KNIME Business Hub 1.19 Release Notes

KNIME Business Hub 1.19.0

(released September 3, 2026)

Keycloak upgrade: Upgraded Keycloak to version 26.5.7.
Maintenance: Removed the keycloak-migration job from release assets, as this step is no longer necessary.
NATS controller upgrade: Upgraded NATS jetstream-controller to v0.23.0 to fix security vulnerabilities.
VirtualService headers: Configured X-Forwarded-Proto and X-Forwarded-Port headers on the Keycloak VirtualService so Keycloak detects secure requests and issues secure cookies (effective only on TLS-enabled instances).
Monitoring labels: Updated PodMonitor and ServiceMonitor labels across Helm charts to match Prometheus v0.92.1-87.10.1 in the latest kURL installer.
CRI-O support: KNIME Business Hub now supports the CRI-O container runtime (OpenShift, OKE) with Kubernetes versions later than 1.34.
(Replicated) Restore script update: The restore script has been updated to version 1.5, which is required for the 1.19.0 release.
(ArgoCD) Restore process: The restore process guide has been updated for the 1.19.0 release package.
Kubectl and Busybox version updates: Upgraded kubectl to v1.35.3 and busybox to v1.37.0 for workloads.
Secret store on Replicated clusters: The legacy Vault/OpenBao service is disabled by default. Re-enable it in the KOTS admin console if migration to the database has not completed. (see Technical Upgrade Notes)

Job pools: Executors for service deployments can now keep a configurable number of jobs preloaded and ready, instead of loading a job fresh for every incoming request. Requests are served against an already-loaded job, cutting load time out of the critical path and reducing latency. (see Documentation)
Data sovereignty for remote execution: Remote execution contexts can now be configured to control whether execution data is stored in or routed through KNIME Hub, so sensitive data never has to leave the customer-owned environment. This enables sovereign execution architectures that meet strict governance and compliance requirements. (see Documentation)
MinIO-v2 migration (Replicated kURL only): Migrating to the security-enhanced MinIO version is now supported through a dedicated KOTS configuration option. Enabling this setting triggers a Kubernetes job on the next deployment to migrate existing MinIO data automatically. Review the KOTS documentation and configuration option description for required precautions before starting the migration.
Agentic K-AI: K-AI can now explore workflows, ask clarifying questions, and build data apps.
Secret store: Microsoft interactive secrets now support OAuth scope requests during workflow execution, which may be required when working with Microsoft Fabric.

Fixed a bug where basic account information was accessible to unauthenticated users.
Fixed a bug where deleted accounts remained counted toward the account limit for a period of time after deletion.
Fixed a bug where deployments reading workflow-relative files failed after the account was renamed.
Fixed an issue in knime-keycloak-operator where incorrect ServiceMonitor port and endpoint configurations caused Prometheus targets to remain offline.