Tanium Cloud Deploy Updates & Release Notes

Security update

This release includes security updates. Details of the issue, including affected versions, and mitigation information, can be obtained within Tanium's Community site, or by contacting support.

Improvements

• Improved performance of software package list page.
• Improved how quickly content set name changes appear. A renamed content set now shows its new name within 60 seconds.
• Through the Deploy API, an Atlas automatic deployment configuration can now use a single rule that keeps all eligible software from the Deploy software gallery up to date, with Deploy adding and removing titles as the gallery changes.
• Compressed the software catalog collection, reducing the download size of the software catalog on endpoints.
• Added support for macOS to the Deploy - Self Service Profiles sensor.
• Updated automatic deployments to only be created for applicable software packages.
• Added antibody-software.com, diskanalyzer.com, dl3.xmind.app, fastdl.mongodb.org, updates.liquidfiles.com, bdefs.threattrack.com, downloads.printercloud.com, swupdate.lens.poly.com, dl.eviware.com, desktop.miro.com, downloads.pdf-xchange.com, www.eposaudio.com, download01.logi.com, and downloads.thousandeyes.com to egress allow list.
• Added software package gallery setting to allow for auto importing only when the package is applicable in the environment.
• Added software package applicability counts when retrieving automatic deployment configurations.
• Added an optional parameter to the software package gallery routes that returns applicability counts for each package.
• Updated error message to 400 instead of 500 when creating or updating an automatic deployment configuration without a deploymentPlanId.
• Added a not-applicable status to the automatic deployment configuration views for packages with no applicable endpoints in the target. The status appears as "No applicable endpoints in target" and can be filtered on.

Resolved issues

• Fixed an issue where Atlas could not create Deploy deployments because the deployment-creation route was missing from the Atlas route tree.
• Fixed an issue in the Create Software Package form where inspecting certain MSI installers would fail.
• Fixed an issue where some Windows sensors would emit garbled output if the output had non-ASCII characters.
• Fixed an issue where the Initialization status stayed "Not Initialized" after saving Deploy settings.
• Fixed an issue where adding an operating system with a duplicate name or a missing platform displayed "Request failed with status code 409" or "400" instead of the server's validation message.
• Fixed an issue where per-organization catalog and configuration manifests were not published when multiple organizations were enabled.
• Fixed an issue where widgets on the Overview page briefly displayed "Unable to Load Chart Data" while the page loaded.
• Fixed an issue where the Atlas Deployments grid showed numeric computer group IDs instead of group names when more than 20 groups were involved.
• Fixed an issue where deployments created by the API would restart the endpoint if the restart flag was not explicitly set to false.
• Fixed an issue where the row-count status bar in the Atlas Deploy and Patch grids stayed blank if the first block of rows took more than one second to load.

API Version

2.51.233

Fixed the Software Packages export so it no longer fetches the entire catalog in one request, and added feedback when an export is busy or fails.

Fixed the Applicable Software Packages panel in Single Endpoint View so it shows an error instead of appearing empty when data can't be loaded.

Fixed an issue where updating a software package or software package bundle (PUT /software-packages, PUT /software-package-bundles) reset any optional field omitted from the request to its default value, which could unintentionally clear existing data such as a bundle's package list; omitted fields are now preserved.

Monthly and yearly maintenance windows that start in the evening in time zones behind UTC now show the correct day in the Tanium Console.

Fixed an issue where updating a software package with the legacy requires32BitSystem / requires64BitSystem system requirements failed validation after upgrading to 2.49.

Fixed an issue where the Deploy - Installed Applications Details sensor did not work on macOS endpoints without python3 installed.

Fixed an issue where filtering the Deployments list by search text could show an incorrect total, resulting in extra blank rows in the list.

Fixed the Upload Package Files form showing the wrong package when opened from a failed sync on a Tanium Automate deployment.

Fixed an issue where an upgrade could leave a built-in operating system under a temporary name, preventing built-in operating systems from being kept up to date.

Fixed an issue where a job could hang indefinitely due to a network outage. The job will now time out after 20 seconds and fail as expected.

Fixed an issue where Debian and Ubuntu endpoints did not answer the Deploy - Software Packages Applicability sensor.

Fixed an issue where Mac, RHEL-based Linux, and SUSE-based Linux endpoints did not include the final row when answering the Deploy - Software Packages Applicability sensor.

Fixed an issue where Deploy - Software Packages Applicability sensor did not produce output if no minimum software package ID parameter was supplied.

Fixed an issue where certain macOS applications were not reported by the Deploy - Installed Applications Details sensor.

Fixed an issue where the Deploy - Installed Applications Details sensor did not report Windows system components that Deploy can detect with installed application rules.

Fixed an issue where the Deploy - Installed Applications Details sensor did not report applications installed within the /Users folder on macOS.

The deprecated maintenance-window delete API now returns a conflict instead of a server error when the window still has targets.

Fixed an issue where the Software Packages page gathered applicability counts for the entire software catalog on every request, causing load times to grow with catalog size.

Fixed a rare issue where Installed Application Details could not report the install location for specific applications.

Resolved Issues

• Deploy API write requests that set the Tanium-API-Strict-Mode header, including those made by Atlas, no longer fail with an empty-body validation error. The following routes were impacted and are now fixed:
  • POST /v1/software-packages
  • PUT /v3/software-packages/{id}
  • POST /v2/software-package-bundles
  • PUT /v2/software-package-bundles/{id}
  • POST /v1/software-package-gallery/bulk-import
  • POST /v1/software-package-gallery/update-import-settings
  • POST /v2/maintenance-windows
  • PUT /v2/maintenance-windows/{id}
  • POST /v1/deployment-templates
  • PUT /v1/deployment-templates/{id}
  • POST /v1/default-deployment-template
  • PUT /v1/automatic-deployments/{id}
  • POST /v1/profiles
  • PUT /v1/profiles/{id}
  • PATCH /v1/profiles/{id}/software
  • POST /v1/operating-systems
  • POST /v1/tempfiles

POST/PUT v2/bundles APIs now reject bundles containing packages from multiple platforms, even when the request labels those packages as the same platform.

Users with deployment-write and bundle-read permission can now stop bundle deployments without package-execute permission, matching the existing stop behavior for package deployments.

API documentation now describes the structured validation details returned in 400 Bad Request responses, including machine-readable reason codes for each violation.

Improved performance of the Deploy - Gallery Compliance by Age sensor on Unix.

API path parameters are now consistently documented as {id} across all Deploy endpoints; no change to request URLs or behavior.

Validation errors now report every invalid field in a single response instead of only the first problem.

Older versions of several Deploy API routes are now marked deprecated in the API documentation, and each one names the version to use instead. Affected routes are v1 and v2 of the deployments endpoints, v1 through v3 of the software package endpoints, v1 and v2 of the software package gallery endpoints, and v1 of the maintenance window create, update, and delete endpoints.

Improved automatic deployment configuration retrieval and settings audit log performance under heavy load by reducing unnecessary database lock contention.

Fixed an issue where updating a software package or software package bundle reset any optional field omitted from the request to its default value, which could unintentionally clear existing data such as a bundle's package list. Omitted fields are now preserved.

Fixed an issue where a maintenance window set to Endpoint Local Time and repeating on a relative day of the month could become active at the wrong time.

Fixed an issue where a deployment whose name was blank or contained a pipe (|) could not be stopped or edited.

Fixed an issue where the effective timezone did not populate for some maintenance windows.

Fixed an issue where upgrading with unparseable data in a software package or bundle would fail the upgrade and prevent the Deploy service from starting.

Fixed Tanium Deploy API route documentation so Atlas can distinguish the software package gallery (vendor packages available to import) from imported software packages available to deploy.

Fixed a bug where the system could retry a database operation too quickly after a conflict, causing performance to degrade under heavy load.

Fixed an issue where some Deploy sensors used more endpoint resources than needed.

Fixed a crash affecting the Software Packages page when it received a high volume of concurrent requests.

Fixed an issue that could cause failure at startup if a software package had more than one revision marked current in legacy data.

Fixed an issue where filtering deployments by a single targeted computer group could return incorrect results.

Dependency updates

• Dependency updates.

Improvements

• Added SLES 16 to Deploy Supported Operating Systems.
• Added macOS 26 Tahoe to Deploy Supported Operating Systems.
• Added Ubuntu 26.04 to Deploy Supported Operating Systems.
• Added enforcement ensuring every profile software package entry specifies at least one operation (install, update, or remove).
• Added downloads.cloudflareclient.com to egress allow list.
• Added packages.openv.pn to egress allow list.
• Improved risk assessment and governance for API operations with Atlas.
• Deploy now supports Simplified Chinese for end-user notifications.
• Improved AI agent efficiency in package list API documentation.
• Improved deployment auditing reliability.
• Improved performance of software package gallery deletion.
• Improved performance of software package synchronization.
• Improved reliability of ring deployment error status tracking.
• Improved software package retrieval performance.
• Improved performance when creating or editing large software bundles.
• Improved system stability during temporary database issues.
• Improved validation and reliability of AI-assisted deployment and deployment template actions.
• Removed the overrideApproval field from the public API documentation to accurately reflect the supported API surface.
• The Deploy service account now has read and write permissions for global maintenance windows across all content sets.
• Updated API documentation to correctly represent response schemas for endpoints that return objects with no properties.
• Updated Deploy service API documentation to clarify that gallery package IDs must be imported before deployment, generating a new deployable package ID distinct from the gallery ID.
• Added a new Atlas component for browsing the Deploy software package catalog, bringing key Software Packages workbench functionality to Atlas.
• Added awscli.amazonaws.com to egress allow list.
• Added d2td7dqidlhjx7.cloudfront.net to egress allow list.
• Added desktop.figma.com to egress allow list.
• Added dl.duosecurity.com to egress allow list.
• Added download-mac.grammarly.com to egress allow list.
• Added download.oracle.com to egress allow list.
• Added downloads.claude.ai to egress allow list.
• Added downloads.typora.io to egress allow list.
• Added files2.codecguide.com to egress allow list
• Added trials.adobe.com to egress allow list.
• Added updates.talon-sec.com to egress allow list.
• Added windsurf-stable.codeiumdata.com to egress allow list.
• Added www.notion.com to egress allow list.
• Added www.tenable.com to egress allow list.
• Added downloads.screenmeet.com to egress allow list
• Fixed an issue where content set id could be updated in an active deployment

Resolved Issues

• Added validation for deployment time zone to ensure it's a valid IANA time zone.
• Fixed a 'Validation error: invalid files' error that appeared when editing or renaming an already-distributed software package.
• Fixed a UI text typo where 'Every 5 month' incorrectly appeared instead of 'Every 5 months' in scheduling settings.
• Fixed a bug where a brief database hiccup could permanently and silently stop a deployment job queue, requiring a service restart to recover.
• Fixed a bug where embedding updates could get permanently stuck and never processed after a temporary database outage.
• Fixed a bug where failed audit-log exports left file handles open and incomplete zip files on disk.
• Fixed a bug where the AEM Degradations configuration job would repeatedly fail and leave a stuck failed-job banner in the workbench.
• Fixed a bug where the ECF software-catalog audit silently missed or misreported individual package, bundle, and deletion discrepancies.
• Fixed a crash in the Deploy workbench that occurred when sorting by column header.
• Fixed a crash on the All Activity page that prevented sorting automatic deployments by product version when any software package used pre-release version strings.
• Fixed a crash on the Deployments page that could occur when sorting or filtering by the Platform or Complete columns.
• Fixed a data integrity bug where deleting a deployment template could leave orphaned records if the operation failed and was rolled back.
• Fixed a performance issue where audit log exports repeatedly resolved usernames on every page, causing unnecessary API calls and slow exports.
• Fixed a race condition where deleting a software package version could leave orphaned ADC rules and import settings behind.
• Fixed a silent database transaction bug in gallery sync that could cause package category data to become inconsistent.
• Fixed an error that occurred when stopping a ring deployment after all rings had already completed.
• Fixed an intermittent issue where a transparent overlay could get stuck on screen after creating a deployment or software bundle, blocking further clicks until the page was refreshed.
• Fixed an issue in the Create Maintenance Window form where the 'End time must be after start time' error appeared prematurely before users had a chance to adjust the end time.
• Fixed an issue where "Deploy - Software Package Catalog Icons" and "Deploy - Deployment Image Files" packages were incorrectly visible in the Tanium console.
• Fixed an issue where "Inspect MSIX to Populate Fields" failed with the error Template:Xml should have dependencies info when processing Template:.msixbundle files.
• Fixed an issue where concurrent deployment stop PUT requests returned 408 status code.
• Fixed an issue where filtering the Deployments list by search text could show an incorrect total, resulting in extra blank rows in the list.
• Fixed an issue where newly imaged endpoints could get stuck in "Initializing" status because the catalog download address didn't match the Allowed URLs list.
• Fixed an issue where removing a notification icon or body image from a deployment template did not take effect.
• Fixed an issue where ring deployment plan validation could exhaust database connections and freeze the Deploy module under concurrent load.
• Fixed an issue where temporary server unavailability could interrupt live updates for alerts, deployment status, and job progress instead of automatically reconnecting.
• Fixed an issue where the 'Clear Filters' button appeared on Profile and Maintenance Window list pages even when no filters were applied.
• Fixed an issue where updating heavily referenced software packages failed with a 403 error on Tanium Cloud due to an oversized request body.
• Fixed audit log exports to correctly handle field values containing commas, preventing data from being split across multiple columns.
• Fixed audit logs to correctly record the user who performed delete operations on profiles, maintenance windows, and enforcements.
• Fixed broken bundle links in the software package edit form when a package is used as "latest applicable" in a bundle.
• Fixed the Profile Details page to support vertical scrolling, consistent with other detail pages.
• Maintenance windows now validate that all targeted Tanium groups exist at save time, preventing silent misconfigurations and misleading permission errors.
• Security Update.
• Fixed a performance issue where the software packages catalog summary endpoint was unnecessarily loading large icon image data, significantly reducing response payload size.
• Fixed a product module installation error that was causing failures during Ambient Mode service setup.
• Fixed an issue where Deploy settings changes could fail to apply to endpoints.

Dependency updates

• Dependency updates.

Improvements

• Added SLES 16 to Deploy Supported Operating Systems.
• Added macOS 26 Tahoe to Deploy Supported Operating Systems.
• Added Ubuntu 26.04 to Deploy Supported Operating Systems.
• Added enforcement ensuring every profile software package entry specifies at least one operation (install, update, or remove).
• Added downloads.cloudflareclient.com to egress allow list.
• Added packages.openv.pn to egress allow list.
• Improved risk assessment and governance for API operations with Atlas.
• Deploy now supports Simplified Chinese for end-user notifications.
• Improved AI agent efficiency in package list API documentation.
• Improved deployment auditing reliability.
• Improved performance of software package gallery deletion.
• Improved performance of software package synchronization.
• Improved reliability of ring deployment error status tracking.
• Improved software package retrieval performance.
• Improved performance when creating or editing large software bundles.
• Improved system stability during temporary database issues.
• Improved validation and reliability of AI-assisted deployment and deployment template actions.
• Removed the overrideApproval field from the public API documentation to accurately reflect the supported API surface.
• The Deploy service account now has read and write permissions for global maintenance windows across all content sets.
• Updated API documentation to correctly represent response schemas for endpoints that return objects with no properties.
• Updated Deploy service API documentation to clarify that gallery package IDs must be imported before deployment, generating a new deployable package ID distinct from the gallery ID.

Resolved Issues

• Added validation for deployment time zone to ensure it's a valid IANA time zone.
• Fixed a 'Validation error: invalid files' error that appeared when editing or renaming an already-distributed software package.
• Fixed a UI text typo where 'Every 5 month' incorrectly appeared instead of 'Every 5 months' in scheduling settings.
• Fixed a bug where a brief database hiccup could permanently and silently stop a deployment job queue, requiring a service restart to recover.
• Fixed a bug where embedding updates could get permanently stuck and never processed after a temporary database outage.
• Fixed a bug where failed audit-log exports left file handles open and incomplete zip files on disk.
• Fixed a bug where the AEM Degradations configuration job would repeatedly fail and leave a stuck failed-job banner in the workbench.
• Fixed a bug where the ECF software-catalog audit silently missed or misreported individual package, bundle, and deletion discrepancies.
• Fixed a crash in the Deploy workbench that occurred when sorting by column header.
• Fixed a crash on the All Activity page that prevented sorting automatic deployments by product version when any software package used pre-release version strings.
• Fixed a crash on the Deployments page that could occur when sorting or filtering by the Platform or Complete columns.
• Fixed a data integrity bug where deleting a deployment template could leave orphaned records if the operation failed and was rolled back.
• Fixed a performance issue where audit log exports repeatedly resolved usernames on every page, causing unnecessary API calls and slow exports.
• Fixed a race condition where deleting a software package version could leave orphaned ADC rules and import settings behind.
• Fixed a silent database transaction bug in gallery sync that could cause package category data to become inconsistent.
• Fixed an error that occurred when stopping a ring deployment after all rings had already completed.
• Fixed an intermittent issue where a transparent overlay could get stuck on screen after creating a deployment or software bundle, blocking further clicks until the page was refreshed.
• Fixed an issue in the Create Maintenance Window form where the 'End time must be after start time' error appeared prematurely before users had a chance to adjust the end time.
• Fixed an issue where "Deploy - Software Package Catalog Icons" and "Deploy - Deployment Image Files" packages were incorrectly visible in the Tanium console.
• Fixed an issue where "Inspect MSIX to Populate Fields" failed with the error Template:Xml should have dependencies info when processing Template:.msixbundle files.
• Fixed an issue where concurrent deployment stop PUT requests returned 408 status code.
• Fixed an issue where filtering the Deployments list by search text could show an incorrect total, resulting in extra blank rows in the list.
• Fixed an issue where newly imaged endpoints could get stuck in "Initializing" status because the catalog download address didn't match the Allowed URLs list.
• Fixed an issue where removing a notification icon or body image from a deployment template did not take effect.
• Fixed an issue where ring deployment plan validation could exhaust database connections and freeze the Deploy module under concurrent load.
• Fixed an issue where temporary server unavailability could interrupt live updates for alerts, deployment status, and job progress instead of automatically reconnecting.
• Fixed an issue where the 'Clear Filters' button appeared on Profile and Maintenance Window list pages even when no filters were applied.
• Fixed an issue where updating heavily referenced software packages failed with a 403 error on Tanium Cloud due to an oversized request body.
• Fixed audit log exports to correctly handle field values containing commas, preventing data from being split across multiple columns.
• Fixed audit logs to correctly record the user who performed delete operations on profiles, maintenance windows, and enforcements.
• Fixed broken bundle links in the software package edit form when a package is used as "latest applicable" in a bundle.
• Fixed the Profile Details page to support vertical scrolling, consistent with other detail pages.
• Maintenance windows now validate that all targeted Tanium groups exist at save time, preventing silent misconfigurations and misleading permission errors.
• Security Update.
• Fixed a performance issue where the software packages catalog summary endpoint was unnecessarily loading large icon image data, significantly reducing response payload size.
• Fixed a product module installation error that was causing failures during Ambient Mode service setup.
• Fixed an issue where Deploy settings changes could fail to apply to endpoints.

Improvements

• Improved confidence score with the following changes:
  • Updated the confidence score Show additional data toggle to display Local Data and Global Data.
  • Local Data shows the results across an organization's own deployment history for a package.
  • Global Data shows the results across all endpoints that Tanium manages.
  • Added Endpoint Readiness to confidence scores.
  • Added confidence score support for custom packages.
  • For more information, see Announcing Confidence Score Updated for Tanium Deploy.

API Versions

2.48.271

Improvements

• Added confidence scores to AI routes for software packages, enabling more accurate deployment recommendations.

Resolved Issues

• Fixed an issue where execution success risk factors were sorted incorrectly in the workbench.
• Fixed a performance issue that could cause the software packages list to load slowly or intermittently fail for organizations with very large software package catalogs.
• Fixed a performance issue that could degrade Deploy service reliability.

API Versions

2.48.264

Enriched Deploy API route documentation to support Atlas AI agent integration, enabling AI assistants to discover and call Deploy endpoints reliably.

Atlas now enforces deployment safety guardrails, requiring ring or test deployments by default to reduce risk when deploying software across your endpoint estate.

Exposed Deploy MCP data handlers to the Atlas AI assistant, enabling Atlas to query and act on Deploy data directly.

Improved the AI assistant's ability to generate uninstall packages for broad use cases such as uninstalling all versions of a software title.

Updated gallery search, software package, and software bundle search tools to use locally-generated embeddings instead of external services, improving search performance and reliability.

Added embedding generation support for software packages and bundles to enable enhanced search and discovery capabilities.

Added support for DST/timezone-aware maintenance window processing to ensure maintenance windows trigger at the correct local time year-round.

Added API support for setting the effective timezone on maintenance windows.

Added an API endpoint to retrieve the module ID for a maintenance window using its global ID.

Updated Deploy API documentation to use an agent-first format for all PUT and POST routes, improving usability for API consumers and automated integrations.

Enhanced API documentation for the confidence score feature with more detailed field descriptions and a corrected enum value.

Improved Atlas AI agent accuracy by correctly annotating Deploy API routes as read-only or requiring user approval.

Added API documentation guidance recommending that bulk gallery imports be batched in chunks of approximately 50 IDs per request.

Fixed end time handling for recurring global maintenance windows to correctly use the duration property instead of a fixed end timestamp, ensuring windows recur at the right time.

Fixed validation that allowed deployments with past end times to skip package and bundle validation checks.

Disabled the POST /private/settings API endpoint for Atlas to prevent unintended modification of module settings.

Users with read-only package permissions can now upload SHA256 hash-validated files to resolve package sync errors without requiring write access.

Moved the legacy Software Installed by Self Service User Request chart to the Reporting page.

Maintenance Window targeting now lists only the computer groups an operator has permission to access.

Updated Dependencies.

Fixed an issue where changes made on the Deploy Settings page were not applied after saving.

Fixed an issue where Deploy pages failed to load for users with RBAC-scoped roles.

Fixed an issue where the Deployment Templates list page was not displaying Deployment Type, Pre-notification Restart, and Post-Notification field values.

Fixed an issue with timeouts and 408 errors when loading the Deployments page in environments with large numbers of deployments.

Fixed an issue where software deployment proposals via AI-assisted workflows failed validation when optional target group IDs were omitted.

Fixed an issue with software bundle creation failing in Atlas AI due to an incorrect field type in the API schema, and improved the validation error message to identify the specific offending field.

Fixed an issue where embedded failures that occurred when software packages or bundles referenced a deleted content set, preventing disruptions to AI-powered search.

Fixed an issue that contributed to an upgrade failure that prevented the Deploy service from starting on environments with duplicate operating system records in the database.

Fixed an issue in the enforcement service that caused duplicate group memberships, silent data corruption, and excess database load during batch operations.

Fixed an issue where packages become stuck in Tanium-managed status after disabling auto-import.

Fixed an issue that prevented setting auto-import on existing Tanium-managed packages.

Fixed an issue with package validation to improve Package Gallery ingestion reliability.

Fixed an issue where deployments, deployment templates, and automatic deployment configurations could be created with negative distribute-over-time values; these are now rejected at the API level.

Fixed an issue with spurious MSI/MSIX inspection warning banners that incorrectly appeared when editing an existing software package without uploading a new file.

Fixed an issue with inspect MSI on certain MSI files that lack system requirements information.

Fixed an issue where MSIX applications installed by individual users were not properly recognized during package inspection.

Fixed an issue with broken bundle links on the software package details page that were navigating to the wrong location.

Fixed an issue where checking cache status for a file uploaded via the v3 tempfiles API returned an incorrect result.

Fixed an issue where updating maintenance windows via the v2 API could return a 500 server error.

Fixed an issue with username display on audit log entries for profiles.

Fixed an issue with audit logging for settings for changes made through the API.

Fixed an issue with silent no-op behavior in the bulk-delete software packages API endpoint when required parameters were omitted.

Fixed an issue with ECF bundle deletion items not using correct field names following schema modernization.

Fixed an issue with validation issue where profile creation flags were incorrectly set when creating Automatic Deployment Configurations via the API.

Fixed an issue causing deployment status metrics to fail when response data exceeded the gRPC message size limit.