2026.09.22 — 2026-09-14

Upgrading to this release

This release reorganises Studio into modules, and the database schema with it. An existing database cannot be upgraded: Studio has to start against an empty one. Several changes below each carry their own note; this is the order to do them in.

Before you stop the old version

1. Remove every message capture (Settings → Message index, subscriptions of kind capture) and wait for the next reconcile pass to report them gone. A capture's divert and queue on the broker are named after this Studio's instance id, which is kept in the database; a new database gets a new id, and the new Studio will never remove what the old one installed. If you have already upgraded, delete the artemis-studio.capture.<old-id>.* diverts and queues on each broker by hand.
2. Write down what you will re-create: registered clusters and their credentials, environments, users, roles and grants, API tokens (and which assistants use them), notification channels, alert rules, request-reply expectations, message index subscriptions, declared broker configuration, and identity provider group mappings.

Upgrade

3. Stop Studio, then drop and recreate its database (or remove the Postgres volume).
4. Rename artemis-studio.rr.clock-skew-tolerance-ms to artemis-studio.broker.clock-skew-tolerance-ms if you set it, and delete artemis-studio.branding.product-name, artemis-studio.security.session-timeout and artemis-studio.security.oidc-default-role, which no longer exist.
5. Start the new version and sign in as admin with the password it prints once.

After

6. Register the clusters and re-create what you wrote down. Built-in alert rules are seeded again for each cluster. Issue new API keys and update every assistant or script that used an old one.
7. With OIDC configured, set each provider's group mappings and default role under Administration → Group mappings. Until then, a user whose groups match no mapping is refused sign-in.
8. API clients: group mappings moved from /api/v1/oidc/mappings to /api/v1/identity/providers/{providerId}/group-mappings; POST /api/v1/auth/login takes an optional provider; GET /api/v1/auth/providers returns { id, kind, label, startPath }; the connection check's recommendations is now contributions.brokerconfig.

Optional features can now be turned off with artemis-studio.features.<id>.enabled=false; see the configuration guide for the ids.

Breaking

• Carry registration check contributions keyed by feature (d288c6ce)

• Provision external users by provider and map groups per provider (f319869d)

  Users signing in through an external identity provider are now keyed by the provider and the subject it reports, so the same subject from two providers is two accounts. Group-to-role mappings and the default role belong to each provider and are re-applied at every sign-in. Administration's "SSO mapping" tab is now "Group mappings", with a provider picker and a default-role choice, and the users table shows each user's provider.

• Re-baseline the schema into one changelog per module (df0401af)

  Each module now owns its tables under db/changelog/<module>/, with a single 0001-baseline.sql changeset included from the master changelog in dependency order (ADR-0072). The baselines reproduce the schema the previous 25 changesets built: column order, storage parameters, partitions, indexes, column comments and the built-in role seeds.

  One deliberate difference: audit_event no longer has foreign keys to cluster, broker_node or app_user. An audit event now keeps the ids of a removed cluster, node or user instead of having them set to null.

• Sign in through identity providers (d4236097)

  Authentication is assembled from identity provider modules instead of being wired by hand into the security configuration:

  • local passwords are the local credential provider;
  • API tokens are a bearer provider behind one kernel bearer filter;
  • each configured OIDC client registration is a redirect provider.

  POST /api/v1/auth/login accepts an optional provider (local when omitted); naming a provider that is not configured fails exactly like a wrong password. Throttling, the sign-in audit row and the must-change-password gate apply to every credential provider.

• Bind startup configuration per module (9cb47dcc)

  The single ArtemisStudioProperties record is replaced by one @ConfigurationProperties record per module (ScrapeProperties, BrokerProperties, SqlProperties, ...). Every artemis-studio.* key keeps its name, except:

  • artemis-studio.rr.clock-skew-tolerance-ms is now artemis-studio.broker.clock-skew-tolerance-ms (ARTEMIS_STUDIO_BROKER_CLOCK_SKEW_TOLERANCE_MS). Rename it if you set it.
  • artemis-studio.branding.product-name and artemis-studio.security.session-timeout are removed. Studio never read either; delete them from your configuration.

  TopicCoalescer moves into the events module, its only user.

Added

• Compose the console from feature contributions (09eb9010)

  Every screen is now a feature folder under web/src/features/<id>, named after its backend module, and the shell renders what the enabled features contribute: routes, navigation, palette groups, stream topics and slots. The kernel under web/src/kernel no longer imports any feature, and eslint-plugin-boundaries fails the lint on an import outside the allowed feature edges.

  What an operator notices:

  • A cluster's live stream now also refreshes consumers, sessions and connections, and request-reply and alerts no longer open a second stream.
  • Change password has moved from the user menu to the Account page, where the identity-local feature contributes it.
  • A firing alert on a topology node is announced to screen readers as well as drawn.
  • Administration opens on the tab in its address for every tab, including Group mappings, which a stale validator used to drop.

  For contributors:

  • api/client.ts is split into kernel/api (request, ApiError, paging, key roots, polling, the generated schema) and one api.ts per feature. The generated schema lives at web/src/kernel/api/schema.d.ts.
  • feature.ts holds a feature's defineFeature; index.ts holds only what another feature may import.
  • New slots: shell.header, shell.navbar, home.empty, cluster.header, topology.node.marks, settings.sections, admin.tabs, account.sections.
  • renderAppAt renders the composed app over an in-memory history, and a contract test holds the frontend feature ids to web/manifest.snapshot.json.

• Group cluster views and explain disabled features (948d06e1)

  The cluster navigation is grouped under Observe, Messaging, Resources, Configuration and Activity. Expanded, each group has a heading; collapsed, groups are separated and keep their names for screen readers. The command palette lists views under the same groups.

  Views follow the installation's manifest. A feature disabled at startup has no entry in the navigation or the palette, and opening one of its addresses shows a page that says the feature is disabled on this installation, names the startup property that enables it, and links back to the cluster. A group whose views are all disabled is not shown.

  A view the signed-in user lacks the read permission for stays in the navigation, disabled, and says which permission it needs, on hover and on keyboard focus.

  After registering a cluster Studio now opens its topology. The recommended configuration is still shown under the connection check and on the cluster's Configuration tab.

  Screens that showed another feature's panel now render whatever the enabled features contribute: the queue drawer's last-hour charts, the request-reply latency card on the metrics view, and the configuration recommendations under a registration check. Each disappears with its feature, leaving no gap.

• Name each feature's enabling property in the manifest (73d37657)

  GET /api/v1/manifest now gives every feature an enabledProperty, the startup property that turns it on or off (for example artemis-studio.features.sql.enabled), so a client can say how to enable a disabled feature without rebuilding the property name itself.

  The manifest's fields are now declared required in the OpenAPI document, and a redirect provider's startPath is declared nullable, matching what the endpoint has always returned.

• Name the setting that restores a disabled feature's runbook tools (ef837985)

  A runbook prompt whose steps use a tool of a disabled feature now says which tool is missing and which artemis-studio.features.<id>.enabled=true setting restores it, so an assistant skips and reports those checks instead of calling a tool that does not exist.

  Disabling the queues feature now also disables routing, which uses queue operations; before, artemis-studio.features.queues.enabled=false stopped Studio from starting.

  FeatureToggleTest starts the application with each optional feature disabled and checks that its endpoints answer 404 feature-disabled and that its jobs, tools, topics, settings and permissions are absent.

• Provision external users by provider and map groups per provider (f319869d)

  Users signing in through an external identity provider are now keyed by the provider and the subject it reports, so the same subject from two providers is two accounts. Group-to-role mappings and the default role belong to each provider and are re-applied at every sign-in. Administration's "SSO mapping" tab is now "Group mappings", with a provider picker and a default-role choice, and the users table shows each user's provider.

• Keep the cluster name on every audit event (5dac69d7)

  Each audit event now records the name the cluster had when the event was written, and the audit API returns it as clusterName. A removed cluster's audit trail stays readable to callers with a global grant, and still says which cluster it was about.

• Sign in through identity providers (d4236097)

  Authentication is assembled from identity provider modules instead of being wired by hand into the security configuration:

  • local passwords are the local credential provider;
  • API tokens are a bearer provider behind one kernel bearer filter;
  • each configured OIDC client registration is a redirect provider.

  POST /api/v1/auth/login accepts an optional provider (local when omitted); naming a provider that is not configured fails exactly like a wrong password. Throttling, the sign-in audit row and the must-change-password gate apply to every credential provider.

• Release broker resources in order on shutdown (fdb2f40e)

  Stopping Studio now releases what it holds on brokers in a fixed order: stream events end first; then background jobs and scraping stop and no new management call is started; then notification subscriptions and capture consumers close; then the Core connection pool. Previously these closed in whatever order bean destruction happened to take, and a scrape tier could still start a broker call while shutdown was under way. A context that is stopped and started again reopens what it released.

• Report background jobs, broker calls and subscriptions (6be5b468)

  • GET /api/v1/system/jobs (settings:read) lists every background job: last start and end, last error, run and failure counts, next scheduled run, and whether it is degraded — no run finished within three of its intervals.
  • /actuator/health/studio groups three contributors:
    • jobs, degraded while a job has stalled, naming when it last completed;
    • brokers, per node the last management call success and failure, the last rate-limit wait, and per cluster the open Core connection count;
    • subscriptions, per serving node whether the notification subscription is established and, if not, why. The group reports DEGRADED (HTTP 200) and is not part of liveness or readiness, so a broker outage or a stalled job never gets Studio restarted or taken out of rotation.

• Switch the MCP server off with the mcp feature property (d47403ad)

  Setting artemis-studio.features.mcp.enabled=false now removes the MCP server entirely: there is no /mcp endpoint, no tool scanning, and the catalogue omits the tools the MCP module itself contributes. With the property unset, nothing changes.

• Publish the feature manifest and explain disabled features (80f09ffb)

  GET /api/v1/manifest lists every built-in module with whether it is enabled, the permission catalogue of enabled modules, and the configured identity providers. A request to a disabled feature's API answers 404 with problem type feature-disabled naming the property that enables it (artemis-studio.features.<id>.enabled). Startup refuses mismatched contract versions, duplicate contributions, a disabled required module, and an enabled feature whose dependency is disabled.

Fixed

• Explain a disabled identity-local at the change-password page (1c2ccd45)

  With artemis-studio.features.identity-local.enabled=false the change-password page still rendered a form whose request could only fail. It now shows the page that says the feature is off and names the property, like every other feature's address.

Refactor

• Carry registration check contributions keyed by feature (d288c6ce)

• Re-baseline the schema into one changelog per module (df0401af)

  Each module now owns its tables under db/changelog/<module>/, with a single 0001-baseline.sql changeset included from the master changelog in dependency order (ADR-0072). The baselines reproduce the schema the previous 25 changesets built: column order, storage parameters, partitions, indexes, column comments and the built-in role seeds.

  One deliberate difference: audit_event no longer has foreign keys to cluster, broker_node or app_user. An audit event now keeps the ids of a removed cluster, node or user instead of having them set to null.

• Bind startup configuration per module (9cb47dcc)

  The single ArtemisStudioProperties record is replaced by one @ConfigurationProperties record per module (ScrapeProperties, BrokerProperties, SqlProperties, ...). Every artemis-studio.* key keeps its name, except:

  • artemis-studio.rr.clock-skew-tolerance-ms is now artemis-studio.broker.clock-skew-tolerance-ms (ARTEMIS_STUDIO_BROKER_CLOCK_SKEW_TOLERANCE_MS). Rename it if you set it.
  • artemis-studio.branding.product-name and artemis-studio.security.session-timeout are removed. Studio never read either; delete them from your configuration.

  TopicCoalescer moves into the events module, its only user.