2026.42 Infrastructure Changes

3 min read

Service deployment order release 2026.42

If your environment has the gatekeeper service deployed, some changes in this release depend on database migrations that must be applied in a specific order. Deploy the services as follows:

backend-service-chat
backend-service-scope-managment
gatekeeper
All remaining services, in any order or at the same time

Changes on Application environment

Change	Environment Variable Name	Application Default Value (if env variable unset)	Example	Required	Applications	Short Description
Added	`OPENAI_PROXY_EXTRA_ALLOWED_ROUTES`	`-` (built-in allowlist only)	`POST /images/generations,POST /v1/embeddings`	false	`backend-service-chat`, `unique-api`	Comma-separated `METHOD /path` routes added to the OpenAI proxy allowlist https://unique-ch.atlassian.net/wiki/x/RgBKo?xpis=eyJicmlkZ2UiOiJzbWFydExpbmtzIiwiaWQiOiIxNzkxODA4NjA5NzY3Iiwic291cmNlIjoiY29uZmx1ZW5jZSJ9
Added	`ANTHROPIC_PROXY_EXTRA_ALLOWED_ROUTES`	`-` (built-in allowlist only)	`POST /v1/messages/batches`	false	`backend-service-chat`, `unique-api`	Comma-separated `METHOD /path` routes added to the Anthropic proxy allowlist; https://unique-ch.atlassian.net/wiki/x/RgBKo?xpis=eyJicmlkZ2UiOiJzbWFydExpbmtzIiwiaWQiOiIxNzkxODA4NjA5NzY3Iiwic291cmNlIjoiY29uZmx1ZW5jZSJ9
Added	`FEATURE_FLAG_CHAT_PINNING_UN_22473`	`true`	`false`	false	`backend-service-configuration`	Pinned chats in the chat list. On by default; set to `false` to turn it off.
Added	`FEATURE_FLAG_ENABLE_EMBEDDED_APP_UN_26694`	`false`	`true`	false	`backend-service-configuration`	Enables Embedded App spaces. Also requires `EMBEDDED_FRAME_URL_ALLOWLIST`.
Added	`FEATURE_FLAG_ENABLE_CONDUCT_MODEL_SELECTION_UN_26651`	`false`	`true`	false	`backend-service-configuration`	Lets admins set a default model, switchable models and effort levels per Conduct space.
Added	`FEATURE_FLAG_GPT_51_LIMITS_BANNER_UN_26126`	`false`	`true`	false	`backend-service-configuration`	Shows a warning in Conduct chats running on GPT-5.1.
Added	`FEATURE_FLAG_AGENTIC_TABLE_FILTER_SEARCH_SELECTION_UN_24533`	`false`	`true`	false	`backend-service-configuration`	Adds “Select all search results” to Agentic Table column filters.
Added	`FEATURE_FLAG_ENABLE_EXTRACTED_METADATA_EMBEDDING_UN_25708`	`false`	`true`	false	`backend-service-configuration`	Embeds LLM-extracted metadata with each chunk on first ingestion. Also requires `FEATURE_FLAG_ENABLE_AGENTIC_METADATA_EXTRACTION_UN_15619`.
Changed	`FEATURE_FLAG_ENABLE_SHARED_CHATS_UN_19869`	`true` (was `false`)	`false`	false	`backend-service-configuration`	Shared Chats are on by default and the company sharing policy defaults to `spaceMembers`. Explicit overrides are kept.
Changed	`FEATURE_FLAG_ENABLE_NEW_KB_UI_UN_17151`	`true` (was `false`)	`false`	false	`backend-service-configuration`	New Knowledge Base interface on by default; set to `false` to keep the previous interface. Knowledge Base for End Users
Added	`EMBEDDED_FRAME_URL_ALLOWLIST`	`-` (no sites allowed)	`https://portal.example.com`	true, if Embedded App spaces are enabled	`web-app-chat` `web-app-admin` `backend-service-chat`	Space-separated HTTPS origins that Embedded App spaces may show; each entry also allows its subdomains. Set the same value on all three services. The framed app must list Unique in its own `frame-ancestors`.
Added	`PUBSUB_REDIS_ENABLE_TLS`	`false`	`true`	false	`backend-service-chat` `backend-service-configuration`	Use TLS for a standalone Redis on any port. Port 6380 still implies TLS.
Added	`REDIS_ENABLE_TLS`	`false`	`true`	false	`activity-records`	Same as `PUBSUB_REDIS_ENABLE_TLS`, for activity-records.
Added	`EXPIRED_CONTENT_BACKFILL_MAX_ROUNDS`	`-` (disabled)	`10`	false	`backend-service-ingestion`	Rounds per retention job run that fully remove chat files expired under older versions. Each round removes up to `EXPIRED_CONTENT_DELETION_PAGE_SIZE` rows (default `100`).
Added	`OPENAI_PROXY_FILE_UPLOAD_TIMEOUT_MS`	`30000`	`60000`	false	`backend-service-chat`	Timeout for file uploads to Code Execution containers; a stalled upload fails and is retried.
Added	`SCOPE_MANAGEMENT_URL`	`-`	URL of `backend-service-scope-management`	true, for Microsoft Purview (MIP) protected files	`backend-service-ingestion-worker` `backend-service-ingestion-worker-chat`	Needed to decrypt protected files with the uploader’s rights. See the Entra permission change below.
Removed	`INGESTION_DEAD_LETTER_QUEUE_ENABLED`	-	-	-	`backend-service-ingestion`	No longer has any effect and can be deleted. See the dead-letter queue note below.
Added	`FEATURE_FLAG_AGENTIC_TABLE_BULK_ADD_TO_LIBRARY_UN_26240`	`false`	`false`	false	`backend-service-configuration`	Bulk add verified rows to the Answer Library in Agentic Tables

Other changes for operators

Allowed-model list: companies that set UNIQUEAI_ALLOWED_MODELS on backend-service-chat must add litellm:anthropic-claude-sonnet-5-5, litellm:vertex-claude-sonnet-5-5, litellm:openai-gpt-6.1-sol and AZURE_GPT_61_SOL_2026_0929 to offer the new models in Unique AI, and must allow GPT 5.6 Sol and GPT 5.6 Terra, or spaces moved off the retiring o-series models are blocked.

Microsoft Purview Changes only apply to clients that have MIP_DECRYPTION_ENABLED set to true or intend to ingest Microsoft Protected Documents.

Microsoft Purview (MIP) protected files: the Entra app of backend-service-ingestion-worker needs the Content.DelegatedReader permission instead of Content.SuperUser, and the worker needs SCOPE_MANAGEMENT_URL. Files are decrypted with the rights of the user who uploaded them.