2026.44 Infrastructure Changes

5 min read

Changes on Application environment

Change	Environment Variable Name	Application Default Value (if env variable unset)	Example	Required	Applications	Short Description
Changed	`FEATURE_FLAG_ENABLE_CONDUCT_MODEL_SELECTION_UN_26651`	`true` (was `false`)	`false`	false	`backend-service-configuration`	Model and effort choice per Conduct space is on by default. Set a company override of `false` to opt a company out.
Removed	`FEATURE_FLAG_ENABLE_MCP_UN_11963`	-	-	-	`backend-service-configuration`	MCP is always on. The flag has no effect and can be deleted.
Removed	`FEATURE_FLAG_ENABLE_MCP_HUB_UN_17188`	-	-	-	`backend-service-configuration`	Replaced by `COMPANY_CONFIGURATION_MCP_HUB_VIRTUAL_SERVERS_ENABLED`.
Added	`COMPANY_CONFIGURATION_MCP_HUB_VIRTUAL_SERVERS_ENABLED`	`-` (off)	`*:true`	true, if Virtual Servers are used	`backend-service-configuration`	Seeds the company setting `mcpHubVirtualServersEnabled` (default `false`). Use `*:true` for all companies or `companyId:true;...` for single companies. Without it, the Virtual Server pages disappear from admin.
Added	`COMPANY_CONFIGURATION_API_REQUEST_USAGE_ENABLED`	`-` (off)	`*:true`	false	`backend-service-configuration`	Seeds the company setting `apiRequestUsageEnabled`: counts Public API requests per company and shows the Cost Management API Requests tab. Counting also needs RabbitMQ for `unique-api`.
Added	`FEATURE_FLAG_DUPLICATE_SPACE_AS_DRAFT_UN_25922`	`false`	`true`	false	`backend-service-configuration`	Duplicating a space creates an unpublished draft that an admin publishes with Update.
Added	`FEATURE_FLAG_AGENTIC_TABLE_TAG_QUESTION_ROWS_V1_UN_27633`	`false`	`true`	false	`backend-service-configuration`	Questions typed into an Agentic Table or added through the API get the same metadata tags as imported questions.
Added	`FEATURE_FLAG_SEARCH_PROXY_ENABLE_CUSTOM_API_UN_26736`	`false`	`true`	false	`backend-service-configuration`	Routes Customized API web searches through the Search Proxy. Needs Search Proxy routing on `ai-service-assistants-core` (`SEARCH_PROXY_BASE_URL` set).
Removed	`FEATURE_FLAG_AGENTIC_TABLE_MULTI_ASSIGNEE_DROPDOWN_UN_22198`	-	-	-	`backend-service-configuration`	The multi-assignee dropdown is always shown. The flag can be deleted.
Added	`SPEECH_STT_MODEL`	`-` (current model)	`mai-transcribe-2-streaming`	false	`backend-service-speech`	Azure Speech model used for voice input.
Added	`SPEECH_STT_MODEL_RESOURCE_ID`	`-`	Azure Speech resource id	false	`backend-service-speech`	Separate Azure Speech resource that serves `SPEECH_STT_MODEL`. Use together with `SPEECH_STT_MODEL_REGION`.
Added	`SPEECH_STT_MODEL_REGION`	`-`	Azure region	false	`backend-service-speech`	Region of the resource in `SPEECH_STT_MODEL_RESOURCE_ID`.
Added	`SPEECH_STT_MODEL_ENDPOINT_HOST`	`-`	Private endpoint host	false	`backend-service-speech`	Private endpoint of the resource that serves `SPEECH_STT_MODEL`. Takes precedence over `SPEECH_STT_MODEL_RESOURCE_ID`; the default model keeps using `SPEECH_PRIVATE_ENDPOINT_HOST`.
Added	`SPEECH_LANGUAGE_ID_MODE`	`-` (off)	`Continuous`	false	`backend-service-speech`	Detects language changes mid-dictation.
Changed	`TRANSCRIPTION_SERVICE`	unchanged	`MAI_TRANSCRIBE`	false	`backend-service-speech`	New value `MAI_TRANSCRIBE` transcribes recordings with Azure MAI-Transcribe, which applies the space’s word list.
Added	`MAI_TRANSCRIBE_ENDPOINT_HOST`	`-`	Endpoint host	true, if `TRANSCRIPTION_SERVICE=MAI_TRANSCRIBE`	`backend-service-speech`	Azure MAI-Transcribe endpoint.
Added	`MAI_TRANSCRIBE_STYLE`	`-`	`clean`	false	`backend-service-speech`	`clean` drops filler words from transcriptions.
Added	`CONDUCT_CODEX_STREAM_MAX_RETRIES`	`-` (Codex’s own retries)	`5`	false	`ai-service-assistants-core`	How often a Codex turn retries a dropped model stream. Whole number.
Added	`BENCHMARKING_EMAIL_VIA_UNIQUE_NOTIFICATIONS`	`false`	`true`	false	`benchmarking`	Sends Benchmark Space alerts as platform email digests, one per space.
Added	`ACTIVITY_RECORDS_MAX_DATA_SIZE_BYTES`	`1048576` (1 MiB)	`2097152`	false	`activity-records`	Maximum data size of one activity-record event. Oversized fields are truncated instead of dropping the event.
Added	`ACTIVITY_RECORDS_MAX_BATCH_SIZE_BYTES`	`8388608` (8 MiB)	`16777216`	false	`activity-records`	Maximum size of one published batch of activity-record events.
Added	`CUSTOM_WEB_SEARCH_API_TRUSTED_PRIVATE_HOSTS`	`[]`	`["search.corp.example"]`	false	`search-proxy`	Exact Customized API hosts allowed on private network addresses.
Added	`HTTP_CLIENT_MAX_RESPONSE_KIB`	`5120` (5 MiB)	`10240`	false	`search-proxy`	Largest single response the Search Proxy downloads.
Added	`REQUEST_LIMITS_MAX_CRAWL_RESPONSE_KIB`	`10240` (10 MiB)	`20480`	false	`search-proxy`	Total page size per crawl request.
Added	`REQUEST_LIMITS_MAX_URLS_PER_CRAWL`	`100`	`50`	false	`search-proxy`	Most URLs per crawl request.
Added	`REQUEST_LIMITS_MAX_URL_LENGTH`	`2048`	`4096`	false	`search-proxy`	Longest URL accepted in a crawl request.
Added	`REQUEST_LIMITS_MAX_TIMEOUT_SECONDS`	`120`	`60`	false	`search-proxy`	Search and crawl timeouts above this are lowered to it.
Added	`REQUEST_LIMITS_MAX_CONCURRENT_FETCHES`	`10`	`5`	false	`search-proxy`	Most pages one crawl fetches in parallel.
Added	`REQUEST_LIMITS_MAX_CONCURRENT_CRAWLS`	`4`	`2`	false	`search-proxy`	Crawls per worker at once.
Changed	`WORKERS`	`2` (was `4`)	`2`	false	`search-proxy`	Worker processes per pod.
Changed	`URL_SAFETY_ENABLED`	`true` (unchanged)	`false`	false	`search-proxy`	`false` is accepted only when all outbound traffic goes through a corporate proxy, with proxy credentials or with per-user proxy usernames for all companies.

Other changes for operators

Zitadel v4: Unique is tested with Zitadel v4.19.5, and Unique-hosted environments are moving to it. Self-hosted customers can upgrade from Zitadel v3. When you upgrade:
- PostgreSQL 14 or newer (action required). Zitadel v4 needs PostgreSQL 14 or newer. Upgrade the Zitadel database first if it runs an older version.
- Allow Zitadel to call Unique services inside your network (action required). Zitadel v4 blocks outbound calls to private IP addresses by default, which breaks its calls to Unique's scope-management service. Change Zitadel's HTTPClient.DenyList setting so it only blocks loopback and cloud metadata addresses (169.254.0.0/16), and limit Zitadel's network access with your own network policies instead.
- Plan for a longer first start. The first start of v4 migrates Zitadel's data and can take much longer than usual. Raise the timeout of your setup or migration job if it has one.
- No change for users. Users keep the current login page. Zitadel's new login UI (Login V2) is not required.
Virtual Servers (action required): deployments that had FEATURE_FLAG_ENABLE_MCP_HUB_UN_17188 on must set COMPANY_CONFIGURATION_MCP_HUB_VIRTUAL_SERVERS_ENABLED on backend-service-configuration (or the company setting mcpHubVirtualServersEnabled), otherwise the Virtual Server pages disappear from admin.
Allowed-model list: companies that set UNIQUEAI_ALLOWED_MODELS on backend-service-chat must add litellm:anthropic-claude-haiku-5-5, litellm:vertex-claude-haiku-5-5, litellm:gemini-4-argon and litellm:vertex-gemini-4-argon to offer the new models in Unique AI.
API request counting: needs RabbitMQ for unique-api (Helm value rabbitmq.enabled). Without it, requests are served but not counted.
PDF extraction: the ingestor’s PDF library was updated to patch a vulnerability. Text extraction can differ (reading order, table cell boundaries, bullet characters), so documents ingested after this release may be chunked differently.
Search tuning after large permission changes: restoring search indexing settings now retries. A failed restore logs the company and setting, counts it in ingestion_indexer_tuning_restore_failures_total (label setting) and fires the new NodeIngestionIndexerTuningRestoreFailed alert.
Helm charts: dedicated backend-service charts can resolve service dependency names and namespaces from a per-environment registry; the activity-records chart passes the top-level imagePullSecrets to intake and worker; CloudNativePG network policies sync before their database clusters, so first-time Argo CD syncs no longer stall.
Search Proxy routing: after search-proxy is deployed and ready, set internalServices.dependencies.searchProxy.enabled: true in the ai-service-assistants-core values; Helm sets SEARCH_PROXY_BASE_URL. With routing on, Google, Grounding with Bing and Vertex AI always go through search-proxy, so it needs the settings for every engine in ACTIVE_SEARCH_ENGINES.
Search Proxy network policy: the chart turns its Cilium network policy on by default, and clusters without Cilium fail to render. Turning it off needs networkPolicy.allowDisabled: true as well as networkPolicy.enabled: false.
Search Proxy resources: the chart’s default resource requests are now 1 CPU and 2 GiB of memory, with a 4 GiB memory limit.
Container images: platform, frontend, ingestion, assistant, Agentic Table and Conduct sandbox images patch published critical, high and medium vulnerabilities; the Search Proxy image patches published critical and high vulnerabilities.