Release 2026.10.22-1

The Translate step in Preview, extraction policies that match on transaction metadata, and two critical security updates.

Cloud, United States
Cloud, Australia
Self-hosted image
ghcr.io/docaifabric/docaifabric:2026.10.22-1

Security

  • Image decoding updated to fix nine memory-safety vulnerabilities, cloud and self-hosted image. See DAF-SA-2026-001.
  • Node.js updated to its October 2026 security release, cloud and self-hosted image: the first part of DAF-SA-2026-002, completed in 2026.10.24-1 on the cloud service and in image 2026.10.26-1.
  • Callers and business rules can no longer set the transaction metadata keys the platform reserves for itself, and a review outcome set in metadata no longer passes a Review step.
  • Certificate bundle updated to stop trusting withdrawn certificate authorities; the HTTP client library updated.
  • Any signed-in user can open the permission list when creating an API key; for a personal key, Agents & API shows only what a personal key can hold.

New

  • Translate step (Preview): translate documents into another language as a workflow step, and read the translation beside the original in the document viewer. See Translate.
  • Extraction policies can depend on transaction metadata, not only on extracted fields.
  • Model profiles: a catalog of model profiles on the Models page, for organization and deployment models; a tenant model can use a Responses profile.

Improved

  • Extraction policies match on the whole extraction and repeat once when a policy changes a value; a field that comes from a source skips the model call.
  • A Similar fix made in production goes to production memory, with a record of what changed; memory never learns from an Evaluation data set by itself.
  • Reporting opens faster over long periods.
  • The Step column shows icons for Translate, Redact and Notification.

Fixed

  • Two simultaneous start requests queue a transaction once, and the metadata and correlation id given at start are applied.
  • Transaction and evaluation search return what they should.
  • Numbers and letter-spaced labels are translated whole.

API

  • Creating, starting or running a transaction ignores the reserved metadata keys and lists them in the new response field ignored_metadata_keys; everything else you sent is stored.
  • da admin profiles list and da admin profiles show: the profile catalog from the command line and the deployment administration tools for agents. See Model configuration.

All releases