---
title: "Platform Updates — July 22–24, 2026"
slug: "platform-update-2026-07-24"
date: "2026-07-24"
tag: "Application"
summary: "5 production image releases (1.104.0 → 1.108.0): granular per-object edX course-creation tools, searchable chat history and an Evals tab in OS, a nonce-based CSP, empty-tenant onboarding in the LMS, and Microsoft SSO plus embed-auth hardening in Auth."
author: "ibl.ai Engineering"
---

Production image releases `1.104.0` → `1.108.0` (5 releases, Jul 22–24, 2026).

| service | image / pin | version span |
|---|---|---|
| dm | `iblai-dm-pro` | `4.316.0-ai` → `4.316.1-ai` |
| lms | `iblai-lms-spa` | `0.50.0` → `0.51.0` |
| edx | `iblai-edx-pro` | `sumac.2.41.0` → `sumac.2.42.0` |
| os | `iblai-os-spa` | `0.98.6` → `0.102.2` |
| auth | `iblai-auth-spa` | `1.18.8` → `1.19.0` |

---

## `iblai-dm-pro` — `4.316.0-ai` → `4.316.1-ai`

**Granular course-creation tools for mentors.** The mentor Course Creation toolkit now exposes fine-grained tools that let an agent build and inspect an EdX course piece by piece: `push_course_outline`, `create_structural_block`, `create_html_component`, `create_multiple_choice_component`, `create_mentor_component` (optionally graded, wired into a unit), `get_unit_components`, `get_component_content`, `get_course_details` (by DB id or xblock id), and `delete_xblock`. The existing delegating tools now indicate in their descriptions that they hand the task to a subagent.

**Course outline naming is now controlled by the LLM.** `create_full_course_on_edx` pushes section, subsection, and unit names verbatim — no more automatic `Module N:` prefixes or `N.M` subsection numbering. Only the unit `type` prefix (used by the content-drafting pipeline) is still applied.

**Skills accessible in deep graph agents.** Mentor skill files are now seeded under the absolute `/skills/` path and the system prompt is rendered eagerly via `create_deep_agent(system_prompt=...)`, so skills listings are preserved alongside progressive disclosure.

**Higher recursion limit for multi-step tasks.** The graph-agent default recursion limit is now 300 (750 with deep research) to support longer multi-step workflows like full course creation.

**Safe concurrent mentor creation.** The mentor-visibility signal now serializes concurrent RBAC policy updates under `select_for_update()` inside `transaction.atomic()`, preventing resource list conflicts when multiple mentors are created at the same time in a tenant.

## `iblai-lms-spa` — `0.50.0` → `0.51.0`

**Empty-tenant course creation flow.** Tenants with no courses now get a dedicated course-creation entry point, making onboarding smoother for new platforms.

**Skills color refresh.** The skills box color has been updated to match the current design palette.

**Course content CTA buttons moved to navbar.** Action buttons for course content are now in the navigation bar for better consistency and accessibility.

## `iblai-edx-pro` — `sumac.2.41.0` → `sumac.2.42.0`

**LTI-based course creation fix.** Course creation through LTI integrations now works correctly.

**Deployment.** Run migrations in edx. After migrations, run from a CMS container:

```
./manage.py cms backfill_mentor_course_mentors
```

## `iblai-os-spa` — `0.98.6` → `0.102.2`

**Searchable chat history.** The agent sidebar now includes a searchable chats dialog with recency grouping (Today / Yesterday / Last 7 days / Last 30 days / Older), paginated results, and session title labels. The search feature is hidden from anonymous users.

**Agent evaluations UI.** A new Evals tab is available in agent settings, letting platform admins view and manage agent evaluation results directly from the admin panel.

**Agent settings tab improvements.** The agent settings view has been reorganized with an updated tab structure for better navigation.

**Nonce-based Content Security Policy.** `iblai-os-spa` now applies a nonce-based CSP via Next.js middleware, hardening inline-script protection. The `upgrade-insecure-requests` directive is only emitted when actively enforcing.

**Shareable Link toggle decoupled from embed form.** The Shareable Link toggle now operates independently of the embed-form validation state, so enabling or disabling a share link no longer requires the embed form to pass validation.

**Guided-prompts embed guard.** Guided prompts now correctly handle missing user IDs in embed mode rather than failing.

**Retrieved-document sidebar items are no longer clickable** when the underlying documents are not user-navigable.

## `iblai-auth-spa` — `1.18.8` → `1.19.0`

**Microsoft/Azure SSO icon.** The login page now shows a Microsoft icon for Microsoft and Azure SSO providers instead of a generic one.

**MCP resources picker.** A new resources picker component is available in the admin containers for browsing and selecting MCP documentation resources.

**WebSocket connection error handling.** WebSocket errors now distinguish between initial-connection failures and active-connection drops, and Sentry error reports are deferred until retry attempts are exhausted.

**Embed auth improvements.** The embedded agent widget's auth handshake now handles CSP-restricted environments correctly, and iframed embeds are no longer force-redirected during tenant resolution.

**Auth loader tenant-switch fix.** The auth-check loader now recovers correctly when a tenant switch lands inside its lock window, preventing the UI from hanging.

**Projects search spinner.** The projects list search field now shows a loading spinner while results are being fetched.