Release Notes

How it used to work

A step configuration offered four Cloud Worker options:

• Cloud Worker — the default.
• Cloud Worker (early access) — the next version, for testing before it became the default.
• Cloud Worker (previous) — the version that was the default before.
• Cloud Worker (Ubuntu 18.04 legacy) — the old Ubuntu container.

Cloud Worker was updated to a newer container from time to time. (previous) kept the container it replaced.

None of the four options let you select an exact container. We controlled what each name pointed to, and we could change it. If a customer needed a fixed container, we configured it manually for that workspace. These manual workarounds show that the model did not work, so we are replacing it.

The names also gave you no information. They did not show the Linux distribution or the build date, and (early access) and (previous) pointed to different containers at different times.

What changes

Each step now uses one of two kinds of option.

• A specific version. The name gives the distribution and the build date, for example Cloud Worker (Debian 12 bookworm) 2026-09-08. This container never changes.
• The automatically updating version. The name ends in auto-update instead of a date, for example Cloud Worker (Debian 12 bookworm) auto-update. When we release a new Cloud Worker for that distribution, we point this option to it. Your steps use the new container on their next run.

Each distribution has one auto-update option, and it only moves within that distribution. A new distribution is added as a new option. We never apply it to an existing selection.

We normally set the auto-update option to the latest available image. This is a guideline, not a fixed rule.

We plan to release a new Cloud Worker about once a month. This is a target, not a commitment.

What this means for your steps

Nothing changes. Your steps use the same container as before. Only the name is different.

There is one exception. Cloud Worker (early access) becomes the auto-update option, so it moves to the latest container. This is the update that option was designed to receive.

The Extended variant is removed. The standard Cloud Worker now contains everything the variant added, including LibreOffice.

No action is required. When you next work on your process configurations, check which Cloud Worker each step uses. The name shows the build date, so you can see if it is old.

See Robocorp-Hosted Cloud Worker for details.

What's new

Workforce Agent Core v8.1.0.

• The bundled runtime has been updated to Node v24 LTS.
• Updated RCC to v21.3.0.
• Updated dependencies, including security fixes.

Minimum macOS version is now 13.5 (Ventura)

Node 24 raises the minimum macOS version it supports, so Workforce Agent Core v8.1.0 requires macOS 13.5 (Ventura) or newer. If you run workers on an older macOS version, stay on v8.0.2 until those machines can be updated.

Linux and Windows requirements are unchanged.

You can find the detailed changelog for Workforce Agent Core here.

RCC v21.3.0 is a security release. It updates two Go dependencies for CVEs reported to us, and moves the toolchain to Go 1.25.14 to pick up the current standard library fixes. Scanning v21.2.0 with govulncheck reported 22 known vulnerabilities; this build reports none.

There are no functional changes and no breaking changes in this release. Upgrading is a straight swap.

Dependency updates

Two CVEs were reported against RCC's dependencies:

• CVE-2026-56852 — golang.org/x/text: norm.Iter can enter an infinite loop when processing input containing invalid UTF-8 bytes. Updated 0.23.0 → 0.41.0.
• CVE-2026-39824 — golang.org/x/sys: NewNTUnicodeString does not check for string length overflow on Windows NT Unicode strings. Updated 0.32.0 → 0.47.0.

golang.org/x/term was updated 0.31.0 → 0.45.0 alongside these to stay in step with golang.org/x/sys.

Go standard library updates

The Go toolchain moved from 1.25.9 to 1.25.14, which resolves 20 standard library CVEs:

• crypto/tls — CVE-2026-42505 (Encrypted Client Hello privacy leak), CVE-2026-56862 (post-handshake message limit)
• crypto/x509 — CVE-2026-27145 (inefficient candidate hostname parsing)
• html/template — CVE-2026-39826 and CVE-2026-39823 (escaper and meta content URL bypasses), CVE-2026-56858 (JavaScript regexp context tracking)
• net — CVE-2026-39836 (panic on NUL byte in Dial/LookupPort on Windows), CVE-2026-33811 (crash on long CNAME response)
• net/http — CVE-2026-33814 (HTTP/2 infinite loop on a bad SETTINGS_MAX_FRAME_SIZE), CVE-2026-56853 (ReadHeaderTimeout on the unencrypted HTTP/2 check), CVE-2026-39825 (ReverseProxy query parameter limit)
• net/mail — CVE-2026-42499 and CVE-2026-39820 (quadratic string concatenation)
• net/textproto — CVE-2026-42507 (arbitrary input included in errors without escaping)
• net/url — CVE-2026-56860 (quadratic complexity in resolvePath)
• mime — CVE-2026-42504 (quadratic complexity in WordDecoder.DecodeHeader)
• os — CVE-2026-39822 (root escape via symlink plus trailing slash)
• encoding/asn1 — CVE-2026-33818 (maximum recursion depth)
• encoding/xml — CVE-2026-56859 (recursion depth guard during decode)
• golang.org/x/net/idna — CVE-2026-39821 (ASCII-only Punycode-encoded labels not rejected)

Getting v21.3.0

Signed and pre-built executables are available directly:

• Windows — rcc.exe
• macOS (Apple Silicon) — rcc
• Linux — rcc

macOS and Windows builds are code-signed, and the macOS build is notarized. Note that RCC supports macOS on Apple Silicon only; Intel builds were discontinued in v21.0.0.

The complete changelog ships inside the executable itself — run rcc docs changelog to read the full list of changes for the version you have installed.

Python 3.14 support

robocorp-log crashed on Python 3.14 before any task code executed (#485, fixed in #486):

ast.Str was deprecated in Python 3.8, began emitting a DeprecationWarning in 3.12, and was removed entirely in 3.14. robocorp-log still used it in the AST rewriter that adds the automatic logging callbacks, so the crash happened while the import hook was rewriting an ordinary standard-library import during logger setup — before your tasks were even collected. There was no way to work around it from automation code; the only option was to stay on Python 3.13 or earlier.

The rewriter now uses ast.Constant, which has been the correct representation for a literal since Python 3.8. This also clears the related deprecation warnings on Python 3.12 and 3.13.

If you pinned your environment to an older Python because of this, you can now move to 3.14:

Upgrading

robocorp 3.1.3 pulls in the fixed robocorp-log automatically, so installing the meta package is enough:

If you depend on robocorp-log directly, upgrade it to 3.1.4.

Released packages

• package robocorp 3.1.3 (meta package)
• package robocorp-log 3.1.4

Control Room API request timeout

robocorp-vault, robocorp-workitems and robocorp-storage now apply a default 60-second request timeout to Control Room API calls (#484).

Previously these calls were made without an explicit timeout, so requests would wait indefinitely for a response. A stalled connection — one dropped by a proxy or load balancer, for instance — hung the run forever instead of raising and letting the existing retry logic take over. With a timeout in place the request fails, retries, and the task can make progress.

The value is configurable through the RC_API_REQUEST_TIMEOUT environment variable. Set it in your run environment (the env section of robot.yaml, or a Control Room environment variable) — that is the normal place for it.

It is read once when the module is imported, so if you do set it from Python it has to happen before the import:

Robocorp Log

robocorp-log 3.1.3 fixes 13 npm security vulnerabilities in the React application that renders the log output (#473), affecting dompurify, vite, lodash, flatted, picomatch, postcss, brace-expansion and tmp.

• dompurify bumped to ^3.4.0 and vite to ^6.4.2
• npm overrides added to pull in fixed versions of transitive dependencies
• The embedded React output view was rebuilt, so log.html files produced by this version carry the fixed bundle

Robocorp Windows

robocorp-windows 1.1.2 fixes wait_for_condition() ignoring the caller-supplied timeout and always waiting 8 seconds (#480). This release shipped slightly ahead of the rest of the batch, on 24 July 2026.

Released packages

• package robocorp 3.1.2 (meta package)
• package robocorp-log 3.1.3
• package robocorp-workitems 1.5.1
• package robocorp-vault 1.4.1
• package robocorp-storage 1.1.1
• package robocorp-windows 1.1.2

Breaking changes

• RPA.Desktop.Windows has been removed (#1343). The pywinauto-based library has emitted a deprecation warning pointing at RPA.Windows for a long time and is no longer maintained. Use RPA.Windows for all Windows UI automation going forward.

This is not a drop-in rename. RPA.Windows is built on UIAutomation rather than pywinauto, so keyword names, arguments and locator syntax differ — expect to rewrite the affected steps rather than just change the import:

The two examples/windows-* scripts that depended exclusively on the removed pywinauto API were removed along with the library.

Security fixes

• RPA.Archive: Fixed a Zip Slip path traversal vulnerability (CWE-22) in Extract Archive (#1341, fixes #1339, #1340). Archive members containing path traversal sequences such as ../../evil.py could previously be written outside the requested destination directory. Extraction now validates that every member resolves inside the destination first and raises ValueError otherwise. Both the ZIP and TAR code paths are covered, for whole-archive and selected-members extraction alike.

• Dependency bumps across the affected packages:

  • soupsieve ≥2.8.4 — HIGH, memory exhaustion via large comma-separated selector lists (CVE-2026-49476) (#1342)
  • pillow ≥12.3.0 — HIGH, heap out-of-bounds write in ImageCmsTransform.apply() (CVE-2026-59205) and a decompression-bomb DoS in PdfParser.PdfStream.decode() (CVE-2026-59200)
  • cryptography ≥50.0.0 — HIGH, Bleichenbacher oracle in PKCS#7 EnvelopedData decryption (CVE-2026-69247)
  • pypdf ≥6.15.0 — MEDIUM, excessive memory use for large /ToUnicode streams (CVE-2026-71870), in rpaframework-pdf
  • pyasn1 ≥0.6.4 — HIGH, BER/CER/DER decoder DoS via unbounded long-form tag IDs (CVE-2026-59884), and httplib2 ≥0.32.0 — HIGH, decompression-bomb DoS via unbounded gzip/deflate handling (CVE-2026-59939), both in rpaframework-google
  • setuptools ≥83.0.0 — MEDIUM, MANIFEST.in exclusion bypass via Unicode normalization collision (CVE-2026-59890), in rpaframework-sema4ai

  The pillow and cryptography floors were raised across all packages (#1350, #1338).

Fixes and improvements

• rpaframework-core: Fixed the Windows locator parser silently mis-tokenizing a strategy when the locator value carried a stray locator= prefix or an unmatched quote character — for example producing a bogus locator='executable strategy instead of recognizing executable:. A clearer warning is now surfaced when this happens (#1343, fixes #1323).

• rpaframework-core: executable: locators are now matched case-insensitively. Windows file names are case-insensitive but the comparison was not, so executable:notepad.exe could not find a process that Windows lists as Notepad.exe — as it does on Windows 11. handle: matching is numeric and is unchanged.

• RPA.Desktop: Highlight Elements now returns the list of matched element regions instead of None, exposing the coordinates that were already being computed internally (#1343, fixes #1324):

• rpaframework now requires rpaframework-core ≥13.0.2, so a fresh install cannot resolve a core version that predates the Windows locator fixes RPA.Windows relies on.

Released packages

• package rpaframework 33.0.1
• package rpaframework-core 13.0.3
• package rpaframework-pdf 11.0.2
• package rpaframework-recognition 8.0.2
• package rpaframework-google 12.0.1
• package rpaframework-sema4ai 1.1.1

What's new

Workforce Agent Core v8.0.2 / Service Helper v1.23.0.

Changes to Workforce Agent Core

• Security improvement: the password used for desktop connections is now handled more securely.
• Updated dependencies.

Changes to Service Helper

• Updated FreeRDP to the latest version for improved desktop connection stability.
• Updated dependencies.

What's new

This release focuses on security improvements, dependency updates, and a runtime upgrade.

• Update to Electron 40 and Node 24
• Upgrade RCC to v21.2.0
• Windows service helper updated to 1.23.0
• Security and dependency updates

Download from here and check our documentation here.
Have a splendid day! 🚀

Security releases regarding dependency package cryptography. Other security updates have been included as well and because of that multiple package releases have been done.

• package rpaframework 28.6.3

• package rpaframework-google 9.0.2

• package rpaframework-hubspot 1.0.2

• package rpaframework-openai 1.3.3

• package rpaframework-pdf 7.3.3

• package rpaframework-recognition 5.2.5

• package rpaframework-windows 7.5.2

Also as mentioned on 03 Apr 2024, the dialogs package has been now removed from repository.

Since Robocorp was acquired by Sema4.ai in January 2024, we have been busy building the vital components of AI Agents to become generally available. You can read more about our vision for building, running, and managing enterprise AI Agents on our website.

As we gear up for our first Sema4.ai product launches, we have restructured some of the components we previously offered, without removing any features from the current Robocorp Automation platform users.

The Robocorp Code extension for VS Code has become the Sema4.ai extension for VS Code

The new Sema4.ai extension for VS Code retains all the functionality of Robocorp Code. In addition, it will get a lot of new AI agent-related features moving forward.

🔔 Your action is needed! 🔔

• Remove the Robocorp Code extension from the VS Code. This is done by navigating to Extensions from the left sidebar, locating Robocorp Code, and clicking “Uninstall”.

• Install the new Sema4.ai Extension from the Marketplace, or by searching for it through the VS Code Extensions panel.

Robocorp Code is deprecated and will not receive any updates after September 30, 2024. Please make sure to install the new Sema4.ai extension by this date. This change has no impact on your current automations deployed to the Control Room - they continue to operate normally.

Apart from supporting everything the automation developer needs for building the Tasks, here are some recent additions:

• AI Actions complete workflow: from bootstrapping from the provided templates to debugging to publishing them to Sema4.ai Studio.

• Completely renewed inspectors and recorders for web, Windows, Java and image-based automations. Have a look at the recording of our recent Product Hour Live for all the details.

• Better environment management when working on Python - when you change any dependencies, it’ll ask if you want to update the environment.

For a detailed list of features, visit the change log.

Rebranding AI Actions and Action Server

Thank you to the community members for the great feedback during the developer preview period. You all helped us shape the Actions and Action Server to be a top-notch method for connecting new capabilities to AI agents.

To prepare for general availability, we have made the following naming changes:

• AI Actions and Action Server moved from robocorp/robocorp GitHub repository to sema4ai/actions.

• Renamed Robocorp Action Server to Sema4.ai Action Server.

• PyPi package changed from robocorp-actions to sema4ai-actions.

This brings slight changes to using the packages, while features remain the same or more.

Working on a Mac, you should remove the old versions and install a new:

In your Action code, the import changes like this:

We have added loads of new features in the Actions and Action Server, and here are some of the most important ones.

• Hot reload of actions when the package directory changes

• Support for parsing Custom Types in Action Server UI action run view

• Console output added to Action Server UI action run view

• Support OAuth2 secrets as Action arguments, and in the Action Server UI

• Stable public URL link to Action Server UI if started with --expose

• Support for action-server package build, extract, metadata, and update (for publishing to future Sema4.ai products)

• Automatic version handling by the Sema4.ai platform

• Customizable action display names in openapi.json using @action(display_name="<Action name>")

• An environment built only once, no longer checked/made pristine on server start to save time

For full details, have a look at the change log in the repository.

Early Access to AI Agents

We are excited to bring you the best of automation and unlock your journey towards AI Agents. To stay updated on the new releases from Sema4.ai, sign up for early access to Sema4.ai Agents here.

• Update rpaframework-core to version 11.3.3 including webdriver-manager upgrade to version 4.0.2. This should fix the issue with downloading the latest Chrome driver version.

• (in rpaframework 28.6.1) Library RPA.Robocorp.Vault (#1199): Proper error message if caused by SSL truststore patching bug.

Couple of reminders when using Selenium browsers and handling webdrivers:

• the matching webdriver can be always placed into robot root folder and that will be used if it is compatible with the selected browser (can be downloaded from here). BUT remember that open_available_browser method will automatically try to download and use correct webdriver

• the Chrome's new search engine selection startup popup can be bypassed by giving argument for the Chrome (examples in Python and Robot Framework syntax)

Python

Robot Framework

More and more complex enterprise setups highlighting improvement points for configuring networks and Workers.

• Added the ability for users to delete profile from Profile Management

• Added the ability to remove .service.json file if the user wants to

• The Worker configuration changes are disabled in the interface

Download from here and check our documentation here.

Have a splendid day! 🚀

• Library RPA.Browser.Selenium (#1191):

  • Fix/workaround for Chromium browser all instances not closing after the run. Which affects methods open_available_browser and open_chrome_browser. The default behavior can be changed with new parameter sandbox=True.

• Library RPA.Excel.Application (#1191):

  • Enhance find with new parameters search_type, start_after, and exact

  • Allow open_workbook to load workbooks from URLs

  • Improve all RPA.*.Application.quit_application methods to perform garbage collection before calling app.quit() to avoid problem with unreleased COM objects

  • Add rgb_to_excel_color(red, green, blue) method to get a suitable color value for Range.Font.Color and Range.Interior.Color

👉 Our next Product Hour Live session on April 24th will dive deeper into Inspectors so join us there.

The complete Inspector set is now available in the VS Code Extension, as we've added the Java Inspector and Image-based locator support.

The creation of Java locators is quite similar to that of Windows locators. You can hover over elements to pick items and then browse the element tree in the Inspector. Create locators out of rules on the UI or write the locator directly and test. We do not yet have the code generation available in the Inspector, but that is simple enough in the VS Code code editor.

👉 Checkout our documentation on the new Inspectors for details

We have also integrated the Image-based locator support in the VS Code extension. As before, we see Image-based automation as a last resort, so we heavily recommend trying out the other types of locators and even hotkey sending before returning to image-based automations.

• Library RPA.Word.Application (#1159):

  • Add keyword Select current paragraph for selecting the current paragraph.

  • Add keyword Select paragraphs for selecting previous/next paragraphs.

  • Add keyword Copy selection to clipboard for copying the selection to the clipboard.

• Library RPA.Excel.Application (#1158):

  • Add keyword Remove hidden columns and rows from given range.

  • Add keyword Merge range for merging cells in a range.

  • Add keyword Unmerge range for unmerging cells in a range.

• Library RPA.Cloud.Google (#1157, rpaframework-google 9.0.0):

  • Fix problem with method intellisense in Python development environments.

  • Add keyword Detect Tables for detecting table-like structures in spreadsheet’s sheets.

  • Add keyword Get Sheet Formulas for getting formulas from a sheet.

  • Add keyword To A1 notation for converting column number to A1 notation.

Action Server is developing fast towards general availability, with 10 releases in the past 7 weeks! It's time for a recap of the biggest new features and updates. To follow the plans and progress in detail, head to the GitHub Project, and check out the changelog.

New Action Package format

We've introduced a new configuration file and format: package.yaml. It replaces the previous conda.yaml (and other) files, and simplifies the configuration of Action Packages along with their Python environments to a single file.

Run command action-server package --update in your project folder to automatically upgrade to a new format.

Robocorp Code for VS Code supports Actions

We've added proper support for developing Actions (and Packages) to our VS Code extension. You can now access commands like Create Action Package, Run and Debug Action from the Command Palette.

In addition, you can now start the Action Server locally from VS Code. When running Actions, VS Code helps you create test inputs in devdata folder so that you don't need to repeat giving the inputs separately every time.

Custom data models as Action inputs and outputs

You can now use custom pydantic models as inputs/outputs of an @action. This opens many possibilities besides previously supported simple str, int, float and bool. Most commonly used LLMs create solid JSON inputs for function/tool/action calls; supporting those now in the Actions is a breeze.

For example you could define a class for "Prospect" like this

Then you can use it as an input argument in one or more actions just like this:

When using the Annotated types shown above, you only need to describe the fields once in your custom model, and they will be automatically included in the OpenAPI spec that gets exposed to AI Assistants like Custom GPT. Check out this cookbook example on how to use custom models, or head over to our Youtube channel for a video on how to use the Actions with OpenAI Custom GPTs!

Robocorp ReMark - Generative AI assistant is now available as a widget inside Robocorp Documentation and Portal 🎉

The new widget streamlines your workflow while browsing the documentation. You can get help from ReMark for multiple topics for your automation projects. ReMark can help you generate and debug Python code, tailored for automation use cases. It recognizes the page you are browsing and automatically suggests questions you might be interested in.

Benefits of the ReMark widget

• Smooth operation while browsing the documentation without the need to jump to a separate page

• Recognition of the content you are browsing - automatically suggests topics you might be interested in

• Available instantly when you need it and can be minimized when not needed

• Easy to continue the conversation at the full page site, your conversations from the widget all land to ReMark.

Check it out e.g. here, the bottom right corner: https://robocorp.com/docs

• Library RPA.Excel.Application (#1152): Add keyword Write data to range for writing data to range(s) in a spreadsheet. This will be significantly faster than using Write to cells keyword for large data sets.

• Library RPA.Word.Application (#1152):

• Add keywords starting with Move_ for positioning cursor position in a document.

• Add keyword Find text for finding text in a document.

• Add keyword Paste from clipboard for pasting text from clipboard to a current cursor position.

• Add keyword Get current line to get text from the current line.

• Add keyword Get number of lines to get number of lines in a current document.

• Refactor keyword Write text to take cursor positioning into consideration.

EU1 instance (cloud.robocorp.com) database has now been updated and the maintenance window is over. Update was started at 10:28 EET and completed 10:52 EET. Everything should now be operating normally.

Reminder related to the comms we sent out 2 weeks ago: we're performing a mandatory database update on EU1 instance (cloud.robocorp.com) which will have an impact on the system usage. This can show up as e.g. errors on UI or some API calls failing, and even some runs failing altogether. Runtime environments for robots runs are not directly impacted at all. Some robot operations like accessing the Vault can be interrupted.

We’re working to minimise the impact on customer operations. The actual update should not take more than 15mins.

The update will be performed between 10:00 and 13:00 EET on 21.02.2024