Release Notes

RCC v21.3.0 is a security release. It updates two Go dependencies for CVEs reported to us, and moves the toolchain to Go 1.25.14 to pick up the current standard library fixes. Scanning v21.2.0 with govulncheck reported 22 known vulnerabilities; this build reports none.

There are no functional changes and no breaking changes in this release. Upgrading is a straight swap.

Dependency updates

Two CVEs were reported against RCC's dependencies:

• CVE-2026-56852 — golang.org/x/text: norm.Iter can enter an infinite loop when processing input containing invalid UTF-8 bytes. Updated 0.23.0 → 0.41.0.
• CVE-2026-39824 — golang.org/x/sys: NewNTUnicodeString does not check for string length overflow on Windows NT Unicode strings. Updated 0.32.0 → 0.47.0.

golang.org/x/term was updated 0.31.0 → 0.45.0 alongside these to stay in step with golang.org/x/sys.

Go standard library updates

The Go toolchain moved from 1.25.9 to 1.25.14, which resolves 20 standard library CVEs:

• crypto/tls — CVE-2026-42505 (Encrypted Client Hello privacy leak), CVE-2026-56862 (post-handshake message limit)
• crypto/x509 — CVE-2026-27145 (inefficient candidate hostname parsing)
• html/template — CVE-2026-39826 and CVE-2026-39823 (escaper and meta content URL bypasses), CVE-2026-56858 (JavaScript regexp context tracking)
• net — CVE-2026-39836 (panic on NUL byte in Dial/LookupPort on Windows), CVE-2026-33811 (crash on long CNAME response)
• net/http — CVE-2026-33814 (HTTP/2 infinite loop on a bad SETTINGS_MAX_FRAME_SIZE), CVE-2026-56853 (ReadHeaderTimeout on the unencrypted HTTP/2 check), CVE-2026-39825 (ReverseProxy query parameter limit)
• net/mail — CVE-2026-42499 and CVE-2026-39820 (quadratic string concatenation)
• net/textproto — CVE-2026-42507 (arbitrary input included in errors without escaping)
• net/url — CVE-2026-56860 (quadratic complexity in resolvePath)
• mime — CVE-2026-42504 (quadratic complexity in WordDecoder.DecodeHeader)
• os — CVE-2026-39822 (root escape via symlink plus trailing slash)
• encoding/asn1 — CVE-2026-33818 (maximum recursion depth)
• encoding/xml — CVE-2026-56859 (recursion depth guard during decode)
• golang.org/x/net/idna — CVE-2026-39821 (ASCII-only Punycode-encoded labels not rejected)

Getting v21.3.0

Signed and pre-built executables are available directly:

• Windows — rcc.exe
• macOS (Apple Silicon) — rcc
• Linux — rcc

macOS and Windows builds are code-signed, and the macOS build is notarized. Note that RCC supports macOS on Apple Silicon only; Intel builds were discontinued in v21.0.0.

The complete changelog ships inside the executable itself — run rcc docs changelog to read the full list of changes for the version you have installed.

We've had a 4-month gap in updating the latest RCC, which ends now 🚀

For the last four months, we've been working hard on the new enterprise Firewall setups coming online and finding solutions to work with those. RCC is the keystone in solving and distributing these solutions.

The breaking change between v16 and v17 is that we dropped the interactive commands for profile creation. These were only used to help bootstrap new network profiles, so the change is quite limited. The task of profile creation is now handled by Setup Utility, which has all the testing and diagnostics tools right next to profile creation with a nice UI.

The new features and improvements list is a long one, but I am raising a few here:

• A lot of TLS-related testing and diagnostic solutions were added
• A lot of tooling around certificates needed and used by the MITM firewalls
• Improvements in environment build speeds
• Space usage tracking to enable simpler cleanups
• Less load subprocess monitoring
• Detecting multiple users sharing ROBOCORP_HOME

That's not all; please check the full changelog for all the details.

(This version of RCC is already available in the latest Worker and is coming out to VS Code and other tools as well).

As you may have noticed, we have been pushing out many updates to our tools and libraries lately, so a summary of the key things you can gain by updating is in place.

Support for newer type firewalls (MITM)

New firewall setups are coming to many companies, so we had to be the bridge to get the open-source frameworks to work inside these protected networks. Tools and libraries have been updated, and we have documentation here and here.

VS Code extensions

Support for our new Python logging is now built into VS Code, and several smaller improvements and supports for Python developers have been added.

There is a dependency helper that highlights and helps you update your dependencies to new versions. Just hover over the dependencies, and you will see the versions available.

The full changelog is worth following if you want to keep up with the updates.

Setup Utility, Worker, and RCC

The latest version of Setup Utility adds new checks to identify potential blockers for Windows RDP setups. It adds a lot of new information coming from RCC diagnostics for the firewall setups and testing.

For the Worker, we would like to draw your attention to Cloud Workers specifically. Many are still running their processes on the older Ubuntu containers, so a kind reminder to update to the new Cloud Workers.

We have not seen any problems arising from this change, but switching to the new one has fixed a few cases. We also have the latest Worker (v7.1.3) in the Cloud Worker (early access), so you can always test the next upcoming Cloud Worker by using that one.

This update solves an issue where RCC locks would be reported as long paths check failed and would block the application. Now those are no longer reported and the application starts normally.

This update contains:

• Adding a way to disable the auto-updater by adding - as the autoupdater URL
• Update to use RCC v16.1.1
• Bug fix for RCC not injecting environment variables like HTTP_PROXY properly for micromamba process, supporting complex firewall setups with self-signed certificates

Robocorp Assistant 2.1.0

This update contains:

• Support for SSO Assistant-only Users

• Security updates

• Update to use RCC v14.15.4

• RCC upgraded from v14.6.0 to v14.15.4.

• Information from pypi is shown on hover for pypi packages in conda.yaml.

• Warning if the versions for pypi in conda.yaml have updates.

• Warning if python version is not >= 3.8 in conda.yaml

• Warning if pip version is not >= 22.0 in conda.yaml

• ROBO TASKS OUTPUT updated to latest version (now supports robocorp-log 2.7.0).

👉 Need to control or scan every file your automations use in production?

👉 Want to save time / protect developers from environment building?

We now have a solution for setting up environment pre-building inside your company network so that all robot runs and developer tools can get environments much faster.

The setup enables you to build the environments on dedicated machines and, if needed, scan the results before passing them on to your users.

The client machines only download missing files to get the environment which means drastic speed improvements over time as the environments share many of the same files.

🚀 The documentation covers the feature and setup, but if there are any questions, do not hesitate to ping us.

Robocorp Assistant 2.0.11

This update contains:

• Now all the Error pages will show a "Submit issue" button; this will specially be helpful for users to submit an issue in case of linking errors
• RCC updated to version 14.6.0

Kind reminder that Assistant v1 will be deprecated end of June 2023, we will push the automatic update, at which point the end-users still using version 1 will get a prompt to upgrade.

Robocorp Assistant 2.0.8

This update contains:

• RCC updated to version 13.12.0 now supports the ROBOCORP_HOME env variable to be a path that contains special characters like diacritics
• Security updates for multiple 3rd party dependencies
• Fixes that should support better the complex network proxy setups

We also released Robocorp Assistant 1.9.3 that contains important security updates as part of the maintenance for v1. This is a kind reminder that Assistant v1 is marked for deprecation.

We will publish security updates to Assistant v1 until the end of April 2023. End of June 2023, we will push the automatic update, at which point the end-users still using version 1 will get a prompt to upgrade.