measures or dimensions. Those reports now appear as tables, and cards created from Add Chart show data. - **Global Export Omitted Dashboards** — Fixed an issue where Global Export left out dashboards that belonged to a workspace and were visible in the UI. Those dashboards are now included in the export package, and import keeps workspace and dashboard links in sync. - **Notification Usage Graph Showed Zero for Days With No Data** — Fixed an issue where the Notification Admin Panel usage graph treated missing days as 0, so hover could not distinguish a true zero from no data. Days with no data are omitted from the axis. Actual 0 values still display. - **Filtered Report Search Failed With a System Error** — Fixed an issue where some Condition Builder filters on values-list or user fields returned a system error instead of results. Filters such as Status does not equal Resolved, and sorts on Status or Current Owner, now complete. - **Filtered Report Showed Blank Status and Owner Columns** — Fixed an issue where a filtered application report showed empty Status and Current Owner columns even though the records had values. Those columns now show the expected labels and names. ### Records - **CSV and Report Export Wrote Incorrect Time Field Values** — Fixed an issue where a standalone Time field exported as a full timestamp such as 1970-01-01T21:43:00. When you download, schedule, or email a report, Time fields now show only the stored time. - **Record Row Opened an Invalid Page When Display Columns Were Empty** — Fixed an issue where clicking a Records Listing row that had a Tracking ID but no values in the visible columns opened an invalid record page. The row now opens the correct record. - **Required Fields Blocked Save When Workflow Hid or Made Them Optional** — Fixed an issue where the record form allowed save after a workflow hid a required field or made it optional, but the server rejected the save. Save validation now follows the same workflow rules as the form. - **Selected Radio Button Looked Cleared but Kept Its Value** — Fixed an issue where clicking an already selected radio button cleared the selection in the UI while the stored value stayed set. Save stayed unavailable, and dependent workflow still treated the old value as selected. Clicking the selected option now leaves it selected until you choose a different option. - **Saving a Record Reference Failed With an Error** — Fixed an issue where adding or saving a record reference failed with an error and the record did not update. Saving a reference now completes and keeps the linked record. - **History Comments Were Cut Off** — Fixed an issue where comment text was truncated in the History field. The full comment is now visible. ### Classic Playbooks - **Classic Playbook Publish Stopped on a Blank Step** — Fixed an issue where Next after Content Information opened a blank review step if you continued before the playbook finished validating. Next now stays unavailable until the check finishes, then opens the review step so you can publish.