Release Notes

This page lists third-party component updates and configuration changes introduced in each CodeMie release. Releases are grouped by month, newest first. Click a release to expand its details. Releases older than two months are collapsed under Older Releases.

Badges show what each release requires from administrators:

Hotfixes — Hotfix releases were published on top of this version
Breaking — Configuration changes that break existing setups if not applied
Config changes — Configuration updates to review before upgrading
Component updates — Third-party components were updated and upgrading them is recommended as part of this release

Upgrade regularly

We highly recommend keeping CodeMie up to date. Regular upgrades deliver the latest security fixes and keep each upgrade small, with fewer configuration changes to review at once.

Review every release between your current and target version that has a Breaking, Config changes, or Component updates badge. Releases marked No admin action required can be skipped.

Use the verified LiteLLM version

While we recommend keeping CodeMie up to date, keep LiteLLM at the version that has been tested and verified with your CodeMie release. The currently tested and verified LiteLLM version is 1.99.4.

Do not upgrade LiteLLM beyond this version until it has been verified with CodeMie. Newer LiteLLM releases are not validated against CodeMie and may be incompatible with it or introduce unexpected bugs that affect platform stability.

November 2026

CodeMie 2.67.0Nov 12, 2026Config changesComponent updates

Release Date: November 12, 2026 · GitHub Tag ↗

Third-Party Component Updates

oauth2-proxy 7.15.6

Updated from 7.15.3 (Helm chart 10.7.4, previously 10.6.1). The update addresses multiple security vulnerabilities, including two critical authentication bypass advisories. For details, see the release notes for 7.15.4 ↗, 7.15.5 ↗, and 7.15.6 ↗.

Configuration Changes

No breaking configuration changes were introduced in this release.

AI Katas

AI Katas are no longer enabled by default — the UI hides the Katas navigation, pages, floating kata window, and kata leaderboard metrics unless the features:katas component is enabled. If users work with AI Katas, administrators must enable the feature explicitly by adding the following component to the customer feature configuration. See Customer Feature Configuration for details.
```
components:
  - id: "features:katas"
    settings:
      enabled: true
      name: "AI Katas"
      description: "Show AI Katas navigation, pages, floating kata window and kata metrics in the leaderboard"
```
AI Katas are unavailable after the upgrade unless enabled
Deployments that relied on the previous default lose access to AI Katas after upgrading to this release. Add the component above before upgrading to keep the feature available.

oauth2-proxy Behavior Changes

The oauth2-proxy security fixes tighten request handling. The default CodeMie configuration is not affected. Administrators who customized oauth2-proxy should review the oauth2-proxy changelog ↗ for the 7.15.4, 7.15.5, and 7.15.6 releases.

CodeMie 2.66.0Nov 10, 2026Config changes1 hotfix

Release Date: November 10, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

PostgreSQL Database Names

LiteLLM and Langfuse default database names changed — the Helm defaults changed from postgres_litellm to litellm and from postgres_langfuse to langfuse, matching the databases Terraform creates for dedicated instances (TF_VAR_litellm_db_config, TF_VAR_langfuse_db_config).

Shared database upgrades
If LiteLLM or Langfuse already runs on the shared CodeMie PostgreSQL instance under the old name, set db.database (LiteLLM) and langfuse.postgresql.database (Langfuse) to the old name in your values files. Otherwise the services connect to a new, empty database.

Hotfixes

2.66.1 · GitHub Tag ↗ – November 10, 2026

CodeMie 2.65.0Nov 6, 2026BreakingConfig changes3 hotfixesComponent updates

Release Date: November 6, 2026 · GitHub Tag ↗

Third-Party Component Updates

NATS 2.15.2

NATS upgraded from 2.11.0

Configuration Changes

LiteLLM Spend Ledger

[BREAKING] LiteLLM spend collector and related variables removed — spend, budget, limit, and analytics figures are now served from a single spend ledger (litellm_spend_logs) that is filled by the spend uploader. The following variables are no longer read and must be removed from extraEnv if present.

Removed variable	Replaced by
`LITELLM_SPEND_COLLECTOR_ENABLED`, `LITELLM_SPEND_COLLECTOR_SCHEDULE`	`LITELLM_SPEND_UPLOADER_ENABLED`, `LITELLM_SPEND_UPLOADER_SCHEDULE` (see the next item)
`LITELLM_BUDGET_RESET_TRACKER_ENABLED`, `LITELLM_BUDGET_RESET_TRACKER_SCHEDULE`, `LITELLM_BUDGET_RESET_WINDOW_MINUTES`	No replacement; budget periods are calculated from the ledger. Daily reset reconciliation remains available via `LITELLM_BUDGET_RESET_RECONCILIATION_*`
`BUDGET_USAGE_STALENESS_THRESHOLD_MS`, `BUDGET_MEMBER_SPEND_STALENESS_THRESHOLD_MS`	No replacement; figures are calculated from the ledger on read
`CLI_METRICS_CUTOFF_DATE`	No replacement

Spend figures depend on the spend uploader

Deployments that relied on the spend collector must enable the spend uploader, otherwise spend and budget consumption figures are missing or incomplete.

Enable the spend uploader and activate the ledger — required for deployments that route requests through LiteLLM.
1. Set LITELLM_SPEND_UPLOADER_ENABLED: "true" and configure the LiteLLM database connection (LITELLM_SPEND_UPLOADER_LITELLM_DB_URL, or LITELLM_SPEND_UPLOADER_LITELLM_DB_HOST and LITELLM_SPEND_UPLOADER_LITELLM_DB_USER with the related variables).
2. Wait for the first run to finish loading the historical spend logs.
3. Set SPEND_LEDGER_COVERAGE_FLOOR to the timestamp of the earliest request in the completed load and restart the API pods.
The LiteLLM database connection supports IAM token authentication: with PG_IAM_AUTH_PROVIDER set, leave the password empty (or omit it from the URL) and a short-lived token is used.

API validates the LiteLLM database connection at startup
When LITELLM_SPEND_UPLOADER_ENABLED is true and the LiteLLM database is configured, the API connects to the LiteLLM database at startup and does not start if the credentials are rejected or the database is unreachable. Verify the connection settings before upgrading.

See Project Budget Management for details.
New optional variables — SPEND_LEDGER_* settings for coverage, projection, and read isolation, and EVENT_LOOP_LAG_* settings for event loop monitoring. All have defaults. See API Configuration.

Model Retirements

The following models are retired on November 19, 2026 according to the Azure OpenAI model retirement schedule ↗ and the Gemini 3.6 Flash model page ↗. After this date, requests to these models fail. Their configuration examples have been removed from LiteLLM Model Configuration.

Retired model	Provider	Retirement date	Recommended replacement
`o1`	Azure OpenAI	Nov 19, 2026	`gpt-5.6-sol`
`o3-2025-04-16`	Azure OpenAI	Nov 19, 2026	`gpt-5.6-sol`
`o3-mini`	Azure OpenAI	Nov 19, 2026	`gpt-5.6-terra`
`o4-mini-2025-04-16`	Azure OpenAI	Nov 19, 2026	`gpt-5.6-terra`
`gemini-3.6-flash`	Vertex AI	Nov 19, 2026	`gemini-3.8-flash`

Update model references before November 19, 2026

Remove the retired models from your LiteLLM configuration and replace them with the recommended models. Also update any assistants, workflows, and premium model lists that still reference them.

NATS Configuration

[BREAKING] NATS configuration values moved to nats root section - NATS is now dependency of codemie-nats helm chart.

Hotfixes

2.65.1 · GitHub Tag ↗ – November 6, 2026
2.65.2 · GitHub Tag ↗ – November 6, 2026
2.65.3 · GitHub Tag ↗ – November 6, 2026

CodeMie 2.64.0Nov 3, 2026No admin action required

Release Date: November 3, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

October 2026

CodeMie 2.63.0Oct 30, 2026Component updates

Release Date: October 30, 2026 · GitHub Tag ↗

Third-Party Component Updates

LiteLLM 1.99.4

Updated from 1.99.2. For details, see the LiteLLM 1.99.4 Release Notes ↗.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.62.0Oct 26, 2026Config changes

Release Date: October 26, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

CodeMie Keycloak Theme

Updated from 2.50.0 to 2.62.0. This update upgrades the base build container image to Node.js 24 (dhi.io/node:24-alpine3.23-dev).

CodeMie 2.61.0Oct 22, 2026Config changes

Release Date: October 22, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

LiteLLM graceful drain

LiteLLM pods now drain in-flight requests through the /health/drain endpoint before they stop. This was added so that rollouts and scale-down no longer drop requests that are still being served. The drain call is authorized with a token stored in the new litellm-drain-token secret. The general_settings.enable_drain_endpoint: true setting and the preStop hook are already included in the updated litellm/config/litellm-<cloud>-config.yaml and litellm/values-<cloud>.yaml files.

Actions required

Only if LiteLLM Proxy is deployed:
- Automated deployment: no action required, helm-charts.sh creates the litellm-drain-token secret.
- Manual deployment: create the secret before upgrading, see Manual Deployment.
- Custom LiteLLM values.yaml or config files: copy the extraEnvVars, lifecycle.preStop and enable_drain_endpoint settings from the updated files.

CodeMie 2.60.0Oct 19, 2026Component updates

Release Date: October 19, 2026 · GitHub Tag ↗

Third-Party Component Updates

Keycloak Operator 1.35.0

Existing deployments need CRDs update.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.59.0Oct 16, 2026No admin action required

Release Date: October 16, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.58.0Oct 12, 2026Config changes

Release Date: October 12, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

Code Executor

These applicable only if the Code Executor tool is enabled:

The meaning of CODE_EXECUTOR_SECURITY_THRESHOLD values is corrected. Previously the values were inverted: LOW enforced the strictest policy and HIGH the most permissive. They now match the parameter name: LOW is permissive and HIGH is the most restrictive. The default value changed from LOW to HIGH, which enforces the same policy the old default did.
CodeExecutor Docker image name has changed from codemie-python to codemie-code-executor. codemie-python image is available but no longer supported in favor to codemie-code-executor image.

Actions required

Only if CODE_EXECUTOR_SECURITY_THRESHOLD is set explicitly:
- Previously set to LOW: change it to HIGH to keep the same enforcement level.
- Previously set to HIGH: change it to LOW to keep the same enforcement level.
- Not set, or the Code Executor tool is disabled: no action required.
Only if CODE_EXECUTOR_DOCKER_IMAGE is set explicitly:
- Update docker image name from codemie-python to codemie-code-executor. Ensure image tag is set to 2.58.0 or newer.
- Not set, or the Code Executor tool is disabled: no action required.

CodeMie 2.57.0Oct 9, 2026Component updatesConfig changes2 hotfixes

Upgrade not recommended

Versions 2.57.0 and 2.57.1 contain known issues and are not recommended for upgrade. Environments already running either version should move to the latest hotfix release, 2.57.2.

Release Date: October 9, 2026 · GitHub Tag ↗

Third-Party Component Updates

CodeMie Code CLI 0.15.8

The recommended CLI version is updated to v0.15.8.

Configuration Changes

Minimum CodeMie Code CLI version: the backend environment variable CODEMIE_MIN_CLI_VERSION enforces a minimum CLI version of 0.15.6. Upgrading to 0.15.8 is recommended.

Hotfixes

2.57.1 · GitHub Tag ↗ – October 9, 2026
2.57.2 · GitHub Tag ↗ – October 9, 2026

CodeMie 2.56.0Oct 5, 2026Config changes

Release Date: October 5, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

LiteLLM Bedrock route for Claude Haiku 4.5: updated litellm_params.model from bedrock/converse/<model_id> to bedrock/<model_id>. When LiteLLM WebSearch interception is configured, searches on Haiku 4.5 executed successfully under both routes, but the Converse adapter did not return the native Anthropic search metadata blocks expected by Claude Code (codemie-code), displaying WebSearch 0. Switching to native bedrock/ delivers the proper server_tool_use and web_search_tool_result structures, so search events are accurately reflected. CodeMie UI and workflows remain unaffected.

note
LiteLLM WebSearch interception is an optional proxy feature that requires separate setup.

See LiteLLM Model Configuration for details.

CodeMie 2.55.0Oct 1, 2026Config changes

Release Date: October 1, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

Code Executor — changes in codemie-api — only applies if Code Executor tool is enabled:
- CODE_EXECUTOR_SANDBOX_MODE env var now defaults to sandbox-jobs — sandbox-shared will be removed in next releases.
- CODE_EXECUTOR_NAMESPACE env var default value changed to codemie-code-executor (previously codemie-runtime).
warning
If you already use the Code Executor with a custom namespace, keep CODE_EXECUTOR_NAMESPACE and features.tools.code_executor.namespace.name set to that namespace and ensure RBAC stays enabled in codemie-api helm chart — otherwise the executor now defaults to the codemie-code-executor namespace.
The old rbac.namespace key is removed; migrate to namespace.name:
features: tools: code_executor: namespace: name: "<namespace>"
See Code Executor Configuration for details.

Older Releases

Releases from previous months, grouped by year and month. Expand a month to see its releases.

2026

September9 releases

CodeMie 2.54.0Sep 29, 2026Component updates

Release Date: September 29, 2026 · GitHub Tag ↗

Third-Party Component Updates

LiteLLM 1.99.2

Updated from 1.96.2 (Helm chart 1.96.2 to 1.99.0). For details, see the LiteLLM 1.99.2 Release Notes ↗.

Container-only release

LiteLLM 1.99.2 is a container-only release and is not published to PyPI.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.53.0Sep 24, 20261 hotfix

Release Date: September 24, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

Hotfixes

2.53.1 · GitHub Tag ↗ – September 25, 2026

CodeMie 2.52.0Sep 21, 2026No admin action required

Release Date: September 21, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.51.0Sep 17, 20261 hotfix

Release Date: September 17, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

Hotfixes

2.51.1 · GitHub Tag ↗ – September 18, 2026

CodeMie 2.50.0Sep 14, 2026Component updatesConfig changes

Release Date: September 14, 2026 · GitHub Tag ↗

Third-Party Component Updates

LiteLLM 1.96.2

Updated from 1.93.0. For details, see the LiteLLM 1.96.2 Release Notes ↗.

Configuration Changes

CodeMie Keycloak Theme

Updated from 2.15.2 to 2.50.0. This update addresses security vulnerabilities in the base Alpine Linux image.

CodeMie 2.49.0Sep 10, 2026No admin action required

Release Date: September 10, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.48.0Sep 8, 2026No admin action required

Release Date: September 8, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.47.0Sep 7, 2026No admin action required

Release Date: September 7, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.46.0Sep 1, 2026No admin action required

Release Date: September 1, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

August4 releases

CodeMie 2.45.0Aug 28, 2026Component updates1 hotfix

Release Date: August 28, 2026 · GitHub Tag ↗

Third-Party Component Updates

Langfuse 3.224.1

Updated from 3.129.0. For details, see the Langfuse 3.224.1 Release Notes ↗.

Configuration Changes

No breaking configuration changes were introduced in this release.

Hotfixes

2.45.1 · GitHub Tag ↗ – August 28, 2026

CodeMie 2.44.0Aug 20, 2026Config changes1 hotfix

Release Date: August 20, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

AWS Terraform changes
- S3 user data bucket encryption switched to SSE-KMS — the user data S3 bucket is now encrypted with a dedicated customer-managed KMS key instead of SSE-S3 (AES256). This change only applies to objects uploaded after the update; existing objects keep their current encryption and remain fully readable. To re-encrypt existing files with the new key:
  1. Run:
    aws s3 cp s3://<AWS_S3_BUCKET_NAME>/ s3://<AWS_S3_BUCKET_NAME>/ --recursive
- Terraform state bucket encryption switched to SSE-KMS, restricted to the deployer role. aws-terraform.sh migrates existing deployments automatically; for manual deployments, see updated backend init commands.
- RDS PostgreSQL now uses IAM database authentication — codemie-api on AWS connects to the RDS PostgreSQL instance using short-lived IAM authentication tokens instead of a static password. Existing deployments must be migrated — see Upgrading an Existing Deployment to IAM Authentication.

Hotfixes

2.44.1 · GitHub Tag ↗ – August 20, 2026

CodeMie 2.43.0Aug 12, 2026Component updates

Release Date: August 12, 2026 · GitHub Tag ↗

Third-Party Component Updates

LiteLLM 1.93.0

Updated from 1.83.7. For details, see the LiteLLM 1.93.0 Release Notes ↗.

oauth2-proxy 7.15.3

Updated from 7.15.1. For details, see the oauth2-proxy 7.15.3 Release Notes ↗.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.42.0Aug 4, 2026Config changes

Release Date: August 4, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

Container image registry path updated in codemie-helm-charts values files — the default container image repository has changed from prod to codemie-clients-releases in the Helm chart values.

Affected charts: codemie, codemie-ui, codemie-nats-auth-callout, codemie-mcp-connect-service, mermaid-server.

warning
All existing releases are available in both repositories, and future releases will continue to be published to both. Therefore, no immediate action is required. However, we recommend updating any custom values.yaml overrides that reference prod to use codemie-clients-releases instead.

July5 releases

CodeMie 2.41.0Jul 27, 2026BreakingConfig changes

Release Date: July 27, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

[BREAKING] Frontend environment variables removed from codemie-ui — the following variables have been removed from the codemie-ui Helm chart and runtime config and replaced by backend-side mechanisms.

Removed variable	Default	Replaced by
`viteEnableBudgetManagement`	`false`	`features:budgetManagement` in `customer-config.yaml`
`VITE_SHOW_ALL_PROJECTS`	`false`	`features:showAllProjects` in `customer-config.yaml`
`viteEnableUserManagement`	`false`	Computed from `ENABLE_USER_MANAGEMENT` backend env var
`VITE_IS_ENTERPRISE_EDITION`	`false`	Computed from enterprise package auto-detection
`viteIdpProvider`	—	Computed from `IDP_PROVIDER` backend env var
`viteMcpAuthOrigin`	—	Computed from `CALLBACK_API_BASE_URL` backend env var
`viteBannerMessage`	—	`bannerMessage` entry in `customer-config.yaml`

See Customer Feature Configuration for full deployment instructions.

New YAML-configurable entries added to customer-config.yaml:

New entry	Description
`mcpAuthTimeoutSeconds`	MCP authentication timeout in seconds (default: `60`)
`bannerMessage`	Text content of the banner message (default: disabled)
`bannerLinkLabel`	Label for the banner link (default: disabled)
`bannerLinkRoute`	Route/URL for the banner link (default: disabled)

See Customer Feature Configuration for configuration details.

CodeMie 2.40.0Jul 20, 2026No admin action required

Release Date: July 20, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.39.0Jul 14, 20261 hotfix

Release Date: July 14, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

Hotfixes

2.39.1 · GitHub Tag ↗ – July 2, 2026

CodeMie 2.38.0Jul 9, 2026Config changes

Release Date: July 9, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

Google OAuth credentials required for Google Docs datasources — Google Docs indexing now authenticates via per-user Google OAuth instead of a shared service account. Three new environment variables must be set before Google Docs datasources can be created:

Variable	Description
`GOOGLE_OAUTH_CLIENT_ID`	OAuth 2.0 Client ID from Google Cloud Console
`GOOGLE_OAUTH_CLIENT_SECRET`	OAuth 2.0 Client Secret from Google Cloud Console
`CALLBACK_API_BASE_URL`	Public HTTPS hostname of your deployment (defaults to `http://host.docker.internal:8080` — must be overridden in all non-local deployments)

See Google OAuth in the API Configuration guide for the full Google Cloud Console setup steps. See also Add and Index Google Data Source for datasource setup instructions.

Action required

Existing Google Docs datasources that relied on the service account sharing approach will need to be updated.

Code Executor is disabled by default — set CODE_EXECUTOR_ENABLED=true to opt in; while disabled, the tool is neither listed in the tools catalog nor executed.
AUTHORIZED_APPS_ALLOWED_KEY_DOMAINS required for Authorized Applications — set it to the list of domains allowed to host public_key_url keys before relying on your Authorized Applications configuration. Requests referencing a public_key_url on a domain not in the allowlist are rejected.

Other Improvements

This release also delivers a set of security and hardening improvements across the CodeMie platform.

Removed the local mode of Code Executor; the sandboxed Code Executor tool is now disabled by default and must be explicitly enabled via CODE_EXECUTOR_ENABLED.
Hardened Authorized Applications by validating public_key_url domains against an explicit allowlist (AUTHORIZED_APPS_ALLOWED_KEY_DOMAINS).

CodeMie 2.37.0Jul 2, 20261 hotfix

Release Date: July 2, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

Other Improvements

This release also delivers a set of security and hardening improvements across the CodeMie platform, its infrastructure, and supporting services.

Code Execution & Tooling Security

Deprecated the legacy Python tool in favor of the sandboxed CodeExecutor tool.
Hardened the Code Executor by closing security-policy and threshold bypass paths and strengthening execution isolation.
Reduced arbitrary code-execution risk in MCP server configuration and added corresponding security validation.
Mitigated remote code-execution risks in workspace script execution and MCP tools.
Hardened the internal MCP-Connect service bridge.

Authentication, Authorization & Access Control

Revised legacy header-based authentication logic and removed an redundant authentication header.
Reviewed AWS IAM trust policies for service accounts and hardened cloud IAM configurations, including role-chaining and access-scope reductions.

Platform & Dependency Maintenance

Upgraded multiple platform components and dependencies (logging, search, networking, storage drivers, and security sensors) to address known CVEs, including a kernel-level fix.
Reviewed and reduced exposure of internal code-execution endpoints.

AWS Infrastructure

Reviewed and tightened cluster API access, IMDS access, and authentication tokens.
Improved project configuration security, enabled default fault-tolerance and monitoring for the managed database, and enabled versioning for user-data storage.
Disabled EKS Auto Mode IAM policy for cluster role.
Revised IAM policies permissions and improved observability and encryption for the EKS cluster.
Enabled reuse of an existing VPC / subnets and enabled enforcement of network policies for the VPC CNI.
Removed EKS SSH key pair creation and usage.

Hotfixes

2.37.1 · GitHub Tag ↗ – July 2, 2026

June6 releases

CodeMie 2.36.0Jun 26, 2026Config changes1 hotfix

Release Date: June 26, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

AWS Terraform changes
- IMDS hop limit reduced to 1 — prevents containers from accessing the instance metadata service.
- S3 user data bucket versioning enabled — the user data S3 bucket now has versioning enabled, protecting against accidental deletion and overwrites. Noncurrent object versions are automatically expired after 365 days.
- AmazonBedrockFullAccess replaced with a custom IAM policy — the broad AWS-managed policy is replaced with a least-privilege custom policy scoped to Anthropic, Amazon Titan, Qwen, and Moonshot AI models, including cross-region inference profiles for all supported prefixes (us, eu, ap, global, jp, au).

Hotfixes

2.36.1 · GitHub Tag ↗ – June 29, 2026

CodeMie 2.35.0Jun 22, 2026Config changes

Release Date: June 22, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

security.processAuthSecret removed from AI/Run CodeMie Backend Helm chart — the static shared-secret approach for inter-process authentication (INTERNAL_BIND_KEY) has been replaced with per-request HMAC signing. The key is now generated in-memory at pod startup and no Kubernetes Secret is needed.
Configuration housekeeping
If the AI/Run CodeMie Backend Helm chart values still contain security.processAuthSecret, it can be safely removed:
# Remove the following block from your custom Helm values: security: processAuthSecret: create: false name: "internal-bind-key" field: "bind-key"
If you created a Kubernetes Secret for INTERNAL_BIND_KEY manually (e.g. for ArgoRollout deployments), it can also be safely deleted.
MCP Connect Service isolated to a dedicated Kubernetes namespace — codemie-mcp-connect-service is now deployed in its own codemie-mcp-connect-service namespace with Pod Security Admission (restricted) enforced. This improves workload isolation and aligns with security best practices.

Script deployments
The provided deployment script handles namespace creation, Pod Security Admission labeling, and service deployment automatically. No manual action is required.
Manual migration (without deployment script)
To apply the same isolation manually:
1. Create the namespace and apply Pod Security Admission labels:
  kubectl create namespace codemie-mcp-connect-service kubectl label namespace codemie-mcp-connect-service \ pod-security.kubernetes.io/enforce=restricted \ pod-security.kubernetes.io/enforce-version=latest \ --overwrite
2. Redeploy the Helm chart into the new namespace and update MCP_CONNECT_URL in the AI/Run CodeMie Backend Helm values:
  - name: MCP_CONNECT_URL value: "http://codemie-mcp-connect-service-{MCP_CONNECT_BUCKET}.codemie-mcp-connect-service-headless.codemie-mcp-connect-service:3000"
3. Delete the old deployment from the codemie namespace.
Network isolation hardening
Applying Kubernetes NetworkPolicy to the codemie-mcp-connect-service namespace is recommended to enforce least-privilege traffic controls. See Network Policies for MCP Connect Service for cloud-specific configurations and helper scripts.
AWS Terraform changes
- KMS hardening — replaced the account-root kms:* wildcard with least-privilege policies. Key administrators now have management permissions only, and the IRSA role has cryptographic operations only. The KMS IAM policy scope is narrowed to the specific key. Review KMS-dependent workloads for access regressions after upgrading.
- Multi-AZ enabled by default for all RDS instances — all RDS instances (main CodeMie, Keycloak, LiteLLM, Langfuse) now run with a standby replica in a secondary Availability Zone, providing automatic failover in case of an AZ outage. The change is applied during the next scheduled RDS maintenance window.
- Network Policy enforcement enabled for the AWS VPC CNI addon.

CodeMie 2.34.0Jun 15, 2026Config changes

Release Date: June 15, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

External Secrets Operator IRSA provisioning removed from AWS Terraform code.
SSH key pair module and its usage in the EKS cluster configuration removed from AWS Terraform code.
Fluent-bit version upgrade from 4.2.3.1 to 5.0.7.
Spot node group (worker_group_spot) removed from AWS EKS Terraform configuration — the Auto Scaling Group was permanently scaled to zero. Associated IAM role, instance profile, and launch template are destroyed on the next terraform apply.

CodeMie 2.33.0Jun 9, 2026No admin action required

Release Date: June 9, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.32.0Jun 4, 2026Config changes

Release Date: June 4, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

AWS EKS authentication via ConfigMap no longer supported and removed from terraform scripts.
Added optional provisioning AWS Valkey (Redis Cache).

Redis usage
Redis instance is required to enable functionality such as WebHook rate limiter.

CodeMie 2.31.0Jun 1, 2026No admin action required

Release Date: June 1, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

May6 releases

CodeMie 2.30.0May 27, 2026Config changesComponent updates1 hotfix

Release Date: May 27, 2026 · GitHub Tag ↗

Third-Party Component Updates

Keycloak Operator 1.34.0

keycloak-operator has been updated from 1.32.0 to 1.34.0 (Helm chart 1.32.0 to 1.34.0). For details, see the keycloak-operator 1.34.0 Release Notes ↗.

Starting from v1.33.0, keycloak-operator no longer auto-appends the /auth context path. If your Keycloak is deployed with a context path (e.g. /auth), include it explicitly in keycloak.url in your oauth2-proxy Helm chart values (e.g. http://keycloakx-http/auth). If Keycloak runs without a context path, leave the URL as-is.

Configuration Changes

opsPool removed from AI/Run CodeMie Backend Helm chart - this workload was deprecated and is no longer supported. Remove all opsPool.* fields from the custom Helm values before upgrading.

Configuration housekeeping
If the AI/Run CodeMie Backend Helm chart values still contain opsPool, it can be safely removed.

Hotfixes

2.30.1 · GitHub Tag ↗ – May 29, 2026

CodeMie 2.29.0May 22, 2026BreakingConfig changes1 hotfix

Release Date: May 22, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

[BREAKING] Ingress annotations removed from upstream Helm charts

Breaking Change
These annotations are no longer shipped as defaults in the Helm charts but are still required for oauth2-proxy authentication to work. Add them to the custom Helm values before upgrading to preserve this behavior.

The following oauth2-proxy ingress annotations announced for removal in 2.28.0 have been removed from the default values of the AI/Run CodeMie Backend and AI/Run CodeMie UI Helm charts:
```
nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-Access-Token,Authorization
nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.oauth2-proxy.svc.cluster.local:80/oauth2/auth
```

Hotfixes

2.29.1 · GitHub Tag ↗ – May 25, 2026

CodeMie 2.28.0May 21, 2026Config changes1 hotfix

Release Date: May 21, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

viteEnableAnalytics removed from AI/Run CodeMie UI Helm chart — this value and the corresponding VITE_ENABLE_ANALYTICS environment variable were deprecated and are no longer supported.

Configuration housekeeping
If the AI/Run CodeMie UI Helm chart values still contain viteEnableAnalytics, it can be safely removed.
Infrastructure logs index renamed — the default value of ELASTIC_LOGS_INDEX changed from codemie_infra_logs* to logs-codemie-infra*. If this value is set explicitly in the deployment, update it accordingly. See Logs Retention for cleanup and retention configuration.
Upcoming change: ingress annotations — the following oauth2-proxy ingress annotations will be removed from the AI/Run CodeMie Backend and AI/Run CodeMie UI Helm charts in a future release:
Removed from default Helm chart values in 2.29.0
These annotations are no longer shipped as defaults in the Helm charts but are still required for oauth2-proxy authentication to work. Add them to the custom Helm values before upgrading to preserve this behavior.
nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-Access-Token,Authorization nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.oauth2-proxy.svc.cluster.local:80/oauth2/auth

Hotfixes

2.28.1 · GitHub Tag ↗ – May 21, 2026

CodeMie 2.27.0May 18, 2026Config changes

Release Date: May 18, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

USE_POSTGRES removed from AI/Run CodeMie Backend Helm Chart — this variable was deprecated and is no longer supported.

Configuration housekeeping
If the AI/Run CodeMie Backend Helm Chart values still contain USE_POSTGRES, it can be safely removed.
Post-migration cleanup — if the Platform-Managed Mode migration has been completed but the one-time migration variables have not yet been removed, this is a good time to clean them up.
Post-migration housekeeping
After a successful migration, the following variables are no longer needed and should be removed from extraEnv:
- KEYCLOAK_MIGRATION_ENABLED
- KEYCLOAK_ADMIN_URL
- KEYCLOAK_ADMIN_REALM
- KEYCLOAK_ADMIN_CLIENT_ID
- KEYCLOAK_ADMIN_CLIENT_SECRET
See Disable migration after the first run for the full cleanup steps.
LITELLM_PREMIUM_MODELS_ALIASES format changed to JSON array — if this variable is in use, update its value from a comma-separated string to a JSON array.
Format change required
The previous comma-separated format is no longer supported. Update extraEnv before upgrading:
# Before - name: LITELLM_PREMIUM_MODELS_ALIASES value: "opus,o1" # After - name: LITELLM_PREMIUM_MODELS_ALIASES value: '["opus", "o1"]'
LITELLM_PREMIUM_MODELS_BUDGET_NAME removed — this variable was deprecated and is no longer supported. Remove it from extraEnv if still present.

Configuration housekeeping
The budget name is now derived automatically from the budget_category: premium_models entry in budgets-config.yaml. No replacement variable is needed.

CodeMie 2.26.0May 12, 2026Config changes1 hotfix

Release Date: May 12, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

Update LiteLLM budget env vars — remove LITELLM_SPEND_COLLECTOR_SCHEDULE and set LLM_PROXY_BUDGET_BACKFILL_ENABLED: "true". See Budget Configuration.
One-time reconciliation via LLM_PROXY_BUDGET_RECONCILIATION_ENABLED

One-time operation
Enable only on a single API replica, wait for reconciliation to complete (check pod logs), then disable and scale replicas back.

Steps:
1. Scale API to 1 replica.
2. Set LLM_PROXY_BUDGET_RECONCILIATION_ENABLED: "true".
3. Wait for reconciliation log confirmation.
4. Remove or set the variable to "false".
5. Scale API replicas back to the desired count.

Hotfixes

2.26.1 · GitHub Tag ↗ – May 13, 2026

CodeMie 2.25.0May 8, 2026No admin action required

Release Date: May 8, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

Known Issues

Skip to 2.26.0 if using LiteLLM integration

If your deployment has the LiteLLM proxy integration enabled, it is strongly recommended to skip this version and upgrade directly to CodeMie 2.26.0.

Version 2.25.0 contains a known issue that causes instability in environments with LiteLLM configured. Upgrading to 2.26.0 resolves this issue.

April5 releases

CodeMie 2.24.0Apr 23, 2026BreakingConfig changesComponent updates1 hotfix

Release Date: April 23, 2026 · GitHub Tag ↗

Third-Party Component Updates

LiteLLM 1.83.7 (CodeMie 2.24.1)

Updated from 1.81.0. For details, see the LiteLLM 1.83.7 Release Notes ↗.

Configuration Changes

[BREAKING] Fluent Bit: Remove span_id and trace_id from Metrics Logs

Breaking Change
Without this configuration update, no metrics will be written to the codemie_metrics_logs Elasticsearch index. Apply this change before or during the upgrade to CodeMie 2.24.0.

A new [FILTER] block must be added to fluent-bit/values.yaml to strip span_id and trace_id fields from CodeMie metrics logs before they are forwarded to Elasticsearch.

Why: Starting with CodeMie 2.24.0, the backend includes span_id and trace_id fields in its log output. These fields are not accepted by the codemie_metrics_logs Elasticsearch index, causing all metrics ingestion to fail.

Required change in fluent-bit/values.yaml:
```
[FILTER]
    Name         record_modifier
    Match        kube.codemie-metrics.*
    Remove_key   span_id
    Remove_key   trace_id
```
This filter is included in the updated codemie-helm-charts. No manual action is required if you are upgrading using the provided Helm charts.
Keycloak Login Theme

The CodeMie login theme (codemie) is now automatically applied to the codemie-prod realm via the oauth2-proxy Helm chart.

Upgrade instructions: Keycloak Theme Setup
New Environment Variable: INTERNAL_BIND_KEY

A new INTERNAL_BIND_KEY environment variable has been introduced. It is a shared secret for inter-process communication. Without it, webhook trigger may fail when running multiple workers (WORKERS > 1) or multiple pod replicas.

If upgrading using Helm charts:

The updated Helm chart automatically creates a Kubernetes Secret with a random value for INTERNAL_BIND_KEY. No manual action is required for standard deployments.

ArgoRollout deployments
Automatic secret generation is skipped when argoRollout is enabled. Create the Kubernetes Secret manually and reference it via security.processAuthSecret.name and security.processAuthSecret.field.

If deploying without Helm charts:

Set INTERNAL_BIND_KEY to the same strong random value across all workers and pods. Generate with: openssl rand -hex 32. Store in a secrets manager or Kubernetes Secret.

See API Configuration for full details.

Hotfixes

2.24.1 – April 29, 2026

Updated LiteLLM to 1.83.7. For details, see the LiteLLM 1.83.7 Release Notes ↗.

CodeMie 2.23.0Apr 15, 2026Config changes4 hotfixes

Release Date: April 15, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

Budget Enforcement Environment Variables

Three new environment variables have been introduced to control LLM budget enforcement. All default to false (disabled):

Variable	Default	Description
`LLM_PROXY_BUDGET_CHECK_ENABLED`	`false`	Enables budget limit checking for LLM proxy requests
`LLM_PROXY_BUDGET_SYNC_ENABLED`	`false`	Syncs predefined budgets from `budgets-config.yaml` into the database on startup
`LLM_PROXY_BUDGET_BACKFILL_ENABLED`	`false`	Backfills user budget assignments from LiteLLM on startup for existing users

See Budget Configuration and API Configuration for details.

Deprecated Budget Environment Variables

The following environment variables are deprecated and will be removed in a future release. Replace them with the corresponding budgets-config.yaml fields:

Deprecated Variable	Type	Default	Replacement in `budgets-config.yaml`
`DEFAULT_SOFT_BUDGET_LIMIT`	float	`200`	`soft_budget`
`DEFAULT_HARD_BUDGET_LIMIT`	float	`500`	`max_budget`
`DEFAULT_BUDGET_DURATION`	string	`"30d"`	`budget_duration`
`DEFAULT_BUDGET_ID`	string	`"default"`	`budget_id`
`LITELLM_PREMIUM_MODELS_BUDGET_NAME`	string	`""`	`premium_models` category entry
`LITELLM_CLI_BUDGET_NAME`	string	`""`	`cli` category entry

See Budget Configuration for migration details.

Hotfixes

2.23.1 · GitHub Tag ↗ – April 15, 2026
2.23.2 · GitHub Tag ↗ – April 16, 2026
2.23.3 · GitHub Tag ↗ – April 21, 2026
2.23.4 · GitHub Tag ↗ – April 20, 2026

CodeMie 2.22.0Apr 9, 20261 hotfix

Release Date: April 9, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

Hotfixes

2.22.1 · GitHub Tag ↗ – April 9, 2026

CodeMie 2.21.0Apr 8, 2026Component updates

Release Date: April 8, 2026 · GitHub Tag ↗

Third-Party Component Updates

oauth2-proxy 7.15.1 (Chart 10.4.2)

Updated oauth2-proxy from 7.14.2 to 7.15.1 (Helm chart 10.1.0 to 10.4.2). For details, see the oauth2-proxy 7.15.1 Release Notes ↗.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.20.0Apr 2, 2026Component updates

Release Date: April 2, 2026 · GitHub Tag ↗

Third-Party Component Updates

ElasticSearch / Kibana 8.19.12

Updated from 8.18.4. For details, see the Elastic 8.19.12 Release Notes ↗.

Upgrade instructions: ElasticSearch and Kibana Upgrade Guide

NATS Chart 1.3.0 (NATS 2.11.0, Reloader 0.22.3)

Updated NATS Helm chart from 1.2.6 to 1.3.0, which includes NATS server 2.11.0 (up from 2.10.22) and NATS Reloader 0.22.3 (up from 0.16.0).

Upgrade instructions: NATS Upgrade Guide

Keycloak 26.5.6 (keycloakx 7.1.9)

Updated Keycloak to 26.5.6 (up from 26.4.5) and keycloakx chart to 7.1.9 (up from 7.1.5). For details, see the Keycloak 26.5 Release Notes ↗.

Upgrade instructions: Keycloak Upgrade Guide

Nginx 1.15.1

Updated nginx ingress controller to version 1.15.1 (up from 1.14.3).

Configuration Changes

No breaking configuration changes were introduced in this release.

March5 releases

CodeMie 2.19.0Mar 27, 2026Component updates

Release Date: March 27, 2026 · GitHub Tag ↗

Third-Party Component Updates

Postgres Operator Removed

CodeMie 2.19.0 removes the postgres-operator Helm chart (PGO 5.4.3) used for Keycloak's in-cluster PostgreSQL. It is replaced by two new database options:

Dedicated database instance — a separate, Terraform-provisioned database instance for Keycloak (default for Terraform deployments)
Shared CodeMie database — Keycloak reuses the existing CodeMie database instance; a Helm hook Job automatically creates the required database and user on first install

See the Keycloak Database Migration Guide for upgrade instructions.

note

Migration to an external database is optional. If you prefer to continue using the in-cluster PostgreSQL, no migration is required when upgrading to 2.19.0.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.18.0Mar 24, 2026No admin action required

Release Date: March 24, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.17.0Mar 20, 2026No admin action required

Release Date: March 20, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.16.0Mar 18, 2026No admin action required

Release Date: March 18, 2026 · GitHub Tag ↗

Third-Party Component Updates

No third-party component updates in this release.

Configuration Changes

No breaking configuration changes were introduced in this release.

CodeMie 2.15.0Mar 16, 2026Component updates

Release Date: March 16, 2026 · GitHub Tag ↗

Third-Party Component Updates

Fluent Bit 4.2.3.1

CodeMie 2.15.0 includes Fluent Bit version 4.2.3.1, providing improved log collection and processing capabilities.

What's new:

For detailed information about changes, improvements, and bug fixes, see the Fluent Bit 4.2.3.1 Release Notes.

Upgrade instructions:

To upgrade Fluent Bit to version 4.2.3.1, follow the Fluent Bit Upgrade Guide.

Configuration Changes

No breaking configuration changes were introduced in this release. All existing Fluent Bit configurations remain compatible.

November 2026​

Third-Party Component Updates

oauth2-proxy 7.15.6

Configuration Changes

Third-Party Component Updates

Configuration Changes

Hotfixes

Third-Party Component Updates

NATS 2.15.2

Configuration Changes

Hotfixes

Third-Party Component Updates

Configuration Changes

October 2026​

Third-Party Component Updates

LiteLLM 1.99.4

Configuration Changes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

Keycloak Operator 1.35.0

Configuration Changes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

CodeMie Code CLI 0.15.8

Configuration Changes

Hotfixes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

Configuration Changes

Older Releases​

2026​

Third-Party Component Updates

LiteLLM 1.99.2

Configuration Changes

Third-Party Component Updates

Configuration Changes

Hotfixes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

Configuration Changes

Hotfixes

Third-Party Component Updates

LiteLLM 1.96.2

Configuration Changes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

Langfuse 3.224.1

Configuration Changes

Hotfixes

Third-Party Component Updates

Configuration Changes

Hotfixes

Third-Party Component Updates

LiteLLM 1.93.0

oauth2-proxy 7.15.3

Configuration Changes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

Configuration Changes

Third-Party Component Updates

Configuration Changes

Hotfixes

November 2026

October 2026

Older Releases

2026

Budget Enforcement Environment Variables

Deprecated Budget Environment Variables