Issues

• Pr descriptions are hard to read

  conductor-oss/conductor#1730 · Filter by author igorwojda opened on Oct 10, 2026

• Sunset ES7 (Phase 3): remove ES7 from the server build

  enhancement
  conductor-oss/conductor#1727 · Filter by author nthmost-orkes opened on Oct 9, 2026

• Sunset ES7 (Phase 2): deprecate in place with a removal date

  enhancementsecurity
  conductor-oss/conductor#1726 · Filter by author nthmost-orkes opened on Oct 9, 2026

• Epic: Sunset the Elasticsearch 7 (ES7) indexing backend

  enhancementsecurity
  conductor-oss/conductor#1725 · Filter by author nthmost-orkes opened on Oct 9, 2026

• Bump spring-webmvc for CVE-2026-47884 — deferred to Spring Boot 4 track

  dependenciessecurity
  conductor-oss/conductor#1722 · Filter by author nthmost-orkes opened on Oct 8, 2026

• Security: dependency CVEs from 2026-10-07 scan (10 critical server CVEs)

  dependenciessecurity
  conductor-oss/conductor#1721 · Filter by author nthmost-orkes opened on Oct 8, 2026

• Critical CVEs in conductor/ui: 6 build-time deps pinned by react-scripts (CRA)

  dependenciessecurityui
  conductor-oss/conductor#1719 · Filter by author nthmost-orkes opened on Oct 8, 2026
  1

  

• LLM Prompt Concatenation + Over-Privileged Tools Allow Injection to SSRF / SQL-Write / Exfiltration

  agentspanbugsecurity
  conductor-oss/conductor#1718 · Filter by author jhaabhijeet864 opened on Oct 8, 2026
  1

• Unsafe SnakeYAML new Yaml() in SkillNormalizer Enables Tag-Injection

  agentspanbugsecurity
  conductor-oss/conductor#1717 · Filter by author jhaabhijeet864 opened on Oct 8, 2026
  2

• OSS API Open by Default — No Authentication, No RBAC

  enhancementsecurity
  conductor-oss/conductor#1716 · Filter by author jhaabhijeet864 opened on Oct 8, 2026

• Unsandboxed GraalVM Python Evaluator Allows RCE; JS Evaluator Uses Denylist Instead of Allowlist

  bugsecurity
  conductor-oss/conductor#1715 · Filter by author jhaabhijeet864 opened on Oct 7, 2026

• Rerun fails with task_index.workflow_type NOT NULL violation when the workflow contains a SKIPPED task

  bug
  conductor-oss/conductor#1698 · Filter by author cburatto opened on Sep 29, 2026
  1

• Migrate Elasticsearch 7.x to 8.x for CVE-2025-37731

  dependenciessecurity
  conductor-oss/conductor#1682 · Filter by author nthmost-orkes opened on Sep 25, 2026
  1

• Bump spring-security for CVE-2026-59270 (Spring Boot 4 track)

  dependenciessecurity
  conductor-oss/conductor#1681 · Filter by author nthmost-orkes opened on Sep 25, 2026

• Migrate server base image to eclipse-temurin:21-jre-alpine (perl / libssh2 / nginx CVEs)

  dependenciessecurity
  conductor-oss/conductor#1680 · Filter by author nthmost-orkes opened on Sep 25, 2026

• Epic: Production-grade AMQP support

  enhancementjava
  conductor-oss/conductor#1677 · Filter by author nthmost-orkes opened on Sep 25, 2026

• AMQP: add Testcontainers integration tests against a real broker

  javatests
  conductor-oss/conductor#1676 · Filter by author nthmost-orkes opened on Sep 25, 2026
  1

• AMQP: add metrics and reduce log-level noise

  enhancementjava
  conductor-oss/conductor#1675 · Filter by author nthmost-orkes opened on Sep 25, 2026
  1

• AMQP: publishes are fire-and-forget (no publisher confirms / mandatory)

  enhancementjava
  conductor-oss/conductor#1674 · Filter by author nthmost-orkes opened on Sep 25, 2026
  1

• AMQP: TLS is insecure by default (no cert/hostname verification, no truststore/mTLS)

  enhancementjavasecurity
  conductor-oss/conductor#1673 · Filter by author nthmost-orkes opened on Sep 25, 2026
  1

• Workflow waits 60 to 120 s for its next task after decide() misses the workflow lock (Postgres queue)

  bug
  conductor-oss/conductor#1667 · Filter by author NicolasBissig opened on Sep 24, 2026
  1

• SystemTaskWorker per-queue semaphores allow aggregate admission to exceed shared executor capacity

  bug
  conductor-oss/conductor#1649 · Filter by author eriona-pearl opened on Sep 18, 2026
  1

  

• Restart with useLatestDefinitions=true does not re-seed workflow.variables from the new definition, so ${workflow.variables.*} resolves to null

  bug
  conductor-oss/conductor#1628 · Filter by author rahulrebase opened on Sep 15, 2026

• /workflowDefs aborts while serializing a 100+ MB /metadata/workflow response (Broken pipe)

  bug
  conductor-oss/conductor#1611 · Filter by author jerrynieRe opened on Sep 9, 2026

• MySQL backend without Elasticsearch: workflow search silently returns nothing

  documentationenhancement
  conductor-oss/conductor#1602 · Filter by author nthmost-orkes opened on Sep 4, 2026
  1