Rasa Pro Change Log
All notable changes to Rasa Pro will be documented in this page. This product adheres to Semantic Versioning starting with version 3.3 (initial version).
Rasa Pro consists of two deployable artifacts: Rasa Pro and Rasa Pro Services. You can read the change log for both artifacts below.
[3.16.2] - 2026-04-02
Rasa Pro 3.16.2 (2026-04-02)
Bugfixes
-
Fixed correction reset when a user answers the active collect slot and corrects another slot in the same turn.
CorrectSlotsCommand.create_correction_frameno longer chooses the reset step only from slots in the correction payload. It also considers the current collect-information step and picks the earlier collect step in flow order, so the stack resets to the question currently being asked instead of jumping ahead to a later slot’s collect step (which skipped validation for the new value on the active slot).
[3.16.1] - 2026-04-01
Rasa Pro 3.16.1 (2026-04-01)
Bugfixes
-
Fixed three bugs in
ConcurrentRedisLockStorethat caused anIndexError: deque index out of rangecrash in the PII anonymization and deletion cron jobs under multi-replica deployments.get_lock()now returnsNonewhen no ticket keys exist in Redis (all tickets had expired), instead of returning an emptyConcurrentTicketLockobject that caused downstream callers to crash.save_lock()now skips the Redis write when the ticket has already expired (TTL ≤ 0), preventing aResponseErrorfrom Redis.save_lock()previously passed the absolute epoch expiry timestamp as the RedisEXTTL, resulting in ticket keys that effectively never expired (~55 years). The TTL is now correctly computed as a relative duration in seconds.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.16.0] - 2026-03-26
Rasa Pro 3.16.0 (2026-03-26)
Deprecations and Removals
- Remove
HumanHandoffcommand from the codebase and default prompt templates. - Remove generic
process_outputmethod fromAgentProtocol. In ReAct / MCP agents, useprocess_tool_outputfor tool-result-based post-processing. InA2AAgent, useprocess_agent_outputmethod.
Features
-
Added
max_polling_timeandpolling_initial_delayto A2A agent configuration so polling parameters can be set per agent. Defaults remain 60 seconds and 0.5 seconds respectively when not set.To override polling for an A2A agent, set the options in the agent's configuration:
agent:
name: my_agent
protocol: A2A
# ...
configuration:
agent_card: "https://example.com/agent-card.json"
max_polling_time: 120 # max total polling time in seconds (default: 60)
polling_initial_delay: 1.0 # initial delay before first poll in seconds (default: 0.5)
# ... other configuration (timeout, max_retries, etc.) -
Added filler message support for ReAct agents via a new
enable_filler_messagesconfig flag. Filler messages are enabled by default and are streamed to the user before tool execution, with streaming capability determined by a newsupports_streamingproperty onOutputChannel.To disable filler messages for an agent, set
enable_filler_messages: falsein the agent's configuration:agent:
name: my_agent
# ...
configuration:
enable_filler_messages: false
# ... other configuration (llm, timeout, etc.) -
Implements user-scoped tracker querying and durable conversation metadata across all tracker stores. Persists
user_idandconversation_started_timestampin the tracker object to use for querying and ordering:- serialisation now omits null user_id
- deserialisation handles
JSONDecodeError - Ensures
conversation_started_timestampbackfilled on save/update for backward compatibility
Summary of tracker store changes for user-scoped retrieval of conversation trackers:
- SQL: introduces users table (sender_id→user_id, timestamp) with upsert per dialect; JOIN-based retrieval and DB-level ordering/pagination; cleanup on delete
- Redis: maintains secondary index
user_trackers:\{user_id\}(Sorted Set) for O(1) lookup; batch mget, robust deserialisation, index cleanup - Mongo: creates indices on user_id and (conversation_started_timestamp, sender_id); aggregation pipeline for ordering/pagination; restores user_id
- Dynamo: saves user_id and conversation_started_timestamp (Decimal) in update_item; GSI support (user_id-index with sort on conversation_started_timestamp) with full-scan fallback
-
Added optional
user_idparameter toDialogueStateTrackerto enable associating multiple conversations with a single end user. -
Implemented conversation lifecycle management with
ConversationInactiveand enhancedSessionEndedevents. Conversations can now be marked as inactive (resumable via user message orConversationResumedevent) or terminated (permanently ended, blocking all further updates).Added a new
session_configoptionstart_session_after_expirythat controls what happens when a session expires (based onsession_expiration_time).- When
true(default), Rasa emits aSessionStartedevent and starts a new session, ensuring backward compatibility. - When
false, expired sessions simply continue without automatically starting a new session.
- When
-
Add REST API endpoint
/users/{user_id}/trackersto retrieve all conversations for a given user.This admin endpoint provides user-scoped tracker querying with:
- Authentication: Requires token or JWT authentication
- Pagination: Supports
limitandoffsetquery parameters for efficient pagination - Event verbosity: Configurable via
include_eventsquery parameter (NONE, APPLIED, AFTER_RESTART, ALL) - Error handling: Proper validation and HTTP status codes for invalid inputs
- Performance: Database-level sorting and pagination for efficient queries with 1000+ conversations
Important: This is an admin endpoint that should be used as a proxy or in a backend service to manage what data is exposed to the client. Direct client access should be avoided to maintain security and control over sensitive user data.
Example usage:
GET /users/{user_id}/trackers?limit=50&offset=0Response format:
{
"conversations": [...],
"limit": 50,
"offset": 0
} -
Implemented Multilingual Voice AI Agents. The configuration of Automatic Speech Recognition (ASR) and Text to Speech (TTS) changes through the conversation based on the value of built-in
languageslot. For each ASR and TTS Engine, users can configure the language, model or voice to be used for each value oflanguageslot. In case of ASR Engines, reconfiguration requires a websocket reconnect. Rasa manages that on the fly to ensure that no speech is lost. The signature of certain methods in classesASR_EngineandTTS_Enginehave also changed. These methods are, init and from_config_dict. -
Implemented session-scoped conversations. Each conversation session now has a unique
session_id(UUID v4) that is automatically generated and attached to all events within that session. This enables better tracking and analytics of user sessions. Session IDs are automatically generated on session start or resume events and propagated to event metadata.Added
current_session_idfield to DialogueStateTracker. The session ID is automatically:- Generated as a UUID4 when a new session starts or resumes. Generation triggers include:
- Brand new conversations (first event on a tracker)
- SlotSet for session metadata slot
action_session_startorSessionStartedeventsConversationResumedafter inactivityUserUtteredreactivating an inactive conversation
Added
session_idto event metadata. The generated ID is automatically included in the metadata of all events created during a conversation session. - Generated as a UUID4 when a new session starts or resumes. Generation triggers include:
-
Add
timer_storeconfiguration toendpoints.ymlto enable configurable background session timer storage. -
Add MCP
_metaparameter support so you can pass user-specific data to MCP servers without exposing it to the LLM.- Configuration: Optional
meta_mapper MCP server inendpoints.ymlwith:static: Fixed key-value pairs always sent in_metafrom_slots: Slot-to-mcp key mappings; slot values are sent under the given param in_meta
- Execution: Both flow-based and agent-based MCP tool calls build and send
_metawhenmeta_mapis configured. A compatibility layer supports current MCP SDK versions that do not exposemetaoncall_tool. - Agent-based calls: For
from_slots, values are read from agent input only when the slot is present; slots that have been removed from agent input will not appear in_meta.
Example
endpoints.yml:mcp_servers:
- name: internal_api_server
url: http://internal-api:8000/mcp/
type: http
meta_map:
static:
api_version: "v2"
source: "rasa_agent"
from_slots:
- slot: user_id
param: user_id
- slot: role
param: user_roleThis replaces the need to override private Rasa methods (e.g.
execute_mcp_tool,send_message) to inject auth or context into MCP requests. - Configuration: Optional
-
Implemented Session Timer System for automatic session expiration. Conversations are now automatically marked as inactive after a configurable timeout period, supporting both single-instance and horizontally-scaled deployments.
- Timers are scheduled when a session starts and reset on each user message
- When a timer expires, a
ConversationInactiveevent is emitted - Race condition handling ensures correct behavior in multi-pod deployments
- Redis-backed storage enables timer persistence across restarts
- Automatic recovery of expired timers on server startup
- Fallback to in-memory storage during Redis outages
SessionTimerStore/SessionTimerManagerabstract base classesInMemorySessionTimerStore/InMemorySessionTimerManagerfor single-instance deploymentsRedisSessionTimerStore/RedisSessionTimerManagerfor distributed deployments
-
Implemented out-of-the-box collection of customer satisfaction.
- Added built-in
pattern_customer_satisfactionfor CSAT collection. - The pattern is triggered automatically via a link from
pattern_completedwhen users decline to continue the conversation. - It collects a
csat_scoreslot (categorical:satisfied/unsatisfied) and responds with appropriate thank-you messages. - The pattern, its responses (
utter_ask_csat_score,utter_csat_thank_you_satisfiedandutter_csat_thank_you_unsatisfied) and when the pattern is triggered are all fully customizable.
- Added built-in
-
Handle
SessionEndedevents returned from custom actions gracefully by stopping the prediction loop and flow executor when the conversation is terminated. -
Added the system action
action_handoff_metricto mark conversations as "not contained" for containment metrics. Any conversation that includes this action emits anActionExecutedKafka event and is counted as not contained. The action is a no-op; no user-visible behavior or migration is required.Updated the default
pattern_human_handoffflow to runaction_handoff_metricbeforeutter_human_handoff_not_available, so existing assistants automatically emit the metric when the human handoff pattern is used. If you have overriddenpattern_human_handoffin your flows, you can add a stepaction: action_handoff_metricat the start of that flow to include those conversations in containment metrics. -
Add support for multiple Audio Formats in Rasa. These are G.711 μ-law (legacy) along with Linear PCM 24kHz and Linear PCM 48kHz.
-
Extended support for Audio Formats, Updated Azure and Deepgram Automatic Speech Recognition (ASR) to support multiple audio formats. G.711 μ-law, Linear PCM 24kHz and Linear 48kHz. Updated Azure, Deepgram, and Cartesia Text to Speech (TTS) to support the same audio formats. Rime TTS only supports G.711 μ-law and Linear PCM 24kHz. Updated Jambonz and Audiocodes Stream Channel to use Linear PCM 24kHz audio when sending or receiving audio from the platform.
-
Add prompt templates and the corresponding model mapping for GPT-5.1 and GPT-5.2.
-
Update default models for LLM-based components:
CompactLLMCommandGenerator,SearchReadyLLMCommandGenerator,LLMBasedCommandGenerator,ContextualResponseRephraserandMCPBaseAgentwill usegpt-5.1-2025-11-13;EnterpriseSearchPolicy,LLMBasedRouter,ConversationRephraserandIntentlessPolicywill usegpt-5-mini-2025-08-07. -
Browser Audio channel uses Linear PCM 48kHz audio with ASR and TTS components. The sample rate of this encoding can be configured with
sample_rateproperty of the channel. Supported values in kHz are 8000, 24000 and 48000 Voice Inspector has been updated to receive and play Linear PCM at any of the supported sample rates. The sample rate is sent to the Voice Inspector in a handshake message. -
ReAct agent now uses the streaming LLM API and consumes the response incrementally instead of buffering the full stream. Content tokens are delivered to the user in real time when the channel supports streaming. Tool calls are executed after the stream segment completes and their results are sent in one shot. This reduces perceived latency.
-
Voice channels enforce two type of minimum gaps between bot audio: a shorter gap for regular back-to-back utterances, and a longer gap following filler messages (e.g., when streaming assistant text alongside tool calls from ReAct-style agents). After each message is sent, when the next message arrives, the channel checks the time since the last message was sent against the configured minimum delay. If more time is needed, generates silence audio for that duration, sends the silence to the stream, and then sends the next message. Consecutive turns are therefore naturally spaced.
-
Add prompt templates and the corresponding model mapping for Claude Sonnet 4.5 and Claude Sonnet 4.6.
-
Add public method
process_tool_output()inMCPBaseAgentfor implementing custom post-processing logic based on the tool results in each iteration. -
Support metadata pass-through in A2AAgent so that specialized data can be passed to the agent's backend via
AgentInput.metadatawithout being processed by the LLM. The metadata is forwarded to theMessagesent to the A2A server. -
- Add graceful cancellation of long-running A2A agent operations (both polling and streaming). When
ConversationInactiveevent is added to the tracker aftersession_expiration_timeminutes while an A2A task is in progress, the operation is now cancelled promptly instead of running until timeout. Note: This is a model breaking change. Please retrain your model. - Introduce a public method
Agent.cancel_background_tasks(sender_id)that can be used to explicitly trigger the cancellation of the background A2A processing (both streaming and polling) from other components (e.g. from custom channels). - Add a new POST
/cancel_background_tasks/<sender_id>endpoint in the REST channel that allows frontends and external systems to explicitly cancel background processing for a conversation. - Closing the Inspector browser tab now automatically cancels any in-flight A2A operations for that conversation.
- Add graceful cancellation of long-running A2A agent operations (both polling and streaming). When
-
AgentInput.metadatais now propagated to custom tool execution. Tool executors receive(args, context), whereargscontains the LLM-generated tool parameters andcontextis anAgentToolContext. The request metadata is available viacontext.metadataand it can be set by the agent in theprocess_inputmethod using theAgentInput.metadataattribute.
Improvements
-
The continue-interrupted pattern is now triggered after a knowledge (e.g. EnterpriseSearch) answer, so users are asked if they want to resume previously interrupted flows when returning from a search.
-
When an agent was interrupted and then resumed, it now gets reinvoked with the current context and a system instruction that it was interrupted and may use the new context or ask again. Previously, the agent only repeated its last message and did not run again.
-
Add
SessionPausedevent which purpose is to be triggered by external systems when a session is paused. It has the following properties:event- which is always set tosession_pausedreason- which describes why the session was pausedtimestamp- (optional) Unix timestamp, which indicates when the session was paused
If
timestampis not provided, the current Unix timestamp of the Rasa Pro server will be used.This event can be used to notify pipelines bout the pause state of a session, allowing them to take appropriate actions based on the session's status.
To use this event, external systems should trigger it when a session is paused, via
POSTconversations/<sender id>/tracker/events.Example of the payload for the POST request:
{"event": "session_paused", "timestamp": 1761232628.512342, "reason": "Widget closed"} -
Refactor Copilot response handling to support structured streaming from the agent SDK copilot and improve text content processing. The new implementation properly segments text content parts into start, delta, and end events, handles controlled predictions, and fixes buffer handling issues in the legacy copilot handler.
-
Events streamed to the event broker now include
user_idin the message payload alongsidesender_id. This allows downstream consumers to identify the end user associated with each conversation event. -
Add support to stream audio chunks from Azure Speech Service via websocket. Rasa will use streaming via websocket when response does not contain any SSML tags. If response contains any SSML tag, Rasa will default to use HTTPS to create audio chunks from Azure Speech Services. Improve interruption handling by:
- stopping stream from Azure Speech Services when interruption happens
- stopping to send audio chunks from Rasa to external voice service when interruption happens
-
Improve
action_session_startexecution to ensure it runs only once (coordinating calls from theMessageProcessorand theFlowPolicywhen it triggerspattern_session_start). -
Update eligibility and session-splitting logic for privacy cron jobs in line with the new session management improvements.
- when USER_CHAT_INACTIVITY_IN_MINUTES is unset, “new” trackers are processed based on ConversationInactive/SessionEnded events and session_id grouping (with a grace period of min_after_session_end), while “legacy” trackers without session_id fall back to a fixed 30min + min_after_session_end threshold.
- when the env var is set, time-based behavior remains but is now deprecated and applied per session.
SQL tracker store:
update()now supports a content-only path when the timestamp-based delete removes no rows (e.g. anonymization: same timestamps, content changed). In that case, the store either updates existing event rows in place where content differs or performs a full replace if event counts differ, so anonymized content is persisted correctly in a single atomic transaction.Anonymization cron job: the privacy manager now uses
update(updated_tracker)for anonymization instead of delete-then-save. SQL tracker store behavior is aligned with MongoDB, Redis and DynamoDB (overwrite semantics), and anonymization with SQL completes in one atomic operation without a separate delete/save sequence. -
Cancel timer unconditionally when a
SessionEndedevent is appended via the REST API, regardless of whetherexecute_side_effectsis requested. -
Add
model_nameto event metadata. -
Add
tool_timeoutfor MCP/ReAct agents configuration to configure tool-call timeout in seconds. -
Enabled deletion of a Studio assistant during upload. Introduced a new
--dangerously-delete-existingflag torasa studio upload. When set, any existing Studio assistant with the same name is deleted before the upload proceeds, with no interactive confirmation. -
Added logic for signaling interruptions in tts streaming. Sendind a variation of clear command to stop streaming audio and clear the buffer to prepare for the next response.
-
Added a warning log when
carry_over_slots_to_new_sessionandstart_session_after_expiryare both set tofalsein the domain session config, ascarry_over_slots_to_new_sessionhas no effect when no session boundary is created on expiry. -
Use the prompt template for
gpt-5.1-2025-11-13as new default prompt template in theCompactLLMCommandGeneratorandSearchReadyLLMCommandGenerator. -
SQL and Mongo tracker stores now slice the latest conversation session using the same boundary as other tracker stores:
ActionExecuted(action_session_start). That action is always executed by the message processor when a new session starts, whileSessionStartedmay be omitted by a custom action-session-start action. Incremental save offsets and SQL partial-fetch queries were updated to match this boundary. -
Add normalization of
AgentOutput.eventsso entries from ReAct/A2A customizations may be either RasaEventinstances or serialized event dicts; dicts are parsed into proper events before flow handling (e.g. stack metadata attachment), and invalid entries are dropped with structured error logs. -
Declared
safetensorsandkerasas optional NLU extras (pip install 'rasa-pro[nlu]'orfull), so minimal installs no longer pull them in directly.regexis also declared optional and listed under those extras for consistency withWhitespaceTokenizer, but it remains installed on most minimal installs because the base dependencytiktoken(used by the LLM stack) depends onregex.The affected code paths lazy-import
safetensorsandregex; if either package is not installed, they raiseMissingDependencyExceptionwith install instructions.kerasis only pulled in for the TensorFlow model stack (rasa.utils.tensorflow.models), so it is optional for the same minimal-install story assafetensors. -
Improved sub-agent call steps that use
exit_if: when the same ReAct agent runs again in one conversation, slots named inexit_ifare cleared so a new run does not reuse values from the last finished run. Ongoing multi-turn agent sessions (waiting for the next user message) are unchanged. -
Two improvements to
DynamoTrackerStore:- Idempotent
save(): concurrent or retried saves no longer produce duplicate events. New conversations are written viaput_itemwithattribute_not_exists(sender_id), ensuring the full tracker is stored exactly once. Subsequent saves append only new last-turn events via a conditionalupdate_itemguarded bylast_event_timestamp, which atomically rejects any append whose events are already stored — without requiring a read-before-write. - Reused boto3 resource:
boto3.resource("dynamodb")is now instantiated once in__init__asself._dynamoand shared across all methods, eliminating repeated resource construction per call. The connection pool size is configurable via themax_pool_connectionsconstructor argument (default: 50) to prevent urllib3 pool saturation under concurrent load.
- Idempotent
-
The
GET /users/{user_id}/trackersendpoint no longer replays conversation history throughDialogueStateTracker.from_dict()andcurrent_state()on every request. Each tracker store now implementsget_serialized_trackers_by_user_id(), which returns serialized event dicts directly from storage without event replay.Additional store-specific improvements included with this change:
- SQL: replaced an N+1 query loop (one
retrieve_full_trackercall per conversation) with two bulk queries — one paginateduserstable query and oneevents IN (...)fetch — eliminating query count growth with conversation volume. - Redis: orphaned sorted-set index entries are now removed in a single batched
ZREMcall instead of one call per orphan. - All stores:
current_session_idis now derived consistently from the last event's metadata rather than from stored state, correctly returningNonewhen the last event isConversationInactive.
- SQL: replaced an N+1 query loop (one
Bugfixes
-
Restarted task-oriented ReAct agents no longer exit immediately. When an agent is restarted, the previous run's user/assistant messages are now marked in the conversation so the model does not set slots from them; the system prompt instructs the agent to treat the current interaction as a fresh start for slot collection.
-
Fix potential Tensor shape mismatch error in
TEDPolicyandDIETClassifier. -
Fix bug with the missing
language_datamodule by installinglangcodeswith thedataextra dependency. -
Fixed
languageparameter in RimeTTS configuration to be passed correctly to the Rime API. Temporarily changed RimeTTS to non-streaming input mode as a workaround for a Rime API bug that impacts conversation experience; audio is now generated from the complete response at once. -
Update
mcpversion to~1.23.0to address security vulnerability CVE-2025-66416. -
Fix bug in
CommandPayloadReaderwhere regex matching did not account for list slots, leading to incorrect parsing of slot keys and values. Now, slot names and values are correctly extracted even if a list is provided. -
Previously,
DialogueStateTracker.has_coexistence_routing_slotcould incorrectly returnTruewhen the tracker was created without domain slots (i.e., usingAnySlotDict), becauseAnySlotDictpretends all slots exist. Now, the property returns False in that case, so the routing slot is only considered present if it is actually defined in the domain. -
Fix LLM prompt template loading to raise an error instead of just printing a warning when a custom prompt file is missing or cannot be read.
-
Fix
AttributeError: 'str' object has no attribute 'pop'when usingKnowledgeAnswerCommandwith tracing enabled. -
Fix
UnboundLocalErrorinE2ETestRunner._handle_fail_diffthat caused e2e tests to crash when processingslot_was_not_setassertion failures. -
Fixed button payloads with nested parentheses (e.g.,
/SetSlots(slot=value)) not being parsed correctly inrasa shell. The payload was incorrectly stripped of its/SetSlotsprefix, causing it to be treated as text instead of a slot-setting command. -
Add missing deprecation warning for legacy
RASA_PRO_LICENSEenvironment variable. Update license validation error messages to reference the actual environment variable used. -
Include response button titles in conversation history in prompts of LLM based components.
-
Fixed e2e test coverage report to correctly track coverage per flow. Each flow now appears as a separate entry with accurate coverage percentages. Additionally,
call/linksteps andcollectsteps with prefilled slots are now properly marked as visited. -
Fix DUT fails with AttributeError when running with custom CommandGenerator
-
Fix OAuth2AuthStrategy to use URL-encoded parameters with Basic Authentication to fetch access token
-
Remove config file content from endpoint read success logs to prevent sensitive data exposure.
-
The MCP task agent now includes slot changes in the agent output when the state is
INPUT_REQUIREDor when max iterations is reached. Previously, slots set via set_slot tools were updated in memory but not forwarded in the output, so they were not persisted until exit conditions were met. -
Fix race conditions in PII cron jobs by requiring a LockStore for BackgroundPrivacyManager and acquiring a per-sender_id lock while anonymization/deletion jobs read-modify-write trackers.
-
Rasa needs to check if it is in listening mode before it triggers the silence timeout watcher. Silence timeout watcher will be triggered if all are true:
- User is not speaking
- Bot is not speaking
- Rasa is in listening mode
If any of the conditions above are not true, Rasa will cancel the silence timeout watcher.
-
Channel specific silence_timeout can now be set in credentials file. Fixes the type error. If silence_timeout is not set the channel will use global value.
-
Stop silence timeout immediately when interruption is detected.
-
When an A2A task has status
input_required, Rasa now populatesAgentOutput.structured_resultsfrom bothtask.artifactsand DataParts intask.status.message.parts. Previously only the text message was returned and structured data was omitted, so clients can now process artifact data when the agent is waiting for user input. -
Fix PII redaction of user or bot messages when slot values do not match the original message text. This can occur when the original messages are multi-line or TTS-style bot read-backs.
-
Update setuptools to 80.10.2 to address vulnerability https://osv.dev/vulnerability/DEBIAN-CVE-2026-23949. Replaced randomname with duoname (no dependencies) library.
-
Fixed the backend tracing wrapper (e.g., Jaeger or OTLP) around send_message to correctly forward the output_channel argument to the underlying implementation.
-
When an agent or MCP tool call returns a fatal error (e.g. internal server error), the user no longer receives two bot messages. Previously both the internal error message ("Sorry, I am having trouble with that...") and the flow-cancelled message ("Okay, stopping...") were shown. Now only the internal error message is shown; the cancel pattern is not pushed for system-initiated failures, so the flow is still marked ended for tracking but the confusing cancel utterance is omitted.
-
Add rephrase endpoint validation by treating defaults-only misconfiguration as warning and user-defined rephrase misconfiguration as error.
-
Issue a warning when ASR and TTS
language_mapis missing languages fromadditional_languageproperty read fromconfig.yml. -
Fixed replay-safe latest-session handling for all built-in tracker stores. Tracker store
retrievemethod usesget_latest_replay_safe_session_tracker, widening the replay prefix when stack patches cannot be applied on the latest-session slice alone. -
Fixed
default_languageraisingRasaException("No default language configured")even whenlanguage:was properly set inconfig.yml. It happened when thelangaugeslot was reset (set toNone). -
Improved OpenTelemetry histograms for MCP agent LLM usage:
mcp_agent_llm_prompt_token_usageandmcp_agent_llm_response_durationnow record a consistent, call-scoped set of attributes (agent_name,execution_context, andprotocol_type), making metrics easier to aggregate. -
Fixes Implemented:
-
Both default and customized
action_session_startnow raise a Rasa exception when the session is already started for the current message. This exception is caught and handled byMessageProcessorwhich appendsActionExecutionRejectedevent and continues processing the message. This ensures that the message processing flow is not interrupted by the exception and allows for proper handling of the session start action. This change was required to avoid generating new session ids when this action is executed multiple times in the same time-bound tracker session. -
Fix conversation stalling when a flow contains an explicit
action_session_startstep and the session is already started for the current message.
- The root cause explanation: The attempt to execute
action_session_starta 2nd time for an existing session is rejected. The action execution rejection propagates to the DefaultPolicyPredictionEnsemble, which zeroes out action_session_start's confidence across all policy predictions. Since FlowPolicy only predicted that one action (with confidence 1.0), zeroing it leaves only the default action_listen at 0.0. - The fix: detect this condition in FlowPolicy and skip the step immediately, letting FlowPolicy continue the loop and return the actual next flow step's action.
-
-
Fixed empty assistant bubbles in Socket.IO channels (including Inspector) when the model returned whitespace-only or paragraph-only text. Non-streaming LLM responses are now stripped before send and blank segments from
\n\nsplitting are no longer emitted. -
Fixed three bugs in
DynamoTrackerStore:JsonPatchConflicton tracker retrieval: duplicate events appended by concurrent or retriedsave()calls causedjsonpatchto attempt operations on already-mutated dialogue stack fields (e.g. removingframe_typea second time), raising an unhandled exception. Duplicate events are now removed on load via_deduplicate_events(), which deduplicates by full event content to safely handle multiple legitimate events sharing the same timestamp.- Event accumulation across trackers in
get_trackers_by_user_id:events_with_floatswas declared outside the per-item loop in_process_dynamodb_items, causing each reconstructed tracker to accumulate all preceding trackers' events. Each tracker now gets its own isolated events list. - Pre-
UserUtteredevents lost on first save:save()only appended last-turn events (from the latestUserUtteredtimestamp onwards), so events emitted before the first user message — such asaction_session_start,session_started, and initialslotevents — were never persisted for new conversations. First saves now useput_itemto store the complete tracker state.
-
Upgrade
langsmithdependency to 0.6.3 to address CVE-2026-25528.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.15.19] - 2026-04-02
Rasa Pro 3.15.19 (2026-04-02)
Improvements
-
Declared
safetensorsandkerasas optional NLU extras (pip install 'rasa-pro[nlu]'orfull), so minimal installs no longer pull them in directly.regexis also declared optional and listed under those extras for consistency withWhitespaceTokenizer, but it remains installed on most minimal installs because the base dependencytiktoken(used by the LLM stack) depends onregex.The affected code paths lazy-import
safetensorsandregex; if either package is not installed, they raiseMissingDependencyExceptionwith install instructions.kerasis only pulled in for the TensorFlow model stack (rasa.utils.tensorflow.models), so it is optional for the same minimal-install story assafetensors. -
Improved sub-agent call steps that use
exit_if: when the same ReAct agent runs again in one conversation, slots named inexit_ifare cleared so a new run does not reuse values from the last finished run. Ongoing multi-turn agent sessions (waiting for the next user message) are unchanged.
Bugfixes
-
When an agent or MCP tool call returns a fatal error (e.g. internal server error), the user no longer receives two bot messages. Previously both the internal error message ("Sorry, I am having trouble with that...") and the flow-cancelled message ("Okay, stopping...") were shown. Now only the internal error message is shown; the cancel pattern is not pushed for system-initiated failures, so the flow is still marked ended for tracking but the confusing cancel utterance is omitted.
-
Add rephrase endpoint validation by treating defaults-only misconfiguration as warning and user-defined rephrase misconfiguration as error.
-
Improved OpenTelemetry histograms for MCP agent LLM usage:
mcp_agent_llm_prompt_token_usageandmcp_agent_llm_response_durationnow record a consistent, call-scoped set of attributes (agent_name,execution_context, andprotocol_type), making metrics easier to aggregate. -
Upgrade
langsmithdependency to 0.6.3 to address CVE-2026-25528. -
Fixed three bugs in
ConcurrentRedisLockStorethat caused anIndexError: deque index out of rangecrash in the PII anonymization and deletion cron jobs under multi-replica deployments.get_lock()now returnsNonewhen no ticket keys exist in Redis (all tickets had expired), instead of returning an emptyConcurrentTicketLockobject that caused downstream callers to crash.save_lock()now skips the Redis write when the ticket has already expired (TTL ≤ 0), preventing aResponseErrorfrom Redis.save_lock()previously passed the absolute epoch expiry timestamp as the RedisEXTTL, resulting in ticket keys that effectively never expired (~55 years). The TTL is now correctly computed as a relative duration in seconds.
-
Fixed correction reset when a user answers the active collect slot and corrects another slot in the same turn.
CorrectSlotsCommand.create_correction_frameno longer chooses the reset step only from slots in the correction payload. It also considers the current collect-information step and picks the earlier collect step in flow order, so the stack resets to the question currently being asked instead of jumping ahead to a later slot’s collect step (which skipped validation for the new value on the active slot). -
When interruptions are ENABLED, user message should be queued for processing only if it passes interruption criteria.
[3.15.18] - 2026-03-16
Rasa Pro 3.15.18 (2026-03-16)
Bugfixes
- Restarted task-oriented ReAct agents no longer exit immediately. When an agent is restarted, the previous run's user/assistant messages are now marked in the conversation so the model does not set slots from them; the system prompt instructs the agent to treat the current interaction as a fresh start for slot collection.
- When an A2A task has status
input_required, Rasa now populatesAgentOutput.structured_resultsfrom bothtask.artifactsand DataParts intask.status.message.parts. Previously only the text message was returned and structured data was omitted, so clients can now process artifact data when the agent is waiting for user input. - Fix PII redaction of user or bot messages when slot values do not match the original message text. This can occur when the original messages are multi-line or TTS-style bot read-backs.
- Update setuptools to 80.10.2 to address vulnerability https://osv.dev/vulnerability/DEBIAN-CVE-2026-23949. Replaced randomname with duoname (no dependencies) library.
- Fixed the backend tracing wrapper (e.g., Jaeger or OTLP) around send_message to correctly forward the output_channel argument to the underlying implementation.
[3.15.17] - 2026-03-11
Rasa Pro 3.15.17 (2026-03-11)
Deprecations and Removals
- Removed an explicit deprecation warning for the license varible
RASA_PRO_LICENSEto provide clarity that we will continue to support both this and the newerRASA_LICENSEvariable for the forseeable future.
Bugfixes
-
Fixes MCP tool result handling to now process results that contain only
structuredContent(and no or emptycontent). Previously, an emptycontentfield caused the result to be skipped and slots were not set fromstructuredContent. -
Downgraded the A2A polling "waiting to poll again" log from ERROR to INFO so normal polling no longer triggers false alerts.
-
SQL tracker store:
update()now supports a content-only path when the timestamp-based delete removes no rows (e.g. anonymization: same timestamps, content changed). In that case, the store either updates existing event rows in place where content differs or performs a full replace if event counts differ, so anonymized content is persisted correctly in a single atomic transaction.Anonymization cron job: the privacy manager now uses
update(updated_tracker)for anonymization instead of delete-then-save. SQL tracker store behavior is aligned with MongoDB, Redis and DynamoDB (overwrite semantics), and anonymization with SQL completes in one atomic operation without a separate delete/save sequence. -
Prevent
JsonPatchConflictexceptions raised when tracker is split in sub-sessions during PII anonymization cron jobs. Replace usage of a utility function that was recreating tracker objects using sub-sessions with an approach retrieving list of events for each sub-session instead.
[3.15.16] - 2026-03-06
Rasa Pro 3.15.16 (2026-03-06)
Bugfixes
- When a flow had Agent A → flow steps → Agent B and the user restarted Agent A while Agent B was already started (then interrupted), execution after the restarted Agent A completed would jump back to Agent B and skip the flow steps between A and B. Flow steps between agents are now executed correctly, and the previously interrupted Agent B is resumed instead of started from scratch.
- Channel specific silence_timeout can now be set in credentials file. Fixes the type error. If silence_timeout is not set the channel will use global value.
[3.15.15] - 2026-03-03
Rasa Pro 3.15.15 (2026-03-03)
Bugfixes
-
- Kafka event broker background polling thread caused test hangs and didn't allow the process to exit: The background poll thread is now a daemon thread, so the process can terminate when the broker is not closed explicitly (e.g. in tests or after an abrupt exit). The
close()method uses a 5-second join timeout so it does not block forever if the poll thread is stuck (e.g. when the broker is unreachable). - Background polling: The poll loop now runs for the whole lifetime of the broker, even before the producer is created. When the producer is not ready, the loop sleeps briefly instead of exiting. This allows the IAM OAuth callback to be triggered when using SASL_SSL with AWS IAM (MSK), so tokens can be refreshed as the library calls
poll(). - Connection keepalive (optional): New broker options
socket_keepalive_enable,reconnect_backoff_ms,reconnect_backoff_max_ms, andtopic_metadata_refresh_interval_mslet you reduce idle connection drops. Whensocket_keepalive_enableis true, these are passed to the underlying producer.
- Kafka event broker background polling thread caused test hangs and didn't allow the process to exit: The background poll thread is now a daemon thread, so the process can terminate when the broker is not closed explicitly (e.g. in tests or after an abrupt exit). The
-
Fixes race conditions in PII cron jobs by requiring a LockStore for BackgroundPrivacyManager and acquiring a per-sender_id lock while anonymization/deletion jobs read-modify-write trackers.
Implemented measures to defend against JSON patch issues and ensure correct event order.
- Deletion cron job: When reconstructing the tracker from retained events after deleting old sessions, the deletion
job now catches
JsonPatchExceptionandJsonPointerException(e.g. from invalid or inconsistent dialogue stack updates). On failure, the tracker is left unchanged and an error is logged instead of overwriting or deleting data, so no data loss occurs. Users can resolve stack-related issues by appending aRestartedevent to the tracker if needed. - Anonymization cron job: Events from already-anonymized, processed, and ineligible sessions are now sorted by timestamp before rebuilding the tracker, with original index used as a tie-breaker when timestamps are identical. This keeps replay order chronologically consistent and ensures dialogue stack updates and other order-dependent events are applied in the correct sequence.
- Deletion cron job: When reconstructing the tracker from retained events after deleting old sessions, the deletion
job now catches
-
ReAct agents now filter conversation events to user and bot utterances before building assistant and user role messages, and the default context limit is 10 utterance messages. Previously, the last 20 events were taken first and then filtered, so fewer user and assistant messages were included in the context.
[3.15.14] - 2026-02-26
Rasa Pro 3.15.14 (2026-02-26)
Bugfixes
- The MCP task agent now includes slot changes in the agent output when the state is
INPUT_REQUIREDor when max iterations is reached. Previously, slots set via set_slot tools were updated in memory but not forwarded in the output, so they were not persisted until exit conditions were met.
[3.15.13] - 2026-02-25
Rasa Pro 3.15.13 (2026-02-25)
Bugfixes
- Upgraded
litellmto 1.81.15 so thatstrict: Truecan be passed to Bedrock and tool calling has the same guarantees as with OpenAI. Upgradedopenaito >=2.8.0 to satisfy litellm's dependency. - Unquoted environment variable references for MCP and A2A OAuth credentials (
client_id,client_secret) inendpoints.ymlare now accepted. Previously, training failed unless these values were wrapped in double quotes (e.g."${MCP_CLIENT_SECRET}"). - Move MCP task agent exit condition evaluation to after
process_output, so thatSlotSetevents added by customprocess_outputimplementations are considered when checkingexit_ifconditions.
[3.15.12] - 2026-02-23
Rasa Pro 3.15.12 (2026-02-23)
Bugfixes
-
E2E fixture resolution and conftest hierarchy:
Fixture resolution now uses a conftest-style hierarchy, with local overrides taking precedence over global fixtures. This is a change from the previous behavior where all fixtures were merged into a single list, which could lead to silent data loss if duplicate fixture names were used. Now, every test case has its own resolved set of fixtures, and duplicate fixture names are allowed when the intent is "override".
Details:
- Conftest-style hierarchy: Fixtures can be defined at root or folder level (e.g.
conftest.yml/conftest.yaml); all e2e tests under that path see them. - Single-file run parity: Running one test file resolves fixtures the same way as when that file is run as part of the full suite (global/conftest fixtures are loaded for that file’s path).
- Runtime namespace: Each test case has its own resolved set of fixtures; there is no shared mutable fixture state between tests. Duplicate fixture names in different files are allowed when the intent is “override” (no need to remove or rename for full-suite runs).
- Override semantics: Local (file-level) fixtures override folder-level; folder-level overrides root. Within a single file, duplicate fixture names remain an error.
- Conftest-style hierarchy: Fixtures can be defined at root or folder level (e.g.
-
Update cryptography dependency to 46.0.5 to address CVE-2026-26007. Update pillow dependency to 12.1.1 to address CVE-2026-25990. Update pyasn1 dependency to 0.6.2 to address CVE-2026-23490. Update python-multipart dependency to 0.0.22 to address CVE-2026-24486.
[3.15.11] - 2026-02-18
Rasa Pro 3.15.11 (2026-02-18)
Bugfixes
- Upgrade
litellmto 1.80.0. - Remove config file content from endpoint read success logs to prevent sensitive data exposure.
- Update
protobufto v5.29.6 to address CVE-2026-0994. Updatewheelto v0.46.3 to address CVE-2026-24049.
[3.15.10] - 2026-02-10
Rasa Pro 3.15.10 (2026-02-10)
Improvements
- Flows can now link to
pattern_search(e.g. to trigger RAG or branch on knowledge-based search).
Bugfixes
- Added interruption handling for final transcripts. Moved interruption check to eliminate interruption handling delay.
- Fix Enterprise Search Policy triggering
utter_ask_rephraseinstead ofutter_no_relevant_answer_foundwhen the vector store search returns no matching documents. Thepattern_cannot_handlenow correctly receives thecannot_handle_no_relevant_answeras acontext.reasonin all cases where no relevant answer is found, not only when the optional relevancy check rejects the answer.
[3.15.9] - 2026-02-05
Rasa Pro 3.15.9 (2026-02-05)
Bugfixes
- Upgrade Keras to 3.12.1 to address CVE-2026-0897.
- Fixed
languageparameter in RimeTTS configuration to be passed correctly to the Rime API. Temporarily changed RimeTTS to non-streaming input mode as a workaround for a Rime API bug that impacts conversation experience; audio is now generated from the complete response at once.
[3.15.8] - 2026-01-26
Rasa Pro 3.15.8 (2026-01-26)
Bugfixes
- Update azure-core to 1.38.0 to address CVE-2026-21226.
[3.15.7] - 2026-01-21
Rasa Pro 3.15.7 (2026-01-21)
Bugfixes
- Fixed e2e test coverage report to correctly track coverage per flow. Each flow now appears as a separate entry with accurate coverage percentages. Additionally,
call/linksteps andcollectsteps with prefilled slots are now properly marked as visited. - Fix OAuth2AuthStrategy to use URL-encoded parameters with Basic Authentication to fetch access token
[3.15.6] - 2026-01-15
Rasa Pro 3.15.6 (2026-01-15)
Bugfixes
- Fixed an issue where storing documents in FAISS individually could hit the token limit. Now, documents are stored in batches to avoid exceeding the token limit.
- Throw error when duplicate fixtures are found in the same file or across files.
SessionEndeddoes not reset the tracker anymore.- Updated
werkzeug,aiohttp,filelock,fonttools,marshmallow,urllib3andlangchain-coreto resolve security vulnerabilities.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.15.5] - 2025-12-29
Rasa Pro 3.15.5 (2025-12-29)
Bugfixes
- Include response button titles in conversation history in prompts of LLM based components.
- Fix OpenTelemetry exporter
Invalid type <class 'NoneType'> of value Noneerror when recording the request duration metric for requests made from Rasa server to the custom action server. This error occurred because the url parameter was not being passed to the method that records the request duration metric, resulting in a NoneType value. - Fix DUT fails with AttributeError when running with custom CommandGenerator
[3.15.4] - 2025-12-19
Rasa Pro 3.15.4 (2025-12-19)
Bugfixes
- Fixed token expiration validation failing on servers running in non-UTC timezones. Token expiration checks now use timezone-aware UTC datetimes consistently, preventing premature "access token expired" errors on systems in timezones like UTC+8.
[3.15.3] - 2025-12-11
Rasa Pro 3.15.3 (2025-12-11)
Bugfixes
- Fix potential Tensor shape mismatch error in
TEDPolicyandDIETClassifier. - Update
mcpversion to~1.23.0to address security vulnerability CVE-2025-66416. - Fix bug in
CommandPayloadReaderwhere regex matching did not account for list slots, leading to incorrect parsing of slot keys and values. Now, slot names and values are correctly extracted even if a list is provided. - Previously,
DialogueStateTracker.has_coexistence_routing_slotcould incorrectly returnTruewhen the tracker was created without domain slots (i.e., usingAnySlotDict), becauseAnySlotDictpretends all slots exist. Now, the property returns False in that case, so the routing slot is only considered present if it is actually defined in the domain. - Fix LLM prompt template loading to raise an error instead of just printing a warning when a custom prompt file is missing or cannot be read.
- Fix
AttributeError: 'str' object has no attribute 'pop'when usingKnowledgeAnswerCommandwith tracing enabled. - Fix
UnboundLocalErrorinE2ETestRunner._handle_fail_diffthat caused e2e tests to crash when processingslot_was_not_setassertion failures. - Fixed button payloads with nested parentheses (e.g.,
/SetSlots(slot=value)) not being parsed correctly inrasa shell. The payload was incorrectly stripped of its/SetSlotsprefix, causing it to be treated as text instead of a slot-setting command. - Add missing deprecation warning for legacy
RASA_PRO_LICENSEenvironment variable. Update license validation error messages to reference the actual environment variable used.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.15.2] - 2025-12-04
Rasa Pro 3.15.2 (2025-12-04)
Bugfixes
- Fix agentic prompt template to access slots directly.
- Disable LLM health check for Enterprise Search Policy when generative search is disabled (i.e. use_generative_llm is False).
- Fix deduplication of collect steps in cases where the same slot was called in different flows.
- Cancel active flow before triggering internal pattern error during a custom action failure.
- Fix bug with the missing
language_datamodule by installinglangcodeswith thedataextra dependency.
[3.15.1] - 2025-12-02
Rasa Pro 3.15.1 (2025-12-02)
Bugfixes
- Raise validation error when duplicate slot definitions are found across domains.
- Raise validation error when a slot with an initial value set is collected by a flow collect step
which sets
asks_before_fillingtotruewithout having a corresponding collect utterance or custom action. - Update
pipto fix security vulnerability. - Fix AgentToolSchema._ensure_property_types() correctly preserves structural keywords ($ref, anyOf, oneOf, etc.)
Miscellaneous internal changes
Miscellaneous internal changes.
[3.15.0] - 2025-11-26
Rasa Pro 3.15.0 (2025-11-26)
Features
-
Added Langfuse integration for tracing LLM and embedding calls. All LLM-based components (Command Generators, Rephraser, Enterprise Search Policy, ReAct Sub Agent) and embedding operations are automatically traced when Langfuse is configured. Each trace includes, among other things, input/output, latency, token usage, cost, session ID, and component name.
To get started, configure Langfuse by adding a
langfuseentry to thetracingsection inendpoints.yml.Example:
tracing:
- type: langfuse
public_key: ${LANGFUSE_PUBLIC_KEY}
private_key: ${LANGFUSE_PRIVATE_KEY}
host: https://cloud.langfuse.comCustom components can override
get_llm_tracing_metadata()to customize metadata. -
Added support for triggering clarification when multiple
StartFlowcommands are generated with no active flow. To enable this feature, set theCLARIFY_ON_MULTIPLE_START_FLOWSenvironment variable toTrue. -
Adds DTMF (Dual-Tone Multi-Frequency) input support for collect steps in flows. Voice channels can now configure DTMF collection with options for digit length, finish key, and audio input control. The feature gracefully handles non-voice channels by skipping DTMF configuration when call_state is not initialized.
-
Added new CLI option
-f, --e2e-failed-teststo export failed e2e tests to a file that can be directly used to re-run only those tests. It accepts an optional filename or directory path, with automatic timestamping to prevent overwriting previous test runs. -
Added support for including current datetime information by default in LLM prompts. This feature enables LLM-based components to include date and time context in their prompts, helping the model understand temporal references and provide time-aware responses.
Components Updated:
CompactLLMCommandGeneratorSearchReadyLLMCommandGeneratorEnterpriseSearchPolicyMCPOpenAgent(with timezone support)MCPTaskAgent(with timezone support)
Prompt Template Updates: When
include_date_timeis enabled, prompts include a "Date & Time Context" section showing:- Current date (formatted as "DD Month, YYYY")
- Current time (formatted as "HH:MM:SS" with timezone)
- Current day of the week
E2E Testing Support: For deterministic testing, you can mock the datetime using the
mocked_datetimeslot in e2e test fixtures. The mocked datetime value must be provided in ISO 8601 format (e.g.,"2024-01-15T10:30:00+00:00"). The e2e test runner validates the format and raises aValidationErrorif the value is invalid.
Improvements
-
Updated
pattern_completedto check wether the user wants to continue the conversation or not by adding acollectstep to the pattern. -
The
OutputChannelis now provided to policies through the graph inputs. This enables any policy to access the output channel and send messages directly to the user, which is particularly useful for sending intermediate or filler messages. -
Allow LLM responses to be streamed to the output channel for any generative responses. This currently only applies to Enterprise Search Policy and Rephraser. Output channels that support streaming should handle duplicate message prevention when a response has already been streamed. Voice output channels (Browser Audio, Genesys, Audiocodes Stream, and Jambonz Stream) have been updated to use the streaming tokens to prepare the Text-to-Speech audio stream instead of waiting for the complete response to be generated. These changes are backward compatible; any existing channel does NOT need any additional changes. However, it can add new methods to make use of the streaming responses whenever they are available.
-
Enhanced the clarification pattern with a configurable limit on the number of flows in the clarification options. Added a new slot
max_clarification_optionsto thedefault_flows_for_patterns.ymlwith an initial value of3which can be changed by overriding theinitial_valueof the slotmax_clarification_optionsto customize the maximum number of flows displayed during clarification. -
Enhanced the clarification pattern to handle empty clarification options. Added
utter_clarification_no_options_rasaresponse todefault_flows_for_patterns.yml, triggered whenpattern_clarificationreceives aClarifyCommandwith no options. -
Allow e2e test results CLI flag
-o,--e2e-resultsto be specified with a custom path. If the flag is used without a path, the default pathtests/is used. -
Enable generative responses dispatched by custom actions to be evaluated by
generative_response_is_groundedandgenerative_response_is_relevantassertions in E2E testing. In order for the E2E testing framework to evaluate generative responses dispatched by custom actions, you must add the custom action dispatching the generative bot response to theutter_sourcekey of the appopriate assertion in the E2E test case. For example, if you have a custom actionaction_generate_summarythat generates a summary using a generative model, you can add the following assertion to your E2E test case:test_cases:
- test_case: Generate summary for user query
steps:
- user: |
Can you provide a summary of the latest news on climate change?
assertions:
- generative_response_is_grounded:
threshold: 0.8
utter_source: action_generate_summary
ground_truth: <insert_ground_truth_summary_here>
- generative_response_is_relevant:
threshold: 0.9
utter_source: action_generate_summary -
Allow
flow_startedandpattern_clarification_containsE2E testing assertions to define the operator i.e.all,any, for matching multiple flow_id values. Previously,flow_startedonly supported a single flow_id value, whilepattern_clarification_containsdefaulted toall. Introduce new format to specify the operator explicitly:test_cases:
- test_case: user is asked to clarify contact-related message
steps:
- user: contacts
assertions:
- pattern_clarification_contains:
operator: "any"
flow_ids:
- remove_contact
- list_contacts
- add_contact
- update_contact
- test_case: user removes a missing contact
steps:
- user: i want to remove a contact
assertions:
- flow_started:
operator: "any"
flow_ids:
- remove_contact
- update_contactThe
operatorfield can take valuesallorany, determining whether all specified flow_ids must match or if any one of them is sufficient.The previous format for these two assertions remains unchanged for backward compatibility, however it has been deprecated and will be removed in a future major release.
-
Updated the default model and voice of Cartesia TTS, using
sonic-3and voice ID American English Katie. -
Move commit messages to top of the SSE
-
Allow trigerring empty
Clarify Commandwithout flow options.
Bugfixes
- Run action_session_start if tracker ends with SessionEnded event.
- Fixed PostgreSQL
UniqueViolationerror when running an assistant with multiple Sanic workers. - Fix Kafka producer creation failing when SASL mechanism is specified in lowercase. The SASL mechanism is now case-insensitive in the Kafka producer configuration.
- Fix issue where the validation of the assistant files continued even when the provided domain was invalid and was being loaded as empty. The training or validation command didn't exit because the final merged domain contained only the default implementations for patterns, slots and responses and therefore passed the check for being non-empty.
- Trigger pattern_internal_error in a CALM assistant when a custom action fails during execution.
- Create AWS Bedrock / Sagemaker client only if the LLM healthcheck environment variable is set. If the environment variable is not set, validate that required credentials are present.
- Update
langchain-coreversion to~0.3.80to address security vulnerability CVE-2025-65106.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.14.20] - 2026-04-02
Rasa Pro 3.14.20 (2026-04-02)
Improvements
-
Declared
safetensorsandkerasas optional NLU extras (pip install 'rasa-pro[nlu]'orfull), so minimal installs no longer pull them in directly.regexis also declared optional and listed under those extras for consistency withWhitespaceTokenizer, but it remains installed on most minimal installs because the base dependencytiktoken(used by the LLM stack) depends onregex.The affected code paths lazy-import
safetensorsandregex; if either package is not installed, they raiseMissingDependencyExceptionwith install instructions.kerasis only pulled in for the TensorFlow model stack (rasa.utils.tensorflow.models), so it is optional for the same minimal-install story assafetensors. -
Improved sub-agent call steps that use
exit_if: when the same ReAct agent runs again in one conversation, slots named inexit_ifare cleared so a new run does not reuse values from the last finished run. Ongoing multi-turn agent sessions (waiting for the next user message) are unchanged.
Bugfixes
-
When an agent or MCP tool call returns a fatal error (e.g. internal server error), the user no longer receives two bot messages. Previously both the internal error message ("Sorry, I am having trouble with that...") and the flow-cancelled message ("Okay, stopping...") were shown. Now only the internal error message is shown; the cancel pattern is not pushed for system-initiated failures, so the flow is still marked ended for tracking but the confusing cancel utterance is omitted.
-
Add rephrase endpoint validation by treating defaults-only misconfiguration as warning and user-defined rephrase misconfiguration as error.
-
Upgrade
langsmithdependency to 0.6.3 to address CVE-2026-25528. -
Fixed three bugs in
ConcurrentRedisLockStorethat caused anIndexError: deque index out of rangecrash in the PII anonymization and deletion cron jobs under multi-replica deployments.get_lock()now returnsNonewhen no ticket keys exist in Redis (all tickets had expired), instead of returning an emptyConcurrentTicketLockobject that caused downstream callers to crash.save_lock()now skips the Redis write when the ticket has already expired (TTL ≤ 0), preventing aResponseErrorfrom Redis.save_lock()previously passed the absolute epoch expiry timestamp as the RedisEXTTL, resulting in ticket keys that effectively never expired (~55 years). The TTL is now correctly computed as a relative duration in seconds.
-
Fixed correction reset when a user answers the active collect slot and corrects another slot in the same turn.
CorrectSlotsCommand.create_correction_frameno longer chooses the reset step only from slots in the correction payload. It also considers the current collect-information step and picks the earlier collect step in flow order, so the stack resets to the question currently being asked instead of jumping ahead to a later slot’s collect step (which skipped validation for the new value on the active slot).
[3.14.19] - 2026-03-16
Rasa Pro 3.14.19 (2026-03-16)
Bugfixes
- Restarted task-oriented ReAct agents no longer exit immediately. When an agent is restarted, the previous run's user/assistant messages are now marked in the conversation so the model does not set slots from them; the system prompt instructs the agent to treat the current interaction as a fresh start for slot collection.
- When an A2A task has status
input_required, Rasa now populatesAgentOutput.structured_resultsfrom bothtask.artifactsand DataParts intask.status.message.parts. Previously only the text message was returned and structured data was omitted, so clients can now process artifact data when the agent is waiting for user input. - Fix PII redaction of user or bot messages when slot values do not match the original message text. This can occur when the original messages are multi-line or TTS-style bot read-backs.
- Update setuptools to 80.10.2 to address vulnerability https://osv.dev/vulnerability/DEBIAN-CVE-2026-23949. Replaced randomname with duoname (no dependencies) library.
[3.14.18] - 2026-03-11
Rasa Pro 3.14.18 (2026-03-11)
Deprecations and Removals
- Removed an explicit deprecation warning for the license varible
RASA_PRO_LICENSEto provide clarity that we will continue to support both this and the newerRASA_LICENSEvariable for the forseeable future.
Bugfixes
-
When a flow had Agent A → flow steps → Agent B and the user restarted Agent A while Agent B was already started (then interrupted), execution after the restarted Agent A completed would jump back to Agent B and skip the flow steps between A and B. Flow steps between agents are now executed correctly, and the previously interrupted Agent B is resumed instead of started from scratch.
-
Fixes MCP tool result handling to now process results that contain only
structuredContent(and no or emptycontent). Previously, an emptycontentfield caused the result to be skipped and slots were not set fromstructuredContent. -
Downgraded the A2A polling "waiting to poll again" log from ERROR to INFO so normal polling no longer triggers false alerts.
-
SQL tracker store:
update()now supports a content-only path when the timestamp-based delete removes no rows (e.g. anonymization: same timestamps, content changed). In that case, the store either updates existing event rows in place where content differs or performs a full replace if event counts differ, so anonymized content is persisted correctly in a single atomic transaction.Anonymization cron job: the privacy manager now uses
update(updated_tracker)for anonymization instead of delete-then-save. SQL tracker store behavior is aligned with MongoDB, Redis and DynamoDB (overwrite semantics), and anonymization with SQL completes in one atomic operation without a separate delete/save sequence. -
Prevent
JsonPatchConflictexceptions raised when tracker is split in sub-sessions during PII anonymization cron jobs. Replace usage of a utility function that was recreating tracker objects using sub-sessions with an approach retrieving list of events for each sub-session instead.
[3.14.17] - 2026-03-03
Rasa Pro 3.14.17 (2026-03-03)
Bugfixes
-
- Kafka event broker background polling thread caused test hangs and didn't allow the process to exit: The background poll thread is now a daemon thread, so the process can terminate when the broker is not closed explicitly (e.g. in tests or after an abrupt exit). The
close()method uses a 5-second join timeout so it does not block forever if the poll thread is stuck (e.g. when the broker is unreachable). - Background polling: The poll loop now runs for the whole lifetime of the broker, even before the producer is created. When the producer is not ready, the loop sleeps briefly instead of exiting. This allows the IAM OAuth callback to be triggered when using SASL_SSL with AWS IAM (MSK), so tokens can be refreshed as the library calls
poll(). - Connection keepalive (optional): New broker options
socket_keepalive_enable,reconnect_backoff_ms,reconnect_backoff_max_ms, andtopic_metadata_refresh_interval_mslet you reduce idle connection drops. Whensocket_keepalive_enableis true, these are passed to the underlying producer.
- Kafka event broker background polling thread caused test hangs and didn't allow the process to exit: The background poll thread is now a daemon thread, so the process can terminate when the broker is not closed explicitly (e.g. in tests or after an abrupt exit). The
-
Fixes race conditions in PII cron jobs by requiring a LockStore for BackgroundPrivacyManager and acquiring a per-sender_id lock while anonymization/deletion jobs read-modify-write trackers.
Implemented measures to defend against JSON patch issues and ensure correct event order.
- Deletion cron job: When reconstructing the tracker from retained events after deleting old sessions, the deletion
job now catches
JsonPatchExceptionandJsonPointerException(e.g. from invalid or inconsistent dialogue stack updates). On failure, the tracker is left unchanged and an error is logged instead of overwriting or deleting data, so no data loss occurs. Users can resolve stack-related issues by appending aRestartedevent to the tracker if needed. - Anonymization cron job: Events from already-anonymized, processed, and ineligible sessions are now sorted by timestamp before rebuilding the tracker, with original index used as a tie-breaker when timestamps are identical. This keeps replay order chronologically consistent and ensures dialogue stack updates and other order-dependent events are applied in the correct sequence.
- Deletion cron job: When reconstructing the tracker from retained events after deleting old sessions, the deletion
job now catches
-
ReAct agents now filter conversation events to user and bot utterances before building assistant and user role messages, and the default context limit is 10 utterance messages. Previously, the last 20 events were taken first and then filtered, so fewer user and assistant messages were included in the context.
[3.14.16] - 2026-02-26
Rasa Pro 3.14.16 (2026-02-26)
Bugfixes
- Upgraded
litellmto 1.81.15 so thatstrict: Truecan be passed to Bedrock and tool calling has the same guarantees as with OpenAI. Upgradedopenaito >=2.8.0 to satisfy litellm's dependency. - Unquoted environment variable references for MCP and A2A OAuth credentials (
client_id,client_secret) inendpoints.ymlare now accepted. Previously, training failed unless these values were wrapped in double quotes (e.g."${MCP_CLIENT_SECRET}"). - Move MCP task agent exit condition evaluation to after
process_output, so thatSlotSetevents added by customprocess_outputimplementations are considered when checkingexit_ifconditions. - The MCP task agent now includes slot changes in the agent output when the state is
INPUT_REQUIREDor when max iterations is reached. Previously, slots set via set_slot tools were updated in memory but not forwarded in the output, so they were not persisted until exit conditions were met.
[3.14.15] - 2026-02-23
Rasa Pro 3.14.15 (2026-02-23)
Bugfixes
-
Remove config file content from endpoint read success logs to prevent sensitive data exposure.
-
Update
protobufto v5.29.6 to address CVE-2026-0994. Updatewheelto v0.46.3 to address CVE-2026-24049. -
E2E fixture resolution and conftest hierarchy:
Fixture resolution now uses a conftest-style hierarchy, with local overrides taking precedence over global fixtures. This is a change from the previous behavior where all fixtures were merged into a single list, which could lead to silent data loss if duplicate fixture names were used. Now, every test case has its own resolved set of fixtures, and duplicate fixture names are allowed when the intent is "override".
Details:
- Conftest-style hierarchy: Fixtures can be defined at root or folder level (e.g.
conftest.yml/conftest.yaml); all e2e tests under that path see them. - Single-file run parity: Running one test file resolves fixtures the same way as when that file is run as part of the full suite (global/conftest fixtures are loaded for that file’s path).
- Runtime namespace: Each test case has its own resolved set of fixtures; there is no shared mutable fixture state between tests. Duplicate fixture names in different files are allowed when the intent is “override” (no need to remove or rename for full-suite runs).
- Override semantics: Local (file-level) fixtures override folder-level; folder-level overrides root. Within a single file, duplicate fixture names remain an error.
- Conftest-style hierarchy: Fixtures can be defined at root or folder level (e.g.
[3.14.14] - 2026-02-12
Rasa Pro 3.14.14 (2026-02-12)
- Upgrade
litellmto 1.80.0. - Fix Enterprise Search Policy triggering
utter_ask_rephraseinstead ofutter_no_relevant_answer_foundwhen the vector store search returns no matching documents. Thepattern_cannot_handlenow correctly receives thecannot_handle_no_relevant_answeras acontext.reasonin all cases where no relevant answer is found, not only when the optional relevancy check rejects the answer.
[3.14.13] - 2026-02-05
Rasa Pro 3.14.13 (2026-02-05)
Bugfixes
- Upgrade Keras to 3.12.1 to address CVE-2026-0897.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.14.12] - 2026-01-26
Rasa Pro 3.14.12 (2026-01-26)
Bugfixes
- Update azure-core to 1.38.0 to address CVE-2026-21226.
[3.14.11] - 2026-01-21
Rasa Pro 3.14.11 (2026-01-21)
Bugfixes
- Fixed e2e test coverage report to correctly track coverage per flow. Each flow now appears as a separate entry with accurate coverage percentages. Additionally,
call/linksteps andcollectsteps with prefilled slots are now properly marked as visited. - Throw error when duplicate fixtures are found in the same file or across files.
- Fix OAuth2AuthStrategy to use URL-encoded parameters with Basic Authentication to fetch access token
[3.14.10] - 2026-01-15
Rasa Pro 3.14.10 (2026-01-15)
Bugfixes
- Fixed an issue where storing documents in FAISS individually could hit the token limit. Now, documents are stored in batches to avoid exceeding the token limit.
SessionEndeddoes not reset the tracker anymore.- Updated
werkzeug,aiohttp,filelock,fonttools,marshmallow,urllib3andlangchain-coreto resolve security vulnerabilities.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.14.9] - 2025-12-29
Rasa Pro 3.14.9 (2025-12-29)
Bugfixes
- Include response button titles in conversation history in prompts of LLM based components.
- Fix OpenTelemetry exporter
Invalid type <class 'NoneType'> of value Noneerror when recording the request duration metric for requests made from Rasa server to the custom action server. This error occurred because the url parameter was not being passed to the method that records the request duration metric, resulting in a NoneType value. - Fix DUT fails with AttributeError when running with custom CommandGenerator
[3.14.8] - 2025-12-19
Rasa Pro 3.14.8 (2025-12-19)
Bugfixes
- Fixed token expiration validation failing on servers running in non-UTC timezones. Token expiration checks now use timezone-aware UTC datetimes consistently, preventing premature "access token expired" errors on systems in timezones like UTC+8.
[3.14.7] - 2025-12-11
Rasa Pro 3.14.7 (2025-12-11)
Bugfixes
- Fix potential Tensor shape mismatch error in
TEDPolicyandDIETClassifier. - Update
mcpversion to~1.23.0to address security vulnerability CVE-2025-66416. - Fix bug in
CommandPayloadReaderwhere regex matching did not account for list slots, leading to incorrect parsing of slot keys and values. Now, slot names and values are correctly extracted even if a list is provided. - Previously,
DialogueStateTracker.has_coexistence_routing_slotcould incorrectly returnTruewhen the tracker was created without domain slots (i.e., usingAnySlotDict), becauseAnySlotDictpretends all slots exist. Now, the property returns False in that case, so the routing slot is only considered present if it is actually defined in the domain. - Fix LLM prompt template loading to raise an error instead of just printing a warning when a custom prompt file is missing or cannot be read.
- Fix
AttributeError: 'str' object has no attribute 'pop'when usingKnowledgeAnswerCommandwith tracing enabled. - Fix
UnboundLocalErrorinE2ETestRunner._handle_fail_diffthat caused e2e tests to crash when processingslot_was_not_setassertion failures. - Fixed button payloads with nested parentheses (e.g.,
/SetSlots(slot=value)) not being parsed correctly inrasa shell. The payload was incorrectly stripped of its/SetSlotsprefix, causing it to be treated as text instead of a slot-setting command. - Add missing deprecation warning for legacy
RASA_PRO_LICENSEenvironment variable. Update license validation error messages to reference the actual environment variable used.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.14.6] - 2025-12-05
Rasa Pro 3.14.6 (2025-12-05)
Bugfixes
- Fix agentic prompt template to access slots directly.
- Disable LLM health check for Enterprise Search Policy when generative search is disabled (i.e. use_generative_llm is False).
- Fix deduplication of collect steps in cases where the same slot was called in different flows.
- Cancel active flow before triggering internal pattern error during a custom action failure.
- Fix bug with the missing
language_datamodule by installinglangcodeswith thedataextra dependency.
[3.14.5] - 2025-12-02
Rasa Pro 3.14.5 (2025-12-02)
Bugfixes
- Update
pipto fix security vulnerability. - Fix AgentToolSchema._ensure_property_types() correctly preserves structural keywords ($ref, anyOf, oneOf, etc.)
[3.14.4] - 2025-11-27
Rasa Pro 3.14.4 (2025-11-27)
Bugfixes
- Fixed
patten-continue-interruptedrunning out of order before linked flows. - Fix
rasa studio uploadtimeouts by enabling TCP keep-alive with platform-specific socket options to maintain stable connections. - Remove
action_metadatatracing span attribute fromEnterpriseSearchPolicyinstrumentation to prevent PII leakages. Add new environment variableRASA_TRACING_DEBUGGING_ENABLEDto enable addingaction_metadatatoEnterpriseSearchPolicyspans for debugging purposes. By default, this variable is set tofalseto ensure PII is not logged in production environments. - Fixed PostgreSQL
UniqueViolationerror when running an assistant with multiple Sanic workers. - Fix Kafka producer creation failing when SASL mechanism is specified in lowercase. The SASL mechanism is now case-insensitive in the Kafka producer configuration.
- Fix issue where the validation of the assistant files continued even when the provided domain was invalid and was being loaded as empty. The training or validation command didn't exit because the final merged domain contained only the default implementations for patterns, slots and responses and therefore passed the check for being non-empty.
- Trigger pattern_internal_error in a CALM assistant when a custom action fails during execution.
- Create AWS Bedrock / Sagemaker client only if the LLM healthcheck environment variable is set. If the environment variable is not set, validate that required credentials are present.
- Update
langchain-coreversion to~0.3.80to address security vulnerability CVE-2025-65106. - Raise validation error when duplicate slot definitions are found across domains.
- Raise validation error when a slot with an initial value set is collected by a flow collect step
which sets
asks_before_fillingtotruewithout having a corresponding collect utterance or custom action.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.14.3] - 2025-11-13
Rasa Pro 3.14.3 (2025-11-13)
Miscellaneous internal changes
Miscellaneous internal changes.
[3.14.2] - 2025-10-30
Rasa Pro 3.14.2 (2025-10-30)
Improvements
-
Add new environment variable
LOG_LEVEL_PYMONGOto control the logging level of PyMongo dependency of Rasa. This can be useful to reduce the verbosity of logs. Default value isINFO.The logging level of PyMongo can also be set via the
LOG_LEVEL_LIBRARIESenvironment variable, which provides the default logging level for a selection of third-party libraries used by Rasa. If both variables are set,LOG_LEVEL_PYMONGOtakes precedence.
Bugfixes
-
Clean up duplicated
ChitChatAnswerCommandsin command processor.Ensure that one
CannotHandleCommandremains if only multipleCannotHandleCommandswere present. -
LLM request timeouts are now enforced at the event loop level using
asyncio.wait_for.Previously, timeout values configured in
endpoints.ymlcould be overridden by the HTTP client's internal timeout behavior. This fix ensures that when a specific timeout value is configured for LLM requests, the request respects that exact timing regardless of the underlying HTTP client implementation. -
Fixed an issue where duplicate collect steps in a flow could cause rendering problems, such as exceeding token limits. This occurred when a flow called another flow multiple times. Now, each collect step is listed only once when retrieving all collect steps for a flow.
-
If a FloatSlot does not have min and max values set in the domain, the slot will not be validated against any range. If the slot defines an initial value, as well as min and max values, the initial value will be validated against the range and an error will be raised if the initial value is out of range. Enhance run-time validation for new values assigned to FloatSlot instances, ensuring they fall within the defined min and max range if these are set. If min and max are not set, no range validation is performed.
-
Fixed bug preventing
deploymentparameter from being used in generative response LLM judge configuration. -
Fixed bug where
persisted_slotsdefined in called flows were incorrectly reset when the parent flow ended, unless they were also explicitly defined in the parent flow. Persisted slots now only need to be defined in the called flow to remain persisted after the parent flow ends. -
Fixes the prompt template resolution logic in the CompactLLMCommandGenerator and SearchReadyLLMCommandGenerator classes.
-
When
action_clean_stackis used in a user flow, allowpattern_completedto be triggered even if there are pattern flows at the bottom of the dialogue stack below the top user flow frame. Previously,pattern_completedwould only trigger if there were no other frames below the top user flow frame. This assumes that theaction_clean_stackis the last action called in the user flow. -
Update
pipversion used in Dockerfile to23.*to address security vulnerability CVE-2023-5752. Updatepython-socketioversion to5.14.0to address security vulnerability CVE-2025-61765.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.14.1] - 2025-10-10
Rasa Pro 3.14.1 (2025-10-10)
Miscellaneous internal changes
Miscellaneous internal changes.
[3.14.0] - 2025-10-09
Rasa Pro 3.14.0 (2025-10-09)
Features
-
Added the possibility to call an agent from within a flow via a
callstep. We support two types of ReAct style agents:-
An open ended exploratory agent - Here the user’s goal is loosely defined, for example researching about stocks to invest in. There is no pre-defined criteria which can be used to know when the goal is reached. Hence the agent itself needs to figure out when it has helped the user to the best of its capabilities.
flows:
stock_investment_research:
description: helps research and analyze stock investment options
steps:
- call: stock_explorer # runs until agent signals completion -
A task specific agent - Here we can come up with conditions, which when true, signals the completion of a user goal. For example, helping the user find an appointment slot based on their preferences - you know the agent can exit once all user’s preferences have been met and they have agreed to a slot.
flows:
book_appointment:
description: helps users book appointments
steps:
- call: ticket_agent
exit_if:
- slots.chosen_appointment is not null
- slots.booking_completed is True**
- collect: user_confirmation
To configure the agents you need to create a folder structure like this:
your_project/
├── config.yml
├── domain/
├── data/flows/
└── sub_agents/
└── stock_explorer/
├── config.yml # mandatory
└── prompt_template.jinja2 # optionalThe
config.ymlfile for each agent is mandatory and should look, for example, like this:# Basic agent information
agent:
name: stock_explorer # name of the agent
protocol: RASA # protocol for its connections either RASA or A2A
description: "Agent that helps users research and analyze stock options" # a brief description used by the command generator to continue / stop the agent and the agent during its execution
# Core configuration
configuration:
llm: # (optional) Same format as other Rasa LLM configs
type: openai
model: gpt-4
prompt_template: sub_agents/stock_explorer/prompt_template.jinja2 # (optional) prompt template file containing a customized prompt
timeout: 30 # (optional) seconds before timing out
max_retries: 3 # (optional) connection retry attempts
# MCP server connections
connections:
mcp_servers:
- name: trade_server
include_tools: # optional: specify which tools to include
- find_symbol
- get_company_news
- apply_technical_analysis
- fetch_live_price
exclude_tools: # optional: tools to exclude; helpful to not allow the agent to execute critical tools.
- place_buy_order
- view_positions -
-
Added the possibility to call an MCP tool directly from a flow step via a
callstep.Example:
- call: place_buy_order # MCP tool name
mcp_server: trade_server # MCP server where tool is available
mapping:
input:
- param: ticker_symbol # tool parameter name
slot: stock_name # slot to send as value
- param: quantity
slot: order_quantity
output:
- slot: order_status # slot to store results
result_key: result.structuredContent.order_status.successThe MCP server needs to be defined in the
endpoints.ymlfilemcp_servers:
- name: trade_server
url: http://localhost:8080
type: http -
We updated the inspector
- to highlight when a call step is calling an agent or an MCP tool using a little icon in the flow view.
- and added an additional agent widget that shows the available agents and their corresponding status in the conversation.
-
Whenever agents are configured, the
SearchReadyLLMCommandGeneratorand theCompactLLMCommandGeneratorwill use new default prompt templates that contain new agent specific commands (RestartAgentandContinueAgent) and instructions. -
Adds Interruption Handling Support (beta) in Voice Stream Channels, namely Browser Audio, Twilio Media Streams and Jambonz Stream. Interruptions are identified from partial transcripts sent by the Automatic Speech Recogintion (ASR) Engine. Interruption Handling is disabled by defaulat and can be configured using the optional
interruptionskey incredentials.yml.browser_audio:
server_url: localhost
interruptions:
enabled: True
min_words: 3
asr:
name: "deepgram"
tts:
name: cartesiaThe configuration property
min_words(default 3) requires the partial transcript to have at least 3 words to interrupt the bot. This is a rudimentary way to filter backchannels (brief responses like "hmm", "yeah", "ok").Interruptions can be disabled for certain responses using the domain response property
allow_interruptions(default true). Example,responses:
utter_current_balance:
- text: You still have {current_balance} in your account.
allow_interruptions: false -
Added the following new events to capture the state of any agent used within a conversation:
AgentStartedAgentCompletedAgentCancelledAgentResumedAgentInterrupted
-
Added support for Redis Cluster mode in the tracker store for horizontal scaling and cloud compatibility.
Added support for Redis Sentinel mode in the tracker store for high availability with automatic failover.
Added 3 new configuration parameters to
RedisTrackerStore:deployment_mode: String value specifying Redis deployment type ("standard", "cluster", or "sentinel"). Defaults to "standard".endpoints: List of strings in "host:port" format defining cluster nodes or sentinel instances.sentinel_service: String value specifying the sentinel service name to connect to. Only used in sentinel mode, defaults to "mymaster".
-
Add support for IAM authentication to AWS RDS SQL tracker store. To enable this feature:
- set the
IAM_CLOUD_PROVIDERenvironment variable toaws. - set the
AWS_DEFAULT_REGIONenvironment variable to your desired AWS region. - if you want to enforce SSL verification, you can set the
SQL_TRACKER_STORE_SSL_MODEenvironment variable (for example, toverify-fullorverify-ca) and provide the path to the CA certificate using theSQL_TRACKER_STORE_SSL_ROOT_CERTIFICATEenvironment variable.
- set the
-
Add support for IAM authentication to AWS Managed Streaming for Kafka event broker. This allows secure authentication to an AWS MSK cluster without the need for static credentials. To enable this feature:
- set the
IAM_CLOUD_PROVIDERenvironment variable toaws. - set the
AWS_DEFAULT_REGIONenvironment variable to your desired AWS region. - ensure that your application has the necessary IAM permissions to access the AWS Managed Service Kafka cluster.
- ensure the topic is created on the MSK cluster.
- use the
SASL_SSLsecurity protocol andOAUTHBEARERSASL mechanism in your Kafka configuration inendpoints.yml. - download the root certificate from Amazon Trust Services: https://www.amazontrust.com/repository/ and provide its path
to the
ssl_cafileevent broker yaml property.
- set the
-
Added support for Redis Cluster mode in
RedisLockStorefor horizontal scaling and cloud compatibility.Added support for Redis Sentinel mode in
RedisLockStorefor high availability with automatic failover.Added 3 new configuration parameters to
RedisLockStore:deployment_mode: String value specifying Redis deployment type ("standard", "cluster", or "sentinel"). Defaults to "standard".endpoints: List of strings in "host:port" format defining cluster nodes or sentinel instances.sentinel_service: String value specifying the sentinel service name to connect to. Only used in sentinel mode, defaults to "mymaster".
-
Added support for Redis Cluster mode in
ConcurrentRedisLockStorefor horizontal scaling and cloud compatibility.Added support for Redis Sentinel mode in
ConcurrentRedisLockStorefor high availability with automatic failover.Added 3 new configuration parameters to
ConcurrentRedisLockStore:deployment_mode: String value specifying Redis deployment type ("standard", "cluster", or "sentinel"). Defaults to "standard".endpoints: List of strings in "host:port" format defining cluster nodes or sentinel instances.sentinel_service: String value specifying the sentinel service name to connect to. Only used in sentinel mode, defaults to "mymaster".
-
Add support for IAM authentication to AWS ElastiCache for Redis lock store. This allows secure authentication to an AWS ElastiCache without the need for static credentials. To enable this feature:
- set the
IAM_CLOUD_PROVIDERenvironment variable toaws. - set the
AWS_DEFAULT_REGIONenvironment variable to your desired AWS region. - download the root certificate from Amazon Trust Services and provide its path to the
ssl_ca_certslock store yaml property. - if enabling cluster mode, set the
AWS_ELASTICACHE_CLUSTER_NAMEenvironment variable to your ElastiCache cluster name. - ensure that your application has the necessary IAM permissions to access the AWS ElastiCache for Redis cluster.
- set the
-
Default silence timeout is now configurable per channel. Default silence timeout is read from channel configuration in credentials file. Example:
audiocodes_stream:
server_url: "humble-arguably-stork.ngrok-free.app"
asr:
name: deepgram
tts:
name: cartesia
silence_timeout: 5Silence timeout at collect step is also configurable per channel:
flows:
- name: example_flow
steps:
- collect:
silence_timeout:
- audiocodes_stream: 5If not configured, default silence timeout is 7 seconds for each channel.
-
Adds support for Deepgram TTS Adds
browser_audiochannel to the credentials.yml intutorialtemplate
Improvements
-
In case a
StartFlowCommandfor a flow, that is already on the stack, is predicted, we now resume the flow and interrupt the current active flow instead of ignoring theStartFlowCommand. -
Updated
pattern_continue_interruptedto ask the user if they want to proceed with any of the interrupted flows before resuming that particular flow. -
We have isolated the dependencies that are only required for NLU components. These include:
transformers(version:"~4.38.2")tensorflow(version:"^2.19.0, only available for"python_version < '3.12')tensorflow-text(version"^2.19.0", only available for"python_version < '3.12')tensorflow-hub(version:"^0.13.0", only available for"python_version < '3.12')tensorflow-io-gcs-filesystem(version:"==0.31"forsys_platform == 'win32', version:"==0.34"forsys_platform == 'linux', version:"==0.34"forsys_platform == 'linux'for"sys_platform == 'darwin' and platform_machine != 'arm64'; all only available for"python_version < '3.12')tensorflow-metal(version:"^1.2.0", only available for"python_version < '3.12')tf-keras(version:"^2.15.0", only available for"python_version < '3.12')spacy(version:"^3.5.4")sentencepiece(version:"~0.1.99", only available for"python_version < '3.12')skops(version:"~0.13.0")mitie(version:"^0.7.36", added for consistency)jieba(version:">=0.42.1, <0.43")sklearn-crfsuite(version:"~0.5.0")
The dependencies for those components are now in their own extra, called
nluand can be installed via:poetry install --extras nlu,pip install 'rasa-pro[nlu]'oruv pip install 'rasa-pro[nlu]'. -
We added dependencies for agent orchestration,
mcp("~1.12.0") anda2a-sdk("~0.3.4"), to the list of default dependencies. As a result, they get installed via:poetry install,pip install 'rasa-pro'oruv pip install 'rasa-pro'.To ensure compatibility between
a2a-sdkandtensorflow,tensorflowand its related dependencies were updated. These include:tensorflow(from"2.14.1"to"^2.19.0")tensorflow-text(from"2.14.0"to^2.19.0)tensorflow-metal(from"1.1.0"to"^1.2.0")- instead of
keras("2.14.0"), we now usetf-keras("^2.15.0")
Additionally, tensorflow dependencies that are incompatible with the upgraded
tensorflowversion were removed. These include:tensorflow-intel,tensorflow-cpu-aws,tensorflow-macos.Because tensorflow and related packages were upgraded, tensorflow code was also updated. As a consequence, the incremental training feature is not supported anymore. This is because
tf-keras("^2.15.0") does not allow a compiled model to be updated. -
We updated the supported Python versions:
- Dropped support for Python 3.9.
- Added support for Python 3.12 and Python 3.13.
So, whilst we previously supported
python = ">=3.9.2,<3.12", we now supportpython = ">=3.10.0,<3.14".
To ensure compatibility with the newly supported Python versions, existing dependencies had to be updated. These include:
protobuf(from"~4.25.8"to"~5.29.5")importlib-resources(from"6.1.3"to"^6.5.2")opentelemetry-sdk(from"~1.16.0"to"~1.33.0")opentelemetry-exporter-jaeger("~1.16.0") - has been removedopentelemetry-exporter-otlp(from"~1.16.0"to"~1.33.0")opentelemetry-api(from"~1.16.0"to"~1.33.0")pep440-version-utils- only available for"python_version < '3.13'"pymilvus(from">=2.4.1,<2.4.2"to"^2.6.1")numpy(from"~1.26.4"to"~2.1.3")scipy("~1.13.1"for"python_version < '3.12'";"~1.14.0"for"python_version >= '3.12'")tensorflow(version:"^2.19.0, only available for"python_version < '3.12')tensorflow-text(version"^2.19.0", only available for"python_version < '3.12')tensorflow-hub(version:"^0.13.0", only available for"python_version < '3.12')tensorflow-io-gcs-filesystem(version:"==0.31"forsys_platform == 'win32', version:"==0.34"forsys_platform == 'linux', version:"==0.34"forsys_platform == 'linux'for"sys_platform == 'darwin' and platform_machine != 'arm64'; all only available for"python_version < '3.12')tensorflow-metal(version:"^1.2.0", only available for"python_version < '3.12')tf-keras(version:"^2.15.0", only available for"python_version < '3.12')sentencepiece(version:"~0.1.99", only available for"python_version < '3.12')
Note that
tensorflowand related dependencies are only supported for Python < 3.12. As a result, components requiring those dependencies are not available for Python >= 3.12. These are:DIETClassifier,TEDPolicy,UnexpecTEDIntentPolicy,ResponseSelector,ConveRTFeaturizerandLanguageModelFeaturizer. -
We have isolated the dependencies required for channel connectors. These include:
fbmessenger(version:"~6.0.0")twilio(version:"~9.7.2")webexteamssdk(version:">=1.6.1,<1.7.0")mattermostwrapper(version:"~2.2")rocketchat_API(version:">=1.32.0,<1.33.0")aiogram(version:"~3.22.0")slack-sdk(version:"~3.36.0")cvg-python-sdk(version:"^0.5.1")
The dependencies for those channels are now in their own extra, called
channelsand can be installed via:poetry install --extras channels,pip install 'rasa-pro[channels]'oruv pip install 'rasa-pro[channels]'. Note that the dependencies for the channelsbrowser_audio,studio_chat,socketIOandrestare not included and remain in the main list of dependencies. -
Validation errors now raise meaningful exceptions instead of calling sys.exit(1), producing clearer and more actionable log messages while allowing custom error handling.
-
Engine-related modules now raise structured exceptions instead of calling
sys.exit(1)orprint_error_and_exit, providing clearer, more actionable log messages and enabling custom error handling. -
Enable connection to AWS services for LLMs (e.g. Bedrock, Sagemaker) via multiple additional methods to environment variables, for example by using IAM roles or AWS credentials file.
-
Relocate
latency displayin Inspector -
Implement Redis connection factory class to handle different Redis deployment modes. This class abstracts Redis connection creation and automatically selects the appropriate redis-py client (Redis, RedisCluster, or Sentinel) based on configuration.
- In
standardmode, connects to a single Redis instance. - In
clustermode, connects to a Redis Cluster using the provided endpoints. - In
sentinelmode, connects to a Redis Sentinel setup for high availability.
- In
-
Metadata of
action_listenevent in the tracker contains the execution times for Command Processor and Prediction Loop for the previous turn. This information is present in the keyexecution_timesin the metadata and the times are in milliseconds. -
Rasa Voice Inspector (browser_audio channel) used to require a Rasa License with a specific voice scope. This scope requirement has been dropped.
-
Add new environment variables for each AWS service integration (RDS, ElastiCache for Redis, MSK) that indicates whether to use IAM authentication when connecting to the service:
KAFKA_MSK_AWS_IAM_ENABLED- set totrueto enable IAM authentication for MSK connections.RDS_SQL_DB_AWS_IAM_ENABLED- set totrueto enable IAM authentication for RDS connections.ELASTICACHE_REDIS_AWS_IAM_ENABLED- set totrueto enable IAM authentication for ElastiCache for Redis connections.
Bugfixes
- Pass all flows to
find_updated_flowsto avoid creating aHandleCodeChangeCommandin situations where flows were not updated. - The .devcontainer docker-compose file now uses the new
docker.io/bitnamilegacyrepository for images, rather than the olddocker.io/bitnami. This change was made in response to Bitnami's announcement that they will be putting all of their public Helm Chart container images behind a paywall starting August 28th, 2025. Existing public images are moved to the new legacy repository -bitnamilegacy- which is only intended for short-term migration purposes. - In case an agents fails with an fatal error or returns an unkown state, we now cancel
the current active flow next to triggering
pattern_internal_error. - Bugfix for Jambonz Stream channel Websocket URL path which resulted in failed Websocket Connections
- Fixed the contextual response rephraser to use and update the correct translated response text for the current language, instead of falling back to the default response.
- Refactored
validate_argument_pathsto accept list values and aggregate all missing paths before exiting. - Fix expansion of referenced environment variables in
endpoints.ymlduring Bedrock model config validation. - Enabled the data argument to support both string and list inputs, normalizing to a list for consistent handling.
- Fixed model loading failures on Windows systems running recent Python versions (3.9.23+, 3.10.18+, 3.11.13+) due to tarfile security fix incompatibility with Windows long path prefix.
- Fixes the silence handling bug in Audiocodes Stream Channel where consecutive bot responses could trip silence timeout pattern while the bot is speaking. Audiocodes Stream channel now forecefully cancels the silence timeout watcher whenever it sends the bot response audio.
- Use correct formatting method for messages in
completionandacompletionfunctions ofLiteLLMRouterLLMClient.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.13.24] - 2026-02-23
Rasa Pro 3.13.24 (2026-02-23)
Bugfixes
-
E2E fixture resolution and conftest hierarchy:
Fixture resolution now uses a conftest-style hierarchy, with local overrides taking precedence over global fixtures. This is a change from the previous behavior where all fixtures were merged into a single list, which could lead to silent data loss if duplicate fixture names were used. Now, every test case has its own resolved set of fixtures, and duplicate fixture names are allowed when the intent is "override".
Details:
- Conftest-style hierarchy: Fixtures can be defined at root or folder level (e.g.
conftest.yml/conftest.yaml); all e2e tests under that path see them. - Single-file run parity: Running one test file resolves fixtures the same way as when that file is run as part of the full suite (global/conftest fixtures are loaded for that file’s path).
- Runtime namespace: Each test case has its own resolved set of fixtures; there is no shared mutable fixture state between tests. Duplicate fixture names in different files are allowed when the intent is “override” (no need to remove or rename for full-suite runs).
- Override semantics: Local (file-level) fixtures override folder-level; folder-level overrides root. Within a single file, duplicate fixture names remain an error.
- Conftest-style hierarchy: Fixtures can be defined at root or folder level (e.g.
[3.13.23] - 2026-02-12
Rasa Pro 3.13.23 (2026-02-12)
Improvements
- Flows can now link to
pattern_search(e.g. to trigger RAG or branch on knowledge-based search).
Bugfixes
- Fixed e2e test coverage report to correctly track coverage per flow. Each flow now appears as a separate entry with accurate coverage percentages. Additionally,
call/linksteps andcollectsteps with prefilled slots are now properly marked as visited. - Upgrade
litellmto 1.80.0. - Fix Enterprise Search Policy triggering
utter_ask_rephraseinstead ofutter_no_relevant_answer_foundwhen the vector store search returns no matching documents. Thepattern_cannot_handlenow correctly receives thecannot_handle_no_relevant_answeras acontext.reasonin all cases where no relevant answer is found, not only when the optional relevancy check rejects the answer.
[3.13.22] - 2026-01-15
Rasa Pro 3.13.22 (2026-01-15)
Bugfixes
- Fixed an issue where storing documents in FAISS individually could hit the token limit. Now, documents are stored in batches to avoid exceeding the token limit.
- Throw error when duplicate fixtures are found in the same file or across files.
SessionEndeddoes not reset the tracker anymore.- Updated
werkzeug,filelock,fonttools,marshmallow,urllib3andlangchain-coreto resolve security vulnerabilities.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.13.21] - 2025-12-29
Rasa Pro 3.13.21 (2025-12-29)
Bugfixes
- Include response button titles in conversation history in prompts of LLM based components.
- Fix OpenTelemetry exporter
Invalid type <class 'NoneType'> of value Noneerror when recording the request duration metric for requests made from Rasa server to the custom action server. This error occurred because the url parameter was not being passed to the method that records the request duration metric, resulting in a NoneType value. - Fix DUT fails with AttributeError when running with custom CommandGenerator
[3.13.20] - 2025-12-19
Rasa Pro 3.13.20 (2025-12-19)
Bugfixes
- Fixed token expiration validation failing on servers running in non-UTC timezones. Token expiration checks now use timezone-aware UTC datetimes consistently, preventing premature "access token expired" errors on systems in timezones like UTC+8.
[3.13.19] - 2025-12-11
Rasa Pro 3.13.19 (2025-12-11)
Bugfixes
- Fix bug in
CommandPayloadReaderwhere regex matching did not account for list slots, leading to incorrect parsing of slot keys and values. Now, slot names and values are correctly extracted even if a list is provided. - Previously,
DialogueStateTracker.has_coexistence_routing_slotcould incorrectly returnTruewhen the tracker was created without domain slots (i.e., usingAnySlotDict), becauseAnySlotDictpretends all slots exist. Now, the property returns False in that case, so the routing slot is only considered present if it is actually defined in the domain. - Fix LLM prompt template loading to raise an error instead of just printing a warning when a custom prompt file is missing or cannot be read.
- Fix
AttributeError: 'str' object has no attribute 'pop'when usingKnowledgeAnswerCommandwith tracing enabled. - Fix
UnboundLocalErrorinE2ETestRunner._handle_fail_diffthat caused e2e tests to crash when processingslot_was_not_setassertion failures. - Fixed button payloads with nested parentheses (e.g.,
/SetSlots(slot=value)) not being parsed correctly inrasa shell. The payload was incorrectly stripped of its/SetSlotsprefix, causing it to be treated as text instead of a slot-setting command. - Add missing deprecation warning for legacy
RASA_PRO_LICENSEenvironment variable. Update license validation error messages to reference the actual environment variable used.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.13.18] - 2025-12-04
Rasa Pro 3.13.18 (2025-12-04)
Bugfixes
- Update
pipto fix security vulnerability. - Disable LLM health check for Enterprise Search Policy when generative search is disabled (i.e. use_generative_llm is False).
- Fix deduplication of collect steps in cases where the same slot was called in different flows.
- Cancel active flow before triggering internal pattern error during a custom action failure.
- Fix bug with the missing
language_datamodule by installinglangcodeswith thedataextra dependency.
[3.13.17] - 2025-11-27
Rasa Pro 3.13.17 (2025-11-27)
Bugfixes
- Fixed PostgreSQL
UniqueViolationerror when running an assistant with multiple Sanic workers. - Fix Kafka producer creation failing when SASL mechanism is specified in lowercase. The SASL mechanism is now case-insensitive in the Kafka producer configuration.
- Fix issue where the validation of the assistant files continued even when the provided domain was invalid and was being loaded as empty. The training or validation command didn't exit because the final merged domain contained only the default implementations for patterns, slots and responses and therefore passed the check for being non-empty.
- Trigger pattern_internal_error in a CALM assistant when a custom action fails during execution.
- Create AWS Bedrock / Sagemaker client only if the LLM healthcheck environment variable is set. If the environment variable is not set, validate that required credentials are present.
- Update
langchain-coreversion to~0.3.80to address security vulnerability CVE-2025-65106. - Raise validation error when duplicate slot definitions are found across domains.
- Raise validation error when a slot with an initial value set is collected by a flow collect step
which sets
asks_before_fillingtotruewithout having a corresponding collect utterance or custom action.
[3.13.16] - 2025-11-21
Rasa Pro 3.13.16 (2025-11-21)
Bugfixes
- Fixed
patten-continue-interruptedrunning out of order before linked flows. - Fix
rasa studio uploadtimeouts by enabling TCP keep-alive with platform-specific socket options to maintain stable connections. - Remove
action_metadatatracing span attribute fromEnterpriseSearchPolicyinstrumentation to prevent PII leakages. Add new environment variableRASA_TRACING_DEBUGGING_ENABLEDto enable addingaction_metadatatoEnterpriseSearchPolicyspans for debugging purposes. By default, this variable is set tofalseto ensure PII is not logged in production environments.
[3.13.15] - 2025-11-13
Rasa Pro 3.13.15 (2025-11-13)
Miscellaneous internal changes
Miscellaneous internal changes.
[3.13.14] - 2025-10-30
Rasa Pro 3.13.14 (2025-10-30)
Improvements
-
Add new environment variable
LOG_LEVEL_PYMONGOto control the logging level of PyMongo dependency of Rasa. This can be useful to reduce the verbosity of logs. Default value isINFO.The logging level of PyMongo can also be set via the
LOG_LEVEL_LIBRARIESenvironment variable, which provides the default logging level for a selection of third-party libraries used by Rasa. If both variables are set,LOG_LEVEL_PYMONGOtakes precedence.
Bugfixes
-
Clean up duplicated
ChitChatAnswerCommandsin command processor.Ensure that one
CannotHandleCommandremains if only multipleCannotHandleCommandswere present. -
LLM request timeouts are now enforced at the event loop level using
asyncio.wait_for.Previously, timeout values configured in
endpoints.ymlcould be overridden by the HTTP client's internal timeout behavior. This fix ensures that when a specific timeout value is configured for LLM requests, the request respects that exact timing regardless of the underlying HTTP client implementation. -
Fixed an issue where duplicate collect steps in a flow could cause rendering problems, such as exceeding token limits. This occurred when a flow called another flow multiple times. Now, each collect step is listed only once when retrieving all collect steps for a flow.
-
If a FloatSlot does not have min and max values set in the domain, the slot will not be validated against any range. If the slot defines an initial value, as well as min and max values, the initial value will be validated against the range and an error will be raised if the initial value is out of range. Enhance run-time validation for new values assigned to FloatSlot instances, ensuring they fall within the defined min and max range if these are set. If min and max are not set, no range validation is performed.
-
Fixed bug preventing
deploymentparameter from being used in generative response LLM judge configuration. -
Fixed bug where
persisted_slotsdefined in called flows were incorrectly reset when the parent flow ended, unless they were also explicitly defined in the parent flow. Persisted slots now only need to be defined in the called flow to remain persisted after the parent flow ends. -
Fixes the prompt template resolution logic in the CompactLLMCommandGenerator and SearchReadyLLMCommandGenerator classes.
-
When
action_clean_stackis used in a user flow, allowpattern_completedto be triggered even if there are pattern flows at the bottom of the dialogue stack below the top user flow frame. Previously,pattern_completedwould only trigger if there were no other frames below the top user flow frame. This assumes that theaction_clean_stackis the last action called in the user flow. -
Update
pipversion used in Dockerfile to23.*to address security vulnerability CVE-2023-5752. Updatepython-socketioversion to5.14.0to address security vulnerability CVE-2025-61765.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.13.13] - 2025-10-13
Rasa Pro 3.13.13 (2025-10-13)
Bugfixes
- Use correct formatting method for messages in
completionandacompletionfunctions ofLiteLLMRouterLLMClient.
[3.13.12] - 2025-09-17
Rasa Pro 3.13.12 (2025-09-17)
Improvements
- Accept either
RASA_PRO_LICENSEorRASA_LICENSEas a valid Environment Variable for providing the Rasa License. Also deprecatesRASA_PRO_LICENSEEnvironment Variable.
Bugfixes
- Fixed conversation hanging when using direct action execution with invalid actions module by deferring module validation until action execution time, allowing proper exception handling in the processor.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.13.11] - 2025-09-15
Rasa Pro 3.13.11 (2025-09-15)
No significant changes.
[3.13.10] - 2025-09-12
Rasa Pro 3.13.10 (2025-09-12)
Bugfixes
- Fixes the silence handling bug in Audiocodes Stream Channel where consecutive bot responses could trip silence timeout pattern while the bot is speaking. Audiocodes Stream channel now forcefully cancels the silence timeout watcher whenever it sends the bot response audio.
- Update
langchainto0.3.27andlangchain-communityto0.3.29to fix CVE-2025-6984 vulnerability inlangchain-communityversion0.2.19.
[3.13.9] - 2025-09-03
Rasa Pro 3.13.9 (2025-09-03)
Bugfixes
- Upgrade
skopsto version0.13.0andrequeststo version2.32.5to fix vulnerabilities. - Fixed flow retrieval to skip vector store population when there are no flows to embed.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.13.8] - 2025-08-26
Rasa Pro 3.13.8 (2025-08-26)
Improvements
- Validation errors now raise meaningful exceptions instead of calling sys.exit(1), producing clearer and more actionable log messages while allowing custom error handling.
- Enable connection to AWS services for LLMs (e.g. Bedrock, Sagemaker) via multiple additional methods to environment variables, for example by using IAM roles or AWS credentials file.
Bugfixes
- The .devcontainer docker-compose file now uses the new
docker.io/bitnamilegacyrepository for images, rather than the olddocker.io/bitnami. This change was made in response to Bitnami's announcement that they will be putting all of their public Helm Chart container images behind a paywall starting August 28th, 2025. Existing public images are moved to the new legacy repository -bitnamilegacy- which is only intended for short-term migration purposes. - Fix expansion of referenced environment variables in
endpoints.ymlduring Bedrock model config validation. - Fixed model loading failures on Windows systems running recent Python versions (3.9.23+, 3.10.18+, 3.11.13+) due to tarfile security fix incompatibility with Windows long path prefix.
[3.13.7] - 2025-08-15
Rasa Pro 3.13.7 (2025-08-15)
Bugfixes
- Don't tigger a slot correction for slots that are currently set to
NoneasNonecounts as empty value. - Enabled the data argument to support both string and list inputs, normalizing to a list for consistent handling.
[3.13.6] - 2025-08-08
Rasa Pro 3.13.6 (2025-08-08)
Bugfixes
- Fixed the contextual response rephraser to use and update the correct translated response text for the current language, instead of falling back to the default response.
- Refactored
validate_argument_pathsto accept list values and aggregate all missing paths before exiting.
[3.13.5] - 2025-07-31
Rasa Pro 3.13.5 (2025-07-31)
Bugfixes
-
Fix correction of slots:
- Slots can only be corrected in case they belong to any flow on the stack and the slot to be corrected is part of a collect step in any of those flows.
- A correction of a slot should be applied if the flow that is about to start is using this slot.
-
Upgrade
axiosto fix security vulnerability. -
Fix issue where called flows could not set slots of their parent flow.
[3.13.4] - 2025-07-23
Rasa Pro 3.13.4 (2025-07-23)
Improvements
- Engine-related modules now raise structured exceptions instead of calling
sys.exit(1)orprint_error_and_exit, providing clearer, more actionable log messages and enabling custom error handling.
Bugfixes
- Fix validation of the FAISS documents folder to ensure it correctly discovers files in a recursive directory structure.
- Updated
Inspectordependent packages (vite, and@adobe/css-tools) to address security vulnerabilities. - Fixed bug preventing
model_groupfrom being used withembeddingsin generative response LLM judge configuration.
[3.13.3] - 2025-07-17
Rasa Pro 3.13.3 (2025-07-17)
Bugfixes
- Allowed NLG servers to return None for the text property and ensured custom response data is properly retained.
[3.13.2] - 2025-07-16
Rasa Pro 3.13.2 (2025-07-16)
Bugfixes
- Pass all flows to
find_updated_flowsto avoid creating aHandleCodeChangeCommandin situations where flows were not updated. - Bugfix for Jambonz Stream channel Websocket URL path which resulted in failed Websocket Connections
[3.13.1] - 2025-07-14
Rasa Pro 3.13.1 (2025-07-14)
Bugfixes
- Fix issues with bot not giving feedback for slot corrections.
- Fixed bot speaking state management in Audiocodes Stream channel. This made the assistant unable to handle user silences
Added periodic keepAlive messages to deepgram, this interval can be configured with
keep_alive_intervalparameter
[3.13.0] - 2025-07-07
Rasa Pro 3.13.0 (2025-07-07)
Deprecations and Removals
- Deprecate IntentlessPolicy and schedule for removal in Rasa
4.0.0. - Removed
monitor_silenceparameter from Voice Channel configuration. Silence Monitoring is now enabled by default. It can be configured by changing the value of Global Silence Timeout - Remove pre-CALM PII management capability originally released in Rasa Plus 3.6.0.
Remove
presidio,fakerandpycountrydependencies from Rasa Pro.
Features
-
Introducing the
SearchReadyLLMCommandGeneratorcomponent, an enhancement over theCompactLLMCommandGenerator. This new component improves the triggering accuracy ofKnowledgeAnswerCommandand should be used when theEnterpriseSearchPolicyis added to the pipeline. By default, this new component does not trigger theChitChatAnswerCommandandHumanHandoffCommand. Handling small talk and chit-chat conversations is now delegated to theEnterpriseSearchPolicy.To incorporate the
SearchReadyLLMCommandGeneratorinto your pipeline, simply add the following:pipeline:
...
- name: SearchReadyLLMCommandGenerator
... -
Implement Privacy Filter capability to detect PII in 3 supported events (SlotSet, BotUttered, and UserUttered) and anonymise PII from the event data.
The PII detection takes a tiered approach:
- the first tier represents a slot-based approach: the sensitive data is stored in a slot whose name is defined in the privacy YAML configuration.
- the second optional tier uses a default GliNer model to detect PII that is not captured by the slot-based approach.
The anonymisation of PII is done by redacting or replacing the sensitive data with a placeholder. These anonymisation rules are also defined in the privacy YAML configuration.
-
EnterpriseSearchPolicycan now assess the relevancy of the generated answer. By default, the policy does not check the relevancy of the generated answer. But you enable the relevancy check by settingcheck_relevancytotruein the policy configuration.policies:
- name: FlowPolicy
- name: EnterpriseSearchPolicy
...
check_relevancy: true # by default this is falseIf the relevancy check is enabled, the policy will evaluate the generated answer and determine if it is relevant to the user's query. In case the answer is relevant, the generated answer will be returned to the user. If the answer is not relevant, the policy will fallback to
pattern_cannot_handleto handle the situation.pattern_cannot_handle:
description: |
Conversation repair flow for addressing failed command generation scenarios
name: pattern cannot handle
steps:
- noop: true
next:
... # other cases
# Fallback to handle cases where the generated answer is not relevant
- if: "'{{context.reason}}' = 'cannot_handle_no_relevant_answer'"
then:
- action: utter_no_relevant_answer_found
next: "END" -
Implement privacy manager class which manages privacy-related tasks in the background.
This class handles the anonymization and deletion of sensitive information in dialogue state trackers stored in the tracker store, as well as the streaming of anonymized events to event brokers. It uses background schedulers to periodically run these tasks and processes trackers from a queue to ensure that sensitive information is handled in a timely manner.
-
Add support for
jambonz_streamvoice-stream channel. Log level ofwebsocketslibrary is set toERRORby default, it can be changed by the environment variableLOG_LEVEL_LIBRARIES. -
Remove the beta feature flag check from the
RepeatBotMessagesCommand. TheRASA_PRO_BETA_REPEAT_COMMANDenvironment variable is no longer needed as the feature is GA in 3.13.0.
Improvements
-
Coverage report feature can now be used independently of RASA_PRO_BETA_FINE_TUNING_RECIPE feature flag.
-
Update default Embedding model from
text-embedding-ada-002totext-embedding-3-large. UpdateLLMBasedRouter,IntentlessPolicyandContextualResponseRephraserdefault models to usegpt-4o-2024-11-20instead ofgpt-3.5-turbo. Update theEnterpriseSearchPolicyto usegpt-4.1-mini-2025-04-14instead ofgpt-3.5-turbo. -
Update
MultistepCommandGeneratorto usegpt-4o, specificallygpt-4o-2024-11-20, instead ofgpt-3.5-turboasgpt-3.5-turbowill be deprecated on July 16, 2025. Add deprecation warning forSingleStepCommandGenerator; leave current default model asgpt-4-0613. Adapt tests for CommandGenerators to usegpt-4oinstead ofgpt-3.5-turbodue to upcoming model deprecation. UpdateLLMJudgeModelandFine tuning Conversation Rephraserto usegpt-4.1-mini, specificallygpt-4.1-mini-2025-04-14, instead ofgpt-4o-mini, asgpt-4o-miniwill be deprecated on September 15, 2025. -
Make
CALMtemplate the default forrasa init. -
Redis lock store now accepts
hostproperty from endpoints config. Propertyurlis marked as deprecated for Redis lock store. -
Added support for basic authentication in Twilio channels (Voice Ready and Voice Streaming). This allows users to authenticate their Twilio channels using basic authentication credentials, enhancing security and access control for voice communication. To use this feature, set
usernameandpasswordin the Twilio channel configuration.credentials.yamltwilio_voice:
username: your_username
password: your_password
...
twilio_media_streams:
username: your_username
password: your_password
...At Twilio, configure the webhook URL to include the basic authentication credentials:
# twilio voice webhook
https://<username>:<password>@yourdomain.com/webhooks/twilio_voice/webhook
# twilio media streams webhook
https://<username>:<password>@yourdomain.com/webhooks/twilio_media_streams/webhook -
Added two endpoints to the model service for retrieving the assistant’s default configuration and the default project template used by the assistant.
-
All conversations on Twilio Media Streams, Audiocodes Stream, Genesys channel ends with the message
/session_end. This applies to both the conversation ended by user and the assistant. -
Refactor Voice Inspector to use AudioWorklet Web API
-
Added new CLI commands to support project-level linking and granular push/pull workflows for Rasa Studio assistants:
- Introduced
rasa studio linkto associate a local project with a specific Studio assistant. - Added
rasa studio pullandrasa studio push, with subcommands for granular resource updates (config,endpoints) between local and Studio assistants.
- Introduced
-
Implement
deletemethod forInMemoryTrackerStore,AuthRetryTrackerStore,AwaitableTrackerStoreandFailSafeTrackerStoresubclasses. -
Implement
deletemethod forMongoTrackerStore. -
Implement
deletemethod for SQLTrackerStore: this method accepts sender_id and deletes the corresponding tracker from the store if it exists. -
Implement
deletemethod for DynamoTrackerStore: this method accepts sender_id and deletes the corresponding tracker from the store if it exists. -
Implement
deletemethod forRedisTrackerStore. -
Update
KafkaEventBrokerYAML config to accept 2 new parameters:stream_pii: boolean (default: true). If set tofalse, the broker will not publish un-anonymised events to the configured topic.anonymization_topics: list of strings (default: []). If set, the broker will publish anonymised events to the configured topics when the PII management capability is enabled.
-
Add 2 new PII configuration parameters to
PikaEventBroker:stream_pii: Boolean flag to control whether or not to publish un-anonymised events to the configuredqueues. If set to False, un-anonymised events won't be published to RabbitMQ. Defaults toTruefor backwards compatibility.anonymization_queues: List of queue names that should receive anonymized events with PII removed. Defaults to an empty list ([]).
-
Add a new
anonymized_attimestamp field to the Rasa Pro events supported by the PII management capability:userslotbotThis field indicates when the PII data in the event was anonymized. The field is set tonullif the PII data has not been anonymized.
-
Add support for reading
privacyconfiguration key from endpoints file to enable PII management capability. -
Add new
DELETE /conversations/<conversation_id>/trackerendpoint that allows deletion of tracker data for a specific conversation. -
Cleaned up potential sources of PII from
info,exceptionanderrorlogs. -
Allow default patterns to link to
pattern_chitchat. -
Cleaned up potential sources of PII from
warninglogs. -
Add a warning log to alert users when exporting tracker data that contains unanonymized events.
-
Remove beta feature flag for pypred predicate usage in conditional response variations. Mark this functionality for general availability (GA).
-
Updated the default behavior of
pattern_chitchat. With the deprecation ofIntentlessPolicy,pattern_chitchatnow defaults to responding withutter_cannot_handleinstead of triggeringaction_trigger_chitchat. -
PII deletion job now performs a single database transaction in the case of trackers with multiple sessions, where only some sessions are eligible for deletion. The deletion job overwrites the serialized tracker record with the retained events only. This ensures that the tracker store is updated atomically, preventing any potential tracker data loss in case of Rasa Pro server crashes or other issues during the deletion job execution.
Bugfixes
-
Fixes a bug where fine-tuning data generation raises a FineTuningDataPreparationException for test cases without assertions that end with one/multiple user utterance/s, as opposed to one/multiple bot utterance/s.
For these types of test cases, the fine-tuning data generation transcript now contains all test case utterances up to but excluding the last user utterance(s) as the test case does not specify the corresponding, expected bot response(s).
-
allowed for usage of litellm model prefixes that do not end in '<provider>/'
-
Fixes a bug in Inspector that raised a TypeError when serialising
numpy.float64from Tracker -
- Fixes an issue with prompt rendering where minified JSON structures were displayed without properly escaping newlines, tabs, and quotes.
- Introduced a new Jinja
filter to_json_encoded_stringthat escapes newlines (\n), tabs (\t), and quotes (\") for safe JSON rendering.to_json_encoded_stringfilter preserves other special characters (e.g., umlauts) without encoding them. - Updated the default prompts for
gpt-4oandclaude-sonnet-3.5
-
Fix intermittent crashes on Inspector app when Enterprise Search or Chitchat Policies were triggered
-
Add channel name to UserMessage created by the Audiocodes channel.
-
Reduced redundant log entries when reading prompt templates by contextualizing them. Added source component and method metadata to logs, and changed prompt-loading logs triggered from
fingerprint_addonto useDEBUGlevel. -
Prompts for rephrased messages and conversations are now rendered using agent, eliminating errors that occurred when string replacements broke after prompt updates.
-
Fix retrieval of latest tracker session from DynamoTrackerStore.
-
Files generated by the finetuning data generation pipeline are now encoded in UTF-8, allowing characters such as German umlauts (ä, ö, ü) to render correctly.
-
Fix an issue where the SetSlot and Clarify command value was parsed incorrectly if a newline character immediately followed the value argument in the LLM output.
-
Fixed the repeat action to include all messages of the last turn in collect steps.
-
- Fix an issue where running
rasa inspectwould always set theroute_session_to_calmslot toTrue, even when no user-triggered commands were present. This caused incorrect routing to CALM, bypassing the logic of the router. - Fix a regression in non-sticky routing where sessions intended for the NLU were
incorrectly routed to CALM when the router predicted
NoopCommand().
- Fix an issue where running
-
Fix validation and improve error messages for the documents source directory when FAISS vector store is configured for the Enterprise Search Policy.
-
Prevent slot correction when the slot is already set to the desired value.
-
Fallback to
CannotHandlecommand when the slot predicted by the LLM is not defined in the domain. -
Fix tracker store PII background jobs not updating the
InMemoryTrackerStorereference stored by the Agent. -
Fix potential
KeyErrorinEnterpriseSearchPolicycitation post-processing when the source does not have the correct citation. Improve the citation post-processing logic to handle additional edge cases. -
Fix issue with PrivacyManager unable to retrieve trackers from Redis tracker store during its deletion background job, because the Redis tracker store prefix was added twice during retrieval.
-
Fixed anonymization failing for
FloatSlotswhen user-provided integer values don't match the stored float representation during text replacement. -
Fix Redis tracker store saving tracker with prefix added twice during the anonymization background job.
-
Fix DynamoDB tracker store overwriting tracker with the latest session in case of multiple sessions saved prior.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.12.42] - 2025-12-11
Rasa Pro 3.12.42 (2025-12-11)
Bugfixes
- Fix bug in
CommandPayloadReaderwhere regex matching did not account for list slots, leading to incorrect parsing of slot keys and values. Now, slot names and values are correctly extracted even if a list is provided. - Previously,
DialogueStateTracker.has_coexistence_routing_slotcould incorrectly returnTruewhen the tracker was created without domain slots (i.e., usingAnySlotDict), becauseAnySlotDictpretends all slots exist. Now, the property returns False in that case, so the routing slot is only considered present if it is actually defined in the domain. - Fix LLM prompt template loading to raise an error instead of just printing a warning when a custom prompt file is missing or cannot be read.
- Fix
AttributeError: 'str' object has no attribute 'pop'when usingKnowledgeAnswerCommandwith tracing enabled. - Fix
UnboundLocalErrorinE2ETestRunner._handle_fail_diffthat caused e2e tests to crash when processingslot_was_not_setassertion failures. - Fixed button payloads with nested parentheses (e.g.,
/SetSlots(slot=value)) not being parsed correctly inrasa shell. The payload was incorrectly stripped of its/SetSlotsprefix, causing it to be treated as text instead of a slot-setting command.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.12.41] - 2025-12-04
Rasa Pro 3.12.41 (2025-12-04)
Bugfixes
- Update
pipto fix security vulnerability. - Disable LLM health check for Enterprise Search Policy when generative search is disabled (i.e. use_generative_llm is False).
- Fix deduplication of collect steps in cases where the same slot was called in different flows.
- Cancel active flow before triggering internal pattern error during a custom action failure.
- Fix bug with the missing
language_datamodule by installinglangcodeswith thedataextra dependency.
[3.12.40] - 2025-11-27
Rasa Pro 3.12.40 (2025-11-27)
Bugfixes
- Fixed PostgreSQL
UniqueViolationerror when running an assistant with multiple Sanic workers. - Fix issue where the validation of the assistant files continued even when the provided domain was invalid and was being loaded as empty. The training or validation command didn't exit because the final merged domain contained only the default implementations for patterns, slots and responses and therefore passed the check for being non-empty.
- Trigger pattern_internal_error in a CALM assistant when a custom action fails during execution.
- Update
langchain-coreversion to~0.3.80to address security vulnerability CVE-2025-65106. - Raise validation error when duplicate slot definitions are found across domains.
- Raise validation error when a slot with an initial value set is collected by a flow collect step
which sets
asks_before_fillingtotruewithout having a corresponding collect utterance or custom action.
[3.12.39] - 2025-11-21
Rasa Pro 3.12.39 (2025-11-21)
Bugfixes
- Fixed
patten-continue-interruptedrunning out of order before linked flows. - Remove
action_metadatatracing span attribute fromEnterpriseSearchPolicyinstrumentation to prevent PII leakages. Add new environment variableRASA_TRACING_DEBUGGING_ENABLEDto enable addingaction_metadatatoEnterpriseSearchPolicyspans for debugging purposes. By default, this variable is set tofalseto ensure PII is not logged in production environments. - Fix Kafka producer creation failing when SASL mechanism is specified in lowercase. The SASL mechanism is now case-insensitive in the Kafka producer configuration.
[3.12.38] - 2025-11-13
Rasa Pro 3.12.38 (2025-11-13)
Miscellaneous internal changes
Miscellaneous internal changes.
[3.12.37] - 2025-10-30
Rasa Pro 3.12.37 (2025-10-30)
Bugfixes
-
Clean up duplicated
ChitChatAnswerCommandsin command processor.Ensure that one
CannotHandleCommandremains if only multipleCannotHandleCommandswere present. -
LLM request timeouts are now enforced at the event loop level using
asyncio.wait_for.Previously, timeout values configured in
endpoints.ymlcould be overridden by the HTTP client's internal timeout behavior. This fix ensures that when a specific timeout value is configured for LLM requests, the request respects that exact timing regardless of the underlying HTTP client implementation. -
Fixed an issue where duplicate collect steps in a flow could cause rendering problems, such as exceeding token limits. This occurred when a flow called another flow multiple times. Now, each collect step is listed only once when retrieving all collect steps for a flow.
-
Fixes the prompt template resolution logic in the CompactLLMCommandGenerator.
-
When
action_clean_stackis used in a user flow, allowpattern_completedto be triggered even if there are pattern flows at the bottom of the dialogue stack below the top user flow frame. Previously,pattern_completedwould only trigger if there were no other frames below the top user flow frame. This assumes that theaction_clean_stackis the last action called in the user flow. -
Update
pipversion used in Dockerfile to23.*to address security vulnerability CVE-2023-5752.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.12.36] - 2025-10-27
Rasa Pro 3.12.36 (2025-10-27)
Miscellaneous internal changes
Miscellaneous internal changes.
[3.12.35] - 2025-10-21
Rasa Pro 3.12.35 (2025-10-21)
Improvements
-
Add new environment variable
LOG_LEVEL_PYMONGOto control the logging level of PyMongo dependency of Rasa. This can be useful to reduce the verbosity of logs. Default value isINFO.The logging level of PyMongo can also be set via the
LOG_LEVEL_LIBRARIESenvironment variable, which provides the default logging level for a selection of third-party libraries used by Rasa. If both variables are set,LOG_LEVEL_PYMONGOtakes precedence.
Bugfixes
- If a FloatSlot does not have min and max values set in the domain, the slot will not be validated against any range. If the slot defines an initial value, as well as min and max values, the initial value will be validated against the range and an error will be raised if the initial value is out of range. Enhance run-time validation for new values assigned to FloatSlot instances, ensuring they fall within the defined min and max range if these are set. If min and max are not set, no range validation is performed.
- Fixed bug preventing
deploymentparameter from being used in generative response LLM judge configuration. - Fixed bug where
persisted_slotsdefined in called flows were incorrectly reset when the parent flow ended, unless they were also explicitly defined in the parent flow. Persisted slots now only need to be defined in the called flow to remain persisted after the parent flow ends.
[3.12.34] - 2025-10-13
Rasa Pro 3.12.34 (2025-10-13)
Bugfixes
- Fixed conversation hanging when using direct action execution with invalid actions module by deferring module validation until action execution time, allowing proper exception handling in the processor.
- Use correct formatting method for messages in
completionandacompletionfunctions ofLiteLLMRouterLLMClient.
[3.12.33] - 2025-09-12
Rasa Pro 3.12.33 (2025-09-12)
Bugfixes
- Fixes the silence handling bug in Audiocodes Stream Channel where consecutive bot responses could trip silence timeout pattern while the bot is speaking. Audiocodes Stream channel now forcefully cancels the silence timeout watcher whenever it sends the bot response audio.
- Fixed flow retrieval to skip vector store population when there are no flows to embed.
[3.12.32] - 2025-09-03
Rasa Pro 3.12.32 (2025-09-03)
Bugfixes
- Upgrade
skopsto version0.13.0andrequeststo version2.32.5to fix vulnerabilities.
Miscellaneous internal changes
Miscellaneous internal changes.
[3.12.31] - 2025-08-26
Rasa Pro 3.12.31 (2025-08-26)
Bugfixes
- The .devcontainer docker-compose file now uses the new
docker.io/bitnamilegacyrepository for images, rather than the olddocker.io/bitnami. This change was made in response to Bitnami's announcement that they will be putting all of their public Helm Chart container images behind a paywall starting August 28th, 2025. Existing public images are moved to the new legacy repository -bitnamilegacy- which is only intended for short-term migration purposes. - Fixed model loading failures on Windows systems running recent Python versions (3.9.23+, 3.10.18+, 3.11.13+) due to tarfile security fix incompatibility with Windows long path prefix.
[3.12.30] - 2025-08-19
Rasa Pro 3.12.30 (2025-08-19)
Bugfixes
- Don't tigger a slot correction for slots that are currently set to
NoneasNonecounts as empty value.
[3.12.29] - 2025-07-31
Rasa Pro 3.12.29 (2025-07-31)
Bugfixes
-
Fix correction of slots:
- Slots can only be corrected in case they belong to any flow on the stack and the slot to be corrected is part of a collect step in any of those flows.
- A correction of a slot should be applied if the flow that is about to start is using this slot.
[3.12.28] - 2025-07-29
Rasa Pro 3.12.28 (2025-07-29)
Bugfixes
- Upgrade
axiosto fix security vulnerability. - Fix issue where called flows could not set slots of their parent flow.
[3.12.27] - 2025-07-23
Rasa Pro 3.12.27 (2025-07-23)
Bugfixes
- Fix validation of the FAISS documents folder to ensure it correctly discovers files in a recursive directory structure.
- Updated
Inspectordependent packages (vite, and@adobe/css-tools) to address security vulnerabilities. - Fixed bug preventing
model_groupfrom being used withembeddingsin generative response LLM judge configuration.
[3.12.26] - 2025-07-17
Rasa Pro 3.12.26 (2025-07-17)
Bugfixes
- Allowed NLG servers to return None for the text property and ensured custom response data is properly retained.
[3.12.25] - 2025-07-16
Rasa Pro 3.12.25 (2025-07-16)