En

Version 5.9.1#

13.07.2026

New Sherpa Orchestrator release: Version 5.9.1.

  1. Before updating Sherpa Orchestrator, PostgreSQL and MariaDB must be migrated to the new hardened container images. The migration is performed by creating a backup, restoring the data to the new Docker volumes, and then verifying their integrity. The full upgrade and rollback procedure is described in the MariaDB and PostgreSQL guides.
  2. The Sherpa Orchestrator interface has been migrated to API v1. This standardizes data exchange between the interface and the server, improves screen stability, and provides a unified foundation for further integration development.
  3. In API v1, the pagination format for lists has changed: the page number, the number of records, and the total number of records are now returned in the meta object. GUIDs are used to access Actions, Jobs, Queues, and other objects.
  4. VNC robot connections have been improved. Now, when a VNC connection starts, Sherpa Orchestrator does not perform a preliminary check of the remote VNC port, which could interfere with connecting to servers with a single active session.
  5. The mail_check_interval setting now defines the mail polling interval in seconds. Existing values in minutes are automatically converted during the upgrade.
  6. VNC session completion has been improved. Now, upon successful completion, error, timeout, or failed connection, the VNC proxy is stopped and the remote VNC connection is force-released. The connection timeout has also been reduced to 15 seconds.

This helps free VNC sessions faster and reduces the risk of stalled connections.
7. The default VNC port has been changed. Connections to robots now use port 5901 instead of 5900. The change is reflected in robot connections, VNC Viewer, the installation wizard, and Docker documentation.
8. VNC over HTTP and HTTPS has been improved. VNC connections now go through nginx at /vnc/{port}/websockify instead of directly through port 6080.

This helps establish more stable connections to robots in environments where Sherpa Orchestrator is exposed over HTTP or HTTPS.
9. VNC fullscreen mode has been improved. When opening a remote desktop, the Sherpa Orchestrator interface no longer overlaps the connection window, and the VNC scale is recalculated more accurately after connection and window resizing.
10. Docker image security has been improved. The base images for PostgreSQL, MariaDB, and the VNC proxy have been moved to Chainguard, and the VNC proxy dependencies have been updated to address identified vulnerabilities.

This increases the security of Sherpa Orchestrator deployments.
11. The role creation and editing dialog on the Roles screen has been redesigned. Permissions are now easier to configure as a matrix by sections and actions, such as create, read, update, and delete. Bulk toggles have also been added for quickly granting or clearing permissions.

This simplifies role configuration and reduces the risk of missing a required permission.
12. On the API screen, API token handling has been improved. The token table now follows the same styling as other Sherpa Orchestrator tables.
13. The audit API now includes a diff field. The API can now store and return the structure of changes for a record; this works only for API v1.

This is useful for integrations that need to see not only that a change occurred, but also the composition of the changed data.
14. On the Resources screen, the allowed size of a text resource has been increased. The "Text" field is no longer limited to 4096 characters and now supports the size of the database text column.

This allows longer text values to be stored in resources.
15. On the Actions screen, duplicate actions have been fixed. When creating a copy of an action, the created and modified dates are now preserved in the same time zone.
16. On the Actions screen, deleting buttons in the edit dialog has been fixed.

  1. The Skills screen required for Sherpa Autopilot has been added.