Release notes (2026.10.15)

Here's what's new in the latest stable release version (2026.10.15):

New Features

External Integration

• A "Trusted client" setting has been added to the OAuth Authorization Server client editor. It records administrator-provided consent for a client managed by the same organization: signed-in users skip the consent screen, and an authorization code is issued within the configured scope and resource limits. prompt=none is also supported, so a client can check whether authorization completes without displaying any screen. It can be enabled only for clients using authorization_code, and for public clients only when every redirect URI is an https URI on a host other than a loopback address. Existing clients are unaffected because the setting is disabled by default.
• On an OAuth Authorization Server with target domain API, the consent screen now shows an [Access level to grant] selection (Read & write / Read-only) when the application requests both api:read and api:write. Read & write is preselected; if Read-only is chosen, the token is issued without api:write and write requests are rejected. The admin panel settings are unchanged.

Admin Panel

• Sidebar layout has been added. From [Environment] -> [Admin panel] -> [Sidebar layout], you can hide sidebar menu items of the admin panel, change their display names and icons, reorder them, and add folders and links. An access limit (member group or member search conditions) can be set for each layout, and among the matching layouts, only the one with the largest order is applied. Hiding an item does not change access permissions to that page.
• Log Retention Settings has added the ability to choose how long logs are kept, per site. You can select a period from 7 days to 7 years, and logs older than the retention period are deleted automatically by a deletion process that runs once a day. The setting screen is opened from the [Log retention] button at the top right of the [Operation] -> [Log management] screen, and only a superuser can save it.
• The admin panel plugin slot parameters topics_group_id and inquiry_id now accept multiple IDs (array or comma-separated), in the same way as group_id. The plugin is shown for any of the specified topic groups / inquiries.
• [Pick category with AI] and [Pick tags with AI] buttons have been added to the content editor. AI picks categories and tags based on the content you have entered and sets them in the form (the content is not saved). Tags added by AI are shown in purple.
• When adding a site from the Site list, you can now select a backup of the source site as the source. The site is created in the state at the time the backup was taken, and by running a full sync with the created site as the sync source, you can return an existing site to the state at the time of the backup. See Restoring a site from a backup for details.

Admin MCP

• The content structure management API and Admin MCP now accept publication settings (open_type / open_sta_date / open_sta_time / open_end_date / open_end_time) when creating a content structure.
• Each row in the content structure list response and the Admin MCP response now includes open_type / open_sta_date / open_sta_time / open_end_date / open_end_time (dates as YYYY/MM/DD, times as HH:MM, empty string when not set).
• Admin MCP can now save content as a draft and issue a preview token (preview URL) for a draft. A preview URL, which until now could only be issued from the [Preview] button on the content editing screen of the admin panel, can be issued and shared during a conversation with an AI agent. An error is returned if "Preview page URL" is not set in the content structure. Anyone with the issued URL can view the draft without authentication until it expires, so take care whom you share it with.
• Admin MCP can now get and update the member Extended item settings. As in the admin panel, the update permission for member detail settings is required.

API

• The FileManager::list endpoint and the Admin MCP file_manager-list tool now return size (in bytes) and update_ymdhi (last modification time in ISO 8601 format, in the site time zone) for each file, which can be used to detect differences from local files. Both are null for a symbolic link whose target is missing, and update_ymdhi is also null when the cloud storage reports no modification time. Existing response fields are unchanged.
• In the responses of content retrieval endpoints (Topics::list, Topics::details, etc.), extension items with the "Relational data selection" field setting now include label, the name of the referenced item: subject for content, inquiry_name for forms, and name1 + name2 for members. label is not included when the caller does not have permission to view member information (member reference), when the referenced member has been deleted, or when a content reference points to the record itself (the reference itself is still returned as before). See List of extension items available in the content structure for details.
• The Site::add_site endpoint now accepts mcp_client_redirect_uris in the request body. It specifies the redirect URIs registered on the OAuth Authorization Server client that is created automatically for a new site for interactive MCP connections.

Specification Changes

File upload

• The FileManager::upload, FileManager::list, and FileManager::delete endpoints now also apply the per-folder settings of the File Manager in the admin panel. When the target folder for the upload, listing, or deletion has "Groups allowed to edit" configured, the request fails with an error (403) unless the member executing the API belongs to one of those groups. On upload, in addition to the checks against the extensions allowed for the site and the folder ACL's "Allowed extensions" / "Denied extensions", a file with an image extension whose content is not an image fails with an error (400). The "Groups allowed to edit" restriction does not apply to super users. If a request that previously succeeded starts failing, review the permission settings of the target folder and the file being uploaded.
• The response returned by the Files::upload endpoint when an upload fails has changed. When the file size exceeds the endpoint's max_size (or size) setting, the endpoint returns HTTP status 413 (the error code is payload_too_large); when the file extension is not allowed, it returns HTTP status 422 (unprocessable_entity). Both cases previously returned HTTP status 200 with the details in errors, so a frontend that detects errors based on a 200 response must be changed to check the HTTP status and the error code.
• For the Files::create_temp_upload_url and Files::create_temp_upload_post endpoints, the HTTP status returned when the declared file_size exceeds the endpoint's max_size setting has changed from 422 to 413 (the error code is payload_too_large). A missing file_size or an extension that is not allowed still returns 422.

Adding and updating content

• The values that can be written to extended fields whose field setting is "Date picker" have been unified across the endpoints that add or update content (Topics::insert, Topics::update, Topics::bulk_upsert, etc.) and the management APIs. A string that can be interpreted as a date (2026-12-25, 2026-12-25T09:15:00+09:00, etc.) is saved as that date and time, and an empty string or null clears the field (null returns a required-field error for required fields). A string that cannot be interpreted as a date (unknown, 2026年12月25日, etc.) results in an input error and the record is not saved. In the public REST API, such strings previously resulted in a successful request that saved an empty value, so this behavior has changed. Frontends that send such strings must be changed to send a string that can be interpreted as a date, an empty string, or null. See What values can I send to date fields when adding/updating content via API? for details.
• In the responses of the content insert/update endpoints (Topics::insert, Topics::update) and the management APIs, notices meaning "the write succeeded but part of it was not applied" have moved from messages to a new warnings key. This covers notices such as fields that were not updated because of the "Edit restriction" field setting in a content structure, and rows skipped during CSV / JSON import. warnings is an array of strings that is included only when there is such a notice; the HTTP status and errors do not change. If you have a program that reads these notices from messages, change it to read warnings. See API Error Response for details.

Other

• An [Admin panel] group has been added under [Environment] in the admin panel sidebar. [Admin panel], [Sidebar layout], [Dashboard widget], [Admin panel plugin], and [WYSIWYG Templates] have moved from directly under [Environment] to [Environment] -> [Admin panel]. The URLs of these screens remain unchanged.
• In the File Manager Folder ACL, "Edit permission group settings" and "View permission group settings" saved with no group checked are now treated as not set, and the settings of the parent folder apply. Until now, they were treated as allowing no group. If a KurocoFiles(Restricted) folder had only the edit permission group settings configured and the view permission group settings left empty, only users in the edit permission groups could view its files until now; from now on, all logged-in users can view them unless the parent folder restricts viewing. To limit who can view the files, set the target groups in the view permission group settings. Users in the groups set in the edit permission group settings can still view the files even if they are not included in the view permission group settings.
• On the Backup screen, getting a download URL, changing the expiry date, and deleting backups are now limited to super users. Creating a backup and configuring auto backup continue to require only the update permission for Environment settings. In addition, the expiry date in the list now shows "No Expiry Date" when not set, and changing it requires selecting [Change] on each row and entering a date.
• In the Site::add_site endpoint, omitting mcp_client_redirect_uris in the request body now registers no redirect URIs on the OAuth Authorization Server client for interactive MCP connections of the new site. Until now, the five redirect URIs for Claude.ai / ChatGPT / Cursor were registered unconditionally; this automatic registration has been removed.
• The credentials that Kuroco issues automatically when an MCP server (Kuroco API) or the Admin MCP server is configured for an AI agent can no longer create AI agent sessions (AiAgent::create_session) or send them messages (AiAgent::send_message). This prevents an agent from continuously launching other agents. Calls return a 403 error, and these two tools are not shown in the tool list of the client API MCP server. Retrieving sessions and message history, use with other credentials (such as a logged-in user, or an MCP client such as Claude Code that a user connects themselves), and agent launches from batches and triggers are not affected.
• Admin MCP is being improved in short cycles based on user feedback, and for the time being its specifications, such as tool names, arguments, and responses, will change frequently. Kuroco Skills are updated along with these changes. Admin MCP is intended to be used from AI agents with Kuroco Skills installed, so calling its tools directly from your own programs based on an analysis of the tool specifications may stop working with each change. Please refrain from such programmatic use.
• In Smarty templates such as custom processing and batch processing, the callbacks that can be passed to the array_filter / filter_var modifiers have been restricted to an allowed list of functions. If a function outside the list is specified for array_filter, a warning is logged, the callback is ignored, and falsy values are removed instead. If a function outside the list is specified for filter_var with FILTER_CALLBACK, a warning is logged and false is returned. Built-in filters such as FILTER_VALIDATE_* and FILTER_SANITIZE_* continue to work as before. If you have templates that pass arbitrary PHP function names as callbacks, replace them with one of the allowed functions. See array_filter and filter_var for the allowed functions.
• The Smarty plugins that create credentials (login / api_mng / api_internal / assign_api_credential / api_token) and the Smarty plugins that read secrets and site settings (secret / assign_rcms_conf / gcloud_functions_token) can now be saved only in custom functions and batch processing, and only super users can save or test them. If they were written in email templates, content structure trigger settings, extension field templates, CSS/JS, form admin notification subjects and thank-you emails (subject and body), and so on, saving that item is rejected the next time, so the processing must be moved to a custom function and called with {function} / {include}. Content editors cannot save content that contains these plugins even if they have the edit permission for custom functions and batch processing. Saving via Admin MCP requires the mcp:admin scope. The runtime behavior of processes that are already saved does not change. See Information (2026-10-15) and Smarty Plugin for details.

Bug Fixes

• Fixed an issue where, on sites with SMTP integration configured, connecting to the SMTP server failed when sending mail and the mail was not sent. An issue where sending mail failed after changing the administrator email on the SMTP integration screen and integrating again has also been fixed.
• Fixed an issue where, on sites whose API domain differs from the admin panel domain, accessing the download URL returned by a bulk download (bulk_download) endpoint returned 404.
• Fixed an issue where the Topics::waiting_for_approval_list and Topics::draft_list endpoints returned a 403 error when the specified topics_group_id included a content structure that the member did not have edit permission for. Only the pending-approval items and drafts of content structures that the member can edit are now returned.
• Fixed an issue where searching with full_text_search on content list endpoints did not find matching content when the search string contained HTML special characters such as &, <, >, ", and '.
• Fixed an issue where filtering by the publish start / end date and time (open_sta_ymdhi / open_end_ymdhi) with "not set or a comparison" conditions, such as field = null OR field <= "datetime" in filter, returned all content.
• Fixed an issue where the ImageSize / FileSize API post-processing functions returned an empty object for files whose names contain non-ASCII characters such as Japanese.
• Fixed an issue where files registered in file fields continued to be served from the CDN cache after the content was deleted.
• Fixed an issue where, in the WYSIWYG editor, replacing a YouTube video embedded in saved content with a different URL kept the original URL when saved.
• Fixed an issue where, on sites with "Change password when logging in for the first time" enabled, a member who needed to change their password was redirected to the password reset screen and could not use the admin panel after logging in to the admin panel via OAuth SP / SAML SP SSO.
• Fixed an issue where, on sites whose site name contains non-ASCII characters such as Japanese, the QR code shown on the two-factor authentication registration screen could not be read by authenticator apps on Android.

Please note that there may be minor improvements and internal processing fixes that are not listed here. Bug fixes may also be implemented in advance before the official release date.